Compound Finance 通过 Immunefi 推出 100 万美元的漏洞赏金计划

去中心化金融（DeFi）协议Compound Finance已经制定了增强安全性的雄心勃勃的计划。此前，该公司最近利用 Immunefi 启动了一项价值 100 万美元的漏洞赏金计划。

Decentralized finance (DeFi) protocol Compound Finance has set out on its ambitious plans to beef up security. This follows after it recently tapped Immunefi to launch a $1 million bug bounty program.

去中心化金融（DeFi）协议Compound Finance已经制定了增强安全性的雄心勃勃的计划。此前，该公司最近利用 Immunefi 启动了一项价值 100 万美元的漏洞赏金计划。

According to the announcement, which was shared via Immunefi’s Medium blog, the program seeks to make Compound’s algorithmic interest rate platform a lot safer. That is, by encouraging security experts to identify vulnerabilities. The interesting part would be that these experts also get to earn tangible rewards for their roles in securing the platform.

根据通过 Immunefi 的 Medium 博客分享的公告，该计划旨在使 Compound 的算法利率平台更加安全。也就是说，通过鼓励安全专家识别漏洞。有趣的是，这些专家还可以因其在保护平台方面所发挥的作用而获得切实的奖励。

Critical Vulnerabilities Could Earn Researchers Up to $1 Million in Bug Bounty Program

研究人员可通过漏洞赏金计划为关键漏洞赚取高达 100 万美元的奖金

In the announcement, Compound Finance detailed that the program will offer rewards that measure up to the level of risk identified. This means that the reward structure will be based on the severity of reported vulnerabilities.

在公告中，Compound Finance 详细说明该计划将提供与所识别的风险水平相匹配的奖励。这意味着奖励结构将基于报告的漏洞的严重性。

As classified under Immunefi’s Vulnerability Severity Classification System V2.3, there are four categories of risks. Therefore, there are also four reward categories.

根据 Immunefi 的漏洞严重程度分类系统 V2.3 的分类，风险分为四类。因此，奖励类别也分为四种。

Starting from the smallest, the bounty program will reward low-level vulnerabilities (those with minimal risks) with $1,000. Then follows the medium-level vulnerabilities, where researchers who identify mid-tier issues can earn up to $5,000.

从最小的漏洞开始，赏金计划将为低级漏洞（风险最小的漏洞）奖励 1,000 美元。然后是中级漏洞，发现中级问题的研究人员可以获得高达 5,000 美元的收入。

The next category is that of high-level vulnerabilities. Here is where issues like theft or freezing of funds occur and can earn experts between $10,000 to $50,000. The amount, however, will be determined by the potential damage and funds at risk.

下一类是高级漏洞。这里是发生盗窃或冻结资金等问题的地方，专家可以获得 10,000 到 50,000 美元的报酬。不过，具体金额将根据潜在损害和面临风险的资金来确定。

Lastly, there is the critical vulnerability level. This category rewards up to $1 million or 10% of affected funds, depending on whichever is lower. However, a minimum payout of $50,000 is guaranteed to encourage timely reporting of critical issues.

最后，还有严重漏洞级别。此类别的奖励最高为 100 万美元或受影响资金的 10%，以较低者为准。然而，保证至少支付 50,000 美元，以鼓励及时报告关键问题。

Meanwhile, Compound has also acknowledged that there is a possibility for critical vulnerabilities to involve repeatable attacks. This is in situations where the compromised smart contract can not be paused or upgraded.

同时，Compound 也承认关键漏洞有可能涉及可重复的攻击。这是在受损的智能合约无法暂停或升级的情况下。

In such instances, Compound confirms that it will calculate the reward based on the total cumulative damage to funds.

在这种情况下，Compound 确认将根据资金的累积损失总额来计算奖励。

Payment in COMP Tokens, Says Compound Finance

复合金融表示，以 COMP 代币支付

The bug bounty payments will be handled directly by the Compound DAO. Although these rewards are denominated in USD, Compound says payouts will be made in its native token COMP.

Bug 赏金付款将由Compound DAO 直接处理。尽管这些奖励以美元计价，但Compound表示，支付将以其原生代币COMP进行。

The company also addressed the issue of price volatility. It said that USD will be converted to COMP based on the average price listed on CoinMarketCap and CoinGecko at the time that the report is submitted.

该公司还解决了价格波动的问题。它表示，美元将根据提交报告时 CoinMarketCap 和 CoinGecko 上列出的平均价格转换为 COMP。

Overall, Compound Finance’s bug bounty program appears to be a standout strategy. One that is bound to ensure that researchers are well motivated to disclose issues promptly and prevent avoidable damages.

总体而言，Compound Finance 的错误赏金计划似乎是一项出色的策略。这必然会确保研究人员有充分的动力及时披露问题并防止可避免的损害。