The Desk's supply side, measured

The Whitehat Desk page says a sweep is run by independent researchers and coordinated by Kerne. This page is that sentence turned into a number you can check, because a claim about capacity that a buyer cannot weigh is the same species of claim the rest of this property exists to argue against.

It is also the least flattering page we could have written about our own commercial position, and it is on the site for the same reason the realized yield number is: publishing the weak number before somebody else finds it is the only version of this that stays credible.

The claim, and whether it currently holds

Who has disclosed

The only people named on this page are the 2 on the roster above, each after a separate written yes to appearing here. 12 of the researchers below have agreed to public credit and are listed by the handle they chose, with the finding class and current status of each report, on the acknowledgments wall, which is where that consent applies and which sells nothing.

Agreeing to be credited for a disclosure is not agreeing to appear on a page that exists to support a commercial offer. Those are different questions and we are treating them as different questions, so the names stay on the wall and this page carries numbers. If somebody tells us in writing that they want to be listed here as available for paid work, they will appear in the roster below and not before.

The submitter count at the top of this page is the first two bands added together. Enquiries are excluded from it on purpose: somebody asking how the programme works has not disclosed anything, and counting them as supply would be the flattering error.

This number is larger than the one on the acknowledgments wall, and the difference is not an error on either page. The wall is a credit ledger: it carries the researchers who asked to be listed and whose finding can be described without handing over a live exploit, so it grows slowly and on purpose. This page counts everyone who sent something, named or not. If the two ever imply the same thing, the wall is the one to trust on credit and this page is the one to trust on volume.

How fast we answered, including where we were late

Each row is checkable by the person it concerns against their own copy of the thread, which is the only reason it is worth publishing. One row is a miss and stays on the page. Section 3.4 of the bug bounty program says a missed date entitles the person owed to say so publicly and that we will not dispute it, which is difficult to mean while quietly leaving the misses off the scorecard.

What Kerne can actually pay

This is the number that makes the rest of the page honest. It is read on chain when this page renders, not written down here, so it cannot drift into being wrong the way a typed figure does.

Kerne cannot pay a reward today, and no reward is offered or implied for a report submitted now. That sentence is on the programme page and it is repeated here because this is the page where somebody is most likely to be deciding whether to spend a weekend on our code.

What being on this page does not mean

• It does not make anybody staff, a contractor, a partner or a creditor of Kerne.
• It does not mean they were paid. Nobody on this page has been paid anything by Kerne, and the count of people we have ever paid is printed at the top precisely so it cannot be missed.
• It does not mean they endorse Kerne, vouch for the contracts, or consider the protocol safe. Several of them are on this page because they found something wrong.
• It is not an audit and not a security guarantee. A finding is a finding, and a wall of them is not a clean bill of health.
• Anybody listed here can be removed on request, without giving a reason, by writing to the disclosure address.

The offer, for researchers reading this

When a sweep is booked, the researcher who does the work takes 70 percent of the fee, paid in USDC within 72 hours of the report being delivered, and Kerne keeps 30 for scoping and coordination. On the published tiers that is $1,750 on a focused sweep and $3,500 on an extended one. The terms and the windows are on the Whitehat Desk page.

The honest part: no sweep has ever been booked, so agreeing to be listed puts no work in front of anybody today. It is an option on future work, not a job, and it is deliberately kept separate from the unpaid commitments above. Taking desk work does not settle, offset or re-queue anything Kerne already owes.

If you want to be on that roster, write to kerne.systems@protonmail.com with the subject "Whitehat Desk: roster" and say what you review and where your work is visible. Two separate answers are useful: whether you want your name on this page at all, and whether you want to be listed as available for paid work. Yes to one and no to the other is a normal answer, no to both is a complete answer, and anyone listed can come off later by asking, without giving a reason.

How this was counted

Counted from three first-hand sources: the sent folder of the disclosure mailbox, read directly rather than from a summary; the acknowledgments ledger, which is the canonical credit surface; and the dated runsheets written at the time each set of verdicts went out.

One person, one row. Where two addresses or two spellings might be the same person they are collapsed into one row and the other identifiers are printed beside it, so the deduplication is auditable instead of asserted. If a collapse is wrong it undercounts by one, which is the direction an honest error should go.

On 2026-08-31 that rule caught this page. The submitter count fell from twenty to nineteen, because three rows were one person counted twice: a handle carried across from the acknowledgments wall and a display name read out of the mailbox, with nothing joining them. The folded identifiers are printed beside the rows that absorbed them. The error inflated our own headline, which is the direction this page exists to catch, so it is recorded here rather than quietly corrected.

An enquiry is not a disclosure. People who wrote to ask how the programme works, and never sent a finding, are counted in their own band and are excluded from the disclosure count.

What this count does not cover

The sent folder was read first-hand for 2026-07-31 through 2026-08-09, which covers the entire disclosure burst. Correspondence outside that window, in both directions, is carried from the acknowledgments ledger and the dated runsheets rather than re-read for this page. That is how the three duplicate rows above survived seventeen days: inside the window a person was read under one name, outside it under another.

The window before 2026-06-16 is not enumerated here. If somebody disclosed to Kerne before that and is missing from this count, the omission is ours and the correction is a message away.

Most of the people counted here are not named anywhere, because they have not asked to be. They are counted and left unnamed rather than dropped: a tally that included only the researchers comfortable being listed would understate the work that was actually done, and the point of this page is the size of the supply rather than a list of endorsements.

No finding on this page is re-adjudicated by it. Every disposition was settled at the time and this page only counts those outcomes. If a row misstates what you were told, that is a transcription error on our side and we will correct it on the page.