Arbitrum Security Program

Proposals
1

Arbitrum Security Program

Abstract

The Arbitrum Foundation proposes to continue and evolve the Arbitrum Audit Program (AAP) - launched on 1 August 2025 with a one-year mandate - into a broader Arbitrum Security Program (ASP), running for a further 12 months on a rolling-application basis.

  • From “Audit” to “Security”. AAP delivered on its original purpose - real vulnerabilities surfaced and remediated before mainnet, with a high share of net-new teams brought to Arbitrum - and demonstrated where subsidised security converts into the most ecosystem value. Building on that, the mandate broadens to four pillars covering the full security lifecycle: AI-assisted screening ahead of a full audit, the human-conducted audit itself, the Arbitrum bug bounty program, and the ArbitrumDAO Security Council.

  • No new treasury request. ~$2M in cumulative audit commitments is expected by AAP’s close. The remaining $1.76M USDC + 25M ARB held by the Foundation becomes ASP’s operational budget, less ~$1.2M in predicted outstanding deployments.

  • Operational refinements from a year of experience. The audit committee technical expert retainer is right-sized to $2.5k/month based on expected workload; the DAO-approved alignment framework is maintained as the program’s baseline; program changes adopt a lightweight optimistic approval process to reduce governance overhead; and idle funds are put to work in low-risk management strategies.

The program runs for one year (or until funds are exhausted), managed by the Arbitrum Foundation and supported by the audit committee as technical SME, with quarterly transparency reports and a final summary report to the DAO.

Motivation

The AAP was approved by ArbitrumDAO to remove a barrier facing early-stage teams: third-party audits are the industry norm, but their cost puts them out of reach for many young projects. The program’s full design - objectives, eligibility, application process, auditor approval, and alignment commitments including Arbitrum exclusivity - is set out in the original proposal, and its performance has been reported quarterly (#1, #2, #3).

Results

(covering Q1-Q3 and preliminary Q4, prior to final report)

367 applications were received through preliminary Q4, with application-to-decision time averaging 2-3 weeks. To date, 18 completed audits reviewed 71,366 lines of code and identified 385 vulnerabilities - 13 critical and 40 high - remediated before mainnet. The average audit cost was $50,706, approximately $15 per line of code, which sits below the industry average of $70,000 for mid-complexity DeFi audits as per market references provided by Sherlock and Zealynx. The total commitments are expected to reach ~$2M once in-progress and pending audits are activated.

What Worked

  • The program delivered on its original mandate. With ~60% of funded teams net new to the ecosystem, it attracted security-first founders who might otherwise have launched elsewhere.
  • It demonstrated Arbitrum’s dedication to user security. Funding security work upfront led to tangible critical findings, remediated before mainnet.
  • Operationally the program matured. A growing referral channel now drives roughly half of onboarded teams, and pricing has stayed within benchmarked ranges.

Lessons Learned

  • Early-stage teams didn’t have enough runway to benefit from audits. Some recipients were unable to move forward after receiving funding, in a few cases winding down within months. Future eligibility should require at least 1 year of runway and the capacity to cover part of the audit cost.
  • Value secured has concentrated in later-stage teams that could typically fund audits themselves - a tension with the early-stage mandate, since younger projects generally need more time to grow TVL for their product.
  • Lead times are long. Audit contract signature to mainnet launch averages ~135 days for teams not yet live.
  • Impact was real, but visibility was low. Audit subsidies set Arbitrum apart from other ecosystems, but the program received too little visibility to capitalize on that. Going forward, funded teams will be asked to publicly acknowledge the subsidy, among other improvements to program communications.

These results and lessons, among others, shape the adjustments below.

Specifications

Program Adjustments

1. Expand Scope with AI Audits

AAP identified five AI security agents to be trialed under this program. ASP will run the pilot: every funded team will receive an AI-assisted review ahead of its full audit, with lower-cost AI screening available to earlier-stage teams, and all five tools running in parallel for evaluation.

2. Expand Scope with Core Protocol Security: Bug Bounty & Security Council

Audits are point-in-time; protecting the core protocol that every funded team builds on also requires continuous review of live code and emergency response - the program’s third and fourth pillars:

  • Bug Bounty (continuous review). Arbitrum operates a bug bounty covering the Arbitrum One and Arbitrum Nova smart contracts, with rewards of up to $2,000,000 for critical findings - a maximum that has never been paid out since the Foundation began running the program. Its scope remains the Arbitrum protocol codebase; ecosystem teams’ codebases are covered through the AI-screening and audit pathway above.
  • Security Council (emergency response). The ArbitrumDAO Security Council is the DAO-elected body empowered by the Constitution to respond to security emergencies affecting the protocol in production, and has been historically funded by the AF on behalf of the DAO.

Both are included for the reason set out in the Abstract: redirecting part of the unspent allocation toward the security layers with the highest impact on the ecosystem - every team, user, and dollar of TVL on Arbitrum ultimately depends on the integrity of the core protocol they protect - with no change to the bounty’s scope and reward terms or to the Council’s compensation, election process, and constitutional mandate. Bug and bounty reporting will be provided yearly at a high level, e.g., total payout amounts.

3. Maintain Alignment Framework

After strict exclusivity created material friction during AAP, the requirement was revised via a formal governance proposal into a DAO-approved, alignment-based framework, which ASP adopts as its baseline.

4. Introduce a Lightweight Governance Process

Adjusting the exclusivity framework during AAP showed that putting every program change through the full governance process adds significant overhead. ASP therefore adopts the optimistic approval framework from the recent Code of Conduct proposal: changes posted to the forum by the AF take effect after 14 days unless a combined 5% of delegated VP (measured at the time of posting) raises objections, in which case the change goes to an off-chain vote at the non-constitutional quorum. The AF is responsible for monitoring objections and tallying VP.

5. Enable Idle Funds Deployment

Lastly, with the majority of AAP funds remaining unproductive for the duration of the program, we propose that ASP deploy idle funds into low-risk management strategies.

Budget

AAP was funded through a 30M ARB allocation, part of which was converted to cover audit commitments and the $60k technical expert retainer; roughly $1.23M was committed by the end of Q3, expected to reach ~$2M by program close (cumulative over the program’s duration). ASP requests no new funding: it operates from the actual remaining balance already held by the Foundation - $1.76M USDC plus 25M ARB - less ~$1.2M in predicted outstanding deployments (final amount depends on total audit commitments, some of which may not materialize). This budget covers the expanded scope:

  • Audit, AI screening and security subsidies for ecosystem teams.
  • Arbitrum protocol bug bounties: operation of the bug bounty program, with contingent reward payouts for validated findings.
  • Security Council: member compensation of $5,000 per member per month across the 12-member Council, i.e., $720,000 per year.
  • Technical expert: retainer of $2,500/month (down from $5,000/month, or $60,000/year, in AAP), reflecting updated workload.
  • All other costs (legal, program management, operations) remain covered by the Arbitrum Foundation.

As in AAP, funds committed towards audits will be disclosed in each quarterly transparency report, giving the DAO visibility into deployment pace against the remaining balance. Any balance unspent at term end returns to the ArbitrumDAO treasury unless the DAO approves a continuation

Timeline

With AAP applications closed on 31 July 2026 and an approximate two-month wind-down underway, continuity of a live audit offering is an important matter for builders on Arbitrum. We propose the following governance timeline, subject to delegate feedback:

  1. August 13th → Proposal posted in the forum (complete)
  2. August 20th → Binding off-chain vote following non-constitutional quorum
  3. By October 1st → Applications open for the program, with an official announcement declaring the start date and the one-year clock.
4 Likes
DZack23.eth Delegate Communications thread
Rewarding Active Delegates - August 2026 Results
Cp0x Delegate Communication Thread
2

We will be hosting the following open discussion governance call on this proposal:

Arbitrum Security Program: Open Discussion
Tuesday, August 18 · 4:30 – 5:30pm
Time zone: UTC
Video call link: Google Meet meeting

Call recording can be accessed here: https://drive.google.com/file/d/1wFiGzp371Urc3CtTA-WHIbyUz1mxFIzx/view?usp=sharing

3

I support the Arbitrum Security Program.

The shift from a narrow Audit Program to a broader security program is timely and valuable. Combining AI assisted screening, human audits, the core protocol bug bounty, and Security Council support creates a more complete security lifecycle for Arbitrum builders, users, and protocol infrastructure. The previous program also showed clear impact, with critical and high severity issues identified and fixed before mainnet deployment.

I especially support the decision to continue without requesting new treasury funds. However, to make this program stronger, more transparent, and more accountable to the DAO, I would encourage the Foundation to add the following safeguards:

  • Clear budget caps by pillar: Publish an indicative annual allocation for AI screening, audits, bug bounty payouts, Security Council compensation, and technical expert costs. This will help delegates track whether ecosystem team security is receiving sufficient funding relative to core protocol expenses.

  • Quarterly KPI dashboard: Each quarterly report should include applications received, approvals, rejections, average decision time, audit completion rate, total subsidy deployed, vulnerabilities by severity, remediation status, time to mainnet, and projects still active after six and twelve months. The proposal already commits to quarterly reports, so these metrics would make those reports more useful.

  • Transparent selection rubric: Publish a weighted scoring framework for selecting teams. Factors could include protocol maturity, user funds at risk, technical complexity, runway, audit co payment, Arbitrum alignment, and expected ecosystem value. This reduces discretion concerns and makes decisions easier to evaluate.

  • Milestone based audit payments: Rather than committing the full subsidy upfront, payments should be linked to clear stages such as audit start, final report delivery, remediation confirmation, and verified deployment. This directly addresses the lesson that some early stage teams did not have enough runway to benefit from funded audits.

  • AI pilot evaluation before scaling: Since five AI security tools will be tested in parallel, the Foundation should publish an evaluation framework before the pilot begins. It should measure false positives, meaningful findings, overlap with human audits, cost per useful finding, and time saved. AI screening should remain complementary to, not a replacement for, independent human auditing.

  • Defined rules for idle funds: “Low risk” needs a public definition. The DAO should know permitted assets, approved protocols or custodians, maximum exposure per venue, liquidity requirements, counterparty limits, and whether principal loss is possible. A monthly disclosure of deployed amount, yield earned, and risk exposure would be appropriate.

  • Limits on optimistic governance: The 14 day optimistic process is useful for small operational changes, but it should not apply to material changes in budget allocation, program duration, eligibility rules, Security Council compensation, bug bounty reward terms, or idle fund risk parameters. These should require a normal DAO vote. The proposed process allows Foundation posted changes to proceed unless 5 percent of delegated voting power objects, so defining these boundaries is important.

  • Public security impact reporting: Aggregate vulnerability data is helpful, but reports should also show how many critical and high issues were fixed, how many teams launched, how much TVL or user exposure was protected where feasible, and how many funded projects remained active. This will allow the DAO to assess security return on capital, not only audit volume.

  • Independent annual review: At the end of the 12 month term, an independent reviewer should assess program effectiveness, financial deployment, conflicts of interest, auditor performance, and the results of the AI tool pilot before any renewal proposal is brought to the DAO.

Overall, I support the proposal. With stronger reporting, defined capital management rules, selection transparency, and limits on delegated operational changes, ASP can become a credible long term security public good for the Arbitrum ecosystem

4

@MconnectDAO Your emphasis on shifting from upfront lump sums to Milestone-Based Payments and Quarterly KPI Dashboards is the exact structural upgrade the Arbitrum security framework requires.

When governance funding is tied strictly to verifiable milestone completion rather than speculative projections, accountability shifts from “trust” to “math.” This is the foundational standard required for all major capital allocations moving forward.

5

I’m generally in support of the Arbitrum Security Program.

The shift from the Audit Program to a broader security program makes sense to me. The AAP has already shown that subsidising security can create real value for the ecosystem, from getting critical vulnerabilities caught before mainnet to bringing new teams into Arbitrum.

What I like about ASP is that it looks beyond the audit itself. AI-assisted screening, human audits, bug bounties, and Security Council support cover different parts of the security lifecycle, which feels much more practical than treating an audit as the finish line.

I also like that there’s no new treasury ask. The proposal is essentially trying to get more value out of funds that have already been allocated, while keeping the DAO informed through quarterly transparency reports.

A few things I’d still keep an eye on:

• AI screening: Running five tools in parallel is interesting, but the program should actually measure how useful they are. I’d like to see whether they catch meaningful issues that human auditors miss, rather than just producing more findings.

• Team eligibility: The runway requirement is a good lesson from AAP. There’s little value in funding an audit for a team that may not have the runway or resources to actually ship.

• Idle funds: Putting unused funds to work is reasonable, but capital preservation and liquidity should come first. The DAO shouldn’t be taking unnecessary risks just to generate yield.

• Governance: I like the 14-day optimistic approval model because not every operational adjustment needs to become a full governance event. At the same time, the objection mechanism needs to remain genuinely accessible to delegates.

• Transparency: The quarterly reports should tell us more than just how much was spent. Metrics around vulnerabilities found, severity, remediation, AI performance, funded teams that actually launched, and remaining funds would make it much easier to judge whether ASP is delivering.

Overall, I think ASP is a solid evolution of AAP. The biggest win here is moving from “we funded audits” to building a more complete security pipeline for the Arbitrum ecosystem.

I’m supportive, but I’d like us to keep the focus on measurable outcomes, responsible treasury management, and transparency throughout the 12-month mandate.

6

Hi @Arbitrum ! Great to see the continuation of this programe. More ecosystems should take this as an example for supporting early stage builders.

I have a quick question: how were the AI security agents that will be trailed identified and can you share who built them?

Also, will there be possible for new Service Providers to join the list of approved ones?

Thanks!

1 Like
7

Budget questions

The proposal is explicit that it broadens the mandate, and that the bug bounty and the Security Council have been carried by the Foundation to date. Our questions are about what that means for the budget on both sides.

Both functions also sit inside the Foundation’s own 2027 funding, approved and transferred earlier this year: the technical lines are described in that proposal as covering “block explorers, bug bounties, auditing spend, cloud service providers,” and in that thread the Foundation listed the Security Council among what those lines cover. Nothing in ASP states that the corresponding amounts will be deducted from, returned from, or otherwise reconciled against that budget. The technical lines are aggregated, so this cannot be checked from outside.

What amounts for these two functions are currently embedded in the 2027 Foundation budget, and how will they be reconciled if these functions are funded through ASP?

On the program’s own breakdown: in the deck from the 18 August call, the Security Council and the technical expert carry defined annual amounts, the bug bounty carries its maximum payout per critical finding, and “Audits and AI screening” reads “from remaining balance.” If that reflects the intended hierarchy, ecosystem audit subsidies become the residual category.

What amount, or minimum floor, is reserved for the audit and AI screening pillar for the year? And is there a defined spending priority between the pillars if the balance does not cover all of them? The second was raised on the call and answered as to likelihood rather than as to rule.

We support @MconnectDAO on defining “low-risk” for idle fund deployment and on bounding which changes can pass through the 14-day optimistic process.

Pending answers, we are voting Against.

1 Like
Cp0x Delegate Communication Thread
8

The results from the first year provide a useful basis for refining the program rather than simply extending the previous model. In particular, the combination of AI-assisted screening with human audits could help address the cost and runway constraints identified among early-stage teams, while the inclusion of continuous bug bounty coverage and Security Council funding broadens the security benefit beyond individual projects. The proposed 14-day optimistic process is also worth watching, as its effectiveness will depend on whether the objection threshold provides sufficient protection while actually reducing governance overhead.

9

Voting FOR.

The Audit Program earned its renewal on results: 18 completed audits across 71,366 lines of code surfaced 385 vulnerabilities — 13 critical, 40 high —all remediated before mainnet, at roughly $15 per line against a ~$70k industry mid-market reference. About 60% of funded teams were net new to the ecosystem. Broadening from point-in-time audits to a full security lifecycle — AI screening, human audit, bug bounty, Security Council — is the right read of where subsidised security actually converts into ecosystem value.

Two structural features make this a straightforward FOR for me. There is no new treasury request: ASP runs on the balance the DAO already allocated to
AAP, and anything unspent at term end returns to the treasury. And the proposal is unusually candid about what didn’t work — the runway problem, value
concentrating in later-stage teams that could have self-funded, the 135-day audit-to-mainnet lead times. A program that reports its own failures is one
worth renewing.

A couple of things I’d like to see clarified as the program gets underway. The bug bounty and Security Council have been carried by the Foundation to date and appear inside the aggregated technical lines of the already-approved 2027 AF budget; it would help to understand how those amounts are reconciled now that both sit under ASP, since the aggregation makes that hard to see from outside.

Related: with the Security Council at $720k/year and roughly $1.2M of the $1.76M USDC already committed to outstanding audits, “audits and AI screening from remaining balance” leaves the program’s original purpose as the residual claimant. An indicative floor for the audit pillar, and some sense of priority between pillars if the balance doesn’t cover
everything, would give delegates a clearer picture. @cp0x raised both points well.

I’d also echo @MconnectDAO on defining “low-risk” for idle-fund deployment and on bounding which changes pass through the 14-day optimistic process.

None of this changes my support. Audit coverage lapsing would be the worse outcome — applications closed 31 July and the wind-down is already underway —
and the structure here keeps the DAO’s exposure bounded.

1 Like
10

Thank you for your feedback and questions, @ostanescu.eth.

The five providers were identified over the course of AAP’s operations, based on the audit committee’s review of the tooling available in the market. We’re not sharing provider names at this stage, as all five will run in parallel so we can collect comparative data. We’d expect to name any providers the program converges on once the evaluation concludes.

Yes, depending on the volume and availability of current providers, more firms may be approved in the future. Providers interested in joining the approved list can reach out to the Foundation.

11

This proposal is well-structured, low-risk from a treasury perspective, and demonstrates strong program iteration based on real data.

Key governance strengths:

• No new capital request: It reuses the remaining AAP allocation (~$1.76M USDC + 25M ARB, net of ~$1.2M outstanding commitments).

• Continuity + evolution: It builds directly on a one-year pilot with clear metrics (367 applications, 18 completed audits, 385 vulnerabilities found including 13 critical/40 high, ~60% net-new teams, cost efficiency below industry benchmarks).

• Scope expansion is logical and justified: Moving from pure audits to the full security lifecycle (AI screening → human audit → continuous bug bounty → emergency response via Security Council) addresses the reality that point-in-time audits alone are insufficient for ecosystem security.

• Process improvements reduce overhead: The optimistic approval mechanism (14-day forum post + 5% VP objection threshold → non-constitutional vote if needed) is a sensible response to the friction experienced when adjusting the exclusivity framework.

• Accountability mechanisms remain intact: Quarterly transparency reports, final summary, alignment framework retention, and return of unspent funds at term end preserve DAO visibility and control.

• Risk controls: Right-sizing the technical expert retainer, eligibility tightening (runway + co-funding), public acknowledgment requirements, and idle-funds deployment into low-risk strategies all show operational maturity.

• Bundling Security Council compensation and bug-bounty operations into the same envelope could raise questions about whether these should remain separately budgeted or more explicitly ring-fenced.

• The optimistic process is efficient but relies on the Foundation accurately monitoring and tallying the 5% VP threshold.

• Lead times and runway lessons indicate that pure early-stage focus had limits; the proposal acknowledges this without fully abandoning the original mandate.

Overall, this is a responsible, data-driven continuation that prioritizes ecosystem security ROI while minimizing governance and treasury friction. It strengthens Arbitrum’s competitive positioning as a security-first L2 without requesting incremental capital.

Appreciation:

Thank you to the Arbitrum Foundation and the audit committee for the transparent, metrics-rich proposal and for the disciplined execution of AAP over the past year.

Particularly:

• The clear accounting of results (vulnerabilities found and remediated pre-mainnet, cost-per-line efficiency, net-new team acquisition, and referral growth).

• Honest lessons learned — especially around runway requirements, concentration of value in later-stage teams, long lead times, and the need for greater visibility. Acknowledging that some funded teams could not fully capitalize on the subsidy is refreshing and responsible.

• The decision to expand the mandate to AI-assisted screening, continuous bug bounties, and Security Council support without a new treasury ask. This shows capital stewardship and a genuine focus on protecting the entire stack rather than optimizing solely for audit volume.

• Right-sizing the technical expert retainer and introducing low-risk idle-funds strategies further demonstrate operational refinement.

• Retaining the DAO-approved alignment framework while reducing process overhead via optimistic governance is a pragmatic balance.

This kind of iterative, evidence-based program design is exactly what healthy DAO governance should look like.

Opinion:

I am supportive of this proposal. Continuing and evolving the security program with remaining funds is a high-ROI use of capital that reinforces Arbitrum’s security posture, attracts quality builders, and protects existing users and TVL. The shift from a narrow “audit subsidy” to a broader “security lifecycle” program is a natural and welcome maturation. The operational tweaks (eligibility filters, public acknowledgment, optimistic process, idle-funds deployment) address real friction points without introducing unnecessary complexity. Barring material concerns raised in the discussion period, this should proceed.

Questions for Clarification: @Arbitrum

1. Budget transparency & ring-fencing: Can you provide a clearer projected breakdown of the remaining ~$1.76M USDC + 25M ARB (net of outstanding commitments) across the four pillars (AI screening + audits, bug bounties, Security Council compensation, technical expert, and contingency)? How will contingent bug-bounty payouts be managed if a large critical payout occurs?

2. AI pilot evaluation: How will success of the five AI security agents be measured (e.g., true-positive rate vs. human auditors, cost savings, false-positive burden on teams)? Will results of the parallel evaluation be shared in the quarterly reports?

3. Eligibility refinements: Beyond the 1-year runway and partial self-funding requirements, will there be any scoring or prioritization criteria that balance early-stage access with likelihood of successful mainnet launch and sustained presence on Arbitrum?

4. Optimistic process safeguards: How will the Foundation publicly track and report the 5% VP objection threshold in real time? Is there a planned notification mechanism (e.g., Snapshot or forum alerts) so delegates can easily monitor and respond within the 14-day window?

5. Security Council & bug bounty reporting: Beyond the high-level yearly payout summary, will the quarterly ASP reports include any anonymized or aggregated insights on Security Council activity or bug-bounty submissions (without compromising operational security)?

6. Idle funds strategy: What specific low-risk management strategies are contemplated, and what is the expected yield range and risk parameters? Will these be disclosed in the first quarterly report?

7. Continuity & wind-down: Given the two-month wind-down of AAP and the proposed October 1 start, is there any bridge mechanism for teams currently in the pipeline that might otherwise face a gap?

Looking forward to delegates discussion and happy to support the proposal.​​​​​​​​​​​​

12

Thanks for highlighting this and for supporting the need to define low risk idle fund deployment and clear limits for the 14 day optimistic process.

I also agree that budget reconciliation is essential. If bug bounty and Security Council costs are already covered within the Foundation budget, ASP should clearly disclose how duplicate funding will be avoided.

A minimum allocation for audits and AI screening is equally important, otherwise the core purpose of the program may become dependent on leftover funds. Clear spending priorities, reporting, and governance limits would help delegates assess the program with confidence. @cp0x @Arb_Junior @JulianCross

13

Thank you, @TodayInDeFi. I appreciate you highlighting these points.

I agree that continuing security coverage is important, especially when the program is using already allocated funds and has shown clear results. My concern is mainly about making the expanded scope equally clear in practice.

A public definition of “low risk” for idle fund deployment, along with clear limits on what can be changed through the 14 day optimistic process, would help delegates maintain oversight while allowing the program to operate efficiently.

The requested audit budget floor and clearer priority order across audits, AI screening, bug bounty, and Security Council would also improve accountability. @TodayInDeFi @cp0x

14

@MconnectDAO You are correctly identifying the accounting friction.

@cp0x @Arb_Junior To ensure the Arbitrum Security Program (ASP) does not become a convoluted residual category of the broader Foundation budget, the DAO cannot rely on retroactive, manual quarterly summaries.

True budget reconciliation requires a deterministic data dashboard that automatically indexes and isolates ASP deployments (Audit payouts, Bug Bounties, AI Screening costs) from baseline Foundation spend in real-time. If delegates cannot instantly verify the on-chain execution of these specific security tranches, “spending priorities” become unenforceable.

Architect the tracking infrastructure first, and the governance accountability will naturally follow.

15

Voting FOR. I love the idea of the AI screening, this will be an excellent opportunity for teams to benefit from security and focus on building. The lessons learned make sense and I’m excited to see what’s coming from builders. If the bull market really kicks in, builders should be attracted to Arbitrum.

Zeptimus Delegate Communication Thread
16

Voting FOR.
This Security program has 2 purposes: Secure Arbitrum, and also attract new projects, and overall i think it can work for achieving both those goals.

One of the main barriers to entry for any cool web3 innovation is getting the audits, subsidizing them for teams really can be the difference in what chain they deploy on… Personally, I can’t say i totally align with this strategy in 2026… it seems like large trusted players are safer bets for our ARB… which OCL does seem to do a good job at managing (the Robinhood deal for instance was great!) but at the the same time, i can understand this strategy… it does let us gamble on finding new teams and you never know who can be the next Polymarket, Hyperliquid or Pump.fun.

But I love seeing the AI screening and bug bounty uses… in general, i think we can make HUGE waves by making Arbitrum the most secure L2 in the ecosystem.

i would love to see MORE efforts in that direction… Circuit breakers, an alternative group to the security council that can freeze funds quickly during hacks like we did with the LayerZero/rsETH/Aave incident (hopefully in conjunction with Seal 911), and other initiatives that can really move the needle to prevent thefts that seem all too common in crypto… Just think if those threats were mitigated on Arbitrum! It would be a great selling point to users and companies alike.

This is why I support this vote. It opens the door to support broader security initiatives… and the kicker is that it is only allocating funds that were already allocated to Audits (which i think has a smaller security ROI) to broader more impactful initiatives.

17

Reverie is voting FOR this proposal. The original program produced tangible security outcomes, and the extension uses already-allocated funds rather than asking the DAO for more. We think extending the audit process from a snapshot review to a continuous process with AI screening, bug bounties and emergency response via the security council provides a more holistic product to teams building on the ecosystem. We also believe the optimistic approval process could be useful in reducing the friction for early stage startups.

18

The following reflects the views of L2BEAT’s governance team, composed of @krst and @Manugotsuka, and is based on their combined research, fact-checking, and discussion.

We voted AGAINST.

We recognize that security is a critical priority for Arbitrum, and we are supportive of programs that help builders access high-quality audits and security support. The original Arbitrum Audit Program had a clear and useful purpose: reduce the financial burden for teams building in the ecosystem and help them reach mainnet with stronger security practices.

Our concern is that the Arbitrum Security Program broadens that mandate too much. Some parts of the proposal, such as improving audit support for builders, make sense. However, combining builder audit support, protocol-level bug bounties, and Security Council compensation under the same remaining funding pool makes the program harder to evaluate and moves it away from its original focus.

This is also difficult to reconcile with the Foundation’s broader funding request, which already included security-related expenses while treating the Audit Program as a separate DAO-approved initiative. During the discussion, we asked how this proposal fits with that previously approved funding, and the response was that expenditures under this program would be reconciled against the Foundation budget to extend the Foundation’s operational runway. That makes us uncomfortable, because funds originally allocated for a builder-facing audit program should not gradually become part of the Foundation’s operating runway.

Our understanding was that costs such as Security Council compensation and protocol-level bug bounties were already covered through the Foundation’s ordinary operating budget, especially given that the previous ask included $4.63M allocated to Security. We think the DAO should be more diligent about the use of DAO treasury funds, especially given that the treasury is not as large as it used to be.

Furthermore, as OpCo is already operational, we think it may make sense to place this program under OpCo if it is intended to remain a DAO program. That would help avoid ambiguities around funding sources and expenses related to DAO programs.

The remaining audit program funds should either stay focused on ecosystem builders or return to the DAO treasury.

For these reasons, we voted AGAINST. This vote is not against Arbitrum security spending. It is about keeping budgets, mandates, and governance accountability clear.

2 Likes
19

Cornell Blockchain supports this proposal to streamline and increase security.

20

The following reflects the views of GMX’s Governance Committee and is based on the combined research, evaluation, consensus, and ideation of various committee members.

The GMX Governance Committees are supportive of the general direction of this proposal.

Evolving the Arbitrum Audit Program into a broader Security Program makes sense. The first year showed that subsidised audits can surface meaningful issues before mainnet, and we agree that ecosystem security should not be treated as a one-off audit exercise.

We are supportive of the broader scope, including AI-assisted screening, the continued audit pathway, core protocol bug bounty coverage, and Security Council support.

Our main request is for more clarity on two points.

First, when available, we would appreciate more detail on the AI screening pilot: which tools will be used, how they will be selected, what kinds of findings they are expected to surface, and how their performance will be evaluated against human audits.

Second, we would like more detail on which security subsidies are available for ecosystem teams. The proposal refers to “audit, AI screening and security subsidies for ecosystem teams,” but it is not fully clear whether this is limited to audits and AI screening, or whether teams may also be eligible for other support such as bug bounty programs, AI audit competitions, monitoring, or post-deployment security coverage.

Overall, we support the proposal’s direction and appreciate that it does not request new treasury funding. More detail on the AI tools and the scope of available ecosystem subsidies would make the program easier for teams and delegates to evaluate.