Bug bounty scope gap on highest-TVL contracts
EigenLayer's assessment for RD-F-183 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Immunefi program page (404) and docs page (403) inaccessible as of 2026-04-28 — live scope cannot be verified. August 2025 EigenPods Immunefi disclosure was handled effectively, confirming core TVL-bearing EigenPod contracts are in scope. No evidence of scope exclusion on highest-TVL contracts (StrategyManager, DelegationManager, EigenPodManager). However, the $8.89B TVL vs $2M max bounty ceiling (confirmed 2023) creates a significant economic mismatch — the bounty cap is 0.02% of TVL, well below the 1% standard for large protocols. Scored yellow for the bounty cap-to-TVL mismatch and inability to verify current live scope.
Sources #
- GovernanceEigenPods Bug Fix — Immunefi disclosure confirms program scopeEigenPods bug fix Aug 29 2025 — Immunefi disclosure handled, confirms program active and EigenPod in scoperetrieved 2026-04-28
- EigenLayer Stage 1 Mainnet Launch — bug bounty mentionEigenLayer Stage 1 launch blog — $2M bug bounty via Immunefiretrieved 2026-04-28
Methodology #
Determine whether the highest-TVL contracts of this protocol (especially shared primitives: OFT adapters, ZK verifiers, bridge inbox) are explicitly excluded from the protocol's active bug bounty scope.
See the full factor methodology and distribution across all protocols →