There's a bounty on the 0x smart contracts, but not on this sample exchange codebase https://blog.0xproject.com/the-0x-v2-bug-bounty-f8981f322dd7

The real bug bounty is for someone to exercise a flaw and steal from others :/.

A dapp of any sufficient complexity will have bugs, some of which can probably be exercised to steal funds.