Bug bounty scope gap on highest-TVL contracts

Curve Finance's assessment for RD-F-183 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

Curve runs a self-managed bug bounty (max $250K, no Immunefi listing). The program scope is not publicly machine-readable (curve.finance/bugbounty returns 403). It is not independently verifiable whether all highest-TVL contracts are explicitly in-scope. The May 2024 $250K Marco Croc payout demonstrates the program is active. Self-managed nature means scope gaps are not auditable in the way Immunefi programs are. Data cache shows bug_bounty.platform: null confirming no Immunefi integration.

Sources #

URL
Curve Finance Rewards Dev $250K — CryptoTimesMarco Croc $250K payout — confirms bounty program activeretrieved 2026-04-28
Docs
Curve Finance Bug Bounty ProgramCurve bug bounty page (403 on direct fetch)retrieved 2026-04-28

Methodology #

Determine whether the highest-TVL contracts of this protocol (especially shared primitives: OFT adapters, ZK verifiers, bridge inbox) are explicitly excluded from the protocol's active bug bounty scope.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol curve-v2 factor RD-F-183 score yellow collected_at 2026-04-28 19:48:40