A silent security scandal or dying profession? DeFi Bug Bounty Wall of Shame has millions in unpaid bounties

The crypto assemblage is grappling with issues surrounding bug bounty programs, a important mechanics for discovering and addressing strategy vulnerabilities.

Usmann Khan, a web3 information auditor, posted connected Aug. 17, “Remember that projects tin simply not pay, whitehat,” with a screenshot of a connection from Immunefi indicating a task had been removed from its bug bounty occupation for nonaccomplishment to wage a minimum of $500,000 successful bounties.

Source: X

In response, information researcher Marc Weiss shared the ‘Bug Bounty Wall of Shame’ (BBWoS), a database documenting unpaid rewards allegedly owed to achromatic chapeau hackers successful web3. The information from BBWoS appears to awesome a important deficiency of accountability and spot wrong the crypto ecosystem that cannot beryllium ignored.

The BBWoS indicates that a bug bounty for the Arbitrum exploit of Sep. 2022 had a $2 cardinal reward. Yet, the achromatic hatred was awarded conscionable $780,000 for identifying an exploit that exposed implicit $680 million.

Further, BBWoS states the CRV borrowing/lending exploit connected Aave from Nov. 2022 led to the nonaccomplishment of $1.5 million, with $40 cardinal astatine risk, and nary bounty was paid to the achromatic chapeau who identified the onslaught way “days before.”

Lastly, successful April this year, conscionable $500 was paid to a achromatic chapeau who reportedly identified a mode for managers to bargain up to $14 cardinal worthy of “tokens from users utilizing malicious swap paths” aft being told by dHEDGE that the contented was “well-known.”

The database was created by whitehat hackers “tired of spending sleepless nights uncovering bugs successful protocols lone to person a payout of $500 erstwhile the economical harm totals successful the millions,” with the creator stating,

“I created this leaderboard to assistance pass the information assemblage arsenic to the projects that don’t instrumentality information earnestly truthful we tin debar them and walk clip connected the projects that do.”

The request for in-house auditors successful DeFi.

In his presumption astatine the DeFi Security Summit successful July, Weiss highlighted auditors’ captious relation astatine assorted stages of protocol development. By integrating auditors and researchers in-house, helium stressed their imaginable to marque insightful architectural decisions, plan effectual codebases, and follow a security-focused attack to protocol development.

Consequently, it is concerning erstwhile platforms neglect to admit and adequately reward the efforts of these information professionals erstwhile moving connected a declaration basis.

Auditors Gogo and MiloTruck highlighted that non-payment for identified vulnerabilities is simply a wide issue. Their posts underscore the urgent request for these platforms to heighten their accountability and trustworthiness and guarantee owed designation for achromatic chapeau hackers.

More transparency is required successful handling vulnerabilities. High-profile cases listed connected BBWoS, similar the compromised deposit declaration of Arbitrum, the economical exploit of Aave, and the malicious swap paths successful dHEDGE, amplify this need.

Trusted Execution Environments successful DeFi.

In effect to Weiss’s issues astir trust, Danny Ki from Super Protocol emphasized the imaginable of “decentralized confidential computing” to bolster spot successful Web3 projects and mitigate vulnerabilities. Ki is referencing the enactment to tally DeFi successful Trusted Execution Environments (TEE), thing inherent successful Super Protocol.

A TEE is simply a unafraid country of a processor that guarantees codification and information loaded wrong beryllium protected for confidentiality and integrity. However, 1 disadvantage of utilizing TEEs wrong DeFi dApps is relying connected proprietary architecture from centralized companies specified arsenic Intel, AMD, and ARM. There are efforts successful the open-source assemblage to make unfastened standards and implementations for TEE, specified arsenic Open-TEE and OP-TEE projects.

Ki argues that should “Web3 projects run wrong confidential enclaves, determination whitethorn beryllium nary request to wage retired for vulnerabilities, arsenic the information volition beryllium inherently fortified.”

While a fusion of blockchain and confidential computing could supply a formidable information furniture for aboriginal projects, the determination to regenerate bug bounties and information auditors with TEEs seems complex, to accidental the least.

Issues with bug bounties successful DeFi.

Still, determination are further concerns for achromatic chapeau hackers, specified arsenic improper bug disclosures from information firms connected societal media. A station from Peckshield identifying a bug successful July simply said, “Hi @JPEGd_69, you whitethorn privation to instrumentality a look,” with a nexus to an Ethereum transaction.

Gogo lambasted the station stating, “If this vulnerability were responsibly disclosed alternatively of exploited, PEGd’s users wouldn’t person mislaid $11 million, No reputational harm would person been caused, The feline would person gotten a coagulated bug bounty alternatively of been front-run by an MEV bot.”

Gogo shared their bug bounty experience with Immunefi, a institution they described arsenic ‘beyond fantastic,’ wherever the payout required a mediation process, yet starring to a satisfactory payout of $5k for a captious bug.

These insights from the web3 information assemblage underscore the captious relation of auditors and the value of effectual bug bounty programs to the crypto ecosystem’s security, trust, and growth.

As immoderate person identified, hacks are covered extensively successful the quality and connected X, but what for those who observe the exploits and are ne'er adequately compensated? Nearly $2.5 cardinal successful allegedly unpaid bounties is listed connected BBWoS alone, yet, arsenic Ki highlighted, could the aboriginal see a web3 that is innately unafraid with nary request for bounties?

The station A soundless information ungraded oregon dying profession? DeFi Bug Bounty Wall of Shame has millions successful unpaid bounties appeared archetypal connected CryptoSlate.