Disclosure SLA public

Evidence summary #

72-hour acknowledgement SLA is publicly stated per centrifuge.io/security. However: (a) Cantina bounty program does not state a specific Centrifuge SLA — it says researchers should report within 24 hours which is a researcher SLA, not a team-response SLA; (b) no evidence found of SLA being honored or tested in a documented public case; (c) legacy bounty SLA ($50K DAI max) is not aligned with current Cantina $250K program.

Sources #

Methodology #

Determine whether the protocol publishes an acknowledgment-time SLA for disclosed vulnerabilities (e.g., 72h ack).

See the full factor methodology and distribution across all protocols →