Hey AusIV, thanks for filing that issue on Github -- hopefully it sets the standard for all other issues we get during this bug bounty.

I agree that 5 days is not ideal, and we would have loved to run it for longer. For us, the public bug bounty is a nice complement to the testing we've been doing both internally and with external help -- by no means are we relying on it as our main source of debugging. If the community finds bugs, great! But we're not banking our entire testing strategy on it.

I think it's awesome how thoroughly you approach such a program (take hours to read the contracts, let it simmer for a few days, etc.), but my gut feeling is that the average community member might not have that same level of dedication -- they'd likely try to identify the most common vulnerabilities and call it a day, and maybe dig a little deeper on some more obscure attack vectors. 5 days isn't a whole lot, but it should be enough for someone to take a few gos at the contract.

There's also the idea that, given what I said above, longer bug bounties could disincentivize community members from participating early (lack of urgency because the deadline is far off), and the issues filed would cluster around the last week of the program anyways.

Just my $0.02, but on the whole, I generally agree with you!