# \[Proposal\] \[Poll\] Hire a pentesting company to check the main frontends used to interact with Yearn contracts

**URL:** <https://gov.yearn.fi/t/proposal-poll-hire-a-pentesting-company-to-check-the-main-frontends-used-to-interact-with-yearn-contracts/7009>\
**Category:** Protocol and Governance\
**Created:** [16 October 2020 09:55 UTC](https://gov.yearn.fi/t/proposal-poll-hire-a-pentesting-company-to-check-the-main-frontends-used-to-interact-with-yearn-contracts/7009 "2020-10-16T09:55:24Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![laur\_science](https://dub1.discourse-cdn.com/flex013/user_avatar/gov.yearn.fi/laur_science/32/1205_2.png) [@laur\_science](https://gov.yearn.fi/u/laur_science)\
**Post date:** [16 October 2020 09:55 UTC](https://gov.yearn.fi/t/proposal-poll-hire-a-pentesting-company-to-check-the-main-frontends-used-to-interact-with-yearn-contracts/7009/1 "2020-10-16T09:55:25Z")

</div>

> Hire a [pentesting](https://www.cloudflare.com/learning/security/glossary/what-is-penetration-testing/) company to check the main servers and frontends used to interact with Yearn contracts

This would be done in perpetuity, but only the first audit would be more costly. Afterward, they’d just do a faster check each month. This would permit us to display on the website a badge saying something like “Secured by …”.

Additionally, we would implement w/e security protocols they recommend. For example, who has access to changing the frontend? How is that access secured? Who has access to the actual server? How is that secured? And so on.

Testing and contract audits won’t help us much if someone hacks yearn.finance and changes the website to call functions with the wrong arguments, or other similarly bad stuff. This is highly needed.

I will formalize the proposal during the next few days. We should come up with suggestions on what pentesting company we should go for, and what’s the budget.

**Poll:**

_Poll ([view on site](https://gov.yearn.fi/t/proposal-poll-hire-a-pentesting-company-to-check-the-main-frontends-used-to-interact-with-yearn-contracts/7009/1))_

---

<div class="post-metadata">

**Author:** ![laur\_science](https://dub1.discourse-cdn.com/flex013/user_avatar/gov.yearn.fi/laur_science/32/1205_2.png) [@laur\_science](https://gov.yearn.fi/u/laur_science)\
**Post date:** [16 October 2020 09:55 UTC](https://gov.yearn.fi/t/proposal-poll-hire-a-pentesting-company-to-check-the-main-frontends-used-to-interact-with-yearn-contracts/7009/2 "2020-10-16T09:55:32Z")

</div>

This thread is for discussion and for polling sentiment (same as [https://snapshot.page/#/yearn](https://snapshot.page/#/yearn)), therefore I guess I’ll also have to submit an YIP, right?

---

<div class="post-metadata">

**Author:** ![laur\_science](https://dub1.discourse-cdn.com/flex013/user_avatar/gov.yearn.fi/laur_science/32/1205_2.png) [@laur\_science](https://gov.yearn.fi/u/laur_science)\
**Post date:** [16 October 2020 10:04 UTC](https://gov.yearn.fi/t/proposal-poll-hire-a-pentesting-company-to-check-the-main-frontends-used-to-interact-with-yearn-contracts/7009/3 "2020-10-16T10:04:50Z")

</div>

Alternatively, we could extend the bug bounty program to cover this.

---

<div class="post-metadata">

**Author:** ![ejbaraza](https://dub1.discourse-cdn.com/flex013/user_avatar/gov.yearn.fi/ejbaraza/32/2241_2.png) [@ejbaraza](https://gov.yearn.fi/u/ejbaraza)\
**Post date:** [16 October 2020 13:47 UTC](https://gov.yearn.fi/t/proposal-poll-hire-a-pentesting-company-to-check-the-main-frontends-used-to-interact-with-yearn-contracts/7009/4 "2020-10-16T13:47:03Z")

</div>

The bug bounty seems like the easier way to go.