{
  "schema_version": "1.6.0",
  "id": "BPX-2026-004",
  "published": "2026-08-19T00:00:00Z",
  "modified": "2026-08-19T00:00:00Z",
  "summary": "Staking-path finding (third bounty wave, T2)",
  "details": "Second confirmed finding from the third bounty wave. Fixed in the staking repository and merged to production with regression coverage. Status: fixed. Severity: unclassified. Results-level by policy — deep technical registers live in the repositories. Canonical: https://blazephoenix.xyz/security/advisories/BPX-2026-004/",
  "affected": [
    {
      "package": {
        "ecosystem": "GitHub Actions",
        "name": "blazephoenixxyz-crypto/Blaze-Phoenix-Staking"
      },
      "versions": [
        "pre-PR#12"
      ]
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://blazephoenix.xyz/security/advisories/BPX-2026-004/"
    },
    {
      "type": "WEB",
      "url": "https://github.com/blazephoenixxyz-crypto/Blaze-Phoenix-Staking/pull/12"
    }
  ],
  "credits": [
    {
      "name": "Thomas",
      "type": "FINDER"
    }
  ]
}