Crypto currency exchange Regulated  by VARA 

OFZA is a VARA regulated cryptocurrency trading platform based in the UAE, designed to provide secure, seamless, and innovative crypto trading experiences for users across the UAE. With a focus on accessibility, security, and user-centric features, OFZA aims to bridge the gap between traditional finance and the world of digital assets.

Execute arbitrary system commands

Retrieve sensitive data/files from a running server, such as:
- /etc/shadow
- database passwords
- blockchain keys (this does not include non-sensitive environment variables, open source code, or usernames)

Taking down the application/website

Subdomain takeover with already-connected wallet interaction

Injection of malicious HTML or XSS through metadata

Changing sensitive details of other users (including modifying browser local storage) without already-connected wallet interaction and with up to one click of user interaction, such as:
- Email
- Password of the victim etc.

Subdomain takeover without already-connected wallet interaction

Changing non-sensitive details of other users (including modifying browser local storage) without already-connected wallet interaction and with up to one click of user interaction, such as:
- Changing the first/last name of user
- Enabling/disabling notifications

__Rewards by Threat Level__

For critical web/apps bug reports will be rewarded with USD $10,000 only if the impact leads to:

- A loss of funds involving an attack that does not require any user action
- Private key or private key generation leakage leading to unauthorized access to user funds 

All other impacts that would be classified as Critical would be rewarded a flat amount of **USD $3,000**. The rest of the severity levels are paid out according to the Impact in Scope table.

__Reward Payment Terms__

Payouts are handled by the **OFZA** team directly and are denominated in **USD**. However, payments are done in **USDT** on **Tron**.

The calculation of the net amount rewarded is based on the average price between CoinMarketCap.com and CoinGecko.com at the time the bug report was submitted. No adjustments are made based on liquidity availability.