Are crypto auditing incentives designed to make the client happy rather than deliver bad news? What happens if you don’t pay out bug bounties?