Bug bounty presence & max payout

Usual (USD0 / bUSD0 / USUAL)'s assessment for RD-F-007 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

Sherlock bug bounty #56: $16M max payout USDC, live since April 8, 2025 — one of the largest bug bounty programs in DeFi history. Additionally, tech.usual.money/security-and-audits/bug-bounty lists direct disclosure channel (security@usual.company) with severity matrix. Two-channel program.

Sources #

URL
The Block — Usual $16M bug bountyThe Block — Usual/Sherlock $16M bounty announcementretrieved 2026-05-17
URL
Sherlock Bug Bounty #56 — UsualSherlock bug bounty #56 — $16M max payoutretrieved 2026-05-17
URL
Bug Bounty | Usual Tech DocsUsual tech docs — bug bounty pageretrieved 2026-05-17

Methodology #

Check whether a public bug bounty program is active for this protocol and record the maximum payout in USD.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol usual factor RD-F-007 score green collected_at 2026-05-16 20:39:44