Disclosure channel exists

Orca's assessment for RD-F-175 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

Immunefi program is active (immunefi.com/bug-bounty/orca, live since 2022-05-19, last updated 2026-01-08). SECURITY.md in repo routes researchers directly to Immunefi. Program funded by passed governance vote (1M ORCA allocation). The 2026-01-08 last-update timestamp confirms active maintenance. Green threshold: public disclosure channel exists and is actively monitored.

Sources #

URL
Orca SECURITY.md — Immunefi-only disclosure, no credential leak indicatorshttps://github.com/orca-so/whirlpools/blob/main/SECURITY.mdretrieved 2026-05-16
Governance
Orca Bug Bounty Governance Proposal (1M ORCA approved 2022-05-28)https://forums.orca.so/t/bug-bounty-program/36retrieved 2026-05-16
URL
Orca Immunefi Bug Bounty Programhttps://immunefi.com/bug-bounty/orca/retrieved 2026-05-16

Methodology #

Determine whether the protocol publishes a public security disclosure channel (security@ email, Immunefi program, in-house disclosure page).

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol orca factor RD-F-175 score green collected_at 2026-05-16 02:39:16