The Bug Hunter’s Guide to High-Quality Reporting
summary
Five practical rules used by Immunefi triagers: concise titles that summarize attack vector — source — impact (example: unprotected delegatecall in proxy manager → griefing), bug descriptions that contrast expected vs malicious behavior, PoCs that include dependencies, setup and PoC output, and explicit feasibility notes (gas, capital, slippage, detection risk). Callouts show bad PoCs (lab-only forks, on‑chain storage edits, “unlimited money” cheats) and real impacts (reentrancy → direct theft). High‑quality reports speed triage and raise reward likelihood.
AI-written summary · about
chapters (10)
- 0:00Introduction to bug reporting
- 0:40Core components of a report
- 2:58Focusing on attack impact
- 3:44Proof of concept requirements
- 4:31Addressing feasibility limits
- 5:09Title and description review
- 6:01Impact analysis examples
- 7:20Bad POC practices
- 9:06Feasibility factors
- 10:44Benefits of quality reporting
related talks
41mHow to Keep Your Cool and Write Powerful Incident Response Reports
52mPractical Tips For Running A Successful Bug Bounty Program
15m"You've Got Your Nice List of Bugs, Now What?" Vulnerability Discovery and Management
55mYour License for Bug Hunting Season
24mAI Is Writing Your Bug Reports. Can You Tell?
43mHard Knock Lessons On Bug Bounties
50mPanel: Let's Get 360 w/Bug Bounty!
50mBug Bounty Programs: Successfully Controlling Complexity and Perpetual Temptation