<aside> 💡 This is a space to compile all the information and processes regarding the Bug Bounty programs our Threshold DAO has with Immunefi.

</aside>

Immunefi Program General Overview

Our DAO, representing our commitment to fortifying the security of our products, has launched 2 Bug Bounty programs in collaboration with Immunefi.

The first program, as approved through TIP-041 in a Snapshot vote by the DAO, launched officially on April 28th, 2023. The scope of this Bug Bounty is to protect Threshold’s products, i.e., the Threshold Network DAO contracts and the tBTC product. This can be expanded in the future to hold additional products of the network, e.g., TACo.

Our second program, approved through TIP-059 in a Snapshot vote, launched officially on October 5th, 2023. The aim of this dedicated Bug Bounty is to protect the Threshold USD product.

Request for Comments: Immunefi Bug Bounty Process and Ownership

TIP-041: Establish a Bug Bounty Program for Threshold’s Products

TIP-059: Establish a Bug Bounty Program for thUSD

Threshold Network DAO Expectations and Responsibilities

Threshold Network’s Team Expectations and Responsibilities

To best run your Bug Bounty Program, we need you to:

• Keep Immunefi updated with changes in key points of contacts or critical personnel departures, to ensure maximum security
• Keep assets in scope and new bugs discovered updated; outdated programs will result in poor experiences for both you and the security community, decreasing user trust
• Monitor the Immunefi Dashboard and Telegram Support Channel for escalations, so that you can receive and resolve vulnerabilities in a timely and respectful manner
• Determine the validity of a vulnerability report, including the functioning of relevant proofs of concept (PoCs)
• Determine if suggested fixes work; Immunefi is not an audit firm and will not provide guidance on fixes or affirm the safety of vulnerability mitigations
• Timely triaging of reports according to our SLAs, to ensure a good user experience and maximize trust from the security community