The easiest way to erase a security researcher’s work is five words: “We already knew about it.”

Without a timestamp, that isn’t a defense. It’s a rewrite.

@TermMaxFi closes that loophole through Known Issue Assurance in its Immunefi bounty. A known bug must have been disclosed publicly or logged privately through a self-reported submission before the researcher files it.

If the project cannot prove the issue was already known, then a valid report remains in scope and is due a reward. The burden of proof works both ways: researchers bring a PoC; the project brings receipts.

Immunefi handles triage, arbitration is enabled, and neither side gets to retcon the timeline after the fact. That turns a bug bounty from “the project has the final word” into an evidence-based process.

This does not mean every duplicate report gets paid. Unfixed issues already disclosed in public audits are excluded, and there is no public evidence that TermMax has had to invoke this clause in an actual dispute.

The point is preventative: the rules are written before money, reputation, and incentives collide.

Mature Web3 security is not just bigger bounty numbers. It is due process when someone says, “Trust us, we knew.”

Should “no receipts, no known-issue defense” become the default rule for every serious crypto bug bounty?