@taichiaudit Founder | Whitehat doing mediations @Immunefi | Core Member @DeFiHackLabs
GMT+8
Joined January 2018
- Tweets3.1K
- Following3.9K
- Followers2.6K
- Likes8.4K
A very stupid feature because each submission is endorsed by a user deposit, rate limiting is pointless
20 studio dup check 75 submission 250 mediation flip wrong triage and another 250 flip protocol closing for private known issue
馃槀I will be very surprised if any of them is paid. Under this bug density the protocol will go bankrupt soon
Unfortunately I had one very similar case on cantina today lol, an unfixed critical marked duplicate and it shows the original report was rejected and I can't see the details.... Again I am very confused but that's the norm of beg bounty now, moving on to next target
Update: Immunefi upheld the duplicate closure.
Their own fix-bypass policy says a bug that wasn't effectively fixed should be reported.
That's exactly what I did. The PoC in my report still works after the attempted fix.
Yet their mediation response didn't even mention the fix-bypass policy.
So what's the point of having it?
Why would any whitehat spend time checking whether a fix actually works if the answer is still "duplicate, no reward"?
I thought Immunefi was supposed to keep this fair.
Instead, they're keeping their clients happy.
Private known issue means you reported so they know it now, if you disagree just pay another 250 bucks and Mr.J will run prompt "find an execuse to close this mediation" and respond to you within 30 minutes
In my experience only one specific mediator is fair and others just use pure ai and the prompt is "find an excuse to close this mediation"
In current bb situation this is a good outcome already, many malicious programs won't even pay or at least downgrade more than one levels
Submitted 2 High severity bounty reports to Cantina and let's see how it goes馃槣Wish me luck and mental health