FAKERADAR

UPLINK OK // SYNC 7M AGO

H1 HackerOne LIVE

MetaMask

domain mobile other

pays bountiesTABLE ↗ Open on HackerOne ↗

listed: before tracking
tracked since: 2026-09-20
website: https://metamask.io/
managed triage: yes
response efficiency: 73%
first response: 18h avg
time to bounty: 131h avg

13 targets in scope

asset	type	bounty	max sev	seen
`api-wallet.web3auth.io`	domain	yes	critical	2026-09-20
`metamask.io`	domain	yes	critical	2026-09-20
`signature-insights.api.cx.metamask.io`	domain	yes	critical	2026-09-20
`snaps.metamask.io`	domain	yes	critical	2026-09-20
`wallet.web3auth.io`	domain	yes	critical	2026-09-20
`io.metamask`	mobile	yes	critical	2026-09-20
`io.metamask.Metamask`	mobile	yes	critical	2026-09-20
`MetaMask Browser Extension`	other	yes	critical	2026-09-20
`MetaMask SDK`	other	yes	critical	2026-09-20
`Snaps`	other	yes	critical	2026-09-20
`Third Party Snaps`	other	no	none	2026-09-20
`https://metamask.github.io/phishing-warning/<vX.Y.Z>`	other	yes	critical	2026-09-20
`mUSD Stablecoin`	other	yes	critical	2026-09-20

22 out of scope — black ICE, don't touch

api-dashboard.web3auth.io domain
card.metamask.io domain
community.metamask.io domain
dashboard.web3auth.io domain
developer.metamask.io domain
https://mmi-support.metamask.io/ domain
https://support.metamask.io/ domain
https://user-storage.api.cx.metamask.io domain
permissionless.snaps.metamask.io domain
portfolio.metamask.io (app.metamask.io) domain
travel.metamask.io domain
Core Tier Assets other
Message signing snap other
Metamask Flask Extension other
Non-Core Tier Assets other
Wallet Tier Assets other
https://metamask.github.io/ other
https://www.npmjs.com/search?q=%40metamask other
Snaps Development Packages source code
https://github.com/Web3Auth/web3auth-web source code
*.api.cx.metamask.io wildcard
https://*.metamask.io wildcard

Change log

No changes since we started tracking on 2026-09-20.