percolator-cli-bounty5-v16

00.1 — Scope

00.2 — Methodology

The audit followed Jelleo's 6-tier pipeline. Each tier is adversarial to the one above it — false positives are eliminated layer by layer:

00.3 — Findings overview

00.4 — Verification ledger

--- a/percolator-prog/src/v16_program.rs
+++ b/percolator-prog/src/v16_program.rs
@@ -8904,7 +8904,7 @@
     #[inline(never)]
     fn handle_close_resolved<'a>(
         program_id: &Pubkey,
         accounts: &'a [AccountInfo<'a>],
-        _fee_rate_per_slot: u128,
+        fee_rate_per_slot: u128,
     ) -> ProgramResult {
         let owner = account(accounts, 0)?;
         let market_ai = account(accounts, 1)?;
@@ -8932,57 +8932,21 @@
                     .saturating_sub(group.header.resolved_slot.get())
                     < cfg.force_close_delay_slots
             {
                 expect_signer(owner)?;
             }
-            group
-                .sync_account_fee_to_slot_not_atomic(
-                    &mut portfolio,
-                    group.header.resolved_slot.get(),
-                    cfg.maintenance_fee_per_slot,
-                )
-                .map_err(map_v16_error)?;
-            group
-                .settle_negative_pnl_from_principal_not_atomic(&mut portfolio)
-                .map_err(map_v16_error)?;
-            if !percolator::active_bitmap_is_empty(
-                portfolio.header.active_bitmap.map(percolator::V16PodU64::get),
-            ) || portfolio.header.pnl.get() != 0
-                || portfolio.header.reserved_pnl.get() != 0
-                || portfolio.header.stale_state != 0
-                || portfolio.header.b_stale_state != 0
-                || portfolio.header.close_progress.active != 0
-                || (portfolio.header.resolved_payout_receipt.present != 0
-                    && portfolio.header.resolved_payout_receipt.finalized == 0)
-            {
-                return Err(PercolatorError::EngineLockActive.into());
-            }
-            let payout = portfolio.header.capital.get().min(group.header.vault.get());
-            // ...inline payout, c_tot debit, zero-out fields...
+            // Delegate to engine: single call covers (a) B-chunk progress via
+            // settle_account_side_effects_not_atomic, (b) fee accrual to
+            // resolved_slot, (c) negative-PnL principal settlement, (d) the
+            // bankruptcy-ledger path via settle_resolved_bankruptcy_negative_pnl,
+            // and (e) the actual payout & vault/c_tot debits.
+            let outcome = group
+                .close_resolved_account_not_atomic(&mut portfolio, fee_rate_per_slot)
+                .map_err(map_v16_error)?;
+            let payout = match outcome {
+                percolator::ResolvedCloseOutcomeV16::Closed { payout } => payout,
+                percolator::ResolvedCloseOutcomeV16::ProgressOnly => 0,
+            };
             group.validate_shape().map_err(map_v16_error)?;
             portfolio
                 .validate_with_market(&group.as_view())
                 .map_err(map_v16_error)?;
             (cfg, payout)
         };

--- a/percolator/src/v16.rs
+++ b/percolator/src/v16.rs
@@ -6911,6 +6911,21 @@
             worst_case_loss = worst_case_loss
                 .checked_add(risk_notional)
                 .ok_or(V16Error::ArithmeticOverflow)?;
             slot += 1;
         }
+        // Spec section 7 (percolator/spec.md:1147-1158): maintenance_req MUST
+        // include impaired_lien_penalty and pending_obligation_exposure.
+        // Without these, accounts holding stale liens or pending obligations
+        // certify as healthy below their true maintenance threshold.
+        let impaired_lien_penalty =
+            self.account_impaired_lien_penalty_view(account)?;
+        let pending_obligation_exposure =
+            self.account_pending_obligation_exposure_view(account)?;
+        maintenance_req = maintenance_req
+            .checked_add(impaired_lien_penalty)
+            .ok_or(V16Error::ArithmeticOverflow)?
+            .checked_add(pending_obligation_exposure)
+            .ok_or(V16Error::ArithmeticOverflow)?;
+        // TODO(C11-6 remainder): add stale_penalty, concentration_penalty,
+        // thin_market_penalty, unsettled_loss_penalty,
+        // target_effective_lag_penalty, domain_lock_penalty,
+        // sum(maintenance_pending_loss_penalty), and subtract hedge_credit.
         let equity = self.account_haircut_equity(account)?;

--- a/percolator/src/v16.rs
+++ b/percolator/src/v16.rs
@@ -2887,6 +2887,12 @@
 pub struct StockReconciliationProofV16 {
     pub token_vault: u128,
     pub senior_capital_total: u128,
     pub insurance_capital: u128,
     pub backing_provider_earnings: u128,
+    pub cancel_deposit_escrow_total: u128,
+    pub pending_obligation_escrow_total: u128,
+    pub close_staged_quote_reserve_total: u128,
+    pub resolved_payout_escrow_total: u128,
+    pub explicit_backed_loss_reserve_total: u128,
+    pub protocol_fee_payable_total: u128,
     pub settlement_rounding_residue_total: u128,
     pub unallocated_protocol_surplus: u128,
 }

--- a/percolator/src/v16.rs
+++ b/percolator/src/v16.rs
@@ -735,6 +735,76 @@
     /// spec.md:548-569 — recover_or_reconcile_impaired_insurance_lien
     /// outcome == Released: drop the impaired lien without spending insurance.
+    fn prepare_insurance_lien_recover_released_delta(
+        mut reservation: InsuranceCreditReservationV16,
+        mut source: SourceCreditStateV16,
+        amount: u128,
+    ) -> V16Result<(InsuranceCreditReservationV16, SourceCreditStateV16)> {
+        if amount == 0 { return Ok((reservation, source)); }
+        if reservation.impaired_liened_insurance_num < amount
+            || source.impaired_liened_insurance_num < amount
+            || reservation.insurance_credit_reserved_num < amount
+            || source.insurance_credit_reserved_num < amount
+        { return Err(V16Error::CounterUnderflow); }
+        reservation.impaired_liened_insurance_num -= amount;
+        reservation.insurance_credit_reserved_num -= amount;
+        source.impaired_liened_insurance_num -= amount;
+        source.insurance_credit_reserved_num -= amount;
+        Ok((reservation, source))
+    }
+    // ... + prepare_insurance_lien_recover_consumed_delta
+    // ... + prepare_counterparty_lien_recover_released_delta
+    // ... + prepare_counterparty_lien_recover_consumed_delta (mirrors on bucket+source)
+
+    // Public wrappers: recover_or_reconcile_impaired_insurance_lien_not_atomic
+    //                  recover_or_reconcile_impaired_counterparty_backing_lien_not_atomic

--- a/percolator/src/v16.rs
+++ b/percolator/src/v16.rs
@@ -551,7 +551,7 @@ impl V16Core {
     fn prepare_counterparty_lien_consume_delta(...) -> V16Result<...> {
         if bucket.valid_liened_backing_num < amount
             || source.valid_liened_backing_num < amount
-            || source.fresh_reserved_backing_num < amount
+            || source.fresh_reserved_backing_num < amount
+            || source.positive_claim_bound_num < amount
         { return Err(V16Error::CounterUnderflow); }
         bucket.valid_liened_backing_num -= amount;
         source.valid_liened_backing_num -= amount;
         source.fresh_reserved_backing_num -= amount;
+        // spec.md:369-377 — reduce or finalize the locked source-domain claim
+        // in the same atomic step. Underflow guarded above.
+        source.positive_claim_bound_num -= amount;
+        let exact_reduction = source.exact_positive_claim_num.min(amount);
+        source.exact_positive_claim_num -= exact_reduction;
         // ... + symmetric on prepare_insurance_lien_consume_delta

--- a/percolator/src/v16.rs
+++ b/percolator/src/v16.rs
@@ -2203,16 +2203,21 @@
 pub struct CloseProgressLedgerV16 {
     pub b_loss_booked: u128,
     pub explicit_loss_assigned: u128,
+    /// spec.md:1007 — pending-obligation credits applied against this close.
+    /// Disjoint from b_loss_booked even if the same residual atoms motivated both.
+    pub pending_obligation_credits: u128,
+    /// spec.md:1008,1011 — counterparty-backed source-credit lien backing
+    /// consumed by the close. DISJOINT from insurance_spent.
+    pub consumed_counterparty_credit_lien_backing: u128,
     pub quantity_adl_applied_q: u128,
@@ -8715,12 +8722,15 @@
         let progress = ledger
             .support_consumed
             .checked_add(ledger.insurance_spent)
             .and_then(|v| v.checked_add(ledger.b_loss_booked))
             .and_then(|v| v.checked_add(ledger.explicit_loss_assigned))
+            .and_then(|v| v.checked_add(ledger.pending_obligation_credits))
+            .and_then(|v| v.checked_add(ledger.consumed_counterparty_credit_lien_backing))
             .ok_or(V16Error::ArithmeticOverflow)?;

--- a/percolator/src/v16.rs
+++ b/percolator/src/v16.rs
@@ -1506,6 +1506,12 @@
     pub explicit_unallocated_loss_short: u128,
     pub epoch_long: u64,
     pub epoch_short: u64,
+    /// spec.md:797-800 — per-asset recovery reference price.
+    pub recovery_reference_price: u64,
+    /// spec.md:797-800 — fallback price used during recovery if oracle stale.
+    pub fallback_recovery_price: u64,
+    /// spec.md:797-800 — max allowed deviation of fallback from reference.
+    /// MUST be <= V16Config.max_recovery_fallback_deviation_bps.
+    pub recovery_fallback_deviation_bps: u64,
     pub mode_long: SideModeV16,
     pub mode_short: SideModeV16,
 }

--- a/percolator/src/v16.rs
+++ b/percolator/src/v16.rs
@@ -1560,6 +1560,21 @@
+/// spec.md:597-611 — purpose tag on every SourceCreditLien.
+/// Variants are mutually exclusive and dictate which engine subsystems
+/// may consume the lien.
+#[repr(u8)]
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum LienPurpose {
+    Risk = 0,
+    Withdrawal = 1,
+    Conversion = 2,
+    Fee = 3,
+    ResidualCure = 4,
+    Payout = 5,
+}
+
+impl Default for LienPurpose { fn default() -> Self { Self::Risk } }
+
 pub struct SourceCreditStateV16 {
+    /// spec.md:597-611 — purpose of the most-recently-created lien.
+    pub last_lien_purpose: LienPurpose,
 }

--- a/percolator/src/v16.rs
+++ b/percolator/src/v16.rs
@@ -1602,6 +1602,32 @@
+/// spec.md:305-330 — per-bucket upper-bound contribution to
+/// positive_claim_bound_num. Computed conservatively from price/funding
+/// uncertainty and aggregate position weight inside the bucket.
+#[repr(C)]
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Default)]
+pub struct ClaimBoundBucketV16 {
+    pub sum_abs_pos_q: u128,
+    pub sum_funding_weight: u128,
+    pub unit_profit_bound_num: u128,
+    pub unit_funding_bound_num: u128,
+    pub stale_uncertainty_bound: u128,
+    pub current_upper_bound_num: u128,
+}
+
+impl ClaimBoundBucketV16 {
+    pub fn recompute_current_upper_bound_num(&mut self) -> V16Result<()> {
+        // sum_abs_pos_q*unit_profit_bound_num
+        //   + sum_funding_weight*unit_funding_bound_num
+        //   + stale_uncertainty_bound*BOUND_SCALE
+    }
+}

--- a/percolator/src/v16.rs
+++ b/percolator/src/v16.rs
@@ -978,6 +978,12 @@ pub struct V16Config {
+    /// spec.md:1163-1164 + 1278-1285
+    pub cfg_close_drift_reserve_enabled: bool,
+    /// Anchor mode (0 = drift_reference_slot, 1 = max_close_slot)
+    pub cfg_close_drift_anchor_mode: u8,
 }
@@ -2218,6 +2226,11 @@ pub struct CloseProgressLedgerV16 {
+    /// spec.md:1278-1285 — reserved loss-capacity for max adverse close drift.
+    pub close_drift_reserve: u128,
     pub residual_remaining: u128,
 }

--- a/percolator/src/v16.rs
+++ b/percolator/src/v16.rs
@@ -5715,6 +5715,57 @@
+    /// spec.md:1066-1075 — per-leg haircut factors. leg_local_factor = min(all 8).
+    #[repr(C)]
+    #[derive(Clone, Copy, Debug, PartialEq, Eq, Default)]
+    pub(crate) struct LegLocalFactors {
+        pub maturity_or_warmup_factor: u128,
+        pub oracle_confidence_factor: u128,
+        pub target_effective_dual_price_factor: u128,
+        pub thin_market_factor: u128,
+        pub domain_lock_factor: u128,
+        pub pending_loss_factor: u128,
+        pub recovery_factor: u128,
+        pub configured_leg_credit_cap: u128,
+    }
+
+    impl LegLocalFactors {
+        pub fn leg_local_factor(self) -> u128 {
+            self.maturity_or_warmup_factor
+                .min(self.oracle_confidence_factor)
+                .min(self.target_effective_dual_price_factor)
+                .min(self.thin_market_factor)
+                .min(self.domain_lock_factor)
+                .min(self.pending_loss_factor)
+                .min(self.recovery_factor)
+                .min(self.configured_leg_credit_cap)
+        }
+    }

--- a/percolator-prog/Cargo.toml
+++ b/percolator-prog/Cargo.toml
@@ -51,7 +51,7 @@
 percolator = { git = "https://github.com/aeyakovenko/percolator", rev = "23de295039360182338e8675315103b7cf25e15b" }
-anchor-lang-v2 = { git = "https://github.com/solana-foundation/anchor", rev = "e3cf760826fa0a60f247635ea0572e59861ec9b5", package = "anchor-lang-v2", default-features = false, features = ["alloc", "guardrails"], optional = true }
+anchor-lang-v2 = { git = "https://github.com/solana-foundation/anchor", rev = "e3cf760826fa0a60f247635ea0572e59861ec9b5", package = "anchor-lang-v2", default-features = false, features = ["alloc", "guardrails", "account-resize"], optional = true }

--- a/percolator-prog/src/v16_program.rs
+++ b/percolator-prog/src/v16_program.rs
@@ -8818,12 +8818,17 @@
             profile.mark_ewma_e6 = next_mark;
             profile.mark_ewma_last_slot = authenticated_slot;
             profile.oracle_target_price_e6 = next_mark;
             profile.oracle_target_publish_time = 0;
             profile.last_good_oracle_slot = authenticated_slot;
+            // C20-1/C20-2 fix: also refresh the trade-path asset state so
+            // trades between this push and the next crank cannot settle at
+            // the stale effective_price.
+            let asset = &mut group.markets[asset_index_usize].engine.asset;
+            asset.effective_price = percolator::V16PodU64::new(next_mark);
+            asset.fund_px_last = percolator::V16PodU64::new(next_mark);
+            asset.slot_last = percolator::V16PodU64::new(authenticated_slot);
@@ -8881,12 +8886,17 @@
+            // C20-1/C20-2 fix (push_ewma_mark mirror).
+            let asset = &mut group.markets[asset_index_usize].engine.asset;
+            asset.effective_price = percolator::V16PodU64::new(mark_e6);
+            asset.fund_px_last = percolator::V16PodU64::new(mark_e6);
+            asset.slot_last = percolator::V16PodU64::new(authenticated_slot);

--- a/percolator-prog/src/v16_program.rs
+++ b/percolator-prog/src/v16_program.rs
@@ -2771,11 +2771,12 @@
     pub fn validate_matcher_return(
         ret: &MatcherReturn,
         lp_account_id: u64,
         asset_index: u16,
         oracle_price_e6: u64,
         req_size: i128,
         req_id: u64,
+        max_exec_deviation_bps: u64,
     ) -> Result<(), ProgramError> {
+        // C29-1 fix: enforce a hard band on exec_price_e6 vs the engine's
+        // oracle for any non-zero exec_size.
+        if max_exec_deviation_bps == 0 || oracle_price_e6 == 0 {
+            return Err(ProgramError::InvalidAccountData);
+        }
+        let diff = if ret.exec_price_e6 > oracle_price_e6 {
+            ret.exec_price_e6 - oracle_price_e6
+        } else { oracle_price_e6 - ret.exec_price_e6 };
+        let lhs = (diff as u128).saturating_mul(10_000);
+        let rhs = (oracle_price_e6 as u128).saturating_mul(max_exec_deviation_bps as u128);
+        if lhs > rhs { return Err(ProgramError::InvalidAccountData); }
         Ok(())
     }

--- a/percolator-prog/src/v16_program.rs
+++ b/percolator-prog/src/v16_program.rs
@@ -5286,12 +5286,29 @@
     fn handle_trade_cpi<'a>(...) -> ProgramResult {
+        // C30-1 fix: set a per-market cpi_in_progress flag for the
+        // duration of the matcher CPI.
+        {
+            let mut data = market_ai.try_borrow_mut_data()?;
+            let (mut cfg, mut group) = state::market_view_mut(&mut data)?;
+            if group.header.cpi_in_progress != 0 {
+                return Err(PercolatorError::EngineLockActive.into());
+            }
+            group.header.cpi_in_progress = 1;
+            group.validate_shape().map_err(map_v16_error)?;
+            state::write_wrapper_config(&mut data, &cfg)?;
+            drop(data);
+        }
+        // Scope guard: clear cpi_in_progress on every exit path.
+        let _guard = scopeguard::guard((), |_| {
+            // ... clear flag on drop
+        });

--- a/percolator-prog/src/v16_program.rs
+++ b/percolator-prog/src/v16_program.rs
@@ -7605,6 +7605,11 @@ pub mod processor {
         if action == ASSET_ACTION_ACTIVATE
             && (asset_index == configured_slots_pre || permissionless_reuse_target)
         {
+            // F16: bound max_market_slots so trade CU stays under the 1.4M ceiling.
+            // The 14-slot cap was established by CU profiling; any growth past it
+            // pushes apply_backing_domain_fees_after_trade_view + permissionless
+            // fee doublings into deficit.
+            if asset_index >= WRAPPER_MAX_PORTFOLIO_ASSETS {
+                return Err(PercolatorError::EngineLockActive.into());
+            }

--- a/percolator-prog/src/v16_program.rs
+++ b/percolator-prog/src/v16_program.rs
@@ -7256,30 +7256,21 @@
                 if reward != 0 {
+                    // C35-2 fix: charge the reward against insurance_domain_budget_*
+                    // proportionally before debiting header.insurance.
+                    debit_maintenance_cranker_reward_from_active_market_budgets_view(
+                        &cfg,
+                        &mut group,
+                        reward,
+                    )?;
                     group.header.insurance = percolator::V16PodU128::new(
                         group.header.insurance.get()
                             .checked_sub(reward)
                             .ok_or(PercolatorError::EngineArithmeticOverflow)?,
                     );
                     // ... + identical patch at separate-cranker branch

--- a/percolator/src/v16.rs
+++ b/percolator/src/v16.rs
@@ -8833,15 +8833,30 @@
         if weight_sum == 0 {
             if decode_market_mode(self.header.mode)? == MarketModeV16::Resolved {
                 self.header.bankruptcy_hlock_active = 1;
+                // C38-1 fix: debit insurance for the absorbed loss; if
+                // insurance is exhausted, escalate to permissionless
+                // recovery so the residual is visibly un-backed.
+                let insurance_avail = self.header.insurance.get();
+                let insurance_used = residual_remaining.min(insurance_avail);
+                if insurance_used != 0 {
+                    self.header.insurance = V16PodU128::new(
+                        insurance_avail.checked_sub(insurance_used)
+                            .ok_or(V16Error::CounterUnderflow)?);
+                }
+                if insurance_used < residual_remaining {
+                    self.declare_permissionless_recovery(
+                        PermissionlessRecoveryReasonV16::ActiveBankruptCloseCannotProgress,
+                    )?;
+                }
                 // ... + identical patches at engine_chunk==0 and delta_b==0 branches

--- a/percolator/src/v16.rs
+++ b/percolator/src/v16.rs
@@ -9799,12 +9799,29 @@
     fn clear_resolved_unattributed_negative_pnl(...) -> V16Result<()> {
         if account.header.pnl.get() >= 0 { return Ok(()); }
         self.header.bankruptcy_hlock_active = 1;
+        // C38-2 fix: debit insurance for the absorbed loss before wiping PnL.
+        let loss = account.header.pnl.get().unsigned_abs();
+        let insurance_avail = self.header.insurance.get();
+        let insurance_used = loss.min(insurance_avail);
+        if insurance_used != 0 {
+            self.header.insurance = V16PodU128::new(
+                insurance_avail.checked_sub(insurance_used)
+                    .ok_or(V16Error::CounterUnderflow)?);
+        }
+        if insurance_used < loss {
+            self.declare_permissionless_recovery(
+                PermissionlessRecoveryReasonV16::ActiveBankruptCloseCannotProgress,
+            )?;
+        }
         self.set_account_pnl(account, 0)?;
         // ... + identical runtime mirror at v16.rs:12384

--- a/percolator/src/v16.rs
+++ b/percolator/src/v16.rs
@@ -294,9 +300,18 @@
     fn expected_source_credit_rate_num_for_state(state: SourceCreditStateV16) -> V16Result<u128> {
         Self::validate_source_credit_state_shape_static(state)?;
-        if state.positive_claim_bound_num == 0 {
-            return Ok(CREDIT_RATE_SCALE);
-        }
+        if state.positive_claim_bound_num == 0 {
+            // spec.md:276-279 — credit_rate_num = CREDIT_RATE_SCALE only if
+            // NO exact, bucketed, pending, unresolved, or recovery claim exists.
+            let no_claim_exists = state.exact_positive_claim_num == 0
+                && state.bucketed_claim_bound_num == 0
+                && state.pending_domain_loss_barriers == 0
+                && state.unresolved_recovery_bound_num == 0;
+            if no_claim_exists {
+                return Ok(CREDIT_RATE_SCALE);
+            }
+            return Ok(0);
+        }

--- a/percolator-prog/src/v16_program.rs
+++ b/percolator-prog/src/v16_program.rs
@@ -6924,7 +6924,7 @@
     fn handle_withdraw_insurance_limited<'a>(
         program_id: &Pubkey,
         accounts: &'a [AccountInfo<'a>],
         amount: u128,
+        mint_kind: u8,
     ) -> ProgramResult {
@@ -6956,12 +6956,18 @@
-        verify_withdrawable_token_accounts(
-            dest_token, operator.key, vault_token, &vault_authority, &cfg_pre,
-        )?;
+        // Bind this call to exactly one mint so SPL flow can't diverge from
+        // engine accounting. 0 = primary, 1 = secondary. See C13-4.
+        let required_mint = match mint_kind {
+            0 => primary_collateral_mint(&cfg_pre),
+            1 => secondary_collateral_mint(&cfg_pre)?,
+            _ => return Err(PercolatorError::InvalidInstruction.into()),
+        };
+        verify_user_token_account(dest_token, operator.key, &required_mint)?;
+        verify_vault_token_account(vault_token, &vault_authority, &required_mint)?;

--- a/percolator-prog/src/v16_program.rs
+++ b/percolator-prog/src/v16_program.rs
@@ -6755,10 +6755,38 @@
             let available = domain_budget_remaining_view(&group, domain)?;
+            // Mirror the policy checks _limited (v16_program.rs:6990-7011)
+            // enforces. _domain previously skipped these entirely so the
+            // insurance_operator could circumvent the throttles. See C14-1.
+            let clock_slot = Clock::get().map(|c| c.slot)
+                .unwrap_or(group.header.current_slot.get());
+            if cfg.insurance_withdraw_max_bps == 0 {
+                return Err(PercolatorError::EngineLockActive.into());
+            }
+            if cfg.last_insurance_withdraw_slot != 0
+                && cfg.insurance_withdraw_cooldown_slots != 0
+                && clock_slot.saturating_sub(cfg.last_insurance_withdraw_slot)
+                    < cfg.insurance_withdraw_cooldown_slots
+            {
+                return Err(PercolatorError::EngineLockActive.into());
+            }
+            let insurance_total = market_insurance_remaining_view(&group, 0)?;
+            let mut cap = insurance_total
+                .checked_mul(cfg.insurance_withdraw_max_bps as u128)
+                .ok_or(PercolatorError::EngineArithmeticOverflow)? / 10_000;
+            if cap == 0 && insurance_total >= constants::MIN_INSURANCE_WITHDRAW_FLOOR_UNITS {
+                cap = constants::MIN_INSURANCE_WITHDRAW_FLOOR_UNITS;
+            }
+            if cfg.insurance_withdraw_deposits_only != 0 {
+                cap = core::cmp::min(cap, cfg.insurance_withdraw_deposit_remaining);
+            }
             if amount > available
                 || amount > group.header.insurance.get()
                 || amount > group.header.vault.get()
+                || amount > cap
             { return Err(PercolatorError::EngineLockActive.into()); }

--- a/percolator-prog/Cargo.toml
+++ b/percolator-prog/Cargo.toml
@@ -77,3 +77,7 @@
 unexpected_cfgs = { level = "warn", check-cfg = [
     'cfg(kani)',
     'cfg(target_os, values("solana"))',
     'cfg(feature, values("custom-heap", "custom-panic", "idl-build"))',
 ] }
+
+[profile.release]
+overflow-checks = true

--- a/percolator-prog/src/v16_program.rs
+++ b/percolator-prog/src/v16_program.rs
@@ -5083,9 +5083,17 @@
         expect_owner(market_ai, program_id)?;
         expect_owner(account_a_ai, program_id)?;
         expect_owner(account_b_ai, program_id)?;
-        if account_a_ai.key == account_b_ai.key {
+        // C18-3 fix: reject self-trade not only when the two portfolios
+        // are the same account, but also when both portfolios are signed
+        // by the same key OR owned by the same human.
+        if account_a_ai.key == account_b_ai.key || signer_a.key == signer_b.key {
             return Err(PercolatorError::InvalidInstruction.into());
         }
+        let (a_hdr, a_owner) = state::read_portfolio_owner_preflight(&account_a_ai.try_borrow_data()?)?;
+        let (b_hdr, b_owner) = state::read_portfolio_owner_preflight(&account_b_ai.try_borrow_data()?)?;
+        if a_owner == b_owner {
+            return Err(PercolatorError::InvalidInstruction.into());
+        }

--- a/percolator-prog/src/v16_program.rs
+++ b/percolator-prog/src/v16_program.rs
@@ -10214,32 +10214,38 @@
-        let ewma_updates_from_trade = oracle_v16::profile_is_ewma_mark(profile)
-            || (oracle_v16::profile_is_hybrid(profile)
-                && oracle_v16::profile_hybrid_soft_stale_matured(profile, now_slot));
+        // C20-4 fix: during the hybrid soft-stale window the engine has no
+        // independent oracle signal, so any trade-driven mark update is
+        // attacker-controlled. Restrict to pure-EWMA mode only.
+        let ewma_updates_from_trade = oracle_v16::profile_is_ewma_mark(profile);
         if !ewma_updates_from_trade { return Ok(()); }
+        // C20-4 fix: clamp by the real slot delta since the last update.
+        let dt_slots = now_slot.saturating_sub(profile.mark_ewma_last_slot).max(1);
         let clamped_exec = oracle_v16::clamp_toward_engine_dt(
             effective_price,
             exec_price,
             group.header.config.max_price_move_bps_per_slot.get(),
-            1,
+            dt_slots,
         );

--- a/percolator/src/v16.rs
+++ b/percolator/src/v16.rs
@@ -10510,15 +10510,22 @@
         let nonflat = !active_bitmap_is_empty(account.header.active_bitmap.map(V16PodU64::get));
+        // C20-6 fix: maintenance fee is time-based, not oracle-based.
+        // Remove the Live+nonflat slot_last clamp entirely — use now_slot
+        // as the fee anchor so that long oracle silences are still billed.
         let fee_anchor = if decode_market_mode(self.header.mode)? == MarketModeV16::Resolved {
             self.header.resolved_slot.get()
         } else {
             now_slot
         };

// In the PushAuthMark handler (locate via handle_push_auth_mark):
        // C33-6: rate-limit PushAuthMark to one push per slot per asset.
        // Without this an oracle authority can pack PushAuthMark+Crank in the
        // same tx and walk the mark toward a liquidation target one clamp-step
        // at a time.
        let now_slot = authenticated_market_slot_or_fallback_view(&group);
        if profile.last_push_slot.get() >= now_slot {
            return Err(PercolatorError::OracleRateLimited.into());
        }
        // ...existing push logic...
        profile.last_push_slot = percolator::V16PodU64::new(now_slot);

// Schema dependency: AssetOracleProfileV16 must gain a
// last_push_slot: V16PodU64 field.

--- a/percolator-prog/src/v16_program.rs
+++ b/percolator-prog/src/v16_program.rs
@@ -2974,6 +2974,10 @@
         if *price_ai.owner != PYTH_RECEIVER_PROGRAM_ID {
             return Err(ProgramError::IllegalOwner);
         }
+        // C34-A: match Switchboard/Chainlink readers — bind the AccountInfo key
+        // to the expected feed so attacker cannot substitute a sibling
+        // PriceUpdateV2 account with the same embedded feed_id.
+        if price_ai.key.to_bytes() != *expected_feed_id {
+            return Err(PercolatorError::InvalidOracleKey.into());
+        }
         let data = price_ai.try_borrow_data()?;

--- a/percolator-prog/src/v16_program.rs
+++ b/percolator-prog/src/v16_program.rs
@@ -7934,6 +7934,12 @@
                 ASSET_ACTION_RETIRE => {
                     if now_slot == 0 || initial_price != 0 {
                         return Err(PercolatorError::InvalidInstruction.into());
                     }
+                    // Mirror the SHUTDOWN guard (v16_program.rs:7786): asset 0
+                    // is the fee-redirect sink (credit_fee_to_domain_budget_view
+                    // at 4129) and must never be RETIRED, otherwise a later
+                    // ACTIVATE-reset orphans the accumulated insurance budget
+                    // via clear_asset_domain_budget_counters_view (7891). See C35-1.
+                    if asset_index == 0 {
+                        return Err(PercolatorError::InvalidAccountKind.into());
+                    }

--- a/percolator/src/v16.rs
+++ b/percolator/src/v16.rs
@@ -7489,7 +7489,12 @@
-        self.header.loss_stale_active =
-            encode_bool(asset.slot_last < now_slot);
+        // OR-assign so cranking a single fresh asset can never clear the
+        // global gate when another asset is still loss-stale. See C37-1.
+        if asset.slot_last < now_slot {
+            self.header.loss_stale_active = encode_bool(true);
+        }
+
+    /// Scan every configured asset; clear loss_stale_active iff ALL are fresh.
+    pub fn clear_loss_stale_active_if_all_fresh(&mut self, now_slot: u64) {
+        let n = self.header.config.max_market_slots.get() as usize;
+        for i in 0..n {
+            if self.markets[i].engine.asset.slot_last.get() < now_slot { return; }
+        }
+        self.header.loss_stale_active = encode_bool(false);
+    }

--- a/percolator/src/v16.rs
+++ b/percolator/src/v16.rs
@@ -10062,12 +10062,17 @@
     fn initialize_resolved_payout_ledger_if_needed(&mut self) -> V16Result<()> {
         if decode_bool(self.header.payout_snapshot_captured)? { return Ok(()); }
         let snapshot_residual = self.residual();
         self.header.payout_snapshot = V16PodU128::new(snapshot_residual);
         self.header.payout_snapshot_pnl_pos_tot = V16PodU128::new(self.junior_claim_bound());
         self.header.payout_snapshot_captured = 1;
+        // C38-3: snapshot_residual is intentionally captured once. To keep
+        // payouts solvent, we must hold an invariant that vault never drops
+        // below snapshot_residual minus payouts already disbursed. That
+        // invariant is enforced in validate_shape (see post_snapshot_vault_floor
+        // check) — any residual-debiting path (bankruptcy, cranker reward,
+        // c_tot drift) MUST validate_shape() before returning.
         // ... + new validate_post_snapshot_vault_floor() invariant function

--- a/percolator-prog/src/v16_program.rs
+++ b/percolator-prog/src/v16_program.rs
@@ -7504,9 +7505,18 @@
         verify_mint(primary_mint_ai)?;
         verify_mint(secondary_mint_ai)?;

         let (mut cfg, _, _, _) =
             state::read_market_config_mode_and_capacity(&market_ai.try_borrow_data()?)?;
         expect_live_authority(&cfg.base_unit_authority, authority.key)?;
+        // Refuse to rotate if any atoms remain in the current primary vault.
+        // Without this the old mint becomes non-withdrawable (10411) and the
+        // SPL balance is stranded. See C10-3.
+        let (vault_authority, _) = derive_vault_authority(program_id, market_ai.key);
+        let current_primary = primary_collateral_mint(&cfg);
+        verify_vault_token_account(current_mint_vault, &vault_authority, &current_primary)?;
+        if unpack_token_account(current_mint_vault)?.amount != 0 {
+            return Err(PercolatorError::InvalidVaultAccount.into());
+        }

--- a/percolator-prog/src/v16_program.rs
+++ b/percolator-prog/src/v16_program.rs
@@ -7961,7 +7961,9 @@
                             cfg.free_market_slot_count = cfg.free_market_slot_count
                                 .checked_add(1)
                                 .ok_or(PercolatorError::EngineCounterOverflow)?;
-                            group.header.current_slot = percolator::V16PodU64::new(now_slot);
+                            group.header.current_slot = percolator::V16PodU64::new(
+                                authenticated_slot_or_fallback(now_slot),
+                            );

--- a/percolator-prog/src/v16_program.rs
+++ b/percolator-prog/src/v16_program.rs
@@ -355,9 +355,17 @@
     #[inline]
     pub fn is_initialized(data: &[u8]) -> bool {
-        data.len() >= HEADER_LEN && read_u64(data, 0).ok() == Some(MAGIC)
+        // Treat a "closed-sentinel" account as still initialized so subsequent
+        // init paths refuse to re-type it. See C27-2.
+        if data.len() >= HEADER_LEN && read_u64(data, 0).ok() == Some(CLOSED_SENTINEL_MAGIC) {
+            return true;
+        }
+        data.len() >= HEADER_LEN && read_u64(data, 0).ok() == Some(MAGIC)
     }
+
+    pub const CLOSED_SENTINEL_MAGIC: u64 = 0x434C_4F53_4544_5F31; // "CLOSED_1"

// Companion: ClosePortfolio writes the sentinel as its last step:
//     data.fill(0);
//     data[..8].copy_from_slice(&state::CLOSED_SENTINEL_MAGIC.to_le_bytes());

--- a/percolator-prog/src/v16_program.rs
+++ b/percolator-prog/src/v16_program.rs
@@ -7549,12 +7549,28 @@
+        // Reflect the primary-collateral inflow in the engine's accounted
+        // vault scalar. Without this, group.header.vault drifts below the
+        // SPL primary-vault balance. See C33-5.
+        {
+            let mut market_data = market_ai.try_borrow_mut_data()?;
+            let (_, mut group) = state::market_view_mut(&mut market_data)?;
+            group.header.vault = percolator::V16PodU128::new(
+                group.header.vault.get()
+                    .checked_add(amount)
+                    .ok_or(PercolatorError::EngineCounterOverflow)?,
+            );
+            group.validate_shape().map_err(map_v16_error)?;
+        }

--- a/percolator-prog/src/v16_program.rs
+++ b/percolator-prog/src/v16_program.rs
@@ -8928,12 +8928,11 @@
             if group.header.mode != 1 {
                 return Err(PercolatorError::EngineLockActive.into());
             }
-            if cfg.force_close_delay_slots != 0
-                && authenticated_market_slot_or_fallback_view(&group)
-                    .saturating_sub(group.header.resolved_slot.get())
-                    < cfg.force_close_delay_slots
-            {
-                expect_signer(owner)?;
-            }
+            // C34-C: always require the portfolio owner to authorize their own
+            // close. The prior gating left a force-claim griefing window once
+            // the delay elapsed.
+            expect_signer(owner)?;

99 — Appendix

A1 — Dedup methodology (39 → 36)

Cluster merges reduced 39 candidates to 36:

A2 — Test infrastructure notes

All POCs are reproducible from the bounty repo:

• L2 source-pin tests: cargo test --features test --test <pin_file>
• L3 Kani: requires WSL Ubuntu + cargo-kani 0.67.0 + CBMC + cadical. cargo kani --tests --features fuzz --harness <harness_name>
• L4 LiteSVM (V16CuEnv): cargo test --test v16_cu <test_name> -- --nocapture. BPF build via cargo build-sbf --no-default-features.
• Cargo git cache caveat — percolator-prog's Cargo.toml pins engine as a git dep at rev 23de295. Local edits to percolator/src/v16.rs are NOT picked up by wrapper-side test compilation unless the same edit is applied to ~/.cargo/git/checkouts/percolator-*/23de295/src/v16.rs AND percolator-prog/target/debug/deps/libpercolator-*.rlib is deleted.

A3 — Disclosure ordering guidance

1. F1 + F2 (CRITICAL) are headline. F1's positive-PnL-stuck is the most visceral; F2's health-cert bypass is the most catastrophic if exploitable.
2. F4 (impaired liens) is the strongest "spec violation" narrative since both sides of a symmetric primitive are missing.
3. F18 + F19 + F31 (bad-debt family) could be presented together in a single issue body — same area, three distinct mechanisms.
4. F14 + F15 (matcher CPI) can share one issue body since both bound to handle_trade_cpi.
5. F24 + F25 (EWMA poisoning) form an attack chain; cross-reference in disclosure.

A4 — Authorship + verification chain

END OF REPORT · 36 unique findings · 2026-05-26