As of this week, we will be stopping all development work on the Bounties Explorer and Protocol

When we first started work on the problem of outsourced market transactions and minimum-viable-incentives in 2017, we did so with a number of hypotheses.

We were initially excited about the prospect of marketplace interoperability: the idea that people could easily post bounties on one marketplace, which would also end up on competing sites as well, to the ultimate benefit of users everywhere. We were also very keen to explore the nature of building protocol based open platforms, which exposed functionality that could easily be composed and reused for as many use-cases as the mind could think of. Finally, we were eager to dive into the world of incentives, understanding the exciting ways a myriad of tokenized community models could be used to reshape human behaviour, and bring about deeper collaboration among strangers. Over the past two and a half years, we’ve done a great deal with a small team and a shoestring budget.

Marketplace Interoperability

The first of our assumptions we got the chance to test was that of cross-platform interoperability, thanks to our collaboration with Gitcoin. We were delighted to have found a team that shared our intentions around open source data (and not just codebases), and in early 2018 we began to experiment with what marketplace interoperability meant for us as businesses, and for our users.

As time went on, it became apparent that the thesis wasn’t as straightforward as we initially assumed: users didn’t seem to care that much for the sharing of bounties across our platforms, and more importantly, this interoperability was counter to both of our incentives as platforms (which needed to build network effects with high switching costs in order to generate sustainable revenue). From this work, came the conclusion that for interoperability to exist on top of open platforms like Ethereum, it would likely need to be Adversarial Interoperability. This meant that platforms would likely continuously fight to maintain their closed networks as long as those networks functioned as the moats that ensured the platforms’ continued profitability. Changing behaviours can take a long time.

Smart Contract Composability & Reusability

This assumption is one which is still being tested, and may still come to fruition. Originally, we had imagined a no-brainer use case for bounty composability, where DAOs could easily post bounties from within their own applications, and those bounties would automatically end up on a multitude of marketplaces thanks to the open nature of Ethereum smart contracts. We had also hoped that we might be able to collaborate with external marketplace teams on building open shared standards, or that other applications could be built atop the protocol we’d designed.

Over time, we learned a few things:

• Ethereum may have a reinventing-the-wheel problem. Ethereum developers feel particularly inclined to build everything themselves and avoid reusing pre-existing work.
• Composability requires cross-team collaboration, and strong lines of communication, both of which are difficult to achieve when teams are globally distributed, and are each working under different assumptions, towards different priorities.

While we’re happy to have explored collaboration opportunities with many DAO-related organizations (including Aragon and DAOStack), we believe the difficulties we’ve encountered are only a glimpse at some of the people-related challenges that currently exist around Ethereum’s thesis of composable applications at this time. DAOStack is launching their integration with StandardBounties at ETHDenver so there is definitely still scope for success.

Hard Stats

One of the defining aspects of Bounties Network is how much we managed to achieve with a very small team and a low budget. We have always operated as a lean startup, working with limited expenditures and spending as much time as possible trying to define the best use cases for the technology and its world changing mechanisms. In the end, this approach did not align with the needs of our investors. Nonetheless, we believe this experimentation and validation is necessary and that it takes time. Finding an environment where it is possible to sustain this type of work without consistent revenue continues to be difficult in our space.

As a team of four throughout 2019, we managed to ship StandardBounties 2.0, Meta-Transactions and a whole host of exciting community programmes.

Some of our Key Metrics:

• 12,000+ user signups with web3 wallets
• 885+ bounties live bounties on explorer.bounties.network
• 3,000+ bounties from Gitcoin using the StandardBounties protocol
• 8,000+ total fulfillments across all Bounties Network community platforms
• 3,900+ activity comments on bounties and fulfillments
• 70,000+ monthly views during December alone

Real World Use Cases

Communities

One of the main things we realized while exploring the use of bounties across verticals is that anyone can participate in and be a part of the communities we are creating. By creating different bespoke networks around distinct events and organizations for almost two years, we have gained a deep understanding of how incentives and engagements stimulate individual action for communal benefit.

The idea of creating bespoke bounty networks, some with their very own tokens, came from the desire to provide a market-space for the individuals coming together for a particular event to interact and transact with each other. By facilitating these actions, we enabled the environment for behaviours and relationships at the very core of what can be defined as community DNA.

Notable examples of these real world use cases are plentiful:

• UNICEF Boost token & the Surge Network
• BRLN Coin & the Berlin Network
• Moksha Coin & Network
• ConsenSys Internal network

We are at a tipping point in the evolution of communities and we believe the work we’ve done with Bounties is incredibly rich. The precedents we have created prove that we have the technologies to create spaces and tools for a variety of communities to develop and thrive through. The work we’ve been doing so far has already given us key insights into the makeup of crypto community DNA, patterns of behaviour and relationship dynamics. The work has only just begun and we hope bounties will continue to be a key part of communities to come.

Education

Perhaps one of the most effective and successful use cases for bounties has been our “earn as you learn” model. Given that a practice-by-doing learning method results in 75% retention, bounty based education has been a key driver in web3 user onboarding for us.

We used the model across the ETHGlobal circuit throughout 2019 to educate and onboard all new and beginner hackers attending for an enhanced event experience. By onboarding and enabling users to earn, rather than buy crypto, we ensured a much smoother and engaging experience. 2019’s earn as you learn efforts culminated with the work we did with the EF Devcon ETHScholars Programme.

We also included education bounties in the Brazil Favelas Educational Programme we had the privilege to get involved with — a partnership between MakerDAO, the World Bank, CVM (Brazil’s SEC) and Blockchain Academy Brazil. The purpose of the initiative was to educate youth from Brazil’s favelas in a “Develop your Future” course. By introducing bounties into the learning process, student retention grew exponentially compared to a previous cohort.

Whether you work with existing tokens that have an explicit monetary value or community specific tokens designed to signal reputation and enable access to specific perks, the value of incentives in the educational process is very high indeed.

User Centric Design

Throughout our time working on the bounties platform, we have always placed emphasis on collecting feedback from users to inform our design decisions early and often. Whether it has been learning through our partnerships or our bespoke network pilot projects, we have always been keen on creating the means for our community to voice their feedback about their experiences, both for our benefit and theirs. With a platform like Bounties Network which has been intentionally designed from the get-go to accommodate a broad spectrum of use cases, we have even been able to leverage our own platform as a means to…

…recruit & test with our users:

Design & User Research with Bounties

…engage in important discussion with our community:

Share your thoughts: Leveraging monetary incentives for crowdsourcing creative work

…and to incentivize and reward our community participants for doing so. Not only has this provided us with a wealth of actionable insight from the people that have engaged with the product, but it has also enabled us to spark and strengthen relationships with the people that have used the platform and who have supported us on our journey. Winning the Devcon IV UX Awards in 2018 with our new explorer was a key indicator that the work we had been doing was incredibly valuable. We hope this serves as an example of how important user centric building can be for web3.

Looking Ahead

Moving forward, the protocol and the Bounties explorer as well as the existing communities will stay as they are. Organizations will still be able create bounties on any tasks they desire at their own leisure, and continue giving everyone an opportunity to explore a live Ethereum dapp and earn crypto. We will also continue supporting teams wanting to make use of the platform or protocol (on a more casual basis), and remain open to contributions to any of our codebases if users have new functionality they wish to add.

Overall, we feel very excited about what’s next, for both the team and for the space in general. We feel confident that Gitcoin will continue to steward the bounties use-case in a way that improves collaboration in the Ethereum community, as well as explore new ways of incentivizing people like their CLR Grants program.

A list of “thank-you’s” would be too long to include in a blog post like this one, so for now we’ll say this — to the many individuals, teams and incredible users who over the past two years have given us advice, guided our intuitions, and supported our work, we want to extend our deep gratitude for your help and we hope you continue using bounties as part of your blockchain experience.

We’re excited to announce that we’ve deployed meta-transactions for users who don’t have the ETH necessary to pay for gas. Initially, this will only be available for users while they are fulfilling bounties, which we see as an extremely important on-boarding moment for brand new users. It will also be available only on new bounties, and is not backwards compatible with existing bounties.

Nonetheless, this removes one of the biggest hurdles we’ve seen with user on-boarding to date, and makes it even easier for new members of the Ethereum community to earn their first crypto, rather than having to buy it.

What Are Meta-Transactions?

When a user creates a new transaction in their wallet, they sign a message which is sent directly to the Ethereum network. When a user creates a meta-transaction, a user signs a similar message (but one which is not a valid Ethereum transaction), and sends it to a 3rd party, who then submits the message on their behalf, within a transaction of their own. This is possible because the message that the user signs contains all of the same information that they would otherwise pass while creating the transaction — the address contract they’re interacted with, the function being called, and the parameters that the user is supplying for the function.

This means that while the signed message doesn’t conform to the standard which is required for signed messages to be valid Ethereum transactions, we can still write smart contracts which decode these messages (verifying their veracity on-chain), and then call those functions on behalf of other users. In this way, anyone can sponsor the gas that’s needed to initiate the transaction on the network, rather than having it come out of that user’s account.

Why Do Meta Transactions Matter?

For our purposes, we expect that this will help us continue our efforts to broaden the access our platform provides, making it even easier for people within the many communities that we serve to use our product without entirely understanding what’s going on under the hood. While it’s still early, we see meta-transactions as a critical element of an Ethereum user experience that closely mirrors the one which users might expect from existing Web2.0 platforms. This will create an important additional benefit for bounty issuers whose main goals are to access new markets, with individuals who might not have the means, education, or regulatory environment necessary to purchase ETH.

While many teams are doing great work to push meta-transactions forward in their own ways (people building transaction relayer networks, MetaCartel, and teams like Gnosis Safe using them as part of novel contract wallets), we decided that it would still be worthwhile to create a customized relayer contract specifically for StandardBounties, which made it even easier for us to deploy our own relayer, and begin enabling the feature immediately. Nonetheless, meta-transactions submitted via proxy contracts (ie by contract wallets) are still possible simply by having users interact with the original contract, and ignoring the surplus relayer that we’ve deployed.

Finally, this will help us continue exploring how bounties can be used for rapid organization within any community, with an intentional focus on those which are unrelated to Ethereum or cryptocurrency.

If you’re a community organizer who might benefit from using a tokenized marketplace to get members to collaborate, we’d love to talk to you.

Have some thoughts on meta transactions? Drop us a line. In the mean time, subscribe to our updates, follow us on Twitter and join our community.

Going Live With Meta-Transactions was originally published in Bounties Network on Medium, where people are continuing the conversation by highlighting and responding to this story.

How Bounties Can be Used to Incentivize the Growth of Culture in a Broad and Diverse Manner

Two weeks ago at Devcon 5, I was lucky enough to deliver a talk about a thesis which had been gestating for quite a while. The talk told the story of Bitcoin’s rise to global digital asset dominance, and explained the importance of culture for having gotten it there. I showed how many of the disparate actors and stages within the ecosystem, from Satoshi’s original paper, to BitcoinTalk forums, to the Silk Road, had led to the formation of an ever-evolving and fragmenting culture. Most importantly, I described how critical cultures are for bringing people into communities and keeping them there. I also hinted at some ideas about how cultures can be successfully built.

For more on the importance of culture, see the talk in its entirety:

Building a Culture From Thin Air

One of the important aspects of building cultures is that it’s difficult to accomplish in an intentional or directed way — the second you start trying to shape what’s “cool” within a community, an awkwardness washes over the endeavour. This is the same feeling that we experience when we see grown adults trying to mimic youth culture: you’re trying too hard.

In light of this, how does a community — with its own set of goals and values — begin to create its own culture? While we aren’t experts in this field, we have seen various organizations using bounties to successfully create a culture by leveraging the power of incentives to organize action.

Many Views of the Same Focal Points

One of the ideas I discuss in my talk is the notion of a focal point: an object, a word, an event, a person, any thing, which acts as a manifestation of the community in the real world. Good focal points give communities critical fulcrums around which they may revolve. I also note the importance leaving focal points as vaguely defined as possible, so that there’s enough freedom for individuals to see whatever they please within them. The Ethereum diamond is a great focal point, since it can be interpreted with so many stylistic angles that it can easily express the universal nature of the technology it’s meant to represent.

This past year, the ETHNewYork hackathon organizing team decided that their primary focal point (their mascot and logo) would be the Pizza Rat. However, instead of putting it on themselves to create visual representations of the Pizza Rat, they left it to their community using a bounty.

Pizza Rat Design Challenge

The team experimented with our competition format for the bounty, so that anyone could freely create their own designs for the Pizza Rat, without having to ask for permission. Then, once submissions had been collected, organizers turned to their community on Twitter, to let the public vote on which images were the best.

What resulted was a beautiful myriad of images of the Pizza Rat, running around doing all the things that pizza rats do. The winning image was selected for being the best representation of the goals & values of ETHNY:
“Everyone Deserves a Piece”.

This bounty showed a great example of how communities can crowdsource media to create new interpretations of their focal points. This is powerful because it opens up the creation of focal points to the many rather than the few: anyone could freely submit an image, and anyone could vote on which ones were the best. In this way, it wasn’t the organizers who created the focal point (beyond seeding the initial idea), it was the community creating their focal points together.

Creating Spaces For Culture to Form Itself

Another aspect of forming culture that we know well is the importance of events, through the creation of new connections between the nodes within a given community. Events allow new members to meet other like-minded individuals, and create spaces for ideas to move much faster than they might otherwise, using online forums.

Again, we see a number of examples of teams using bounties to help them run events, whether it’s explicitly paying people to run meetups, or using bounties to incentivize referrals to discover the best individuals in new areas who can run them:

Refer a friend to Maker's Community Meetup Grants program

In this way, community organizers can scale their event-planning activities by having other people run the events, rather than trying to do all of the organizing themselves. This is incredibly important for teams which desire to have a global presence, but don’t have team members in all markets, and need to avoid the high travel costs of flying team members across the world. We strongly believe that bounties can be powerful for helping communities reach a global scale, by helping them run events in a cost efficient and scalable manner.

Bringing In Fresh Faces

One of the key elements of the thesis on the importance of culture is the way that it brings in new people to an ecosystem. Communities which are able to successfully bring in lots of new members will have an easier time getting discovered by new contributors, funders, and users.

Once more, we see that bounties can be powerful tools for pulling people into communities, when companies choose to spend their user acquisition costs more wisely by giving the funds to new users, rather than spending it on advertising.

There are a plethora of on-boarding bounties which have accomplished this successfully, one of which includes Opera’s recent bounty:

Experience Web 3, get your first bounty with Opera 💸

By incentivizing users to on-board, you can help them get past the mental fatigue of joining your new platform or community, and have them join for long enough to realize it’s real value to them.

Looking Ahead

These are only just a few examples of how cultures can be built using incentivized tasks, but hopefully this post can begin to paint a picture about how it is indeed possible to create a culture from thin air, if you’re brave enough to experiment with how you disburse your tokens to new users. This is only the beginning though, and we’re excited about how communities will continue exploring how bounties can be used to create and grow their cultures.

Finally, many who encounter bounties for cultural tasks might balk at the idea of paying people to do tasks which “loyal community members should already do on their own, based on intrinsic motivations”. However, it’s important to remember that many of the people who are joining our web3 communities are focussed on more pressing issues of paying their rents and getting food on their tables. Using tokenized incentives for these types of tasks is a great way of showing consciousness about the disparity between the abundance many have achieved within our ecosystem, and the status quo for so many in the world. 🌎🌍🌏

Have some thoughts on communities? Drop us a line. In the mean time, subscribe to our updates, follow us on Twitter and join our community.

Creating Culture Within Communities was originally published in Bounties Network on Medium, where people are continuing the conversation by highlighting and responding to this story.

An example of the attack vector:

A contributor C1 makes a contribution of 10 Ether with contribution id = 0.

A contributor C2 makes a contribution of 10 Ether with contribution id = 1.

An issuer I1 that does not relate in any way to C1 or C2 issues a refundContributions call with the _contributionIds parameter being equal [1].

As a result of this call, C2 receives 10 Ether back. After the call, the balance of the bounty is 10 Ether.
C2 issues a refundContribution call with the _contributionId parameter being equal to 1. As a result of this call, C2 receives the remaining 10 Ether.

Ultimately, C2 received a double refund, and the contribution of C1 was in fact transferred to C2. The balance of the bounty is 0, despite the fact that the issuer intended to refund only C2.

The nature of this bug was such that it first required bounty issuers to refund a set of contributions en masse, but leave a subset of the funds in the bounty remaining (for a contributor to then re-refund themselves). This mass-refund function wasn’t one which we’d implemented on our front-end, and could only be accessible through customized interfaces, or by interacting directly with the smart contract in a manual fashion. We therefore decided the likelihood of funds being at risk was fairly low, and delayed announcing this issue until the fix was ready.

As soon as we discovered this issue, we notified the original team which had performed our smart contract audit (ConsenSys Diligence), and immediately began work on a new version of the contract which fixed this issue.

The new version of our contracts (V2.1) has now been deployed, and the new code is now live for use by the public. We’re glad to say no users were able to exploit this esoteric bug in the time it took us to update our codebase and test it to ensure no new bugs would arise from the patch.

We remain incredibly thankful for the Mixbytes team who performed the audit, and the Autark team that triggered a new audit of the code (and has been a delight to work with as they develop an integration between Bounties Network and Aragon).

While we remain diligent about following best practises around deploying smart contract code — complete with both programmatic and manual testing, code reviews, 3rd party code auditing, and finally a public bug bounty (none of which were able to surface this issue) — this occurrence serves as an important reminder that any code written by humans is susceptible to human errors and bugs.

We look forward to continuing to support an open protocol for Bounties on Ethereum, and working with as many teams as we can to ensure maximal interoperability and standardization to the benefit of our users and the broader Ethereum community.

StandardBounties V2 Vulnerability Report was originally published in Bounties Network on Medium, where people are continuing the conversation by highlighting and responding to this story.

Going Live with StandardBounties 2.0

When we first started working on The Bounties Network in Spring of 2017, our main goal was simple: to create a generalized protocol for bounties on Ethereum. This would allow for interoperable marketplaces to be built with ease, letting any application integrate the use of bounties as they saw fit.

When we launched the StandardBounties protocol and Bounties Explorer to Mainnet in October of 2017, the smart contracts that would power this shared liquidity pool were fairly simple. However, we baked in a number of default features which were meant to protect freelancers: that people who post bounties wouldn’t be able to change requirements on the fly (an issue freelancers face on a daily basis), and that they wouldn’t be able to decrease the payouts without first de-activating the bounty and creating a new one. This marked a clear change from web2.0 models, and reflected our belief in creating new means of earning for people that didn’t commoditize or de-humanize them, but rather respected the needs of individuals on both sides of the transactions.

As the protocol and the Explorer got more and more traction and we expanded the use of bounties across different verticals, the feedback started rolling in.

Our first key realisation was that bounty issuers could still choose not to pay bounty fulfillers if they didn’t want to, so we’d eventually need a dispute resolution mechanism alongside the bounty escrow contracts. Changing requirements unfairly or refusing to pay people all fall within the scope of dispute resolution mechanisms, and shouldn’t therefore be included within the core bounty escrow contracts. While we’ve spent significant time exploring such dispute resolution mechanisms, we’re lucky enough to not need such complex solutions just yet.

Alongside this feedback that the contracts were too restrictive, we also learned that the contracts weren’t nearly as flexible as real life use cases needed them to be. Our users didn’t just want fixed payouts, they wanted to experiment with new fund disbursal mechanisms and dynamic payouts. This had nothing to do with avoiding set rewards, but an attempt to fairly distribute funds when requirements weren’t as simple as one fulfiller submitting deliverables.

As a result, we went back to the drawing board and re-wrote our StandardBounties smart contracts from scratch to more accurately reflect the way that our users were interacting with each other. We’re excited to say that these new contracts are now live, and that many of these new features are coming soon to the Bounties Explorer.

Here are some of the major changes coming to StandardBounties:

NFT Bounties

In the last year and a half, the Ethereum ecosystem has fallen in love with non-fungible tokens, realizing how important they are in representing the non-fungible assets we already interact with, digital or otherwise. To that end, we’re excited that our new contracts will now support rewards in NFTs, so that our users can continue experimenting with new ways to reward each other with tokenized assets.

Meta Transactions

One of the biggest complaints we hear is that interacting with smart contracts shouldn’t necessarily cost gas, if there are other users willing to sponsor them. To that end, we’ve created a Meta Transaction Relayer that’s custom built for StandardBounties which lets anyone submit signed messages on anyone else’s behalf, paying the gas on their behalf while still make verifiably consistent state transitions on Ethereum. While we recognize that the ecosystem is still early in defining the best solution for gas-less transactions, we believe this is a good first step that will enable us to further experiment with sponsored transactions.

Collaboration

One of the largest oversights in our initial contracts was the inability for multiple users to receive payouts for a submission (without deploying a multi-sig wallet on the group’s behalf). This greatly restricts the manner in which users can collaborate each other, and once again does not properly reflect the manner in which our users actually perform tasks. We’ve now added the ability for submissions to include multiple payout recipients, so that people can work together on tasks and get paid easily for doing so.

Dynamic Payouts

By far the most dramatic change to the way our bounty escrow contracts work is around bounty payouts, which are now entirely flexible and enable bounty issuers to choose how much to pay various submissions even after the bounty has completed. This means that Bounties Network users can continue experimenting with new competition models, such as paying a subset of the bounty to chosen submissions and having the remainder split among submissions which weren’t selected.

Issuers can now also pay out a subset of the bounty in a piecemeal fashion based on the completion of particular milestones within a given bounty, letting various contributors do parts of the task (without collaborating) rather than requiring a single submission to include the finished deliverables. This will enable Bounties Network to host even larger and more important tasks than ever before.

While our Bounties Explorer won’t see immediate implementation of these new features, we’re keen to begin pushing them out continuously in an iterative fashion as time goes on. By making sure our new smart contracts are as robust and generalized as possible, we hope we can continue to grow the platform without causing any interruptions for our users or for other dapps which use StandardBounties like Gitcoin or Aragon.

While smart contract migrations are hard, we plan on continuing to support interactions with the existing version of our contracts until the funds within it have all been paid out, so you can rest assured that if you’re using Bounties right now, nothing will change.

We can’t wait to see what the next year will bring for us in our continued exploration of incentives, and how they can be used to shape human behaviour. If you’re excited about this too, or just want to jam out about how much you love bounties, don’t hesitate to join our Slack. If you prefer a more regular cadence from hearing from us, you can sign up to our newsletters or follow us on Twitter as well.

Bzzz.

Ushering In a New Era of Bounties was originally published in Bounties Network on Medium, where people are continuing the conversation by highlighting and responding to this story.

Last year, the Bounties Network team spent some time researching decentralized arbitration schemes, attempting to solve the difficulties that most marketplaces face around providing fair arbitration for users, which takes into account the changing contexts of the transactions they facilitate.

Out of this sprung Delphi, a mechanism for p2p dispute resolution that had users staking tokens and opening claims against each other. Most importantly, rather than those claims being ruled upon by us as a marketplace operator, they would instead be adjudicated by a group of 3rd party individuals, whose membership would be curated by a TCR. Using a TCR to curate a list of trustworthy arbiters for a particular set of domains made sense — the subjective nature of the evaluation necessitates a human touch. However, as time went on (and I talked to Dean Eigenmann more), it became increasingly clear that we shouldn’t be relying on TCRs as a finished component that didn’t require further scrutiny.

While we’ve since de-prioritized our work on Delphi for the immediate term, we feel compelled to share where we left off in our exploration, lest another brave mechanism designer wants to pick up the torch. The key, we believe, is self curation.

Self Curating Groups

One of the biggest issues we had with TCRs was based on the notion that the curation of the list would be undertaken by a group of token-holders, with no guarantees of honesty, trustworthiness, or even that the token holders knew anything about the contents of the list being curated. This made no sense to us — why would we blindly trust the evaluations of strangers without the ability to contextualize their evaluations based on their levels of understanding and bias? TCR1.0-maximalists will typically assert that the profit motive is strong enough to incentivize individuals into rationally evaluating their biases and understanding, to only vote when they felt they would improve the quality of the list. But are humans rational? How effectively do we evaluate our own biases and understanding towards a given topic?

In response to this, our thinking changed dramatically: what if instead of assuming that the curators and listees were independent groups (with some overlap), we treated them as one and the same?

Natural Systems

When we look at how individuals organize into groups in the real world, we witness the natural processes of curation through invitation, exclusion, and expulsion happening organically by members of the group itself, rather than some external deciding body. While centralized planning and coordination produce efficiency benefits when that body can be guaranteed to be of a high quality, the efficiency is lost if just anyone can become a member of the governing body simply by purchasing tokens on the open market.

Humans organically self-organize all the time, usually when high quality individuals coagulate to separate themselves from their peers, seeking differentiation in an increasingly homogenous world. They evaluate their peers, and gravitate towards those within or above their quality bracket. When they encounter new individuals, they’ll invite those who meet the quality thresholds of the group. When members of the group misbehave, they’ll get ostracized when high quality members don’t want to associate with them anymore. Similarly, members of the group will seek to differentiate the group from those outside of it, emphasizing how members of the group differ in quality from the general population.

We witness and participate in this kind of curation on a daily basis, when we choose which friends to spend time with in our personal lives, or which organizations we should work with in our professional lives.

Listees are Domain Experts

Within an ecosystem, there will be certain metrics or values with which members are evaluated for their quality: among ballerinas it might be their flexibility or artistry; among restaurants it might be the speed of their service or quality of ingredients. Members of the ecosystem will know these metrics well — these are the same metrics they will use when optimizing their own performances. They will also be experienced in evaluating their peers using these metrics, as they constantly compare themselves to others in their race towards relative excellence.

As a result of this, it seems self-evident that the individuals which should be most trusted to curate a list are those within it, who already possess the skills necessary to curate within a particular domain. This is contrary to TCR1.0s, which desire for “the crowd” to manifest their wisdom, even when the crowd has no understanding or experience working within it.

Are people all equally fit to make various evaluations, or does our suitability depend on our knowledge and experience within a particular domain?

Intelligent Plutocracy

One of the elements which was recently included within the Moloch DAO specification was the notion that to become a token-holder and voter, one needed to apply to purchase shares, allowing existing token-holders to curate the set of individuals who would be voting to administer it’s funds. Individuals apply to purchase a given amount, and are accepted if the group feels comfortable giving that individual their desired voting weight over the funds.

While this wasn’t a detail we’d considered previously, it’s certainly interesting — should listees have equal weight in their curation voting?

Once again looking at natural systems, the answer seems to be no: we constantly give more credence to the opinions of our most highly regarded peers. Our stronger reliance on expert opinions is the reason why social media influencers succeeded in drawing a crowd to the ill-fated Fyre Festival, and is also the reason we prefer political pundits who have themselves worked within the sphere that’s being discussed.

By following in the footsteps of the Moloch DAO and having list applicants self-specify their desired voting weight (or changes to their weights if they’re already members), the group itself can determine whose voices should be the loudest. Ranking list members by their voting weight would likely also merit some interesting insights, for those who would wish to understand the breadth of quality within the list (derived as a result of the difference in voting weight between the highest and lowest ranked members), or simply the ordering of members.

However, if TCRs were to implement such a mechanism, they would differ substantially from organic vote-weighting due to the explicit nature of the weight specification: in natural systems, actors will weigh each others’ opinions based on their personal opinions of them, which may change when they become exposed to the public (or when they can see how heavily others weigh an individual’s opinions).

Healthy Competition

Finally, and in my opinion most importantly, self curating groups allow for healthy competition.

One of the main issues with TCRs was the high overhead in launching a competing TCR: not just the gas or technical costs of supporting a new system, but the high social costs required for people to begin coordinating around a newly minted token. These barriers to entry and competition meant that most TCR designers expected for there to be just one list for a particular domain, rather than a plurality of competing lists.

Are monopolies healthy?

Because of the way self-curated lists simplify the social constructs of TCRs, the overhead of starting a new list becomes much lower, improving the efficiency of the system when those who were wrongfully rejected from one list may start their own. Of course these lists will still suffer the consequences of being less relied upon, however this can easily be fixed by having TCR-consuming-systems respond to the creation of new lists and support a plurality of lists rather than just one.

When we once again look at natural systems, we see that in the face of inconsistent curation (where suitable members are unfairly excluded from a list), individuals will instead opt to create their own groups, sometimes including those members of the original list who agreed with their entry. From the playground to the fashion world, this kind of competition is the way that insecure incumbents are commonly disrupted.

When we think about the lists we rely upon as consumers, a number stand out that help us make decisions about where or how to spend our time and money. One such example is winners of The Oscars, the unquestionably most important curation that occurs in the film ecosystem. And by whom is this list curated? By a collection of past nominees (listees) and individuals who have been sponsored by existing members of The Academy, to be curated even further by The Academy’s Board of Governors.

Self-curating lists are all around us, and their existence rests on their simplicity. They don’t rely on the procurement of a 3rd party who should be incentivized to curate; instead they use the intrinsic incentives of list members to only associate with their highest quality peers to improve their own reputations.

In light of this we’re forced to ask: if curated registries exist in the natural world without their own tokens, why do they need a token to function now?

As the pace of Ethereum development continues to accelerate and teams continue to explore curation mechanisms for their various use cases, my hope is that more teams will continue to explore how we can construct crypto-systems which mirror the natural world, rather than eschewing the patterns that exist within our common social behaviours. If you are working on a TCR related use-case, please feel free to reach out and join our slack (and chat with us about these concepts at length), or evolve my nascent perspective into a more fully-formed Self Curating Lists concept.

As with most of my opinions, this blog post necessitates a disclaimer that my perspective on this topic is unrefined and unfinished — my hope is simply that by sharing it we can help accelerate the pace of TCR development towards an end which, to me, appears inevitable.

TCRs 2.0: Self Curating Lists was originally published in Bounties Network on Medium, where people are continuing the conversation by highlighting and responding to this story.

When we talk about the future of work, what we’re usually talking about is the future of earning: how are people’s sources of income changing? Blockchains have not only helped far-flung users transact more efficiently, but they’ve also opened up new incentive systems and completely new sources of income for communities worldwide.

At Bounties Network, we’ve taken a most primitive form of incentive — the exchange of tokens for services rendered — and spent over a year experimenting with how it can be used to shape human behavior. What we’ve found is that there’s a long tail of varied and unique tasks that capital allocators are now able to fund, and the curve is only getting flatter as people discover new ways to incentivize each other.

The Long Tail: 5 Bounties Use Cases

As we analyze the types of tasks that are being bountied, the glaring truth before us is that a large majority of our tasks will be outsourced work: code, design, translations, research, and writing. However, what we’re also seeing is a new genre of tasks based on incentivizing whole communities: bounty creators are asking one or more people in a community to do something — anything — in order to spark larger community action.

If you met anyone from the Bounties Network team at an event in 2018, we probably asked you our golden question: If you could bounty anything in the world, what would it be?

Some people wanted to bounty burdensome chores like cleaning or dog-walking. Others said they’d put their money towards community commons: things like art, education, or environmental stewardship.

Gradually, we’ve seen people become more used to the idea that bounties are valuable for more than just code. Over the last year, we went out and tested bounties in the wild, and here are some of the long-tail examples we encountered.

Bounties are helping people incentivize social impact

One of the first places we knew we wanted to test bounties was in the social impact space, realizing that it was ripe for innovation. The cool thing about bounties in this use-case is how they easily allow people from around the world to coordinate and pool capital and deploy it towards practical causes. With bounties, contributors can be certain that 100% of the funds go to people on the ground who are actually completing the tasks, rather than to NGO marketing or admin costs.

One example of a social impact bounty is our Bounties for the Oceans project, which started off as a simple bounty and grew into a much larger phenomenon after we ran a targeted cleanup event in Manila Bay last December. Check out the trailer for The Bounty for Basura, a documentary we’re working on with filmmakers Will Lee and Nathan Beer about how crypto-based incentives can fix community issues and reinvent what it means to work in the 21st century.

Bounties are helping marketers scale community management

The world of marketing is rapidly changing. With the advent of the internet, marketing has gone from organizations just communicating to the outside world to organizations engaging the their communities in more meaningful dialogue. Nowhere is this more prevalent than the crypto space, where community management now makes up a growing percentage of our marketing expense.

What would happen if companies slashed their marketing budgets, and instead gave the money to people in their communities?

This is the question we’ve been asking ourselves, and we’re seeing more and more companies beginning to ask themselves the same thing. My favourite example is a recent bounty from the Status team that incentivizes members of their community who are attending ETHDenver to submit media content for the film they’re creating.

#ETHDenver Chronicles Bounty #1 (simple pictures, short video)

Another meaningful example comes from the Ocean Protocol team, which used a bounty to engage someone in their community to run a meetup for them. Again we see an example of an organization using bounties to engage their most loyal community members to become ambassadors of the organization. This is how you scale community management.

Organize a local Ocean Protocol event

Community Engagement is one of my favourite verticals, because it revolves around strengthening the relationship between a core team and their community members through the use of smart collaboration. The best way to help people feel like they’re a part of your mission is to blur the lines of your organization and have them actually help you achieve that mission.

Bounties are helping startups talk to their users

Your users’ time is valuable — you should pay them for it.

If you’re a startup building towards product-market fit, then you know that feedback from your users is worth its weight in gold. They will tell you exactly how they feel while using your product, and slowly guide you towards solving their most pressing pain points. Responding to user needs is the hallmark of a successful startup, but as anyone who’s ever tried to gather feedback knows, it isn’t always very forthcoming.

What we’ve noticed is that user research is far easier when you can pay people who otherwise wouldn’t have been willing to volunteer their time. Research bounties are a staple on the platform, and we rely on them heavily as a team. This recent example from Trustless Atomic Loans pays 25 DAI for someone to complete a 30 minute video call interview:

Complete a Zoom Interview on Cryptocurrency Mining

Bounties are helping audiences commission creative work from the world

Bounties are reactivating and broadening the patronage model that gave the world some of our greatest art. Commissioning creative work that the public can consume is a magical feeling. I put a bounty on a musical mashup I wanted to hear and the result surpassed anything I had expected. These bounties for art give us a taste of what’s possible when people put capital behind the creation of commons.

Commissioning creative work through bounties also has a potentially lucrative side: individuals can pool capital to commission some artifacts and then generate an income from either selling them, earning ad revenue for their consumption, or using a mechanism like a bonding curve for creative works that we’re beginning to see teams in the ecosystem explore. I suspect that once someone figures out how to close the value loop on bounties, these will become a massive sector on their own.

Bounties are helping teams outsource work and hire top candidates

Alongside our exploration into the deep end of bounties, we’ve always made sure that people could still use Bounties Network to outsource work and help teams move faster when there’s an overflow of tasks. We’ve seen Gitcoin use the Bounties protocol to make massive strides in the Open Source community, helping many of Ethereum’s most important development teams ship faster. Similarly on Bounties Network, we’ve seen teams bounty design, translations, research, and writing tasks, once again engaging their communities while at the same time moving closer towards their individual goals.

The strongest teams know that when they outsource work to their communities, they strengthen ties by bringing people into their organization. Bounties are also our team’s most important hiring tool: we hire people who have completed our bounties, and we also use bounties to vet candidates before extending offers. We find bounties to be the perfect way to test candidates in a meaningful way — to have them produce code you’ll actually end up using — without just taking advantage of candidates for free labour.

What we commonly see is that productivity bounties are themselves an element of an organization’s community strategy: forward-thinking teams are pulling back the curtain and letting the community help them produce the show, rather than sitting in the audience watching it. This recent bounty from Uniswap is a great example of a team with an active community using bounties to build in a more collaborative manner:

Uniswap Logo

What’s Next and How to Get Started

As more teams move from just building projects to actually shipping and testing them with users, we expect we’ll see more teams using bounties to engage with their audiences and move even faster.

What this all means, practically speaking, is that the way people are earning money is changing. By all accounts, the long tail of bounties is only getting longer, as people begin allocating capital in new ways to shape and change human behaviour. We’re only just beginning to unpack what it means to “work” or “create” in the age of the internet, but what we can tell for sure is that people love earning tokens to augment their existing income streams, and we want to help them do that more.

We’re working on some cool updates coming to the Bounties Network over the next few months, and we’re excited to continue exploring the way that individuals engage and collaborate with organizations and with one another.

If you’re excited about a bounties-powered economy and looking to create, earn, or just learn more, here are a couple great places to get started:

• 🌺🐝 Browse Active Bounties on the Explorer
• ➕✉️ Sign Up for Email Updates
• 🦆⭐️ Join our Slack Community

Disclaimer. The views, information and opinions expressed are solely those by the author above do not necessarily represent the views of Consensys AG. This article is a general interest piece and is not an endorsement of any betting or gambling platforms. Any reference in this article to any person, organization, activity, products, or services does not constitute an endorsement or recommendation of ConsenSys. This article does not constitute legal or other professional advice or services. ConsenSys is a decentralized community with ConsenSys Media being a platform for members to freely express their diverse ideas and perspectives. To learn more about ConsenSys and Ethereum, please visit our website.

How Crypto Bounties are Changing the Way We Earn was originally published in ConsenSys Media on Medium, where people are continuing the conversation by highlighting and responding to this story.

On December 1st and 2nd, Bounties Network, ConsenSys Social Impact, and Coins.ph came together for an event with one goal: to test how incentives could catalyze grass-roots environmental impact.

Our main intention with the BFTO bounty-based cleanup in Manila Bay was to test out how we could re-engineer the flow of money and its distribution patterns by actively involving local communities through cryptocurrency based incentives. We believed this new mechanism could also help create new means of rewarding individuals for positive action while vastly reducing the burdensome administrative costs afflicting most charity models today.

As anyone who attended the cleanup can attest, the atmosphere across the two days was nothing short of electrifying. We witnessed this convergence of two groups, who were simultaneously both teaching and learning from each other. On one hand we had locals, most of whom had never even heard of cryptocurrencies before, who were curious about the potential benefits that blockchains could provide them. On the other, we had technologists who were keen to understand the real challenges they’d face in on-boarding the general public to these nascent systems.

From the very first stages of planning, we knew we had a long list of questions to answer:

• How many people would be interested in picking up the trash that floated into Manila Bay?
• How many of them would know what cryptocurrencies were, or how to use them?
• How many of them would even have smartphones with stable internet access?

Regardless of the hurdles they faced, we encountered participants who were delighted that people around the world had donated funds just to help them clean up their small corner of the planet, and were excited to earn an income while improving their community. It was refreshing to see people not worried about the prices of various coins, but rather encouraged by the tangible impact that blockchains could have on their lives.

Incentives as a Spark

One of the most interesting dynamics we saw throughout the weekend was the manner in which people shifted from being extrinsically motivated to intrinsically. Many who attended the event came out simply because they saw the opportunity to earn supplementary income. However, as we engaged with participants on an individual basis, we learned about the sense of personal accomplishment they felt in collectively improving their environment.

Extrinsic incentives may be the spark that ignites action, but it’s the self-motivation, celebration, and community validation that keep the fire burning.

As a company whose entire charge is to motivate action using extrinsic incentives (i.e. bounties), this was a truth none of us had considered uncovering, yet the individual stories we heard drove the point home. We’re looking forward to seeing how we can continue to use bounties in this manner, encouraging people to overcome the initial hurdles of doing social and environmental good without having to necessarily incentivize them in perpetuity.

Talking TO the Unbanked Instead of ABOUT them

One of the main motivators for creating and running a pilot project like Bounties for the Oceans was to actually engage with the individuals who we, as an ecosystem, spend so much time describing at conferences and on panels. It immediately became clear to us that this was a significant departure from the norm — how many dapps working to help on-board the “unbanked” have ever actually spoken to the people they’re describing?

We spent much of the cleanup talking to locals from around the metro Manila area, and the stories we heard were fascinating: fishermen whose jobs were erased due to overfishing and pollution, community members whose entire livelihood is based on recycling the plastic that floated into Manila Bay, and students looking towards their future and the future of the world around them. This barely scratches the surface of what we learned, but we will share more of these stories at a later date.

The Issues we Faced

While this event was by all accounts a success, there are a number of challenges we ran into and we want to share them with the Ethereum community and anyone observing our work in the ecosystem. After all, the entire point of this event was to test our assumptions on the ground, going way beyond a traditional cleanup.

• Education: By far the most prominent issue we faced during the event was around education. Most of the participants had never even heard of Bitcoin, let alone other blockchains like Ethereum or smart contracts. We only had 2 hours to get people accustomed to the flow of the technology, and most people were entirely unfamiliar with the technology to begin with. It became abundantly clear to us that in order to explain how they were getting paid, we needed to cut to the gist: why do blockchains matter for this group of people.
  In Manila, we found it valuable to describe some of the benefits for cross-border payments, since many Filipinos already rely heavily on international payment rails. We also saw the obvious benefit of education by obfuscation — explaining what was happening without ever getting into how.
• Having a Wallet: After education, on-boarding users onto wallets was a challenging hurdle. Only 10% of participants who decided to attend the event had working smartphones. Of those, a considerable percentage came from illegitimate manufacturers, and therefore couldn’t run any of the mobile wallet apps available for download in the Philippines (of which there were two). As a result, we ended up relying on volunteer reps to fulfill the bounty on behalf of the participants. Our exchange partner on the ground, Coins.ph, could then convert and assign the funds to individual users based on their phone numbers, with pick up available at a multitude of locations across Manila and the entire country. Our hope is to continue innovating on this front, without sacrificing the entire point of decentralized technologies — the ability for users to administer their funds autonomously.
• Paying Gas: While this issue was Bounties Network specific (as our dapp still requires bounty fulfillers to pay a nominal amount of gas), we thought it important to document here. Even though we were paying for users’ gas (sending them ETH once their wallet was setup), waiting for the transactions to confirm before users could fulfill the bounty added complexity to the process. We are hard at work solving this issue, experimenting with a myriad of meta-transaction solutions that will let us easily subsidize the gas on behalf of our users.

• Internet: This was an issue which we had expected, and unsurprisingly it manifested, not only due to the slow internet speeds we faced in the middle of a natural habitat reserve, but also because most participants simply didn’t have mobile data plans they could rely on. We quickly realized that we needed to setup hotspots in order to minimize the amount of data being transferred from the devices of participants to our servers, and vice versa. An important facet to remember here is that in most developing countries, mobile phones operate on a pay-as-you-go basis, meaning that every single additional megabyte that was transmitted resulted in a decrease in the net payout participants would eventually receive. Data is money.

These are some of the issues we faced when on-boarding new users to our dapp. Since the pilot was all about testing our social impact model within real communities for concrete initiatives, we believe these takeaways are incredibly valuable. As the Ethereum ecosystem begins to shift its focus away from crypto-economic research for scaling, towards end-user research for improved on-boarding, we want to encourage every single reader to run experiments like this one, even if it’s just in their own communities. It’s a process that was full of friction, but we need to experience that friction in order to smooth out the process.

What was the Impact?

As many critical readers of this post might be thinking, the reality is that the long-term environmental impact we made was quite minimal. We taught 224 people about cryptocurrency and cleaned up just over 3 tonnes of trash consisting of 315 kg of plastic, 103kg of rubber, 120 kg styro, and 27kg glass bottles. However, ultimately we know that when the next storm comes, a new wave of trash will be washed ashore, ready to be picked up.

We also haven’t taken any real steps to address the issue at hand: where is this trash coming from? It’s well known that these types of beach cleanups usually function as mechanisms for education and evangelism rather than long-term impact, showing people the realities of where our straws and plastic bags end up, as well as helping to spread the cleanup message to a wider audience.

After running this event, we’ve realized that the real impact we made was social rather than environmental — teaching participants (and those following the project) about the lifecycle of trash, so they can make long-term behavioural changes on their own. Our hope is that this event will also create long-lasting benefit because now we understand how incentives can be used to motivate people to take action, and similarly how our dapp can be improved for more of these types of use-cases in the developing world. Most importantly, seeing as the cost of the event was less than the cost of a sponsorship slot at an industry event, we’re quite happy with the ROI we’ll achieve as a result.

Our Reflections as a Team

Running the Bounties for the Oceans clean-up event, we felt a profound sense of rejuvenation and inspiration — we were reminded of why we we’re building Bounties Network in the first place. It’s easy for us to get distracted with crypto conferences and Twitter beef. Nothing can compare to actually speaking with people on the ground, and watching as they begin to understand the potential technology has to improve their lives. It felt good to know that we were fighting the on-boarding war directly on the front lines, and making a real difference for the planet while we did it. We hope that this event can inspire more dapps to journey to new communities, understand their stories, and learn about how they can bridge the gap between the technologists and those who need this tech the most.

Giving Thanks

Finally, we wanted to take a moment to thank every single organizer and volunteer who attended the event and made it possible. Here’s a long list of people who made a tangible impact on this event (in no particular order). Simona Pop, Ben Siegel, Cheryl Douglass, Aiai Garcia, Nathan Beer, Will Lee, Gabriel Tumlos, Will King, Amanda Dominguez, Jonny Howle, Scott Moore, Dean Eigenmann, the entire Full House team (Chriz Serrano Zabala, Maricel Ticar Santos, Alex Godinez), the entire Coins.ph team (Ron Hose, Christina Vergara, Colin Goltra, Kyle Vega, Aaron Galano), and many more.

Looking ahead, we’re incredibly excited for the future.

Long after this event is over, individuals in Manila can continue working to restore the health of their ecosystem and earn an income while doing it. The true value of bounties for social impact is empowering individuals and communities to self organize without the need for an organization to administer the process. Enabling, organizing, and facilitating positive action across the globe are the core ways we can re-engineer how the world works. We are committed to expanding the Bounties for the Oceans movement as a means of galvanizing action across the globe.

Together — individuals and organisations alike, we must collaborate to turn this ship around before we lose the natural resources that our very existence depends on. 🌊🌊🌊

Become a part of our Bounties Slack community, sign up to our emails, and follow us on Twitter to stay on top of all Bounties related social impact progress.

Bounties For The Oceans: Incentives to Change the World was originally published in Bounties Network on Medium, where people are continuing the conversation by highlighting and responding to this story.

The Ethereum Dispute Resolution Alliance

by Dean Eigenmann and Mark Beylin

In case it wasn’t already obvious, Ethereum needs robust, unopinionated dispute resolution systems. While Ethereum is great at minimizing the amount of trust counterparties must have in each other, ultimately some trust is required, and we need to build systems which address the cases when that trust is broken. In order to effectively pool together multiple teams and researchers working on this issue, we are announcing EDRA — The Ethereum Dispute Resolution Alliance.

This effort was started together by the Bounties Network and ENS teams after realizing that we were doubling our efforts to solve the same issues in designing dispute resolution systems. Since then, the Aragon One team has also decided to officially join us as a member of the alliance.

Our Goals

While we have many things we want to accomplish, they can be categorized into two main areas: collaborating on research and on standards.

In collaborating on research, our goal is to share as much information as possible with each other about ensuring the theoretical soundness of the mechanisms we’re designing, as well as their applicability for real users. While most researchers in Ethereum consider only the former game theory research, the latter is at least as important. We’ve realized that no matter how sound our designs are, it’s all for naught if users don’t feel they fulfill their needs. Our charge is to share our research in these areas as openly as possibly, not only among members of the alliance, but as well to the rest of the Ethereum community. A rising tide lifts all boats.

In collaborating on standards, we recognize and acknowledge that we have a rough road ahead of us. Collaborating on standards is necessarily difficult: we need multiple groups at the table, each of whom has different goals and use-cases, each making sure that what we build is consistent across a myriad of implementations. In order to accomplish this, we plan to:

• Take the time to understand the needs of all members, and ensure they’re met by whatever designs we settle on
• Make concessions, if we realize that ultimately one size won’t fit all
• Collaborate respectfully, not throwing stones if we become unhappy with the progress (or lack thereof) of EDRA members

Standardization is an uphill battle, but one we recognize is important when building such foundational mechanisms.

Our Plans

We desire to build a protocol for dispute resolution that is:

• Anti-fragile: providing the consistency necessary for such a core component
• Modular: capable of having different components swapped out, so that it is usable across any use-cases where dispute resolution is needed
• Un-opinionated: absent of implicit assumptions which are grounded in present-day dispute resolution systems.

Initially, we will meet on a monthly basis on publicly viewable calls, in which we can share the current status of our various efforts, and move towards finality in our various specifications and development efforts. When necessary, we’ll collaborate on shared code repositories, or build separate (but compatible) implementations of our specifications. These implementations will remain open and public, not siloed or hidden from outside scrutiny.

Finally, we will publish quarterly reports to summarize our work for public consumption, and keep anyone up to date who wishes to know the progress of our work. We don’t believe it’s necessary to deploy any new legal structures to accomplish these goals (as all alliance members are already part of established structures), but we pledge to equally share the burden of both work and costs. We’re a self-governing collective, without an ability to enforce anything other than membership, and easily forkable by anyone who disagrees with our goals, intentions, or direction.

Call to Action

If you’re a researcher, dapp, or user who’s interested in dispute resolution systems built on and for Ethereum, please join us. While we want to be slow about spinning up this effort to ensure we don’t have too many cooks in the kitchen before a more concrete direction can be decided upon, our goal is to eventually allow any interested collaborator to join this alliance.

• Sign Up to receive updates
• Join our Gitter

When we first began working on StandardBounties, it was because we saw people posting bounties with ETH and ERC20 tokens by writing brand new contracts from scratch for one-off use. We knew there needed to be an easier way for people to publicly collateralize their requests for work, without having to worry about writing code, or making sure it was secure themselves.

Immediately after deploying StandardBounties into production on MainNet, we launched a bug bounty program awarding between 1 and 10 ETH, depending on the severity of submitted bugs. We have consistently believed that smart contract security should be taken seriously, which means relying on both private auditing alongside public bug bounties that positively incentivize hackers to disclose bugs responsibly.

What Happened

On November 6th, the Bounties Network team was notified by Oleksii Matiiasevych from Ambisafe, that there was a re-entrancy bug written in the original StandardBounties contract that we deployed last December, which didn’t affect any funds in the contract.

The essence of the bug is:

On line 218 of StandardBounties, a user issuing a new bounty performs a token transfer before completing all necessary state changes, meaning the token contract can potentially re-enter, to take advantage of the non-atomic state transitions currently underway.

A malicious actor could call the issueAndActivate function, issuing a bounty which intends to pay out in the malicious token contract. When the transferFrom call is performed on line 218, the malicious contract can once again call issueAndActivate, creating a new bounty and overriding the token contract address which is stored at tokenContract[bounties.length] .

As a result of this bug, a malicious actor would be able to issue bounties which are corrupted, i.e. they would have a tokenContract address which is 0x0, but the paysToken field of the struct would be set to true, meaning that any attempted payouts would eventually fail (as no legitimate token contract resides at the 0 address).

After spending a significant amount of time researching this bug, we don’t believe there’s any way it can allow byzantine bounty issuers to administer funds which they haven’t deposited. Now that we’ve taken the time to understand the implications of this bug, we wanted to immediately disclose it to the community, because we care deeply about the integrity of our contracts, and we understand how important it is to be communicative about their status in an open and honest manner.

As of the time of writing, the only implication we have discovered is the one outlined above: that corrupted bounties can be created. No one else’s bounties can be altered, nor can their funds be touched.

Since a different re-entrancy bug was discovered last year and we were forced to re-deploy without buggy functionality, we’ve been itching to upgrade our contracts to have stronger security guarantees. However, throughout this upgrade process, we’ve chosen to extend our timeline in order to integrate as many features as possible based on feedback from new users, and other dapps joining the conversation.

Nonetheless, we’re currently in the midst of completing a code audit on StandardBounties 2.0. This update greatly improves the security guarantees we can make for bounties by having bounties live in separate smart contracts rather than the all-in-one approach used here.

While we cannot confirm the absence of risk, after extensive auditing we believe it is safe to continue employing this version of StandardBounties. We will be migrating to version 2.0 in the coming months, and plan to continue exploring this vulnerability to stay ahead of any potential attackers.

We invite anyone to offer submissions of severe exploits in the code that put funds at risk and offer 10 ETH for submissions of any severe exploits in the code that put funds at risk.

We are very grateful that our bug bounty is producing results, and are excited that Oleksii can be compensated for his successful sleuthing. Moving ahead, we will continue pushing ahead with our efforts to improve our protocol and our product.

StandardBounties Bug Discovered was originally published in Bounties Network on Medium, where people are continuing the conversation by highlighting and responding to this story.