Spark triage - ARGUS name-collision disambiguation + domain-fit gates EV (before saturation)
Date: 2026-06-16 Type: scope triage (NO-GO) Target: Immunefi "Spark (Lightspark)".
Lesson 1: disambiguate same-named programs by STACK/REPO, not name. Three different "Spark" security
programs exist: (a) Spark Protocol / SparkLend (Sky/MakerDAO DeFi, /sparklend/, up to $5M, Solidity);
(b) Spark by Lightspark (Bitcoin statechain L2, /spark-lightspark/, up to $100k, Go operator + Rust signer +
TS SDKs); (c) Lightspark's own Lightning infra (HackerOne). ARGUS mashed (a)+(b) into "Spark (Lightspark)".
ALWAYS resolve the canonical program by its repo (github.com/buildonspark/spark) + stack before any EV math -
a one-letter brand overlap can put you in the wrong domain entirely.
Lesson 2: DOMAIN FIT gates EV BEFORE saturation does. The triage rubric should check fit first:
- Is the high-VALUE surface in a domain where WE have an edge (EVM/Solidity DeFi seams; Web2 OSS incomplete-fix
in Go/Rust/Python web apps)? Spark's value is in statechain/adaptor-signature/Lightning crypto -> elite
Bitcoin specialists' turf, not ours. NO-GO on fit alone, regardless of payout size or saturation.
- A big max-reward ($100k) in a domain we can't compete in = $0 EV for us. Don't let the headline number
override the fit check. The only in-lane sliver (a logic/authz bug in the Go operator) is low-probability
and dwarfed by our proven lanes.
Lesson 3: "new program + low yield/day + open-source + high-profile" usually = specialist-saturated
long-tail, NOT virgin territory. Open-source + "available to audit" + a famous founder draws the domain elite
fast; the easy bugs are gone even when the program is young. Low $/day on a NEW program is a saturation tell.
The right output is a crisp GO/NO-GO + the single reason, not a deep dive - the whole point of triage is to NOT
spend audit hours on a misfit.