KVORUM
compoundSource: Compound governor bravo · #391

Compound Safe Harbor

executedFeb 1, 2025, 03:30 PM UTCby3F0x3fb1…4c8a

01Summary

AISummary by Kvorumclaude-haiku-4-5

Activate Safe Harbor legal framework on Immunefi's bug bounty program to allow whitehat security researchers to recover and return funds during active blackhat attacks. Whitehats receive 10% of recovered funds (capped at $600,000 based on Compound's $1M max critical reward). No additional costs to Compound. Requires DAO approval to proceed with activation through Immunefi dashboard.

Type
governance change

Key changes

  • Activate Safe Harbor framework enabling whitehat security researchers to rescue protocol funds during active blackhat attacks and redirect them to a protocol-controlled vault(high)
  • Establish whitehat compensation at 10% of funds saved, capped at 60% of maximum critical reward ($600,000 for Compound)(high)
  • Include all current bug bounty in-scope assets in Safe Harbor program(medium)
  • Establish vault address for security researchers to return recovered Compound funds(medium)

Notable concerns

  • Safe Harbor activation contingent on whitehat identifying and recovering funds during actual blackhat attack
  • Maximum payout of $600,000 represents significant cost if triggered
  • Requires agreement to unified Terms & Conditions document
  • Relies on security researcher community identifying and responsibly reporting exploits
Contracts0x1cb5b5c0acd248c0fb4be52af789732d17f78da0
Generated by Kvorum
model: claude-haiku-4-5
provider: anthropic
profile: anthropic-fast-v1
prompt: v1.0
generated: 2mo ago
Read the description ↗

02Description

339 words

Compound Safe Harbor

Summary:

To activate <u>Safe Harbor</u> for the <u>Compound Finance Bug Bounty Program</u> on Immunefi, we are pleased to share the full details of the program to align the Compound DAO.

Safe Harbor:

Safe Harbor is a legal framework developed by the <u>Security Alliance (SEAL)</u> for protocols to empower whitehat security researchers to rescue protocol funds during an active blackhat attack — and redirect those funds back to a protocol-controlled <u>Vault</u> on Immunefi. In return, whitehats receive 10% of the funds saved, with a maximum of up to 60% of the project’s maximum critical reward.

Safe Harbor provides Compound Finance a secure solution for the whitehat recovery of funds during an active blackhat exploit. Immunefi’s implementation of the Security Alliance’s robust Safe Harbor framework, coupled with our extensive community of security researchers, provides a solution that integrates seamlessly with Compound’s bug bounty infrastructure. This ensures that our top-tier security researcher community has a credible and safe channel for returning funds when other security measures fail.

Cost:

If Safe Harbor is utilized during a blackhat attack, the payment to the security researcher is 10% of the funds saved, up to 60% of the project’s maximum critical reward. With Compound Finance’s $1M max critical payout, the rewards paid to a whitehat security researcher would be capped at $600,000.

There are no additional costs payable to Immunefi or to SEAL.

Activation of Safe Harbor:

Once we have the full support of the Compound DAO for the activation of Safe Harbor, the current program administrators will be able to activate Safe Harbor through the Immunefi dashboard, which is where the program administrators are receiving bug reports from the security researcher community.

Once Safe Harbor is activated, we will include all <u>assets</u> that are currently in scope of the bug bounty program on Safe Harbor. A vault address will also be provided which is the address that security researchers will use to return Compound’s funds.

By approving this proposal, you agree to the unified <u>Terms & Conditions</u> for Safe Harbor Program.

03Mismatch analysis

AIMismatch analysis by Kvorumlow confidenceclaude-sonnet-5
Minor discrepancy

placeholder

Generated by Kvorum
model: claude-sonnet-5
provider: anthropic
profile: anthropic-strong-v1
prompt: v1.0
generated: 2mo ago
Review the decoded actions ↗

04Actions

1 total
#0fallback()chain 0x1
Target
0x1cb5…8da0
Value
0 wei
Function
fallback()
Arguments
{}
Calldata

05Tally

Summed from votes

Voters43
VP participating684.2K
Outcome (current)For
Current support100%

06Voters

43 total

No votes recorded yet.

07Forum

No forum thread is confidently linked to this proposal.