Campaigns 16 to 18 plus PM1 verification · 2026-05-15 · Session 3
Targets scanned
57
4 manual (C16 to C17) plus 53 DeepSeek (C18)
Total findings
11,120
65 manual plus 11,055 DeepSeek pipeline
DeepSeek cost
~$6.28
$4.05 confirmed / ~$2.23 estimated (20 truncated)
PM1 confirmed
3
TermMax (10/10) · USX (9/10) · Berachain (8/10)
PM1 kill rate
73%
8 killed out of 11 verified
Budget remaining
$14.19
56% of $25.41 original
API usage this session
DeepSeek chat API
~960
API calls (53 scans)
$6.28 estimated
Immunefi public API
1
Bounty check
$0.00
WebFetch
~5
Scope verification
$0.00
WebSearch
~8
Target discovery
$0.00
Git clone
2
Impermax plus Spark
$0.00
Total API calls
~976
All APIs combined
$6.28 total cost
DeepSeek API cost breakdown
Metric
Value
Endpoint
api.deepseek.com/v1/chat/completions
Model
deepseek-chat (DeepSeek Flash)
Input pricing
$0.07 / million tokens
Output pricing
$0.28 / million tokens
Scans with confirmed cost
33 ($4.05)
Scans with estimated cost
20 (~$2.23)
Avg cost per scan
$0.118
Avg cost per finding
$0.00057
C18 scan heatmap · 53 targets by findings
Hover for details. Rust marks high findings, faint marks low findings.
Findings rated 1 to 10
Each rating folds together five signals. Code verification, exploitability, impact, novelty, and bounty potential.
Tier 1 · critical (9 to 10/10)
TermMax UUPS _disableInitializers missing
TermMax Protocol · Immunefi $50K · C12
10
Three UUPS contracts skip _disableInitializers() in the constructor. An attacker can initialize the implementation,
call _authorizeUpgrade, then point the proxy at malicious logic. That is full protocol takeover. CODE VERIFIEDSUBMISSION READY6 prior audits, none covered UUPS constructors
USX rebalanceBySwapping missing access control
USX Protocol (Scroll) · Immunefi $100K · C9
9
rebalanceBySwapping() in USXRebalancer carries no access control modifier. Anyone can call it with an arbitrary
swap router and drain USDC reserves. The other rebalance functions have access control. This one was missed. CODE VERIFIEDSUBMISSION READY
_claimVestedRewards() checks tx.origin != beneficiary, which permanently locks Gnosis Safe and
ERC-4337 wallets out of vesting. The impact grows as account-abstraction adoption climbs. PM1 CONFIRMEDBLOCKED BY 3-REPORT CAPScope verified, StreamingNFT in scope, Distributor1 OOS
Inverse Finance governable modifier uses || not &&
Inverse Finance FiRM · Immunefi $100K · C18 (NEW)
7
Line 36 of Governable.sol reads if (msg.sender != guardian || msg.sender != gov). It uses
|| where it needs &&, so the condition is always true unless guardian equals gov.
removeMarket() in ERC4626Helper and CurveDolaLPHelper ends up permanently bricked. CODE VERIFIEDNEW, NEEDS PM1 DEEP VERIFYSurvived 3 prior audits. Governance DoS, medium severity.
Inverse Finance curve oracle staleness (systemic)
Inverse Finance FiRM · Immunefi $100K · C11
7
Six composite feeds validate Chainlink staleness but skip the Curve EMA oracle (price_oracle(), ema_price()).
Same vulnerability class as the March 2026 sDOLA exploit ($240K loss). CODE VERIFIEDNEEDS AUDIT CROSS-REF
levConvex3Crv swaps the coinId and threeId parameters in the Gearbox Curve withdrawal, so it requests the wrong token.
Cross-protocol integration code tends to be under-audited by design. CODE VERIFIEDHELD
Ostium reinitializer() missing access control
Ostium Protocol · Immunefi $200K · C13
7
Six reinitializer() functions across 5 contracts have no onlyOwner or onlyGov modifier.
They are front-runnable during the upgrade window. Zero prior audits, $200K bounty. CODE VERIFIEDHELD
Resonate harvest() zero slippage and no access control
Resonate Protocol · Immunefi $100K · C13
7
harvest() in 3 MasterChef adapters has commented-out access control plus amountOutMin=0 on swaps.
An MEV sandwich extracts all reward tokens. The commented-out isContract is the smoking gun. CODE VERIFIEDHELD
Tier 3 · medium (5 to 6/10)
Citrea single DVN configuration
Citrea Protocol · HackenProof $250K · C17
6
All 3 bridge contracts depend on a single DVN. Configuration risk, high impact, but a reviewer may class it as centralization.
Nado updateRisk missing bounds
Nado DEX · HackenProof TBD · C17
6
No bounds checks on the risk parameters in updateRisk(). Best non-centralization bug in this Vertex-fork DEX.
SmarDex price average manipulation
SmarDex · HackenProof $150K · C17
6
Same-block price average manipulation on the fictive reserves. An MEV bug on the IL mitigation. Design-level, 1 to 2 prior audits.
Berachain ClaimBatchProcessor address(0)
Berachain Airdrop · Immunefi $250K · C16
6
Missing zero-address validation. Low exploitation path, but worth submitting next to the tx.origin bug if that one lands.
Tier 4 to 5 · low and generic FPs (1 to 4/10)
Pattern
Est. count
Rating
Why
Nado sequencer centralization (6 findings)
6
4/10
Centralization by design, excluded by bounty programs
SmarDex feeToAmount uint104 overflow
1
4/10
Edge case, extreme conditions, 1 to 2 prior audits
Missing L2 sequencer uptime feed
~2,000
2/10
Generic FP, most protocols are mainnet or handle L2
Missing Chainlink staleness check
~1,500
2/10
Generic FP, heartbeat config handles it
First depositor inflation attack
~800
2/10
Generic FP, dead shares and virtual offset
Uninitialized implementation contract
~600
1/10
Generic FP, _disableInitializers in constructor or base
EIP-712 missing chainId
~500
1/10
Generic FP, OZ and framework handle it
Signature malleability and ecrecover
~300
1/10
Generic FP, nonce prevents replay
Division by zero
~200
1/10
Generic FP, upstream require and if guards
Total generic FPs
~6,300
1 to 2/10
57% of all 11,055 findings
PM1 verification results
#
Finding
Campaign
Pipeline rating
PM1 result
1
TermMax UUPS _disableInitializers
C12
10/10
CONFIRMED
2
USX rebalanceBySwapping AC
C9
9/10
CONFIRMED
3
Berachain tx.origin SC wallet
C16
8/10
CONFIRMED
4
Sommelier Redstone ms/s
C14
8/10
KILLED· FP, code uses seconds correctly
5
GammaSwap ERC4626
C12
8/10
KILLED· dead shares plus internal accounting
6
OKX DODO adapter callback
C9
8/10
KILLED· atomic, no attack window
7
TermMax OdosV2 adapter
C12
8/10
KILLED· intentional V2 design
8
Phoenix bridge no crypto
C16
8/10
KILLED· centralization risk, excluded
9
Phoenix PUSD burn
C16
7/10
KILLED· design choice
10
Phoenix 1hr timelock
C16
6/10
KILLED· informational
11
Phoenix TWAP staleness
C16
6/10
KILLED· secondary oracle handles it
PM1 kill rate
73%
8 KILLED
3 CONFIRMED
Current submission queue
Priority
Target
Finding
Rating
Bounty
Status
1
TermMax
UUPS _disableInitializers
10/10
$50K
SUBMIT NOW
2
USX
rebalanceBySwapping AC
9/10
$100K
SUBMIT NOW
3
Berachain
tx.origin SC wallet lockout
8/10
$250K
BLOCKED, 3-report cap
4
Inverse Finance
Governable || vs &&
7/10
$100K
NEW, PM1 verify
5
Inverse Finance
Curve oracle staleness
7/10
$100K
HELD
6
Sector Finance
Gearbox adapter swap
7/10
$25K
HELD
7
Ostium
reinitializer() AC
7/10
$200K
HELD
8
Resonate
harvest() zero slippage
7/10
$100K
HELD
Top 20 targets by non-generic findings
#
Target
Total
H
M
Specific H
Cost
Top finding
1
silo-v3
508
156
213
106
$0.29
Flash loan callback validation (1.0)
2
okx-dex-router
714
159
364
82
$0.28
HermesAdapter drain (0.99)
3
sommelier
786
217
344
78
$0.50
AtomicQueue deadline (0.95)
4
kiln-defi
483
170
243
71
·
FeeRegistry storage layout (0.99)
5
symmio
624
170
318
68
·
FakeStablecoin.mint, test contract
6
olympus
596
136
290
63
·
Missing Curve slippage (0.98)
7
inversefirm
608
141
364
62
·
Governable || vs && (1.0) VERIFIED
8
abracadabra
462
123
203
61
$0.18
LP spot reserves oracle (0.95)
9
phoenix
201
79
72
60
$0.07
Vault AC, PM1 KILLED
10
cap
427
113
176
38
$0.17
EigenServiceManager upgrade (0.98)
11
harvest-finance
415
69
193
36
$0.16
Stale virtualPrice (0.95)
12
midas
518
153
228
36
$0.29
setRoundDataSafe AC (1.0)
13
defisaver
530
81
248
35
$0.35
InstPullTokens low-level call (0.99)
14
sturdy
388
115
173
34
$0.22
DOLA3CRV decimals (0.98)
15
berachain-contracts
360
73
159
32
$0.24
HoneyFactory reentrancy (0.98)
16
sector-finance
433
102
199
32
$0.25
Uniswap V2 swap reentrancy (0.95)
17
ssv-network
172
50
71
30
$0.10
Operator fee reentrancy (0.95)
18
aera
295
71
128
26
$0.17
ERC777 reentrancy (0.95)
19
seamless
236
72
105
26
·
UUPS LeverageManager (1.0)
20
usx
221
54
97
23
·
rebalanceBySwapping AC (0.95)
Campaign comparison · C7 to C18
Campaign
Date
Targets
Findings
Cost
Handoffs
Confirmed
Model
C7
05-14
13
5,384
$2.46
17
·
DeepSeek
C8
05-14
4
1,709
$0.95
1
·
DeepSeek
C9
05-15
6
2,363
$0.95
5
1 (USX)
DeepSeek
C10
05-15
7
1,528
$0.61
1
·
DeepSeek
C11
05-15
10
1,890
$0.81
9
·
DeepSeek
C12
05-15
10
3,201
$1.56
8
1 (TermMax)
DeepSeek
C13
05-15
9
3,631
$1.55
2
·
DeepSeek
C14
05-15
9
311
$0.17
2
·
DeepSeek
C15
05-15
5
810
$0.85
5
·
DeepSeek
C16
05-15
4
65
$0.00
7
1 (Bera)
Claude
C17
05-15
285*
0 new
$0.00
0
·
Claude
C18
05-15
53
11,055
$6.28
8
·
DeepSeek
TOTAL
·
415
31,947
$16.19
65
3
·
Budget status
Budget burn
$11.22 spent (44%)
$14.19 remaining of $25.41 original
Cost efficiency
Cost per scan
$0.118
Cost per finding
$0.00057
Cost per PM1 confirmed
$3.74
Cost per 7/10 plus candidate
$2.04
What the session taught us
What worked
$6.28 DeepSeek spend kept us inside compliance
53 targets in one sweep covered the full workspace
The Inverse Finance Governable bug is real and code-verified
Berachain tx.origin got PM1 confirmed with scope verified
Three submission-ready findings sit in the queue
What didn't
85% of findings are generic FPs, so the noise is heavy
The full re-scan ($6.28) surfaced only 1 new verified bug
HackenProof returned 403, so only 5 of 14 programs were reached
Zero new Immunefi EVM targets, the field is saturated