KVORUM
compoundSource: Compound governor bravo · #354

Compound Bug Bounty Program with Immunefi

executedOct 30, 2024, 07:19 AM UTCby3F0x3fb1…4c8a

01Summary

AISummary by Kvorumclaude-haiku-4-5

Compound DAO is establishing a bug bounty program with Immunefi, allocating $57,500 annually for Immunefi's platform subscription and $500,000 (with potential additional $500,000) for bounty payouts. Bug reports will be reviewed by OpenZeppelin, Dmitry, Arr00, and Compound Labs, with rewards ranging from $1,000 (Low) to $50,000-$1,000,000 (Critical). Payouts will be delayed until bugs are fully fixed to prevent exploitation.

Type
treasury allocation
Funding
$57500 (annual subscription) + 500000 (initial bounty pool, with potential additional 500000)

Key changes

  • Establishment of bug bounty program on Immunefi platform with structured severity-based reward tiers (Critical: $50K-$1M, High: $10K-$50K, Medium: $5K, Low: $1K)(high)
  • Annual subscription to Immunefi ($57,500) including Managed Triage Services, Safe Harbor access, and 30 KYCs for security researchers(high)
  • Implementation of multi-reviewer process (OpenZeppelin, Dmitry, Arr00, Compound Labs) for bug report validation(high)
  • Policy requiring bug fixes to be fully deployed before security researcher payouts to prevent vulnerability exploitation(medium)

Notable concerns

  • Payment delays until bugs are fully fixed may reduce researcher participation
  • Dependency on external reviewers (OpenZeppelin, Dmitry, Arr00) for bug validation
  • Multisig control of bounty funds requires trust in governance working group and reviewers
Contracts0xc00e94cb662c3520282e6f5717214004a7f268880x3d9819210a31b4961b30ef54be2aed79b9c9cd3b
Generated by Kvorum
model: claude-haiku-4-5
provider: anthropic
profile: anthropic-fast-v1
prompt: v1.0
generated: 2mo ago
Read the description ↗

02Description

532 words

Compound Bug Bounty Program with Immunefi

Summary

After working closely with many of Compound DAO’s delegates, Immunefi is working with PGov to bring our proposal to an onchain vote to further develop the existing bug bounty program for Compound and to host it on Immunefi’s platform. Our platform will provide access to industry-leading security researchers and will provide a greater long-term security that benefits Compound and its community. 

During the development of the public proposals, we focused on providing a thorough bug bounty program while structuring the backend details such as the creation of the bounty program, deciding on the program administrators, the features of the subscription packaging, bug report reviews, and the validation and payment processes.

More details can be found in the two public proposals below:

<u>First Proposal</u>

<u>Second Proposal/Update</u> (includes scope of Compound’s bug bounty program)

Reward Structure and Fee

The bug bounty reward breakdown for the severity payout to the security researchers is as follows:

  • Critical: $50,000 - $1,000,000
  • High: $10,000 - $50,000
  • Medium: $5,000
  • Low: $1,000

This breakdown is based on our current client roster along with Compound’s position in the rankings of CMC, Coingecko, and DefiLlama. The program will be able to payout the reward in COMP. The reward suggestion above is based on the top tier DeFi lending protocol on our platform such as Sky (formerly MakerDAO), Sparks, AAVE, and Morpho.

Immunefi’s annual subscription fee is $57,500, which includes the highest tier Managed Triage Services, access to Safe Harbor, 30 KYCs for security researchers, the program design, and hosting of the program. The highest tier of Managed Triage Services was requested by the bounty program administrators as a result of the preliminary technical assessment of every report that the Immunefi team provides before it is prepared and delivered to the administrators for validity of a bug report. 

Program Administrators, Bug Report Review, and Bug Fixes 

All Bug Reports that pass through Immunefi will be reviewed by OpenZeppelin, Dmitry, and Arr00, with Compound Labs as secondary eyes if a conclusion cannot be reached. If necessary, the Immunefi meditation team will also be able to assist in mediating issues arising from the review of the bug report with the security researchers. 

Though Immunefi considers any processes around fixing bug reports to be outside the consideration of payments, it is understood that this needs to be accounted for in a DAO environment. Specifically, fixes may take more time to be implemented, and need to be fully deployed before payouts can be made due to the need for the payment process to be more transparent with DAO processes. For example, if a payout process is initiated while a bug still has not been fixed, it may provide enough information for one or more people to find the vulnerability and exploit it. Because of this, payments to the security researcher may be delayed until a discovered bug has been appropriately addressed.

Budget:

$57,500 for ImmuneFi will be sent to: 0x7119f398b6c06095c6e8964c1f58e7c1baa79e18

$500,000 for the Bug Bounty will be sent to: 0x429D01a5ff7f7880081f858B50C26452255477f5. This multisig is controlled by the reviewers and governance working group. The remaining $500,000 budgeted will only be sent if this first half is exhausted.

03Mismatch analysis

AIMismatch analysis by Kvorumclaude-sonnet-5
Consistent

The description lists exactly two payments: a $57,500 subscription fee to Immunefi's address and a $500,000 initial bug bounty allocation to a reviewer-controlled multisig (with the second $500k tranche explicitly withheld pending exhaustion of the first). The calldata contains exactly two actions matching these in both target address and approximate USD value: 1,322 COMP transferred to the Immunefi address (≈$57,500 at a plausible COMP price) and 11,363.64 COMP granted to the named multisig (≈$500,000), consistent with only the first half of the bounty budget being funded now. Both addresses match those quoted in the description verbatim (including their unusual character lengths, which appear to be pre-existing typos in the original proposal text rather than calldata manipulation, since they're identical in both places). No additional targets, recipients, or functions appear in the calldata beyond what the description describes, and no claimed action is missing from the calldata. Given the close numerical and address alignment, I assess this proposal as consistent with high confidence.

Generated by Kvorum
model: claude-sonnet-5
provider: anthropic
profile: anthropic-strong-v1
prompt: v1.0
generated: 2mo ago
Review the decoded actions ↗

04Actions

2 total
#0transfer(address,uint256)chain 0x1
Target
0xc00e…6888
Value
0 wei
Function
transfer(address,uint256)
Arguments
{
  "amount": "1322000000000000000000",
  "address": "0x7119f398b6C06095c6E8964C1f58e7C1BAa79E18"
}
Calldata
#1_grantComp(address,uint256)chain 0x1
Target
0x3d98…cd3b
Value
0 wei
Function
_grantComp(address,uint256)
Arguments
{
  "amount": "11363636400000000000000",
  "recipient": "0x429D01a5ff7f7880081f858B50C26452255477f5"
}
Calldata

05Tally

Summed from votes

Voters0
VP participating0
Outcome (current)—
Current support—

06Voters

0 total

No votes recorded yet.

07Forum

AIForum synthesis by Kvorumclaude-haiku-4-5
sentiment · favorablethread · constructive

Arguments for

  • A formal bug bounty program with Immunefi will help secure Compound's protocol by incentivizing security researchers to responsibly disclose vulnerabilities.— joe_immunefi
  • The program has been carefully drafted in collaboration with multiple stakeholders including OpenZeppelin, Compound Labs, and experienced delegates to ensure best practices and comprehensive coverage.— joe_immunefi
  • Clear reward structures ranging from $1,000 to $1,000,000 based on severity and impact will appropriately incentivize researchers to report critical bugs without withholding them.— joe_immunefi
  • The Immunefi Standard Badge certification and adherence to Immunefi's vulnerability severity classification system ensures the program meets industry best practices.— joe_immunefi
  • Monthly DAO proposals for payouts provide transparency and governance oversight while reducing burden through batching of validated reports.— joe_immunefi
  • Designated program administrators (OpenZeppelin, Dmitry, Arr00) with Compound Labs as backup will ensure professional management and fair evaluation of bug reports.— joe_immunefi
  • KYC requirements and eligibility criteria prevent conflicts of interest and protect against OFAC violations and exploitation by project insiders.— joe_immunefi

Arguments against

None surfaced.

Notable participants

  • joe_immunefiImmunefi representative who authored the proposal, collaborated with stakeholders, and presented the comprehensive bug bounty program draft.
  • PGovDelegate sponsor of the Immunefi onchain proposals for Compound's bug bounty program who posted the voting link.
  • OpenZeppelinCollaborator on program design and designated as one of three primary program administrators.
  • Arr00Collaborator on program design and designated as one of three primary program administrators.
  • DmitryCollaborator on program design and designated as one of three primary program administrators.
  • Compound LabsProvided feedback on the program design and designated as secondary oversight administrator.
Generated by Kvorum
model: claude-haiku-4-5
provider: anthropic
profile: anthropic-fast-v1
prompt: v1.0
generated: 2mo ago
Open the thread ↗