> An amount of CHF 150'000.- is available for compensations.

Seems to me like this is the wrong approach. Essentially, they’re saying they they have no idea how much they can pay per bug.

A sensible approach would be to insure bug bounties, at least up to the amount that a black hat could profit from compromising the system.