Underground Bug Bounty Platform - Private Disclosure Marketplace
1. The Problem
Whitehat platforms (HackerOne, Bugcrowd) are increasingly hostile to independent researchers - low bounties, slow payouts, bans for vague TOS violations. Meanwhile gray and black vulnerability markets are fragmented across private Telegram groups, invite-only forums, and one-off broker relationships.
There is no standardized platform for anonymous exploit sales with escrow, quality vetting, and negotiated disclosure terms. This proposal outlines exactly such a platform.
2. Architecture
- Marketplace: List vulns with metadata (CVE, CVSS, affected software, impact type)
- Escrow: Multisig crypto escrow. Buyer deposits, researcher delivers PoC, funds released on verification.
- Dispute Resolution: Third-party arbitrator from trusted community reviews evidence.
- Reputation: Verified transaction history, no-knock ratings (raters never see researcher identity).
- Messaging: E2E encrypted, auto-expiry, screenshot prevention.
3. User Flows
Registration: Generate GPG key pair, submit via Tor form, pay 0.05 XMR fee (reduced if vouched), receive encrypted welcome message.
Listing: Fill vuln details, upload encrypted PoC, set XMR price, choose Public/Auction/Direct listing, set disclosure terms.
Purchase: Buyer deposits to multisig escrow, platform releases encrypted PoC, buyer verifies within 72h, funds release or dispute. No action = auto-release to researcher. Platform fee: 5-10%.
4. Security Architecture
- No logs of buyer-researcher communications beyond 30 days
- Zero-knowledge - operators cannot decrypt listings
- PGP-signed announcements prevent phishing
- Auto-delete inactive accounts after 90 days
- No KYC, no email verification, no IP logging
5. Pricing Model
- Standard listing: 8% of sale. Auction: 5%. Direct: 10%.
- Registration: 0.05 XMR (refundable after 3 sales)
- Dispute arbitration: 2% from losing party
| Type | No PoC | With PoC | With Exploit |
|---|---|---|---|
| XSS | $500-2k | $1k-5k | $2k-10k |
| SQLi | $1k-5k | $3k-15k | $5k-30k |
| RCE | $10k-50k | $25k-100k | $50k-250k+ |
| Priv Esc | $5k-20k | $10k-50k | $20k-100k |
| Auth Bypass | $3k-15k | $5k-30k | $10k-50k |
| SSRF | $2k-10k | $5k-25k | $10k-40k |
6. Operational Risks
- LE infiltration: Design as if operators get arrested tomorrow. Zero-knowledge limits damage.
- Exit scam: Multisig with time-locked refunds prevents fund theft.
- DDoS: Tor .onion reduces surface. Cloudflare for clearnet mirror.
- Doxxing: Zero logs, no IPs, no metadata collection.
- Backdoors: Open-source core code for community auditing.
The vulnerability market is worth billions. Right now researchers see pennies on the dollar. A properly designed platform changes that.