Request for Bounty Payout - March 2025
01Summary
Proposal to distribute $23,100 in GHO tokens as bug bounty payouts: $20,000 to one white-hat researcher, $1,000 to another, and $2,100 as platform fee to Immunefi (10% of bounties). This is a monthly payout for valid security submissions to the Aave-Immunefi bug bounty program.
- Type
- treasury allocation
- Funding
- $$23,100
Key changes
- Transfer 20,000 GHO to 0x62566e81CcDFF9407E840d5ec3056e7354D44012 for bug bounty(medium)
- Transfer 1,000 GHO to 0xF5BED21BD285CBe352737F686766cCC19BeE7acC for bug bounty(medium)
- Transfer 2,100 GHO to immunefi.eth (0x7119f398b6C06095c6E8964C1f58e7C1BAa79E18) as 10% platform fee(low)
Generated by Kvorum
02Description
Simple Summary
Proposal to release a total of $21’000 as bounty for four outstanding Aave <> Immunefi valid submissions, together with $2’100 as the fee to the Immunefi platform; amounting to a grand total of $23'100.
The asset of payment will be GHO.
Motivation
After the previous Request for Bounty Payout on January 2025, there have been only two valid bug submissions on the Aave <> Immunefi program, which should be paid now with the month finished, cleaning up the pipeline.
Specification
This proposal will release the following funds to white-hat addresses and the Immunefi platform:
- 20’000 GHO to 0x62566e81CcDFF9407E840d5ec3056e7354D44012
- 1’000 GHO to 0xF5BED21BD285CBe352737F686766cCC19BeE7acC
- 2’100 GHO to 0x7119f398b6C06095c6E8964C1f58e7C1BAa79E18 (immunefi.eth). This is the fee corresponding to the 10% of the previous bounties.
References
- Implementation: AaveV3Ethereum
- Tests: AaveV3Ethereum
- Snapshot
- Discussion
Copyright
Copyright and related rights waived via CC0.
03Mismatch analysis
The proposal only contains a single decoded on-chain action: a call to execute() with no decoded arguments, which is typical for Aave governance payloads where the actual logic (GHO transfers to specific addresses) resides in a delegatecalled contract not exposed in this decoding. Because the calldata provides no visible amounts or recipient addresses, I cannot directly verify the three GHO transfers described (20,000 / 1,000 / 2,100 GHO totaling 23,100) against on-chain parameters. This lack of granular calldata detail limits confidence in a full match, so I rate confidence as low rather than asserting a severe or material mismatch that isn't evidenced. The description itself is well-structured and internally detailed, but I noted one internal inconsistency: the summary claims four valid submissions while the motivation says only two, which could mislead a reviewer about how many bounties are being paid, though the total dollar amounts and recipient list are consistent with two bounty payments plus one fee. No evidence of a target mismatch, value mismatch tied to calldata, or omitted/extra actions could be established due to the opaque execute() call. Given the absence of demonstrable calldata-level contradictions, and only a low-severity internal wording inconsistency, I classify this as a minor discrepancy overall, with low confidence due to insufficient decoded detail to fully cross-check the specific transfer amounts and addresses.
Discrepancies
- lowmisleading phrasing
The Simple Summary states the payout covers 'four outstanding Aave <> Immunefi valid submissions' while the Motivation section states there were 'only two valid bug submissions' since the last payout. This is an internal inconsistency in the description's own narrative, not something verifiable against the calldata, but it could confuse a delegate trying to reconcile the stated rationale with the listed payments (which only list two bounty recipients plus the platform fee).
“four outstanding Aave <> Immunefi valid submissions”
Generated by Kvorum
04Actions
- Target
- 0x160a…09b8
- Value
- 0 wei
- Function
- fallback()
- Arguments
{}- Calldata
05Tally
Summed from votes
06Voters
No votes recorded yet.
07Forum
No forum thread is confidently linked to this proposal.
08Similar proposals
- aaveexecutedRequest for Bounty Payout - Feb 202599%
- aaveexecutedRequest for Bounty Payout - August 202594%
- aaveexecutedRequest for Bounty Payout - June 202492%
- aaveexecutedRequest for Bounty Payout - January 202488%
- aaveexecutedRequest for Bounty Payout - December 202387%
- aaveexecutedRetroactive Bug Bounty Pre-Immunefi84%
- aaveexecutedStable Rate Bug Bounty79%
- aaveexecutedAave <> Immunefi program activation77%
- aaveexecutedBug Bounty May 202372%