Security rewards

Break it on the testnet, not at launch

Report vulnerabilities in Sequentia Core (the node and its desktop wallet), the explorer, the faucet, Compages, this site, or the servers behind them. Reports are private: only you and the review team can see them. Accepted reports are credited in SEQ according to severity, and a proposed fix raises the award within its tier. An exceptional finding can be awarded up to 1,500,000 SEQ; 16,000,000 SEQ of the program pool is reserved for security awards.

Severity tiers

LowA reproducible defect in shipped code with a demonstrated security consequence, however small: a crash any peer can trigger on one node, an RPC or wallet path that leaks something it should not, a fee-asset or blinding edge case that loses testnet funds under a specific sequence. Documentation errors, UI problems, missing headers, version disclosure and theoretical concerns are not security findings; report those as a bug instead. 1,000 SEQ

MediumA contained vulnerability with a working reproduction: remote denial of service against a single node, an authentication or authorization weakness in an RPC or web surface, a wallet bug that loses funds under conditions a normal user can hit. 6,000 SEQ

HighSerious vulnerabilities: remote crash of many nodes, theft of funds requiring user interaction, breaking the opt-in confidentiality of a blinded transaction. 30,000 SEQ

CriticalNetwork-level vulnerabilities: consensus splits, silent inflation of any asset, theft of funds without user interaction. A working proof of concept is expected at this tier. 150,000 SEQ

ExceptionalNetwork-wide consequences, a truly novel technique and a working proof of concept. Awarded above Critical at the team's discretion. up to 1,500,000 SEQ

Amounts are the reference award for a clear, reproducible report in that tier. The review team sets the final award. The first reporter of an issue is the one rewarded; later reports of the same issue are marked duplicates.

Exceptional findings

A finding can be awarded far above the Critical tier, up to 1,500,000 SEQ, when all of the following hold: the consequences are network-wide (a consensus split, silent inflation of an asset, theft of funds without user interaction, or a break of Bitcoin anchoring), the technique is truly novel rather than a known class applied to new code, and the report comes with a working proof of concept. The team decides these awards case by case, and the reasoning is shared with the reporter.

What every accepted report needs

A defect in shipped code. Sequentia Core, the explorer, the faucet, Compages, this site or the servers behind them, as released or on the default branch. Documentation, advice and configuration examples are not in scope here.
A security consequence you demonstrate. Show what an attacker gains or a user loses, even if it is small. "Could be dangerous combined with an unknown bug" does not qualify, and neither do missing headers, version disclosure, rate limits, or best-practice deviations without an exploit.
Reproduction a reviewer can confirm in under an hour from the steps as written. A report that cannot be reproduced is not accepted at any tier.
First and untracked. Anything already on the public issue trackers or fixed on the default branch is a duplicate.
Your account code on the first line. Start the report with your account code, inside the encrypted block if you encrypt. That is how a report is known to be yours even if it is read long after it was sent.

Found a real bug without a security angle? The Report a bug task pays for those.

Ground rules

Test against your own nodes and wallets, or the public testnet. Never against other users or their funds.
No denial of service against shared infrastructure beyond the minimum needed to prove the issue.
Report privately here first. Public disclosure before a fix ships forfeits the reward.
Include steps to reproduce. A working proof of concept and a proposed fix both raise the award.

Encrypt your report

Reports are private to you and the review team, but the text is stored on the project's server. For a finding you would rather the server never holds in the clear, encrypt the report to the team's key and paste the encrypted block into the form. Only the review team, on machines that never expose the private key, can read it.

Public keysecurity-pgp.asc

Fingerprint175E 5689 7EFA 18DF 9D6A E5BD 8A92 51CD 2A22 27AF

curl -O https://sequentiatestnet.com/emissio/static/security-pgp.asc
gpg --import security-pgp.asc
gpg --armor --encrypt -r "Sequentia security reports" report.txt
# paste the contents of report.txt.asc into the report field