geodude
26 posts
@code4rena Shout out to the team and especially @0xtotem 👏🎉🤘
Sunday reflection: contest that won't pay for low/info findings and why I think they shouldn't do that. Context: I'm participating in a contest that follows this rule. Unfortunately, I discovered it only once I had already submitted some of them (totally my fault to not have paid enough attention to that). Now that I know it, I feel like I've wasted my time and I have no more incentives into investing into it. Why do I think that they should allow low/info findings? First, because from low reports, you could discover med/high findings by combining them. Second, because low/info reports are usually a treasure trove for the protocols to understand how to improve the design, architecture and codebase. Yes, probably from a security prospective they are not as valuable as a high, but they for the protocol they could be as valuable if not even more if you think about the long term. Having strong foundations should be your priority, if you build on top of a weak one, you are most likely going to regret it. Finally, I think that the main problem is that when a contest follows this rule, it creates a wrong mental model for the security researcher. You start not looking with accuracy at all the code because you are just rushing to find med/high findings and there's a good probability that some of them will be missed directly or indirectly. I understand that a lot of low/info reports can create much more work for the judge and the client, but I think that's worth reserving a small piece of the overall pot for them, you never know the outcome.
