Request for Bounty Payout - August 2025
01Summary
Proposal to distribute $13,000 in GHO bounties to two security researchers who submitted valid Immunefi vulnerability reports, plus $1,300 as platform fee to Immunefi, totaling $14,300 in GHO payments.
- Type
- treasury allocation
- Funding
- $$14,300
Key changes
- Transfer $8,000 GHO to white-hat security researcher at 0xbD5895f2855C3d0B7f366Bd946D56c4D9Ef03a25(high)
- Transfer $5,000 GHO to white-hat security researcher at 0x2770cC972a7666C974B1b1269F4F31b97f99f898(high)
- Transfer $1,300 GHO to Immunefi platform (immunefi.eth) as 10% platform fee(medium)
Generated by Kvorum
02Description
Simple Summary
Proposal to release a total of $13’000 as bounty for two outstanding Aave <> Immunefi valid submissions, together with $1’300 as the fee to the Immunefi platform; amounting to a grand total of $14'300.
The asset of payment will be GHO.
Motivation
After the previous Request for Bounty Payout in March 2025, there have only been two valid submissions on the Aave <> Immunefi program, to be paid now, cleaning up the pipeline until 1st September, 2025.
Specification
This proposal, following an approach similar to Direct-to-AIP, will go directly on-chain and will release the following funds to white-hat addresses and the Immunefi platform:
- $8’000 to 0xbD5895f2855C3d0B7f366Bd946D56c4D9Ef03a25
- $5’000 to 0x2770cC972a7666C974B1b1269F4F31b97f99f898
- $1’300 to 0x7119f398b6C06095c6E8964C1f58e7C1BAa79E18 (immunefi.eth). This is the fee corresponding to 10% of the previous bounties.
References
- Implementation: AaveV3Ethereum
- Tests: AaveV3Ethereum
- Discussion
Copyright
Copyright and related rights waived via CC0.
03Mismatch analysis
The proposal follows Aave's standard 'Direct-to-AIP' governance pattern, where the on-chain action is a single call to execute() on a purpose-built payload contract. The actual fund transfer logic (amounts, recipients, asset) is encoded inside that payload contract's bytecode rather than being visible as decoded calldata arguments in this single action. The referenced GitHub implementation link corresponds to a contract named 'RequestForBountyPayoutAugust2025', consistent with the description's narrative of releasing GHO bounties to two white-hat addresses and the Immunefi fee wallet. However, because the decoded action here is just a generic execute()/fallback call with no arguments, it is not possible to directly verify from the calldata alone that the specific dollar amounts, GHO denomination, and recipient addresses stated in the description are what the payload will actually execute. This is typical and expected for this proposal type, so I do not flag it as a discrepancy, but confidence in the comparison is necessarily low since the substantive transfer details are opaque at this action layer and could only be confirmed by reviewing the linked payload contract source code and its test file. No value mismatches, target mismatches, or omissions can be identified from the available decoded data, and nothing in the description appears to overstate or contradict what a single execute() call would do in this governance pattern. Given the low visibility into internal logic, I withhold speculative discrepancy flags per guidance and instead note the limitation transparently.
Generated by Kvorum
04Actions
- Target
- 0x00fb…7914
- Value
- 0 wei
- Function
- fallback()
- Arguments
{}- Calldata
05Tally
Summed from votes
06Voters
No votes recorded yet.
07Forum
No forum thread is confidently linked to this proposal.
08Similar proposals
- aaveexecutedRequest for Bounty Payout - June 202496%
- aaveexecutedRequest for Bounty Payout - Feb 202595%
- aaveexecutedRequest for Bounty Payout - March 202594%
- aaveexecutedRequest for Bounty Payout - January 202492%
- aaveexecutedRequest for Bounty Payout - December 202391%
- aaveexecutedRetroactive Bug Bounty Pre-Immunefi88%
- aaveexecutedStable Rate Bug Bounty82%
- aaveexecutedAave <> Immunefi program activation80%
- aaveexecutedBug Bounty May 202376%