Proposal: Increase Bancor's Bug Bounty Payout on Immunefi

It sounds like the foundation is covering the current bounty given the language (perhaps someone from the foundation or a core team member can confirm?):

Payouts are handled by the Bancor core devs directly and are denominated in USD

If the proposal passes and the Bancor DAO can compel the foundation to raise the bounty then I think it is the correct approach. The increase is in line with what other protocols are doing and right now we are at a disadvantage.

If the Bancor DAO can’t compel the foundation to raise the bounty (even if the proposal passes) then it should still be done but the payment would have to come from us (the DAO) via minting $BNT. The language would have to change to make this explicit

Payouts are handled by the Bancor core devs in conjunction with the Bancor DAO directly and are denominated in USD.

If that is indeed the case then it might make sense for us to pre mint $BNT (A small amount but enough to cover the cost of a few vulnerabilities. We can use 52-week average price of $BNT to make this determination and some threshold, say $1m USD or 250K $BNT if the average price was $4) to a community-owned (some members of the community and core bancor devs) multisig to have ready for these scenarios so that we are not delaying the payment process by waiting for a proposal on our end to pass. I can take this up separately as a follow-up proposal.

2 Likes