KVORUM
aaveSource: Aave governance v3 · #27

Retroactive Bug Bounty Pre-Immunefi

executedFeb 18, 2024, 03:26 PM UTCbyF70xf71f…1e02

01Summary

AISummary by Kvorumclaude-haiku-4-5

Proposal to release 86,500 USDC from the Aave Ethereum Collector to reward white-hat security researchers for bug reports submitted before the official Aave-Immunefi partnership (September 25, 2023). Payments include 65,000 USDC and 15,000 USDC to two white-hat addresses, plus 6,500 USDC fee to Immunefi (10% of one bounty).

Type
treasury allocation
Funding
$86500

Key changes

  • Release 65,000 USDC to white-hat address 0xFa760444A229e78A50Ca9b3779f4ce4CcE10E170 for retroactive bug bounty(high)
  • Release 15,000 USDC to white-hat address 0x7dF98A6e1895fd247aD4e75B8EDa59889fa7310b for retroactive bug bounty(high)
  • Release 6,500 USDC to Immunefi (0x2BC5fFc5De1a83a9e4cDDfA138bAEd516D70414b) as 10% mediation fee(medium)

Notable concerns

  • Retroactive evaluation of reports outside the official Immunefi program framework
  • Immunefi fee (10%) charged due to mediation process requested by white-hat
Contracts0xc7950e9591a6e3d7fb68b0d289dd4e54167f1b70
Generated by Kvorum
model: claude-haiku-4-5
provider: anthropic
profile: anthropic-fast-v1
prompt: v1.0
generated: 2mo ago
Read the description ↗

02Description

259 words

Simple Summary

Proposal to release a grand total of 86’500 USDC, for bounties pending from before the setup of the Aave <> Immunefi official bug bounty program.

Motivation

Before the setup of the Aave <> Immunefi bug bounty program on September 25th 2023, security reports by white hats were evaluated in an ad-hoc basis.

Currently, every report is being processed via Immunefi and the rules of the Aave program, however, there were other reports submitted via other channel before that. As these reports should be evaluated at time of submission for fairness, and outside of the Immunefi scope defined afterwards, we think it is a good idea to reward them separately and retro-actively outside the program.

In one of the cases, we had recommended the white hat to submit the report via Immunefi, in order to have access to the mediation procedure of the platform. As this mediation process was finally requested by the white hat, Immunefi charges the corresponding fee of 10% of the amount.

Specification

This proposal, will release the following funds to white-hat addresses and the Immunefi platform, from the Aave Ethereum Collector:

  • $65’000 to 0xFa760444A229e78A50Ca9b3779f4ce4CcE10E170.

  • $15’000 to 0x7dF98A6e1895fd247aD4e75B8EDa59889fa7310b.

  • $6'500 to 0x2BC5fFc5De1a83a9e4cDDfA138bAEd516D70414b (immunefi.eth). This is the fee corresponding to the 10% of the bounty being paid.

Note: After checking with a financial contributor to the DAO (TokenLogic & Karpatkey), the asset used for the transfers is aUSDC v2 Ethereum

References

Copyright

Copyright and related rights waived via CC0.

03Mismatch analysis

AIMismatch analysis by Kvorum

A calldata-vs-description analysis is not generated yet. Review the decoded actions →

04Actions

1 total
#0fallback()chain 0x1
Target
0xc795…1b70
Value
0 wei
Function
fallback()
Arguments
{}
Calldata

05Tally

Summed from votes

Voters0
VP participating0
Outcome (current)—
Current support—

06Voters

0 total

No votes recorded yet.

07Forum

No forum thread is confidently linked to this proposal.