Issues

• Security report: tari-ootle timeout certificates are accepted without checking their epoch, letting a Byzantine leader replay a stale quorum-signed TC to force an unauthorized view/height skip (GHSA-x75p-5xgq-26cv)

  bounty-Mretro-bounty
  tari-project/special_contributions#125 · Filter by author sdbondi opened on Oct 8, 2026

• Security report: tari-ootle direct stealth UTXO burn skips resource authorization hook (EMAIL-61)

  bounty-Mretro-bounty
  tari-project/special_contributions#109 · Filter by author sdbondi opened on Oct 8, 2026

• Security report: tari-ootle unauthenticated cross-shard QC replay forces consensus sync loop, halting committee liveness (GHSA-p6cp-739m-2hrv)

  bounty-Mretro-bounty
  tari-project/special_contributions#107 · Filter by author sdbondi opened on Oct 8, 2026

• Security report: tari-ootle committee member can remotely abort validator via NodeHeight overflow in LeaderSkipSet (GHSA-v8m9-4g8c-j2jf)

  bounty-Sretro-bounty
  tari-project/special_contributions#100 · Filter by author sdbondi opened on Oct 7, 2026

• Security report: tari-ootle malicious indexer can irreversibly drain nearly an entire L1 burn claim through a non-refundable auto-claim fee (GHSA-vv8c-c3cc-cwm8)

  bounty-Lretro-bounty
  tari-project/special_contributions#96 · Filter by author sdbondi opened on Oct 7, 2026

• Security report: tari-ootle committed state that the state-sync transport cannot deliver makes a shard permanently unsyncable for new nodes (GHSA-fcgg-6mg5-357x)

  bounty-Lretro-bounty
  tari-project/special_contributions#95 · Filter by author sdbondi opened on Oct 7, 2026

• Security report: tari-ootle unauthenticated validator JSON-RPC can create signed exit artifact (GHSA-39x3-3pg3-px79)

  bounty-Sretro-bounty
  tari-project/special_contributions#85 · Filter by author sdbondi opened on Oct 7, 2026

• Security report: tari-ootle scalar_invert intrinsic is charged at the cheap scalar-field-op rate (GHSA-2h95-2f82-q9m8)

  bounty-Sretro-bounty
  tari-project/special_contributions#73 · Filter by author sdbondi opened on Oct 6, 2026

• Security report: tari-ootle epoch-checkpoint total_exhaust_burn is unbounded and overflows the indexer Amount accumulator, aborting it (GHSA-jhc4-392q-5jvw)

  bounty-Mretro-bounty
  tari-project/special_contributions#72 · Filter by author sdbondi opened on Oct 6, 2026

• Security report: tari-ootle liquidity pool: swap on a one-sided pool pays out the entire reserve for a 1-unit input (missing zero-reserve guard) (GHSA-8mmv-p9gv-57jf)

  bounty-Lretro-bounty
  tari-project/special_contributions#65 · Filter by author sdbondi opened on Oct 5, 2026

• Security report: tari-ootle messaging handler: no read timeout — stalled inbound streams pin task capacity and prevent connection reaping (GHSA-38xx-4h6j-jmr3)

  bounty-Mretro-bounty
  tari-project/special_contributions#60 · Filter by author sdbondi opened on Oct 5, 2026

• Security report: tari-ootle foreign proposal committee binding (GHSA-m493-gggq-hvvw)

  bounty-Sretro-bounty
  tari-project/special_contributions#45 · Filter by author sdbondi opened on Oct 2, 2026

• Security report: tari-ootle unauthenticated HotStuff restart (GHSA-wxp4-rq8h-jcvf)

  bounty-Lretro-bounty
  tari-project/special_contributions#43 · Filter by author sdbondi opened on Oct 2, 2026

• Onboard Naveen

  tari-project/special_contributions#22 · Filter by author Kelketek opened on Aug 26, 2026
  2

• Onboarding sprucetree

  tari-project/special_contributions#12 · Filter by author Kelketek opened on Aug 21, 2026
  2

• Write up the Exchange update process in the Tari Wiki

  tari-project/special_contributions#1 · Filter by author metalaureate opened on Jul 23, 2026