I want to raise a concern about Immunefi’s pay-to-submit model without disclosing any vulnerability, project, or private report information.

I submitted several good-faith reports supported by runnable proofs of concept and extensive validation. Multiple reports were subsequently closed as duplicates of private submissions that researchers cannot inspect before paying the submission fee.

The problem is structural:

- researchers cannot perform a complete duplicate check because earlier reports are private;

- the submission fee is retained even when the report is a technically accurate and independently reproduced duplicate;

- the project receives an additional PoC and validation of the issue;

- the researcher bears all of the research time and financial risk;

- in some cases, the reported behavior may remain deployed even though an earlier report already exists;

- mediation or support may be unavailable because of cooldown restrictions.

I understand why vulnerability reports must remain confidential,…