[DAO: bafkrei] Manage Bounty program for vulnerability reports

Governance
1

by 0x87956abc4078a0cc3b89b419928b857b8af826ed (Nacho)

Linked Pre-Proposal

Set up a bounty program for vulnerability reports

Summary

Request the DAO to cover the payment of the rewards and grant the Decentraland Foundation to manage them as the proposal state.

Abstract

As the DAO owns the smart contracts and manages the development of the protocol, we are requesting to cover the rewards needed for every vulnerability found in the Decentraland bounty program. The Decentraland foundation is committed to triage, answering, and fixing every disclosure received. Every payment will be published publicly.

Motivation

Bug bounty programs are open invitations to security researchers to discover and disclose potential vulnerabilities in projects’ smart contracts and applications, thereby protecting projects and their users. For their good work, security researchers receive a reward based on the severity of the vulnerability, as determined by the project affected.

Why have a bug bounty program at all? In 2020 alone, hacks and scams cost the Web3 community over $238m, and bug bounties can prevent those hacks from happening. Bug bounty programs surface vulnerabilities so they can be fixed before they get exploited in malicious hacks that destroy projects and ruin reputations.

Specification

As members of the Security Advisory Board (SAB), we hereby request the DAO to approve and fund the bounty program and due to its nature and limited execution capabilities, delegate to the Decentraland Foundation the ability to respond to any vulnerability disclosed through the program. That means that the Decentraland Foundation is committed to doing the triage and answering the disclosures received, while the DAO is in charge of providing the funds needed once a confirmed bug report is reviewed and confirmed. So basically when a payment has to happen due to a valid report under the program, the Decentraland Foundation will inform DAO with case #, the recipient wallet address, and the amount to be paid and also, shall contact the SAB in order to fix the vulnerabilities disclosed.

The program is composed of different threat levels and topics:

Smart Contracts

High Up to USD 500 000

Medium Up to USD 20 000

Low USD 1 000

Websites and Applications

Critical USD 18 000

High USD 6 000

Medium USD 3 000

Low USD 1 000

Payouts are denominated in USD. However, payouts are done in MANA and USDT, with a minimum of 20% to be done in USDT.

The program is not tied or attached to any third party but the Decentraland Foundation will use them and their expertise and platforms to help administrate the program. Therefore and after a deep initial analysis, the SAB has selected and recommended the Decentraland Foundation to start the bounty program using Immunefi.

The Decentraland bounty program can be found here.

The DAO will publish each payment made for every reward.

Conclusion

The idea is to keep Decentraland safe and secure for every user. The DAO will provide the funds while the Foundation will manage the disclosures accordingly

Vote on this proposal on the Decentraland DAO

View this proposal on Snapshot

2

I personally love this proposal because bug bounty programs tend to be so hit or miss. I do have a question though. There’s a line item in the ImmuneFi page:

“Attacks that the reporter has already exploited themselves, leading to damage”

How does one properly test a vulnerability in a safe manner, if exploitation isn’t allowed? Let’s pretend, for example, that a LAND contract vuln (Like the one discovered by BirdofParadise69) is found. Would it be acceptable to have 2 wallets (Let’s call them Wallet A and Wallet B), hold LAND in Wallet A, and test an exploit to transfer it to Wallet B? In that scenario, on-chain activity would be taking place, but the tester/bounty hunter would effectively be hacking themselves.

I didn’t see this covered in the ImmuneFi page, so forgive me if I missed it. Again, my vote is a resounding YES, but I’m interested in having some discussion around this as well.

3

Thanks for submission of this proposal @Nacho and for the work of the SAB.

Question about the clause below, that could potentially be answered in the final binding governance proposal:

Is there a process by which the DAO can authorize or prevent the payment from happening? Or is that part of the service provided by Immunefi, so by approving the proposal, we are effectively agreeing to their arbitration?

4

For smart contracts, you can fork Mainnet with Hardhat and/or Tenderly.
For websites you can run it locally and test it.

Is there a process by which the DAO can authorize or prevent the payment from happening? Or is that part of the service provided by Immunefi, so by approving the proposal, we are effectively agreeing to their arbitration?
We agree on the SAB criteria/arbitration.

Let me know if that answers your questions.

1 Like
5

Nacho,

Thanks for the reply with links to back it up. I was explaining the bug bounty program to some friends, who expressed an interest due to the payout amounts. The answers you’ve provided are more than enough to point them in the right direction, should they decide to pursue anything.

6

Manage Bounty program for vulnerability reports

This proposal is now in status: PASSED.

Voting Results:

  • Yes 100% 2,727,944 VP (43 votes)
  • No 0% 0 VP (0 votes)