Ignored bounty disclosure

Methodology how we score #

What this measures
This factor captures post-mortem evidence that a disclosed vulnerability was reported to the protocol team -- whether through the bug bounty channel, a security researcher DM, an audit finding, or a public forum post -- and was not actioned before an exploit occurred. The data source is post-mortem text, audit reports, and OSINT. This factor is episodic: it fires when evidence emerges rather than on a continuous schedule.

Why it matters
A disclosed but unactioned vulnerability is strictly worse than an undiscovered one: the team has been informed, the risk window is open, and the protocol continues to accept user funds without mitigating the known risk. Elephant Money ($22.2M, 2022) is the sharpest example in the dataset: Solidity Finance's audit specifically identified the flash-loan price manipulation vulnerability but failed to adequately communicate its severity to the team; the attack vector remained open and was exploited. The ignored disclosure pattern is also documented in Atomic Wallet (Least Authority findings from 2021 went unaddressed until the 2023 exploit) and MonoX (two independent auditors missed the self-swap bug). Audit quality and bounty programs are both undermined when disclosure-to-action pipelines break down.

Green / Yellow / Red
Green: no evidence of unactioned disclosures in the protocol's public history; all known prior disclosures have documented on-chain or commit-level resolutions. Yellow: a disclosure exists in the record but the team actioned it within a reasonable window (under 30 days) and has post-mortem documentation of the fix. Red: post-mortem or public record shows a disclosed vulnerability was reported to the team and remained unaddressed for more than 30 days, or was dismissed without a documented rationale.

Common gray cases
This factor is gray by default for most protocols because ignored disclosures are only surfaced by post-mortems; curators cannot assess what has not been publicly documented.

Notable historical examples
- Elephant Money ($22.2M, 2022): Audit firm identified the flash-loan manipulation vector; the finding was not adequately communicated to or acted upon by the team.
- Euler Finance ($197M, 2023): Bug survived a Sherlock review; Sherlock paid a $4.5M insurance claim acknowledging the miss -- the closest analog to an ignored-disclosure outcome.
- Atomic Wallet ($100M est., 2023): Least Authority findings from 2021 were not addressed in the two years before the exploit.
- MonoX ($31.4M, 2021): Self-swap token pricing bug survived two independent audits by Halborn and PeckShield.
- KyberSwap Elastic ($48M, 2023): Precision failure survived two independent reviews by ChainSecurity and Sherlock.

Measurement what to look for #

Determine whether any prior post-mortem documents a disclosed vulnerability that was reported to the team and not actioned before exploit.

Data & output #

Scored protocols 0 carry this factor #

Linked hacks 31 historical incidents #