Used the wirex card to purchase goods online, very cool. Looking forwards to BTS integration into Wirex 👍

How did it go?

If CEX offered the ability to borrow bitCNY using BTS directly on their CEX (borrowing on BTS DEX on their behalf) perhaps you'd see more borrowers?

The quantity of Norn price feed publishers is dropping, I'd greatly appreciate price feed participation. There's peak value buy orders in to the tune of ~1M BTS at the moment, that would result in 2M BTS being locked up as collateral at reduced GS risk. Hoping other active witnesses take an interest soon 👍

Bump! Still seeking active price feed publishers for the Norns

If we go ahead with this WP, will subsequent integrations (bitUSD, bitEUR, ..) cost just as much? Or do you think we can get a discount? Got my card in the mail 👌

Just verified and ordered my wirex card, ordering anything online with a debit card & a crypto balance is pretty cool.

Can I request some changes to the wp doc?

Several critical reports have been submitted and fixed through HackTheDex, proof for its value and necessity.

In terms of Owasp vulnerability ratings, HTD auditors have not yet rated any publicly disclosed vulnerabilities as critical, so this is an inaccurate claim to make.

The proposal will use allocated funds to reward those that step forward with exploits, relative to the overall risk assessment of the exploit.

Do you want vulnerability disclosure reports, or are you requesting the full development of weaponized exploits?

By the owasp rating guide, two vulnerability factors (https://www.owasp.org/index.php/OWASP_Risk_Rating_Methodology#Vulnerability_Factors) incentivize the creation of automated metasploit modules.

How the vulnerability is scored, and the methods used to determine the score, are at the sole discretion of the panel chosen to audit the report

Since you're using the owasp vulnerability rating system, there shouldn't be undisclosed deviation from this scoring mechanism. I get not disclosing details before they're mitigated, but this comes off as a clause to avoid reporters successfully contesting low vulnerability ratings.

---

A couple issues I had with the previous HTD worker proposal:

• The turnaround time from submitting report to being in receipt of reward is multiple months. It's discouraging to wait months with an unknown payout status; if there was a faster turnaround time then researchers would be more confident in dedicating time towards HTD.
• Reports which aren't vulnerabilities don't get responses & you can't check on progress of any submitted reports without manual telegram/email communications every couple weeks. Rejection emails would be great.
• There has been no news update since late July 2018 nor changes to the website aside from populated reports/leaderboard/receipts. The organizer of the first HTD WP left the role & this role was filled by another community member without a blog update. What happened to Matt?
• One of my submissions broke the submission form, resulting in a partial report submission. Bug report for your bug report.
• Final scores for vulnerabilities are not disclosed, only the grade category for Likelihood, Impact & Severity. This further distances the researcher from contesting low rewards. A simple final_owasp_rating:reward calculation would make researchers reward expectations more realistic months before final payout. The full disclosure of vulnerability details (inc final score) is an industry standard practiced by nvd.nist.gov , cvedetails.com and vuldb.com (etc..) which HTD aught to replicate so as to be more transparent.
• It's the researcher's responsibility to report the vulnerability to nist/cvedetails/vuldb; HTD should take the initiative to boast about solved vulnerabilities to potentially attract veteran security researchers (and potentially devs/investors). Bitcoin has vulnerability reports on these websites.
• Report 20180918A (reflected XSS vuln) has a high impact, whereas 20180728A (stored XSS vuln) and 20180801A (stored XSS vuln) have Medium impacts. Regardless of how they trigger (stored/reflected) the end result is identical (XSS attack). I believe that 20180728A and 20180801A aught to have been higher ranked & rewarded.

---

I love the HTD WP concept & don't hold any malice against anyone nor intend to grief/troll, I wish to simply improve the HTD process. I'll be voting to support this WP and hope that the above information helps.

Cheers.