Bug bounty scope gap on highest-TVL contracts
Meteora's assessment for RD-F-183 — scored red on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
No confirmed active Immunefi bug bounty program as of 2026-05-16. Immunefi's bug-bounty listing page (223 programs) does not list Meteora. Direct URL immunefi.com/bounty/meteora/ returns 404. Data-cache bug_bounty.platform: null, immunefi_slug: null. With no verified active bounty program, the highest-TVL contracts (DLMM at ~$320M) have no bug bounty coverage at all. SolanaCompass claims a $500K Immunefi program but this cannot be independently verified. A missing bug bounty at $320M TVL is a red finding for F183.
Sources #
- URLMeteora on SolanaCompassSolanaCompass - claims $500K Immunefi max payout (unverified secondary source)retrieved 2026-05-16
- Immunefi Bug Bounty Programs Listingimmunefi.com/bug-bounty/ - Meteora not listed among 223 programs on 2026-05-16retrieved 2026-05-16
- Meteora Data Cache and Profile Meta - Bug Bounty Fields00-data-cache.json bug_bounty.platform: null; 00-profile.meta.json immunefi_slug: nullretrieved 2026-05-16
Methodology #
Determine whether the highest-TVL contracts of this protocol (especially shared primitives: OFT adapters, ZK verifiers, bridge inbox) are explicitly excluded from the protocol's active bug bounty scope.
See the full factor methodology and distribution across all protocols →