The rocket pool immunefi bug bounty was recently updated to include houston code. At the same time the classifications for critical bugs were changed (see cached bounty page) and partially downgraded to high based on $-value. In detail:
Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield
Used to be classified as critical ($500k bounty) and was changed to:
Direct theft of any user funds (with value > $250,000), whether at-rest or in-motion, other than unclaimed yield
Still critical ($500k bounty) and:
Direct theft of any user funds (with value < $250,000), whether at-rest or in-motion, other than unclaimed yield
Now high ($25k bounty)
The same change was made for:
Permanent freezing of funds
My initial impression was that this is about reducing cost, given that the payout either remains the same or is reduced significantly, however langers assured me that this is not the case and the goal was to have more sensible payouts. To check sensibility, I had a quick look at some other staking protocol programs for comparison:
- Stader: Linear scaling (10%) with $100k minimum and $1m maximum for theft or permanent freezing
- Stakewise: $200k fixed for loss of user funds, independent of $-impact
- Lido: Linear scaling (1%) for loss of user funds with $100k min and $2m maximum.
It is worth noting that the bug bounty is fully run by the team and not the pDAO. So these are just my two cents and not meant as a formal proposal.
- Scaling payout with the potential impact is a fine thing to do, but I believe that a minimum payout of $25k for critical bugs as described here puts Rocket Pool in a comparatively bad position and I would like to see minimum increased significantly.
- Scaling can go both ways. Especially in the context of making a change from fixed to scaled, increasing payout for very high impact at the same time are better optics that make it clear what the change is about.
- Big payout jumps based on impact should be avoided, as they create perverse incentives for whitehats. Impact of a bug can fluctuate over time with ETH value, RPL value or factors like number of minipools in a certain state. Here, the payout would 20x if an impact goes from $240k to $260k, so there is a strong incentive for a potential whitehat to sit on a known issue until the treshold is met. Linear scaling doesn’t produce strong incentives to wait like that, because payouts are kept proportional to impact changes.