Stacking a Move market-key confusion, a caller-controlled price, and a primitive-type witness to drain an incentive vault on Sui
Chaining an arbitrary file write, a Sage/PPL segfault, and cysignals unsafe gdb auto-load into a CAP_SYS_PTRACE read of a setgid-only flag
Draining a meta-transaction vault through a relayer credit-transfer with no signature check, plus the intended ECDSA malleability and cross-function reentrancy chain
