Bug bounty presence & max payout

Liquity V1 + V2 (LUSD / BOLD)'s assessment for RD-F-007 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

v2/BOLD has active Cantina bounty (max 125,000 BOLD for critical, approx $125K at BOLD peg). v1 bounty discontinued after 4 years post-v2 launch (team judgment: immutable, battle-tested). Payout denominated in BOLD (not USD) introduces uncertainty; 125K BOLD is near the $100K-$500K yellow-green threshold; platform is Cantina not Immunefi.

Sources #

Docs
Liquity v1 Bug Bounty Documentationv1 bug bounty discontinued after 4 yearsretrieved 2026-05-16
URL
Liquity v2 Cantina Bug Bounty Programv2 Cantina bounty, max 125,000 BOLD for criticalretrieved 2026-05-16

Methodology #

Check whether a public bug bounty program is active for this protocol and record the maximum payout in USD.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol liquity factor RD-F-007 score yellow collected_at 2026-05-16 10:35:50