Bug bounty scope gap on highest-TVL contracts

Evidence summary #

Immunefi program has 74 assets in scope. Exclusions are specific known-and-resolved findings from prior audits (not contract address exclusions). Standard AMM v4 ($1B+ TVL), CLMM, and CPMM are all in active bounty scope. $1.7M paid; median 2-day resolution. No high-TVL contract found explicitly excluded from bounty.

Sources #

Methodology #

Determine whether the highest-TVL contracts of this protocol (especially shared primitives: OFT adapters, ZK verifiers, bridge inbox) are explicitly excluded from the protocol's active bug bounty scope.

See the full factor methodology and distribution across all protocols →