Bug bounty scope gap on highest-TVL contracts
Chainlink CCIP's assessment for RD-F-183 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Immunefi scope page explicitly lists CCIP-related assets: CCIP OCR Execute Plugin, CCIP OCR Commit Plugin, CCIP EVM, CCIP Solana — all added August 2025. $3M max payout. Scope uses categorical asset names not individual contract addresses. Cannot confirm whether all highest-TVL contracts (e.g., specific token pools holding cbBTC/cbETH) are explicitly in scope vs. covered categorically by CCIP EVM. Yellow: bounty covers CCIP categorically at high payout but per-contract verification unavailable.
Sources #
- URLChainlink Bug Bounty Scope | Immunefi — CCIP OCR Execute/Commit Plugin, CCIP EVM, CCIP Solana in scopeImmunefi Chainlink scope page — CCIP assets listedretrieved 2026-05-16
- Chainlink Bug Bounty Program | ImmunefiImmunefi Chainlink program overview — $3M max, updated 2026-05-05retrieved 2026-05-16
Methodology #
Determine whether the highest-TVL contracts of this protocol (especially shared primitives: OFT adapters, ZK verifiers, bridge inbox) are explicitly excluded from the protocol's active bug bounty scope.
See the full factor methodology and distribution across all protocols →