Date: June 30, 2025
Proposer: Polkadot Assurance Legion (PAL) Curators
Requested Amount: 500,000 DOT
Beneficiary: Polkadot Assurance Legion (PAL) Bounty #22
Short Description: This proposal is the first bounty top-up for the Polkadot Assurance Legion (bounty #22), requesting 500,000 DOT. These funds will enable PAL to continue its crucial work in enhancing the security of the Polkadot ecosystem. The current mandate of PAL includes the partial audit funding for Runtimes and smart contracts (both Rust and Solidity), the development of security tooling, common-good security initiatives, and partial reimbursements for bug bounty payouts.
1. Introduction & Background
The Polkadot Assurance Legion (PAL) is a community-driven initiative dedicated to making Polkadot a safer and more attractive platform for builders and users. By allocating funds from the Polkadot Treasury, PAL supports a range of security-focused activities critical for Polkadot's health and growth. With PAL, Polkadot is the only ecosystem that allocates a portion of its on-chain treasury to enhance the security of the ecosystem, thereby investing in its long-term security, stability, and success.
Since the start of 2024, PAL has co-funded 25 audits, which have helped identify and resolve 133 on-chain vulnerabilities, of which 27 were classified as critical or high-risk. Furthermore, PAL has funded the development of a static-analysis tool and is just about to fund the development of a comprehensive ecosystem monitoring tool.
You can find the funding details in our community reports: Q1 2025, H2 2024, and H1 2024.
Previous PAL OpenGov referenda: #47, #1074.
More info on https://dotpal.io
2. Current funding status
At the time of writing, the balance of the PAL Bounty #22 stands at approximately 177,800 DOT. Here is a breakdown of the spending so far (not including 2025 Q1 as the numbers are not final):
Here is a breakdown of the share of each spending category:
3. Top-Up Justification
Considering the past spending behaviour outlined above, and the anticipated future demand for security services, we would like to request a top-up of the PAL bounty with 500,000 DOT.
The funds currently remaining in the bounty provide sufficient albeit limited leeway for the upcoming months. In the next weeks, we will initiate payouts for the development of the ecosystem monitoring tool, which will have a total cost in the range of $200,000 to $250,000 (delivered via milestones of up to $50,000). Besides several ecosystem projects expressing interest in audit co-funding, we expect an uplift in demand due to the launch of EVM smart contracts on Polkadot Hub, which (hopefully) will be audited by their deployers. Furthermore, we would like to continue funding open-source security tools that benefit the Polkadot ecosystem.
According to our knowledge, the requested top-up should allow PAL to continue its operations uninterrupted for at least another 12-18 months (depending on factors such as DOT valuation).
4. Why Fund Security
A well-funded PAL directly contributes to:
PAL has a proven track record of effective fund management and impactful security contributions. The requested top-up will ensure that this vital work can continue and adapt to the Polkadot network's evolving needs.
We welcome any questions and are committed to continuing to report on the use of these funds in a transparent manner.