Bug bounty scope gap on highest-TVL contracts
Rocket Pool's assessment for RD-F-183 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Immunefi program active with 77 assets, last updated March 31, 2026 (post-Saturn One Feb 18, 2026 launch — consistent with Saturn assets added post-launch). Discord summary Feb 16, 2026 confirms transition of bug bounty to Saturn assets was in progress. Indirect inference that Saturn megapool contracts were added to scope by March 31, 2026; no confirmed in-scope contract address list available to verify explicitly.
Sources #
- URLRocket Pool Bug Bounty | ImmunefiImmunefi bug bounty page — 77 assets, last updated 2026-03-31retrieved 2026-05-04
- Bug Bounty Program UpdateBug bounty update governance post — Saturn transition mentionedretrieved 2026-05-04
Methodology #
Determine whether the highest-TVL contracts of this protocol (especially shared primitives: OFT adapters, ZK verifiers, bridge inbox) are explicitly excluded from the protocol's active bug bounty scope.
See the full factor methodology and distribution across all protocols →