Bug bounty presence & max payout

Orca's assessment for RD-F-007 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

Active Immunefi program at immunefi.com/bug-bounty/orca, $500k maximum critical payout (minimum $100k for critical). Program live since 2022-05-19, last updated 2026-01-08. Whirlpools program is explicitly in scope. Funded by community governance vote (1M ORCA passed 2022-05-28). Meets green threshold (active program with max payout >=500k USD).

Sources #

Governance
Orca Bug Bounty Governance Proposal (1M ORCA approved 2022-05-28)https://forums.orca.so/t/bug-bounty-program/36retrieved 2026-05-16
URL
Orca Immunefi Bug Bounty Programhttps://immunefi.com/bug-bounty/orca/retrieved 2026-05-16

Methodology #

Check whether a public bug bounty program is active for this protocol and record the maximum payout in USD.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol orca factor RD-F-007 score green collected_at 2026-05-16 02:39:16