LCAM Blockchain Expedited Arbitration Rules–key procedural featuresContextThe London Chamber of Arbitration and Mediation (‘LCAM’) has worked in conjunction with Immunefi, a blockchain security platform, to create the LCAM Blockchain Expedited Arbitration Rules(the ‘Rules’), a bespoke arbitral scheme tailored to the needs of participants in the security vulnerability market. Immunefi is an online platform which connects blockchain projects with security researchers and provides tools to manage security testing, disclosing vulnerabilities they discover, so that hacks can be averted. If these security researchers (also known as ‘whitehat hackers’) identify qualifying on-chain vulnerabilities, they may claim a payment known as a ‘bug bounty’, with posted payments running up to multimillion-dollar bounties.Bug bounty disputes arise in this context when there are disagreements between a blockchain project and a security researcher in relation to the security research carried out on the project. These disputes can arise in a number of ways, including in relation to the disputed existence of the reported security vulnerability, disagreement as to the purported severity of it, or in relation to the payment of the bug bounty itself. In the past, it has been difficult for these disputes to be resolved for a number of reasons, including the preference of security researchers to retain their anonymity, inherent jurisdictional complexities and enforcement challenges. The Rules provide a pathway for bug bounty disputes to be resolved via arbitration, under a bespoke set of arbitral rules which take account of the unique features of this type of dispute.The Rules also have wider significance, as they provide a blueprint for how arbitration as a dispute resolution mechanism can accommodate the unique challenges which arise in web3 disputes–ie disputes involving applications built on blockchain technology, where users can own and transfer digital assets directly without a central intermediary. Marking a significant development in the landscape of web3 dispute resolution, they introduce a streamlined arbitral process to resolve disputes involving sophisticated web3 participants, prioritising speed and privacy, and accommodating both off-chain enforcement and on-chain execution. This innovative approach situates LCAM at the forefront of modern arbitration practice, providing parties with a robust framework tailored to the particularities of digital asset disputes.Key features of the RulesThe Rules, which have been effective from 9 December 2024, have been designed to address specific challenges encountered in web3 disputes, including issues relating to party consent, privacy and anonymity, confidentiality of awards, and the practicalities of enforcing arbitral decisions against digital assets. The following sets out an overview of the main features which distinguish the Rules from more traditional arbitration frameworks.Offer and acceptance structureThe Rules operate in the context of blockchain projects offering anonymous security researchers the opportunity to claim a bounty by identifying a qualifying blockchain project security vulnerability. The parties are therefore not operating in a typical contractual nexus where named parties sign a traditional contract. The blockchain project does not know the identity of the security researcher and the bug bounty only becomes payable after a qualifying bug bounty report from a registered researcher has been accepted by the blockchain project.In this context, a distinctive feature of the Rules is the manner in which arbitration agreements are formed. According to Article 4, there is no need for a pre-dispute agreement to arbitrate between the parties. Rather, when a claimant submits a Request and Statement of Claim, the claimant accepts in its terms the standing offer to arbitrate made by the respondent in its agreement with Immunefi, if there has not been any prior acceptance of an offer to arbitrate. By integrating this mechanism into the Immunefi platform, parties engaging in web3 transactions are automatically bound by the arbitration framework upon initiation of a claim, thereby streamlining post-dispute agreement to arbitrate and reducing pre-dispute negotiation between parties.Anonymity provisionAnother singular provision of the Rules is that the claimant security researcher can choose to remain anonymous to the respondent (the blockchain project party involved in the web3 dispute). This recognises the sensitivity inherent in many blockchain disputes, particularly those involving ethical hackers.Article 7 of the Rules accordingly provides for optional anonymity, allowing parties to request that their identities remain confidential. The Rules are even-handed in stating that any party can take up this option of anonymity but, in reality, the blockchain project entity’s identity is highly likely to already be known to the security researcher, as it will usually have been stated when the bug bounty is offered and will also usually be apparent from the platform that the security researcher is exploring for vulnerabilities.The Rules provide that LCAM and the appointed arbitrator must be informed of each party’s identity details, ensuring that the details are available for appropriate purposes, including conflict checking. However, if a party has requested anonymity, their identity details are withheld from the other parties unless disclosure becomes necessary, including for enforcement or compliance with legal obligations.The Rules also contain a further safeguard at Article 7.3, such that, if a party refuses to provide sufficient identity details to allow an award to be enforced against that party or to enable LCAM to comply with its legal obligations, then either LCAM or the arbitrator shall be entitled to refuse to allow the relevant party to proceed anonymously.Redacted awardsIn relation to the treatment of Awards, the Rules strike a compromise between transparency of the reasoning behind decisions in web3 disputes and protecting confidentiality. The Rules provide at Article 37 that all awards will be published in a redacted form. LCAM has partnered with Jus Mundi in relation to publication of awards and all awards will be available on the Jus Mundi platform. However, the Rules also provide that, unless the parties have agreed otherwise, the published awards will not refer to the identity of the parties or make it possible to identify them. Any information which would pose a cybersecurity risk to any party will also be redacted.The LCAM Secretariat circulates proposed redactions to parties for comments prior to publication. Failure to respond within 7 days is deemed as the party not having any comments on the redactions to the award. This process ensures that sensitive information remains protected while providing transparency within the arbitration community. The redacted award is only published once the 28 days to challenge the award under section 67 or section 68 of the Arbitration Act 1996 have elapsed.Location of digital assets for enforcementIn many web3 disputes, the location of digital assets is a complex question, which can lead to uncertainty in relation to enforcement when cases come before national courts. The Rules contain a number of provisions which work to circumvent difficulties which might otherwise exist in relation to the location of digital assets. Article 38 of the Rules sets a deemed location of all digital assets held on the Immunefi platform. The location of digital assets is accordingly agreed to be London, aligned in the Rules with the seat of Arbitration, which Article 1 of the Rules provides will also be London.By agreeing to arbitrate under these Rules, parties additionally consent to the enforcement of awards either through traditional legal channels (off-chain) or via blockchain-based mechanisms (on-chain). The Immunefi Vault system (a smart‑contract‑based system which can securely hold digital assets pending the resolution of a dispute) (the ‘Vault’) plays a pivotal role in this context: it is a secure platform which can hold digital assets pending resolution of a dispute. Assets held in the Vault can be released or transferred in accordance with the arbitrator’s decision. This innovative mechanism provides an efficient means of enforcing awards directly against digital assets without recourse to national courts, while still preserving the important option for off-chain enforcement under the Convention on the Recognition and Enforcement of Foreign Arbitral Awards (the ‘New York Convention’) where necessary.Documents-only procedureA central feature of the Rules is that they provide for a documents-only procedure, which is designed to promote efficiency and reduce costs. All communications, submissions and evidence are to be exchanged electronically, and the process is conducted without in-person hearings unless the arbitrator determines that a remote hearing (by telephone or video conference) is necessary. Even in such cases, there is to be no oral cross-examination of witnesses (Article 20). This approach places a premium on the clarity and quality of written advocacy, as parties must present their entire case, including factual and expert evidence, through concise, well-structured documents. The Rules also impose strict word and page limits (discussed further below).Fixed feesAnother notable feature of the Rules is their fixed fee structure. Fees are determined by reference to the value of the claim or counterclaim and are payable at the outset of the proceedings. According to Appendix II of the Rules, for claims up to £1 million, the claimant or counterclaimant is to pay a fixed fee of £7,500; for claims exceeding £1 million, the fee rises to £10,000. A registration fee of £150 is also payable on commencement. These fees cover all standard stages of the arbitration up to a specified number of hours’ work by the arbitrator; any additional time required may incur further charges at hourly rates set out in the Rules.Timeline and procedural milestoneThe expedited nature of proceedings under the Rules is reflected in a highly streamlined procedural timetable set out in Article 20, under which the award is required to be produced within four months of the appointment of the arbitrator (absent exceptional circumstances). Within this overall framework, the arbitrator may, on the application of a party or on their own motion, grant extensions of time to the procedural deadlines below. However, sanctions are built in if any party fails to put in a submission or present their case, as Article 21 provides that the arbitrator can then proceed to the award on the basis of the submissions and documents which have been submitted in the arbitration. Under this provision, the arbitrator may also draw such inference as they consider appropriate where a party fails (without good cause) to comply with any provision of the Rules or requirement set out in a tribunal procedural order.Request and Statement of ClaimAn arbitration is commenced under the Rules when LCAM receives the Request and Statement of Claim accompanied by supporting documents, proof of delivery of these to the other parties, receipt of fees and of the claimant’s identity details if anonymity is sought (this date constitutes the ‘Commencement Date’) (Article 5).The requirements for the content of the Request and Statement of Claim are set out in Article 14, which requires that this states the claimant’s identity details where anonymity is not sought, along with electronic contact details for both the claimant and respondent, the full terms of the arbitration agreement/clause, details of the dispute, the issues to be determined and arguments as well as the relief sought, including stating the amount of any monetary relief. The claimant must supply with the Request and Statement of Claim copies of all relevant contractual documents, a copy of the arbitration agreement and copies of all other documents which the claimant relies on in support of its claim, including documentary evidence and any witness statements. The process is effectively significantly frontloaded and speeded up by the requirement to supply all these elements with the initial Request.The respondent must then submit its Answer and Defence within 15 days of the Commencement Date. The Answer and Defence should be accompanied by supporting documents and any objections concerning the existence, validity or applicability of the arbitration agreement. If applicable the respondent should include any Counterclaim in its Answer and Defence (Article 15).Answer and DefenceThe Answer and Defence must contain all the information set out in Article 15, which will include the respondent’s identity details (where anonymity is not sought), any objection to jurisdiction and the full details including arguments in relation to the respondent’s position on the relief sought by the claimant. If there is any counterclaim, this must also be set out, including its anticipated monetary value. The respondent must then supply all documents relied on in relation to any counterclaim and supply any witness statements at the same time as filing the Answer. This contributes to the speed of the arbitral timetable which is a notable feature of the Rules.Appointment of the arbitratorIn line with the objective of a cost-effective procedure, the Rules provide at Article 19 that disputes will be resolved in all cases by a sole arbitrator and that the institution, rather than the parties, will make the appointment. Arbitrators appointed under the Rules are chosen by the LCAM Board from the panel established for the scheme. Appendix I to the Rules sets out the approach which can be expected in relation to such appointments, noting that ‘it may be assumed that the arbitrator is technologically literate and understands complex software concepts’.The Board is required under the Rules to endeavour to appoint the arbitrator within 5 working days of the Answer and Defence. If the respondent fails to produce an Answer and Defence, the Board is in any event required to endeavour to make the appointment within 5 working days of the date on which the Answer and Defence was due.Further submissionsAccording to Article 20, the claimant then has 15 days from receiving the Answer and Defence to deliver its Statement of Reply and, if applicable, a Statement of Defence to Counterclaim. The respondent has 7 days from receiving any Statement of Defence to Counterclaim to deliver its Statement of Reply to Defence to Counterclaim. The Rules require that the Reply and any Reply to Defence to Counterclaim should only address new matters raised in the Answer and Defence and Reply respectively and the arbitrator may disregard any elements of these submissions which do not specifically relate to such new matters.Requests for further information or documentsThe arbitrator may also, at any time before issuing the award, request further information or documents relating to the arguments advanced in the submissions from either party, fixing a deadline of not more than 7 days for delivery of such information and a deadline of not more than 3 days for delivery of any response by the other party. If a party does not respond to the arbitrator’s request, the arbitrator may proceed to the award on the basis of the submissions and documents before them (Article 20).Expert evidenceThe Rules envisage a circumscribed role for expert evidence, guiding the parties towards a tribunal-appointed expert model. Within 20 days of the parties’ last submission, and after consultation with the parties, the arbitrator may appoint one or more impartial and independent experts at the claimant’s option and cost, to report on specific issues. On receipt of the expert’s report, the arbitrator must share it with the parties who are then given an opportunity to submit written comments within 7 days (Article 25).AwardThe arbitrator is expected to issue an award within 2 weeks of the closing of submissions and, in any event, within four months of their appointment. In exceptional circumstances the arbitrator may seek an extension of time from the LCAM Board but, as this is a high hurdle, extensions are unlikely to be granted lightly. An unreasonable delay in the issuance of an award may result in the LCAM Board making a reduction to the amount of fees to be paid to the arbitrator (Article 27).Practical points to noteUnder the Rules, parties must navigate a number of distinctive procedural requirements and strategic considerations. The following practical points highlight a number of key aspects of the Rules that are likely to have a material impact on the conduct and outcome of proceedings.Content and format of submissionsParties involved in disputes under the Rules should pay particular attention to the content and format of their submissions. Strict word limits are imposed in Article 22: the Request and Statement of Claim, the Answer and Defence and any Defence to Counterclaim are limited to 3,000 words each (with an additional 3,000 words for any Counterclaim made by the respondent); Statements of Reply (including a Reply to Defence to Counterclaim) are limited to 1,000 words. While these word limits are in the interests of parties, as they help ensure that the process can be completed within the expedited timeframe set out in the Rules, the short submission format requires parties to focus narrowly on the critical issues and to make their case succinctly.Parties need to exercise a similarly discerning approach in relation to the selection of supporting documents and witness evidence, which are also tightly controlled under the Rules. Bundles of supporting documents, which the Rules require be provided with the submissions, must not exceed 100 pages per submission without approval either from the LCAM Board or the arbitrator. Witness statements must be included in the bundles and are limited to 3,000 words each (all as set out in Article 22).There is no separate disclosure stage in arbitrations under the Rules, although there is provision at Article 24 for the arbitrator to request documents. Given the lack of any further disclosure phase, parties will need to ensure that they have reviewed their case documents before they make their initial submissions so that they can provide with their submissions the critical documents that help make out their case.Securing anonymitySecuring anonymity requires prompt action at the outset. According to Article 7, a party seeking anonymity must state this choice in its Request and Statement of Claim or in its Answer and Defence. The party must provide its identity details confidentially to LCAM and the arbitrator. If sufficient details are not provided, anonymity may be refused; if a party fails to comply with a direction to provide identity details within a specified period, its claim or counterclaim may be withdrawn or struck out. This is reiterated in the Practice Note.Where anonymity is granted, it is important for the relevant party to be aware that this is not an absolute guarantee that they will be able to retain this anonymity throughout the proceedings. The Rules contain some proportionate limits on the anonymity provisions at Article 7, meaning that identity can be disclosed where it is necessary for the fair resolution of the dispute, for enforcement of any award or order, for the protection of the arbitrator’s own interests, or if required by any law or regulation or court order. It is difficult to see, for example, how anonymity could be sustained in any appeal to the English courts against an award, or any enforcement proceedings in the English courts.Managing technical evidenceThe arbitrator has discretion over the admissibility, relevance, materiality and weight of the evidence (Article 23). Given the expedited, documents-only nature of proceedings under the Rules, parties must present technical evidence in a clear and accessible manner so that it can be understood through their submissions and accompanying bundle of supporting documents, as there will be no disclosure phase to allow for further documentation to be introduced and no opportunity to clarify their case orally at a hearing.Expert evidence on technical issues is permitted at the claimant’s cost, but the Rules point out (in Appendix I) that this will not be required in every case. For example, where a dispute relates simply to the non-payment of a bug bounty, which the parties agree has been validly earned, it is likely that a claimant will decide not to go to the expense of paying for expert evidence. Where an arbitrator appoints an expert (or experts) in accordance with Article 25, such an expert is to remain impartial and independent, and there is no opportunity to cross-examine the expert. As the expert evidence cannot be tested by questioning the expert at an oral hearing and parties’ written comments on the expert report are limited to 2,500 words, parties and their lawyers need to ensure that any comments they raise on the technical evidence are tightly focused on the key technical issues in the case.On-chain versus off-chain enforcementAwards issued under the Rules can be enforced both off-chain and on-chain and parties should consider their enforcement strategies early in proceedings. For enforcement purposes, digital assets held on-platform are deemed to be located in London (Article 38).On-chain enforcement allows for direct execution against digital assets held in the Vault system. This means that, where a project offering a bug bounty has placed the bug bounty into the Vault, the award can be satisfied on-chain by payment of the bug bounty by Immunefi to a successful security researcher. This on-chain enforcement option is likely to be extremely attractive to successful security researcher claimants, because it means that awards can be enforced quickly, simply and without further cost, as there will be no need to engage in traditional enforcement processes to receive payment of the sum due under the award.Awards issued under the Rules can also be enforced in the traditional way, off-chain, under the New York Convention or under local laws in the jurisdiction where the assets are located. The Rules note that parties to the arbitration agreements that refer to these Rules have consented to both on-chain and off-chain enforcement, or a combination of both. Where a party has been able to achieve part-satisfaction of the award through on-chain enforcement, they retain the option of pursuing off-chain enforcement for the remaining balance. In some situations, for example where the losing party does not have assets held in the Vault, if the award remains unsatisfied, then the successful party will need to enforce the full amount off-chain in the standard way. Many arbitral awards delivered globally are of course satisfied without the need for enforcement proceedings.Considerations before choosing the RulesCompanies using the Immunefi system to engage the services of security researchers decide whether to sign up to the Rules at the time that they offer bug bounties on the site. Security researchers also make a decision on whether to use the Rules when they decide whether to submit a bug on a project that has signed up to the Rules and is displaying the LCAM arbitration badge.Before opting in to arbitration under the Rules, parties should assess the procedure’s suitability based on the type, size and complexity of the expected dispute. For parties contemplating disputes involving digital assets and web3 technology, this expedited procedure offers significant advantages where speed, anonymity, confidentiality, enforceability and cost-effectiveness are priorities. However, a documents-only procedure with strict page and word limits might not be appropriate in some high value matters involving complex factual issues and requiring voluminous evidence.Further, where expert evidence is required, there is no opportunity for oral cross-examination of an arbitrator-appointed expert in proceedings under the Rules, which may limit parties’ ability to test or challenge technical opinions effectively. The Rules seek to avoid party-appointed expert evidence and there is no specific provision for arbitrators to be experts in particular digital assets. Parties should assess the significance of these factors when contemplating highly technical disputes.In addition, while parties opting to arbitrate under the Rules can gain the benefit of the anonymity provisions where they do not want their identity to be disclosed, conversely parties facing an anonymous opponent in arbitration will suffer a loss of transparency. In arbitrations under the Rules, some parties will potentially reach the end of the proceedings without ever knowing the identity of the other side, which may not be acceptable to some parties.On the enforcement side, although the Rules facilitate both on-chain and off-chain enforcement, practical difficulties for parties may still arise. For example, off-chain enforcement depends on the ability and willingness of national courts to recognise and enforce arbitral awards issued under the Rules, which may vary depending on local law and judicial attitudes towards blockchain-based transactions and anonymous parties. As to on-chain enforcement, this is contingent on assets being held on-chain and may not be effective if counterparties have moved assets or if technical obstacles arise in executing the award.While these points should all be carefully considered, the advantages of a dispute resolution mechanism enforceable both on-chain and off-chain are likely to weigh heavily with many parties to bug bounty disputes. Enforceability is likely to be key to decision-making here, as enforcement has previously been challenging in disputes of this type, which typically arise in a complex jurisdictional nexus. For security researchers, there are also likely to be few other avenues to achieve binding dispute resolution while maintaining anonymity.