Incentive Model
Changelog
Jan 9th, 2024 - test new distribution algorithm, changes include:
Base share change from 10% to 5%
No more separate pool for informational issues
New weight of Critical: Medium: Low: Informational -> 64 : 16 : 4 : 1
How to Win More Rewards - Cheat Sheet
To maximize your rewards, consider the following strategies:
Find more critical bugs
Find Solo bugs that no other auditors find
Write a high-quality summary of the findings
Clear root cause or reproduce logic or PoC
Actionable fix proposal
Submit as many valid findings as possible
How do Secure3 Graders determine the reward?
Bug Categorization & Reward Share
Everyone who finds a valid bug will split 10% of the total rewards. Bugs are categorized as follows:
High, Medium, and Low: earn 81% of the reward pool
Informational: earn 9% of the reward pool
The rewards ratio of High, Medium, and Low findings is 4: 0.6: 0.4
Scoring System for Findings
Auditors' findings are rated on a scale of 0-3:
0: Not a bug.
1: Bug found, but no clear explanation or actionable fix provided.
2: Average quality.
3: Bug verified, with clear explanations, reproduction steps and actionable fix proposals.
Rewards for each bug are shared based on the score, ensuring that auditors who find the same bug split the reward according to their respective scores.
Reward Distribution Logic
The final reward you can get as an auditor will solely depend on three dimensions:
1. Reward Efforts
If nobody can find a single bug in an audit contest, every participant equally splits 10% of the total pool to reward your efforts.
We believe in the capabilities of our auditors and are confident that bugs will be discovered. Therefore, as long as you identify verified issues, you will be entitled to an equal share of the 10% base reward.
Example: If the total reward is $15,000 and there are 15 auditors who find verified bugs, each auditor will receive: Reward per auditor= $15000 * 10% / 15 = $100
2. Reward Severity
We reward your findings based on severity and quality. The performance portion (90% of the total reward) will be divided into two pools:
Critical/Medium/Low: 81%
Informational: 9%
For the definition of severity, please refer to Security Vulnerability Severity. Feedback on the severity level definition is welcomed!
As the total number of bugs found in each project varies, we define the ratio of earnings between Critical: Medium: Low bugs to be 4: 0.6: 0.4, and Informational bugs are equally divided by the number of findings.
Let's say there are in total of x critical bugs, y medium bugs, z low bugs, and i informational bugs found, the reward pool for each criticality is:
Criticalshare = TotalRewards * 81% * 4x / (4x + 0.6y + 0.4z)
Mediumshare = TotalRewards * 81% * 0.6y / (4x + 0.6y + 0.4z)
Lowshare = TotalRewards * 81% * 0.4z / (4x + 0.6y + 0.4z)
Infoshare = TotalRewards * 9%
Empirically, x < y < z << i.
3. Reward Quality of Findings
We value auditors who provide findings that are:
Unique: No one else found the same issue.
High quality: Includes a clear explanation of the root cause (or reproduction logic) along with an actionable fix plan.
Hence, to determine the reward for the quality of the finding, we have 2 layers of calculation:
Within the same findings
Within the same severity level
Within the Same Findings
To ensure trustworthy security audits and a competitive incentive model for auditors, we have established clear rubrics for evaluating the validity and quality of each bug. After submission, your findings will be reviewed and graded on a scale of 0-3:
0: The finding is NOT a bug.
1: The bug is found, but there are no clear or actionable suggestions provided.
2: Average quality—the finding meets some but not all quality criteria.
3: The finding is valid, with clear explanations, reproduction steps, and actionable fix proposals.
The severity of the bug will also be adjusted during the review. In cases where multiple auditors receive the same score, we guarantee that they will earn equal rewards.
Within the Same Severity Level
When the quality of suggestions does not merit a score of 3, we weigh individual findings based on the highest score received for that finding:
If there exist 3-point findings, reward weight w = 1.2.
If the highest point of all reported bugs on this finding is 2, w = 1.
If the highest point of all reported bugs on this finding is 1, w = 0.8.
In simpler terms, if your suggestions are the most concise and actionable, you have the potential to earn up to 50% more than those with less effective suggestions.
Last updated