When a user with at least 200 rep on any Stack Exchange site registers a new account on another SE site, they immediately receive 100 rep on that site as an association bonus. This is a deliberate feature to give users who are already familiar with how the SE platform and community works a bit of an extra boost (e.g. letting them upvote and comment immediately), and it's pretty much working as intended.
What's probably not intended is that, currently, this bonus rep can be given away as bounties.
In fact, because awarding bounties currently requires only 75 rep, any user with 200+ rep on at least one site can join another site, receive the 100 rep bonus, and immediately award it all as a bounty to another user, without having to earn any actual rep on the site at all. Not only does this seem contrary to the design intent of bounties (and of the association bonus), but it also seems ripe for potential abuse.
(In fact, the only thing stopping a sockpuppet ring from gaining unlimited rep this way is the fact that the bounties would likely be sooner or later noticed by mods.)
It's also possible for experienced users to (more or less) accidentally bounty their reputation so low that that they lose access to basic site features that they'd normally have due to the bonus. Arguably, of course, this is entirely the user's own fault, but it can still be annoying. Also, this behavior interacts poorly with protected questions, which currently require 110 rep to answer for users with the association bonus.
The fix I'd like to suggest is simple:
If a user has been awarded the association bonus, don't let them award a bounty that would take their rep below 100.
Of course, it would still be possible for users with the bonus to drop below 100 rep via other means, e.g. by having their posts downvoted. But they wouldn't be able to just give away this baseline rep to other users any more.