ICOs are mostly in a less than grey legal area, so there is nothing surprising there. Nevertheless, it may well be an impersonator/scammer who may lure you in, using the bounty program as a pretext, and you eventually end-up providing information which you will later regret.