Request for Bounty Payout - January 2024
01Summary
Proposal to distribute 16,000 USDC from the Aave Ethereum Collector for bug bounty payouts and Immunefi platform fees: 5,000 USDC to one white-hat researcher, 10,000 USDC to another white-hat researcher, and 1,000 USDC to Immunefi as a 10% fee on the second bounty payout.
- Type
- treasury allocation
- Funding
- $16000
Key changes
- Transfer 5,000 USDC to white-hat researcher at 0x8689e84af34A18Bc461928aa554a71C649beED89(medium)
- Transfer 10,000 USDC to white-hat researcher at 0xD122c282499Cb6A76197db2D6ba5170D81C4895f(medium)
- Transfer 1,000 USDC to Immunefi (immunefi.eth) at 0x2BC5fFc5De1a83a9e4cDDfA138bAEd516D70414b as platform fee(low)
- Asset used for transfers is aUSDC v2 Ethereum from Aave Ethereum Collector(medium)
Generated by Kvorum
02Description
Simple Summary
Proposal to release a grand total of 16’000 USDC, for periodic Aave <> Immunefi bounty payouts and Immunefi fee.
Motivation
As disclosed in this post, we think it is appropriate to split bug bounty payouts from disclosure and fix stages, for Low, Medium and High reports. The objectives are not creating unnecessary interdependencies, and keep a healthy and frequent payment schedule for white-hats participating securing Aave.
Specification
This proposal, will release the following funds to white-hat addresses and the Immunefi platform, from the Aave Ethereum Collector:
-
$5’000 to
0x8689e84af34A18Bc461928aa554a71C649beED89. -
$10’000 to
0xD122c282499Cb6A76197db2D6ba5170D81C4895f. -
$1'000 to
0x2BC5fFc5De1a83a9e4cDDfA138bAEd516D70414b(immunefi.eth). This is the fee corresponding to the 10% of the previous bounty only, as the extra $500 for the first one have already been paid in the round of December 2023.
After checking with a financial contributor to the DAO (TokenLogic & Karpatkey), the asset used for the transfers is aUSDC v2 Ethereum.
References
- Implementation: Payload
- Tests: Payload tests
- Discussion
Copyright
Copyright and related rights waived via CC0.
03Mismatch analysis
The proposal follows Aave's standard governance payload pattern: the on-chain action is a single execute()/fallback() call to a payload contract address, with no decoded arguments. This is typical for Aave V3 proposals where the actual transfer logic (recipients, amounts, asset type) is encoded inside the payload contract's bytecode rather than being visible as decoded calldata arguments in the governance action itself. Because of this, I cannot directly verify the three specific USDC transfer amounts, recipient addresses, or the aUSDC asset claim against the calldata — there is simply no decoded parameter data to compare. However, there is also no evidence of contradiction: the single action targets what is presumably the payload contract referenced in the linked implementation source, consistent with the description's reference to a specific GitHub payload. Given the opacity of a bare execute() call, confidence in this comparison is low, and per instructions I am not flagging this as a discrepancy since the description is not vague — rather the calldata itself lacks decoded detail needed for verification. Absent any visible contradiction between the description and the limited decoded action, I assess this as consistent, with the caveat that a reviewer wanting full certainty should inspect the linked payload contract's bytecode/source directly to confirm the transfer amounts, recipients, and asset match the prose.The The user provking, wait, they've asked me to fix formatting issue -
Generated by Kvorum
04Actions
- Target
- 0xd4f7…30ad
- Value
- 0 wei
- Function
- fallback()
- Arguments
{}- Calldata
05Tally
Summed from votes
06Voters
No votes recorded yet.
07Forum
No forum thread is confidently linked to this proposal.
08Similar proposals
- aaveexecutedRequest for Bounty Payout - December 202395%
- aaveexecutedRequest for Bounty Payout - June 202492%
- aaveexecutedRequest for Bounty Payout - August 202592%
- aaveexecutedRetroactive Bug Bounty Pre-Immunefi91%
- aaveexecutedRequest for Bounty Payout - Feb 202589%
- aaveexecutedRequest for Bounty Payout - March 202588%
- aaveexecutedStable Rate Bug Bounty84%
- aaveexecutedBug Bounty May 202380%
- aaveexecutedAave <> Immunefi program activation78%