search

EdOverflow / bounty-formula

A formula to calculate bounty amounts.
https://edoverflow.com/2017/the-math-behind-bug-bounties/
MIT License
13 stars 5 forks source link

Values for $n$ greater than 2 create very significant gaps between CVSS scores in the high and critical range. #3

Closed EdOverflow closed 6 years ago

EdOverflow commented 6 years ago

Description

richinseattle notified me of an interesting issue in our formula when supplying it with values greater than 2 for n.

image

Steps To Reproduce

Set n to a value greater than 2. I am using n = 6 below.

$$N = \frac{10000}{(10)^6}$$

$$b = N \times (C^6)$$

Result

There is a very large gap between the bounty amount for a CVSS score of 9.0 versus a score of 10.0 — namely $5314 for 9.0 and $10'000 for 10.0.

image

Potential Solutions

The following are some potential solutions that may even be combined to resolve this problem and other problem for n in the future.

1) Create an S-curve as richinseattle pointed out. [1] 2) Form pairs of CVSS scores. [2] 3) Base the bounty on the maximum value in the CVSS rating rather than basing it off the CVSS score. This is similar to approach 2). 4) Base n on a large data set. This would allow us to create "realistic" values for n for the three categories mentioned in the write-up. [3]

EdOverflow commented 6 years ago

We believe that our latest version of the formula resolves this problem by forcing n to be within the 1.0 to 3.0 range.

image

We also suggested that users decrease n as b_{max} increases.

We recommend setting a lower value for n as you increase b_{max}. This should ensure that the gap between values in the 7.0 to 10.0 CVSS score range is not too big.