kaal:claim:4734750-004

Bug bounty programs fail at their own premise because the hackers they pay to demonstrate exploitability frequently sell or exploit the bugs they find instead of disclosing them.

Source quote, verbatim

Alas, hackers often sell the bug or exploit them when they discover them.

From

Wulf A. Kaal, Code Review DAO (2024), Community Audits, p. 9
https://ssrn.com/abstract=4734750 · source PDF

Cite as

Wulf A. Kaal, Code Review DAO (2024). SSRN: https://ssrn.com/abstract=4734750

Holds when

community audit and bug bounty programs for smart contracts

Classification

failuresupport: arguedfailure: Bounty hunter defectionfamily: fraud-and-misconductcomplianceai-and-agentsrisk-and-incentivessmart-contractsconsensus-and-security

Verify

The quote above is an exact substring of the source PDF, whose sha256 is 60eadf91c0913468505afc664c8d8d1e1673d6c5326d031ca7060addb8ab2eda. Extraction method: pdf-text-layer.
Attestation record: colloquium/attestations/f4e6d4e882b698b4...json
Verify the binding yourself: curl -s https://wulfkaal.github.io/claims/4734750-004.md | sha256sum