Bounty System

Status: roadmap preview. The contribution UI, validation model, and Solana payment integration are being built incrementally. Do not treat the payout ranges, CLI examples, or API examples below as a live public bounty offer.

Tamandua's planned bounty system rewards security researchers who contribute validated detection rules, IOCs, hardening configs, benchmark scenarios, and threat intelligence. Unlike traditional bug bounties, Tamandua bounties reward defensive value: artifacts that improve detection or response quality without leaking tenant data.

Core Principles

Bounties reward validated defensive value, not simulated malware noise.

This means:

Rules must detect real threats, not just pass syntax checks
IOCs must be correlated with external threat intel
Submissions must not contain PII or fake data
Multiple validation methods prevent fraud
No payout should be automated from a single self-generated detection

What Earns Bounties?

Detection Rules

Type	Target Bounty Range	Requirements
Sigma rule	0.05-0.5 SOL	Syntax valid, no FP, benchmark coverage
YARA rule	0.05-0.5 SOL	Compiles, tested samples, low FP
Behavioral pattern	0.1-1.0 SOL	Cross-platform, documented, tested
ML training data	0.01-0.1 SOL	Labeled, diverse, no duplicates

Threat Intelligence

Type	Target Bounty Range	Requirements
IOC bundle	0.01-0.1 SOL	Fresh, public, validated source
Threat report	0.1-0.5 SOL	Actionable, MITRE-mapped, sourced
Campaign attribution	0.2-1.0 SOL	Evidence-backed, peer-reviewed

Ecosystem Contributions

Type	Target Bounty Range	Requirements
Response playbook	0.1-0.5 SOL	Tested, documented, reviewed
Hunt query	0.05-0.2 SOL	Documented, low FP, coverage-adding
Integration plugin	0.2-1.0 SOL	Functional, documented, tested
Documentation	0.01-0.1 SOL	Accurate, complete, reviewed

Eligibility Requirements

A submission is eligible for bounty only when it passes all checks:

eligible_for_bounty =
  syntax_ok &&
  no_pii &&
  not_duplicate &&
  reviewer_approved &&
  (
    benchmark_evidence ||
    external_threat_intel_correlated ||
    multi_org_observed
  )

Required Validations

Syntax validation: Rule parses without errors
PII check: No private IPs, hostnames, usernames, paths
Duplicate check: Not already in the detection library
Reviewer approval: Human reviewer signed off

Validation Evidence (at least one required)

Benchmark evidence: Rule detected attack in Atomic Red Team, Caldera, GOAD, or Tamandua's validation lab
External TI correlation: IOCs confirmed by third-party threat intel (VirusTotal, OTX, etc.)
Multi-org observation: 2+ organizations independently observed the indicator

High-Value Bounty Requirements

Bounties exceeding 0.5 SOL require additional validation:

2-of-3 validation sources (benchmark + reviewer, external TI + multi-org, etc.)
Expert or Partner trust tier
Cooldown period (cannot claim immediately)
Second reviewer approval for amounts >1 SOL

Marketplace and Reputation Status

The public marketplace is roadmap. Detection/config packs can be modeled and validated before public commerce is enabled, but the production marketplace requires:

signed artifact manifests;
runtime activation and rollback;
license and revenue-share metadata;
reviewer workflow;
false-positive and duplicate tracking;
public audit metadata that does not expose tenant telemetry.

Contributor reputation should remain off-chain until there is enough validated history to make it meaningful. On-chain reputation, staking, slashing, and automated payout governance are future research items, not current product guarantees.

Contributing Rules

Submit a Sigma Rule

# Planned CLI flow
tamandua submit rule \
  --type sigma \
  --file ./my_rule.yml \
  --wallet YOUR_SOLANA_WALLET

# Response
Submission ID: sub_abc123
Status: Submitted
Wallet: ABCdef...
Estimated Bounty: 0.05-0.2 SOL

Next Steps:
1. Automated validation (5-10 minutes)
2. Benchmark testing (if applicable)
3. Human review (24-48 hours)
4. Bounty payment (after validation)

Submit IOCs

# Planned API flow
curl -X POST https://tamandua.treantlab.org/api/v1/bounties/submit \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "type": "ioc",
    "title": "Redline Stealer C2 Infrastructure",
    "wallet": "YOUR_SOLANA_WALLET",
    "iocs": [
      {"type": "domain", "value": "evil-c2.com"},
      {"type": "ip", "value": "1.2.3.4"},
      {"type": "hash_sha256", "value": "abc123..."}
    ],
    "source": "Sandbox analysis",
    "mitre_techniques": ["T1071.001", "T1041"]
  }'

Submit via Dashboard

Navigate to Contributions > New Submission when the public contribution flow is enabled
Select submission type
Upload or paste content
Enter your Solana wallet address
Add metadata (MITRE techniques, sources, notes)
Submit for review

Validation Process

Stage 1: Automated Checks

Runs immediately on submission:

Syntax validation
PII detection
Duplicate detection
Schema compliance
MITRE mapping validation

[Automated] Syntax check: PASS
[Automated] PII check: PASS
[Automated] Duplicate check: PASS
[Automated] Schema check: PASS
Status: Moved to Triage

Stage 2: Benchmark Testing

If rule covers testable techniques:

[Benchmark] Testing against Atomic Red Team...
[Benchmark] T1555.003 (Chrome Cookies): DETECTED
[Benchmark] T1555.003 (Firefox Cookies): DETECTED
[Benchmark] T1555.004 (Safari Keychain): NOT TESTED (no macOS runner)
[Benchmark] Coverage: 2/3 techniques detected
Status: Benchmark Evidence Added

Stage 3: External Correlation

For IOC submissions:

[Correlation] Checking VirusTotal...
[Correlation] domain evil-c2.com: 15/90 vendors flagged
[Correlation] ip 1.2.3.4: 8/90 vendors flagged
[Correlation] hash abc123: 45/70 vendors flagged
[Correlation] External TI Evidence Added
Status: Correlated with 3 external sources

Stage 4: Human Review

Reviewer evaluates:

Detection quality
False positive potential
Coverage value
Attribution accuracy

[Review] Reviewer: security_analyst_42
[Review] Verdict: APPROVED
[Review] Notes: "Clean rule, good coverage for browser credential theft"
[Review] Estimated Bounty: 0.1 SOL
Status: Validated

Stage 5: Bounty Payment

Once validated:

[Payment] Processing bounty...
[Payment] Amount: 0.1 SOL (100,000,000 lamports)
[Payment] Recipient: YOUR_SOLANA_WALLET
[Payment] Transaction: 5Uy3abc...
[Payment] Solscan: https://solscan.io/tx/5Uy3abc...?cluster=devnet
Status: Paid

Reputation System

Your contribution history builds a reputation score:

Reputation Score =
  validated_submissions * 10 +
  bounties_paid * 20 +
  rules_reused * 5 +
  low_fp_bonus -
  rejected_submissions * 15 -
  duplicate_submissions * 10 -
  pii_violations * 50 -
  fraud_flags * 100

Trust Tiers

Tier	Score	Benefits
New	0-49	Manual review required
Trusted	50-199	Faster approval
Expert	200-499	High-value bounties eligible
Partner	500+	Auto-approval for benchmarked submissions
Restricted	<0	All submissions paused

Building Reputation

Start with smaller submissions to build trust
Ensure quality over quantity
Avoid duplicate or low-value submissions
Respond to reviewer feedback

Claiming Rewards

Check Submission Status

tamandua submissions list --wallet YOUR_WALLET

ID          TYPE    STATUS      BOUNTY      TX
sub_abc123  sigma   paid        0.1 SOL     5Uy3abc...
sub_def456  ioc     validated   0.05 SOL    pending
sub_ghi789  yara    reviewing   --          --

Verify Payment

tamandua verify --tx 5Uy3abc...

Bounty Verified
---------------
Amount: 0.1 SOL
Recipient: YOUR_WALLET
Rule: my_detection_rule.yml
Incident: Linked to detection on 2025-05-08
Solscan: https://solscan.io/tx/5Uy3abc...

View Earnings

tamandua wallet history --wallet YOUR_WALLET

Total Earned: 1.5 SOL
Submissions: 12 validated
Last Payment: 2025-05-08

History:
DATE        AMOUNT    TYPE    SUBMISSION
2025-05-08  0.1 SOL   sigma   sub_abc123
2025-05-05  0.05 SOL  ioc     sub_def456
2025-05-01  0.2 SOL   yara    sub_ghi789
...

Bounty Pools

Bounties are funded from multiple sources:

Global Community Pool

Treant maintains a global pool for general bounties:

Base detection rules
Community IOC contributions
Documentation improvements

Customer-Sponsored Pools

Roadmap concept: organizations may eventually fund bounties for specific threats:

# As an organization
tamandua pool create \
  --name "APT29 Detection" \
  --amount 10 SOL \
  --techniques T1547,T1055,T1134 \
  --description "Rules detecting APT29 tradecraft"

Pack Revenue Share

Roadmap concept: contributors to marketplace detection packs may receive revenue share after marketplace policy, tax/accounting, licensing, fraud controls, and payout rails are defined. No public revenue split is active yet.

Anti-Fraud Measures

Tamandua employs multiple fraud prevention mechanisms:

What Does NOT Count as Validation

benchmark_testable - Tests exist, but rule not actually tested
Self-observation only - Must be multi-org
Syntax passing - Necessary but not sufficient
High severity claim - Must be verified

Red Flags

Submissions covering only testable techniques (gaming benchmarks)
Many submissions with no detections
IOCs only from private infrastructure
Duplicate submissions across accounts
Self-referential correlation

Consequences

PII violations: -50 reputation, submission rejected
Fraud flag: -100 reputation, account restricted
Repeated violations: Permanent restriction

API Reference

Submit Contribution

POST /api/v1/bounties/submit
Authorization: Bearer $TOKEN

{
  "type": "sigma|yara|ioc|playbook",
  "title": "Detection Title",
  "wallet": "SOLANA_WALLET",
  "content": "rule content or object",
  "metadata": {
    "mitre_techniques": ["T1555.003"],
    "source": "Analysis description",
    "tags": ["infostealer", "browser"]
  }
}

Response:
{
  "data": {
    "id": "sub_abc123",
    "status": "submitted",
    "estimated_bounty_range": [50000000, 200000000],
    "validation_eta": "2025-05-08T12:00:00Z"
  }
}

Check Status

GET /api/v1/bounties/submissions/{id}
Authorization: Bearer $TOKEN

Response:
{
  "data": {
    "id": "sub_abc123",
    "status": "validated",
    "bounty_eligibility": "eligible",
    "validation_details": {
      "syntax_ok": true,
      "benchmark_evidence": true,
      "external_correlation": ["virustotal"],
      "reviewer_approved": true,
      "validated_by": "reviewer_id",
      "validated_at": "2025-05-08T12:00:00Z"
    },
    "bounty_amount_lamports": 100000000,
    "payment_status": "pending"
  }
}

Get Leaderboard

GET /api/v1/bounties/leaderboard?limit=10

Response:
{
  "data": [
    {
      "rank": 1,
      "wallet": "ABC...(truncated)",
      "total_lamports": 5000000000,
      "submission_count": 45,
      "trust_tier": "partner"
    },
    ...
  ]
}

Next Steps

Solana Program - Technical integration details
Self-Hosted Relay - Run your own attestation relay
Detection Rules - Learn to write Sigma rules