Bug bounty scope gap on highest-TVL contracts
JustLend DAO's assessment for RD-F-183 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Immunefi covers 55 assets. All vulnerabilities in CertiK review excluded from bounty eligibility (known-issue carve-out). Max payout $50K is very low relative to $3.6B TVL — the economic incentive for whitehat disclosure of a major vulnerability is essentially zero. EnergyRental contract scope status not confirmed. Scope appears comprehensive for named contracts but the $50K cap creates a de facto bounty scope gap for high-impact findings.
Sources #
- URLJustLend DAO Immunefi Bug Bounty — payout cap and exclusionsImmunefi: max payout $50K; CertiK findings excluded from bounty; 55 in-scope assetsretrieved 2026-05-17
- JustLend DAO Immunefi Scope — 55 assetsImmunefi scope page — 55 TRON-based assets in scoperetrieved 2026-05-17
Methodology #
Determine whether the highest-TVL contracts of this protocol (especially shared primitives: OFT adapters, ZK verifiers, bridge inbox) are explicitly excluded from the protocol's active bug bounty scope.
See the full factor methodology and distribution across all protocols →