IOTA has launched a bug bounty program on Sherlock, inviting security researchers to identify vulnerabilities in the core software supporting its Layer 1 blockchain. Announced on October 14, 2026, the program offers rewards of up to $25,000 in USDC for qualifying critical vulnerabilities, with additional payouts for high-severity findings.
The initiative focuses on protecting user funds, preserving ledger integrity and transaction finality, and maintaining network availability. IOTA is a Move-based blockchain with an object-oriented execution model and a validator network using Starfish consensus, making its execution environment, consensus mechanisms and transaction processing key areas of security review.
According to the program details, only Critical and High severity vulnerabilities qualify for rewards. Researchers must submit reports through Sherlock and provide a coded proof of concept with instructions for reproducing the issue. The program is live, but its scope is restricted to specified repositories, source files and production configurations.
IOTA Targets Consensus, Move Execution and Network Security
The program offers between $15,000 and $25,000 in USDC for Critical vulnerabilities and between $5,000 and $15,000 for High-severity findings. Sherlock and the IOTA team will determine the reward based on demonstrated impact, the conditions required for exploitation, the assets or functionality affected and the measures needed for recovery.
Critical findings include vulnerabilities that compromise consensus safety or finality, enable unauthorized asset creation or control, cause permanent loss of user funds, or prevent the network from making progress under qualifying conditions. These categories cover risks such as conflicting finalized transactions, unauthorized token inflation and network-wide failures that require substantial intervention to resolve.
High-severity issues cover material but more limited financial losses, theft or permanent freezing of earned staking rewards, temporary freezing of user funds and sustained disruption to core functionality. Remote arbitrary code execution in an in-scope production node can also qualify as High severity when it does not produce a Critical-level consequence.
The scope includes Starfish consensus and networking, validator communication, transaction ordering, data availability, signature verification, authorization checks, replay protection and protocol-proof verification. It also covers Move bytecode verification, virtual machine execution, native functions, object ownership, resource safety and gas metering.
Other eligible components include native asset accounting, staking and unstaking, validator selection, voting power, rewards, epoch transitions, protocol upgrades, checkpoints, execution effects, state synchronization, storage integrity and recovery. Dependencies may qualify when a vulnerability affects an in-scope component and demonstrably produces a Critical or High impact on IOTA.
Sherlock Rules Restrict Testing and Eligible Vulnerabilities
The program excludes a range of findings, including Medium- and Low-severity issues, cosmetic problems, documentation errors, gas optimizations without qualifying security consequences and theoretical vulnerabilities without a working proof of concept. Standalone wallets, browser extensions, explorers, indexers, third-party applications, bridges and IOTA EVM are also outside the stated scope, although a covered Layer 1 runtime vulnerability can qualify even when an application triggers it.
Researchers cannot claim rewards for previously known vulnerabilities, duplicate reports or issues already identified in earlier audits and awaiting fixes. Issues requiring privileged access, economic or tokenomic weaknesses without direct loss of funds, and risks arising solely from centralization are also excluded under the published rules. A single underlying vulnerability receives one reward based on its highest demonstrated eligible impact, rather than separate payouts for every consequence.
Testing restrictions are particularly important. Researchers must use isolated local networks, simulations or local forks; exploiting public mainnet or testnet infrastructure, public RPC endpoints or third-party systems is prohibited. The rules also prohibit accessing private user data, moving other users’ funds, social engineering, phishing and denial-of-service attacks.
All reports must remain confidential and be submitted exclusively through Sherlock. Public disclosure is permitted only after the vulnerability has been verified, a fix has been implemented and deployed, and the protocol team has explicitly authorized disclosure. Premature disclosure can disqualify a submission from receiving a reward.
For the IOTA community, the program creates a defined route for independent researchers to examine core blockchain security while receiving compensation for qualifying discoveries. The maximum reward of $25,000 establishes the upper limit for a Critical finding, not a guaranteed payout for every reported issue. Its effectiveness will depend on the quality of submissions, the vulnerabilities uncovered and how promptly the team addresses confirmed problems.
About The Author
