Bug bounty presence & max payout

StakeWise v3's assessment for RD-F-007 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

Active Immunefi program with $200K maximum payout for critical smart-contract bugs. Program active since May 2022, last updated March 10 2026. Payout threshold meets yellow (≥$50K). However, scope covers only v2 contracts (see F183) — the v3 contracts holding ~$795M TVL are absent from scope, which limits the effective whitehath incentive for the highest-TVL surface. Scored yellow for payout adequacy despite scope gap (F183 captures the scope gap separately).

Sources #

URL
StakeWise Immunefi Bug Bounty ProgramImmunefi program page confirming $200K max payout, live since May 2022, last updated March 10 2026retrieved 2026-05-16
URL
StakeWise Immunefi Bug Bounty ScopeImmunefi scope page confirming 12 in-scope contracts (all v2)retrieved 2026-05-16

Methodology #

Check whether a public bug bounty program is active for this protocol and record the maximum payout in USD.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol stakewise factor RD-F-007 score yellow collected_at 2026-05-16 01:03:28