Bug bounty scope gap on highest-TVL contracts
mETH Protocol's assessment for RD-F-183 — scored red on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
The cmETH BoringVault (0x33272D40b247c4cd9C646582C9bbAD44e85D4fE4) and L1cmETHAdapter (LayerZero OFT, 0x4aFA9620D0B79137383A7A9AB3477837d475e948, holding ~$70.6M in cmETH) are NOT in scope of the Immunefi bug bounty. The 10 in-scope contracts cover only the core mETH staking surface. LiquidityBuffer and PositionManagerAAVE are also not listed in scope despite managing material ETH from the $535M staking TVL. Whitehats have no economic incentive to disclose bugs affecting cmETH restaking or cross-chain bridge contracts. This is analogous to the Kelp DAO precedent where the OFT adapter was excluded from bounty scope.
Sources #
- URLmETH Protocol Immunefi Bug Bounty InformationImmunefi mantlelsp information page confirming $500K max, 10 assets in scoperetrieved 2026-05-16
- mETH Protocol Immunefi Bug Bounty Scope — 10 in-scope contracts (cmETH absent)Immunefi mantlelsp scope: 10 contracts listed — cmETH BoringVault (0x33272D40) and L1cmETHAdapter (0x4aFA9620) absentretrieved 2026-05-16
Methodology #
Determine whether the highest-TVL contracts of this protocol (especially shared primitives: OFT adapters, ZK verifiers, bridge inbox) are explicitly excluded from the protocol's active bug bounty scope.
See the full factor methodology and distribution across all protocols →