Bug bounty scope gap on highest-TVL contracts
Jito's assessment for RD-F-183 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Immunefi Jito bounty (8 assets in scope) explicitly covers the 'Interceptor (SPL Stake Pool LST program)' — the primary $877M TVS surface. StakeNet Steward, Validator History, Restaking, Vault, Tip Payment/Distribution, Jito-Solana validator client are all in scope. The upstream canonical SPL Stake Pool program itself has Solana Foundation security coverage. No highest-TVL contract identified as out of scope.
Sources #
- URLJito Immunefi Bug Bounty ScopeImmunefi Jito bounty information: 8 assets including Interceptor (SPL Stake Pool LST program)retrieved 2026-04-29
- Jito Bounty Launch BlogImmunefi Jito bounty launch blog: StakeNet programs referenced in scoperetrieved 2026-04-29
Methodology #
Determine whether the highest-TVL contracts of this protocol (especially shared primitives: OFT adapters, ZK verifiers, bridge inbox) are explicitly excluded from the protocol's active bug bounty scope.
See the full factor methodology and distribution across all protocols →