Variance Reduction via Pooling

Theorem: Pooled hunting produces the same expected return as solo hunting with dramatically lower variance.

Setup

Let:

• p = probability of finding a vulnerability on a single target
• B = bounty payout for a valid finding
• c = compute cost per target
• n = number of targets in a pool

Solo Hunter

E[solo] = p × B - c
Var[solo] = p(1-p) × B²

Pool with n Independent Targets

E[pool] = n × (p × B - c)    [same per-target EV]

Number of findings ~ Binomial(n, p)
Var[findings] = n × p × (1-p)

Per-sponsor variance decreases as 1/√n (Central Limit Theorem)

Probability of At Least One Finding

P(≥1 finding) = 1 - (1-p)^n

Targets (n)	p = 5%	p = 10%	p = 15%
1 (solo)	5.0%	10.0%	15.0%
5	22.6%	41.0%	55.6%
10	40.1%	65.1%	80.3%
20	64.2%	87.8%	96.1%
50	92.3%	99.5%	99.99%

Key Insight

At n=50 targets with just 10% per-target hit rate, the pool has a 99.5% chance of at least one payout. This is the same math that makes Bitcoin mining pools viable.