A
ARGUS
12-EYE recon + correlation engine
LIVE - Updated 2026-09-04T23:00:02Z
auto-refresh every 10 min
DAY 34 / 90 of 90-day challenge

Snapshot

Methodology Rules
46
cumulative since Day 1
Disclosures Sent
1
awaiting reply
Walks Averted
29
submission slots saved (30d)
Active Findings
1
pending submission/payout

Detail (click to expand)

🎯Active Findings 1 ▶
FindingTargetSeverityEst. PayoutStatus
Luno test_bridge.html bridge-enumeration / P3 info-disclosure floorLuno (Bugcrowd)P3 (P2 ceiling pending Cycle 21 runtime retry)P3 floor ~$250-$1,500 (Bugcrowd Luno range); P2 ceiling ~$1-5K if Cycle 21 confirms LimitlessAuthoriseBid silent executionBANKED 2026-05-12 via Cycle 20 static-deep-trace. P1 fund-withdrawal ceiling COLLAPSED (dispatcher allowlist rejects InitiateInstantBuy + InitiateWithdrawal). P3 floor CONFIRMED (test_bridge.html shipped to prod + dispatcher enumeration discloses production endpoint paths + gRPC service paths + payload structures). Kingsley deciding: ship-P3-now OR Cycle 21 runtime retry on BlueStacks/rooted Android for P2 upgrade.
✋Recent Walks (Methodology Defense) 29 ▶
DateTargetReasonSaved
2026-05-12Day 27 actuator corpus (Allstate qa-roadside + IDnow video.test pair)Cycle 18: 3 Tier-1 candidates only serve banner-grabbing endpoints (health/info/prometheus/metrics). High-value endpoints (env/heapdump/loggers/shutdown) all return 404. Rule 33 = unsubmittable. Day 27 249-host corpus retrospectively pre-classified.~30 min Buddy time + decisive Rule 33 calibration; don't re-audit Day 27 corpus
2026-05-12Polymarket multi-audit Sub-rule 38.4 sweep (Cantina BB $5M pool)Cycle 19: 1 DRIFT found = M-01 DELAY_PERIOD=0 (audit recommended INCREASING, team removed via PR #33), but that's the closed-Duplicate #570 finding per brief constraint. ALL other audit-asserted invariants HOLD in current HEAD across ChainSecurity Exchange + UMA + Multi-Outcome.~50 min Buddy time + Polymarket Sub-rule 38.4 surface confirmed saturated
2026-05-12Luno test_bridge.html runtime PoC (Bugcrowd)Cycle 20: P1 fund-withdrawal ceiling COLLAPSED via static-deep-trace. Dispatcher allowlist rejects InitiateInstantBuy + InitiateWithdrawal. Day 25 P1 hypothesis bust. P3 floor confirmed instead.~30 min + saved from false-P1-submission deposit burn
2026-05-11Veda + Lombard + Aera + Renzo NatSpec Sub-rule 38.5 (Cycle 17)4/4 walk-clean on 38.5 retroactive sweep. ~697 NatSpec entries examined. Yield zone refined to un-audited-rich-NatSpec only.~60 min Buddy time + Sub-rule 38.5 yield zone decisively calibrated
2026-05-11Hyperlane CCTP downstream deployers (Cycle 16, Sub-rule 38.3)Hyperlane registry only contains Hyperlane-owned routes. 3rd-party CCTP warp-routes require chain-explorer bytecode-signature scanning (ARGUS-class multi-cycle). Banked for ARGUS EYE 13.~30 min + EYE 13 spec confirmed needed
2026-05-11Hyperlane core Sub-rule 38.4 (Cycle 15-B)Audit-asserted invariants HOLD on Hyperlane canonical deployments. Bug visible in source-only deployments (PR #8519 TokenBridgeCctp) walks Hyperlane's own scope.~45 min + Hyperlane 38.4 surface clean
2026-05-11Aera v3 Sub-rule 38.4 (Cycle 14)All audit-asserted invariants HOLD on current HEAD. Multi-firm audit discipline confirmed.~50 min
2026-05-11Lombard Finance Sub-rule 38.4 (Cycle 13)All audit-asserted invariants HOLD on current HEAD.~45 min
📚Rules Banked 46 ▶
#RuleDateSummary
RULE 43Rule 38 yield-targeting filter2026-05-11Pre-cycle audit-discipline scoring filters target list. Veda-class (multi-firm + recent cadence + clean prior outcomes) = HIGH-discipline LOW-yield = skip Rule 38 cycle entirely. Calibrated against 9 walks across Tier-1 Solidity perimeter.
RULE 42Walk-clean is a VALID verdict2026-05-11Walks compound methodology + indirect revenue (Securva positioning, Cantina rep, banked rules) even at $0 direct payout. Dual-revenue compound model.
RULE 41BB-velocity-favorable for Rule 382026-05-11Continuous BB programs (Immunefi/H1/BC/Cantina BB) > private contests (Cantina/C4/Sherlock) for Rule 38. Per-tier fixed rewards vs pool-split contest economics. dYdX (continuous BB, $1M Critical) > Polymarket (contest, $5M pool but cluster-split).
RULE 40Private-contest dup-blindness structural Gate 4 cap2026-05-11Cantina/C4/Sherlock SEAL submissions during contest window. Gate 4 cannot fire reliably. Polymarket #570 founder case (8-finder cluster). Dup-economics flatten upside even for 1st-finder.
RULE 38.5NatSpec / inline-doc implementation drift (Sub-rule)2026-05-12 (yield-zone-calibrated)Code-only sister of 38.4. NatSpec/godoc/JSDoc/docstring claims vs implementation. Yield zone = un-audited-rich-NatSpec ONLY (skip already-audited per Cycle 17 4/4 walk). Skill v0.2 shipped.
RULE 38.4Audit-documented safety-net break (Sub-rule)2026-05-11Audit prose asserts invariant as established fact -> post-audit PR silently breaks it. HIGH-Critical regression class. dYdX V4 founder case (PR #2099 inverted DecommissionNonPositiveEquityVaults, broke line-980 invariant). Skill v0.1 shipped.
📊Programs & Scope 1010 programs ▶
Programs
1010
967 active / 43 suspended
In-Scope Assets
48,845
across all programs
Vendor Clusters
9
52 members
Total Signals
37,237
cumulative all EYEs
🚨Signal Tiers 53 T1 / 7500 T2 / 23,963 T3 ▶
Tier-1 Alerts
53
submission-worthy
Tier-2 Signals
7500
deferred / follow-up
Tier-3 Signals
23,963
tracking / informational
Unprocessed 24h
2
awaiting Brain
👁️EYE Breakdown 35,457 signals across 9 EYEs ▶
EYE_0: 4143EYE_1: 5162EYE_2: 0EYE_3: 184EYE_4: 2757EYE_5: 18655EYE_10: 4488EYE_11: 52EYE_12: 16
📡Recent Tier-1 + Tier-2 Signals 30 ▶
TierEYETypeTargetDetected
Tier-2EYE 4github-commit-newhttps://github.com/anza-xyz/solana-sdk1h ago
Tier-2EYE 4github-commit-newhttps://github.com/Uniswap/UniswapX2h ago
Tier-2EYE 4github-commit-newhttps://github.com/anza-xyz/agave2h ago
Tier-2EYE 4github-commit-newhttps://github.com/anza-xyz/agave2h ago
Tier-2EYE 4github-commit-newhttps://github.com/dydxprotocol/v4-chain3h ago
Tier-2EYE 4github-commit-newhttps://github.com/anza-xyz/agave3h ago
Tier-2EYE 4github-commit-newhttps://github.com/anza-xyz/agave3h ago
Tier-2EYE 10all-a-records-migratedchrome.google.com4h ago
Tier-2EYE 10all-a-records-migratedwww.shffls.com4h ago
Tier-2EYE 10all-a-records-migratedapi.us1.fga.dev4h ago
Tier-2EYE 10all-a-records-migrateddocs.sophos.com4h ago
Tier-2EYE 4github-commit-newhttps://github.com/anza-xyz/agave5h ago
Tier-2EYE 4github-commit-newhttps://github.com/anza-xyz/agave8h ago
Tier-2EYE 4github-commit-newhttps://github.com/anza-xyz/agave8h ago
Tier-2EYE 4github-commit-newhttps://github.com/anza-xyz/agave9h ago
Tier-2EYE 10all-a-records-migratedchrome.google.com10h ago
Tier-2EYE 10all-a-records-migratedwww.shffls.com10h ago
Tier-2EYE 10all-a-records-migrateddocs.immutable.com10h ago
Tier-2EYE 10cname-migration-detectedapi.pinterest.com10h ago
Tier-2EYE 10all-a-records-migratedapi.pinterest.com10h ago
Tier-2EYE 10all-a-records-migratedapi.us1.fga.dev10h ago
Tier-2EYE 10all-a-records-migrateddocs.sophos.com10h ago
Tier-2EYE 10all-a-records-migratedwiki.atom-lens.com10h ago
Tier-2EYE 4github-commit-newhttps://github.com/centrifuge/api-v312h ago
Tier-2EYE 4github-commit-newhttps://github.com/pendle-finance/pendle-core-v2-public13h ago
📂Sourcemap Captures (EYE 3) 15 ▶
HostPathSizeFilesRecovered
wallet.opensea.io/assets/index-v2-fbGXalHg.js.map9518.3 KB126918h ago
marketplace.auth0.com/_next/static/chunks/pages/_app-8ff07b3b...5731.0 KB12151d ago
wallet.opensea.io/assets/index-v2-DR_z7IiP.js.map9518.3 KB12691d ago
marketplace.auth0.com/_next/static/chunks/main-a30b1a8d782601...659.4 KB1352d ago
marketplace.auth0.com/_next/static/chunks/webpack-ade5da6074a...13.4 KB212d ago
marketplace.auth0.com/_next/static/chunks/pages/index-fbde65e...0.5 KB12d ago
wallet.opensea.io/assets/index-v2-R49cuirG.js.map9515.1 KB12692d ago
wallet.opensea.io/assets/index-B-_oQ4pO.js.map9513.5 KB12695d ago
wallet.opensea.io/assets/index-Bf2wsKen.js.map9491.7 KB126314d ago
wallet.opensea.io/assets/index-DgYw8GJR.js.map9491.7 KB126317d ago
wallet.opensea.io/assets/index-BqqK8Ymq.js.map9241.7 KB124018d ago
wallet.opensea.io/assets/index-Bv3sFx3a.js.map9241.7 KB124020d ago
wallet.opensea.io/assets/index-ZQhxVqEO.js.map9241.5 KB124021d ago
wallet.opensea.io/assets/index-CJrCSD9-.js.map9241.5 KB124022d ago
wallet.opensea.io/assets/index-DJztCThP.js.map9241.0 KB124023d ago
🔧Recent High-Signal GitHub Commits (EYE 4) 15 of 23 watched repos ▶
RepoLabelSHAMessageCommitted
centrifuge/api-v3securityc9240daca3a5fix: address critical and high Aikido security findings (#483)17d ago
babylonlabs-io/babylonsecurityfcca3a65f72efix(checkpointing): proto-size accounting in checkpoint PrepareProposal repack (GHSA-692h-31d ago
fireblocks/mpc-libsecurity00ae08b7f1bdAdded FROST Schnorr MPC implementation, upgrade flow from legacy threshold keys to CMP, an37d ago
anza-xyz/agavefix_class7d0f4a12d101repair: fix race when responding to block id requests during bank switch (#13718)53d ago
anza-xyz/agavefix_classcb8377d2baabxdp: make umem sharable among threads (#13803)53d ago
anza-xyz/agavefix_class77ac860e1f38streamer: fix test_quic_server_block_multiple_connections race (#13708)57d ago
babylonlabs-io/babyloncve_reference7791059177d9chore(deps): bump github.com/shamaton/msgpack/v2 from 2.2.0 to 2.4.1 in the go_modules gro65d ago
anza-xyz/agavesecurity05e0183465ffXdp Test Harness (#13359)69d ago
anza-xyz/agavegeneric_bypassb5b1f6ee2bc3xdp: use af-xdp for gossip egress traffic (#13141)71d ago
Truelayer/truelayer-signingghsa_advisoryc9603e84b053Python: bump cryptography upper bound from <45 to <47 (#389)78d ago
Truelayer/truelayer-signingsecurity42a37e392f03Pin third-party actions to commit SHAs (#418)78d ago
Truelayer/truelayer-signingsecurity33c9a810a2e5Run CodeQL only for languages changed in a PR (#409)80d ago
anza-xyz/agavegeneric_bypass9376529ed557rpc: fix WS pubsub subscription cap bypass via duplicate params (#12594)98d ago
anza-xyz/agavefix_class52e9e4b4ae5fblockstore_processor: fix BlockFooter race condition (#12780)99d ago
babylonlabs-io/babylonsecurityfe3dd3e8c59afix: backport wrong-epoch VE and stake-expansion early-unbond security fixes from release/100d ago
⚖️Sherlock Contest Watcher (EYE 11) 0 active / 301 tracked / $0 active pool ▶

Top active contests

TitlePoolStatusEnds
No active Sherlock contests right now.

Recent state transitions

TitleTransitionPoolDetected
TareSHERLOCK_JUDGING -> FINISHED$27,0001d ago
Metric Audit ContestSHERLOCK_JUDGING -> FINISHED$121,0002d ago
Raindrops SolanaSHERLOCK_JUDGING -> FINISHED$18,50017d ago
TareESCALATING -> SHERLOCK_JUDGING$27,00028d ago
TareSHERLOCK_JUDGING -> ESCALATING$27,00029d ago
TareESCALATING -> SHERLOCK_JUDGING$27,00029d ago
Metric Audit ContestESCALATING -> SHERLOCK_JUDGING$121,00029d ago
TareSHERLOCK_JUDGING -> ESCALATING$27,00029d ago
🏆Cantina Contest Watcher (EYE 12) 0 active / 144 tracked / $0 active pool ▶

Top active contests

TitlePoolStatusEnds
No active Cantina contests right now.

Recent state transitions

TitleTransitionPoolDetected
Morpho Midnightescalations_ended -> complete$400,0006d ago
(unnamed)escalations -> complete$30,0006d ago
(unnamed)judging -> escalations$30,00012d ago
(unnamed)live -> judging$30,00016d ago
Morpho Midnightescalations -> escalations_ended$400,00056d ago
Morpho Midnightjudging -> escalations$400,00067d ago
Morpho Midnightlive -> judging$400,00084d ago
Reserve Governorescalations_ended -> complete$30,00085d ago
🏢Vendor Clusters 9 ▶
ClusterMembers
FDJ-Kindred16
ByteDance-TLB8
Atlassian-Edge7
Salesforce-Experience-Cloud6
Apple-Geneva-Staging5
Intergamma4
IDnow2
Mozilla-allizom-Staging2
AutoDiscovered-GitRepo-intergamma/shopfront2
🔄Recent State Transitions 10 ▶
HostNoteDetected
-state changed suspended->active4d ago
-state changed suspended->active19d ago
-state changed suspended->active19d ago
-state changed suspended->active19d ago
-state changed suspended->active25d ago
-state changed suspended->active25d ago
-state changed suspended->active29d ago
-state changed suspended->active29d ago
🧠BRAIN State (Cycle 75) 4 ▶
EventDetail
[2026-09-04T22:30:02Z] BRAIN v1 tick complete: signals=7 R0=0 R1=0 R2=0 R3=0 R4=0 (retest passed=0 failed=0) R5=0 R6=0 R7=0
FIRED[2026-09-01T14:30:02Z] R3 fired: adobepublic@intigriti - 41 Tier-3 signals in 24h
FIRED[2026-09-02T14:30:02Z] R3 fired: semtech@hackerone - 43 Tier-3 signals in 24h
FIRED[2026-09-03T02:30:03Z] R3 fired: akeles@bugcrowd - 15 Tier-3 signals in 24h
FIRED[2026-09-04T02:30:02Z] R3 fired: amazonvrp@hackerone - 21 Tier-3 signals in 24h
🎯Skill Ecosystem 17 ▶
SkillVersionStatus
audit-documented-safety-net-checkv??
audit-saturation-pre-checkv??
clarity-audit-primitivesv??
cross-bridge-reconciliation-primitivesv0.3PRODUCTION
deep-invariant-analysisv??
hyperevm-audit-primitivesv0.3PRODUCTION
module-pair-asymmetry-checkv??
natspec-implementation-drift-checkv0.4PRODUCTION
securva-operational-securityv??
skeptic-gate-7-automatorv0.1PRODUCTION
skill-to-eye-translatorv0.2PRODUCTION
solana-audit-primitivesv0.4PRODUCTION
soroban-foundry-equivalentv??
sub-agent-parallel-explorerv0.1PRODUCTION
submission-approval-tg-routerv0.1PRODUCTION
submission-body-templaterv0.1PRODUCTION
web2-differential-testingv??
💰Pre-Banked Inventory 6 ▶
CandidateTargetSeverityPayout rangeOrigin
hybra-drift-a-testnet-constantsHybra FinanceCritical$100,000 - $500,000Cycle 30
hybra-drift-b-gauge-bypassHybra FinanceMedium$10,000 - $50,000Cycle 30
sukukfi-h01-unauthorized-withdrawSukukFiCritical$100,000 - $500,000Cycle 31
megapot-h01-arbitrary-bridge-callMegapotHigh$20,000 - $100,000Cycle 35
megapot-m08-payout-calculator-temporalMegapotMedium$5,000 - $50,000Cycle 69
fresh-launch-immunefi-ssvnetworkSSV NetworkHIGH$10,000 - $100,000Cycle 0
👁EYE Ticker 22 ▶
EYEStatusLast fireLast line
eye-fresh-small-publicok159 min agofeed written: /home/babakinzo/bounty/coord/money-lane-leads.json
eye-to-idan-bridgeok0 min ago[2026-09-04T23:00:02Z] eye-bridge: tick complete scanned=0 inserted=0 capped=0
eye1ok54 min ago[2026-09-04T22:05:03Z] EYE 1 tick complete: programs+=0 assets+=0 probes_fired=0 tier1_hits=0
eye10ok279 min ago[2026-09-04T18:20:27Z] EYE 10 tick complete: hosts=200 new_baselines=0 drifts=4 (issuer=0, san=0, cname=0, a-records=4)
eye11ok29 min ago[2026-09-04T22:30:05Z] tick complete: contests=301 new_signals=0 tier_1=0
eye12ok25 min ago[2026-09-04T22:35:02Z] tick complete: contests=144 new_signals=0 tier_1=0
eye13stale652 min ago[2026-09-04T12:07:25Z] EYE 13 scan done: 5 tier-1 + 3 tier-2 pattern hits (0 new across all targets)
eye14ok19 min ago[2026-09-04T22:40:02Z] tick complete: programs=71 new_signals=0 tier_1=0
eye15stale653 min ago[2026-09-04T12:06:24Z] EYE 15 scan done: 0 tier-1 + 0 tier-2 Solana primitive hits (0 new across all targets)
eye16stale649 min ago[2026-09-04T12:10:54Z] EYE 16 scan done: 51 tier-1 + 93 tier-2 HyperEVM primitive hits (0 new)
eye17stale644 min ago[2026-09-04T12:15:31Z] EYE 17 scan done: 3 tier-1 + 17 tier-2 cross-bridge primitive hits (0 new)
eye19ok279 min ago[2026-09-04T18:20:16Z] EYE 19 v0.2 scan done
eye2-watchdogold9200 min ago[2026-08-29T13:40:01Z] watchdog: EYE 2 launched as PID 2121
eye2ok0 min ago[2026-09-04T22:59:20Z] [*] certstream connected
eye20ok275 min ago[2026-09-04T18:25:02Z] EYE 20 scan done
eye22ok269 min ago[2026-09-04T18:30:10Z] EYE 22 scan done
eye23ok254 min ago[2026-09-04T18:45:03Z] EYE 23 scan done
eye26ok296 min ago[2026-09-04T18:03:31Z] eye26: DONE total_new=0 total_tier1=0
eye27-scope-db-staleness-detectorstale1137 min ago[2026-09-04T04:02:46Z] eye27: DONE processed=67 programs_with_diffs=3
eye3stale1135 min ago[2026-09-04T04:04:29Z] EYE 3 tick complete: hosts_scanned=100 new_recoveries=1 new_diffs=0 tier2_signals=1
eye4ok29 min ago[2026-09-04T22:30:08Z] EYE 4 tick complete: polled=22 errors=1 new_commits=0 high_signal=0
eye5ok299 min ago[2026-09-04T18:00:24Z] EYE 5 tick complete: members=52 new-baselines=0 drift=12 new-exposures=0
🏆Recent Cycle Wins 8 ▶
CycleVerdict
Cycle 141unknown
Cycle 132unknown
Cycle 131unknown
Cycle 130unknown
Cycle 129unknown
Cycle 128unknown
Cycle 128unknown
Cycle 128unknown
Cycle 126unknown
Cycle 126unknown
🤖Idan Investigations (Tier 3 v0.1) 5 ▶
When (UTC)NoveltyTaxonomyConfidenceBrief
2026-09-02 08:30:14ERROR-ERROR[ERROR] EYE 23 BC_WEB3_LAUNCH: [2026-09-02T00:45:03Z] state change
2026-09-01 08:30:13ERROR-ERROR[ERROR] GHSA: decode-uri-component: Denial of service via exponentia
2026-08-30 08:31:01ERROR-ERROR[ERROR] EYE 14 PROGRAM_LAUNCH: [2026-08-29T13:40:03Z] tick complete:
2026-08-30 08:30:56ERROR-ERROR[ERROR] VMs won't contain cyber-capable agents
2026-08-30 08:30:51ERROR-ERROR[ERROR] GHSA: Plate: Media embed provider metadata can bypass URL sa
🔬Idan (multi-modal autonomous researcher) open full view → ▶
22
total candidates banked
3
hunts confirmed
14
novel primitives promoted
3
modalities active
Web3 (6) / Web2 (15) / Mobile (1) | novel-primitive triager →
🌐Cross-Modal Stats (Cycle 123) 3 lanes ▶
ModalityCandidatesHUNT ConfirmedConversion
Web36350.0%
Web21500.0%
Mobile100.0%
🆕Novel-Primitive Candidates (Operator review queue) 14 promoted / 149 total ▶
Triage summary: PROMOTED 14 | DEFERRED 93 | ARCHIVED 42
CodeNameModalityPrioritySource Book
PROP_LAYER7SLOWLORISASYMMETRICLayer7SlowlorisAsymmetricweb20.772Chang Tan - Ultimate Cyberwarf
PROP_SLOWLORISAPPLICATIONDDOSSlowlorisApplicationDDoSinfra0.676Chang Tan - Ultimate Cyberwarf
PROP_SOCIAL_MEDIA_PROFILE_TARGSocial-Media-Profile-Targetingweb20.670threathuntingwithelasticstack.
PROP_DOM_CLOBBERINGDOM-Clobberingweb20.666Web_Hacking_Arsenal.pdf
PASTE_JWTKIDPATHTRAVERSALEMPTYJWTKidPathTraversalEmptyKeyweb20.666manual_paste_podcast
PROP_PASSIVEOSINTSURFACEMAPPINPassiveOSINTSurfaceMappingweb20.658CEH_v12_Certified_Ethical_Hack
PROP_TROJANIZEDTHIRDPARTYINSTATrojanizedThirdPartyInstallercross-domain0.658Hacking the Hacker.pdf
PROP_TLS_DOWNGRADE_STRIPTLS-Downgrade-Stripweb20.658Security + 701 Book.pdf