Interesting... Anthropic Mythos was deemed too dangerous to release to public because it easily hacks every single system on the planet...

So we can basically point AI now at a target and it will find you vulnerabilities...

Even if you had to write a proposal I would support it. It getting even easier for people to find these vulnerabilities using AI. It takes literally zero skill to find a flaw and create and deploy a payload or exploit.

Thanks for your devotion to transparency, @azircon

hard to say , if you lose your wallet and someone finds it and returns it , in a lot of places it's normal to give a finders fee of 10%.

I have no clue of the amount of values there is in splinterlands but i guess 10% would be to much to pay in this case .

you didn't lose your wallet yet , but he pointed out that it could happen .

Thanks for the transparency, I really appreciate that. I was already reading about it on Discord yesterday.

Personally, I do think it’s fair to pay some sort of amount, though I honestly can’t put a price on it. If wallets were potentially at risk, that alone is already worth something.

I even think situations like this can be handled without going through a full proposal process, simply to be able to act fast together with the treasury. I trust them to make solid decisions, but only if we keep the transparency. Don’t solve everything purely in Discord where only a limited group will read about it.

In cases like this, “better to ask for forgiveness than permission” might actually apply.

And regarding the vulnerability itself, I think we should be thankful someone reported it without bad intentions. Again, what price do you put on that?

Chatgpt:
Honestly, in the crypto space, a zero-day vulnerability for a DAO could easily be worth anywhere from a few hundred to thousand dollars to more, depending on the impact and exploitability. Preventing a serious exploit could literally save the treasury.

My understanding is, that the DAO never offered a bounty to begin with. There was no agreement beforehand and I read somewhere that originally the guy wanted to keep 25% as a finders fee. In my opinion it was a service not requested and I don't see any obligation for the DAO to pay anything.

If he did it out of the goodness of his heart, then great and many thanks, but without an official bounty set beforehand I don't see a reason to reward the theft, just because the money was given back. Now if the DAO wants to set an official bounty for the future I would argue that said bounty can be paid retroactively to the guy, otherwise a proper thank you, not the terrible answer originally given, would be in order, but that is about it.

Back in the days "white-hats" just left a note how to fix the vulnerability and request a job interview.

The thing Luis found is IP-address leak through externally loaded content. A guild/tournament/profile page allows user-controlled external images or embeds. Anyone viewing the page leaks their IP to the host of that image.
So this is why content has to be approved before publishing it to SPL, the recent change. Paying 5k for it is nonsense if you ask me. And the fact that you can agree and pay put 5k without ask is terrifying xD ok maybe it's peanuts for you. Anyhow i would reward Luis with 1k as finders fee

Question is, why Sylar didnt find it? Isn't this a part of his job? What do you do in team @sylar1 ? @sylar? If you still are in. Do you think 5k is adequate for this?

As I mentioned in DM when we chatted, I think this should have been handled far better and perhaps it is a good learning experience for everyone going forward that some kind of process is required. Having said that, can't go back in time and change things.

@seattlea ballparked some hours and an hourly rate at say $100 for 20h is 2000, but if he did spend that time (I don't believe it took that long) there was no guarantee of that pay, ,so if he found nothing, he would get nothing. So perhaps a 50% bonus on top for finding, so $3000 for the work plus the bonus.

And then having said this, it should be handled well behind the scenes and then transparently after settled, so that other people know there is an opportunity to earn a bounty. If there is no opportunity for a bounty, then Splinterlands would have lost 100% of what could have been taken and perhaps if it was someone else instead of @louis88, they would have. And remember that now, there will be others using AI to surface vulnerabilities and exploit them, with no intention of getting the bounty.

Not all of the users on Hive are aware of all of the things, so someone has to write something on some burning issues. A well researched topic by anyone should be welcomed.

You have written about and explained Zero Day Vulnerability in such good way that it is hard to say you are other than an expert on the topic.

IMHO, Louis must be paid, at the least, a reasonable percentage what his efforts have saved.

Now that's unfortunate and interesting. I read through the article and the comments, too. I think his work is awesome and am very impressed by it, given that I have not much of a clue, of course. But I'll try to keep it neutral in this comment:

First - worst possible communication if that mail is true like that or even in the ballpark. The people in charge of communication really have to up their game, not the first time it's an issue.

Second, numbers. a) The value of his work hours. Knowing the value of the work does help, though, to find a fair number. But it seems like he's German, so the €/h in German should be used. But what if someone in Ecuador finds the bug? Or another low wage country? Ir a super high wage country? I don't think this is a good approach.

b) Calculating as a full time job is not applicable as he was never hired to do so. It seems to be a hobby, and he's getting financed from other Hive-platforms to use a high end AI to do just that. He did a few great reports on that. So, basically, it's a quid-pro-quo situation. He gets access to an awesome tool and in exchange he helps platforms to fix their security issues.

c) I'd rather go from the potential risk of the issue, how much could've been stolen, and hence how much damage it prevented in the future. Which I can't estimate without numbers.

d) As mentioned in the comments under his post, the bounty should be according to the means of the platform. The DAO funds are not endless, but limited to 5k. If they have 5k, spending all of that for one bug (no matter how big) doesn't leave anything for other vulnerabilities. If we go from the budget, I'd say 20% is fine, 1000$. That gives the DAO enough wiggle room to finance 4 other big vulnerabilities and sends a good signal to other White-Hatters, which is important too. Hopefully unnecessary, but who knows.

Third, compromise. The DAO could buy him a month of that Anthropic Hacker thing that seattlea mentioned, and ask him to find more vulnerabilities so they can learn from them and avoid that kind of code in the future. If that's possible.

Fourth, the DAO could establish a small fund for White Hatters. Those who put in the work, of course, not those who send those screenshot e-mails that Louis mentions. Set some rules, a pathway of how to determine the value of vulnerabilities, and so on.

So, in essence: $1000 for a mayor vulnerability that could've cost the company dearly. If communication was really that rude, an apology is in order, too. And maybe the offer to finance a month of a great AI to find more weaknesses.

I would have preferred to see a proposal to set up a bug bounty program and pay him via that. Then we have one vote and are sorted for the future.

Also, who is in charge of writing the code and hence responsible for not finding the bug? They should be involved in some way, too. They're getting paid to do a save job, but they didn't, and now someone else is being paid for finding the flaws in their work.

Just my point of view:

• I am highly in favor of having a big bounty program. Having the freedom to reward up to 5k without a proposal is something I think is great (I would be in favor of allocating 20k with max single transaction of 5k without a proposal)

• I think that if this program was in place when the issue got noticed, it would had been rewarded.

• Reading up the comments - “initially demanding money in order to return the remaining funds” this changes everything for me. Where I understand his motives and frustration (especially with the $10 offer). This is not the way, and I also don't think it should ultimately be rewarded in this manner. (I think he is crossing the line here and taking the risk of being sued himself).

Overall:

• yes, setup the bug bounty program. Future work for Louis should be rewarded. This mention is not up for reward from the program due to (crossing) the thin line towards blackmail.

Happy Sunday everyone 🙏🏾 please read and share the truth 👇🏾👇🏾👇🏾👇🏾👇🏾👇🏾👇🏾👇🏾

On hive it's like some people don't realise everything is documented and you can never hide from the truth 😂😂😂😂😂🍻

@acidyo @neoxian @themarkymark @hurtlocker @jacobtothe @steevc @meno @theycallmedan @crimsonclad and friends ✨⭕✨😂😂😂

Do you really think no one sees what you do 🤔

@acidyo You took my rep away for no reason with the help of blocktrades delegation 😂 @steevc knows all about it

You and themarkymark work for blocktrades or are blocktrades 😂

You are so sad doing what you do

Promoting your 💩💩💩💩💩💩

Selfvoting your 💩💩💩💩💩💩💩💩💩

You have downvoted so many people away for no reason

You really need to have a hard long look in the mirror and see what you have become

It doesn't matter if you have people who believe anything you say for a few cents or a few pennies 😂😂😂😂

Look at your buddy oldsoulnewb 😂😂😂😂😂

Everything is documented

So the choice is yours again leave me alone and bring my rep back and I will stop sharing the truth

You can call my long copy paste comments spam but it only makes you look stupid 😂

I hope you understand you are only making it worse 😂

Hive is not a game it might be a big game to you 🤔

It seems you love to game Hive don't you 😜

Everyone sees don't you think it's time to stop 🛑

You have shown all the real issues with Hive 😂 you have shown why real people couldn't invest in Hive and build on Hive 😂

You are in god mode 😂 activated 😂 you Marky Dan and others 😂😂😂😂😜

I hope you enjoyed this post or you might see in comment from 😂 which you like to call spam 😂😂😂
@jacobtothe Keep digging just remember @acidyo took my rep away with the help of blocktrades delegations and everything is documented 😂😂😂

☝🏾✨⭕✨☝🏾🍻🍻🍻🍻

👇🏾👇🏾👇🏾👇🏾👇🏾👇🏾👇🏾

@jacobtothe and friends Please get help there's clearly something wrong with you 🙏🏾

I hope blocktrades pays you well enough 😂😂😂😂

Some people just never learn when 😂😂😂👇🏾👇🏾👇🏾👇🏾👇🏾👇🏾👇🏾👇🏾👇🏾👇🏾👇🏾👇🏾

@jacobtothe @livinguktaiwan @oflyhigh @abit @adm @eval @hivetoday @findingfreedom @abitmore @hurtlocker @hurt-locker @epstein @gundamzerofour @gundamzerotwo @gundamzerofive @buratus @gungunkrishu @tarabh @nattosenpai @fw206 @ocd @acidyo @hivetrending @mrtats @poshtoken @davideownzall @dudeontheweb @caspermoeller89 @strawhat @angeluxx @cositav @rachaeldwatson @artofwar74 @solumviz @poshtoken.wallet @shiftrox @hiddenblade @hivegc @alohaed @tobias-g @nattosenpai @hivetrending @erikah @davidke20 @davideownzall @zingtoken @honey-swap @friendlymoose @x-rain @hivegc @lazy-panda @rishi556 @ocd-witness @russia-btc @ocdb @justinw @nutritree @themarkymark @geekgirl @buynburn @stresskiller @forkyishere @forykw @belikechuck @leovoter @upmyvote @punkteam @makerhacks @wiseagent @steevc @davidthompson57 @videoaddiction @annoyingmosquito @meesterboom @demotruk @meno @thelittlebank @knot @buttcoins @snapie @coolmole @davidickeyyall @crimsonclad @smooth @oldsoulnewb @ds-tech @artgirl @flemingfarm @neoxian @nwothini335 @bdvoter.cur @zaku @mango-juice @empo.voter @empoderat @ferranlogs @trumpman @bhattg @azircon @riverflows @lazy-panda @gogreenbuddy @tarazkp @buildawhale @logic @abit @freedom @solominer @letusbuyhive @bijoy12 @sagarkothari88 @theycallmedan @ipromote @apeminingclub @nathen007 @dlmmqb @slobberchops @chops316 @littlenewthings @bozz @adm @abit @cwow2 @adm @logic @savvyplayer @patrice @spaminator @topcomment @theworldaroundme @jongolson @mobi72 and friends ✨⭕✨ Please get help 🙏🏾

@jacobtothe @acidyo @themarkymark @hurtlocker and friends 😁 No one will ever trust you again you weirdo 😂

👇🏾👇🏾👇🏾👇🏾👇🏾👇🏾👇🏾
Hello everyone I hope you are all good and well today in this post is some of the evidence to prove my case

If you didn't know I've been getting downvoted for a long time on Hive

They have been trying to bully me with downvotes and words but it doesn't affect me I've been online for over 25 years

So I've dealt with people like this before it's nothing new

But what they are doing is bad Very badi joined steemit like everyone else thinking it offers freedom but I must say steemit offered much more freedom than Hive does

Everyone already knows I only post my own original content I have no need to steal anything from anyone

I've been labelled a lot of things on Hive 😂 by the biggest farmers scammers and downvoters

Actions speak louder than any words do especially when them words are coming from a compolsive liars

I will keep updating this post when I get time

https://hive.blog/hive/@ureka.stats/the-untrending-report-hive-downvote-analysis-16-09-2025-20250916181314

https://hive.blog/hivedev/@makerhacks/please-peakd-allow-me-to-completely-block-spammers-would-you-ever-vote-for-this

https://hive.blog/hive-167547/@dlmmqb/re-kgakakillerg-t34wy6

https://hive.blog/hive-170475/@acidyo/re-kgakakillerg-t32sw1

https://hive.blog/hive-167922/@themarkymark/re-kgakakillerg-t30ziu

https://hive.blog/hive/@ureka.stats/the-untrending-report-hive-downvote-analysis-29-09-2025-20250929172045

No downvotes for this racist person 🧐

https://hive.blog/hive-196387/@acidyo/re-kgakakillerg-t41yr6

https://hive.blog/dvs/@dhedge/re-kgakakillerg-t3clz3

https://hive.blog/hive-150329/@kgakakillerg/t3a8fu

https://hive.blog/musical/@steevc/re-kgakakillerg-t2kz1m this post

To all the downvoters on Hive When the downvotes stop 🛑 and my rep is back I stop sharing the truth 🙏🏾
☝🏾☝🏾☝🏾☝🏾☝🏾☝🏾 Keep calling the truth lies 😂☝🏾

So many pretend to be doing god's work but they are really working for the devil 👿

Karma will strike you and who ever supports you 🙏🏾

☝🏾☝🏾☝🏾☝🏾☝🏾☝🏾☝🏾☝🏾☝🏾☝🏾☝🏾☝🏾
To @jacobtothe and friends 😁

@crimsonclad please do your job 🙏🏾

https://hive.blog/hive-135178/@crimsonclad/re-kgakakillerg-sxllhv

https://hive.blog/hive-148441/@hivewatchers/svftu9

https://hive.blog/hive-148441/@hivewatchers/svdjjz

https://hive.blog/hive-176853/@steevc/re-kgakakillerg-syyy4x

https://hive.blog/dev/@howo/re-kgakakillerg-szhax7

https://hive.blog/hive/@steevc/follow-friday-respect

https://hive.blog/hive-127022/@shmoogleosukami/re-kgakakillerg-t0hcxc

It's unbelievable that they downvoted this Goodbye Auntie R.I.P 🙏🏾

Comments being downvoted by blocktrades https://hive.blog/hive-170744/@kgakakillerg/t0ns3b

https://hive.blog/hive-127466/@steevc/re-blocktrades-t0kint

https://hive.blog/hive-127466/@blocktrades/t0lq41

https://hive.blog/hive/@ureka.stats/the-untrending-report-hive-downvote-analysis-2025-06-29-20250629143829

https://hive.blog/hive-127466/@kgakakillerg/t0m1vn

https://hive.blog/hive-108278/@kgakakillerg/t0rfo8

https://hive.blog/hive-127466/@kgakakillerg/t0vcl7

Stop farming Hive https://hive.blog/burnpost/@buildawhale/re-1756307402814502169-20250827t151240z

😂😂😂😂😂

📊 The Untrending Report - Hive Downvote Analysis - 2025-09-07

RE: Understanding Pointers in C Programming

Please Peakd, allow me to completely block spammers (Would you ever vote for this?) thanks for exposing yourself more @makerhacks

Please go through it all instead of calling it spam 😂😂😂😂🤣🤣🤣🤣🤣🤣🤣

https://blurt.blog/hive/@candy49/5slvnx-taskmaster4450-is-being-downvoted-on-hive-by-you-know-who

🚨🚨🚨🚨🚨🚨🚨🙄🙄🙄🙄🚨🚨🚨🚨

https://hive.blog/hive-108278/@kgakakillerg/themarkymark

https://hive.blog/hive-178138/@thefed/t6q9kb 🙄🙄🙄🙄🙄🙄🙄🚨🚨🚨🚨🚨🚨🚨🚨🙄🙄🙄🙄🙄

https://hive.blog/music/@geneeverett33/11-25-25-three-tune-tuesday-picking-tunes-from-the-punk-band-the-descendents-1982-1997-era

🚨🚨🚨🙄🙄🙄🙄🙄🙄🙄🚨🚨🚨🚨🚨

https://hive.blog/dmania/@steemcleaners/ps46kb

https://hive.blog/hive-124838/@fjworld/re-peaksnaps-t7161i

🚨🚨🚨🚨🙄🙄🙄🙄🙄🙄🙄🙄🙄🚨🚨🚨🚨

https://blurt.blog/blurt-131902/@condividisulweb/3w94e8-hive-manipulation-censorship-and-suspicious-funds-the-hidden-truth

🚨🚨🚨🚨🙄🙄🙄🙄🚨🚨🚨

https://hive.blog/hive/@kgakakillerg/i-ve-been-put-on-two-blacklists

Thank you for reading and viewing this post

To all the downvoters on Hive When the downvotes stop 🛑 and my rep is back I stop sharing the truth 🙏🏾

I'm sharing the truth I know it hurts you but it is what it is 😂🍻

Consider these entries from @hive.fund's wallet—a digital fortress of staggering proportions:
"HIVE: 31,354,125.286"
"HBD: 23,325,897.167"
"Estimated Account Value: $24,860,896.64<

It's crazy that hives market cap is 36 million dollars 🤔🧐 and a account to hold 24 million dollars 💰 crazy

To everyone who is turning a blind eye to the truth karma will strike you down 🙏🏾

Stop Doing the devils work do gods work 🙏🏾

☝🏾😂😂😂😂😂😂😂😂📷📸📸

☝🏾☝🏾☝🏾☝🏾☝🏾

#themarkymarkfiles #buildawhalefiles #acidyofiles #hurtlockerfiles #neoxianfiles #louis88files #azirconfiles #jacobtothefiles #ausbitbankfiles #poshtokenfiles #menofiles #Guiltypartiesfiles #Usainvotefiles #smoothfiles

☝🏾☝🏾☝🏾☝🏾☝🏾☝🏾☝🏾☝🏾