Bug bounty scope gap on highest-TVL contracts
PancakeSwap's assessment for RD-F-183 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Immunefi Group 1 (highest reward tier) covers AMM V2, V3, StableSwap, MasterChef V2/V3, Smart Chef, Cake Pool. Infinity (V4) core contracts (Vault, CLPoolManager, BinPoolManager) — launched April 2025, $1.73B TVL — are in Group 2 ('other contracts not mentioned in group 1'), receiving lower reward priority. Not fully out of scope, but the newest and most architecturally complex surface is in a lower-priority bounty tier. Yellow rather than red because Group 2 still provides coverage.
Sources #
- URL
Methodology #
Determine whether the highest-TVL contracts of this protocol (especially shared primitives: OFT adapters, ZK verifiers, bridge inbox) are explicitly excluded from the protocol's active bug bounty scope.
See the full factor methodology and distribution across all protocols →