Bug bounty scope gap on highest-TVL contracts

BlackRock USD Institutional Digital Liquidity Fund (BUIDL)'s assessment for RD-F-183 — scored gray on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

No active bug bounty program exists (see RD-F-007). Per methodology: gray = no bug bounty program exists. Factor checks whether highest-TVL contracts are in scope — moot if there is no program.

Sources #

URL
https://hackerone.com/blackrockretrieved 2026-04-26
URL
https://immunefi.comretrieved 2026-04-26

Methodology #

Determine whether the highest-TVL contracts of this protocol (especially shared primitives: OFT adapters, ZK verifiers, bridge inbox) are explicitly excluded from the protocol's active bug bounty scope.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol blackrock-buidl factor RD-F-183 score gray collected_at 2026-05-12 09:40:42