Right now, anyone who finds a vulnerability in Tari has no formal channel to report it through — it’s either a GitHub issue, a DM to a maintainer, or nothing. I think it’s time we fix that with a real bug bounty program, and I want to open discussion on it here.
Why this matters now, not later
- There’s real value at stake. This is an L1 with a live mining economy, wallets holding real balances, and a growing template/smart-contract layer (Ootle) that third-party dApps build on. Every one of those is an incentive for someone to look for a bug — the question is just whether we’ve made it worth their while to tell us first.
- The attack surface is genuinely large and still moving. Consensus, wallet key handling, the confidential/stealth resource types, cross-chain and bridge-adjacent code, third-party templates interacting with our engine — this isn’t a small, frozen codebase. New surface area keeps shipping, which means new bug classes keep shipping with it.
- No formal channel actively selects for the wrong outcome. A researcher who finds something serious and has no clear, credible reporting path faces a real choice: report informally and hope someone with commit access notices, sell it, or just use it. A structured program with real payouts and an SLA changes that calculus — it’s the cheapest insurance we can buy against the alternative.
- It’s the industry baseline, not a nice-to-have. Every L1/L2 and serious DeFi protocol our users and integrators compare us against runs one. Not having one is itself a signal — to exchanges considering listing, to dApp teams considering building on Ootle, to users deciding how much to trust the wallet.
- It forces a triage process we should have anyway. Standing up a bounty means defining scope, severity tiers, an SLA, and a disclosure policy — process we arguably need internally regardless of whether a single external report ever comes in through it.