Bug bounty

Every live smart contract is a standing invitation. If it holds money and has a flaw, someone will eventually go looking. A bug bounty changes the incentive by giving whoever finds the flaw a legitimate, paid way to report it, so that disclosure becomes a better deal than an attack.

How a bug bounty works

A program publishes a scope (which contracts, websites and systems are covered), a set of rules and a reward table. A researcher who finds an issue submits a private report with enough detail to reproduce it. The team confirms the issue, fixes it and pays a reward based on severity. Typical rules forbid testing against live user funds, require keeping the issue private until it is fixed, and exclude known issues and attacks that depend on stolen keys.

How rewards are set

Rewards usually follow severity tiers. A critical issue that could lead to direct loss of funds earns the most, often with a cap linked to the value at risk; high, medium and low issues earn progressively less. The reasoning is economic. If the reward is small next to what an attacker could take, some finders will be tempted, so serious programs in DeFi offer rewards that can be large. Paying quickly and fairly matters as much as the size of the reward, because researchers remember which teams honour their programs.

A simple example

A researcher notices that a vault's withdrawal function rounds in the user's favour in a rare edge case. Repeated many times in one transaction, the error could slowly drain the vault. She writes up the steps privately. The team reproduces the bug, pauses the affected function, ships a fix and pays a high-severity reward. No funds are lost, and the issue is disclosed publicly once the fix is live.

Bug bounty vs. audit

A smart contract audit is a scheduled, scoped review by a hired team at one point in time. A bug bounty is open-ended: anyone can look, for as long as the program runs, and payment depends on results. Audits are strongest before launch; bounties keep paying for attention afterwards, when the code is live and the stakes are real. Runtime monitoring adds a third layer by watching transactions as they happen.

Risks and limits

A bounty only works if a researcher finds the bug before an attacker does, and if the reward is worth their time. Scope matters: an issue outside the listed contracts may not qualify, which can push attention elsewhere. Programs that pay slowly or dispute valid findings lose the research community's trust. A bounty also fixes nothing by itself; the team still has to respond quickly, and some bugs take time to patch safely once reported. The existence of a program says little about its quality. Its scope, rules and record of paying out tell you more than the size of its maximum reward.

Tori Finance runs its own internal bug bounty program, which rewards researchers who report vulnerabilities in its code responsibly. The program is separate from the smart contract audits and from runtime monitoring, and it keeps the code under review while it is live.