Bug bounty presence & max payout

Sanctum's assessment for RD-F-007 — scored red on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

No public bug bounty program exists for Sanctum (sanctum.so / igneous-labs) as of 2026-05-04. CertiK Skynet explicitly confirms 'No third-party bounty program.' Data cache confirms bug_bounty.platform null. SECURITY.md absent. $1.37B TVL with zero bounty coverage.

Sources #

URL
Immunefi Bug Bounty ProgramsImmunefi bug bounty search — no sanctum-so entry found; data cache bug_bounty nullretrieved 2026-05-04
URL
CertiK Skynet — SanctumCertiK Skynet — No third-party bounty programretrieved 2026-05-04
GitHub
sanctum-unstake-program repositorysanctum-unstake-program — SECURITY.md absent per data cacheretrieved 2026-05-04

Methodology #

Check whether a public bug bounty program is active for this protocol and record the maximum payout in USD.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol sanctum factor RD-F-007 score red collected_at 2026-05-04 18:49:23