Bug Bounty Program v2

Beginning of this year we agreed to join Balancer’s Bug Bounty program with the following in-scope contracts:

• Vault
• WeightedPoolFactory
• WeightedPool2TokensFactory
• StablePoolFactory
• Authorizer

For any bug found in one of these contracts, the severity will determine how much of the bounty we match.

Our protocol uses more than just these contracts that are covered by the Balancer program. In addition to the contracts, the webapp as well as its backend are also key components of the system which need to be protected. In light of this, we propose to create our own bug bounty program together with the bug bounty platform immunefi.com. Immunefi is a bug bounty platform for blockchain projects and brings projects and hackers together, they are well-known in the industry and are used by many projects.

Our bug bounty program would have the following assets in scope: Contracts

• Beets Token
• MasterChef
• Timelock (MasterChef Owner)
• BeetsBar (fBEETS)
• MasterChef Operator

Website and applications https://.beets.fi https://.beets-ftm-node.com

These assets are currently all which make Beethoven-X Beethoven-X and they need to be protected.

The bug bounty program intends to offer the following rewards, based on severity:

Smart Contracts Critical 10% of value, max 500k, min 50k USD High 20k USD Medium 4k USD

Websites and Applications Critical 20k USD High 10k USD Medium 2k USD

Immunefi uses the following comprehensive mechanism to classify bugs into severities: https://immunefi.com/immunefi-vulnerability-severity-classification-system-v2-2/

In addition to the bounty that is paid to the bounty hunter, a 10% fee is to be paid to immuneifi.

Following are two examples:

The full draft of the program can be found here: https://docs.google.com/document/d/1_3ORSZwl8nS2Oyt6ih11zmwzlk4P3gSJfW9mM6B0R58

Widen the scope of the joint program with Balancer We approved BIP6 to join Balancers bug bounty program with the following contracts in scope:

• Vault
• WeightedPoolFactory
• WeightedPool2TokensFactory
• StablePoolFactory
• Authorizer

In the meantime, more contracts that are covered under balancers bug bounty program are also in use by Beethoven X, but are not in scope as per BIP6. I propose to change the scope of the joint program to: All Balancer v2 contracts which are part of the Balancer bug bounty program, that are also in use by Beethoven X are in scope. This also applies to any contract released in the future by Balancer and in use by Beethoven X

The pros:

• Makes the protocol safer
• Shows the industry that we are committed to safeguarding users
• Paying bounties results in less economic damage to the protocol if an exploit is disclosed

Cons:

• There are no obvious downsides