Circle and Tether bug bounties aren’t enough says LlamaRisk

LlamaRisk does note, however, that both Circle and Tether, aswell as Paywell, all operate as “centralized, full-reserve issuers,” with “robust” legal operations that would offset various security risks bug bounties are used to tackle.

In order for a bug bounty to attract skilled security researchers, LlamaRisk considers a minimum bounty of $50,000, which would scale based on the total value locked (TVL) at play.

“For protocols with TVL above $250 million, a maximum payout exceeding $1 million represents a sufficiently capitalized program,” LlamaRisk claims.

Bug bounties are becoming “de facto industry standards”

Bug bounties are offered to “white-hat hackers” as a means to incentivize ethical hackers to uncover software vulnerabilities. For instance, Coinbase launched a bug bounty program this year that aimed to secure its smart contracts, with rewards ranging from $5,000 for low-risk finds to $5 million for critical finds.

White hat hackers are asked to create a report on the hack, not disclose it to any third party, and must not exploit it in a malicious manner.

In some cases, however, a bounty is instead offered to a “bad actor” who steals funds from a company.

Indeed, last July, the crypto exchange GMX was hacked for $42 million. The exchange offered the hacker a 10% bounty, and eventually, the hacker began returning the funds in exchange for $5 million.