Issues

• [BOUNTY] High: reconcile_validators deadlocks on pre-dual-stake 72-byte ValidatorRegistry (AccountDidNotDeserialize in Step 2 before Step 3 reset), admits non-canonical PDAs in decode, and exits 0 on invariant mismatch

  paraloom-labs/paraloom-core#1606 · Filter by author sonnyman2014 opened on Nov 14, 2026
  4

• [BOUNTY] paraloom_cli validator withdraw-unbonded reverts with PendingRewardsUnclaimed, claim-rewards masks invalid accounts via unwrap_or(0), and list/status report 0 stake during unbonding

  paraloom-labs/paraloom-core#1604 · Filter by author sonnyman2014 opened on Nov 14, 2026
  1

• [BOUNTY] Medium: NetworkManager::run_event_loop holds Arc<Mutex<Swarm>> across swarm_lock.next().await, deadlocking Node::run bootstrap retries and starving settlement co-signing (~15s per peer)

  paraloom-labs/paraloom-core#1599 · Filter by author Tradelord223 opened on Nov 13, 2026
  1

• [Low] Bridge decoder ignores deposits in v0 transactions loaded via Address Lookup Tables

  paraloom-labs/paraloom-core#1581 · Filter by author hunterciki-droid opened on Nov 12, 2026
  2

• [BOUNTY] Low: Serial settle-queue head-of-line blocking delays other users' healthy settlements

  paraloom-labs/paraloom-core#1580 · Filter by author thepetax15 opened on Nov 12, 2026
  1

• deactivate_validator permanently strands the dual-stake token half (incomplete audit fix B1) — Medium

  paraloom-labs/paraloom-core#1579 · Filter by author Arik2779 opened on Nov 12, 2026
  1

• Settlement co-signing requires every selected voter to sign, and a failed approval is discarded without retry — one registered validator can veto settlement persistently

  paraloom-labs/paraloom-core#1578 · Filter by author mr-hrydarie opened on Nov 12, 2026
  1

• [BOUNTY] Low: fetchPrices leaks the user's shielded-holdings mint set to Jupiter on every wallet open

  paraloom-labs/paraloom-core#1577 · Filter by author thepetax15 opened on Nov 12, 2026
  2

• Co-signers never verify the tally outcome, the reputation floor, or the tally deadline — the settling authority can settle a transact its tally rejected

  paraloom-labs/paraloom-core#1576 · Filter by author mr-hrydarie opened on Nov 12, 2026
  1

• Bridge listener never decodes deposit_note — the only deposit instruction in the pinned program — so the listener-fed shielded pool stays empty for 100% of deposits

  paraloom-labs/paraloom-core#1575 · Filter by author mr-hrydarie opened on Nov 12, 2026
  1

• GET /transact/scan cannot be authenticated — the handler takes no token at all, and it returns every delivered note's ciphertext–commitment pair

  paraloom-labs/paraloom-core#1574 · Filter by author mr-hrydarie opened on Nov 12, 2026
  2

• AdaptiveBatchVerifier::verify skips the proofs/public_inputs length check on the 1–2 proof path (silently returns AllValid)

  paraloom-labs/paraloom-core#1573 · Filter by author kikinurizki05 opened on Nov 12, 2026
  1

• [BOUNTY] High: Post-swap SlippageExceeded abort in withdraw_then_swap and unreserved realized_native fallback permanently strand user funds

  paraloom-labs/paraloom-core#1570 · Filter by author jpereyra243-byte opened on Nov 11, 2026
  2

• [BOUNTY] Medium: swap_router::route_handler lacks identical in/out asset validation, causing SOL/WSOL alias collision and 502 Bad Gateway

  paraloom-labs/paraloom-core#1568 · Filter by author jpereyra243-byte opened on Nov 11, 2026
  1

• [BOUNTY] Medium: JupiterSwapProvider::swap counts pre-existing account balances as swap output, bypassing min_out_amount slippage floor and inflating realized proceeds

  paraloom-labs/paraloom-core#1566 · Filter by author ocakciomursel-pixel opened on Nov 11, 2026
  3

• [BUG BOUNTY] Low: stale-cursor self-heal silently discards the deposit backlog — off-chain Merkle tree permanently diverges from the on-chain tree

  paraloom-labs/paraloom-core#1548 · Filter by author Karucho opened on Nov 9, 2026
  4

• [BOUNTY] transact_spl settles withdrawals without updating total_withdrawn

  paraloom-labs/paraloom-core#1546 · Filter by author ahteenstudio opened on Nov 8, 2026
  1

• [BOUNTY] Medium: Unchecked request_id and unbound peer wallet in run_cosign_round, SWFlags::PointAtInfinity (0x40) corruption in onchain_verifier g1/g2_to_wire, and retained equivocator vote in VoteTally::submit_vote

  paraloom-labs/paraloom-core#1541 · Filter by author linkyang01 opened on Nov 8, 2026
  2

• [Low] reputation.json and equivocators.json are persisted with a non-atomic in-place write: a crash mid-persist silently resets all penalties and lifts equivocation bans on restart

  paraloom-labs/paraloom-core#1539 · Filter by author cicada3301jk-stack opened on Nov 8, 2026
  1

• [BUG] extract_deposit_events processes all top-level deposits before inner CPI deposits, inverting leaf insertion order and permanently forking the off-chain Merkle tree

  paraloom-labs/paraloom-core#1516 · Filter by author e5ash opened on Nov 7, 2026
  1

• [BUG BOUNTY] Privacy and Ceremony Hardening: Enforce Canonical Asset ID and Duplicate Nullifier Checks in Transact Verifier, and Reject Trailing Bytes in Verifying Keys, Proof Envelopes, and Ceremony Keys

  paraloom-labs/paraloom-core#1512 · Filter by author deamybro opened on Nov 7, 2026
  1

• [Low] Transact ingress defaults to no token, with no loopback check or rate limit on non-loopback bind

  paraloom-labs/paraloom-core#1511 · Filter by author kimabdul opened on Nov 7, 2026
  1

• [Low] Reputation floor is dead code: DEFAULT_MIN_REPUTATION_FOR_CONSENSUS and consensus_min_reputation are never read

  paraloom-labs/paraloom-core#1510 · Filter by author kimabdul opened on Nov 7, 2026
  1

• [Low] Validators vote Valid for proofs against an arbitrary root (no root check in the off-chain vote path)

  paraloom-labs/paraloom-core#1509 · Filter by author kimabdul opened on Nov 7, 2026
  1

• [Low] transact_spl does not verify the realized amount on SPL withdrawal (transfer-fee mints)

  paraloom-labs/paraloom-core#1508 · Filter by author kimabdul opened on Nov 7, 2026
  1