PGP-44 l 2026-2027 Immunefi Bug Bounty Program Renewal

Governance Proposal (PGP)
1

Summary: This proposal aims to renew the Parallel bug bounty program and triaging service managed by Immunefi for an additional 24-month period from a reduced annual rate of $38,530 to $20,000 USD per year.

Rationale: One year ago, the DAO approved PGP-28, engaging Immunefi to provide an always-on, fully managed bug bounty program with 24/7 triage and one mitigation review. Since launch in July 2025, the program has been actively protecting Parallel Protocol across all deployed chains.

The bug bounty program is an essential last line of defense. Even after multiple thorough internal and external audits, vulnerabilities can remain, and bug bounty programs consistently surface critical bugs that audits miss. Across Immunefi’s client base, 80% of programs have surfaced critical bugs missed in audits during their first year of operation. Immunefi remains the largest onchain security platform, having prevented over $25B of funds from being lost to hacks and currently protecting over $110B in user funds.

  • Program continuity: Allowing the program to lapse would create a gap in coverage that could be exploited. Renewal ensures uninterrupted protection for the protocol and its users.

  • Renewal terms. Immunefi is offering a significantly reduced rate for the renewal period:

    • Year 2 (this proposal): $20,000

    • Year 3 (committed): $20,000 locked at the same rate

  • Renewal Plan: Parallel would secure the discounted offer while upgrading to a higher level of triaging, the Immunefi Expert Assessment

image
image1976×766 105 KB

Program continuity. All existing program parameters remain unchanged:

  • Maximum reward: $250,000 USD for the most critical impacts

  • Minimum reward: $50,000 USD for other critical bugs

  • Bug validity determined by Parallel’s administrators (Cooper Labs), with Immunefi mediation available for disputes

  • Immunefi vault remains funded with $5,000 for bug bounty payments

  • Business Days managed triage, Safe Harbor module included

  • Program administrators (Cooper Labs) retain authority to transfer funds from the insurance fund without proposal, conditioned to a post detailing the bug found, the amount paid, and its resolution

Means:

  • Human Resources: Cooper Labs will continue to serve as program administrators, responsible for validating bug reports and managing the program. The managed triage plan provided by Immunefi minimizes the time required from administrators by filtering invalid reports.

  • We propose to appoint Cooper Labs as administrators of the bug bounty program. They will be responsible for validating bug reports and will have the authority to transfer funds from the insurance fund without proposal, conditioned to a post detailing the bug found, the amount paid and its resolution. These teams will designate a representative who will sign Immunefi’s standard Master Services Agreement and can also update the program at any time.

  • Treasury Resources: $40,000 worth of USDC from the Parallel Insurance Fund for the Immunefi bug bounty service (Year 2 and 3 of 2-year commitment at $20,000/year). The Immunefi vault is already funded with $5,000 for bug bounty payments; no additional vault funding is required at the time of writing the proposal

Technical implementation:

  • On Ethereum:

    • The DAO Multisig signers will transfer $20,000 worth of USDC for year 2 from (in July 2026) the Parallel Insurance Fund Multisig (0x6aF71a3723D3c0Ed69f84EE259c9De3019C2a77c) to Immunefi (0x7119f398b6C06095c6E8964C1f58e7C1BAa79E18).
      The DAO Multisig signers will transfer $20,000 worth of USDC for year 3 (in July 2027) from the Parallel Insurance Fund Multisig (0x6aF71a3723D3c0Ed69f84EE259c9De3019C2a77c) to Immunefi (0x7119f398b6C06095c6E8964C1f58e7C1BAa79E18).

Voting Options:

  • For the Bug Bounty Program Renewal
  • Against / Rework the Proposal
  • Abstain

Author(s): Immunefi

Community poll:

  • For the Bug Bounty Program Renewal
  • Against / Rework the Proposal
  • Abstain
0 voters
2

@JeanBrasse just a quick check. You support this?