Bug bounty scope gap on highest-TVL contracts

Babylon Protocol's assessment for RD-F-183 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

Immunefi program explicitly excludes 'centralization risks' and 'covenant committee compromise scenarios' from scope. The covenant committee (6-of-9 federated multisig) co-signs all BTC unbonding transactions and is the primary security primitive protecting $4.16B in staked BTC. Its explicit exclusion from bug bounty scope creates a meaningful protection gap for the protocol's highest-value surface. cosmos-bsn-contracts not clearly enumerated as in-scope assets.

Sources #

URL
Babylon Labs Bug Bounties | Immunefi — scope exclusionsImmunefi scope page (covenant committee exclusion)retrieved 2026-05-04

Methodology #

Determine whether the highest-TVL contracts of this protocol (especially shared primitives: OFT adapters, ZK verifiers, bridge inbox) are explicitly excluded from the protocol's active bug bounty scope.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol babylon-protocol factor RD-F-183 score yellow collected_at 2026-05-04 19:43:27