*Markdown view of . The page is the record; this is the same page for reading.* Scope # What the bounty covers, and what each tier means. The rules are at . This page is the desk's reading of them, so a ticket's tier can be checked against the words it was assessed under. [Report a bug](https://bounty.xe.network/report)Private by default; Critical and Severe always. You get an id at once. ## Tiers | Tier | Ceiling | Means | | --- | --- | --- | | Critical | 50,000 XE | Catastrophic protocol breaks. Unauthorized mint, double-spend, escrow theft, key recovery, consensus that finalizes conflicting histories, or lattice compromise. | | Severe | 25,000 XE | Serious breaks short of catastrophe. Signature forgery, validation bypass, node compromise, finality that stalls network-wide under load; exploitable and damaging at scale. | | High | 10,000 XE | Targeted DoS, race conditions, replay attacks, privilege escalation, sustained degradation a single client can cause. | | Medium | 2,500 XE | Validation gaps, accounting mismatches, non-sensitive disclosure, inconsistent API responses, measurable slowdowns under volume. | | Minor | 650 XE | UI bugs, typos, broken explorer views, misleading log messages, documentation errors. | ## Terms - Severity, eligibility and reward are at the discretion of the XE core team. - Duplicate reports go to the first verifiable submission. - Payouts are in native XE at mainnet genesis from the 2%-of-supply allocation, contingent on launch. - Amounts are targeted ceilings and provisional until the pool is finalized. - XE team members and direct contractors are not eligible. ## Areas - [Consensus](https://bounty.xe.network/?area=consensus) - [P2P / sync](https://bounty.xe.network/?area=p2p-sync) - [Node / API](https://bounty.xe.network/?area=node-api) - [Leasing / ledger](https://bounty.xe.network/?area=leasing-ledger) - [DAO harness](https://bounty.xe.network/?area=dao-harness) - [SDK / docs / web](https://bounty.xe.network/?area=sdk-docs-web) - [Ops / testnet](https://bounty.xe.network/?area=ops-testnet) - [Other](https://bounty.xe.network/?area=other) ## How a report moves `new → triaging → (needs-info ⇄) → accepted → fixing → patched → disclosed → awarded → paid`, or `closed` as duplicate, invalid, out of scope or withdrawn. Every move is in the [log](https://bounty.xe.network/log); every ticket says which internal ticket tracks its fix and which PR closed it. **Before, decide, later.** The gate on a bounty ticket says whether its fix lands before mainnet, is a product decision still to be made, or can follow launch. The [before](https://bounty.xe.network/?gate=before) list is the release view. **Private reports.** This report is private. Its body and attachments are sealed; only named readers can open them, and every opening is in the log. **Channels.** Never post a proof of concept into Discord or Telegram. Use the private filing form; the thread is for the conversation, not the exploit. **This desk.** This desk is in scope for the bounty from the day it went public. If you find something in it, file it like anything else.