> This project utilizes a decentralized vault for their bounty rewards to ensure trust by showing that they have the collateral to cover their bounties. Payments are processed directly on-chain inside the Immunefi webapp.
https://immunefi.com/bug-bounty/beanstalk/
An interesting side-effect is that you can view payments from the public vault for each project, for example:
https://etherscan.io/address/0x66Efac6e6d58D4058CF017E66a003...
Top payment so far is 3 payments of about 8,500 USD to the same recipient. The maximum claimed achievable payment is 1.1m USD.
It does at least imply that they've set aside magic beans to pay researchers, and that someone is being paid from the bean fund, for whatever that's worth.
the hackernews post a few months ago had someone earn $2,000,000 which was paid instantly in USDC. this is freely redeemable for USD on Circle and Coinbase
some other firms pay out in a vesting schedule of their own tokens, so you rely on the exchange rate and liquidity just as with RSUs.
I bet you this was lots of persuasion for them to pay out this bounty. You wouldn't have gotten this bounty if you had this bug.
Immunefi has a similar payouts table to h1's at https://immunefi.com/bug-bounty/ implying people are getting paid, but it could boost credibility by linking to write-ups and findings from researchers if any exist.