PGM-20 : Bug Bounty Proposal by Hats Finance (Formerly PGP-20)

Summary

The direct losses from hacks and exploits between 2020-2022 are above $15B, and yet, the solutions currently being offered are not decentralized, permissionless, scalable, and continuous like Paladin is.

This is a proposal for Paladin to collaborate with Hats.finance to create an on-chain, free, and permissionless incentives pool for hackers/auditors to protect the Paladin smart contracts. The goal of the vault is to incentivize responsible vulnerability disclosure for Paladin. Liquidity can be added (with $PAL and/or yield-bearing tokens) permissionless and LPs will be rewarded with $HAT tokens once the liquidity mining program is launched.

Motivation

Project coverage:

  • Hats Finance provides an on-chain and free protocol for bug bounty programs.
  • A non-stop audit bounty with a proactive approach that incentivizes hackers to disclose vulnerabilities instead of exploiting the project
  • A disclosed vulnerability mitigates any TVL\ TOKEN loss
  • Permissionless vault — token holders and the protocol community can deposit or withdraw permissionless at any time.
  • Public relation regarding mitigated vulnerabilities and security becomes a strength of the project.
  • Attract more users that have high security requirements
  • Setting up a bug bounty on Hats dApp is free and takes less than one hour.

Hats Finance

Hats.finance is a on-chain decentralized bug bounty platform specifically designed to prevent crypto-hack incidents by offering the right incentives. Additionally, Hats.finance allows anyone to add liquidity to a smart bug bounty. Hackers can disclose vulnerabilities responsibly without KYC & be rewarded with scalable prizes & NFTs for their work.

Smart bug bounty programs are a win-win for everyone. They can be created easily with a few on-chain transactions (it takes less than 1 hour to set up a vault on Hats), and are free of charge. Hats will only charge a fee once an incident has been successfully mitigated. The protocol will retain 10% of the payout as fee from the security researcher. Scenarios of an exploit are way more costly and can cause irreversible damage. More importantly, the bounty program is transparent, decentralized, and gives power to the community of the project.

The key advantage of Hats solution compared to traditional, centralized bug bounty services:

  • Bug bounty vaults are loaded with the native or yield bearing token of each project. Reducing the free floating supply while giving the token additional utility.
  • Scalable bounty network — vault TVL increases with success / token appreciation of the project.
  • Open & Permissionless — Anyone can participate in the protection of an asset they are a stakeholder of and any hacker, anywhere in the world, can participate anonymously when disclosing exploits (no KYC needed)
  • In the future when providing liquidity(taking risk) every depositor could earn $HATS tokens.
  • Continuous — As long as tokens are locked in the vault, hackers are incentivized to disclose vulnerabilities through Hats, instead of exploiting the project.

Specification

In case that the proposal gets accepted, Paladin DAO is expected to:

1- Choose and set up a committee

2- Vote on the amount the DAO will contribute to the bug bounty program (How much $PAL or yield bearing assets to be used from the treasury for the initial deposit)

Onboarding action items:

  • Choosing a committee: The committee is preferably the public multisig contract of Paladin or a multisig specifically set up to manage the bounty program.
  • The Committees responsibility:
    • Triage incoming vulnerability reports/claims from auditors/hackers (get back to the reporter within 12 hours).
    • Approve claims within a reasonable time frame (Max. of 6 days)
    • Set up repositories and contracts under review. (A list of all contracts covered by the bounty program separated by severity)

Concluding Remarks

At Hats.finance, we envision a future in which a security marketplace acts as permissionless infrastructure for the crypto ecosystem. Considering how much Paladin cares about the security of the network and its operations, it is beyond any doubt that a bounty on Hats.finance will draw more attention from the white hat hackers and auditors to the smart contracts of Paladin. Accordingly, each scrutiny will contribute to the safety and security of Paladin.

References

We would love to see the discussion going in detail and get feedback on the proposal.

Thank you!

4 Likes

Gm, thanks for the proposal !
Do you have an estimation/usual amount committed by the projects for their Hat bounties please ?

Hey! Thanks for the support. We generally recommend 10% of the TVL for the bug bounty vault.

This proposal needs to be seen as an additional step forward in terms of decentralization.
Currently, the core team is sponsoring and over-seeing an ImmuneFi bounty on Paladin Lending. We’d like to have programs covering voth Quest and Boost.
Working with Hats Finance would enable Paladin to manage this as a DAO.

Seeing that we don’t have any TVL on these apps, I think we could start with a 250,000 PAL budget with the following tiers:

  • 150,000 PAL for Critical risk vulnerabilities;
  • 50,000 PAL for High risk vulnerabilities;
  • 10,000 PAL for Medium risk vulnerabilities;
  • 5,000 PAL for Low risk vulnerabilities;

I support this proposal

4 Likes

Sounds like a good approach.
I just wonder, how do you determine whether a vulnerability is critical, high risk, medium or low? Are all auditors more or less using the same set of criteria?

1 Like

Actually, the description and criteria for each severity is pre-set. You can check some descriptions on our dApp: Hats.finance - decentralized cybersecurity bug bounty protocol. Accordingly, the bounty is determined according to these description and criteria.

3 Likes

If no other comments arise, the vote will be put up tomorrow for a 250,000 PAL budget on Hats Finance covering the codebase of Warden Boost & Quest

5 Likes

Gn ! The proposal will be live on snapshot in 1h
https://snapshot.org/#/palvote.eth/proposal/0xf0194d6d976a0135a6c263fe0d07643a41de1dfd4a725673a1704458d3708d53

Ps: @Fav_Truffe can you rename your proposal PGP-20: Bug Bounty Proposal by Hats Finance please ?

1 Like

Hey @Dydymoon! Thanks a lot for the help. I am so sorry but i cannot find the edit part anywhere on the page. Might it be disabled for me?