# Migrate Moonwell's Bug Bounty Program Provider from Immunefi to Code4rena

**URL:** <https://forum.moonwell.fi/t/migrate-moonwells-bug-bounty-program-provider-from-immunefi-to-code4rena/1386>\
**Category:** Community Proposal\
**Created:** [November 12, 2024, 8:46am UTC](https://forum.moonwell.fi/t/migrate-moonwells-bug-bounty-program-provider-from-immunefi-to-code4rena/1386 "2024-11-12T08:46:24Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![coolhorsegirl](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.moonwell.fi/coolhorsegirl/32/1854_2.png) [@coolhorsegirl](https://forum.moonwell.fi/u/coolhorsegirl)\
**Post date:** [November 12, 2024, 8:46am UTC](https://forum.moonwell.fi/t/migrate-moonwells-bug-bounty-program-provider-from-immunefi-to-code4rena/1386/1 "2024-11-12T08:46:24Z")

</div>

## **Proposal Summary**

This proposal seeks approval from the Moonwell community to replace our current bug bounty provider, [Immunefi](https://code4rena.com/how-it-works/bounties), with [Code4rena](https://code4rena.com/bounties). The goal is to improve the quality and effectiveness of Moonwell’s bug bounty program, reduce low-value submissions, and leverage a more robust process to better protect the protocol and its users.

## **Context & Background**

Moonwell has been using Immunefi as its primary bug bounty provider since early 2022. While Immunefi offers a wide network of security researchers, Moonwell contributors have consistently received lower-quality submissions, primarily focusing on informational findings that do not present tangible risks to the protocol. This has led to unnecessary administrative overhead, with the majority of reports either being irrelevant or not impactful enough to justify significant payouts.

To address these challenges, I would like to propose transitioning to Code4rena, a bug bounty program that focuses on higher quality submissions. Moonwell’s new bug bounty program with Code4rena would retain its maximum bounty payout of $250,000.

## **Rationale for the Change**

1. **Higher Quality Submissions** :

2. **Robust Judging Process** :

3. **Clear Scope Definition** :

4. **More Flexible and Transparent Payouts** :

5. **Efficient Resource Utilization** :

## **Proposal Details**

- **Current Provider** : Immunefi
- **Proposed Provider** : Code4rena
- **Key Changes** :
  - Replace Immunefi with Code4rena for Moonwell’s bug bounty program.
  - Focus on high and critical severity vulnerabilities, with discretionary tips for informational findings.
  - Leverage Code4rena’s impartial judges for severity assessments.

## **Voting Options**

- **For** : Replace Immunefi with Code4rena as Moonwell’s bug bounty provider.
- **Against** : Retain Immunefi as Moonwell’s bug bounty provider.