[ARFC] Sunset the Aptos Bug Bounty program and Cantina as a provider

Governance
1

Summary

This proposal seeks to sunset the Aave V3 on Aptos bug bounty program operated on Cantina and remove Cantina as an active bug bounty provider for the Aave protocol, following the wind down of the Aave V3 Aptos deployment.

Motivation

The Aave V3 on Aptos bug bounty program on Cantina was established alongside the Aave V3 Aptos deployment. The Aave Protocol Bug Bounty Programs Restructure later organized DAO bug bounty coverage into programs specific to each subsystem across three platforms, and updated the Aave V3 on Aptos program’s terms, transferring its funding responsibility from Aave Labs to the Aave DAO under the Aave Will Win effort.

Separately, the DAO is winding down the Aave V3 Aptos deployment, see [ARFC] Low Adoption Asset Deprecation on Aave V3. The USDT, APT, USDC, and sUSDe reserves on Aptos are being frozen, with supply and borrow caps reduced to one unit and no new deposits, borrowing, or collateral, on account of a sustained decline in liquidity and protocol revenue on that deployment.

Sunsetting the Aave V3 on Aptos bug bounty program is aligned with the DAO’s objectives in several ways:

  • With the Aave V3 Aptos deployment frozen to new activity, the residual risk surface no longer supports a dedicated, DAO funded bug bounty program.
  • Aave V3 on Aptos is Cantina’s sole allocated scope under the bug bounty restructuring, so sunsetting the program removes the basis for Cantina’s continued participation as a provider.
  • Immunefi and Sherlock continue to cover the remaining programs, Core Aave V3, Core Aave V2, GHO, and non-liquidity protocol infrastructure on Immunefi, and Aave V4 and the Aave App Stack on Sherlock, preserving bug bounty coverage across the active protocol surface.

Specification

This proposal sunsets the Aave V3 on Aptos bug bounty program operated on Cantina and removes Cantina as an active bug bounty provider for the Aave protocol. Immunefi and Sherlock remain the DAO’s active bug bounty platforms.

Disclaimer

This proposal was prepared by Aave Labs in its capacity as a contributor to the Aave ecosystem. Aave Labs has no financial relationship with Cantina or any of its affiliates and has not received compensation from Cantina in connection with this proposal.

Next Steps

  1. Gather community feedback during the ARFC stage.
  2. If the ARFC response is positive, escalate to Snapshot for off-chain confirmation.
  3. Following a positive Snapshot outcome, sunset the Aave V3 on Aptos bug bounty program and remove Cantina as an active bug bounty provider for the Aave protocol.

Copyright

Copyright and related rights waived via CC0.