Skip to content

Appendix: Mathematical Proofs

A.1 Proof: Pooling Preserves Expected Value While Reducing Variance

Setup: Let X_i be the random variable for finding outcome on target i, where:

X_i = B_i with probability p_i
X_i = 0  with probability 1-p_i

Solo (single target):

E[X] = p × B
Var[X] = p(1-p) × B²
CV (coefficient of variation) = √(Var[X]) / E[X] = √((1-p)/p) / 1

For p=0.10, B=$20K: E=$2K, SD=$6K, CV=3.0

Pool (n independent targets, equal weight):

Y = (1/n) × Σ X_i

E[Y] = p × B    [unchanged]
Var[Y] = (1/n) × p(1-p) × B²
CV[Y] = CV[X] / √n

For n=25: CV drops from 3.0 to 0.6, a 5x improvement in risk-adjusted return. ∎


A.2 Proof: Multi-Model Coverage Exceeds Single-Model

Setup: Model j detects vulnerability class v with probability d_j(v). Define coverage as the probability that at least one model detects v:

P(detected by ≥1 model) = 1 - Π_j (1 - d_j(v))

For identical models with coverage C:

P(≥1 detects) = 1 - (1-C)^N

This is monotonically increasing in N and approaches 1 as N→∞. Each additional model provides strictly positive marginal coverage:

ΔCoverage = (1-C)^N - (1-C)^(N+1) = (1-C)^N × C > 0 for C ∈ (0,1)

Marginal benefit decreases but never reaches zero. ∎


A.3 Proof: Cooperative Game Achieves Higher Effort Than All-Pay Auction

Setup (All-Pay Auction): N symmetric players, prize B, effort cost c(e).

Nash equilibrium effort per player (Hillman & Riley, 1989):

e* = B × (N-1) / N²
Total effort = N × e* = B × (N-1) / N

As N→∞, individual effort → 0 (free-riding).

Setup (Cooperative Pool): Operator funded by sponsors, effort cost borne by pool.

Operator maximizes: p(e) × B × split - 0 (compute funded by sponsors)

Optimal effort: p'(e*) × B × split = marginal compute cost

Since compute cost is externalized to sponsors (who benefit from higher p), the equilibrium effort level exceeds the all-pay auction:

e*_cooperative > e*_all-pay when sponsor funding > individual budget constraint

This is because the budget constraint that limits individual effort in all-pay auctions is relaxed by pooled funding. ∎


A.4 Derivation: Optimal Portfolio Diversification for Sponsors

Following Markowitz (1952), for N uncorrelated pools:

μ_p = Σ w_i × μ_i
σ²_p = Σ w_i² × σ²_i

For equal weights w = 1/N and identical pools:
σ²_p = N × (1/N)² × σ² = σ²/N
σ_p = σ/√N

Sharpe Ratio:

S_p = μ_p / σ_p = μ / (σ/√N) = √N × S_solo

Optimal number of pools depends on available pool correlation ρ:

σ²_p = σ²/N × [1 + (N-1)ρ]

For ρ > 0, diminishing returns set in around N = 1/ρ
For ρ = 0.05, optimal diversification ≈ 20 pools
For ρ = 0.10, optimal diversification ≈ 10 pools

Prowl Protocol — Decentralized AI-Powered Bug Bounty Platform