Bug bounty scope gap on highest-TVL contracts

M^0's assessment for RD-F-183 — scored red on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

No active public bug bounty program identified for M^0. Immunefi: no listing. Cantina: no listing. docs.m0.org: no mention. No security@ email. At $325.5M TVS, the core MToken and MinterGateway contracts (majority of TVS) have zero public bounty coverage. KAST on Immunefi is an ecosystem extension (solana-m-extensions), not M^0 core. Structural scope gap at this TVL tier.

Sources #

URL
M^0 Technical AuditsM0 docs — no bounty mentionretrieved 2026-05-16
URL
Immunefi Bug Bounty ProgramsImmunefi search — no M0 core listingretrieved 2026-05-16
URL
Cantina BountiesCantina bounties — no M0 listingretrieved 2026-05-16

Methodology #

Determine whether the highest-TVL contracts of this protocol (especially shared primitives: OFT adapters, ZK verifiers, bridge inbox) are explicitly excluded from the protocol's active bug bounty scope.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol m0 factor RD-F-183 score red collected_at 2026-05-16 09:46:19