How Crowdsourced Security Protects Web3 Projects

What Is Crowdsourced Security?

Crowdsourced security is a cybersecurity approach to protect digital assets from hackers using the public pool of whitehat researchers. 

Not all development teams have the internal expertise to detect bugs and vulnerabilities. 

That is why crowdsourcing security is useful for smaller teams.
For larger organizations, crowdsourced security means that the company can employ fewer full-time employees. This helps reduce their cost structure.

What is bug bounty

One of the popular ways to crowdsource security is to place a bug bounty on your application. When you set up the bug bounty, you are hosting a public pentest with as many researchers as possible.

Think of it this way. Security researcher is limited by their knowledge and experience. A single researcher can perceive app vulnerabilities that others may dismiss.

When you set up a large group of researchers, they cross-cover each other for their lack of perception.

Most popular bug bounty platforms offer a direct connection between the bounty hunters and developers through DevOps platforms like GitHub or GitLab. In some cases, security researchers can help developers with a solution.

How Much Do Bug Bounties Cost?

Bug bounties are designed in a way to reward security researchers for the bugs that they discover.

For example, you can allocate $50,000 for the bug bounty program. 
Then, you would need to categorize bugs by their severity.
Basically, how much damage they can do to your company’s revenue flow:

• Low
• Medium
• High
• Critical

There should be a reward range for every severity level. 
For example, low-severity bugs may go up to $500 per bug. 
While critical-severity bugs may reach $15 000 per bug.

How To Set Up Bug Bounty For Web3 Business

You can set up bug bounties in 2 ways:

• Host a bug bounty program on your website and invite whitehat hackers
• Publish your bug bounty program on marketplace platforms

How To Self-Host A Bug Bounty Program

Setting up self-hosted bug bounties is a complex procedure. 
Here’s what the basic plan for it would look like:

1. Create a page for the bug bounty program.
2. Market the page to white hackers.
3. Create a management workflow for working with security researchers:

• create a bug report template
• create a seamless flow for report handoff and notifications for developers
• create a flow for evaluating reports
• create a flow for paying the rewards to researchers

Be aware that security rating platforms do not favor self-hosted bug bounties. It’s because the rating platforms cannot properly evaluate internal processes.

How To Publish A Bug Bounty Program On The Marketplace

Publishing bug bounties on marketplace platforms is easier because they take care of most of the work from the above plan. You’d save financial and time costs on development, management, and marketing.

To publish a bug bounty for a Web3 project, you will need to find a platform like HackenProof  and prepare only this info:

• Target
• The types of vulnerabilities to check and forego
• Bounty rules

Here’s an example of the bounty info from HackenProof.

How To Pick A Bug Bounty Marketplace For Web3 Projects

There are many bug bounty solutions available, but only a few of them are tailored specifically for web3 projects like exchanges, DEXes, wallets, and dApps.

Top bug bounty platforms for software business

The most popular crowdsourced security platforms are:

• HackerOne
• Bugcrowd
• Synack
• Cobalt
• Open Bug Bounty
• Zerocopter

Security researchers on these platforms scan general software vulnerability categories like:

• cloud security
• app security
• web interface
• API interface

Top bug bounty platforms for web3 projects

Here are the bug bounty platforms for web3 projects we’re aware of:

• HackenProof
• Immunefi

These solutions employ researchers who are not limited to detecting only classic bugs. They can also find vulnerabilities hidden in smart contracts and blockchain protocols.

Compare Top Bug Bounty Solutions for Web3 Business

We’ve prepared a business guide that compares 6 bug bounty solutions for blockchain companies:

• HackenProof
• Immunefi
• HackerOne
• YesWeHack
• Synack
• Bugcrowd

Click here to get this guide and you’ll save yourself at least 50 hours of research.