Take back remaining whitehat bounty to compensate exploit losses

Summary

Ethereum Cream depositors experienced a total loss after the October 2021 exploit. Whitehats from the AMP exploit recovery have already received 12.5% of recovered funds. It’s time to recover this bounty and put it toward compensating exploit losses from the October 2021 exploit.

Action

FOR: Cream Team must stop payment to whitehats named “Lossless/ Pascal” and distribute remaining, 1932.15 ETH, to all impacted depositors on Ethereum Cream based on percentage of Supply - Borrowed assets valued at October 28, 2021, excluding crETH2 deposits.

AGAINST: Cream Team makes no change and pays out the remaining 1932.15 ETH to the whitehats named “Lossless/ Pascal”.

Background

In August 2021, Cream Ethereum was exploited. Two “whitehat” groups emerged, with the first earning 10% bounty and the second earning 50% of the remaining 90% of returned funds. Standard industry bounty for whitehat is 10%. Condition for 50% bounty according to the blog post required “leading to the arrest and prosecution” of the perpetrators - none of this ever happened yet somehow we as a protocol honored a 50% bounty without a vote.

In October 2021, another exploit happened that made the Cream Ethereum system to become insolvent, leaving depositors in a total loss scenario. Then the team gave back everything they got back- yearn yCRV recovered and the crETH2 rugged back from the exploiter. Plus they gave up all of their team vesting and treasury tokens.

Everyone got hurt - token holders, team, depositors. Just not these whitehats.

According to Cream Dev: The current agreement is a 50% bounty of recovered funds to the whitehats in Lossless/ Pascal from the AMP exploit from August 2021. The bounty is being paid out over a 2 year period linearly:

• Recovered funds: 5152.5 ETH
• 50% bounty: 2576.25 ETH
• Payments for 6 months so far: 644.1 ETH
• Remaining for this bounty: 1932.15 ETH

Motivation

To find all available funds to use toward recouping losses for depositors.

Rationale

Industry standard is 10% of recovered funds for whitehats. We have already overpayed these second set of whitehats by giving them 12.5% of recovered funds. Plus they did not meet the conditions of “leading to the arrest and prosecution” of the perpetrators.