Find a bug. Earn XE.

The bounty is a standing programme, not a one-off event: it opens one area of the system at a time and stays open as the protocol is built. Phase 1 is live now. Later phases are listed here by title only — each one's scope, examples and rules go up when that phase opens, and no phase closes the programme.

1. Phase 1transactions & running a nodeopen now
2. Phase 2p2p networking & syncupcoming
3. Phase 3consensus & finalityupcoming
4. Phase 4api, web ui & user surfacesupcoming
5. Phase 5leases, escrow & computeupcoming
6. Phase 6tokenomics & emissionupcoming
7. Phase 7gpu computeupcoming

Phases open as each area settles, not on a fixed calendar. Findings outside the active phase are not eligible for reward yet — except Critical and Severe findings, which we want immediately whatever area they land in, and always pay.

Phase 1 is the entry point to the system: everything one node and one keypair can do on their own or against themselves. That is the scope of the programme today — set your testing to it.

The same five tiers apply in every phase. Severity assigned by the XE core team based on impact, exploitability, and report quality. Amounts are targeted ceilings — exceptional findings may exceed them — and are provisional until the bounty pool is finalized ahead of mainnet launch.

Illustrative Phase 1 examples per tier. If you find something impactful inside the Phase 1 scope that doesn't fit below, report it anyway.

Ranked by total XE awarded across every phase. Updated when the site is redeployed after reports are triaged.

Updated manually when the site is redeployed as reports are accepted and paid.

Reports are filed as public issues on github.com/xeprotocol/xe. Critical/Severe findings go privately by email first — we coordinate disclosure and open the public issue once a patch has shipped.

1. 01
   Reproduce against testnet

   Verify on test.network. Capture tx hashes, block heights, exact reproduction steps.

2. 02
   File a GitHub issue

   Open an issue at github.com/xeprotocol/xe/issues/new with a suggested severity tier and the Phase 1 area it lands in. Public by default — for Critical/Severe findings, see step 4 instead.

3. 03
   Include a clear PoC

   Minimal reproduction script or test case. Impact analysis: who's affected, worst case.

4. 04
   Critical/Severe: email first

   Findings that risk funds or the network go privately to security@xe.network— not a public issue. Ask for an encryption key first; we'll reply with one before you send details, then with a tracking ID. A public issue goes up once a patch ships.

5. 05
   Triage & acceptance

   Core team confirms, assigns severity, and replies on the issue (or by email with a tracking ID for Critical/Severe) — we apply tracking labels ourselves on triage.

6. 06
   Payout at genesis

   Accepted bounties pay in native XE at mainnet launch, if and when it happens. Provide an XE address (or a designated mainnet address) in your report.

• Phase 1 is the active scope — findings inside it are eligible now, and other areas become eligible as their phase opens
• Critical and Severe findings are eligible in any area, in any phase — send those straight away
• Test only on testnet (test.network) — never on mainnet once live
• Don't pivot to attack other users' funds, keys, or workloads
• Report Critical/Severe findings by email, not a public issue — we'll reply with a tracking ID, and a public issue goes up once a patch ships
• Good-faith research that follows these rules is authorized; we won't pursue legal action over it
• One report per bug. Chained findings can be split across reports
• Duplicate reports go to the first verifiable submission
• Severity, eligibility, and reward at discretion of XE core team
• Payouts in native XE at mainnet genesis, contingent on launch. No cash equivalent, no guaranteed monetary value
• XE team members and direct contractors are not eligible