Bug bounty scope gap on highest-TVL contracts

Maple Finance's assessment for RD-F-183 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

Immunefi program covers 43 assets (updated Apr 21, 2026); Maple's primary high-TVL pool contracts appear in scope. The SyrupOftAdapter (LayerZero, 0x688AEe) and CCIP Receiver in-scope status cannot be confirmed from the Immunefi summary page alone. No explicit exclusion found but also no confirmation.

Sources #

Curator note
SyrupOftAdapter (0x688AEe022AA544f150678B8E5720b6b96a9E9a2F) in-scope status not confirmed from public Immunefi pageretrieved 2026-04-27
URL
https://immunefi.com/bug-bounty/maple/retrieved 2026-04-27

Methodology #

Determine whether the highest-TVL contracts of this protocol (especially shared primitives: OFT adapters, ZK verifiers, bridge inbox) are explicitly excluded from the protocol's active bug bounty scope.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol maple-finance factor RD-F-183 score yellow collected_at 2026-04-27 05:38:08