Abstract
This proposal rewards a whitehat researcher, 1nc0gn170 (0xCccbB73ea22c9749D22089Ee617bd715b143b63D), who identified several bugs — including critical ones — in DAO protocol contracts and disclosed them unconditionally, without demands. Findings: (1) 1/4 Power Attack — a multi-option Delta proposal could be constructed so a malicious option executed regardless of the vote outcome, because no "none of the above" (NOTA) option was required; fixed by always including NOTA in Delta proposals. (2) Double Fee Collection — the CTM token, built on CTMERC20 with its cross-chain transfer mechanism, burned the amount and then took a fee, so a portion of CTM vanished between transfers; fixed. (3) No Vote Win — a Delta proposal declaring more winning options than were voted on still executed an unvoted-for option as a winner; fixed. The disclosure prompted DAO maintainers to run further internal audits, and correspondence with QuillAudit revealed further bugs via their QuillShield tool. The reward is 25,000 CTM locked 4 years as veCTM.
Motivation
Timely, no-strings disclosure protected the DAO from flaws in both its governance machinery and its token. Bug 1 was a voting-manipulation vector in the DAO's own proposal system; bug 2 silently destroyed CTM in transit. Rewarding this work states plainly that security research is valued as the DAO's public good, and that the DAO intends to keep a proven, good-faith contributor — the kind of person we wish to keep as a contributor. Paying in 4-year veCTM rather than liquid CTM gives him an aligned long-term stake in the DAO instead of a one-off payout.
Overview
This proposal originates from the committee (core contributors).
Type
Treasury. The action transfers 25,000 CTM of value to the whitehat's wallet on Linea.
Scope
The governor approves veCTM (0x221EC90B3B083A8501A37bdeb7035CeaedF3C31f) to spend 25,000 CTM.
The governor calls create_lock_for(25000e18, 125798400, 0xCccbB73ea22c9749D22089Ee617bd715b143b63D) on veCTM, creating a 4-year veCTM NFT owned by 1nc0gn170.
Public record linking the reward to github.com/ContinuumDAO/vectm/issues/5.
Success Criteria
N/A: the disclosure of the bugs has already been done. The observable completion signal for this proposal is a veCTM NFT for 25,000 CTM / 208 weeks owned by 0xCccb…b63D.
Timeline
Immediate upon execution.
Budget
25,000 CTM (25000e18), from existing DAO holdings at the governor; no new issuance.
Community discussion
The Ideas & Suggestions stage is intentionally omitted; this is a proposal from a committee KeyGen, the preferred KeyGen on this node.
Reference
The fixes are public and accessible on our GitHub at https://github.com/ContinuumDAO/vectm/issues/5
