Evmos

Security

Cosmos

Web3 bug bounty platform Immunefi issued a 90-day suspension on white hat security firm Trust Security. The decision was made after the latter accused Immunefi of unjust denial of bug bounty payment for discovering a critical bug that could potentially lead to the theft of funds.
On Nov. 12, Trust Security revealed on X that its bounty team identified a critical theft-of-funds vulnerability on a forked mainnet of an unidentified project.&nbsp;
The proof-of-concept of the vulnerability was shared with Immunefi, which acts as a mediator between the white hats and projects to ensure bounty payments are made on credible bug identifications.
<h2 id="critical-bug-dismissed-as-out-of-scope-report">Critical bug dismissed as “out of scope” report </h2>
However, the project claimed that Trust Security detected an out-of-scope bug, which would effectively disqualify the white hats from earning bounty rewards.&nbsp;
<figure>
 <img alt="Immunefi suspends TrustSec amid bug bounty dispute" src="https://s3.cointelegraph.com/uploads/2024-11/01932479-51c1-703f-b551-e5590ae04892" title="">
 <figcaption style="text-align: center;">
 Source: <a data-ct-non-breakable="null" href="https://x.com/trust__90/status/1856356982766063847" rel="null" target="null" text="null" title="https://x.com/trust__90/status/1856356982766063847">Trust</a>
 </figcaption>
</figure>
According to Trust, Immunefi wrongly sided with the project’s “nonsense argument” and offered a “tiny goodwill bounty” instead of the full reward for identifying critical bugs.
<h2 id="immunefi-threatens-a-permanent-ban-on-trustsec">Immunefi threatens a permanent ban on TrustSec</h2>
Immunefi rebutted Trust’s claims of unjust payout and issued a 90-day suspension for “mischaracterizing the issues at hand.” The bug bounty platform also threatened to permanently ban Trust if it repeated the infraction.
<figure>
 <img alt="Immunefi suspends TrustSec amid bug bounty dispute" src="https://s3.cointelegraph.com/uploads/2024-11/01932479-a20c-76e4-833f-8e75c1e1632e" title="">
 <figcaption style="text-align: center;">
 Source: <a data-ct-non-breakable="null" href="https://x.com/immunefi/status/1856400499156594823" rel="null" target="null" text="null" title="https://x.com/immunefi/status/1856400499156594823">Immunefi</a>
 </figcaption>
</figure>
Immunefi stood firm in supporting the project:
<blockquote>
 “In this case, we agreed with the project because the issue was absolutely out of scope according to our standard rules. The project was generous to offer a bounty at all.”
</blockquote>
However, Trust rejected the goodwill bounty as accepting it would legally prevent them from publishing the details without approval, adding, “We rather expose the scam and warn hackers than having a few extra Ks in our pocket.”
Related: <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/near-patche-web3-ping-vulnerability" rel="null" target="null" text="null" title="null">Near patches critical bug that could crash every node on the network</a>
Additionally, Trust urged for greater transparency and openness:
<blockquote>
 “We’re going public because the shady, ultra-secretive behavior we’re seeing from projects and some bounty platforms goes directly against the Web3 ethos and the white hat community.”
</blockquote>
Some crypto community members on X questioned Immunefi’s decision to impose a ban on Trust instead of engaging in a constructive dialogue.
Immunefi did not respond to Cointelegraph’s request for comment.
In October, <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/evmos-bug-bounty-reward-150k-security-researcher" rel="null" target="null" text="null" title="null">EvmosBlockchainn paid a $150,000 bounty reward</a> to a security researcher who identified a critical bug by reading the Cosmos Network documentation.
<figure>
 <img alt="Immunefi suspends TrustSec amid bug bounty dispute" src="https://s3.cointelegraph.com/uploads/2024-11/0193247e-e90a-7955-bebd-1769cbdf480b" title="">
 <figcaption style="text-align: center;">
 Evmos bug bounty payout system. Source: Evmos
 </figcaption>
</figure>
According to the pseudonymous Spearbit security researcher jayjonah.eth, the critical bug could have halted the Evmos blockchain and all decentralized applications built on it.
 Magazine: <a data-ct-non-breakable="null" href="https://cointelegraph.com/magazine/tokenization-projects-transforming-farmers-lives-africa/" rel="null" target="null" text="null" title="null">Real life yield farming: How tokenization is transforming lives in Africa</a>

Immunefi suspends TrustSec amid bug bounty dispute

Table of Contents

Cointelegraph

Other articles published on Nov 13, 2024

XRP Community Witnesses Significant Market Movements

Ethereum Inflows Surge, But Treasury Yields Might Hold Back Altcoins

VeChain’s 42% Rally Raises Hopes for 10-Cent Milestone – What’s Next for VET?

Will Bitcoin Price Rise After CPI Data?

Top 3 Altcoins to Soar in Trump’s Economic Boom

$100K Bitcoin? 9 analysts share their end-of-year BTC price predictions

Join our free newsletter for daily crypto updates!