Bug Bounty Program
The Tari Bug Bounty Program is designed for a community-centric problem-solving approach for the Tari ecosystem.
At Tari, security is fundamental to our mission. We highly value the contributions of ethical hackers who help us uphold the highest standards of security across the Tari ecosystem. While Tari has undergone rigorous professional audits and formal verification, it operates on evolving technology that may still contain undiscovered vulnerabilities.
We encourage the community to actively audit our smart contracts and infrastructure and responsibly disclose any security concerns. This program is designed to incentivize responsible security research, outlining the expectations for ethical vulnerability disclosure and the rewards available for eligible findings.
Rewards
Tari offers substantial rewards for vulnerabilities that could lead to the loss or freezing of assets or otherwise cause harm to users. The reward amount is determined based on the severity and exploitability of the vulnerability. Eligible discoveries may receive rewards ranging from $X to $X, in accordance with the terms outlined below.
Scope
Primary Scope:
The primary focus of the bug bounty program is vulnerabilities impacting the on-chain Tari Protocol, deployed on Ethereum Mainnet, specifically for the contract addresses listed in this developer documentation. This scope is subject to change as new contracts are deployed or existing contracts are deprecated.
Out-of-scope items include:
* Vulnerabilities in third-party contracts built on top of Tari (e.g., smart contract wallets).
* Issues that require admin key ownership.
Secondary Scope:
The program also includes vulnerabilities affecting the Tari Interface hosted at tari.com, particularly those that could lead to unauthorized account access or asset manipulation.
Out of Scope:
* Vulnerabilities affecting test environments (Rinkeby, other testnets, and staging servers), unless they also impact the Tari Protocol or Interface in a way that could put user funds at risk.
Disclosure Process
All vulnerability disclosures should be submitted to <info@tari.com> with detailed steps for reproducing the issue. Reports may be submitted in written or video format to ensure clarity. Tari will acknowledge all valid submissions promptly.
**Eligibility** Requirements
To qualify for a bounty reward, you must:
* Identify a previously unreported, original, and non-public vulnerability within the defined scope.
* Provide a detailed disclosure that enables Tari engineers to reproduce and resolve the issue efficiently.
* Be at least 18 years old.
* Submit your report individually or with documented company approval (if submitting on behalf of an organization).
* Not be subject to U.S. sanctions or reside in a U.S.-embargoed country.
* Not be a current or former Tari employee, vendor, contractor, or affiliate of a vendor or contractor.
Rules of Engagement
To encourage ethical security research and distinguish good-faith efforts from malicious activity, researchers must:
* Follow program terms and any other applicable agreements. If conflicts arise, the bug bounty program terms take precedence.
* Report vulnerabilities promptly.
* Avoid causing harm, including privacy violations, service disruptions, or data loss.
* Use only <info@tari.com> for all communications regarding vulnerabilities.
* Maintain confidentiality regarding discovered vulnerabilities until they are patched.
* Limit testing to in-scope systems and avoid interacting with accounts not explicitly authorized for testing.
* Refrain from extortion, blackmail, or any unlawful activities.
What You Can Expect from Tari
When engaging with Tari under this program, we commit to:
* Offering competitive rewards for eligible findings, with payouts determined based on severity and exploitability at Tari’s discretion.
* Providing Safe Harbour for researchers who comply with program guidelines, ensuring Tari will not pursue legal action against those acting in good faith.
* Validating and acknowledging reports promptly, including an initial response and further investigation.
* Addressing vulnerabilities on time.
* Recognizing your contributions if you are the first to report a valid vulnerability that results in a code or configuration change.
All decisions regarding eligibility, reward amounts, and payout determinations are made at Tari’s sole discretion. Tari reserves the right to reject submissions and modify the terms of this program at any time.