Is CertiK running a BS bug bounty program?
CertiK, a cryptocurrency security auditing firm that was recently embroiled in a dispute with Kraken after it hacked the exchange, has now been accused of running a ‘bug bounty’ program that was collecting vulnerabilities for various platforms rather than having security researchers submit those vulnerabilities directly to businesses. Today I was contacted by OpenBounty (@ShentuChain) to add their platform to Web3 Bug Bounty alerts. Never heard about them before so I decided to investigate as it seemed a bit sus 1/6 — h0wl (@h0wlu) June 25, 2024 The accusations center around ‘OpenBounty,’ operated by Shentu Chain. Shentu Chain used to be known as ‘CertiK Chain,’ which was operated by the CertiK Foundation. Archived versions of the CertiK Foundation website make it clear that it was founded by Fonghui Gu and Zhong Shao, both of whom are still listed as co-founders of CertiK. Besides these obvious connections between the entities, others ha...