Disclosure SLA public

Compound V3 (Comet)'s assessment for RD-F-176 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

No explicit acknowledgment-time SLA (e.g., 72h) published on Immunefi program, compound-security-policies repo, or docs.compound.finance. Immunefi Category 3 implies coordinated disclosure window but no specific acknowledgment time stated.

Sources #

URL
https://github.com/OpenZeppelin/compound-security-policiesretrieved 2026-04-27
URL
https://immunefi.com/bug-bounty/compoundfinance/retrieved 2026-04-27

Methodology #

Determine whether the protocol publishes an acknowledgment-time SLA for disclosed vulnerabilities (e.g., 72h ack).

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol compound-v3 factor RD-F-176 score yellow collected_at 2026-04-28 00:20:50