Pay Whitehat veCTM Reward for Findings
-
Abstract
This proposal rewards a whitehat researcher, 1nc0gn170 (
0xCccbB73ea22c9749D22089Ee617bd715b143b63D), who identified several bugs — including critical ones — in DAO protocol contracts and disclosed them unconditionally, without demands. Findings: (1) 1/4 Power Attack — a multi-option Delta proposal could be constructed so a malicious option executed regardless of the vote outcome, because no "none of the above" (NOTA) option was required; fixed by always including NOTA in Delta proposals. (2) Double Fee Collection — the CTM token, built on CTMERC20 with its cross-chain transfer mechanism, burned the amount and then took a fee, so a portion of CTM vanished between transfers; fixed. (3) No Vote Win — a Delta proposal declaring more winning options than were voted on still executed an unvoted-for option as a winner; fixed. The disclosure prompted DAO maintainers to run further internal audits, and correspondence with QuillAudit revealed further bugs via their QuillShield tool. The reward is 25,000 CTM locked 4 years as veCTM.Motivation
Timely, no-strings disclosure protected the DAO from flaws in both its governance machinery and its token. Bug 1 was a voting-manipulation vector in the DAO's own proposal system; bug 2 silently destroyed CTM in transit. Rewarding this work states plainly that security research is valued as the DAO's public good, and that the DAO intends to keep a proven, good-faith contributor — the kind of person we wish to keep as a contributor. Paying in 4-year veCTM rather than liquid CTM gives him an aligned long-term stake in the DAO instead of a one-off payout.
Overview
This proposal originates from the committee (core contributors).
Type
Treasury. The action transfers 25,000 CTM of value to the whitehat's wallet on Linea.
Scope
- The governor approves veCTM (
0x221EC90B3B083A8501A37bdeb7035CeaedF3C31f) to spend 25,000 CTM. - The governor calls
create_lock_for(25000e18, 125798400, 0xCccbB73ea22c9749D22089Ee617bd715b143b63D)on veCTM, creating a 4-year veCTM NFT owned by 1nc0gn170. - Public record linking the reward to
github.com/ContinuumDAO/vectm/issues/5.
Success Criteria
N/A: the disclosure of the bugs has already been done. The observable completion signal for this proposal is a veCTM NFT for 25,000 CTM / 208 weeks owned by
0xCccb…b63D.Timeline
Immediate upon execution.
Budget
25,000 CTM (25000e18), from existing DAO holdings at the governor; no new issuance.
Community discussion
The Ideas & Suggestions stage is intentionally omitted; this is a proposal from a committee KeyGen, the preferred KeyGen on this node.
Reference
The fixes are public and accessible on our GitHub at https://github.com/ContinuumDAO/vectm/issues/5
- The governor approves veCTM (
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login