Bug bounty presence & max payout

Balancer (v2 + v3)'s assessment for RD-F-007 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

Active Immunefi program with $1,000,000 maximum payout (10% of funds at risk, capped at $1M). Program confirmed live as of 2026-04-27 (last update date per Immunefi). 38 assets in scope. v3 contracts added via BIP-758. Concern: BIP-687 proposed transitioning bounty management to DAO under Labs wind-down; responsible party uncertainty exists but program appears operationally active at assessment date.

Sources #

URL
Balancer Immunefi Bug Bounty ($1M max, 38 assets, last updated 2026-04-27)https://immunefi.com/bug-bounty/balancer/retrieved 2026-05-05
Governance
BIP-687: Bug bounty management transition to DAOhttps://forum.balancer.fi/t/bip-687-transition-of-bug-bounty-program-responsibility-to-balancer-dao/5847/8retrieved 2026-05-05
Governance
BIP-758: Update Bug Bounty Program scope for v3 assetshttps://forum.balancer.fi/t/bip-758-update-bug-bounty-program-scope-for-v3-assets/6295retrieved 2026-05-05

Methodology #

Check whether a public bug bounty program is active for this protocol and record the maximum payout in USD.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol balancer factor RD-F-007 score green collected_at 2026-05-05 12:41:36