Bug bounty scope gap on highest-TVL contracts
Yearn Finance's assessment for RD-F-183 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Active Immunefi program with 41 in-scope assets confirmed. Named in-scope chains from Immunefi page: Ethereum, Arbitrum, Fantom, Optimism. Katana chain (chainID 747474, ~25.1% of TVL, ~$44.7M) is NOT explicitly listed as confirmed in-scope on the Immunefi page. V3 vaults on Katana represent the second-largest chain allocation. The scope gap ambiguity for the Katana deployment (25% of TVL) warrants yellow under F183 criteria (scope ambiguous or partially covers high-TVL contracts).
Sources #
- URLImmunefi Yearn Finance — 41 assets, Ethereum/Arbitrum/Fantom/Optimism scope; Katana not listedImmunefi Yearn Finance bounty — scope confirmationretrieved 2026-05-16
- Yearn V3 contracts — Katana (747474) Role Manager, Accountant listedYearn V3 Katana contractsretrieved 2026-05-16
Methodology #
Determine whether the highest-TVL contracts of this protocol (especially shared primitives: OFT adapters, ZK verifiers, bridge inbox) are explicitly excluded from the protocol's active bug bounty scope.
See the full factor methodology and distribution across all protocols →