Tari Ootle Security Bug Hunt
The Tari Council pays up to 1,000,000 XTM for security bugs in the pinned Ootle commit. The hunt ends at 00:00 UTC on 1 November 2026.
The Ootle Security Bug Hunt is a separate contest from the October build contest. The Tari Council posted it on 1 October 2026. Researchers look for security bugs in the tari-project/tari-ootle repository at one pinned commit. Valid reports earn points, and the top three scores get placement prizes: 1,000,000 XTM for first, 500,000 XTM for second, and 250,000 XTM for third. Ties split the prize. Every valid report also qualifies for the standing bounty payout, paid in XTM to the address in the report. The page does not list that standing payout in a dollar amount.
The hunt starts on 1 October 2026 and ends at 00:00 UTC on 1 November 2026. Only bugs present at the pinned commit count. The in scope areas are grouped into three tiers, from consensus and execution crates, through the validator node and networking, to the wallet and SDK. Some crates, the Minotari base layer, and third party dependencies are out of scope unless an Ootle bug is what makes the dependency exploitable. The standing disclosure policy still applies where this contest doc does not replace it.
Send each finding as a GitHub private security advisory on tari-ootle, with a title that starts with the words the post specifies. If you cannot use GitHub, email security@tari.com with the same subject prefix. Other channels are not accepted, and late reports are not accepted. The report needs the affected code, a short explanation, the attacker's position in the trust model, a proof of concept, a claimed severity, and a payout address.
People barred by sanctions cannot take part. Core contributors are not eligible for a finding in code they wrote or reviewed. Testing is limited to infrastructure you run yourself. The council says final points and prizes are compiled after the contest closes, and before 1 December.