James Cirrone

LayerZero, a cross-chain messaging protocol, has established a bug bounty with a maximum reward of $15 million alongside partner Immunefi.



That number surpasses MakerDAO’s bug <a href="https://immunefi.com/bounty/makerdao/">bounty</a>, which offered a maximum of $10 million after launching in February 2022.



<a href="https://blockworks.co/tag/layerzero">LayerZero</a> will reserve the maximum bounty reward for those who find vulnerabilities at the “highest severity level,” and it will be paid out for each new bug found by participants.



LayerZero’s decision to partner with Immunefi mirrors the thinking of other prominent projects who have adopted the Web3 platform for their own bug bounties, including MakerDAO, Compound and Chainlink. Immunefi <a href="https://blockworks.co/news/framework-makes-its-largest-single-bet-yet-on-immunefi">raised $24 million in its Series A round</a> back in September 2022 and now <a href="https://immunefi.com/">claims</a> to have paid out over $75 million in bounties.&nbsp;



Immunefi’s terms for LayerZero’s bounty are <a href="https://immunefi.com/bounty/layerzero/">public</a> and outline the rewards by “threat level” and by “groups.” Group 1 includes the chains Ethereum, BNB Chain, Avalanche, Polygon, Arbitrum, Optimism, and Fantom, while Group 2 is for every other chain out there.&nbsp;



The highest threat level for bugs is “critical,” as defined by Immunefi. For smart contracts, a critical threat entails voting manipulation in governance proposals, direct theft of user funds and NFTs, among a host of other things.



According to Immunefi’s terms, “Critical smart contract vulnerability payouts for Group 1 are a minimum of USD $250,000, or 10% of the value at risk at the time of report submission, with a hard cap of USD $15,000,000, whichever is larger. Value at risk should be calculated primarily (though not exclusively) based on concrete and demonstrable funds at risk.”



For Group 2, the minimum payout is $25,000 or, again, 10% of the value that’s at risk. The cap is $1.5 million. 



Importantly, smaller payouts are up for grabs for lower threat bugs that participants are able to find. The lowest minimum prize is $1,000.



Supplementary rewards beyond minimum payouts or the 10% metric is “at the discretion of the team.”



Additionally, know-your-customer is needed to participate in this bounty. That means to get paid, you’ll have to send an invoice with your name, address and payment instructions. A government identification and an Office of Foreign Assets Control (OFAC) screening are also required. 



Blockworks reported in April that LayerZero <a href="https://blockworks.co/news/layerzero-locks-down-funding">secured $120 million in funding</a> to expand into the Asia-Pacific region’s gaming sector, boosting the company’s valuation to $3 billion.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.

LayerZero, Immunefi Offer Bug Bounty With $15M Max Payout

Bessie Liu

<div id="highlights-block_632c547e14184" class="highlights">
 <ul>
 <li>Most recently Immunefi facilitated a 400 ETH transaction from Arbitrum to a white hacker</li>
 <li>Investors that participated in the round include Electric Capital, Polygon Ventures and Samsung Next</li>
 </ul>
 
</div>



Immunefi, a Web3 bug bounty platform adopted by prominent projects including MakerDAO, Compound and Chainlink, has secured a $24 million Series A led by Framework Ventures.



Framework Ventures previously led Immunefi’s seed round in May last year, but the latest round will be the largest check the prominent venture capital firm has ever publicly written, Roy Learner, principal at Framework Ventures said in a statement.



“As it stands, Immunefi is by far and away the most widely adopted solution in the crypto security and bug bounties space,” Learner said. “We’re excited to see the company scale and amass talent as more and more key projects onboard into their ecosystem.”



Other investors that participated in the round include Electric Capital, Polygon Ventures and Samsung Next.



Mitchell Amador, co-founder of Immunefi came up with the idea for the company after losing a significant amount of money to smart contract hacks.



“There is a whole world that is enabled by [blockchain] technology and it can not exist without security…we mapped the whole stack and concluded that the most critical piece, which the space will not solve on its own, is the disclosure layer — the 911,” Amador said.



The security company rewards white hat hackers for reviewing blockchain projects and disclosing vulnerabilities — creating monetary incentives for experts to make dapps safer. It currently boasts a community of over 11,000 developers, auditors, CTOs and hackers.



According to Amador, rewards can range from a few thousand dollars to upwards of millions of dollars for a single bug report.



<blockquote class="wp-block-quote">“If you do good for the community, not only will you become rich, but you will also become a hero,” Amador said.</blockquote>



Immunefi has previously facilitated a $10 million bug bounty payment for a vulnerability discovered in the cross-chain messaging solution Wormhole, and a $6 million exposure discovered on a bridge and scaling solution Aurora.&nbsp;



Most recently, Arbitrum, a layer-2 Ethereum scaling solution, <a href="https://cms.blockworks.co/arbitrum-saved-from-major-eth-loss-by-white-hat-hacker/" target="_blank" rel="noreferrer noopener">paid 400 ETH</a> (almost $550k USD) to a white hat hacker through Immunefi as a reward for uncovering a vulnerability.



The latest fundraise will be going toward growing the Immunefi team, Amador said.&nbsp;



“We need better technical expertise — we cannot keep up with the level of activity,” Amador said. “We just need more people.”



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.

Framework Makes its Largest Single Bet Yet on Immunefi

Sebastian Sinclair

<div id="highlights-block_62ce137fc3889" class="highlights">
 <ul>
 <li>DeFi hacks totaled more than $1.2 billion for the first quarter of this year alone, significantly more than Q1 2021, according to recent data</li>
 <li>While the DeFi sector&#8217;s security appears bleak, Immunefi&#8217;s CEO told Blockworks the situation was improving</li>
 </ul>
 
</div>



Hacks against decentralized finance protocols have increased almost eightfold when compared to the first quarter of last year, according to DeFi bug bounty platform Immunefi.



In Q1 of this year alone, over $1.22 billion has been identified as having been stolen or rugged from budding protocols. That&#8217;s a 7.9 times increase when compared to some $154.6 million in stolen funds for the same period in 2021, research from Immunefi&#8217;s quarterly <a href="https://assets.ctfassets.net/t3wqy70tc3bv/50AVQU4PoO8DORKFpbFZMi/4dc973e6d273f78b6ea0b8663f2b9645/Immunefi_Crypto_Losses_-_Q1_2022.pdf" target="_blank" rel="noreferrer noopener">crypto losses report</a> shows.



More than 77% of the $1.22 billion figure stems from the <a href="https://cms.blockworks.co/sky-mavis-ronin-network-bridge-exploited-for-over-600m/" target="_blank" rel="noreferrer noopener">Ronin Network&#8217;s</a> $625 million hack — the Ethereum-linked sidechain used for blockchain game <a href="https://cms.blockworks.co/tag/axie-infinity/" target="_blank" rel="noreferrer noopener">Axie Infinity</a> — in March and blockchain bridge <a href="https://cms.blockworks.co/in-second-largest-defi-hack-ever-blockchain-bridge-loses-320m-ether/#:~:text=Wormhole%2C%20one%20of%20the%20largest,in%20a%20tweet%20Wednesday%20evening." target="_blank" rel="noreferrer noopener">Wormhole&#8217;s</a> $326 million hack in February.



The numbers might look bad on the surface, but Immunefi said it&#8217;s not as bad as it seems.



<blockquote class="wp-block-quote">&#8220;The most important thing to keep in mind is that although things look bad, they are in fact getting better and better on the security side,&#8221; Immunefi&#8217;s CEO Mitchell Amador told Blockworks in an interview.</blockquote>



&#8220;Audits have become a stronger standard, every DeFi project is getting audits. You&#8217;re having formal character verification becoming the biggest standard. Almost everybody is running bug bounty programs,&#8221; Amador said.



The second quarter this year has seen less-severe hacks against protocols. Amador said the $100 million theft on Harmony&#8217;s cross-chain bridge <a href="https://cms.blockworks.co/defi-cross-chain-horizon-bridge-hacked-for-100m/" target="_blank" rel="noreferrer noopener">Horizon</a> and algorithmic stablecoin protocol <a href="https://cms.blockworks.co/algo-stablecoin-protocol-beanstalk-cut-down-by-governance-hijack/" target="_blank" rel="noreferrer noopener">Beanstalk&#8217;s</a> $180 million loss were outliers.



&#8220;We didn&#8217;t see any kind of dramatic event,&#8221; Amador said comparing to the ongoing liquidity crisis, lender contagion and sector-related layoffs impacting the wider industry. 



<blockquote class="wp-block-quote">&#8220;There were some close calls in things that could have happened. Bug reports that came through on consensus vulnerabilities that we saw on layer-1 blockchains but these were all successfully patched,&#8221; Amador added.</blockquote>



Despite the progress, though, the threat is not diminishing.



&#8220;This [continuous hacks] is fundamentally an unsolvable problem,&#8221; the Immunefi CEO said. &#8220;We knew things were going to go in this direction. The volatility is a part of crypto, the amount of money flowing in was going to increase. The number of people with the skills was going to increase, it needs an outlet.&#8221;



Compared to global trends, even a couple of billion dollars is a drop in the proverbial bucket, however. 



Recent <a href="https://onfido.com/resources/blog/what-s-the-true-cost-of-fraud-5-must-knows-for-anti-fraud-strategies" target="_blank" rel="noreferrer noopener">estimates</a> of global losses solely from payment fraud are around $32.4 billion. The global market for fraud detection and prevention is <a href="https://www.researchandmarkets.com/reports/4804869/fraud-detection-and-prevention-global-market" target="_blank" rel="noreferrer noopener">in the order of</a> $25 billion this year — not the fraud itself, but just trying to stop it.



Cybercrime as a whole will <a href="https://cybersecurityventures.com/hackerpocalypse-cybercrime-report-2016/" target="_blank" rel="noreferrer noopener">cost the world</a> around $6.9 trillion in 2022, according to consultant Cybersecurity Ventures. So even if DeFi exploits net $3.5 billion by year&#8217;s end, it would represent 0.05% of the global cybercrime haul.



<h3 class="wp-block-heading">Guard duty</h3>



Immunefi, which views its business and function as a type of human immune system battling viruses, has grown to become the sector&#8217;s largest bug bounty platform, offering rewards to white hat hackers who identify vulnerable code.



Whitehats, as opposed to blackhats, attempt to identify security vulnerabilities for a given project and collect a reward for bringing it to attention. Black hats, meanwhile, are those with nefarious intent, often engaging in theft.



Immunefi&#8217;s bug bounty program offers white hats a chance to accept a reward — upwards of millions of dollars — review the code for potential bugs within a scope, submit their findings and get paid.



The platform, less than two years old, says it safeguards platforms housing cryptoassets worth more than $100 billion, including from the likes of Polygon, Chainlink and SushiSwap, among <a href="https://immunefi.com/" target="_blank" rel="noreferrer noopener">others</a>.



When asked about the possibility of missed bugs and vulnerabilities resulting from a narrow scope within a bug bounty contract, Amador said the only way to deal with the issue was to broaden the bounty program as much as possible.



&#8220;You can&#8217;t totally get rid of [missed bugs] but you can partially get rid of that by looking at prioritizing impact, rather than out of scope or in scope,&#8221; he said. &#8220;The real thing most of these projects care about is material impact.&#8221;



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.

DeFi Exploits Top $1.8B YTD, Though Security ‘Getting Better’ Immunefi Says

<div id="highlights-block_629fb10800a8f" class="highlights">
 <ul>
 <li>No user funds were lost or stolen before the loophole was discovered</li>
 <li>Up to $200 million worth of Aurora users’ funds could have been hacked if this bug wasn’t fixed</li>
 </ul>
 
</div>



It was almost the next market-moving DeFi hack.&nbsp;



Aurora, an Ethereum Virtual machine built on the NEAR Protocol, recently paid a $6 million reward to a so-called white hat hacker for identifying a key bug. 



The hacker, known as pwning.eth, uncovered in April a critical vulnerability in Aurora’s system, which could have jeopardized up to $200 million of funds. Virtual machines power smart contracts, or transactions executed in code on the blockchain without intermediaries, on Ethereum. Aurora paid the bounty through the Immunefi platform. 



It marks one of the largest-ever known bounty payouts in DeFi (decentralized finance) history. Last month, crypto bridge Wormhole — which connects different blockchains — <a href="https://www.theblockcrypto.com/post/148085/wormhole-announces-10-million-bug-bounty-payout" target="_blank" rel="noreferrer noopener">paid</a> $10 million to an ethical security hacker that also discovered a bug through Immunefi’s platform.



<blockquote class="wp-block-quote">“Such a vulnerability should have been discovered at an earlier stage of the [defense] pipeline and we have already started improving our methods to achieve that in the future,” Frank Braun, Aurora’s head of security, said in a statement Tuesday. </blockquote>



Added Braun: “However this event ultimately proves that our security mechanisms work.”



The bug was initially flagged via Immunefi — crucially, before any funds were stolen. <a href="https://immunefi.com/bounty/aurora/" target="_blank" rel="noreferrer noopener">Aurora&#8217;s bounty program</a> with Immunefi was launched in April 2022, with rewards ranging from $1,000 to $6 million, depending on severity. 



Jonah Michaels, a spokesperson for Immunefi, told Blockworks that at “a time of distrust in the markets, it’s important more than ever for Web3 projects to show that they take security seriously.”



On Immunefi’s platform, security researchers review code and disclose vulnerabilities. Through its programs with DeFi projects, Immunefi said it paid over $40 million in bounties to friendly hackers — claiming to have prevented over $20 billion in potential damages.



Aurora’s goal is to provide application developers the means to operate on Ethereum-compatible platforms under the governance of the decentralized Aurora DAO. Aurora’s scaling solution is currently responsible for $373 million of NEAR’s $786 million in total value locked, <a href="https://defillama.com/chain/Aurora?currency=USD" target="_blank" rel="noreferrer noopener">according to data provider DefiLlama</a>.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.