AIP-134: Bug Bounty Program for AIP-21

I hear these sentiments, and I think they are a necessary evil of decentralization. Things take longer because people don’t have direct responsibility, so there has to be a lot of initiative taken.

But I think it’s a lesson to all of us. Now that the issue’s been broached, I’m definitely not going to not-delay staking just because of impatience. IMHO, frustration at the lag is not a reason to vote this down.

Here’s the major difference in perspective:

we have been over-promised and under-delivered with delays and missed target dates.

Being promised something as if you are the customer and there is some separate production entity is fundamentally what the DAO structure is trying to fix. There is no line between served and server any more. If there’s a delay, you share blame with me. WE are overpromising ourselves because WE are underdelivering.

4 Likes

I care. I have a strong opinion about any further delays. Increasing the delays even further is extremely frustrating as some of us Community Members have planned for months to begin staking on these target dates and each time there is a reason it is delayed. I think it’s important to meet the set target dates and actually deliver what they say they will. Accountability in this space is important and will should hold to the dates if we can help it.

I understand the purpose of the bounty program and I am not at all opposed to it as long as it doesn’t cause any major delays. We have already been delayed once, it’s time to let Horizen Labs implement the Staking System they were hired to do. The Special Council picked the company they entrusted to get this system built out and if Horizen Labs is comfortable shipping this, then why not launch? Horizen Labs has performed audits and feels as if it’s ready to go.

I just want to see something actually delivered by the Ape Coin DAO and on time.

9 Likes

You said everything I wanted to say, but in a much more eloquent way. I agree with all of your points!

2 Likes

They gave all holders free coins that are still worth a substantial amount and now they want to take extra security measures. You should be happy they want to run a big bounty it shows they don’t want to get hacked and have the reputation destroyed. It’s actually more responsible to do this even if it means you extra “free coins” are delayed

4 Likes

My main problem is that this kind of proposal could be a neverending story without full context and a natural technical/security point of view. (And of course complexity in the original proposal.)

We hired Horizen Labs, which has experience with kind of things. Where are:

  1. Theirs point of view on this proposal? Do we really want to agree on something without having a complex view on it?
  2. Where are the results of the audit they already did? From which company? What are their finding?
  3. Machi Big Brother proposed that they can take a look on whole contract and documentation for free after Horizen will publish the whole documentation this week. There will be many more people nad hackers in the community like this, after publishing the contract and documentation

I dont want to be stubborn on this, but in this kinda style of proposals… We could propose after the first audit, a bounty program - another delay for a month because some another hack occurrs elsewhere and 3 audits are more than 1 hired and 1 from bounty program…

I would really appreciate an open view on it from Dean, CEO of Horizen Labs. He is one of the few people from DAO which communicate with us openly…

4 Likes

All I know is I don’t want another Cream Finance. Look that one up if you don’t know the connections between the people you mentioned and what happened.

4 Likes

Another small but apparent conflict of interest is that since horizen is coding it and ape dao is paying the bounty, theoretically they can leave a complex bug in there and have a friend of a friend of a friend find that bug and get the million ape coin from the dao. Ideally the bug bounty reward would come from horizen to remove this potential scenario. Would’ve been ideal to include this bug bounty payment in the beginning and have it be part of horizen payment (if no bugs are found they get to keep it).

9 Likes

Let me ask one more question because I’m unaware of Apecoin Dao’s work speed.
If I understand the DAO proposal process right according to FAQ:

  1. There will be four more days when we can discuss the proposals (until 21th-22th of October)
  2. After that, the proposal could be selected for voting (definitely, at a minimum, will take a few days?)
  3. After that, mods will contact the author and help with proceeding to the official proposal for VOTING if the draft is selected for voting (minimum 7-10 days?)
  4. Voting for some period *(not sure, how long is the voting period in general - a few days?) *
  5. Implementation

So my question is: is it possible to make all the process phases before the 31st of October? It doesn’t sound realistic to me, but I’m not aware of how speedy these things can be, but I guess not so fast due to the the DAO process. Am I missing something?

In that case, if it is not realistic. Wouldn’t it be better to change the proposal for general bounty or ongoing apecoin staking bounty - without postponing the launch of Staking? Because not fully voted AIP draft, cannot stop official approved AIP?

Nobody will have a problem with that, and the general idea of rewarding bug bounties is excellent.

6 Likes

I think the most important question here is:
Who has the power to decide the starting date of staking? Horizen labs said they are ready to deploy on Oct 31, but “ready != they will”.

We are essentially voting: proceed with vs without bug bounty.

It would also be helpful to release the current audit report that Horizen Labs hired.

6 Likes

100% in favour of this idea as it stands. Thank you so much for proposing @maariab :brain:

2 Likes

Concur. From my reading I don’t believe a later proposal can alter the timeline of an already passed and final stage AIP implementation.

See this clause on conflicting proposals in the DAO charter:

A suggested proposal that directly conflicts with another approved proposal cannot go to vote for three months after the original proposal has been implemented to avoid wasting community assets.

Ahhhhh I’m rules lawyooooring!

10 Likes

This is an extremely interesting and valid point. This draft intends to further delay an already approved AIP, albeit for a very important reason of enhancing security via the bug bounties. I do think the process in which it is being brought up is where many of us community members take issue as we don’t want to undergo further delays. However, I welcome the conversation as we all learn to navigate this DAO in its infancy and figure this all out in real time.

I hope we can come to a solution that is sort of a compromise. If we can fast track a bounty program in order to minimize greater delays, maybe that’s the solution. I’d love to hear more from the Special Council Member’s that drafted this idea and put it out there for discussion.

I do think @ahimaaz brings up a very valid point outlined in Ape Coin DAO Governance Proposal Conflicts section and it does need to be addressed at the very least. We do need to ensure we are respecting the proper guidelines set forth and outlined in our very own Governance Program.

6 Likes

As we all know being able to deliver on time is a basic of professionalism. We can all be delayed but "oups we forgot this…"is not what we want from APECOIN DAO. Let s do this bug bounty live and have the board a bit more careful on deadlines.

4 Likes

The other side of professionalism is to admit when you’re wrong and fix it while taking all the slings and arrows instead of rushing ahead and putting hundreds of millions of dollars at risk! :grin:

2 Likes

For those interested, maariab posted a thread about this proposition and the discussion.

https://twitter.com/maariabajwa/status/1582243641489096705?s=20&t=JnDN_olky1ISUyFZ99xH_w

About my comment above being cited twice in the thread, I did not want to be “harmful”. Apologizes if you took it that way.

I still think that delaying staking by +2 weeks isn’t the best solution, if the contracts are being released today by Horizen it will let us 2-3 weeks to review and potentially join forces with Immunefi or other legit platforms. There has to be a solution that satisfies everybody.

I still think that the communication around the staking building process isn’t perfect. The main problem is coming from here. How about the space that Horizen was supposed to host? I’m sure the community would have been happy to ask questions about potential issues.

We can do a lot better.

3 Likes

Looks like there is many sides on professionalism that I need to discover :slight_smile:

2 Likes

This is fundamental to secure the contract. But part of horizen initial Job. They still can do what they forgot.
No need to delay staking, no need to cancel spaces cause ppl are sick no more excuses to be unprofessional.
Deadline : after the line it tends to be dead…

3 Likes

Why are these arguments on a Twitter thread instead of on this forum? There are even screenshots and replies to some AIP comments but I see no meaningful replies here where they should be.

That said, I like the bug bounty idea but I’m voting NO to this because:

  1. Horizen Labs is HIRED to do the contract and ensure it’s safe.

  2. Bug bounty shouldn’t cause delay to the already delayed deadline.

  3. One million $APE it’s way too much.

7 Likes

I just sharing new documents from Horizen, which were shared a few minutes ago.

Full documentation published by Horizen:

Smart Contract Security Audit from Halbord Security:

You can find out more about Halborn Security here:

8 Likes

I’m surprised to see some people take issue with delays proposed by this major security enhancement proposal. Voting against this AIP would be like voting against your own safety!

17.5% of total $Ape supply (or 175m $Ape) is rewarded over 3 years of staking program (100m Y1, 50m Y2, 25m Y3). This is how much is literally at stake! Now 2-4 weeks delay to the launch of this program equals just 1-2% of the whole duration of staking! Rejecting this proposal means literally gambling everything just to reach the end of the program 2-4 weeks faster! But why? What’s the benefit of starting in 2-3 weeks as opposed to 4-6 weeks that would outweigh a higher risk of an unauthorized hack?

Don’t get me wrong, I’m as excited for staking to start ASAP as the next ape but not at the price of solid security!

Never compromise safety for speed! :raised_hands:

7 Likes