Defect reports and bounties

Section 14 of 22

F4 pays for demonstrated defects under published terms and sends validated findings into the corpus. A report can also trigger immediate protection through F5 before the award is settled.

Step	Work and depth	Required actor, evidence, and transition	Failure or wait
B01. Receive	S + C, none	Reporter submits privately through an authenticated reporting route. Controller records the target release, report or commitment hash, and priority time.	Missing data returns for correction. A bare commitment reserves no arbitrary award.
B02. Complete and reserve	C + X, targeted	Reporter supplies the matching complete report before the deadline. Controller checks advertised scope and applies the funded reservation rule.	A mismatched or expired commitment loses its priority under the terms. Unfunded contingent awards must be labeled as such.
B03. Reproduce	C with conditional J, targeted	Assigned runner reproduces the failure against the identified version. Report authority checks the claimed policy violation when interpretation is needed.	Infrastructure failure enters F10. A failed reproduction requests correction or reaches a recorded rejection. Serious evidence starts F5 immediately.
B04. Determine eligibility	C with conditional J, targeted	Report authority checks scope, duplicates, author exclusions, root cause, severity, and available reward terms.	Uncertain attribution remains a separate question. One patch fixing several cases does not prove one root cause.
B05. Record award	J or C under a fixed schedule, targeted	Authorized report decision records findings, award amount, funding reservation, recipient, and due conditions.	An unsupported claim is rejected with reasons. A qualifying dispute invokes C01 through C05 for the contested amount.
B06. Preserve regression	X + C, targeted	Maintainer opens or links F2 work for the accepted finding and records disclosure conditions.	Do not delay all reporter pay merely because a separate regression implementer or patch is late.
B07. Settle	X + C, none	F6 pays the accepted award under its schedule and confirms the result.	Preserve due entitlements and disputed portions across transfer failures.
B08. Close and disclose	C + X, none	Report authority records final disposition and publishes permitted evidence when the embargo ends.	Incident and repair work can remain open under their own identifiers.

Scope and award terms

Publish covered domains and releases, qualifying defects, reproduction requirements, reservation conditions, priority rules, award tiers, maximum aggregate commitments, payment schedule, and appeal deadlines before advertising funded rewards. A queue for possible future funding does not guarantee compensation or priority over an already funded obligation.

Reward severity and useful findings within those declared limits. Keep caps attached to demonstrated defects, affected work, releases, and available commitments. Account-based caps alone are easy to evade with more accounts. Avoid promising a fresh maximum reward for every duplicate symptom.

Group reports by demonstrated root cause. A shared fix is evidence to examine, not the grouping rule. Separate the undisputed award from a dispute about an additional defect or contributor attribution. Do not make every accepted award wait for a patch the DAO controls.

The earlier dollar bounty tiers and per-case fees remain historical proposals. Select a funded schedule for v2 rather than treating v1 amounts as promised launch rewards. Review that schedule together with holdbacks, optional collateral, and self-bounty exclusions so linked contributors and reporters cannot extract more than the intended funded liability.

Attribution and consequences

Report validation answers whether a defect exists. Attribution answers which accepted work caused it and which quoted consequence applies. Compare releases, reproduce the failure, and use revert-and-retest when informative. Interacting changes can leave responsibility uncertain even when the defect is certain.

Adopt the attribution standard before it can reduce payment. A finding must identify the applicable term, responsible contribution, causal evidence, and amount at issue. Uncertainty cannot silently become proof of fault. An appeal can correct attribution without denying the underlying defect.

Routine payment consequences can follow established defect attribution without proving intent. Fabricated evidence, planted defects, and coordinated extraction are separate misconduct questions. One honest error does not remove membership. Repeated poor work can justify a scoped role review that considers severity, work volume, and difficulty, with notice and appeal.

Corpus work remains useful even without an active bounty finding. Commission benign controls and missing behavior categories alongside attack regressions. Customer code enters that work only through an explicit, sanitized contribution.