# Polkadot Summit 24' - Community Bug Bounty

**URL:** <https://forum.polkadot.network/t/polkadot-summit-24-community-bug-bounty/7206>\
**Category:** Ecosystem\
**Tags:** polkadot-summit\
**Created:** [April 3, 2024, 4:10pm UTC](https://forum.polkadot.network/t/polkadot-summit-24-community-bug-bounty/7206 "2024-04-03T16:10:36Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Remy\_Parity](https://dub1.discourse-cdn.com/flex005/user_avatar/forum.polkadot.network/remy_parity/32/1873_2.png) [@Remy\_Parity](https://forum.polkadot.network/u/Remy_Parity)\
**Post date:** [April 3, 2024, 4:10pm UTC](https://forum.polkadot.network/t/polkadot-summit-24-community-bug-bounty/7206/1 "2024-04-03T16:10:36Z")

</div>

# Community Bug Bounty

Hi all, please see below a write up from one of the Polkadot Summit sessions that was held in Bangkok in 2024.  
You can use the #polkadot-summit tag to see all the other posts, and navigate to the [summary post](https://forum.polkadot.network/t/polkadot-summit-asia-2024/7178) for a recap of the event.

11th March 2024 / POLKADOT SUMMIT ASIA

**Host:** Giovanny Gongora & Serhan Bahar  
**Element:** @gioyik:parity.io | @serhan:parity.io  
**EmaiL** [gio@parity.io](mailto:gio@parity.io) | [serhan@parity.io](mailto:serhan@parity.io)

 ![](https://europe1.discourse-cdn.com/flex005/uploads/polkadot2/original/2X/0/05e895a7273c1974bf4d7b0a750df791e5608f13.jpeg)

## Summary of session

The session covered the Community Bug Bounty program for the _ **Polkadot \<\> Kusama Bridge** _, presented by Giovanny Gongora and Serhan Bahar from Parity Technologies. The program is designed to encourage hackers and researchers to report vulnerabilities rather than exploit them, aiming to create a culture of security awareness and demonstrate maturity in handling external interactions seeking vulnerabilities. Get involved - contact them!

## Notes & key questions asked

- Why a Bug Bounty? It is inevitable for development teams to face bug bounty reports or threats. The program incentivizes ethical reporting to enhance security and reduce unexpected incidents.

- Bridges Bug Bounty Rationale: Given the nature of bridges as intermediaries facilitating asset transfers between blockchains, they present lucrative targets for attacks. The high volume of high-value transactions necessitates robust security measures.

- Scope: The bug bounty program focuses on the common bridges infrastructure and XCM and BridgesHub, with repositories listed for potential contributors to review.

- Clearly defining and improving the Threat Model is key: Identifies the high-risk category for bridge security, with a comprehensive analysis indicating six key categories of IT Security risks at a maximum level of High risk.

- Severity Classification: Details the reward structure, with up to $100,000 for critical vulnerabilities down to $1,000 for low-severity issues, covering various potential threats like governance compromise, loss of user assets, and unauthorized actions.

- Disclosure Policy: Specifies a remediation period and a schedule for bug disclosure post-fix audit and release, emphasizing the need for completed fixes before public disclosure.

- Experience So Far: Highlights the community’s value on credibility and effectiveness, the debate over funds allocation, and the importance of public threat models for transparent severity assessment.

## Key takeaways & next steps

- Community Bug Bounty Benefits: The program aims to secure the network for all, rather than individual teams, making security accessible to everyone in the ecosystem.

- Leveraging Community Collaboration: Encourages leveraging individuals with security skills across the ecosystem for triaging bug bounty submissions, aiming for cost and funds efficiency improvements.

- Call for Collaboration: The presentation ends with a call for individuals with security experience, governance supporters, and curators to contribute to the program’s effectiveness and transparency.

- Next Steps: For individuals interested in contributing to the security of the Polkadot \<\> Kusama Bridge, the session encourages engagement through triage, program maintenance, and governance support. The emphasis is on community collaboration for enhancing security and ensuring the program’s success eg.: