Bug bounty scope gap on highest-TVL contracts

Aave v3's assessment for RD-F-183 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

Immunefi program covers core Aave v3 contracts with $1M max payout and 83 in-scope assets per T-10. The rsETH OFT adapter exploited in April 2026 was a Kelp DAO contract, not an Aave core contract. No evidence that Aave's highest-TVL contracts (Pool, PoolAddressesProvider, etc.) are excluded from bounty scope.

Sources #

Governance
rsETH Incident Report April 2026rsETH incident report confirming exploited contract was Kelp OFT, not Aave coreretrieved 2026-04-27
URL
Aave Immunefi Bug BountyImmunefi Aave bug bounty — scope and assetsretrieved 2026-04-27

Methodology #

Determine whether the highest-TVL contracts of this protocol (especially shared primitives: OFT adapters, ZK verifiers, bridge inbox) are explicitly excluded from the protocol's active bug bounty scope.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol aave-v3 factor RD-F-183 score green collected_at 2026-04-27 23:28:46