Bug bounty scope gap on highest-TVL contracts

Evidence summary #

Immunefi program has 17 assets in scope; program description covers lending but specific klend program address (KLend2g3cP87fffoy8q1mQqGKjrxjC8boSyAYavgmjD) inclusion not independently verified from scope tab.

Detail #

The Immunefi scope tab requires JavaScript rendering not accessible via WebFetch. The program description encompasses lending but the exact 17 in-scope addresses could not be enumerated. The program explicitly excludes pricing oracles and third-party smart contracts. Scored yellow (scope ambiguous for the specific address) rather than red (no evidence of explicit exclusion) or green (cannot confirm explicit inclusion).

Sources #

Methodology #

Determine whether the highest-TVL contracts of this protocol (especially shared primitives: OFT adapters, ZK verifiers, bridge inbox) are explicitly excluded from the protocol's active bug bounty scope.

See the full factor methodology and distribution across all protocols →