Logical Issue (Boosting Reputation points)

How it was found

Hello,

This bug is a design flaw in the reputation system.

Simply, when a bug is resolved +7 is added to the user's account. When bounty is awarded then the reputation points are calculated based on standard deviation from the program's mean.

I found these here ---> https://hackerone.com/news/introducing-reputation

You gain reputation when: Your report is Closed as Resolved: +7 Your report is Closed as Duplicate (Resolved): +2. Only applied if reported before the original was closed. You are awarded a bounty. The amount is based on standard deviation from the program's mean: +50: $ >= µ + 1σ +25: $ > µ +15: $ >= µ - 1σ +10: $ < µ - 1σ Your report is Closed as Won't Fix: +1 Your report is Closed as Duplicate (Won't Fix): +1

You lose reputation when: Your report is Closed as Not Applicable: -5 Your report is Closed as Duplicate (Not Applicable): -5 Your report is updated as Needs more info: -1

1. Now, one reporter can earn max of +50 reputation points if award is far maximum than program's min bounty amount.
2. Also, when report is marked as Resolved then +7 are added.
3. So, totally max of +57 points can be made from a single bug report.

But there exists a flaw which will allow to boost reputation points more than +57.

1. A report is awarded bounty of $350 but minimum bounty of program is $100. So, this adds +50 reputation points to the reporter.
2. Now, report is marked resolved, so +7 reputation points are added.
3. Now, if same report is awarded with bounty $150, then it will again add +15.

So, if a report is rewarded again and again then it will boost reputation points more than default +57. So, this totally contradicts the policy mentioned here ---> https://hackerone.com/news/introducing-reputation Due to this flaw, reporter will earn more reputation points more than other researchers. i.e If researcher two reports a severe bug then he will get +50 and +7. Total of +57. (Total bounty 1000$) But at the 1st researcher's report is being rewarded again and again. It will boost as +50 and +7 and again awarded so +15. Total +72.(Total bounty 350$ + 150$ = 500$)

I hope you understand the severity here and modify the reputation system accordingly. I found this bug on my own account. So, I am attaching an image poc of my account. Sensitive information has been forged.

Regards, Pranav