ZCG Security & Vulnerability Disclosure Initiative

[earthrise]

@scalar

For vulnerabilities with potentially devastating impact, the priority should be to maximize the chance that they are responsibly disclosed if they ever exist. For Zcash specifically, I think there should be a dedicated top-tier bounty category for silent inflation bugs, in the $2–3M range. Same for detectable inflation bugs, they should also have a dedicated bounty, with rewards in the $500k–$1.5M range depending on impact and exploitability.

Yeah, inflation bugs are severe enough, specific enough, and hopefully rare enough, that these higher awards are warranted.