Bug bounty scope gap on highest-TVL contracts

Evidence summary #

Immunefi Ondo Finance: $1M max, 88 assets in scope. Full in-scope contract list not confirmed from public page. OUSG proxy (~$2B TVL) explicit in-scope status unverified. Yellow — large program but highest-TVL contract coverage not independently confirmed.

Sources #

Methodology #

Determine whether the highest-TVL contracts of this protocol (especially shared primitives: OFT adapters, ZK verifiers, bridge inbox) are explicitly excluded from the protocol's active bug bounty scope.

See the full factor methodology and distribution across all protocols →