What the bounty covers, and what each tier means.
The rules are at https://test.network/bounty. This page is the desk's reading of them, so a ticket's tier can be checked against the words it was assessed under.
Report a bugPrivate by default; Critical and Severe always. You get an id at once.
Tiers
| Tier | Ceiling | Means |
|---|---|---|
| Critical | 50,000 XE | Catastrophic protocol breaks. Unauthorized mint, double-spend, escrow theft, key recovery, consensus that finalizes conflicting histories, or lattice compromise. |
| Severe | 25,000 XE | Serious breaks short of catastrophe. Signature forgery, validation bypass, node compromise, finality that stalls network-wide under load; exploitable and damaging at scale. |
| High | 10,000 XE | Targeted DoS, race conditions, replay attacks, privilege escalation, sustained degradation a single client can cause. |
| Medium | 2,500 XE | Validation gaps, accounting mismatches, non-sensitive disclosure, inconsistent API responses, measurable slowdowns under volume. |
| Minor | 650 XE | UI bugs, typos, broken explorer views, misleading log messages, documentation errors. |
Terms
- Severity, eligibility and reward are at the discretion of the XE core team.
- Duplicate reports go to the first verifiable submission.
- Payouts are in native XE at mainnet genesis from the 2%-of-supply allocation, contingent on launch.
- Amounts are targeted ceilings and provisional until the pool is finalized.
- XE team members and direct contractors are not eligible.
Areas
How a report moves
new → triaging → (needs-info ⇄) → accepted → fixing → patched → disclosed → awarded → paid, or closed as duplicate, invalid, out of scope or withdrawn. Every move is in the log; every ticket says which internal ticket tracks its fix and which PR closed it.
Before, decide, later. The gate on a bounty ticket says whether its fix lands before mainnet, is a product decision still to be made, or can follow launch. The before list is the release view.
Private reports. This report is private. Its body and attachments are sealed; only named readers can open them, and every opening is in the log.
Channels. Never post a proof of concept into Discord or Telegram. Use the private filing form; the thread is for the conversation, not the exploit.
This desk. This desk is in scope for the bounty from the day it went public. If you find something in it, file it like anything else.