# Immunefi bounty: Intercom setup issue

**URL:** <https://research.lido.fi/t/immunefi-bounty-intercom-setup-issue/906>\
**Category:** General\
**Created:** [August 12, 2021, 8:50pm UTC](https://research.lido.fi/t/immunefi-bounty-intercom-setup-issue/906 "2021-08-12T20:50:08Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![kadmil](https://dub1.discourse-cdn.com/flex013/user_avatar/research.lido.fi/kadmil/32/1958_2.png) [@kadmil](https://research.lido.fi/u/kadmil)\
**Post date:** [August 12, 2021, 8:50pm UTC](https://research.lido.fi/t/immunefi-bounty-intercom-setup-issue/906/1 "2021-08-12T20:50:08Z")

</div>

We’ve received new vulnerability disclosure under the Lido Immunefi bug bounty program. Due to the insecure default Intercom setup on [help.lido.fi](http://help.lido.fi) website, it was possible to read & write the chat with any user without authorization. The vulnerability is mitigated already. To the best of our knowledge the issue had no real impact — the comms team uses [help.lido.fi](http://help.lido.fi) as a support materials / FAQ store, and user communication is happening through other channels (telegram, discord & twitter mostly).

The vulnerability is of high severity in Immunefi terms with the bounty of $7500. It’s a Boulder in LEGO’s terms, so the council have had a vote concluding for the payout.