IOTA bug bounty on Sherlock

The IOTA bug bounty on Sherlock pays researchers for bugs in the core software of the IOTA network. IOTA describes the network as a Move based layer 1 with an object based execution model and a validator set that uses Starfish consensus. The maximum reward is 25,000 USDC. The program has been live since 14 October 2026 at 1:04 p.m., and the page shows the same time as the last update. There is no end date.

Only Critical and High findings are paid, in USDC. Critical rewards run from 15,000 to 25,000 USDC. High rewards run from 5,000 to 15,000 USDC. One underlying bug receives one reward, based on its highest eligible impact. A coded proof of concept, with instructions to run it, is required. The reward inside each range depends on the impact shown, how much of the network is affected, the conditions needed to exploit it, and what recovery would take.

The scope covers consensus and networking, transaction validation and cryptography, Move execution, core system packages for assets and staking, and ledger state. IOTA EVM, bridges, wallets, explorers, websites and third party applications are out of scope. Reports go through the Report a bug link on the Sherlock page. Keep the details private until the team has verified the bug, deployed a fix and allowed disclosure. Testing must stay on an isolated local network, a simulation or a local fork.

Quick answers

Which severities are paid?

Only Critical and High. Critical pays 15,000 to 25,000 USDC. High pays 5,000 to 15,000 USDC. Medium, low and informational findings are not paid.

Is a proof of concept required?

Yes. A coded proof of concept with instructions to run it is required.

Where should testing happen?

On an isolated local network, a simulation or a local fork. Testing against public mainnet, public testnet or public RPC endpoints is prohibited.