I think the solution might be to only give awards to vulnerabilities with a working poc.