4 ms·

Again, we have another 6-figure winner on finding a vulnerability in a crypto exchange and the payouts are way more than the average bug bounty these days (espe

by rvz 2y ago

Again, we have another 6-figure winner on finding a vulnerability in a crypto exchange and the payouts are way more than the average bug bounty these days (especially for critical bugs). For crypto skeptics and those who REALLY hate crypto, this is a great opportunity to turn your passion of hating all over it into a lucrative hunt for bugs like this one and to make a massive killing from the payouts. Just think about it.

wasteduniverse 2y ago
If I hated crypto companies, why would I help find bugs for them?
- lifty 2y ago
  I think the OP was obvious. To make money.
rty32 2y ago
Cost/benefit analysis? What is the chance I would someday get a $500k payout, starting from near zero experience today, with the help of a little bit of luck?
- saliagato 2y ago
  Can't comment on the cost (varies depending on who you are and what you do in your life) but the benefit is really high. source: I started from 0 and the very first bounty I submitted (related to CEX) was valued to $100k+
  - Loughla 2y ago
    How long did that take? How long was the 0 to reward process, and how much time did you spend?
modernerd 2y ago
Crypto skeptics probably don't trust crypto firms to pay the "rewards up to $15,000,000" bounties advertised at places like https://immunefi.com/ https://immunefi.com/. Immunefi has a similar payouts table to h1's at https://immunefi.com/bug-bounty/ https://immunefi.com/bug-bounty/ implying people are getting paid, but it could boost credibility by linking to write-ups and findings from researchers if any exist.
- cyanydeez 2y ago
  Whenevrt i see a crypto disxussion with dollar signs, im forced to ask if thw payment is in actual dollars or dollar equivelents. Aftetall, bitcoin isnt a currency and is more like a stockmarket as when you try to extract large value from it you typically cause its real price to decline.
  - nl 2y ago
    Unless they are paying multi-billion dollar bounties in BTC, USDC, USDT or ETH it's not big enough to really move the market.
  - modernerd 2y ago
    Payments seem to be in Ethereum, based on the description of the "Immunefi vault platform": > This project utilizes a decentralized vault for their bounty rewards to ensure trust by showing that they have the collateral to cover their bounties. Payments are processed directly on-chain inside the Immunefi webapp. https://immunefi.com/bug-bounty/beanstalk/ https://immunefi.com/bug-bounty/beanstalk/ An interesting side-effect is that you can view payments from the public vault for each project, for example: https://etherscan.io/address/0x66Efac6e6d58D4058CF017E66a0039315a3eb29C?utm_source=immunefi#tokentxns https://etherscan.io/address/0x66Efac6e6d58D4058CF017E66a003... Top payment so far is 3 payments of about 8,500 USD to the same recipient. The maximum claimed achievable payment is 1.1m USD. It does at least imply that they've set aside magic beans to pay researchers, and that someone is being paid from the bean fund, for whatever that's worth.
  - bawolff 2y ago
    The real sketch ones is when the payout is in their custom altcoin since if you find a truly show stopper bug, their altcoin might end up going to 0 once you report it.
twelve40 2y ago
> make a massive killing from the payouts do you have, you know, like some data on those massive payouts? other than one data point?
- unsafe_call 2y ago
  Here’s a list of vulnerability writeups with what they were paid https://github.com/sayan011/Immunefi-bug-bounty-writeups-list https://github.com/sayan011/Immunefi-bug-bounty-writeups-lis...
hgomersall 2y ago
Or you can spend your short life doing something actually useful.
- Nextgrid 2y ago
  I’m not a fan of crypto, but it’s not like non-crypto tech (which is mostly about collecting people’s personal data and wasting their time with ads) is any more useful. Crypto at least is easy to ignore as a user. Every other company out there that wants me to handover my personal data and “engage” is less so.
bawolff 2y ago
You can believe that crypto is "secure" and still be a crypto-skeptic.

by rvz 2y ago

wasteduniverse 2y ago

If I hated crypto companies, why would I help find bugs for them?

lifty 2y ago
I think the OP was obvious. To make money.

rty32 2y ago

Cost/benefit analysis? What is the chance I would someday get a $500k payout, starting from near zero experience today, with the help of a little bit of luck?

saliagato 2y ago
Can't comment on the cost (varies depending on who you are and what you do in your life) but the benefit is really high. source: I started from 0 and the very first bounty I submitted (related to CEX) was valued to $100k+
- Loughla 2y ago
  How long did that take? How long was the 0 to reward process, and how much time did you spend?

modernerd 2y ago

Crypto skeptics probably don't trust crypto firms to pay the "rewards up to $15,000,000" bounties advertised at places like https://immunefi.com/ https://immunefi.com/. Immunefi has a similar payouts table to h1's at https://immunefi.com/bug-bounty/ https://immunefi.com/bug-bounty/ implying people are getting paid, but it could boost credibility by linking to write-ups and findings from researchers if any exist.

cyanydeez 2y ago
Whenevrt i see a crypto disxussion with dollar signs, im forced to ask if thw payment is in actual dollars or dollar equivelents. Aftetall, bitcoin isnt a currency and is more like a stockmarket as when you try to extract large value from it you typically cause its real price to decline.
- nl 2y ago
  Unless they are paying multi-billion dollar bounties in BTC, USDC, USDT or ETH it's not big enough to really move the market.
- modernerd 2y ago
  Payments seem to be in Ethereum, based on the description of the "Immunefi vault platform": > This project utilizes a decentralized vault for their bounty rewards to ensure trust by showing that they have the collateral to cover their bounties. Payments are processed directly on-chain inside the Immunefi webapp. https://immunefi.com/bug-bounty/beanstalk/ https://immunefi.com/bug-bounty/beanstalk/ An interesting side-effect is that you can view payments from the public vault for each project, for example: https://etherscan.io/address/0x66Efac6e6d58D4058CF017E66a0039315a3eb29C?utm_source=immunefi#tokentxns https://etherscan.io/address/0x66Efac6e6d58D4058CF017E66a003... Top payment so far is 3 payments of about 8,500 USD to the same recipient. The maximum claimed achievable payment is 1.1m USD. It does at least imply that they've set aside magic beans to pay researchers, and that someone is being paid from the bean fund, for whatever that's worth.
- bawolff 2y ago
  The real sketch ones is when the payout is in their custom altcoin since if you find a truly show stopper bug, their altcoin might end up going to 0 once you report it.

twelve40 2y ago

> make a massive killing from the payouts do you have, you know, like some data on those massive payouts? other than one data point?

unsafe_call 2y ago
Here’s a list of vulnerability writeups with what they were paid https://github.com/sayan011/Immunefi-bug-bounty-writeups-list https://github.com/sayan011/Immunefi-bug-bounty-writeups-lis...

hgomersall 2y ago

Or you can spend your short life doing something actually useful.

Nextgrid 2y ago
I’m not a fan of crypto, but it’s not like non-crypto tech (which is mostly about collecting people’s personal data and wasting their time with ads) is any more useful. Crypto at least is easy to ignore as a user. Every other company out there that wants me to handover my personal data and “engage” is less so.

bawolff 2y ago

You can believe that crypto is "secure" and still be a crypto-skeptic.