Bug bounty scope gap on highest-TVL contracts
A code & audits factor in the v1.7.0 rubric. Measured per protocol on a s cadence.
Methodology how we score #
**What this measures** This factor identifies whether the protocol's highest-TVL contracts -- particularly shared-primitive contracts such as LayerZero OFT adapters, ZK verifiers, or bridge inbox contracts -- are explicitly excluded from the scope of the protocol's bug bounty program, while other (lower-TVL) contracts remain in scope. The assessment cross-references the Immunefi scope definition and protocol bounty documentation against the contract addresses that collectively hold the majority of user funds.
**Why it matters** A bug bounty program that excludes the contracts holding the most value provides economic incentive for researchers to disclose only the low-value vulnerabilities, while the highest-risk surfaces remain economically unprotected from exploit. Kelp DAO's April 2026 exploit ($292M) is the clearest documented case: the protocol ran an active Immunefi program for its core rsETH contracts, but the LayerZero OFT adapter -- the contract through which the exploiter minted unbacked tokens -- was explicitly excluded from bounty scope despite holding over $1B in bridged value. A whitehat who discovered the 1/1 DVN misconfiguration had no economic incentive to disclose it through the bounty channel because the scope exclusion made the report ineligible for payout.
**Green / Yellow / Red** Green: the protocol's bug bounty scope explicitly includes all contracts that collectively hold more than 80% of TVL, including any bridge adapters, OFT contracts, or shared primitives. Yellow: the bounty scope includes primary lending or swap contracts but excludes some integration contracts (bridges, keepers) where the excluded contracts hold less than 20% of TVL. Red: any contract that individually holds more than $10M in TVL or more than 20% of protocol TVL is explicitly excluded from the bounty scope.
**Common gray cases** This factor is gray when the protocol does not have a bounty program at all (captured separately by RD-F-007), or when the bounty scope documentation is ambiguous and curator review cannot determine inclusion or exclusion of specific contracts.
**Notable historical examples** The Kelp DAO case (April 2026, $292M) is the primary motivating incident.
Measurement what to look for #
Determine whether the highest-TVL contracts of this protocol (especially shared primitives: OFT adapters, ZK verifiers, bridge inbox) are explicitly excluded from the protocol's active bug bounty scope.