Bug bounty (draft)
Draft terms. Amounts and the payout process are set by the project before testnet opens.
Report privately as described in SECURITY.md. The scope and threat model are in AUDIT_SCOPE.md.
| Severity | Examples | Reward (to be set) |
|---|---|---|
| Critical | A consensus split between the Rust and Python nodes; accepting an invalid block, transaction or AuxPoW; minting or stealing coins or assets; bypassing freeze or clawback rules; a reorg below a final checkpoint; remote code execution | highest tier |
| High | A remote crash or persistent DoS of nodes with little traffic; a forged snapshot passing H + delay; key exposure in wallet tooling; a mempool pinning that defeats RBF and packages | high tier |
| Medium | A sustained eclipse vector despite eviction and anchors; DoS needing moderate resources; information leaks from services | medium tier |
| Low | Hardening gaps, misleading API behaviour, documentation errors with security impact | low tier |
Rules
- Test only on regtest, your own devnet or the public testnet. Never attack mainnet or other people's nodes.
- Report the first instance; duplicates go to the earliest report.
- Give us reasonable time to fix before disclosure (see SECURITY.md).
- No social engineering, physical attacks or third-party services.
- A report with a reproducible proof of concept (a failing test or vector is ideal) is rewarded faster.