Bug bounty presence & max payout

Wormhole's assessment for RD-F-007 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

Immunefi program active at immunefi.com/bug-bounty/wormhole/. Maximum payout: $1,000,000 for Tier 1 (extract TVL across all chains). Payout structure is tiered ($1M/$500K/$250K). Historical $10M payout confirmed (2022 uninitialized proxy Immunefi disclosure). Scope explicitly includes Portal Token Bridge, EVM chains, Solana, Aptos, Sui, Near, CosmWasm, Algorand, Guardian Nodes. Bounty was active and responsive — $10M payout is the largest single bridge bounty in DeFi history, demonstrating re...

Sources #

Curator note
Extracted from 01-code-security.md — RD-F-007 finding; no URL cited in originalretrieved 2026-04-28

Methodology #

Check whether a public bug bounty program is active for this protocol and record the maximum payout in USD.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol wormhole factor RD-F-007 score green collected_at 2026-04-28 01:38:43