Most of the time, you wouldn't consider #2.
Those types of promises like the distribution of tokens are mostly handled by the devs.
Bounty managers are mostly the ones in charge of their participants weekly post counts/ shares in social media, as well as counting the stakes weekly.
It would be plus of a point for me if they're even validating each participant, in case someone claims to be another account just to get to the highest rank with higher stakes of course.

Success of the bounty isn't fully dependent on the success of the project.
There are some successful scams and tend to disappear in thin air, leaving bounty hunters complaining.