A process suggestion rather than a view on this payout.

Several proposals here link their scope or audit report as an off-chain PDF. That is convenient to publish but it costs reviewers: you cannot quote a specific line back in the thread, you cannot diff a revised version against the original, and a figures table does not survive a copy-paste.

Converting the attachment to Markdown before posting fixes most of that at no cost. I run them through [pdf2md](https://pdf2md.me/), which converts in the browser so the file is never uploaded anywhere, and keeps heading levels and table structure intact, then paste the output into the proposal body. Reviewers can then quote inline and the discussion stays self-contained.

Might be worth a soft convention going forward: keep the PDF if you like, but put the Markdown in the body.

Approve a `$5,000` payout for the following security report:

- `$5,000` — Medium XCM deposit accounting issue: An over-limit XCM deposit targeting the router
  account could create a duplicate credit and leave bridged-asset issuance in an unexpected state.
  The additional balance was not practically exploitable and no user funds were affected. Fixed in
  commit aa8469fa
  (https://github.com/galacticcouncil/hydration-node/commit/aa8469fa4db1432196bfbe73b6e1be90d2643220)
  by restricting the router’s deposit-lock exemption to active trade execution.

A security issue was found in a blockchain system. It could create duplicate credit when an over-limit deposit was made to a router account. This did not let anyone steal money or hurt users. The problem was fixed by limiting a special rule only to active trades.

Immunefi bounty payout