Bug bounty scope gap on highest-TVL contracts
QuickSwap's assessment for RD-F-183 — scored red on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
No active Immunefi program (cache immunefi_slug: null; Immunefi search returned no QuickSwap listing). The V3 $100K bounty (Sep 2022, Google Forms) was time-limited ('until V3 mainnet launch') and team-discretion payout — now expired. At $451M TVL in May 2026, the highest-TVL contracts (Algebra V1 pool instances on Polygon holding ~95% of TVL) have no currently active formal bug bounty program with defined scope. DeFiSafety references an informal '$50K static bug bounty' but no live program confirmed. This is a material F183 scope gap — the highest-TVL contracts are not covered by any active formal bounty program.
Sources #
- Docs
- $100K V3 Bug Bounty — QuickSwap MediumV3 $100K bounty — time-limited beta program, expired at mainnet launchretrieved 2026-05-16
Methodology #
Determine whether the highest-TVL contracts of this protocol (especially shared primitives: OFT adapters, ZK verifiers, bridge inbox) are explicitly excluded from the protocol's active bug bounty scope.
See the full factor methodology and distribution across all protocols →