2 ms·
The company posting the bounty. Third party verifies the bug. Why sarcastic?
by alexcnwy 8y ago
The company posting the bounty. Third party verifies the bug. Why sarcastic?
- vertex-four 8y agoWhy doesn’t the third party publish the data themselves then?
- alexcnwy 8y agoThe third party doesn't know about the vulnerability. Company C posts bug bounty B in contract. Researcher X discovers vulnerability. Validator Y confirms the vulnerability and X gets paid (1-f)B where f is validator fee.
- vertex-four 8y agoOK, so why doesn't Y hold the money as well, given that they're in the position of deciding whether or not X gets it?