Bug bounty scope gap on highest-TVL contracts
Orca's assessment for RD-F-183 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Active Immunefi program with $500k max payout. The program explicitly covers Whirlpools — described on the Immunefi page as 'Orca has created custom smart contracts for its concentrated liquidity product, Whirlpools.' The Whirlpools program (whirLbMiicVdio4qvUfM5KAg6Ct8VwpYzGff3uctyCc) is the primary TVL-bearing component at $254M TVL; it is in scope per program description. Three total assets in scope. No indication the core program is excluded. SECURITY.md in the repo directs all researchers to the Immunefi program.
Sources #
- URLOrca SECURITY.md — Immunefi-only disclosure, no credential leak indicatorshttps://github.com/orca-so/whirlpools/blob/main/SECURITY.mdretrieved 2026-05-16
Methodology #
Determine whether the highest-TVL contracts of this protocol (especially shared primitives: OFT adapters, ZK verifiers, bridge inbox) are explicitly excluded from the protocol's active bug bounty scope.
See the full factor methodology and distribution across all protocols →