Should we renew the Immunefi Matching Bug Bounty Program w/ $600k in total funding?

This proposal seeks a renewal of the Immunefi Matching Bug Bounty Program with the following requirements and terms:

1. Projects with an active bug bounty program on Immunefi.

2. Provide matching for bug bounties with a critical threat level rating.

3. Cap maximum total payouts at $600k but allow matching up to $600k for projects with greater than $8m in active cover; for projects with active cover between $2m and $8m, the matching bounty will be capped at $200k per bounty payout.

4. Matching ratio will adjust from $1 in matching for every $1 offered as a critical bug bounty (1:1) to $0.50 in matching for every $1 offered as a critical bug bounty (0.5:1)–would create a greater incentive for projects to increase the size of their critical bounty payouts, so long as there is demand for cover on Nexus Mutual.

Matching bug bounty payouts deliver cost effective value to members when the matching payout is less than potential claim payouts on a certain percentage of a project’s active cover amount.

Not all loss events lead to a 100% claim rate. While data on past claim events is thin, members can assume a matching bug bounty is most cost effective when estimated as a percentage of 10% to 40% of the active cover amount for a project.

Proposed matching terms are as follows:

• Cap maximum payouts at $200k (or the remaining funding) for projects with active coverage in the $2m to $8m range; and
• Cap maximum payouts at $600k (or the remaining funding) for projects with greater than $8m in active coverage

Members will be able to select one of the following options for this proposal:

• Option A: Renew the program; allocate $600k in total payouts; 0.5-to-1 matching payouts up to $600k for projects with active cover >$8m; 0.5-to-1 matching bounty payout up to $200k for projects with active cover between $2m to $8m.
• Option B: Renew the program; allocate $600k in total payouts; 1-to-1 matching payouts up to $200k for projects with active cover >$2m
• Option C: Do not renew the program; deny request for further funding

Members can read the full proposal on the forum: Immunefi Matching Bug Bounty Proposal