Bug bounty scope gap on highest-TVL contracts
OpenEden's assessment for RD-F-183 — scored red on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
No bug bounty program exists on any platform (Immunefi null, Sherlock absent, Cantina absent, HackenProof 403, SECURITY.md absent). With zero bounty program, the highest-TVL contracts — TBILL V5 vault proxy (0xdd50C053, ~$84M TVL on Ethereum) and USDO token (0x8238884E) — are definitionally out of scope of any bounty. The absence of any program removes all economic incentive for whitehat disclosure on the most consequential EVM contracts.
Sources #
- DocsOpenEden Official Documentationdocs.openeden.com — no bug bounty or security disclosure page foundretrieved 2026-05-16
- OpenEden Vault Audit Repo — GitHubOpenEden vault.audit repo — SECURITY.md absent (cache security_md_present: false)retrieved 2026-05-16
Methodology #
Determine whether the highest-TVL contracts of this protocol (especially shared primitives: OFT adapters, ZK verifiers, bridge inbox) are explicitly excluded from the protocol's active bug bounty scope.
See the full factor methodology and distribution across all protocols →