Bug bounty scope gap on highest-TVL contracts

Compound V3 (Comet)'s assessment for RD-F-183 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

Immunefi program (Dec 2024) covers 254 assets; Primacy of Impact applies for critical findings meaning researchers can report any impactful vulnerability. No evidence of Kelp-DAO-style exclusion of major Comet contracts. cUSDCv3 (~$1.21B TVL) is in scope.

Sources #

URL
https://immunefi.com/bug-bounty/compoundfinance/retrieved 2026-04-28
URL
https://immunefi.com/bug-bounty/compoundfinance/scope/retrieved 2026-04-28

Methodology #

Determine whether the highest-TVL contracts of this protocol (especially shared primitives: OFT adapters, ZK verifiers, bridge inbox) are explicitly excluded from the protocol's active bug bounty scope.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol compound-v3 factor RD-F-183 score green collected_at 2026-04-28 00:20:50