Ignored bounty disclosure

Evidence summary #

The 2021 Lottery V2 vulnerability was disclosed via Immunefi and patched before exploitation — this was a successful bounty catch, not an ignored disclosure. The 2025 BCE/USDT exploit was a third-party token interaction issue (fee-on-transfer token design flaw), not a disclosure that was ignored by the team. No post-mortem documents an ignored pre-exploit disclosure on core AMM.

Sources #

Methodology #

Determine whether any prior post-mortem documents a disclosed vulnerability that was reported to the team and not actioned before exploit.

See the full factor methodology and distribution across all protocols →