ChainCatcher news, the Web3 vulnerability bounty platform Immunefi has imposed a 90-day suspension on the white hat security company Trust Security. This decision was made after the latter accused Immunefi of unfairly refusing to pay a bounty for a critical vulnerability that could lead to funds being stolen.On November 12, Trust Security revealed on X that its bounty team had discovered a significant fund theft vulnerability on the forked mainnet of an unnamed project. The proof of concept for the vulnerability has been shared with Immunefi, which acts as an intermediary between white hats and projects to ensure bounties are paid for credible vulnerability identification.However, Immunefi stated that Trust Security detected a vulnerability that was out of scope. Trust claimed that Immunefi erroneously sided with the project’s "nonsense," only offering a "meager goodwill bounty" without providing the full reward for identifying the critical vulnerability.Immunefi rebutted Trust's claims of unfair compensation and issued a 90-day suspension order on the grounds of "misrepresentation of the current issue." Immunefi stated that if Trust commits any further violations, it will impose a permanent ban.

ChainCatcher news reports that the vulnerability bounty platform OpenBounty has faced criticism from peer security researchers after users discovered that their submitted vulnerability reports were published on a public blockchain. When OpenBounty receives a report, it automatically publishes the content of these reports as transactions on Shentu, a blockchain operated by OpenBounty's parent company, Shentu Foundation. The publicly disclosed details include the threat level of the vulnerability, the location of potentially vulnerable code, and comments from the report authors. OpenBounty lists over 30 different cryptocurrency projects offering vulnerability bounties, with a total deposit value exceeding $11 billion.Independent security researcher Pascal Caversaccio stated that publicly disclosing potential vulnerabilities is extremely irresponsible, as any hacker can sift through these reports and exploit them. Security researchers also complained that OpenBounty listed and accepted vulnerability bounty reports from other security companies and cryptocurrency projects that had not authorized them. Among the bounties listed on the OpenBounty website are those from top decentralized exchange Uniswap and lending protocol Compound.Michael Lewellen, Solutions Architect at the crypto security company OpenZeppelin, stated, "As a security advisor for Compound DAO at OpenZeppelin, I can authoritatively say that they have not been authorized to manage vulnerability bounties on behalf of the protocol."Dmytro Matviiv, CEO of the vulnerability bounty platform HackenProof, said, "Listing bounties without permission could have legal consequences. The vulnerability bounty market operates under a carefully considered legal process. Within this system, permission from the bounty issuer must be obtained before placing a bounty on a vulnerability bounty platform."A spokesperson for CertiK confirmed that the entity controlling the OpenBounty platform, Shentu, was once part of CertiK; however, Shentu has been operating independently since 2020. Nevertheless, four years after the split, the code on the OpenBounty platform still links to domain names that include CertiK in their names. However, CertiK's spokesperson stated that these domains are managed independently by Shentu.

ChainCatcher news, the bug bounty platform Immunefi has completed a $24 million Series A funding round, led by Framework Ventures, with participation from Electric Capital, Polygon Ventures, Samsung Next, North Island Ventures, Third Prime Ventures, and Lattice Capital. The funds will be used to expand its team to meet the growing demand for its services, with Immunefi currently employing around 50 people and potentially doubling that number in the near future.It is reported that Immunefi was founded in December 2020 and is headquartered in Singapore. It claims to have over 300 clients, protecting more than $10 billion in user funds, and has paid out $136 million in bounties to white hat hackers. (The Block)