Bug bounty scope gap on highest-TVL contracts

Pendle Finance's assessment for RD-F-183 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

Immunefi program confirmed ($250K max). Scope page returned 404 — cannot confirm explicit inclusion/exclusion of highest-TVL contracts (Router 0x888..., Market contracts). Cantina bounty also active. Scope likely covers core but per-market SY wrappers and factory versions V3-V6 scope ambiguous. Yellow due to inability to confirm full-scope coverage of all high-TVL contract addresses.

Sources #

URL
https://immunefi.com/bug-bounty/pendle/scope/retrieved 2026-05-06
URL
Pendle Finance / Pendle Bounty — CantinaCantina Pendle bountyretrieved 2026-04-29

Methodology #

Determine whether the highest-TVL contracts of this protocol (especially shared primitives: OFT adapters, ZK verifiers, bridge inbox) are explicitly excluded from the protocol's active bug bounty scope.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol pendle factor RD-F-183 score yellow collected_at 2026-04-28 21:09:40