big YES.  
whitehat is our friends,  Perhaps we need to launch white hat challenges from time to time

Thank you for notifying mr/mrs 🎩
Of course this behaviour helps and needs to be incentivized.

Good day to the entire progressive community! To be honest, I am starting to explore new areas of activity here (please, do not judge too harshly). I have, of course, read the entire post above, and for my understanding, this is all very complex information! I am deeply convinced that intelligent people should be rewarded financially! For which I will also vote YES. And if I understood correctly, a potential attacker would need $50,000,000 to hack the system!? And I did not quite understand: Has this error already been fixed or just discovered?

[@0xf3a7...87D2](7KATdGbUxgJ9ZpuoNrMS8qcsHLFemdZXQzQiCcxijzi53rsG-hydradx) Yes, measures were taken to prevent the attack

from https://jakpan.hashnode.dev/hydration-oracle-manipulation-post-mortem

says "This is also where we implemented additional limit to prevent the attack completely."

Yes, I also forgot to ask where these funds for payment will come from?

[@0xf3a7...87D2](7KATdGbUxgJ9ZpuoNrMS8qcsHLFemdZXQzQiCcxijzi53rsG-hydradx) the funds come from treasury, 

https://app.hydration.net/wallet/assets?account=13UVJyLnbVp9RBZYFwFGyDvVd1y27Tt8tkntv6Q7JVPhFsTB

Here can check all the assets that the treasury have

I appreciate the transparency from the security team. <3

EDIT: 
I am symbolically NAYing this. I will switch to AYE if it ever becomes close, because we must pay for it.

The symbolic NAY is because the 'attack' is so easily countered that I hardly consider it an attack and instead closer to someone using the regular functioning of our protocol. We can stop this with a high tip and a DCA or weight caps, and then we can close the door on the attacker not letting his funds leave hydration. I agree it is a 'bug' worthy of payment and I want to encourage these types of reports in the future, but 25k for something that can do no actual harm - no, that is not justified in my opinion. 

Whitehat, if you read this, I would love to hear your opinion. Feel free to respond here or DM me on discord (Parakeet)

[@Parakeet](7KejvRw4GZvVjFQEDefAsBRd9iaTjVeUWczB44Mgu8Bue8JW-hydradx) 
Reading the report, it mentions that for the attack to occur, many factors are needed that would surely make it unprofitable or even impossible to do on realistic Omnipool setup, however it mentions that the oracle was manipulable and that this could affect other things later on, which is considered a good finding.

"Although it was possible to manipulate the price oracle, our simulations showed it would be infeasible to leverage this to do so profitably. We however understand, that this is a critical part of our protocol and could become an issue in the future.

For this reason we’ve decided to offer the whitehat highest payout for High tier of 25k$ which matches the lowest reward of Critical payout."

[@Jose Crypto](7NzNFJb2pfy2mZzdS2ky8okkXZL52fn2VAvAsc8jigvCtBec-hydradx) 

Thanks Jose. I have updated my comment with my thoughts. 

[@Parakeet](7KejvRw4GZvVjFQEDefAsBRd9iaTjVeUWczB44Mgu8Bue8JW-hydradx) 

In discussion (dispute) the truth is born! I think that what you said above is a worthy criticism! To a certain extent, I agree with you! (I am pleased to read such criticism) 

This proposal, if approved, will transfer `25,000` USDT to `0x85ad712989eF693FdB0319F3322eCBB9D9426Bc1` - the address of the whitehat who successfully identified the potential manipulation of our price oracles.

This is the highest payout for a **high** tier bug bounty, which also matches the lowest reward for a **critical** payout - we have classified this bounty as **high** as although it was demonstrated that it was possible to manipulate the price oracle, our simulations showed that it would be infeasible to do so profitably.

**The vulnerability was quickly mitigated shortly after being identified and no user funds are at risk.**

A full post mortem written by Intergalactic CTO Jakub Panik can be found at https://jakpan.hashnode.dev/hydration-oracle-manipulation-post-mortem

- A whitehat found a problem with the price system.
- They will get 25,000 USDT as a reward.
- The problem was fixed quickly, and no one lost money.
- The reward is big because the problem was important.
- The whitehat's address is `0x85ad712989eF693FdB0319F3322eCBB9D9426Bc1`.
- More details are in a report by Jakub Panik.

call

Executed

Submitted

DecisionDepositPlaced

DecisionStarted

ConfirmStarted

Confirmed

treasurer

Bug bounty payout

root

whitelisted_caller

referendum_canceller

referendum_killer

general_admin

spender

tipper

omnipool_admin

economic_parameters

Origin able to dispatch a whitelisted call.

 Origin for spending very high amounts of HDX(<= 50M HDX) from the treasury as well as generally administering it.

Origin able to spend up to 2,222,222 HDX from the treasury at once.

Origin able to spend up to 50K HDX from the treasury at once.

Origin able to perform specific Omnipool-related actions.