banteg (@banteg): 10% of tvl bounties as marketing fiction for large protocols

10% of tvl bounties as marketing fiction for large protocols immunefi popularized "up to 10% of impacted funds" presentation for critical bounties. this sounds impressive until you check the caps. looking at top-50 protocols, the payout is always capped by dollar amount. for top-20 protocols, it results in effective rate of 0.05% avg, 0.003% median. as an example, aave has $33b tvl, but max crit bounty is $1m. "0.003% for a crit" doesn't sound nearly as alluring and doesn't guide researcher priorities as well. yearn has never adopted % bounties, while having a track record of multiple max critical payouts to show for it. this should be another thing security researchers look at. high advertised bounties are meaningless if they have never been paid out. actionable suggestions for immunefi: - show effective % alongside advertised % - display max payout history, not just total paid data: immunefi, defillama if you want to explore raw data by yourself: https://twitter.com/i/web/status/1997543283703062823