A higher-impact, lower-noise bounty program could be designed around the most severe bug classes:
- Inflation bugs: require the reporter to exploit the bug on testnet; they either have to trigger a turnstile on testnet or send an unreasonably-large amount of TAZ to a testnet address.
- Chainsplits: require the reporter to exploit the bug on testnet, causing zcashd and zebra testnet nodes to diverge.
- Remote code execution in zcashd: run a publicly accessible zcashd node with W^X, ASLR, and whatever else all turned off and require the reporter to find the contents of a secret.txt file on that server.
This way engineers can be certain that a serious vulnerability exists before they even read the bug report.
Downsides are that requiring reporters to break testnet would create more work for ZF and ZODL to fix it. Also, exploiting the bug on testnet likely leaks the vulnerability details (anyone watching closely enough could reverse-engineer the vulnerability and exploit it on mainnet). Private one-off testnets would mitigate those risks.