Disclosure SLA public
JustLend DAO's assessment for RD-F-176 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
No explicit acknowledgment-time SLA published by JustLend DAO. Immunefi listing shows 'Median 3 days' resolution time as a platform-level observed metric, not a formal commitment. No 'we acknowledge within X hours' SLA found on program page, in docs.justlend.org, or in GitHub repo. Immunefi embargo rule (no public disclosure of unpatched bugs) functions as an implicit disclosure window but a formal SLA is absent. Yellow: no public SLA, though disclosure channel exists.
Sources #
- URLJustLend DAO Bug Bounties — Program InformationJustLend DAO Immunefi program information page — no acknowledgment-time SLA text found; median 3 days is platform-observed metric not a JustLend commitmentretrieved 2026-05-17
Methodology #
Determine whether the protocol publishes an acknowledgment-time SLA for disclosed vulnerabilities (e.g., 72h ack).
See the full factor methodology and distribution across all protocols →