Bug bounty scope gap on highest-TVL contracts
Jupiter's assessment for RD-F-183 — scored red on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Active bug bounty program exists on ooosec.com/programs/jupiter. Maximum payout is $20,000 — 0.001% of $1.717B TVL. The highest-TVL contracts (Jupiter Aggregator v6 JUP6LkbZbjS1jKKwapdHNy74zcZ3tLUZoi5QNyVTaV4, Jupiter Perps PERPHjGBqRHArX4DySjwM6UJHiR3sWAatqfdBS2qQJu) are the core programs under this TVL. Even if technically in-scope, the $20K cap effectively operates as a scope gap — a sophisticated attacker could earn far more exploiting a vulnerability than a researcher could earn disclosing it. This is the exact pattern RD-F-183 measures: bounty scope gap removes economic incentive for whitehat disclosure on the highest-TVL surface.
Sources #
- URL
- Jupiter Aggregator v6 — SolscanJupiter Aggregator v6 program — $1.717B TVL primary contractretrieved 2026-04-29
- Jupiter Bug Bounty — OOOsecJupiter bug bounty — $20K max, $35,300 total paid, very active, launched ~1 month agoretrieved 2026-04-29
Methodology #
Determine whether the highest-TVL contracts of this protocol (especially shared primitives: OFT adapters, ZK verifiers, bridge inbox) are explicitly excluded from the protocol's active bug bounty scope.
See the full factor methodology and distribution across all protocols →