Bug bounty scope gap on highest-TVL contracts
Beefy Finance's assessment for RD-F-183 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Immunefi program active with 244 assets in scope. Docs state Beefy 'generally honours the bounty in respect of live operational products' — non-binding language. Scope page accessible content showed only a sample of 12 polygon contracts; BeefyVaultV7 or BeefyVaultV7Factory not explicitly confirmed in/out-of-scope from accessible page content. Max payout $75K is below peer-protocol norms ($150K-$250K) for comparable TVL. Score: yellow — scope appears broad but implicit, payout cap low.
Sources #
- DocsBeefy Bug Bounty Program Docsdocs.beefy.finance/safety/bug-bounty-program — 'generally honour the bounty in respect of live operational products'retrieved 2026-05-16
- Immunefi Beefy Finance ScopeImmunefi Beefy Finance scope page — 244 assets, sample of 12 polygon contracts visibleretrieved 2026-05-16
Methodology #
Determine whether the highest-TVL contracts of this protocol (especially shared primitives: OFT adapters, ZK verifiers, bridge inbox) are explicitly excluded from the protocol's active bug bounty scope.
See the full factor methodology and distribution across all protocols →