Editing Exploit markets (section)

= Private exploit sales =

In theory zero-knowledge proofs can be used to prove that a person has produced a valid exploit for a buyer. This satisfies the requirement of doing trustless '''private''' purchases for an exploit (as the existing contract requires the exploit to be revealed for the reward to be given.)

The ZK proof approach means that after you encrypt the exploit your proof is given in zero knowledge. If you try to get smart and produce a valid proof but encrypt an invalid exploit the vendor can always release what you provided as the encrypted exploit to prove to the network that you are cheating. This requires a clearing phase for security.

Thus autonomous private exploit markets are possible in theory.

Btw: Something else I just realized is that this protocol has its place within the bug bounties too. The use-case would be to reward researchers for their work much earlier on without having to wait for the the patch time-frame set forth within the contract to elapse before doing a disclosure.<span id="why-does-this-matter"></span>