Bug bounty scope gap on highest-TVL contracts

Evidence summary #

The bug bounty program is self-hosted and describes scope as 'any bug that would cause an outage or logical error on nodes or API servers.' The scope does NOT explicitly enumerate Bridge2 or any Solidity contract addresses as in-scope. The L1 binary is mentioned via 'nodes' reference. $3.26B of USDC lives in Bridge2 but the bounty scope is framed around L1 node/API behavior, creating ambiguity over whether Bridge2 smart contract bugs are explicitly in scope. No Immunefi page with contract addresses to confirm.

Sources #

Methodology #

Determine whether the highest-TVL contracts of this protocol (especially shared primitives: OFT adapters, ZK verifiers, bridge inbox) are explicitly excluded from the protocol's active bug bounty scope.

See the full factor methodology and distribution across all protocols →