ImmuneFi

Immunefi says it has facilitated $66M in bug bounty payouts to whitehats since inception

The average bug bounty payout over 1,248 confirmed reports was $52,800.

According to a new report released on Dec. 21, blockchain security firm Immunefi said that it has processed more than $65,918,994 crypto bounties paid to ethical hackers over 1,248 reports since its inception on Dec. 9, 2020. Web 3.0 projects list bounty programs on ImmuneFi to encourage whitehat hackers to report vulnerabilities and claim monetary rewards, which the company then facilitates.

The payouts appear to be concentrated in nature, with bounty programs operated by Wormhole, Aurora, Polygon, Optimism, and an undisclosed firm accounting for $30.2 million worth of rewards in the past year. The median payout was $2,000, and the average payout was $52,800. A small number of critical vulnerability bug reports received the highest rewards. 

“A $5,000 bounty payout for a critical vulnerability may work in the web2 world, for example, but it does not work in the web3 world. If the direct loss of funds for a web3 vulnerability could be up to $50 million dollars, then it makes sense to offer a much larger bounty size to incentivize good behavior.”

In terms of vulnerability notifications, Smart Contracts issues took the lead, with a total of 728 submissions, accounting for 58.3% of paid reports. Meanwhile, the Websites and Applications and Blockchain/Distributed Ledger Technology (DLT) categories totaled 488 submissions (39.1) and 32 submissions (2.6%), respectively. Interestingly, despite having a high number of submissions, Website and Applications reports only represented 2.9% of total whitehat payouts, whereas Smart Contract bugs accounted for 89.6% of payments.

The Wormhole vulnerability discovery resulted in a $10 million bug bounty payout | Source: Immunefi

The bounty programs detected high vulnerability reports, such as the case in Pods Finance, for a logic error that allowed for theft of yield or abuse of the rewards system on the protocol. Another includes Mushrooms Finance’s vulnerability which could be potentially exploited via a miner-extractable value attack with flash bots.

The report also dedicated a portion of ransom analysis, revealing that malicious hackers have returned $32.7 million in funds illicitly gained from decentralized finance (DeFi) protocols across five specific situations in 2022. Hackers have kept $6,44 million in total ransom payments. Some experts say that the payment of ransom to hackers amounts to giving into extortion, but nearly all agree that it’s much better to instate a bug bounty program ex ante facto. Immunefi currently offers $144 million in bounty rewards through Web 3.0 projects listed on the platform. 

Immunefi says it has facilitated $66M in bug bounties since inception

The average bug bounty payout over 1,248 confirmed reports was $52,800.

According to a new report released on Dec. 21, blockchain security firm Immunefi has processed more than $65.9 million in crypto bounties paid to ethical hackers over 1,248 reports since its inception on Dec. 9, 2020. Web3 projects list bounty programs on ImmuneFi to encourage white hat hackers to report vulnerabilities and claim monetary rewards, which the company then facilitates.

The payouts appear to be concentrated in nature, with bounty programs operated by Wormhole, Aurora, Polygon, Optimism and an undisclosed firm accounting for $30.2 million worth of rewards in the past year. The median payout was $2,000, and the average payout was $52,800. A small number of critical vulnerability bug reports received the highest rewards. 

“A $5,000 bounty payout for a critical vulnerability may work in the web2 world, for example, but it does not work in the web3 world. If the direct loss of funds for a web3 vulnerability could be up to $50 million dollars, then it makes sense to offer a much larger bounty size to incentivize good behavior.”

In terms of vulnerability notifications, “smart contract” issues took the lead, with a total of 728 submissions, accounting for 58.3% of paid reports. Meanwhile, the “websites and applications” and “blockchain/distributed ledger technology” categories totaled 488 submissions (39.1%) and 32 submissions (2.6%), respectively. Interestingly, despite having a high number of submissions, website and application reports only represented 2.9% of total white hat payouts, whereas smart contract bugs accounted for 89.6% of payments.

The Wormhole vulnerability discovery resulted in a $10 million bug bounty payout. Source: Immunefi

The bounty programs detected high-vulnerability reports, such as the case in Pods Finance, for a logic error that allowed for the theft of yield or abuse of the rewards system on the protocol. Another includes Mushrooms Finance’s vulnerability, which could be potentially exploited via a miner-extractable value attack with flash bots.

The report also dedicated a portion to ransom analysis, revealing that malicious hackers have returned $32.7 million in funds illicitly gained from decentralized finance protocols across five specific situations in 2022. Hackers have kept $6,44 million in total ransom payments. Some experts say that the payment of ransom to hackers amounts to giving into extortion, but nearly all agree that it’s much better to instate a bug bounty program ex ante facto. Immunefi currently offers $144 million in bounty rewards through Web3 projects listed on the platform. 

Aurora pays $6M bug bounty to ethical security hacker through Immunefi

Over $200 million worth of users’ funds could have been at risk if the whitehat had chosen to exploit the vulnerability for personal gain instead of reporting it to developers.

On Tuesday, Ethereum (ETH) bridging and scaling solution Aurora announced it had paid out a $6 million bounty to ethical security hacker pwning.eth, who discovered a critical vulnerability in the Aurora Engine. The exploit allegedly placed over $200 million worth of capital at risk. The sum was paid in collaboration with Immunefi, a leading platform for Web 3.0 bug bounties, with more than $145 million bounties available and over $45 million bounties paid out.

On April 26, Immunefi received a report from pwning.eth about a critical flaw in the Aurora Engine that would have enabled the infinite minting of ETH in the Aurora Ethereum Virtual Machine to drain and siphon the corresponding nested ETH (nETH) pool on NEAR. At the time of discovery, the pool contained more than 70,000 ETH, worth at least $200 million.

Mitchell Amador, founder and CEO at Immunefi, said: “Hats off to Aurora and pwning.eth for the flawless overall processing of the report. The bug was quickly patched, with no user funds lost.” Aurora had launched a bug bounty program with Immunefi just one week before discovering the security vulnerability. Meanwhile, Frank Braun, head of security at Aurora Labs, commented: “We look at the bug bounty program as the last step in a layered defense approach and will use this bug as a learning opportunity to improve earlier steps, like internal reviews and external audits.

Though arguably innovative, cross-chain communication protocols have been a prime target of hackers as of late. In February, one of the largest decentralized finance hacks occurred when the Wormhole token bridge was drained of over $321 million in digital assets after hackers exploited an infinite minting glitch between its wrapped ETH and ETH pool.