Hydration reduced its bug bounty program maximum reward by 56%, from $500K to $222.2K, across four tier cuts totaling $290.3K in reduced payouts.
Tech & Launches ·
Hydration, a liquidity protocol on Polkadot, has reduced the maximum reward in its bug bounty program from $500K to $222.2K, a decrease of 56 percent. The critical-level reward cap now stands at $222,222, with a corresponding floor of $15,000 for any valid critical blockchain vulnerability report. These changes represent four separate tier reductions totaling $290.3K in reduced potential payouts across the program.
The program requires proof of concept for all web and app bug reports, with high and critical blockchain reports also mandating PoC submission. Rewards for critical blockchain vulnerabilities are calculated as 10 percent of directly affected funds, capped at the new $222.2K maximum. Attack simulations must account for on-chain security measures, including fees and liquidity constraints, and maintain a value-at-risk to extractable-value ratio not exceeding 5:1, with total execution time limited to two hours.
The assessment of economic damage and final reward determination remains at the discretion of Hydration's Galactic Council, which evaluates exploitability, impact, and likelihood alongside additional conditions. Details on the full scope of tier changes and complete program parameters are available on Immunefi.