Compound Finance 透過 Immunefi 推出 100 萬美元的漏洞賞金計劃

去中心化金融（DeFi）協議Compound Finance已經制定了增強安全性的雄心勃勃的計劃。此前，該公司最近利用 Immunefi 啟動了一項價值 100 萬美元的漏洞賞金計畫。

Decentralized finance (DeFi) protocol Compound Finance has set out on its ambitious plans to beef up security. This follows after it recently tapped Immunefi to launch a $1 million bug bounty program.

去中心化金融（DeFi）協議Compound Finance已經制定了增強安全性的雄心勃勃的計劃。此前，該公司最近利用 Immunefi 啟動了一項價值 100 萬美元的漏洞賞金計畫。

According to the announcement, which was shared via Immunefi’s Medium blog, the program seeks to make Compound’s algorithmic interest rate platform a lot safer. That is, by encouraging security experts to identify vulnerabilities. The interesting part would be that these experts also get to earn tangible rewards for their roles in securing the platform.

根據透過 Immunefi 的 Medium 部落格分享的公告，該計劃旨在使 Compound 的演算法利率平台更加安全。也就是說，透過鼓勵安全專家識別漏洞。有趣的是，這些專家還可以因其在保護平台方面所發揮的作用而獲得切實的獎勵。

Critical Vulnerabilities Could Earn Researchers Up to $1 Million in Bug Bounty Program

研究人員可透過漏洞賞金計畫為關鍵漏洞賺取高達 100 萬美元的獎金

In the announcement, Compound Finance detailed that the program will offer rewards that measure up to the level of risk identified. This means that the reward structure will be based on the severity of reported vulnerabilities.

在公告中，Compound Finance 詳細說明該計劃將提供與所識別的風險等級相符的獎勵。這意味著獎勵結構將基於報告的漏洞的嚴重性。

As classified under Immunefi’s Vulnerability Severity Classification System V2.3, there are four categories of risks. Therefore, there are also four reward categories.

根據 Immunefi 的漏洞嚴重程度分類系統 V2.3 的分類，風險分為四類。因此，獎勵類別也分為四種。

Starting from the smallest, the bounty program will reward low-level vulnerabilities (those with minimal risks) with $1,000. Then follows the medium-level vulnerabilities, where researchers who identify mid-tier issues can earn up to $5,000.

從最小的漏洞開始，賞金計畫將為低階漏洞（風險最小的漏洞）獎勵 1,000 美元。然後是中級漏洞，發現中級問題的研究人員可以獲得高達 5,000 美元的收入。

The next category is that of high-level vulnerabilities. Here is where issues like theft or freezing of funds occur and can earn experts between $10,000 to $50,000. The amount, however, will be determined by the potential damage and funds at risk.

下一類是進階漏洞。這裡是發生盜竊或凍結資金等問題的地方，專家可以獲得 10,000 到 50,000 美元的報酬。不過，具體金額將根據潛在損害和麵臨風險的資金來決定。

Lastly, there is the critical vulnerability level. This category rewards up to $1 million or 10% of affected funds, depending on whichever is lower. However, a minimum payout of $50,000 is guaranteed to encourage timely reporting of critical issues.

最後，還有嚴重漏洞等級。此類別的獎勵最高為 100 萬美元或受影響資金的 10%，以較低者為準。然而，保證至少支付 50,000 美元，以鼓勵及時報告關鍵問題。

Meanwhile, Compound has also acknowledged that there is a possibility for critical vulnerabilities to involve repeatable attacks. This is in situations where the compromised smart contract can not be paused or upgraded.

同時，Compound 也承認關鍵漏洞有可能涉及可重複的攻擊。這是在受損的智能合約無法暫停或升級的情況下。

In such instances, Compound confirms that it will calculate the reward based on the total cumulative damage to funds.

在這種情況下，Compound 確認將根據資金的累積損失總額來計算獎勵。

Payment in COMP Tokens, Says Compound Finance

複合金融表示，以 COMP 代幣支付

The bug bounty payments will be handled directly by the Compound DAO. Although these rewards are denominated in USD, Compound says payouts will be made in its native token COMP.

Bug 賞金付款將由Compound DAO 直接處理。儘管這些獎勵以美元計價，但Compound表示，支付將以其原生代幣COMP進行。

The company also addressed the issue of price volatility. It said that USD will be converted to COMP based on the average price listed on CoinMarketCap and CoinGecko at the time that the report is submitted.

該公司也解決了價格波動的問題。它表示，美元將根據提交報告時 CoinMarketCap 和 CoinGecko 上列出的平均價格轉換為 COMP。

Overall, Compound Finance’s bug bounty program appears to be a standout strategy. One that is bound to ensure that researchers are well motivated to disclose issues promptly and prevent avoidable damages.

總體而言，Compound Finance 的錯誤賞金計畫似乎是一項出色的策略。這必然會確保研究人員有充分的動機及時披露問題並防止可避免的損害。