Bug bounty review log

Time-boxed static reviews of in-scope code, done only on local clones. No mainnet interaction, no testing against live contracts. Findings, if any, are handed to the user to submit through the program; the user needs an Immunefi account (some programs also require KYC).

How targets are picked

The unofficial Immunefi mirror publishes every program's scope with timestamps: https://raw.githubusercontent.com/infosec-us-team/Immunefi-Bug-Bounty-Programs-Unofficial/main/projects.json. Filtering on 3 Sep 2026 for programs with GitHub-hosted smart-contract scope and assets added in the last 90 days gave the shortlist below. Newer code has had less review time, which is the only edge a few hours of reading can have against protocols that already pay for audits.

2026-09-03: Enzyme Onyx (commit 7b48d24, ACE integration scope)

Files read in full or in their money-moving paths: src/shares/Shares.sol, deposit-handlers/ERC7540LikeDepositQueue.sol, redeem-handlers/ERC7540LikeRedeemQueue.sol, deposit-handlers/SyncDepositHandler.sol (deposit path), fees/FeeHandler.sol (entrance/exit settlement, claims, dynamic fees), shares-transfer-validators/*, infra/chainlink-ace/ChainlinkAcePolicyProtectedBase.sol, issuance/hooks/chainlink-ace/ChainlinkAceIssuanceValidatorBase.sol and one concrete hook.

Checked for: access control on mint/burn/withdraw and on hook and validator configuration; request lifecycle (double execution, non-existent ids, cancel/execute races); fee accounting consistency between value-owed tracking and share burns/mints; rounding direction; reentrancy on mint-then-pull ordering; transfer-validator bypass paths; extractor/payload consistency for the ACE policy engine; handler binding on validators.

Result: no exploitable finding.

• Request ids are deleted before transfers; non-existent or already-processed ids revert on zero shares/assets, so batches cannot double-pay.
• Fees are tracked as value owed rather than shares, so burning gross shares on exit and minting net shares on entry are consistent.
• authTransfer/authTransferFrom/mintFor/burnFor bypass the transfer validator by documented design; ACE hooks on the handlers cover issuance.
• ACE validators are thin wrappers over Chainlink's audited PolicyProtectedBaseUpgradeable, bound to a single handler or to Shares.
• One griefing angle: a controller can cancel a request between an admin's executeDepositRequests/executeRedeemRequests submission and inclusion, reverting the whole batch. It is bounded by minRequestDuration and by batch sizing, and the program's rules put admin-side DoS avoidance and configuration out of scope. Not submitted.
• Stale-NAV arbitrage on synchronous deposits is inherent to admin-reported pricing and documented (subscription rounds). Out of scope.

Time spent: roughly 90 minutes. Two ChainSecurity audits cover this scope, which matches the outcome.

2026-09-03: GMTrade builder-fee path (gmx-solana 50c4d8d)

Unofficial Immunefi mirror (3 Sep 2026): slug gmtrade, max $100,000 USDC, kyc: false, isPaused: false, launched 6 Jul 2026. In-scope GitHub trees: programs/store, programs/treasury, programs/liquidity-provider. Reviewed only the newly activated builder-fee charge/settle/claim path in programs/store (commit message: “activate builder fee charging in order execution”). No mainnet interaction.

Files: instructions/builder_fee.rs, instructions/user.rs (set_builder_fee_factor), ops/order.rs charge helpers, states/order.rs record/set, lib.rs error variants for this feature.

Checked for: owner vs builder vs permissionless roles; fee factor checkpoint vs live advertisement; store cap after a later lower; settlement routing and double-pay; claim vault authority; increase underpayment vs decrease clamp; liquidation/ADL attaching a fee; swap types that empty the fee bucket.

Result: no exploitable finding.

• set_builder_fee is owner-signed, pending-only, and requires the advertised factor to match expected_factor and the store cap (missing cap reads as 0).
• Execution uses the checkpointed factor, not the builder’s current advertisement. Liquidation and ADL kinds cannot take a checkpoint.
• Increase underpayment cancels the order instead of taking a partial fee. Decrease clamps the fee to available output.
• settle_builder_fee is permissionless but transfers only to the checkpointed builder’s ATA and zeroes builder_fee_amount after the CPI. A shortfall clamps to escrow balance so the order can still close.
• claim_builder_fees is owner-signed via User Account PDA seeds and rejects destination == claim vault so a no-op SPL self-transfer cannot fake a claim event.

Time spent: roughly 40 minutes on this path only. Treasury and liquidity-provider programs were not reviewed. Not submitted.

2026-09-03: GMTrade treasury + LP (gmx-solana 50c4d8d)

Same program and commit as the builder-fee pass. Reviewed money-moving paths in programs/treasury and the single-file programs/liquidity-provider. No mainnet interaction.

Treasury files: lib.rs, instructions/{treasury,gt_bank,store,swap,config}.rs, states/{gt_bank,treasury,config}.rs. LP file: programs/liquidity-provider/src/lib.rs.

Checked for: role gates vs permissionless completion; authorized vs leftover vault configs; GT-factor split and receiver-vault accounting; buyback reserve vs later sync_gt_bank; pro-rata complete_gt_exchange insolvency/rounding; swap in/out token flags; LP claim/unstake reward double-mint; vault dust and fee-on-transfer; two-step authority handover.

Result: no exploitable finding.

• Withdrawals, deposits, fee claims, buyback confirm, swaps, and GT-bank sync are all role-gated (TREASURY_WITHDRAWER / KEEPER / ADMIN / OWNER) via store CPI auth. withdraw_from_treasury_vault may target any vault config tied to the same Config (not only the currently authorized one); that is how leftover vaults are recovered and is still withdrawer-gated.
• deposit_to_treasury_vault splits the receiver ATA with apply_factor then checked_sub, so GT-bank + treasury equals the pulled amount. Recorded GT bank balances increase only after the GT-bank CPI succeeds.
• confirm_gt_buyback can run once per bank. It reserves a recorded share (reserve_balances) without moving tokens; sync_gt_bank_v2 then sends vault-minus-recorded excess to the treasury. Claimants later pull only the reserved recorded amounts.
• complete_gt_exchange is owner-signed and permissionless. It closes the exchange via store CPI first (vault must already be confirmed; ownership checked there), then pro-rata transfers from recorded balances. Targets must be owned by the signer. Last claimer with remaining_confirmed_gt_amount equal to their GT gets the leftover recorded balances; rounding dust stays recorded and can be synced to treasury. Missing PDA seeds on the GT bank account are not exploitable: only prepare_gt_bank can create that type.
• Swaps require swap-in deposit disabled and swap-out deposit enabled, and pull only from the receiver ATA. Cancel returns to the same ATAs.
• LP claim_gt is off by default. Unstake always mints then snapshots cum_inv_cost; when claims are disabled only a full unstake is allowed, so that path cannot be used as a partial-claim bypass. Full exit transfers the vault's actual balance (dust-safe) and closes the vault + position PDA. Position and vault are PDAs; destination LP ATA must be owner-owned.
• Time-weighted APY uses stake_start_time even after a mid-stake claim, so a later claim applies a life-of-position average APY to only the new inverse- cost integral. That can overpay if the admin lowers APY after a claim, and underpay if APY rises. Default claim_enabled is false (single unstake window). Admin can set APY to APY_MAX directly. Not submitted.
• Fee-on-transfer LP mints would record requested amount/value but unstake the received vault balance. Controllers are admin-created. Not submitted.

Time spent: roughly 70 minutes. No Immunefi report.

2026-09-03: 1inch Aqua core, swap-vm entry, and Aqua opcodes (KYC, $100k)

Unofficial Immunefi program 1inch-aqua. Local clones: aqua 9c5c42e, swap-vm 08089a1 under /tmp/1inch-aqua and /tmp/1inch-swap-vm. No mainnet interaction.

Read: aqua/src/* (Aqua.sol, AquaApp.sol, AquaRouter.sol, Balance.sol, IAqua.sol) and swap-vm SwapVM.sol, AquaSwapVMRouter, AquaOpcodes, Balances, XYCSwap, XYCConcentrate, PeggedSwap, PeggedSwapMath, FeeFlat, FeeProtocol, ProtocolFee helpers, Extruction, Decay, Controls, MakerTraits, TakerTraits, plus TransientLock / TransientLockUnsafe.

Checked for: virtual-balance accounting (ship/dock/pull/push), docked-strategy behaviour, uint248 packing, per-order transient reentrancy, Aqua vs signature hashing, msg.value/WETH, curve rounding, fee bps vs surplus pulls, taker threshold/partial-fill, maker-chosen Extruction.

Result: no exploitable finding on the Aqua opcode set, fee settlement, invalidators and controls. Still unread: TWAP and whitelist, which are outside this program's Aqua opcode dispatcher.

• pull and push update packed balances before token movement; checked arithmetic bounds pulls to what the maker shipped and blocks pushes to docked or missing strategies. Docking requires the full token list. Shipped strategies are immutable per (maker, app, hash).
• TransientLockUnsafeLib only changes slot addressing; lock() still reverts when already held, so a taker callback cannot re-enter the same order.
• Aqua-mode orders hash as keccak256(abi.encode(order)), matching Aqua.ship.
• Aqua opcode set does not include Static/DynamicBalances. Live Aqua orders load reserves from AQUA.safeBalances.
• XYC / concentrate / pegged curves round amountOut down and amountIn up. Concentrate caps output at balanceOut and recomputes exact-in.
• FeeFlatIn / FeeProtocol adjust the taker amount around runLoop. Total bps must stay below 1e7. Extruction is a maker-chosen external call and is documented as needing min-rate / Aqua guards.
• MakerTraits requires tokenA < tokenB. Decay offsets revert on underflow if they would exceed balanceOut.
• PeggedSwapMath.solve uses the rationalized quadratic and floors √D so v is larger (maker-favorable). a == 0 reduces to v = rightSide² / ONE.
• Token-in fees take a pro-rata of feeTotal plus optional surplus from the taker-paid gross; token-out fees pull the same from the maker, then the taker receives the already-net amountOut. Surplus is maker-parameterized. Floor splits can leave dust; they do not over-allocate the flat fee.
• TakerTraits.validate requires amountOut > 0, enforces exact vs partial fill against the taker-specified amount, and scales min-out / max-in thresholds on partial fills.
• Invalidators: InvalidateBit checks the bit before and writes it after the inner program, gated on non-static context and covered by the per-order lock, so a bit shared across orders behaves as one-shot. InvalidateTokenIn/Out keep cumulative fills per (maker, order, token) and scale the paired balance with floor / ceilDiv in the maker's favour; the external cancel functions set the fill to max, after which the order reverts on underflow. Controls: Deadline bounds block.timestamp; Stop, Revert, Salt behave as named. No finding.

Do not submit. Payment requires user KYC. ETHOnline "Build an Aqua App" ($5,000) is a later path: inherit AquaApp, ship strategies, settle against AQUA.safeBalances. Do not pre-build against Start Fresh before the user has ETHGlobal + public GitHub.

2026-09-03: GMTrade store execute / liquidate / ADL (gmx-solana 50c4d8d)

Same Immunefi program as the earlier store builder-fee and treasury/LP passes. Reviewed the keeper-gated execution and position-cut path, not the full gmsol_model decrease math (that crate is not in the sparse clone). No mainnet interaction.

Files: lib.rs (execute_increase_or_swap_order_v2, execute_decrease_order_v2, liquidate, auto_deleverage), instructions/exchange/{execute_order,position_cut}.rs, ops/order.rs (ExecuteOrderOperation, execute_swap, execute_increase_position, execute_decrease_position, PositionCutOperation).

Checked for: who can execute; liquidation vs healthy positions at the store layer; claimable-account PDA + delegation; transfer-out destinations; swap/min-output; ADL pnl-factor bounds; builder-fee interaction on decrease.

Result: no exploitable finding at this depth.

• Execute, liquidate, and ADL are all ORDER_KEEPER. A user cannot invoke them. Liquidation eligibility itself is inside gmsol_model::decrease (is_liquidation_order); the store only requires a full close (size_delta >= position.size_in_usd) and throw_on_execution_error.
• Position-cut owner is unchecked but must match the position PDA seeds and the user account. Receiver of the synthetic order is that owner. Claimable ATAs are store-owned PDAs seeded with the owner (or holding address) plus the recent-time key, and must be delegated to that same address.
• Increase/swap transfer-out goes only to the order's recorded escrows (no user claimable accounts on that path). Decrease/cut uses those escrows plus the claimable PDAs above.
• Swaps honor validate_output_amount. Limit failures are hard errors; market failures can cancel. Empty market-decrease is allowed only to claim funding.
• ADL requires pnl_factor_exceeded before and a lower-but-not-below- MinAfterAdl factor after. Liquidation forbids a closed-index skip except allow_closed on liquidate (index can be closed; long/short vaults cannot).

Not a full store review: oracle price assembly, revertible swap internals, and gmsol_model liquidation thresholds were not read. Not submitted.

2026-09-03: sBTC Clarity contracts (sbtc 18caa9d)

Unofficial Immunefi program sbtc ($250k, KYC). Reviewed only contracts/contracts (in-scope Clarity). Did not review emily / signer / sbtc / wsts Rust. Local clone /tmp/sbtc. No mainnet interaction.

Files: sbtc-deposit.clar, sbtc-withdrawal.clar, sbtc-token.clar, sbtc-registry.clar, sbtc-bootstrap-signers.clar.

Checked for: user mint/burn; deposit replay; withdrawal lock vs unlock; fee refund; protocol-caller gating; signer rotation; protocol-contract update leaving stale roles.

Result: no exploitable finding.

• complete-deposit-wrapper is signer-principal-only, rejects replay on (txid, vout-index), checks burn-header at burn-height, then mints and records. Batch deposits re-enter that wrapper.
• initiate-withdrawal-request locks amount + max-fee from tx-sender before the dust check (the failed assert reverts the lock). Accept burns the locked amount and mints back max-fee - fee when the signer fee is lower. Reject unlocks the full lock. Both are signer-only and require pending status.
• Token protocol mint/burn/lock/unlock require is-protocol-caller for the matching role. SIP-010 transfer allows tx-sender or contract-caller as sender (standard). get-balance includes locked tokens by design.
• Registry is-protocol-caller checks both the flag→contract and contract→flag maps. After update-protocol-contract the old contract fails the flag→contract check even if a stale role row remains.
• Key rotation requires the current signer principal, >50% threshold, 33-byte keys, and a never-seen aggregate pubkey.

Bitcoin peg-in/out correctness is signer-trusted and was not verified against emily/signer. Not submitted. Payment requires user KYC.

2026-09-03: sBTC signer deposit / withdraw (sbtc 18caa9d)

Same Immunefi program. Reviewed the signer crate's deposit and withdrawal validation, request voting, and complete/accept Stacks calls. Did not review emily/handler, the sbtc deposit-script crate, or wsts (those directories were not in the sparse clone). Local clone /tmp/sbtc. No mainnet interaction.

Files: signer/src/stacks/contracts.rs (CompleteDepositV1, AcceptWithdrawalV1), signer/src/bitcoin/validation.rs (DepositRequestReport, WithdrawalRequestReport, pre-sign uniqueness / fee-rate), signer/src/request_decider.rs, signer/src/block_observer.rs (Emily load + UTXO validate), signer/src/transaction_coordinator.rs (complete-deposit amount = request amount − assessed input fee), signer/src/emily_client.rs (client surface only).

Checked for: user-driven over-mint or under-burn; coordinator proposing a mint that ignores the sweep fee; sweep-txid / outpoint replay; dust and max-fee bypass; unconfirmed or reorged sweeps; first-input not being the signer UTXO; deposit requests that never confirmed; voting without a request record; unverified DKG shares being used to sign.

Result: no user-exploitable finding.

• CompleteDepositV1::validate requires a live on-chain incomplete outpoint, a canonical sweep that spends that outpoint with the signers' UTXO as vin0, mint amount exactly request.amount − assess_input_fee, mint ≥ dust, and assessed fee ≤ max_fee. The coordinator constructs the same mint amount; other signers re-check it before signing.
• AcceptWithdrawalV1::validate requires a Fulfilled report whose sweep txid matches, output script and sat amount match the request, assessed output fee equals tx_fee, fee ≤ max_fee, vin0 is a signer script, and outputs 0/1 cannot be withdrawal outputs (assess_output_fee returns None there).
• Bitcoin pre-sign validation refuses empty packages, duplicate deposits/withdrawals, and out-of-range fee rates. A deposit must be confirmed and unspent, inside per-deposit min/cap, outside the reclaim locktime buffer, voted can_accept + can_sign, and locked to Verified DKG shares. Withdrawals need a local accept vote, cap/dust checks, WITHDRAWAL_MIN_CONFIRMATIONS, and not past WITHDRAWAL_BLOCKS_EXPIRY.
• Request-decider votes are only blocklist + “can this signer sign.” If the blocklist client is unset, can_accept is true. That is operator policy, not a user mint path. Incoming deposit decisions are stored only after Emily fetch + load_requests validation. Incoming withdrawal decisions can be stored before the request row exists (explicit TODO); votes are still keyed by signer pubkey and later counted only against the current aggregate key, so an outsider cannot inject a vote.
• CreateDepositRequest::validate in the observer requires a confirmed non-coinbase UTXO and validate_tx on the bitcoin transaction. Script parsing lives in the sbtc crate, which was not in this clone.

Not submitted. Payment requires user KYC.

2026-09-03: sBTC emily deposit/withdraw API + deposit scripts (18caa9d)

Same Immunefi program. Expanded the sparse clone to emily/handler and sbtc/src. Reviewed the public create/update surfaces and the taproot deposit/reclaim parsers. No mainnet interaction.

Files: sbtc/src/deposits.rs; emily/handler/src/api/handlers/{deposit,withdrawal,new_block,limits}.rs; emily/handler/src/api/models/deposit/requests.rs; emily/handler/src/api/routes/{deposit,withdrawal}.rs; emily/handler/src/database/accessors.rs (trusted vs untrusted updates).

Checked for: posting a crafted deposit that later mints; marking another user's request Confirmed/Failed; unauthenticated withdrawal rows that cause a BTC sweep; reclaim scripts that skip OP_CSV via OP_SUCCESS; deposit-script parse that accepts a mismatched ScriptPubKey or wrong-network recipient.

Result: no user-exploitable finding.

• CreateDepositRequestBody::validate deserializes the submitted transaction hex and runs CreateDepositRequest::validate_tx: txid match, vout exists, deposit/reclaim parse, reconstructed taproot ScriptPubKey equals the UTXO, recipient network matches. Emily does not check that the tx is in a bitcoin block; signers re-fetch the outpoint from bitcoin-core and drop missing/unconfirmed UTXOs.
• Deposit script parse requires the standard <max-fee><recipient> OP_DROP <xonly> OP_CHECKSIG layout, rejects non-minimal PUSHDATA1, and rejects invalid x-only keys. Reclaim parse requires a block-height CSV prefix, rejects the disable-locktime bit and time-based units, caps user-script length, and rejects BIP-342 OP_SUCCESSx so the lock cannot be skipped.
• Untrusted PUT /deposit (and the matching withdrawal update) may only move Pending → Accepted. Confirmed/Failed/RBF need the trusted sidecar flag. Warp routes do not enforce the OpenAPI ApiGatewayKey themselves; production is expected to sit behind API Gateway. Even a public Accepted flip is Emily bookkeeping — signers vote and sweep from local bitcoin and Stacks state.
• POST /withdrawal and POST /new_block are likewise key-annotated but unauthenticated in warp. new_block only accepts committed sbtc-registry print events for the configured deployer. Signers do not sweep from Emily rows; a fake withdrawal index entry cannot unlock BTC.

Not submitted. Payment requires user KYC.

2026-09-03: sBTC emily chainstate / reorg (18caa9d)

Same Immunefi program. Impacts list includes “Emily API crash preventing correct processing of sBTC deposits/withdrawals,” so this slice checked whether an unauthenticated chain-tip write can rewind statuses or crash the API. No live Emily calls. No mainnet interaction.

Files: emily/handler/src/api/handlers/{chainstate,internal}.rs, emily/handler/src/api/routes/chainstate.rs, emily/handler/src/database/accessors.rs (add_chainstate_entry), emily/handler/src/database/entries/{chainstate,deposit,withdrawal}.rs (reorganize_around), emily/handler/src/common/mod.rs (NO_REORG_DEPTH).

Checked for: posting a fake older tip; skipping the 6-block bitcoin guard; Confirmed deposits reminted after a rewind; panic/crash on a large reorg.

Result: no user-exploitable finding.

• POST/PUT /chainstate are OpenAPI-key annotated but unauthenticated in warp. Production is expected to sit behind API Gateway. A reachable write would still only mutate Emily’s index; signers complete deposits and accept withdrawals from bitcoin-core and Stacks, with on-chain replay protection. A rewind to Pending cannot remint.
• NO_REORG_DEPTH (6 bitcoin blocks) is skipped when bitcoin_block_height is omitted. That is a defense-in-depth hole on the notice board, not a peg break. Do not probe the live Emily host.
• reorganize_around drops events at or after the new tip (unless the hash matches) and synthesizes Pending if history is empty. synchronize_with_history clears fulfillment unless the latest event is still Confirmed.
• execute_reorg_handler flips API status to Reorg, rewrites impacted rows, then Stable. Version conflicts retry four times and then continue; leftover stale rows are an index inconsistency, not a mint. No panic path on the happy or conflict routes.

Not submitted. Payment requires user KYC. Remaining sBTC slice: wsts.

2026-09-03: Origin CompoundingStakingStrategy (origin-dollar, no KYC)

Unofficial Immunefi program originprotocol ($1M, kyc: false). The 1 Sep 2026 asset adds were the existing OUSD / wOUSD / Vault / Curve AMO proxies. Reviewed the newer native-staking strategy instead: view 0xb7992eFDa9aBBaC3522336A626191D198fa37145 and proxy 0x25e1d468B14005716111d5e8464573e5135275f4 were added 22 Jun 2026. Local clone /tmp/origin-dollar. No mainnet interaction.

Files: contracts/strategies/NativeStaking/CompoundingStakingStrategy.sol (storage + implementation), interfaces/strategies/CompoundingStakingTypes.sol. Did not review BeaconProofsLib SSZ internals.

Checked for: user withdraw; share-price inflation via donated WETH/ETH; double-count of pending deposits vs validator balances; permissionless proofs rewriting NAV; registrator pulling to a non-vault recipient.

Result: no user-exploitable finding.

• deposit / depositAll are vault-only. withdraw allows the registrator but _withdraw requires the recipient to be the vault. validatorWithdrawal is registrator-only and only requests an EIP-7002 sweep back to this strategy’s 0x02 credentials.
• checkBalance is lastVerifiedEthBalance + WETH.balanceOf(this). stakeEth unwraps WETH and adds the same amount to lastVerifiedEthBalance. Wrapping ETH subtracts min(lastVerified, amount) so swept ETH is not double-counted with WETH. Permissionless verifyBalances sets lastVerified to pending deposits + proven validator balances + the snapped ETH balance, then clears the snap.
• verifyDeposit refuses a processed slot after an unverified snap so a deposit cannot leave depositList before verifyBalances has used that snap. First deposits to new pubkeys are capped and serialized (firstDeposit) to bound front-run loss; that loss is documented and deducted from lastVerified when verifyValidator sees wrong credentials.
• Donated ETH sits in receive() until the next snap/verify. Donated WETH raises checkBalance immediately and gifts existing vault holders; it does not let a later minter extract others’ funds.

Not submitted. Vault rebase interaction was not fully read.

2026-09-03: Origin BeaconProofsLib (origin-dollar)

Same Immunefi program. Reviewed the SSZ/EIP-4788 proof library that CompoundingStakingStrategy uses to set lastVerifiedEthBalance. Local clone /tmp/origin-dollar. No mainnet interaction.

Files: contracts/beacon/{BeaconProofsLib,BeaconProofs,Merkle,Endian,BeaconRoots}.sol.

Checked for: forged validator-balance proofs; wrong-leaf extraction from the packed 4-balance chunk; gindex overflow; short proofs treated as roots; withdrawal-credential swap on verifyValidator; pending-deposit list mixin-length bypass.

Result: no user-exploitable finding.

• Inclusion proofs are index-based SHA-256 (not sorted keccak). Each verifier pins an exact proof length (9 / 28 / 37 / 39 / 40 / 53 witnesses) and a zero block-root reject. concatGenIndices places uint40 validator indexes and uint32 deposit indexes inside the reserved height so they cannot collide with the parent gindex bits.
• verifyValidator takes the first sibling as withdrawal credentials and requires it to match the caller-supplied value; substituting a sibling breaks the beacon block root.
• balanceAtIndex left-shifts the packed leaf by (index % 4) * 64 then byte-swaps the top 64 bits, which is the SSZ little-endian layout for four uint64 balances.
• Pending-deposit indexes are capped at 2^27 to account for the SSZ list length mixin. merkleizePendingDeposit is an 8-leaf tree (pubkey, credentials, amount, signature root, slot, three zeros) matching Electra PendingDeposit.
• Roots come from the EIP-4788 oracle (BeaconRoots.parentBlockRoot); a missed slot reverts rather than returning a stale root.

Not submitted.

2026-09-03: Origin CrossChain CCTP (origin-dollar 4fa0602)

Same Immunefi program (originprotocol, $1M, kyc: false). In-scope proxies include Morpho V2 CrossChain Master/Remote 0xB1d624fc40824683e2bFBEfd19eB208DbBE00866 (Ethereum + Base, added 23 Feb 2026 and again 1 Sep 2026) and HyperEVM twins 0xE0228DB13F8C4Eb00fD1e08e076b09eF5cD0EA1e. Local clone /tmp/origin-dollar at 4fa0602. No mainnet interaction.

Files: contracts/strategies/crosschain/{CrossChainMasterStrategy,CrossChainRemoteStrategy,AbstractCCTPIntegrator,CrossChainStrategyHelper}.sol.

Checked for: user-callable mint/withdraw; forged CCTP or Origin payloads; remoteStrategyBalance inflation; nonce replay / skip; relay vs handleReceiveFinalizedMessage double-apply; pending deposit/withdraw accounting; Morpho 4626 try/catch leaving funds untracked.

Result: no user-exploitable finding.

• Master deposit / withdraw are vault-only. Remote deposit / withdraw / sendBalanceUpdate are governor/strategist/operator. relay is operator-only.
• handleReceiveFinalizedMessage / handleReceiveUnfinalizedMessage are onlyCCTPMessageTransmitter, then require sourceDomain == peerDomainID and sender == peerStrategy. Unfinalized receives additionally require minFinalityThreshold == 1000.
• Burn messages are accepted only through relay: header sender must be the TokenMessenger, burn token must be peerUsdcToken, and the extracted mint sender/recipient must be peerStrategy / address(this). Circle receiveMessage then the Origin hook. A user cannot inject a balance-check or deposit hook.
• Nonces start at 1 with nonceProcessed[0] = true. _getNextNonce reverts while the last nonce is open, so only one in-flight transfer exists. Confirmations apply only when nonce == lastTransferNonce. Out-of-order non-confirmation checks are ignored; idle checks older than one day are ignored.
• Master checkBalance is local USDC + pendingAmount + cached remoteStrategyBalance. Deposits set pendingAmount before the burn; confirmations clear it. Withdrawals do not reduce the cache until the remote confirmation, so TVL can stay high for one CCTP round-trip. That is an accounting window, not a path for a user to mint against unbacked value: the next Master withdraw reverts (Pending token transfer) and Origin’s rules exclude accounting discrepancies without extractable loss.
• Remote Morpho deposit / withdraw are try/catch so a 4626 revert still sends a confirmation. Idle USDC is included in checkBalance. A failed withdraw sends a confirmation without tokens and the Master cache is corrected to the reported balance.

Not submitted. Circle CCTP attestation and Morpho share-price behavior are third-party / documented. Ethena ARM source is not in this clone (only ARMBuyback deployment JSON).

2026-09-03: Origin MorphoV2Strategy (origin-dollar 4fa0602)

Same program. In-scope proxy 0x3643cafA6eF3dd7Fcc2ADaD1cabf708075AFFf6e (“OUSD Strategy - Morpho V2”, added 1 Sep 2026). Local clone /tmp/origin-dollar. No mainnet interaction.

Files: contracts/strategies/{MorphoV2Strategy,Generalized4626Strategy,MorphoV2VaultUtils}.sol.

Checked for: non-vault withdraw; maxWithdraw over-pull; idle-asset under/over-count; permissionless Merkl claim redirection.

Result: no user-exploitable finding.

• deposit / withdraw stay vault-only. withdrawAll is vault-or-governor and sends assets to vaultAddress. Morpho V2’s maxRedeem/maxWithdraw return 0, so the override withdraws min(idle-on-V2 + V1-adapter maxWithdraw, checkBalance).
• MorphoV2VaultUtils only adds the V1 adapter’s maxWithdraw when morphoVaultV1() succeeds; any other adapter reverts IncompatibleAdapter. That can block withdrawAll, not a user drain. Ordinary withdraw still uses ERC-4626 withdraw.
• checkBalance is previewRedeem(shares) only. Idle assetToken on the strategy is intentionally omitted. Donated vault shares raise TVL for existing holders; they do not let a later minter extract others’ funds.
• merkleClaim is permissionless but hardcodes users[0] = address(this), so rewards can only land on the strategy. A valid proof cannot redirect to the caller.

Not submitted.

2026-09-03: sBTC wsts + signer signing gate (18caa9d)

Same Immunefi program (sbtc, $250k, KYC). Local clones /tmp/sbtc/wsts and /tmp/sbtc/signer. No mainnet interaction.

Files: wsts/src/{v2,common,schnorr}.rs, wsts/src/state_machine/signer/mod.rs (DKG end, nonce, sign-share, private-share decrypt), signer/src/transaction_signer.rs (NonceRequest / SignatureShareRequest and validate_bitcoin_sign_request).

Checked for: unverified DKG shares becoming a signing key; nonce reuse; coordinator swapping the message after a nonce; a user forcing a signature on an unapproved bitcoin sighash.

Result: no user-exploitable finding.

• check_public_shares requires polynomial degree == threshold and a Schnorr ownership proof of the constant term (WSTS/polynomial-constant). compute_secret then checks each private share against s * G == poly(key_id) and refuses BadPrivateShares before writing private_keys. Decrypt failures go into invalid_private_shares and block a successful DkgEnd.
• compute_secrets remaps src_party → dest_key into dest_key → src_party before that check.
• sign_with_tweak take()s the private nonce. A second share request returns MissingNonce. The library will sign whatever message the caller passes; that is expected for a FROST crate.
• The sBTC signer is the policy layer. Both NonceRequest and SignatureShareRequest require a canonical coordinator, then validate_bitcoin_sign_request: the message must be a known TapSighash with will_sign_bitcoin_tx_sighash == true and a matching prevout signature type. Unknown or rejected sighashes do not enter WSTS. DKG-verification signs only the mock message for a non-failed pending key inside the verification window.

Not submitted. Payment requires user KYC. sBTC in-scope slices from this clone are now exhausted (Clarity, signer mint/burn, emily, chainstate, wsts).

2026-09-03: Horizen ZenStaker / RewardAccumulator (ab92502)

Immunefi program horizen ($10,000 USDC, kyc: true, live). Scope is pinned to HorizenOfficial/staker commit ab92502. Upstream Tally / ScopeLift Staker.sol paths already covered by published audits are out of scope except where Horizen’s integration introduces a new issue. Local clone /tmp/horizen-staker. No mainnet or testnet broadcast.

Files: src/ZenStaker.sol, src/RewardAccumulator.sol, src/DelegationSurrogate.sol, src/calculators/IdentityEarningPowerCalculator.sol. Read Staker.notifyRewardAmount / _stake only for the integration boundary (ZEN-on-ZEN, notifier, surrogate).

Checked for: RewardAccumulator over-count vs balance; permissionless notifyRewardAmount; schedule skip stealing principal; surrogate drain; view helpers changing stake/claim.

Result: no user-exploitable finding.

• ZenStaker adds only view helpers and a non-voting ZenDelegationSurrogate. MAX_CLAIM_FEE is 0. Stake still moves ZEN into the surrogate (max-approve back to the Staker); rewards sit on the Staker. Same token, separate balances. getVotes is depositorTotalStaked and is not a governance hook in Phase 1.
• RewardAccumulator.transferAndNotifyRewards pulls then increments accumulatedRewards. notifyAlreadyTransferredRewards requires balance - accumulated >= amount (0.8 underflow-safe). A second notify of the same surplus reverts. sendRewardsToStaker is permissionless after timeWindow, transfers exactly accumulatedRewards, then staker.notifyRewardAmount (notifier- gated on Staker) then zeros the counter. Empty flushes still snap lastRewardTime to the latest grid; they do not move principal.
• Admin whitelist / window changes are owner-gated. Donating ZEN when the whitelist is off gifts stakers; it does not extract stake. Fee-on-transfer inflation would be a ZEN-OFT property, not present in this integration.
• permitAndStake swallows a failed permit (production ZEN has no EIP-2612) and falls through to transferFrom. Documented known behavior. MAX_CLAIM_FEE = 0 and maxBumpTip = 0; bumping with a positive tip reverts. Only a registered notifier (the accumulator after the deploy script) can call notifyRewardAmount.

Not submitted. Payment requires user KYC.

2026-09-03: Origin BridgedWOETHStrategy (origin-dollar 4fa0602)

Same Immunefi program. In-scope Base proxy 0x80c864704DD06C3693ed5179190786EE38ACf835 and bridged wOETH 0xD8724322f44E5c58D7A815F542036fb17DbbF839 (added 1 Sep 2026). Local clone /tmp/origin-dollar. No mainnet interaction.

Files: contracts/strategies/BridgedWOETHStrategy.sol, contracts/token/BridgedWOETH.sol.

Checked for: user mint of OETHb against unbacked wOETH; permissionless oracle snapshot inflation; vault withdraw of strategy inventory; bridged-token mint/burn.

Result: no user-exploitable finding.

• Vault deposit / withdraw / depositAll revert. withdrawAll is a no-op. Inventory moves only through depositBridgedWOETH / withdrawBridgedWOETH, both governor-or-strategist. Mint happens before the wOETH pull and burn after the OETHb pull; nonReentrant plus a revert on a failed transfer keeps the two legs atomic.
• updateWOETHOraclePrice is permissionless but only stores oracle.price(bridgedWOETH). The stored price must stay > 1e18, never decrease, and not jump more than maxPriceDiffBps (≤ 100%) from the last snapshot. A user cannot invent a price. A manipulated oracle spike that gets snapshotted cannot be walked back; Origin’s rules treat third-party oracle behavior and accounting without an extractable path as out of scope. checkBalance uses the stored price and is documented to underreport when stale.
• BridgedWOETH mint/burn are MINTER_ROLE / BURNER_ROLE. transferToken cannot rescue wOETH or WETH.

Not submitted.

2026-09-03: Origin WOETH CCIP zapper + Base bridge helper

Same Immunefi program. In-scope Ethereum zapper 0x438731b5Ee8fEcC02a28532713E237b93260C3F8 (added 1 Sep 2026). Local clone /tmp/origin-dollar at 4fa0602. No mainnet interaction.

Files: contracts/zapper/WOETHCCIPZapper.sol, contracts/automation/{AbstractCCIPBridgeHelperModule,BaseBridgeHelperModule,AbstractSafeModule}.sol.

Checked for: user stealing another zap; CCIP fee/token-amount mismatch draining the zapper or the Safe; unprivileged bridge of Safe inventory.

Result: no user-exploitable finding.

• WOETHCCIPZapper.zap / receive convert msg.value - fee to OETH, wrap to wOETH, and ccipSend to the chosen receiver. There is no pending-zap storage. A revert on deposit / wrap / ccipSend returns the ETH. getFee quotes CCIP with the full ETH amount as the token amount, then the send uses the smaller wOETH share count. That can overpay the fee; leftover ETH sits on the zapper with no rescue. That is stuck dust, not a path for a second user to extract.
• BaseBridgeHelperModule deposit/withdraw/bridge functions are onlyOperator and execute via the Safe. CCIP receiver is the Safe itself. transferTokens on the module is onlySafe. A user cannot move Safe wOETH or WETH.

Not submitted. Circle CCIP fee behavior is third-party.

2026-09-03: GMTrade gmsol_model liquidation thresholds (50c4d8d)

Same Immunefi program (gmtrade, $100k, no KYC). Fetched crates/model into /tmp/gmx-solana (it was missing from the earlier sparse clone). No mainnet interaction.

Files: crates/model/src/position.rs (check_liquidatable, check_collateral), crates/model/src/action/decrease_position/mod.rs (check_liquidation, remaining-size close-all), crates/model/src/params/position.rs, crates/model/src/market/perp.rs (liq-impact cap).

Checked for: liquidating a healthy position; fee-induced liquidation; partial liquidation leaving a dust position that steals; impact over-cap on a close.

Result: no user-exploitable finding.

• DecreasePosition::execute calls check_liquidation. A liquidation flag requires check_liquidatable(..., for_liquidation=true) to return a reason; a healthy position errors NotLiquidatable. Users still cannot invoke liquidate (store ORDER_KEEPER).
• Eligibility uses collateral + full-size PnL + capped negative impact − position fees, and excludes liquidation fees so the fee itself cannot push a solvent position under the line. for_liquidation uses min_collateral_factor_for_liquidation (falls back to the ordinary factor). Absolute min_collateral_value is also applied.
• Negative impact is capped by max_position_impact_factor_for_liquidations. Remaining size below min_position_size_usd (or tokens that would go to zero) forces a full close. The store already requires size_delta >= size_in_usd on liquidate.

Not submitted.

2026-09-03: GMTrade swap + output/oracle checks (50c4d8d)

Same Immunefi program. Local clone /tmp/gmx-solana. No mainnet interaction.

Files: crates/model/src/action/swap.rs, crates/model/src/price.rs, programs/store/src/ops/order.rs (execute_swap), programs/store/src/states/order.rs (validate_output_amount), programs/store/src/states/oracle/validator.rs.

Checked for: empty/zero-price swap minting out; impact pool over-pay; skipping min_output; user-set stale oracle prices.

Result: no user-exploitable finding.

• Swap::try_new rejects a zero token_in and prices.validate(). Fees come out of token-in. Negative impact is taken from token-in (and reverts if it cannot be paid). Positive impact is capped by the impact pool; extra out is pool_amount_out + capped impact. Conversion uses pick_price(false) on token-in and pick_price(true) on token-out. After the pool delta the action checks pool amount, reserve, and max PnL.
• Store execute_swap runs the revertible path then validate_output_amount against min_output. Limit-order misses set should_throw_error; market misses cancel. Execute is still ORDER_KEEPER.
• PriceValidator enforces max age, a future-timestamp bound, and optional max deviation from the reference mid. Users cannot assemble oracle prices.

Not submitted.

2026-09-03: TermMax V2 gearing token + vault (e314f3f)

Immunefi program termstructurelabs ($80,000, kyc: false). Primary in-scope repo is term-structure/termmax-contract-v2. The 24 Aug 2026 adds were the TMX OFT token addresses; this pass reviewed the V2 money-movers instead. Local clone /tmp/termmax-v2. No mainnet interaction.

Files: contracts/v2/tokens/{AbstractGearingTokenV2,GearingTokenWithERC20V2}.sol, contracts/v2/vault/TermMaxVaultV2.sol (deposit/withdraw/dealBadDebt).

Checked for: minting an underwater GT; liquidating a healthy loan; taking more collateral than the repaid share; flash-repay stealing another user’s collateral; vault withdraw of someone else’s shares.

Result: no user-exploitable finding.

• mint is onlyOwner (the market) and refuses LTV above maxLtv. Collateral is pulled from the provider. Capacity is checked against the token balance plus the encoded amount.
• liquidate requires liquidatable, a true _getLiquidationInfo hit (LLTV before maturity, or the post-maturity window), and caps repayAmt at maxRepayAmt. After the window it reverts. Debt tokens go to the market first. Collateral to the liquidator is repay-equivalent plus the configured bonus, then min’d against collateral * repay / debt, so a partial close cannot drain the rest. Remainder returns to the owner on a full close.
• flashRepay / repayAndRemoveCollateral are owner-or-delegate. Collateral is sent, then executeOperation, then safeTransferFrom of the repay. nonReentrant. A third party cannot flash someone else’s GT.
• Vault _deposit / _withdraw are standard 4626 with allowance on a non-owner redeem. dealBadDebt burns the owner’s shares (or an approved spender’s) and cannot target the vault asset as “collateral”.

Not submitted. LayerZero internals of the flattened TMX.sol were not reviewed.

2026-09-03: TermMax V2 market issue/redeem + order swap (e314f3f)

Same Immunefi program (termstructurelabs). Local clone /tmp/termmax-v2. No mainnet interaction.

Files: contracts/v2/TermMaxMarketV2.sol (mint/burn/issueFt/ leverageByXt/redeem), contracts/v2/tokens/MintableERC20V2.sol, contracts/v2/TermMaxOrderV2.sol (swapExactTokenToToken, swapTokenToExactToken, _rebalance).

Checked for: burning someone else’s FT/XT without allowance; redeem before the liquidation window; flash-leverage without returning collateral; order swap without minOut or with a fake pair.

Result: no user-exploitable finding.

• MintableERC20V2.burn(owner, spender, amount) spends allowance when owner != spender. Market burn / redeem / leverageByXt all go through that path. Pair mint pulls debt tokens from the caller 1:1 into FT+XT.
• issueFt mints a GT (LTV-checked, collateral pulled) then FT minus the mint fee. issueFtByExistedGt is augmentDebt as the GT owner/delegate. leverageByXt flashes debt to the loan receiver, requires collateral in the callback, then burns XT.
• redeem is blocked until maturity (+ liquidation window if the GT is liquidatable). Market FT reserves from repay/liquidate are burned first so they do not inflate the redeemer’s share. Delivery and remaining debt tokens are pro-rata.
• Order swaps allow only debt↔FT and debt↔XT. Deadline and minTokenOut / maxTokenIn are enforced. Input is pulled after the quote; nonReentrant. afterSwap is a maker-set hook, not a user entry.

Not submitted.

2026-09-03: TermMax V2 router + swap adapters (e314f3f)

Same Immunefi program (termstructurelabs). Local clone /tmp/termmax-v2. No mainnet interaction.

Files: contracts/v2/router/TermMaxRouterV2.sol, contracts/v2/access/WithWhitelistCheck.sol, contracts/v2/lib/{OnlyProxyCall,TransferUtilsV2}.sol, contracts/v2/router/swapAdapters/{ERC20SwapAdapterV2,TermMaxSwapAdapter,OneInchSwapAdapter,LifiSwapAdapter,OdosV2AdapterV2,UniswapV3AdapterV2,PendleSwapV3AdapterV2}.sol.

Checked for: leftover tokens after swap/leverage/flash-repay; leftover approvals; per-order minTokenOut=0 vs aggregate netTokenAmt; adapters callable without the router; whitelist bypass; LiFi user-supplied calldata sending output elsewhere.

Result: no user-exploitable finding.

• Adapters are onlyProxy (address(this) must differ from the deployed implementation), so swap only runs via the router's delegatecall. Markets and adapters are checked against WhitelistManager (MARKET / ADAPTER). Flash callbacks use a transient store that is cleared after one use.
• TermMaxSwapAdapter exact-in passes minTokenOut=0 to each order and then reverts if the sum is below netTokenAmt. A sandwich on one order can only fail the user's tx, not extract protocol funds. Exact-out refunds unused input to a user-set refundAddress. Order callbacks and 4626 pools must be whitelisted.
• Aggregator adapters scale minOut with input, require 1inch spentAmount == amountIn, and measure LiFi output on the router before forwarding. A LiFi payload that pays a third party yields zero tokenOut and reverts on netAmount.
• TransferUtilsV2.safeApprove never lowers a leftover allowance. Uniswap / 1inch / Odos still pull only the amount in the current swap params, so a stale allowance does not let a third party drain the router.
• useBalanceOnchain is the intentional leftover sweep inside a multi-path tx. leverage / flashRepayFromColl can leave unused debt or collateral on the router if the caller underspends; that is the user's own leftover (or dust), not an attacker extract of protocol reserves. swapAndRepay returns remaining repay token to msg.sender.

Not submitted. Remaining TermMax adapters (Kyber, OKX, Pancake, Kodiak, vault helpers) are lower-priority copies of the same approve-and-call pattern.

2026-09-03: Strata CDO / Tranche / depositor / accounting (2be97f9)

Immunefi program strata ($250,000, kyc: true). In-scope tranche tree added 17 Jun 2026. Local clone /tmp/strata-contracts on the tranches branch. No mainnet interaction.

Files: contracts/tranches/{StrataCDO,Tranche,TrancheDepositor,Accounting,DiscreteAccounting}.sol, contracts/tranches/base/cooldown/SharesCooldown.sol, contracts/tranches/strategies/ethena/sUSDeStrategy.sol (withdraw path only).

Checked for: first-depositor inflation; burning another user’s shares as fee; cooldown finalize stealing locked shares; meta-token Ceil redeem pulling more than accounting deducts; leftover tokens on the depositor; DiscreteAccounting projected-NAV insolvency beyond the published known issue.

Result: no new user-exploitable finding.

• deposit / withdraw / cooldownShares are onlyTranche. burnSharesAsFee spends allowance when caller != owner. SharesCooldown requestRedeem is COOLDOWN_WORKER_ROLE; finalize redeems to the request owner; cancel / finalizeWithFee are onlyUser.
• Tranche uses OZ decimalsOffset plus MIN_SHARES = 0.1 ether. Meta deposit converts Floor and pulls the quoted token amount. Redeem passes a Ceil tokenAmount into the strategy, but Ethena / Saturn / Neutrl withdrawInner ignore it and size the transfer from baseAssets (previewWithdraw).
• Depositor swaps are router-and-minOut gated; leftover output is deposited in the same tx. deposit is not nonReentrant; a reenter would need an admin-listed malicious token or 4626.
• Continuous Accounting.calculateNAVSplit caps Senior’s target gain by real Junior (jrtNavT1 - ONE_ASSET) and reverts InvalidNavSplit if the pieces do not sum to navT1.
• DiscreteAccounting.calculateNAVSplitProjected still caps by projected Junior and debits real Junior (known issue 1373). The public tranches tip does not contain the cited 6aee201 real-Junior cap. Not re-reported.

Not submitted.

2026-09-03: Strata two-step config + cooldown silos (2be97f9)

Same Immunefi program (strata). Local clone /tmp/strata-contracts. No mainnet interaction.

Files: contracts/tranches/TwoStepConfigManager.sol, contracts/tranches/base/cooldown/{ERC20Cooldown,UnstakeCooldown}.sol, contracts/tranches/strategies/saturn/SaturnStrategy.sol (deposit / withdraw).

Checked for: instant fee hike; stealing another user’s cooldown balance; unstake proxy reuse paying the wrong owner; Saturn withdraw using a Ceil tokenAmount instead of baseAssets.

Result: no user-exploitable finding.

• Exit-fee increases need MIN_DELAY (1 day) and a second role to execute. Decreases apply immediately (user-friendly). Exit-mode bounds are always delayed. Caps: fee ≤ 5% ppm, lock ≤ 30 days.
• ERC20Cooldown.transfer is COOLDOWN_WORKER_ROLE and pulls from the worker (the strategy). finalize pays the request owner. Instant (cooldownSeconds == 0) sends straight to to.
• UnstakeCooldown clones a per-user handler, pulls tokens into that proxy, then request(). Reuse is same-block or slot-cap on the same recipient. finalize returns the proxy to that user’s pool. A failed finalize() leaves the request in place.
• Saturn withdrawInner sizes shares with previewWithdraw(baseAssets) and ignores tokenAmount. USDat deposits return post-fee convertToAssets(sharesReceived).

Not submitted.

2026-09-03: OpenZeppelin LimitOrderHook (2ae32be)

Immunefi program openzeppelin ($25,000, kyc: true). Asset OpenZeppelin/uniswap-hooks added 9 Oct 2025; tip commit is the zero-amount claim-redemption guard. Local clone /tmp/oz-uniswap-hooks. No mainnet interaction.

Files: src/general/LimitOrderHook.sol, src/utils/CurrencySettler.sol.

Checked for: withdrawing another user’s filled order; cancelling after fill to remove already-gone liquidity and desync claims; placing into a filled order id; fee-checkpoint dilution when adding liquidity; native-token zero-value revert (the just-fixed path); principal pro-rata over-pay.

Result: no new user-exploitable finding.

• placeOrder / cancelOrder / withdraw all key off userInfo[msg.sender].liquidity. A filled order’s map id is reset to default so a new place at the same tick gets a new id; the old filled order remains withdrawable.
• Fees accrue per liquidity unit with a re-checkpoint that keeps already-owed fees when the same owner adds more. Principal is split pro-rata and subtracted; floor dust stays in the hook (documented).
• _sendFromClaims and CurrencySettler skip amount == 0, which is the tip fix for tokens / native recipients that revert on zero-value transfers. Cancel after fill tries to modifyLiquidity on an empty position and reverts; the owner still uses withdraw.

Not submitted.

2026-09-03: OpenZeppelin ReHypothecationHook (2ae32be)

Same Immunefi program (openzeppelin). Local clone /tmp/oz-uniswap-hooks. No mainnet interaction.

Files: src/general/ReHypothecationHook.sol (seedLiquidity, addReHypothecatedLiquidity, removeReHypothecatedLiquidity, _beforeSwap / _afterSwap JIT).

Checked for: first-depositor share inflation; seeding a skewed ratio that steals later deposits; overlapping JIT + liquidity ops; third-party modifyLiquidity on the hook pool.

Result: no new user-exploitable finding.

• Seed requires totalSupply() == 0 and mints sqrt(amount0 * amount1) with a floor of 100 * 10 ** decimalsOffset(), so the virtual-share offset cannot inflate the price. Later adds price from yield-source balances (previewMint). Burns happen before withdraw.
• _beforeSwap sets a transient JIT lock and snapshots ticks; _afterSwap removes the same range. Liquidity ops revert JITLocked while that flag is set. Direct pool LP is LiquidityNotAllowed.
• Permissionless _beforeInitialize and a front-run skewed seed are documented warnings (grief / idle liquidity, assets stay redeemable). Not submitted.

2026-09-03: TruFin Solana staker deposit + whitelist (ce5d88b)

Immunefi program trufin ($20,000, kyc: true). In-scope repo TruFin-io/smart-contracts-solana-public added 25 Jun 2026. Local clone /tmp/trufin-solana. No mainnet interaction.

Files: programs/staker/src/{lib.rs,instructions/staking.rs,instructions/whitelist.rs,state/types.rs}.

Checked for: depositing without a whitelist; minting pool tokens against a fake stake pool; init_if_needed creating a self-whitelisted user PDA.

Result: no user-exploitable finding.

• WhitelistUserStatus defaults to None. Deposit’s init_if_needed still requires Whitelisted, so a fresh PDA cannot self-approve. Only an existing agent PDA can whitelist.
• Deposit CPI targets the hardcoded SPL Stake Pool program id. That program checks the pool, mint, and authorities. This wrapper has no withdraw path; redemptions go through the stake pool. Validator add/remove is access.owner.
• Permissionless deposit_to_specific_validator delaying a rebalance is documented in-source as an accepted whitelist trade-off.

Not submitted.

2026-09-03: OpenZeppelin fee + sandwich/JIT hooks (2ae32be)

Same Immunefi program (openzeppelin). Local clone /tmp/oz-uniswap-hooks. No mainnet interaction.

Files: src/fee/{BaseDynamicAfterFee,BaseHookFee}.sol, src/general/{AntiSandwichHook,LiquidityPenaltyHook}.sol.

Checked for: taking more than the unspecified surplus; leftover transient target across swaps; sandwich hook applying a target on the unprotected direction; JIT penalty taking fees from the wrong position or donating to the attacker.

Result: no new user-exploitable finding.

• BaseDynamicAfterFee stores the target in transient storage and clears it in afterSwap. Surplus vs target is taken as 6909 claims on the unspecified currency only. Exact-in fees reduce output; exact-out fees increase input.
• BaseHookFee charges a subclass percent of the unspecified amount, capped at 100%, and skips a zero unspecified delta.
• AntiSandwichHook applies the beginning-of-block target only on !zeroForOne (documented). zeroForOne returns applyTarget=false. Tick walks can OOG on large moves (documented).
• LiquidityPenaltyHook keys withheld fees by (poolId, positionKey) including sender. Penalty is linear in blocks since last add and is donated to in-range LPs. Multi-account redirect is documented and rarely profitable. CurrencySettler skips zero takes.

Not submitted.

2026-09-03: TruFin validator add/remove and rebalance (ce5d88b)

Same Immunefi program (trufin). Local clone /tmp/trufin-solana. No mainnet interaction.

Files: programs/staker/src/instructions/{validators.rs,initialize.rs}.

Checked for: a random signer increasing/decreasing validator stake; adding a validator without paying the reserve; init front-run after deploy.

Result: no user-exploitable finding.

• AddValidator / RemoveValidator require access.owner. Add transfers rent + min stake from the owner into the reserve, then CPI AddValidatorToPool on the official stake-pool program, signed by the staker PDA.
• Increase/decrease require a stake_manager PDA seeded with signer. CPI uses instruction indexes 19/20 on the official program. The live program’s one-time init front-run is documented as already closed.

Not submitted.

2026-09-03: OpenZeppelin BaseCustomCurve / BaseAsyncSwap (2ae32be)

Same Immunefi program (openzeppelin). Local clone /tmp/oz-uniswap-hooks. No mainnet interaction.

Files: src/base/{BaseCustomAccounting,BaseCustomCurve,BaseAsyncSwap}.sol.

Checked for: hook-owned 6909 claims paying a swapper more than the hook holds; exact-out async skip leaking the other pool; native msg.value refund under/over-pay; LP add/remove via the PoolManager bypassing the hook.

Result: no user-exploitable finding.

• BaseCustomAccounting blocks direct pool LP (LiquidityOnlyViaHook), checks deadline and principal slippage, and refunds unused native msg.value after verifying it covered amount0.
• BaseCustomCurve swaps take/settle 6909 claims the hook minted on add. Output size is _getUnspecifiedAmount (subclass). A bad curve can lose the hook’s own LP, not another pool’s reserves. One _poolKey per instance.
• BaseAsyncSwap only intercepts exact-in: it takes the specified amount as claims and returns a delta that nets that amount to 0. Exact-out is left to the PoolManager. Multi-pool 6909 mixing is a documented implementer warning.

Not submitted.

2026-09-03: 1inch Fusion SimpleSettlement (b68b27b)

Immunefi program 1inch-SmartContracts ($500,000, kyc: true). In-scope repo 1inch/fusion-protocol added 10 Jun 2026. Local clone /tmp/1inch-fusion. No mainnet interaction.

Files: contracts/{Settlement,SimpleSettlement}.sol.

Checked for: surplus fee exceeding remaining taking amount; whitelist matching a colliding 10-byte suffix; Dutch-auction rate bump going negative and under-charging the taker.

Result: no user-exploitable finding.

• Surplus share is only the excess of net taking over a Ceil-scaled estimate, times protocolSurplusFee (capped at 100). That extra is added to the protocol fee so the maker still receives at least the estimate.
• Whitelist compares uint80(uint160(taker)) (lowest 10 bytes) plus a time-gated list. A 2^80 collision is not a practical extract. Fills before allowedTime revert.
• Rate bump is interpolated and then reduced by a gas bump; making amount is divided by 1 + bump, taking amount is Ceil-multiplied. After the auction it is 0.
• Mainnet Settlement additionally caps tx.priorityFee vs basefee (governance spec). That can fail a fill; it does not move extra tokens.

FeeTaker itself lives in the limit-order-protocol dependency and was not re-reviewed here.

Not submitted.

2026-09-03: 1inch Fusion whitelist / PowerPod / KycNFT (b68b27b)

Same Immunefi program (1inch-SmartContracts, $500,000, kyc: true). Local clone /tmp/1inch-fusion. Delegation parents from 1inch/delegating tag 1.1.0 (ebd1a17). No mainnet interaction.

Files: contracts/{WhitelistRegistry,CrosschainWhitelistRegistry,PowerPod,KycNFT}.sol; 1inch/delegating contracts/{FarmingDelegationPlugin,TokenizedDelegationPlugin,DelegationPlugin,DelegatedShare}.sol.

Checked for: on-chain registry gating Fusion fills; flash-loan register then settle; _clean skipping a swapped-in address; permissionless promote impersonating a resolver; PowerPod balanceOf inflation; KycNFT mint/transfer without an owner signature.

Result: no user-exploitable finding.

• Fusion fills do not read WhitelistRegistry. SimpleSettlement gates on the order-packed 10-byte list plus KycNFT / access-token balance (already reviewed). Register / clean / promote only change an off-chain resolver roster and per-chain worker hints.
• register requires balance * 10000 >= totalSupply * threshold and balance > 0. register then _cleans anyone now under the threshold. clean is permissionless. Threshold changes are owner-only and do not evict until clean.
• _clean uses AddressSet swap-remove: on eviction it decrements length and re-checks the same index. Tests cover mixed burns.
• promote does not require whitelist membership. getPromotees only maps current whitelist members, so a stale mapping is invisible after eviction.
• PowerPod itself disables transfer / transferFrom / approve. balanceOf is minted to the delegatee from st1INCH plugin balances. DelegatedShare mint/burn is onlyOwnerPlugin. A flash-loan of PowerPod is not possible; staking 1INCH has a lock. Even a temporary register would not open a Fusion fill.
• KycNFT mint and transferFrom are owner-only or EIP-712-signed by the owner. _update bumps nonces[tokenId] and enforces one token per address. safeTransferFrom goes through the overridden transferFrom. Burn: owner any id, holder their own. No public mint path.

Not submitted.

2026-09-03: 1inch FeeTaker / AmountGetterWithFee (4.3.2 / 67c56ae)

Same program. In-scope repo 1inch/limit-order-protocol. Fusion depends on npm 4.3.3; git’s latest 4.3.x tag is 4.3.2 (67c56ae). Local clone /tmp/1inch-lop. No mainnet interaction.

Files: contracts/extensions/{FeeTaker,AmountGetterWithFee,AmountGetterBase}.sol and the taker→maker / unwrap path in OrderMixin.sol.

Checked for: fees exceeding takingAmount under unchecked; getter vs postInteraction fee mismatch draining the maker; whitelist-discount applied only on one side; ETH unwrap leaving WETH stranded or sending unbacked ETH; extra postInteraction pulling leftover taking tokens; integrator fallback reentering a fill to steal FeeTaker inventory.

Result: no user-exploitable finding.

• _parseFeeData caps integratorShare and the whitelist discount at 100. Combined integrator + resolver fee is takingAmount * (integratorFee + resolverFee) / (1e5 + fees), which is strictly below takingAmount. Fusion’s surplus add-on is capped at 100% of the leftover, so the maker still receives at least the Ceil-scaled estimate (already reviewed).
• Getter extraData and postInteraction extraData are different extension fields. Getter whitelist is size + 10*N; Fusion postInteraction whitelist is allowedTime + size + 12*N. A builder can encode different lists; the maker signed both.
• InconsistentFee reverts if fees are non-zero but order.receiver is not FeeTaker, so tokens cannot be taken from a maker who never sent them here.
• LOP unwraps WETH to getReceiver() (FeeTaker) before postInteraction. FeeTaker then _sendEths integrator / protocol / maker. Direct WETH fills safeTransfer.
• Remaining-amount invalidation is written before transfers. Same-order reentrancy hits a reduced remaining (or ReentrancyDetected on a still-new remaining order). A different order filled from an integrator fallback cannot call rescueFunds or postInteraction (owner / LOP only) and FeeTaker never approves a spender, so leftover inventory from the outer fill is not extractable.

1inch Fusion settlement + registry + access-token + FeeTaker money path is exhausted at this commit. Remaining 1inch in-scope trees (token-plugins, farming, cross-chain-swap, Solana) are separate slices.

Not submitted.

2026-09-03: Intuition MultiVault deposit/redeem (94bddae)

Immunefi program intuition ($100,000, kyc: true, launched 8 Jul 2026). In-scope assets are live proxies (MultiVault, curves, emissions, atom wallets) plus primacy of impact. Local clone /tmp/intuition-v2. No mainnet interaction.

Files: src/protocol/{MultiVault,MultiVaultCore}.sol, src/protocol/curves/LinearCurve.sol.

Checked for: vault assets vs contract ETH insolvency after create/deposit/redeem; ghost min-share backing on atom, triple, and counter vaults; protocol/entry/exit/atom-wallet fees reserved twice or not at all; redeeming someone else's shares to a third party; batch msg.value mismatch; empty-supply inflation on LinearCurve; fee flow from a non-default curve emptying the source vault for remaining LPs.

Result: no new user-exploitable finding.

• createAtoms / createTriples require msg.value == sum(assets). Atom cost is atomCreationProtocolFee + minShare; triple cost is tripleCreationProtocolFee + 2 * minShare. Those minShare units back ghost shares on the default Linear curve (1:1 previewMint). Counter triple gets the second minShare.
• Subsequent deposits add assetsAfterFees to the chosen curve. Protocol and atom-wallet fees stay as contract ETH for sweep/claim. Entry fee and triple atom-fraction go to the default curve via _increaseProRataVaultAssets, and only once default shares are above feeThreshold.
• Redeem subtracts convertToAssets(shares) from the source vault, pays the user net of protocol+exit, and (if above threshold) adds the exit fee to the default curve. Remaining source LPs keep the pre-redeem price; the fee ETH is re-attributed, not double-spent.
• Ghost minShare cannot be burned (remainingShares < minShare reverts). LinearCurve empty-supply deposit is shares = assets; create/init never leave totalShares = 0 with leftover assets.
• Redeem always burns receiver's shares and sends ETH to receiver. A third party needs redemption approval and cannot redirect the payout.
• nonReentrant on create/deposit/redeem/claim. Admin fee setters are role-gated. Default-curve-must-be-created-via create paths blocks a first-depositor inflation on the pro-rata vault.
• Repo POST-MORTEM.md documents a Nov 2025 TrustBonding / VotingEscrow _supply_at underflow (PR #126). Not re-reported. Progressive / Offset curves and emissions were not reviewed in this slice.

C4 2026-03 + mitigation 2026-04 and two Diligence reports already cover this tree.

Not submitted.

2026-09-03: Sky PAS + SBEBeam (commit 947e71c / beam)

Immunefi program sky ($10,000,000, kyc: false). Newest GitHub scope added 1 Sep 2026 at sky-ecosystem/pas@947e71cd5dbaaf9c5b3840dd1b23e8e99d9a564d (BeamState, Configurator, PASMom, timelock/Timelock, timelock/Bytes32LinkedList) plus dss-flappers beam SBEBeam.sol (in-scope 17 Aug). Local clones /tmp/reviews/pas and /tmp/reviews/dss-flappers. No mainnet interaction.

Files read in full.

Checked for: an unauthorized party collapsing an unlimited rate-limit key; hop / maxChange overflow wrapping a cap increase; timelock self-call or executor bypass; linked-list pointer corruption on add/remove; SBEBeam bounds that let a facilitator halt or under/over-burn surplus.

Result: no user-exploitable finding.

• Configurator.setRateLimit locks a key as unlimited only when BeamState default is (max, 0) or the live key is already (max, 0) and default is (0, 0). If the live key is unlimited and a finite default exists, the maxAmount <= current.maxAmount clause is always true, so an authorized cBeam can drop unlimited → a tiny finite cap in one call with no hop. BeamState already documents that once cBeams are paired they can interfere and that this is assumed monitored. Trusted-role / known assumption.
• Hop applies only to increases. Decreases are always allowed. maxChange must be 0 or ≥ WAD. Multiplication current.maxAmount * maxChange / WAD is skipped when current is type(uint256).max by the unlimited-lock branch or by the <= current.maxAmount alternative.
• Timelock: schedule / execute singles revert; batch rejects targets[i] == address(this); DEFAULT_ADMIN_ROLE is revoked from the timelock itself; EXECUTOR_ROLE is address(0) (anyone after delay); pause/cancel/admin-immediate-delay match the in-file notes. Bytes32LinkedList rejects bytes32(0) and duplicates; remove updates first/last and both neighbors.
• PASMom.setOwner(0) permanently bricks onlyOwner. auth still works through a leftover authority. Admin footgun, not a user extract.
• SBEBeam.set matches its notes: kbump ≤ maxKbump and % RAY == 0, burn ≤ WAD, minHop ≤ hop ≤ 5 years, kbump / hop ≤ maxRate, tau cooldown. A facilitator (buds) can stall the burn stream by lowering throughput; governance can revive. Documented.

Not submitted.

2026-09-03: Intuition AtomWallet + OffsetProgressive + utilization (94bddae)

Same program and commit as the MultiVault deposit/redeem slice. Local clone /tmp/reviews/intuition-v2. No mainnet interaction. Covers the slices that slice left open.

Files: src/protocol/wallet/AtomWallet.sol, src/protocol/curves/OffsetProgressiveCurve.sol, src/protocol/emissions/TrustBonding.sol (ratio math only).

Checked for: 77-byte validity-window replay; unclaimed wallet owner spoof; remaining square underflow on the offset curve; utilization delta that inflates veTRUST rewards; create-cost vs progressive mint if default curve is switched.

Result: no user-exploitable finding.

• AtomWallet 77-byte signatures hash userOpHash ‖ validUntil ‖ validAfter (the v1.0.2 bind). Other lengths are malformed (fail, zero window) or plain 65-byte ECDSA (no expiry). Unclaimed owner() is always multiVault.getAtomWarden().
• OffsetProgressiveCurve._convertToAssets uses PCMath.square (not squareUp) on both edges, matching the hardening note. Slope must be even and non-zero.
• Utilization is int256. A negative epoch delta returns the configured lower bound (min 25% personal / 40% system). It does not mint extra rewards. Skip the known VotingEscrow _supply_at underflow (PR #126).
• If an admin later pointed defaultCurveId at OffsetProgressiveCurve, create cost would still charge minShare wei while vault totals credited the larger previewMint. onlyRole(DEFAULT_ADMIN_ROLE) footgun, not a user path.

Not submitted.

2026-09-03: Intuition ProgressiveCurve + emissions mint/bridge (94bddae)

Same program and commit. Local clone /tmp/reviews/intuition-v2. No mainnet interaction.

Files: src/protocol/curves/ProgressiveCurve.sol, src/libraries/ProgressiveCurveMathLib.sol, src/protocol/emissions/{BaseEmissionsController,SatelliteEmissionsController}.sol, claim budget in TrustBonding.claimRewards.

Checked for: deposit/redeem rounding that pays a later LP more than the curve holds; mint quoting cheaper than deposit; double-mint of an epoch; satellite transfer draining user TRUST; unclaimed-epoch withdraw racing a late claim.

Result: no user-exploitable finding.

• Deposit: shares = sqrt(s² + assets/½m) − s (square down, div down). Redeem: (s² − sNext²) × ½m (both squares down). Rounding leans against the taker, not toward extra assets out.
• previewMint uses squareUp(sNext) − square(s) and mulUp, so an exact-share mint quotes ≥ the deposit inverse. Slope must be even and non-zero.
• mintAndBridge is CONTROLLER_ROLE, one mint per epoch (_epochToMintedAmount[epoch] > 0 reverts), refunds excess gas. Admin withdraw / burn are DEFAULT_ADMIN_ROLE.
• Satellite transfer is CONTROLLER_ROLE (TrustBonding claim path). withdrawUnclaimedEmissions / bridgeUnclaimedEmissions require the epoch to be ≥2 epochs old (getUnclaimedRewardsForEpoch is 0 otherwise) and mark _reclaimedEmissions[epoch]. A late claim is also capped by _emissionsForEpoch remaining budget.

Intuition core + periphery money paths reviewed in this session are exhausted at 94bddae.

2026-09-03: Intuition BondingCurveRegistry + totalAssets solvency (94bddae)

Complementary pass on the same clone after the Progressive/Offset convert reviews above. Files: BondingCurveRegistry.sol, BaseCurve.sol.

Checked for: registry argument-order swap between deposit and redeem; curve ID 0; convert ignoring totalAssets so redeem pays another vault’s ETH.

Result: no user-exploitable finding.

• IDs start at 1. previewDeposit(assets, totalAssets, totalShares) vs previewRedeem(shares, totalShares, totalAssets) matches IBaseCurve. Add is owner-only.
• Progressive convert prices from share supply only. Fee ETH is routed to the default Linear vault, so a progressive vault’s totalAssets accumulates rounding dust (≥ theoretical area). Redeem subtracts the theoretical amount first; a 0.8 underflow would revert rather than spend another vault’s ETH.

Not submitted.

2026-09-03: Sky diamond-pau core + CCTP / 4626 / 7540 / OTC (1b6743a)

Immunefi program sky ($10,000,000, kyc: false). In-scope sky-ecosystem/diamond-pau dev files added 6 Jul 2026. Local clone /tmp/reviews/diamond-pau at 1b6743a. No mainnet interaction.

Files: Controller.sol, ALMProxy.sol, ALMProxyFreezable.sol, RateLimits.sol, AccessControls.sol, Beacon.sol, facets/Facet.sol, libraries/ApproveLib.sol, facets/transfer-asset/TransferAssetFacet.sol, facets/cctp/CCTPFacet.sol, facets/erc4626/ERC4626Facet.sol, facets/erc7540/ERC7540Facet.sol, facets/otc/OTCFacet.sol, facets/ethena/EthenaFacet.sol.

Checked for: fallback dispatch without a role check; allocator transferring to an arbitrary destination without a rate-limit key; CCTP mintRecipient swap; 4626 first-depositor inflation past the max exchange-rate cap; 7540 claim without a pending request; OTC claim draining the buffer without a prior send; leftover ERC20 approvals on the proxy.

Result: no user-exploitable finding.

• Controller fallback remaps msg.sig → delegateSelector and delegatecalls the wired facet. There is no ACL on the fallback; every money-moving facet function is onlyRole(ALLOCATOR_ROLE) or DEFAULT_ADMIN_ROLE. msg.sender is preserved. Beacon / updateIntegrations are admin-only. A selector can be wired only once.
• ALMProxy.doCall is CONTROLLER only. Rate-limit decrease/increase is CONTROLLER only. Unlimited keys (maxAmount == max) skip accounting.
• TransferAssetFacet.transfer burns LIMIT_ASSET_TRANSFER(asset, destination) before the proxy transfer. An unset key reverts (zero-maxAmount).
• CCTP mint recipient and fee-cap band are admin-set per domain. Allocator cannot change destination. Dual rate limits (global + domain). Approval is cleared after the burn loop. DESTINATION_CALLER == 0 is the standard permissionless-relay CCTP setting.
• 4626 deposit requires (1e36 * assets) / shares <= maxExchangeRate (admin-set) and minSharesOut. An inflated vault that mints too few shares fails the cap. Withdraw/redeem restore the deposit limit via _tryIncreaseRateLimit using assets received.
• 7540 claimDeposit / claimRedeem only require that a claim rate-limit key exists (maxAmount > 0), then mint/withdraw maxMint / maxWithdraw to the proxy. The request already consumed the request-side limit. Trusted allocator.
• OTC send pays the exchange; claim pulls the buffer balance. Next send is blocked until claimed + recharge >= sent * maxSlippage / 1e18. Counterparty, buffer, slippage, and recharge are admin parameters. First send is allowed (sentTimestamp == 0).
• ApproveLib force-approves (zero then retry). Facets reset allowance to 0 after use.
• ALMProxyFreezable is a separate proxy: ALLOCATOR_ROLE may doCall, FREEZER_ROLE may revoke. Not the Controller-owned ALMProxy used by these facets.
• Ethena mint/burn only approve the official minter (allowance is left for the off-chain mint, unlike other facets). Cooldown/unstake are allocator-gated and rate-limited. setDelegatedSigner requires the key to exist. Trusted Ethena minter + allocator.

Remaining diamond-pau facets (Aave, LayerZero, Pendle, Maple, farms, wraps, etc.) were not read.

2026-09-03: Sky emergency spells hub + stUSDS (45651a4)

Immunefi program sky ($10,000,000, kyc: false). In-scope dss-emergency-spells added 3 Jun 2025; stUSDS spells added 21 Jul 2026. Local clone /tmp/dss-emergency-spells. No mainnet interaction.

Files: src/{DssEmergencySpell,DssGroupedEmergencySpell}.sol, src/stusds/{StUsdsRateSetterHaltSpell,StUsdsWipeParamSpell,StUsdsRateSetterDissBudSpell}.sol, src/lite-psm-halt/SingleLitePsmHaltSpell.sol, src/line-wipe/SingleLineWipeSpell.sol.

Checked for: permissionless schedule halting stUSDS / wiping a line without being the governance hat; factory-deployed spells that MOM would honor; done() lying so an operator skips a still-live setter; grouped batch walking off the ilk list; cast/execute no-ops that still mutate.

Result: no user-exploitable finding.

• schedule() has no modifier. The MOM / LineMom / LitePsmMom call reverts not-authorized unless the spell is the current MCD_ADM hat (integration tests write hat() to the spell, then hat() = 0 reverts). A factory deploy() creates a new unhatted spell; poking it does nothing to production.
• Once lifted as hat, anyone may poke schedule(). That is the documented emergency-spell model, not an extract.
• cast / execute / actions are no-ops. GSM delay (eta = 0) is unused because actions run in schedule.
• done() returns true when wards are missing or a try call reverts, so the UI treats an unwired MOM as finished. It does not change parameters.
• Grouped emergencyActionsInBatch caps end and requires start <= end. Same hat check on each ilk.

Not submitted.

2026-09-03: Sky emergency clip / OSM / DDM / splitter / SPBEAM (45651a4)

Same Immunefi program (sky) and clone /tmp/dss-emergency-spells. No mainnet interaction. Completes the in-scope emergency-spell tree after the hub + stUSDS / lite-psm / line-wipe pass.

Files: src/clip-breaker/{Single,Grouped,Multi}ClipBreakerSpell.sol, src/osm-stop/{Single,Multi}OsmStopSpell.sol, src/ddm-disable/SingleDdmDisableSpell.sol, src/splitter-stop/SplitterStopSpell.sol, src/spbeam-halt/SPBEAMHaltSpell.sol, src/line-wipe/MultiLineWipeSpell.sol.

Checked for: a multi-ilk batch that skips the hat check; setBreaker / stop on address(0) moving funds; swallowing not-authorized so an unhatted poke still halts some ilks; empty-registry count() - 1 underflow used as a range.

Result: no user-exploitable finding.

• Single / grouped clip, OSM, DDM, splitter, and SPBEAM all call the matching MOM. Integration tests for the hub already show MOM reverts not-authorized unless the spell is the MCD_ADM hat. Factories deploy unhatted copies that cannot mutate production.
• Multi clip / OSM catch per-ilk failures and require if the reason is ClipperMom/not-authorized or osm-mom/not-authorized, so an unhatted poke cannot silently skip the auth check. Other reasons emit Fail and continue (gas-limit escape hatch).
• Multi line wipe does not swallow: lineMom.wipe reverts the whole schedule if the hat is missing. Ilks with lineMom.ilks(ilk) == 0 are skipped.
• xlip / osms / plan of address(0) makes done() true and the MOM call would revert, not move tokens.
• Batch helpers use maxEnd = count() - 1. An empty registry underflows maxEnd; list(start, end) then depends on the registry and is a poke DoS, not an extract. Live MCD ilk count is not zero.

dss-emergency-spells at 45651a4 is exhausted.

Not submitted.

2026-09-03: Sky diamond-pau Aave / LayerZero / Pendle / UniV3 (1b6743a)

Same Immunefi program and clone as the earlier diamond-pau core slice. No mainnet interaction.

Files: facets/aave/AaveFacet.sol, facets/aave-v4/AaveV4Facet.sol, facets/layer-zero/LayerZeroFacet.sol, facets/pendle/PendleFacet.sol, facets/uniswap-v3/UniswapV3Facet.sol.

Checked for: a malicious aToken/spoke that redirects the approve; LayerZero send to an unset or attacker recipient; Pendle redeem through an aggregator swap; UniV3 swap without a TWAP bound; first-depositor / deficit purchase on Aave v4.

Result: no user-exploitable finding.

• Aave v3 deposit requires admin maxSlippage and burns LIMIT_AAVE_DEPOSIT(underlying, pool, aToken). Pool and underlying come from the aToken. Withdraw measures underlying received and restores the deposit limit. Allocator-only.
• Aave v4 additionally requires hub.getAssetDeficitRay(assetId) <= maxDeficits (default 0, so any deficit blocks until governance opts in). Position change is read from getUserSuppliedAssets, not the return tuple. Withdraw rate-limit key omits hub/asset so a remapped reserve can still exit.
• LayerZero recipient is admin-set per dstEid. In-file note: keep the rate limit at zero until OFT integration tests land. minAmountLD floors to decimalConversionRate. Quote is a proxy staticcall. send refunds fees to the proxy; leftover controller ETH is swept. Approval cleared when approvalRequired.
• Pendle redeem only on isExpired markets, with SwapType none (no ext router). minTokenOut is pyAmountIn * 1e18 / pyIndexCurrent - 5, plus the allocator's minAmountOut. In-file: do not use non-standard SYs without extra tests.
• UniV3 swap requires TWAP seconds, a tick-delta cap, and minAmountOut. Liquidity mint/increase goes to the proxy NFT; remove checks ownership and slippage vs admin maxSlippage. Aggregate rate limits assume pegged stables (documented).

Not submitted.

2026-09-03: Sky diamond-pau Maple / farms / wraps / Curve / PSM (1b6743a)

Same Immunefi program (sky) and clone /tmp/diamond-pau at 1b6743a. No mainnet interaction. Aave / LayerZero / Pendle / UniV3 / Aave V4 were logged in the prior entry.

Files: src/facets/maple/MapleFacet.sol, src/facets/farm/FarmFacet.sol, src/facets/wsteth/WSTETHFacet.sol, src/facets/weeth/WEETHFacet.sol, src/facets/wrap-proxy-eth/WrapProxyETHFacet.sol, src/facets/curve/CurveFacet.sol, src/facets/psm/PSMFacet.sol.

Checked for: Maple cancel restoring request capacity so a second redemption could exceed the request limit; farm getReward sending rewards off-proxy; wstETH/weETH claim paying a caller-chosen owner; Curve slippage mins that do not bind the pool call; leftover approvals; PSM fill loop that credits a partial swap.

Result: no user-exploitable finding.

• Maple requestRedemption burns LIMIT_MAPLE_REQUEST_REDEEM by convertToAssets(shares) before requestRedeem(shares, proxy). Cancel only requires that a cancel key exists (same pattern as 7540 claim) and does not restore the request limit.
• Farm deposit/withdraw burn their keys; claimReward only requires the claim key exists. getReward is called on the farm; the delta is measured on rewardsToken at the proxy.
• WSTETH unwraps WETH then doCallWithValue(wsteth, "", amount) (expects a payable submit/wrap). Request burns the stETH-equivalent; claim requires the claim key and wraps received ETH to WETH on the proxy. WEETH deposit checks minSharesOut. Withdraw requestWithdraw pays the eETH to a weethModule authorized by the rate-limit key, then claim is module-gated the same way. WrapProxyETHFacet.wrapAll wraps the proxy's full ETH balance if the wrap key exists.
• Curve swap/add/remove require admin maxSlippage and compare mins to stored_rates / get_virtual_price. Unseeded pools (virtualPrice == 0) cannot be deposited into. Rate limits run after the pool call (swap vs deposit split on add). PSM USDS↔USDC is 1:1 through immutable daiUSDS + lite PSM; the fill loop reverts if rush() is 0 before the full amount is swapped. DAI/USDC/USDS approvals are reset.

Not submitted.

2026-09-03: Sky diamond-pau UniV4 / DualPool / PSM3 / remaining facets (1b6743a)

Same Immunefi program (sky) and clone /tmp/diamond-pau at 1b6743a. No mainnet interaction. Completes the in-scope facet tree after the Aave/LZ/Pendle and Maple/farms/wraps/Curve/PSM passes.

Files: src/facets/uniswap-v4/UniswapV4Facet.sol, src/facets/dual-pool/DualPoolFacet.sol, src/facets/psm3/PSM3Facet.sol, src/facets/dai-usds/DAIUSDSFacet.sol, src/facets/usds/USDSFacet.sol, src/facets/basin/BasinFacet.sol, src/facets/centrifuge/CentrifugeFacet.sol, src/facets/spark-vault/SparkVaultFacet.sol, src/facets/superstate/SuperstateFacet.sol, src/facets/merkl/MerklFacet.sol, src/facets/nfat-halo/NFATHaloFacet.sol, src/facets/nfat-prime/NFATPrimeFacet.sol, src/facets/weeth/WEETHModule.sol.

Checked for: a fabricated UniV4 PoolKey that bypasses slippage/rate limits; DualPool hook return values that under-report spend; PSM3/Basin receiver other than the proxy; Centrifuge transfer to a caller-chosen recipient; Merkl toggleOperator for an unlisted operator; NFAT Halo issue that credits gem off-proxy; leftover Permit2 allowances; WEETH claim sweeping the wrong recipient.

Result: no user-exploitable finding.

• UniV4 mint/increase require admin tick limits and hooks == 0. NFT recipient is the proxy. Increase checks ownerOf == proxy. Decrease sends TAKE_PAIR to the proxy; PositionManager still gates who can modify a tokenId. Swap hashes the caller PoolKey to poolId; a fabricated key has no maxSlippage and reverts. Permit2 allowances are set to block.timestamp then cleared.
• DualPool measures spend/receipt by proxy balance diffs, not hook return values. Deposit requires previewWithdraw(shares) value ≥ paid × maxSlippage. Withdraw requires allocator mins ≥ preview × slippage (governance floor if the allocator is compromised). Unset poolId reverts.
• PSM3 deposit/withdraw receiver is the proxy. Immutable psm. Rate limits per asset. Basin is the same shape plus minSharesOut / minConversionRate. DAIUSDS is 1:1 through immutable daiUSDS. USDS mint draws to the admin-set vault buffer then transferFroms to the proxy; burn is the reverse and restores the mint key.
• Centrifuge cancel/claim only require that the matching key exists. transferShares pays the admin recipients[centrifugeId] via the vault's spoke. Request id is always 0 (documented).
• SparkVault take burns LIMIT_SPARK_VAULT_TAKE then takes into the proxy. Superstate subscribe is USDC→USTB on immutable addresses and clears the USDC allowance. Merkl toggleOperator requires a (distributor, operator) key; user is the proxy.
• NFAT Halo issue measures gem received on the proxy; to is the facility NFT recipient and is part of the issue rate-limit key. One tokenId per facility. Interest is capped by admin maxAnnualGrowthRate. Repay spends from the proxy and clears allowance. Prime subscribe/withdraw/ collect rate-limit actual gem deltas; data is allocator-chosen on a key-gated facility.
• WEETHModule.claimWithdrawal is proxy-only, requires a valid finalized request, wraps ETH, and transfers WETH to the proxy.

diamond-pau facet sources at 1b6743a are exhausted.

Not submitted.

2026-09-03: Intuition TrustSwapAndBridgeRouter (bb34cc2)

Immunefi program intuition (in-scope Base asset 0xE485D9a5Dc39774b7A80864B625969Cf9d93E5D7). Source is not in intuition-contracts-v2; local clone /tmp/intuition-periphery (0xIntuition/intuition-contracts-v2-periphery bb34cc2). Repo README lists Base 0xA1EC6f95A88Bfc7A8Fd35f1296b64ebaf91C93fb. Reviewed this tree only. No mainnet interaction.

Files: contracts/TrustSwapAndBridgeRouter.sol.

Checked for: a path that does not end in TRUST but still bridges; swap output sent to the caller; bridge fee quoted on minTrustOut while a larger amountOut is sent; ETH-path refund of another user's leftover; missing receive so Slipstream refundETH DoS (known S-324); leftover allowance used against a later user.

Result: no user-exploitable finding.

• ETH and ERC20 swaps require the packed path to start with WETH/tokenIn and end with TRUST. Each hop must exist in the Slipstream CL factory. tokenIn cannot be TRUST. Swap recipient is this router; Metalayer recipient is the caller-chosen dest. nonReentrant.
• exactInput enforces amountOutMinimum: minTrustOut. Bridge fee is quoted on minTrustOut (ETH/ERC20) or the exact trustAmount (direct bridge). If the hub fee scales with amount and amountOut > minTrustOut, transferRemote reverts. Successful txs send the received TRUST.
• ERC20/direct-bridge refund msg.value - fee to msg.sender. ETH swap spends msg.value - fee as WETH in; Slipstream refundETH dust stays on this router (receive()). Tests document that leftover (S-324 was a SwapRouter contamination DoS, now accepted via receive). No sweep; dust is not an extract.
• Allowances use safeIncreaseAllowance to the immutable official router/hub. No third-party spender.

Not submitted.

2026-09-03: Origin OUSD vault + Curve AMO (4fa0602)

Immunefi program originprotocol ($1,000,000, kyc: false). OUSD Token / Vault / Curve AMO were added to scope on 1 Sep 2026 (etherscan assets; source in Origin Dollar). Local clone /tmp/origin-dollar at 4fa0602. No mainnet interaction. Continues the earlier Origin strategy / bridge slices.

Files: contracts/contracts/vault/VaultCore.sol, contracts/contracts/vault/OUSDVault.sol, contracts/contracts/strategies/CurveAMOStrategy.sol.

Checked for: a user mint that credits more OUSD than assets pulled; claiming another account's withdrawal; mintForStrategy from a non-whitelisted caller; Curve AMO withdraw that transfers more hard asset than removed; strategist rebalance that worsens the peg without the solvency floor.

Result: no user-exploitable finding.

• mint scales the asset to 18 decimals, mints that many OTokens, then safeTransferFroms the asset. whenNotCapitalPaused + nonReentrant. Auto-allocate only above autoAllocateThreshold, after the withdrawal queue is filled.
• mintForStrategy / burnForStrategy require both strategies[msg.sender].isSupported and isMintWhitelistedStrategy. Curve AMO is the intended caller. No nonReentrant (documented AMO reentry during allocate); user mint/redeem cannot be wired to those strategies in production.
• Async withdraw burns OUSD on request (1:1, asset decimals in queued). Claim requires the requester, the delay, queued <= claimable, and not already claimed. _postRedeem rejects if |supply/value - 1| > maxSupplyDiff. Rebase is operator/strategist/governor and only increases supply up to vault value, with a trustee fee on yield.
• Curve AMO deposit/withdraw are onlyVault. Deposit mints OUSD between 1× and 2× the hard asset to rebalance, then add_liquidity with maxSlippage. Withdraw computes LP from the pool hard-asset share, requires min[hardAsset] = amount, burns all OUSD left on the strategy, transfers exactly _amount. Strategist one-sided adds/removes use improvePoolBalance (must move the hardAsset−OUSD diff toward zero without overshoot) and _solvencyAssert (≥ 99.8% backed).

Leather was not started: the program requires a working PoC against the current published extension/app build and forbids theoretical reports.

Not submitted.

2026-09-03: Origin WOETH / WOUSD + Ethena ARM (4fa0602 / 2322537)

Immunefi program originprotocol ($1,000,000, kyc: false). Wrapped Super OETH (Base wsuperOETHb) and Ethena ARM / Aave market / Unstaker were added Jul–Aug 2026. Local clones /tmp/origin-dollar 4fa0602 and /tmp/arm-oeth 2322537. No mainnet interaction.

Files: contracts/contracts/token/{WOETH,WOETHBase,WrappedOusd}.sol, src/contracts/{AbstractARM,EthenaARM,EthenaUnstaker}.sol, src/contracts/adapters/EthenaAssetAdapter.sol, src/contracts/markets/Abstract4626MarketWrapper.sol.

Checked for: a WOETH donation that inflates convertToAssets; wrapping that ignores the rebase adjuster; an ARM swap of an unlisted pair; claiming another LP's redeem; adapter redeem that sends USDe off-ARM; a non-ARM deposit into the Aave 4626 wrapper.

Result: no user-exploitable finding.

• WOETH is ERC-4626 over rebasing OETH. totalAssets / convertToShares / convertToAssets use adjuster and rebasingCreditsPerTokenHighres(), not the live OETH balance, so later donations are ignored. initialize2 snapshots adjuster once (1e27 if supply is 0). Governor transferToken cannot collect the core asset. WOETHBase / WrappedOusd only change name/symbol.
• ARM swaps are USDe ↔ a configured base (sUSDe) with operator prices and remaining-liquidity caps. nonReentrant + whenNotPaused. Output is paid after transferFrom. Buy-side fees accrue from realized gain × fee. Two-token Uniswap-v2 path only.
• LP deposit pulls USDe then mints assets * supply / netAssets. Floor + live LPs reverts Insolvent. Redeem escrows shares, FIFO queued <= claimable(), delay, min(request-time, claim-time) assets. Operator may claim for the requester. Dead shares + MIN_LIQUIDITY block empty-supply donation.
• EthenaAssetAdapter.requestRedeem / redeem are onlyARM. Cooldowns rotate across 42 unstakers; claimUnstake sends USDe to the ARM. The 4626 market wrapper deposit/withdraw require msg.sender == receiver == arm. allocate() is permissionless but only moves USDe between the ARM and that wrapper.

Not submitted.

2026-09-03: Lombard SVM asset_router / bridge / bascule / mailbox (09d5e76)

Immunefi program Lombard Finance ($250,000, kyc: true). Solana trees added 25 Jun 2026. Local clone /tmp/reviews/lombard-svm at 09d5e76. No mainnet interaction. Reviewed only the money-moving mint/burn/GMP paths in the in-scope programs.

Files: programs/asset_router/src/instructions/{deposit,redeem,redeem_for_btc,mint_from_payload,mint_with_fee,gmp_receive}.rs, programs/asset_router/src/utils/{mod,fee,consortium_payloads,ed25519}.rs, programs/bridge/src/instructions/{deposit,gmp_receive}.rs, programs/bascule/src/instructions/validator.rs, programs/bascule_gmp/src/instructions/validate_mint.rs, programs/mailbox/src/instructions/{deliver_message,handle_message,send_message}.rs, programs/consortium/src/instructions/finalize_session.rs.

Checked for: a replayed consortium payload that mints twice; GMP mint of a caller-chosen mint; mailbox deliver without a validated payload; bascule below-threshold bypass of consortium; fee signature that is not the recipient owner; bridge inbound without a remote-bridge sender match.

Result: no user-exploitable finding.

• mint_from_payload / mint_with_fee require a consortium ValidatedPayload PDA for sha256(payload), destination CHAIN_ID, native mint, and recipient-account match. Replay is an init PDA (DEPOSIT_PAYLOAD_SPENT). Bascule is extra: above threshold the deposit must already be Reported; below threshold it is marked Withdrawn without a report (documented). Consortium attestation is the mint gate.
• mint_with_fee is Claimer-gated. The fee payload is Ed25519-checked against the token-account owner via the previous native ed25519 ix (offsets must live in that ix). Fee is min(signed, max_mint_commission) and minted to the treasury; remainder to the recipient.
• Asset-router deposit / redeem / redeem_for_btc burn (and optionally fee-transfer) the payer’s own tokens, then mailbox-send. Routes are PDA-bound.
• Asset-router gmp_receive requires the mailbox MessageV1Info PDA as signer, sender BTC_STAKING_MODULE_ADDRESS, recipient match, and a MESSAGE_HANDLED init PDA. Optional bascule_gmp validate_mint same threshold pattern.
• Bridge deposit is sender-whitelist + outbound direction. gmp_receive requires mailbox signer, remote_bridge_config.bridge == message.sender, inbound direction, and consumes the inbound rate limit. Recipient may be the message pubkey or its ATA.
• Mailbox deliver_message inits the message PDA only when consortium has both the session payload and ValidatedPayload for that hash. handle_message flips Delivered→Handled then CPI-signs as the message PDA. inbound_message_path on deliver is program-owned (admin-created), matched by identifier.
• Consortium finalize_session requires session.weight >= current_weight_threshold then init_if_needed the hash PDA. Trusted notary set.

Remaining in-scope SVM (not read this pass): lombard_token_pool, ratio_oracle, mailbox admin / path enable, consortium valset update.

Not submitted. Payouts need Immunefi KYC.

2026-09-03: Leather wallet provider + extension RPC (eca229c)

Immunefi program leather ($5,000, kyc: true, immunefiStandard: false, safeHarbor unset / false). Web/app only. Assets: leather-io/mono (added 13 Jul 2026), leather.io (primacy of impact), Chrome extension, iOS, Android, app.leather.io, api.leather.io. Local clone /tmp/leather-mono on dev at eca229c (2026-09-02). No live wallet, extension, or API testing. No exploit or reproduction steps written.

Program rules that bound this pass: reports need a working PoC against the current published Chrome / App Store build; theoretical or AI-only reports are closed; pre-release / unreleased code is out of scope; third-party dApps and protocol-level Bitcoin/Stacks bugs are out of scope; on-chain metadata spoofing is out of scope unless it becomes code execution or a signing bypass.

Files: apps/extension/src/content-scripts/content-script.ts, apps/extension/src/background/background.ts, apps/extension/src/background/messaging/{rpc-message-handler,rpc-request-utils,methods-requiring-connected-wallet}.ts, apps/extension/src/background/messaging/internal-methods/message-handler.ts, apps/extension/src/background/messaging/rpc-methods/{get-addresses,sign-psbt}.ts, apps/extension/src/shared/{messages,permissions/permission.helpers,crypto/mnemonic-encryption,messaging/send-message-to-originating-frame,utils/urls}.ts, apps/extension/src/app/common/psbt/use-psbt-request-params.ts, apps/extension/src/app/features/psbt-signer/hooks/use-psbt-details.tsx, apps/extension/src/app/pages/rpc-sign-psbt/use-rpc-sign-psbt.tsx, packages/provider/src/{injected-provider,mobile}.ts, apps/web/tests/xss-protection.spec.ts, apps/extension/tests/specs/rpc-get-addresses/rpc-cross-origin-frame.spec.ts.

Checked for: a page that can drive another origin’s granted permissions; a sign/broadcast path that skips the approval popup; approval UI that is not derived from the same PSBT hex that is signed; mnemonic plaintext leaving the encrypt/decrypt helpers; internal background methods callable from a content script; HTML injection from CMS/metadata.

Result: no submittable finding.

• Content-script → background uses chrome.runtime.connect named CONTENT_SCRIPT_PORT. Origin is port.sender.url / port.sender.origin (Chromium/Firefox), not a page-supplied string. Responses go to {tabId, frameId} via chrome.tabs.sendMessage.
• Signing methods sit in methodsRequiringConnectedWallet and open a popup. getAddresses / stx_getAddresses also open a popup and do not auto-return addresses.
• Internal background handler requires sender.url to start with chrome.runtime.getURL('').
• Permissions are keyed by hostname (localhost keeps the port). That is weaker than a full origin key, but without a working PoC against the published build it is theoretical and the program closes those.
• PSBT approval reads hex from the popup search params that the background copied from the validated request, then signs that same hex. Inputs/outputs come from @scure/btc-signer parse of that hex. Cross-origin iframes get an explicit callout (rpc-cross-origin-frame.spec.ts).
• Mnemonic encrypt/decrypt uses Stacks encryption + Argon2 salt; no extra log of the secret in those helpers. Background logger.info of the RPC envelope is verbose, not a key leak.
• v0.5.2-style XSS coverage on the marketing web app is a Playwright sanitizer check, not a wallet signing surface.

Not submitted. A valid Leather report would still need the participant to reproduce against the live store build; this agent will not write that PoC.

2026-09-03: OpenZeppelin Confidential Contracts v0.5.3 (4a4f6c7)

Immunefi program openzeppelin ($25,000, kyc: true). Confidential-contracts asset added 18 Aug 2026: only release v0.5.3 (4a4f6c71f58b75e391899b57e42e3b73d288dfe3). Local clone /tmp/oz-confidential at that tag. Library scope: loss of funds, permanent DoS, access-control bypass, unintended behavior. Best-practice critiques out of scope. No mainnet interaction.

v0.5.3 itself only extracts BatcherConfidential.quit into _quit(batchId, account) so a derived contract can quit on behalf of a depositor. Public quit still uses msg.sender.

Files: contracts/finance/BatcherConfidential.sol, contracts/token/ERC7984/ERC7984.sol, contracts/token/ERC7984/extensions/{ERC7984ERC20Wrapper,ERC7984Rwa,ERC7984Freezable}.sol, contracts/token/ERC7984/utils/ERC7984Utils.sol, contracts/finance/VestingWalletConfidential.sol, contracts/utils/{FHESafeMath,HandleAccessManager}.sol.

Checked for: unwrap/finalize that pays a different account or amount than the burned ciphertext; join that credits without a matching confidential transfer; claim/quit that drains another depositor; RWA recovery or force-transfer callable without AGENT_ROLE; receiver hook that forges an ebool the recipient does not own; vesting release of unvested handles.

Result: no user-exploitable finding.

• onConfidentialTransferReceived requires msg.sender == fromToken. Join amount is the encrypted transfer; overflow uses tryIncrease and joins 0.
• dispatchBatchCallback finalizes the stored unwrap request or, if already finalized, re-checks the decryption proof against that request’s handle. Cancel rewraps unwrapAmountCleartext * rate of fromToken. Partial forbids a change in underlying toToken balance. Exchange rate uses this batch’s toToken underlying balance; leftover wrap dust is documented to roll into the next batch.
• Public claim / quit are nonReentrant. _claim / _quit are documented as needing that guard. Permissionless claim-for is documented and sends to the depositor.
• Wrapper wrap pulls amount - amount % rate then mints amount / rate. Unwrap burns first, request id is the ciphertext (assert unique), finalizeUnwrap deletes the request then transfers cleartext * rate after FHE.checkSignatures. Fee-on-transfer underlying is documented unsupported. Donating underlying can inflate inferredTotalSupply and grief wraps — known, documented.
• ERC7984 transfers require ACL on ciphertext amounts; operators are time-bounded. Transfer-and-call refund is documented best-effort if the receiver drains itself in the hook. Receiver ebool must be uninitialized or ACL-owned by to (v0.5.2).
• RWA mint/burn/freeze/force/recover are onlyAgent. Force/recover bypass pause and restriction via selector allowlist, not frozen amounts (ERC7984Freezable still clamps).
• Vesting release transfers releasable then adds amountSent to released. Handle ACL on the token is checked (v0.5.2). HandleAccessManager defaults _validateHandleAllowance to false.
• FHESafeMath treats uninitialized as 0; add/sub detect wrap via comparison.

Not submitted. Payouts need Immunefi KYC.

2026-09-03: Money on Chain V2 core + queue + V4 swapper (d770477)

Immunefi program moneyonchain ($10,000, kyc: true). GitHub asset money-on-chain/stable-protocol-core-v2 added 8 Jul 2026; many Rootstock addresses added 20 Aug 2026. Local clone /tmp/moneyonchain at d770477. Known-issues gist nubis/9c24c0e2792e4dbb25db74f8f478756f already lists SP-01–SP-24 on this tree (stale-price queue, liquidation AMM bounds, reverse-auction oracle flag, flux-capacitor TP/TP, RC20 callback refresh, locked-fund refunds, etc.). This pass looked only for a new extract path. No mainnet interaction.

Files: contracts/core/MocOperations.sol, contracts/core/MocBaseBucket.sol (checkRecipient, unlock accounting), contracts/queue/MocQueue.sol (execute + failed-op unlock), contracts/multiCollateral/swapper/MocSwapperV4.sol.

Checked for: queue execute callable by a non-queue caller; mint that credits without locking AC/TC/TP; recipient override when _allowDifferentRecipient is false; unlock that returns more than qACmax; V4 swapper that sends the contract’s leftover balance or skips amountOutMin.

Result: no new user-exploitable finding.

• Enqueue mint/redeem is notLiquidated notPaused checkRecipient. _checkRecipient reverts RecipientMustBeSender unless the bucket allows a different recipient. TP lock calls _tpi so only registered pegged tokens enter the queue.
• execMintTC / redeem / swap are onlyMocQueue. Failed mint unlocks params.qACmax via unlockACInPending (onlyMocQueue); a failing AC refund is recorded in senderLockedFunds (known SP-18, no self-serve recover).
• MocSwapperV4 is a permissionless exact-in/exact-out Uniswap v4 wrapper. It spends the caller’s tokens, checks balanceInAfter == before - amountIn (exact in) or balanceOutAfter == before + amountOut (exact out), and transfers only the swap delta (exact in) or the requested out plus surplus in (exact out). Pool fee/hook/tick maps are governor-set. Matches the documented V3 “no leftover sweep of whole balance” pattern; not a new extract.

Duplicates of SP-01–SP-24 were not re-filed.

Not submitted. Payouts need Immunefi KYC.

2026-09-03: Origin Aerodrome / Base Curve / Hydrex AMOs + OETH zapper + Safe modules (4fa0602)

Immunefi program originprotocol ($1,000,000, kyc: false). superOETHb Sep-1 assets continue from the OUSD vault / Curve AMO and WOETH slices. Local clone /tmp/origin-dollar at 4fa0602. No mainnet interaction.

Files: contracts/contracts/strategies/aerodrome/AerodromeAMOStrategy.sol, contracts/contracts/strategies/BaseCurveAMOStrategy.sol, contracts/contracts/strategies/hydrex/OETHbHydrexAMOStrategy.sol, contracts/contracts/strategies/algebra/StableSwapAMMStrategy.sol, contracts/contracts/zapper/{AbstractOTokenZapper,OETHZapper,OETHBaseZapper}.sol, contracts/contracts/automation/{AbstractSafeModule,CollectXOGNRewardsModule,ClaimStrategyRewardsSafeModule,ClaimBribesSafeModule}.sol.

Checked for: a user deposit that mints unbounded OETHb; withdraw that sends WETH off-vault; CL decrease with zero mins that a non-strategist can sandwich; zapper mint that credits more than ETH/WETH pulled; Safe module that moves tokens to a non-Safe address.

Result: no user-exploitable finding.

• Aerodrome AMO deposit / withdraw / withdrawAll are onlyVault + nonReentrant. Withdraw recipient must be the vault. rebalance is onlyGovernorOrStrategist. _addLiquidity mints OETHb via mintForStrategy to match the Sugar estimate, then burns leftovers. Position is valued at the 1:1 tick (_wethAmount == 0); leftover WETH/OETHb on the strategy still count in vault totalValue. DecreaseLiquidity uses amount0Min/amount1Min = 0 (trusted strategist); _checkForExpectedPoolPrice gates ticks and the configured WETH-share interval; _solvencyAssert requires vault value / supply ≥ 99.8%.
• Base Curve AMO is the WETH/OETH twin of CurveAMOStrategy: vault-only deposit mints between 1× and 2× OETH, add_liquidity with maxSlippage, then gauge-stakes. Withdraw computes LP from the pool WETH share, requires min[WETH] = amount, burns leftover OETH, transfers exactly _amount. Strategist one-sided mintAndAddOTokens / removeAndBurnOTokens / removeOnlyAssets use improvePoolBalance + _solvencyAssert.
• Hydrex AMO is a thin GaugeV2 stakeToken() wrapper over StableSwapAMMStrategy. Vault-only deposit mints OToken in pool-reserve proportion (nearBalancedPool + skimPool), withdraw burns leftover OToken and requires enough asset removed. Same 99.8% solvency floor. withdrawAll skips solvency for emergency gauge exit.
• OETHZapper / OETHBaseZapper wrap ETH or pull WETH, vault.mint the zapper’s full WETH balance, require minted ≥ ETH/WETH in, then optionally ERC-4626 wrap with minReceived. Leftover donated WETH/ETH goes to the next caller, not an extract.
• Safe modules: DEFAULT_ADMIN_ROLE is the Safe. transferTokens is onlySafe and only pays the Safe. CollectXOGNRewardsModule operator can only collectRewards and send the OGN delta to a hardcoded rewards source. Strategy/bribe claimers only execTransactionFromModule collect selectors on a Safe-owned veNFT / whitelisted strategy list.

Remaining Origin after the AMO pass was WETH/USDC/Lido ARM (logged next) and CrossChain master/remote (also logged this turn). xOGN remains.

Not submitted.

2026-09-03: Origin WETH / USDC / Lido ARM adapters (2322537)

Immunefi program originprotocol ($1,000,000, kyc: false). WETH ARM stETH/wstETH/eETH/weETH adapters, USDC ARM PYUSD/USDG (Paxos) adapters, Lido ARM, and ARM zappers were listed separately from Ethena ARM. Local clone /tmp/arm-oeth at 2322537. No mainnet interaction. AbstractARM swap / LP deposit / FIFO redeem was already reviewed with Ethena ARM; this pass is the adapter + zapper delta. HyperEVM CrossChain Master/Remote is the same CCTP tree already logged.

Files: src/contracts/{LidoARM,MultiAssetARM,ZapperARM,ZapperLidoARM}.sol, src/contracts/adapters/{AbstractLidoAssetAdapter,StETHAssetAdapter,WstETHAssetAdapter,EtherFiAssetAdapter,WeETHAssetAdapter,PaxosAssetAdapter}.sol.

Checked for: a non-ARM caller that opens or claims a withdrawal; redeem that sends WETH/USDC off-ARM; Ether.fi permissionless claim that burns the NFT and leaves ETH elsewhere; Paxos submit that pays a caller-chosen recipient; zapper mint of more shares than ETH wrapped.

Result: no user-exploitable finding.

• Lido / Ether.fi / Paxos requestRedeem / redeem are onlyARM. Lido FIFO-claims only a finalized prefix owned by the adapter, wraps all ETH, and transfers all WETH to the ARM (donations included). stETH is 1:1; wstETH unwraps then uses getStETHByWstETH. Chunks are ≤ 1000 ETH.
• Ether.fi adapters pull eETH/weETH, open a queue request to address(this), and claim via batchClaimWithdraw. receive() reverts unless claimingEtherFi is set, so a permissionless Ether.fi claim cannot burn the NFT and strand ETH. onERC721Received is present.
• Paxos queues pendingShares then the operator submits to an owner-set paxosRecipient. redeem requires settlingShares and enough settled liquidity, then sends exactly shares USDC to the ARM. Excess recovery is owner-only and also pays the ARM.
• LidoARM / MultiAssetARM only initialize AbstractARM. Zappers wrap the contract’s ETH balance and deposit shares to msg.sender. Lido zapper is pinned to one ARM; generic ZapperARM takes a caller-chosen ARM (user error if they pass a fake). rescueERC20 is owner-only.

Remaining Origin in-scope: xOGN token (not in origin-dollar / arm-oeth; rewards module already reviewed). CapManager / Morpho market wrappers if they differ from the Ethena 4626 wrapper.

2026-09-03: OZ Confidential leftover ERC7984 modules (4a4f6c7)

Continues the v0.5.3 pass. Same Immunefi program (openzeppelin, $25,000, kyc: true). Same clone /tmp/oz-confidential at 4a4f6c7. No mainnet interaction.

Files: contracts/token/ERC7984/extensions/{ERC7984Hooked,ERC7984Votes,ERC7984Omnibus,ERC7984ObserverAccess}.sol, contracts/token/ERC7984/utils/{ERC7984HookModule,ERC7984BalanceCapHookModule,ERC7984HolderCapHookModule}.sol.

Checked for: an unprivileged install that can zero transfers; a hook that forges compliance; holder-count accounting that lets a transfer past the cap; omnibus transfer that moves tokens of an account the caller does not operate; observer that can be set on someone else’s account.

Result: no user-exploitable finding.

• installModule / uninstallModule require _authorizeModuleChange (concrete token). Modules are trusted and keep ACL after uninstall (documented). Pre-hooks AND into one ebool; false zeroes the amount. Transient ACL on the amount is granted only to installed modules. Module preTransfer requires the token already allowed the ciphertext.
• Balance-cap compare uses tryIncrease then le(future, max). setMaxBalance is IERC7984Rwa.isAgent. Sender-visible compliance is a documented leak, not an extract.
• Holder-cap must be installed before total supply is initialized. Pre-check uses encrypted from/to balances; post-transfer increments when to balance equals the transferred amount and decrements when from goes to zero. Self-transfers are skipped. Mint-from-zero edge is documented and dropped when the amount is zero.
• Votes just _transferVotingUnits of the actually transferred amount. Omnibus wrappers call confidentialTransferFrom (operator + ACL) and only emit extra encrypted sub-account labels; no on-chain sub-account ledger. Observer can be set by the account or cleared by the current observer.

Not submitted. Payouts need Immunefi KYC.

2026-09-03: Lombard SVM token pool + ratio oracle (09d5e76)

Immunefi program Lombard Finance ($250,000, kyc: true). Solana trees added 25 Jun 2026. Same local clone /tmp/reviews/lombard-svm at 09d5e76. Completes the SVM money path after asset_router / bridge / mailbox.

Files: programs/lombard_token_pool/src/instructions/{lock_or_burn_tokens,release_or_mint_tokens}.rs, programs/lombard_token_pool/src/{lib,state}.rs, programs/ratio_oracle/src/instructions/{publish_ratio,initialize_oracle}.rs, programs/ratio_oracle/src/{lib,state}.rs, programs/ratio_oracle/src/utils/consortium_payloads.rs, programs/bridge/src/instructions/gmp_receive.rs (mint target already reviewed; re-read for the pool CPI).

Checked for: CCIP lock that burns without the onramp signer; offramp mint to a caller-chosen token account; CCIP amount that does not match the GMP mint; ratio publish without a consortium ValidatedPayload; replay of a used ratio payload; a second oracle for the same denom.

Result: no user-exploitable finding.

• lock_or_burn_tokens requires authority == router_onramp_authority, RMN + allow-list + outbound rate limit (validate_lock_or_burn). It CPI-signs bridge.deposit as the pool signer. Receiver must be 32 bytes. dest_pool_data is the 32-byte payload hash.
• release_or_mint_tokens requires the router ALLOWED_OFFRAMP PDA for this offramp + remote selector, then validate_release_or_mint (remote pool list, inbound rate limit, RMN). It CPI mailbox.handle_message(payload_hash) with the pool signer. Bridge gmp_receive mints the payload amount to the payload recipient (or that wallet’s ATA) and inits MESSAGE_HANDLED. If the mailbox returns InboundResponse, the pool requires res.amount == parsed_amount. If return data is missing it skips that check — the mint already happened at the payload amount; CCIP’s destination_amount is then informational. No extra tokens are minted. Not submitted.
• publish_ratio requires a consortium-owned ValidatedPayload PDA for sha256(payload). Decoder checks selector 0x6c722c2c and word widths. Denom hash must match oracle.denom. Timestamp must be strictly after switch_time and not beyond now + max_ahead_interval. Ratio step is bounded by current * interval * threshold / (MAX * DEFAULT_INTERVAL). Replay fails OutdatedRatioUpdate. Oracle accounts are inited at [ORACLE_SEED, sha256(denom)], so one PDA per denom. Threshold/consortium updates are admin.

Not submitted. Payouts need Immunefi KYC.

2026-09-03: Origin CrossChain master/remote (4fa0602)

Immunefi program originprotocol ($1,000,000, kyc: false). Remaining Sep-1 OETH/OUSD cross-chain slice. Same clone /tmp/origin-dollar at 4fa0602. Base CCTP integrator already reviewed. No mainnet interaction.

Files: contracts/contracts/strategies/crosschain/{CrossChainMasterStrategy,CrossChainRemoteStrategy,CrossChainStrategyHelper}.sol.

Checked for: a user deposit that credits remote balance without bridging; withdraw to a non-vault recipient; a replayed CCTP nonce that double-counts; a stale balance-check that inflates checkBalance enough to mint unbacked OUSD.

Result: no user-exploitable finding.

• Master deposit / withdraw are onlyVault + nonReentrant. Withdraw recipient must be the vault. One in-flight transfer (pendingAmount / _getNextNonce reverts if pending). Incoming CCTP tokens are swept entirely to the vault. Balance is local USDC + pendingAmount + cached remoteStrategyBalance.
• Balance-check messages must match lastTransferNonce. Confirmations clear pendingAmount only when transferConfirmation is set. Out-of-order or older-than-1-day checks are ignored. Stale cache is documented; it is not a user mint path (vault mint still pulls assets).
• Remote local deposit / withdraw are onlyGovernorOrStrategist. CCTP deposit marks the nonce, then tries 4626 deposit in a try/catch so a failed Morpho deposit still sends the confirmation (USDC stays on the remote strategy). Withdraw sends only if idle USDC covers the request; otherwise it tries 4626 withdraw first.

2026-09-03: Lombard mailbox admin + consortium valset (09d5e76)

Same Lombard Finance program and clone as the token_pool / ratio_oracle pass above. This pass only covers leftover admin paths that that write-up did not list.

Files: programs/mailbox/src/instructions/{enable_inbound_message_path,admin}.rs, programs/consortium/src/instructions/update_valset.rs, utils/session_payloads.rs (UpdateValSetPayload + validate_valset).

Result: no user-exploitable finding.

• Inbound-path enable and treasury / fee / pause-unpause are admin-only init / config writes.
• update_valset requires a current-epoch ValidatedPayload, hash-matching session payload, epoch == current+1, incrementing height, unique non-zero weights, and sum(weights) >= threshold. Trusted notary set.

Not submitted. Payouts need Immunefi KYC.

2026-09-03: Sky FarmOwner (dss-flappers 6f3c910 / beam)

Immunefi Sky ($10,000,000, no KYC). In-scope 17 Aug add FarmOwner.sol (paired with already-reviewed SBEBeam). Local clone /tmp/reviews/dss-flappers at 6f3c910. No mainnet interaction.

File: src/FarmOwner.sol.

Checked for: a non-ward calling farm admin; recovered tokens stranded or sent to the caller; ownership escape without a ward.

Result: no user-exploitable finding.

• Every forwarded farm method is auth (wards==1). Constructor relies the deployer. rely / deny are ward-gated.
• recoverERC20 pulls to this contract (the farm owner) then transfers tokenAmount to ward-chosen to. Comment documents no fee-on-transfer. Pre-existing dust of the same token would ride along or cause the transfer to fail — trusted ward, not an external drain.
• nominateNewOwner / acceptOwnership can move farm ownership off this adapter. Trusted wards (Pause Proxy / SBEBeam).

Not submitted.

2026-09-03: Alchemix V3 core money paths (ea6f58b)

Immunefi program alchemix-1 ($150,000 USDC, kyc: false, live). Scope is github.com/alchemix-finance/v3/tree/master/src (added 6 Apr 2026). The 2025 audit competition is closed; this is the standing bounty. Local clone /tmp/reviews/alchemix-v3 at ea6f58b. No mainnet interaction.

Files: AlchemistV3.sol (deposit, withdraw, mint / mintFrom, burn, repay, liquidate / batchLiquidate / _doLiquidation / calculateLiquidation, redeem, selfLiquidate, _earmark, _sync, _computeUnrealizedAccount, _addDebt / _subDebt / _subCollateralBalance, converters), Transmuter.sol (create / claim / pokeMatured), AlTokenV3.sol (burn / burnFrom), AlchemistTokenVault.sol.

Checked for: a deposit that credits without a transfer; withdraw past the min-collateral lock; mint without an NFT owner / allowance; same-block mint-repay; burn of earmarked debt that starves the transmuter; repay that fees a third party into insolvency; liquidation of a healthy account or seizure above realized collateral; permissionless redeem; transmuter claim that over- redeems the alchemist; alUSD burnFrom without allowance.

Result: no exploitable finding on this pass.

• deposit writes collateral then transferFrom. Cap is _mytSharesDeposited + amount. tokenId == 0 mints an NFT to recipient; a non-zero id accepts donated MYT (no owner check). Donation cannot mint debt.
• withdraw is NFT-owner only, earmarks + syncs, locks mulDivUp(debtShares, minimumCollateralization, 1e18), then _validate. The collateralBalance > _mytSharesDeposited clamp only fires when one account already exceeds global tracked shares (prior insolvency / drift).
• mint / mintFrom owner-or-allowance; _addDebt requires collateralValue >= mulDivUp(newDebt, minCR, 1e18). Same-block mint↔repay/burn is blocked both ways. burn only hits unearmarked debt and caps at totalSyntheticsIssued - transmuter.totalLocked().
• repay can target any position. Protocol fee is taken from the position’s collateral on the earmarked slice only (fee < earmarkedYield while debt drops by the full credit), so a grief-repay cannot push a min-CR position under the lock by fee alone. Pulled MYT goes to the transmuter; fee MYT from the position goes to protocolFeeReceiver.
• liquidate no-ops on a healthy account (CR > collateralizationLowerBound) or a zero-price MYT share. Earmarked debt is force-repaid from the account first. _doLiquidation clamps seize / debt burn to realized shares and account.debt. Residual unhealthy + zero collateral uses _clearableDebt. Liquidator fee is taken from seized MYT or the fee vault, never minted.
• redeem is onlyTransmuter. Survival / earmark weights are Q128 packed; amount is capped to live earmarked. Fee is skipped if tracked MYT cannot cover it.
• Transmuter createRedemption locks synthetics under both depositCap and alchemist.totalSyntheticsIssued. claimRedemption is owner-only, not same-block, burns the NFT, scales by an up-rounded bad-debt ratio, redeems only the shortfall vs already-held MYT, and returns leftover synthetics on shortfall. pokeMatured only frees the active cap.
• AlTokenV3.burnFrom deducts allowance unless msg.sender == account, then optional xERC20 burner limits. Token vault: anyone deposits, only authorized withdraws.

Remaining Alchemix src/ after the core pass: concrete protocol strategies, Euler adapter, StakingGraph.

Not submitted.

2026-09-03: Alchemix V3 MYT adapter, allocator, router, fee vaults (ea6f58b)

Same Immunefi program (alchemix-1, $150,000, no KYC). Same clone /tmp/reviews/alchemix-v3 at ea6f58b. No mainnet interaction. Continues the alchemist/transmuter pass with the Morpho-V2 adapter layer and the EOA router.

Files: MYTStrategy.sol, strategies/ERC4626Strategy.sol, AlchemistAllocator.sol, AlchemistGate.sol, AlchemistETHVault.sol, adapters/AbstractFeeVault.sol, router/AlchemistRouter.sol.

Checked for: a non-vault allocate/deallocate; a 0x swap that drains a protected token; allocator cap bypass; router depositing into someone else’s NFT or keeping the position; repay leftover MYT stuck on the router; ETH receive that steals a WETH unwrap; unauthorized fee-vault withdraw.

Result: no user-exploitable finding.

• MYTStrategy.allocate / deallocate are onlyVault. Kill-switch reverts allocate (it does not silently skip). Force-deallocate is limited to ActionType.direct on strategies that opt in. dexSwap pays the owner- set 0x allowance holder and enforces minAmountOut. rescueTokens cannot move the MYT asset (or, in ERC4626Strategy, the receipt shares). Deallocate requires _totalValue() >= assets after the pull.
• AlchemistAllocator is admin/operator. Caps combine vault absolute/relative caps with classifier global and (for operators) local risk caps. Swap calldata is operator-chosen; minIntermediateOut is 0 on the swap helpers (trusted operator slippage).
• AlchemistGate is an owner-only auth map. Fee vaults authorize the alchemist + owner at construct; withdraw is onlyAuthorized. ETH vault unwraps WETH, records deposits only as events, and sends ETH under a reentrancy guard. receive() donations add to totalDeposits without a depositor credit.
• Router holds no funds between txs. Existing-position deposit/withdraw/self-liquidate require ownerOf == msg.sender. New positions mint to the router then transfer the NFT to the caller. Borrow on an existing id uses mintFrom (needs approveMint). NFT custody is documented to reset mint allowances. Repay refunds unused MYT via a pre/post balance delta. receive only accepts ETH while _ethExpected is set around WETH unwrap.

Remaining Alchemix after the adapter pass: none of the previously listed leftover files (see the strategies pass below). Not submitted.

2026-09-03: Alchemix V3 concrete strategies + Euler + StakingGraph (ea6f58b)

Same Immunefi program (alchemix-1, $150,000, no KYC). Same clone /tmp/reviews/alchemix-v3 at ea6f58b. No mainnet interaction.

Files: strategies/{Aave,Moonwell,EtherfiEETH,SFraxETH,SiUSD,StakeDAOWETH,TokeAuto,WstETHEthereum,WstETHL2,OraclePricedSwap}Strategy.sol, adapters/EulerUSDCAdapter.sol, libraries/StakingGraph.sol.

Checked for: a non-vault pull of aTokens / mTokens / weETH / vault shares; an oracle-priced swap that accepts a stale or zero answer; deallocate that approves more than the vault requested; Enso / 0x calldata that a user can inject; Fenwick overflow that inflates transmuter earmarks; Euler adapter minting or moving USDC.

Result: no user-exploitable finding.

• All _allocate / _deallocate overrides still run only through MYTStrategy onlyVault. Idle-balance checks and a final approve-to-msg.sender (the MYT) are the common exit. Force-deallocate stays opt-in (canForceDeallocate) and direct-only.
• OraclePricedSwapStrategy requires raw > 0, updatedAt != 0, and block.timestamp - updatedAt <= MAX_ORACLE_STALENESS. Swap min-out is oracle * (1 - slippageBPS). Owner can retarget the feed. Child wstETH / sfrxETH / weETH / siUSD paths convert wrapped balances into oracle units before the swap cap. L2 has no sequencer-uptime check (owner staleness).
• Aave supplies/withdraws via the provider pool; aToken is protected. adminDexSwap is owner-only. Moonwell mints/redeems with error-code checks, ceilDiv on redeem, and optional ETH→WETH wrap.
• Ether.fi instant redeem sizes weETH from the liquidity-pool share math plus exit fee and a bounded grossRedeemAmountBuffer; it reverts when canRedeem is false. sFRAX deposit is unwrap-WETH→minter; swap-deallocate unwraps sfrxETH to frxETH first. siUSD uses InfiniFi mintAndStake / unstake+redeem(..., shortfall).
• StakeDAO: Curve add/remove with virtual-price and absolute LP floors; Enso routes are operator calldata with a min-out and a post-hoc LP-spent ceiling. Tokemak: deposit NAV floor, direct redeem through Autopilot with execToleranceBps (cap 650) and a NAV-anchored min-out; route calldata requires minAmountOut >= shortfall.
• EulerUSDCAdapter is a convertToAssets price view only. StakingGraph packs a 112/144 Fenwick tree, reverts on delta/product overflow, and queryStake clamps to g.size. Transmuter never queries start block 0 (would underflow start--).

Alchemix V3 src/ money-moving trees treated as exhausted. Not submitted.

2026-09-03: Origin ARM CapManager + Morpho/Silo 4626 wrappers (2322537)

Immunefi program originprotocol ($1,000,000, kyc: false). USDC ARM CapManager, WETH/Lido ARM Morpho markets, and USDC ARM Aave market (same 4626 wrapper) continue the ARM adapter slice. Local clone /tmp/arm-oeth at 2322537. No mainnet interaction.

Files: src/contracts/CapManager.sol, src/contracts/markets/{Abstract4626MarketWrapper,MorphoMarket,SiloMarket}.sol.

Checked for: a non-ARM deposit/withdraw that mints market shares to a third party; CapManager hook that a user can skip or raise their own cap; reward collect that sends MORPHO/Silo incentives off-harvester; transferTokens of the market share token.

Result: no user-exploitable finding.

• CapManager.postDepositHook is ARM-only. It checks totalAssetsCap >= arm.totalAssets() after the deposit and, when account caps are on, decrements the LP’s remaining cap (oldCap >= assets). Caps and the total cap are operator/owner. Setting the total cap to 0 only blocks further deposits.
• Abstract4626MarketWrapper.deposit / withdraw / redeem require msg.sender == receiver == owner == arm. Shares are minted to the wrapper, assets return to the ARM. balanceOf / maxWithdraw / maxRedeem report 0 for any other owner. collectRewards is harvester-only. merkleClaim is permissionless but always claims for address(this). transferTokens is owner-only, cannot move the market share token, and can only pay owner or harvester.
• MorphoMarket only forwards MORPHO balance to the harvester. SiloMarket claims gauge rewards to the harvester. USDC ARM “AAVE Market” is this same wrapper over a 4626 Aave market.

Remaining Origin in-scope: xOGN token (0x63898b3b6Ef3d39332082178656E9862bee45C57) is not in origin-dollar or arm-oeth.

Not submitted.

2026-09-03: Origin xOGN ExponentialStaking (eff0d3d)

Immunefi program originprotocol ($1,000,000, kyc: false). xOGN (0x63898b3b6Ef3d39332082178656E9862bee45C57) is Staked OGN. Source is OriginProtocol/ousd-governance, not origin-dollar. Local clone /tmp/ousd-governance at eff0d3d. No mainnet interaction.

Files: contracts/ExponentialStaking.sol, contracts/RewardsSource.sol.

Checked for: unstaking another account’s lockup; gifting a stake that also restakes the recipient’s rewards; collecting rewards for a third party; transferring xOGN voting points; RewardsSource mint to a non-target.

Result: no user-exploitable finding.

• transfer / transferFrom revert. Points are soulbound. stake always transferFroms msg.sender. Gifting (to != msg.sender) forbids stakeRewards and lockup extension. _collectRewards for the recipient pays that user’s pending OGN to them, then mints only the new points.
• unstake reads lockups[msg.sender]. Early-exit penalty goes to rewardsSource; remainder to the staker. Lockup slots are deleted, indexes stay stable.
• collectRewards is msg.sender only. Global accRewardPerShare is updated from the rewardsSource delta before the user’s debt is settled. rewardsSource.collectRewards is try/catch so a rewards failure does not brick staking.
• RewardsSource.collectRewards requires msg.sender == rewardsTarget (the xOGN contract). Inflation slopes and the target are governor-only. Rate is capped at 5M OGN/day.

Origin Sep-1 / ARM / xOGN smart-contract trees that were listed as remaining are now exhausted.

Not submitted.

2026-09-03: Horizen ZenStaker + RewardAccumulator (ab92502)

Immunefi program Horizen ($10,000, kyc: true). GitHub assets added 20 Jul 2026 at the testnet merge commit. Local clone /tmp/horizen-staker at ab92502. No mainnet or testnet interaction.

Files: src/{ZenStaker,Staker,RewardAccumulator,DelegationSurrogate}.sol, src/extensions/StakerPermitAndStake.sol.

Checked for: withdrawing another account’s deposit; claiming another deposit’s rewards; notifyRewardAmount from a non-notifier; RewardAccumulator notify that credits more than transferred; stake/reward token commingling (ZEN-on-ZEN).

Result: no user-exploitable finding.

• ZenStaker inherits Tally Staker unchanged for writes. Stake pulls ZEN from the caller into a per-delegatee ZenDelegationSurrogate (max-approve back to the staker). Withdraw/claim require owner (and claimer for rewards). Payouts go to owner / caller. Claim fee is hardcoded 0; maxBumpTip is constructor-set (Phase 1: 0).
• notifyRewardAmount is notifier-only. It checkpoints, stretches the remaining stream over REWARD_DURATION, and reverts if rate * duration > this.balance. Staked ZEN lives on surrogates, so the balance check sees only reward inventory on the staker.
• RewardAccumulator.transferAndNotifyRewards / notifyAlreadyTransferredRewards are whitelist- gated (or open if whitelist is off). Notify of already-transferred tokens requires balance - accumulated >= amount. sendRewardsToStaker is permissionless after the window, transfers accumulatedRewards, then notifyRewardAmount. Un-notified donations stay stuck; they are not an extract.
• permitAndStake swallows a failed permit then transferFrom (standard). Surrogate holds tokens with no extra functions.

Not submitted. Payouts need Immunefi KYC.

2026-09-03: Origin CoW harvester + live xOGN rewards + Governor (4fa0602 / eff0d3d)

Immunefi program originprotocol ($1,000,000, kyc: false). The Sep-1 list still had “OUSD CoW Harvester” 0xD400341aEfED0BC75176714cFdE82e8BDAA2D3b8, Origin Governance, and Origin Timelock after the ARM / xOGN pass. The live xOGN rewards proxy is FixedRateRewardsSource, not the inflation RewardsSource file in the earlier xOGN note. Local clones /tmp/origin-dollar 4fa0602 and /tmp/ousd-governance eff0d3d. No mainnet interaction.

Files: contracts/harvest/HarvestingEIP1271.sol, contracts/harvest/{AbstractHarvester,SimpleHarvester}.sol (read to confirm the CoW address is not that path), contracts/ExponentialStaking.sol (already logged; rewards target only), contracts/FixedRateRewardsSource.sol, contracts/Governance.sol.

Checked for: an EIP-1271 magic-value on an order the bot did not sign; a reconstructed digest that is not the CoW EIP-712 hash; a permissionless harvest that pays the caller more than harvestRewardBps; FixedRate rewards mint or a non-target collect; Governor threshold / timelock bypass.

Result: no user-exploitable finding.

• HarvestingEIP1271 is the CoW harvester at 0xD400…. isValidSignature decodes (Order, r, s, v), requires _hashOrder(order, COW_DOMAIN_SEPARATOR) == hash, then ecrecover of "\x19COWSWAP order digest:\n32" || hash equals bot. _isOrderValid requires an enabled sell token, allow-listed buy token and receiver, fill-or-kill, feeAmount == 0, validTo >= now, and sellAmount >= minSellAmount. There is no min buyAmount / price bound — the bot is trusted. kind / balance enums are unchecked; CoW settlement still pulls only the approved sellToken via VAULT_RELAYER. setTokenConfig max-approves the relayer; disableToken zeros it. transferTokens cannot move an enabled sell token. Ownership cannot be renounced. Domain separator is snapshotted at deploy from ComposableCoW.
• AbstractHarvester.harvestAndSwap is permissionless but the implementation now calls _swap(..., IOracle(address(0x1))) and comments that this harvester is unused. The in-scope CoW address is HarvestingEIP1271, not this path. SimpleHarvester is strategist/governor for support flags; harvest itself is open but only forwards collected rewards to dripper (wrapped native) or strategist.
• Live xOGN rewards (010_xOGNSetupScript) initialize FixedRateRewardsSource with rewardsTarget = xOGN. collectRewards is target-only, pays min(elapsed * rewardsPerSecond, balance), and does not mint. Rate / target / strategist are governor-or-strategist. Changing a non-zero rate accrues past time at the new rate (documented). The unused RewardsSource inflation minter is not the proxy implementation.
• Governance is an OZ GovernorSettings + Bravo + quorum-fraction + timelock + late-quorum wrapper (1-day voting delay, ~2-day period, 100k xOGN threshold, 20% quorum). No custom execute path.

Origin Sep-1 Solidity named on Immunefi, including the CoW harvester and governance/timelock wrappers, is exhausted. Not submitted.

2026-09-03: 1inch Aqua solidity-utils mixins + libraries (5b597e4)

Same Immunefi program 1inch-aqua ($100k, KYC). Local clone /tmp/reviews/1inch-solidity-utils at 5b597e4. No mainnet interaction. Aqua opcodes / core already logged.

Files: contracts/mixins/{Simulator,Multicall,Rescuable, EthReceiver,OnlyWethReceiver}.sol, contracts/libraries/{SafeERC20,ECDSA,UniERC20, TransientLock,Transient,Calldata,CalldataPtr, RevertReasonForwarder,StringUtil}.sol.

Composition on this program: AquaRouter is Aqua + Simulator + Multicall + Rescuable. AquaSwapVMRouter is Simulator + SwapVM + AquaOpcodes (SwapVM is OnlyWethReceiver + Rescuable).

Checked for: simulate that persists a drain if a later revert is swallowed; multicall msg.value reuse against a payable Aqua path; rescueFunds that pulls a maker’s shipped allowance; permit assembly that approves a third-party spender; ECDSA recover that accepts a high-s malleable signature; transient lock that unlocks a different slot.

Result: no user-exploitable finding.

• Simulator.simulate always revert Simulated(...) after the delegatecall. A parent try/catch still reverts that frame, so token/ETH moves inside the simulation unwind. Empty storage on the mixin; no collision with Aqua _balances or Ownable.
• Multicall delegatecalls address(this) and bubbles the first revert. Aqua ship / dock / pull / push are not payable. Sending ETH with multicall can only donate to the router; the owner can rescueFunds it. Not an extract.
• Rescuable.rescueFunds is onlyOwner and uniTransfers the router’s own balance. Aqua accounting is virtual; makers keep tokens and grant allowance. Owner cannot pull a shipped maker inventory.
• SafeERC20.tryPermit dispatches by length (compact/full ERC-2612, DAI, Permit2, ERC-7597 default). Owner/spender are taken from the Solidity arguments, not from attacker-controlled permit body on the compact paths. Compact deadline/expiry are documented as stored - 1.
• ECDSA.recover rejects s >= n/2 + 1 and leaves signer == 0. recoverOrIsValidSignature refuses address(0) before EIP-1271. Compact vs 65-byte malleability is documented; Aqua order hashes are not invalidated by raw signature bytes (Aqua mode hashes the order; signed mode uses EIP-712).
• TransientLib tstore/tload at slot + OFFSET. TransientLock.lock requires inc() == 1. Calldata.slice unchecked variants are caller-gated; the bounds-checked overloads revert on end > length.
• EthReceiver rejects EOA tx.origin deposits. OnlyWethReceiver accepts only the constructor WETH. UniERC20 treats address(0) and 0xEeee… as native; uniTransferFrom refunds excess msg.value to from and forbids from != msg.sender.

Aqua-listed solidity-utils files treated as exhausted. Do not submit. Payment requires user KYC.

2026-09-03: 1inch-aqua-improvement is a different program (no proposal)

Unofficial mirror slug 1inch-aqua-improvement ($25k, KYC, not paused, last updated 18 Aug 2026). Same GitHub blobs as 1inch-aqua, but the published rules are an improvement proposal bounty, not a second vuln book: OOS includes new protocol mechanics / feature requests, micro gas (< 1k), pure refactors, and proposals without the required demonstration. ReserveFloor / AquaFloor is therefore an ETHOnline app (aqua-app/DESIGN.md), not an Immunefi submission. No improvement proposal from this pass.

2026-09-03: Alchemix V3 leftover curator / gauge / 0x / NFT (ea6f58b)

Same Immunefi program (alchemix-1, $150,000, no KYC). Same clone /tmp/reviews/alchemix-v3 at ea6f58b. No mainnet interaction. Closes the leftover src/ files after the strategies pass.

Files: AlchemistCurator.sol, AlchemistStrategyClassifier.sol, AlchemistV3Position.sol, AlchemistV3PositionRenderer.sol, PerpetualGauge.sol, FrxEthEthDualOracleAggregatorAdapter.sol, utils/{PermissionedProxy,Whitelist,ZeroXSwapVerifier}.sol, libraries/{FixedPointMath,TokenUtils,SafeERC20,Sets,SafeCast,NFTMetadataGenerator}.sol, external/AlEth.sol.

Checked for: a non-operator addAdapter / cap raise; NFT mint or burn outside the alchemist; a user-callable gauge allocate that ignores risk caps; 0x calldata that swaps a protected token; an oracle adapter that a user can point at a stale feed; permissionless alETH mint.

Result: no user-exploitable finding.

• Curator add/remove/cap paths are onlyOperator / onlyAdmin. Immediate setStrategy writes adapterToMYT then addAdapter; submit helpers only vault.submit. removeStrategy uses the mapped MYT, not the myt argument. PermissionedProxy.proxy is operator-only and selector-gated.
• Classifier defaults unassigned ids to risk 0 (100% / 100% caps). Admin-only writes. Trusted omission, not a user extract.
• Position NFT mint/burn is alchemist-only. _update resets mint allowances before transfer (already noted on the router). Renderer is metadata.
• PerpetualGauge is unfinished: strategyList is never pushed (registerNewStrategy only stamps lastStrategyAddedAt and is permissionless), so executeAllocation always reverts No allocations. Vote power is live balanceOf with no checkpoint (transfer-then-revote would leave stale weight if the list were ever wired). Caps divide WAD by 1e4 instead of 1e18. Tests comment the TODO. Not submitted: no live allocate path.
• ZeroXSwapVerifier is not imported by any production strategy. Fill parsers are marked TODO; buyToken is unchecked. Dead code until an allocator uses it.
• Frax dual-oracle adapter synthesizes updatedAt = block.timestamp (documented). Combined with the already-logged owner staleness on oracle-priced strategies. Not a user-set feed.
• AlEth.sol comments say it is modified for V3 invariant testing; setWhitelist / pauseAlchemist / setCeiling have no access control. Production token is AlTokenV3 (already reviewed).
• Libraries are standard mulDiv / safe ERC20 / 1-based address set / NFT SVG.

Alchemix V3 src/ treated as exhausted. Not submitted.

2026-09-03: Enzyme Blue gated redemption wrapper + share-price throttle (da3b870)

Immunefi program enzymefinance ($200,000, kyc: false). Newest GitHub-adjacent add is GatedRedemptionQueueSharesWrapperFactory (etherscan, 17 Aug 2026). Local clone /tmp/reviews/enzyme-protocol at da3b870. No mainnet interaction. Distinct from the already-logged enzyme-onyx ACE tree.

Files: contracts/persistent/shares-wrappers/gated-redemption-queue/{GatedRedemptionQueueSharesWrapperFactory,GatedRedemptionQueueSharesWrapperLib,IGatedRedemptionQueueSharesWrapper,bases/GatedRedemptionQueueSharesWrapperLibBase1}.sol, contracts/persistent/smart-accounts/share-price-throttled-asset-manager/{SharePriceThrottledAssetManagerFactory,SharePriceThrottledAssetManagerLib}.sol.

Checked for: a deposit that mints wrapped shares without pulling assets; queue cancel after the manager has already tallied the request; redeem outside the window or above the relative cap; kick / force-transfer by a non-owner; throttle that lets a signer exceed lossTolerance in one multicall.

Result: no user-exploitable finding.

• Factory deploy requires a dispatcher-known vault and inits the beacon proxy in the constructor. setImplementation is dispatcher-owner only.
• Direct deposit pulls (or wraps native), deposits via GlobalConfig.formatDepositCall, and mints the vault-share delta. Request mode escrows the asset; cancel refunds the queued amount. Manager __depositFromQueue removes requests before the vault call (cancel then reverts No request) and pro-rata mints (floored dust stays as unwrapped vault shares, documented).
• requestRedeem / cancelRequestRedeem revert in the latest window. Transfers cannot move shares that are queued. redeemFromQueue is manager/owner, window-gated, checkpoints relativeSharesAllowed from wrapped supply × cap, burns, then redeems and disperses by redeemed shares. Native payouts use sendValue (a rejecting recipient reverts the slice).
• kick / forceTransfer / manager approvals are privileged. The lib header states holders must trust the vault owner, who can appropriate value.
• Throttled smart account executeCalls snapshots gross share value, runs the owner multicall, then adds replenished cumulative relative loss. A 0 lossTolerancePeriodDuration would revert on replenish (owner config). Shutdowner zeros the owner.

Not submitted.

2026-09-03: Charm Alpha Pro Vault (0174095)

Immunefi program charm ($10,000, kyc: false). In-scope files are the three GitHub blobs below. Local clone /tmp/reviews/charm-vaults at 0174095. No mainnet interaction.

Files: contracts/AlphaProVault.sol, contracts/AlphaProVaultFactory.sol, contracts/CloneFactory.sol.

Checked for: first-deposit share inflation; withdraw that pulls more than the share of idle + three UniV3 positions; a non-pool mint/swap callback; rebalance that a user can run inside the TWAP / period guards; sweep of token0/token1; protocol+manager fee overflow.

Result: no user-exploitable finding.

• deposit pokes all three ranges, sizes from getTotalAmounts(), pulls, then mints. First depositor locks MINIMUM_LIQUIDITY (1e3) on the factory and needs max(amount0, amount1) > 1e3. amount0Min / amount1Min are the sandwich defense the comment describes.
• withdraw burns first, then idle × shares / supply plus _burnLiquidityShare on full/base/ limit. Collect takes the whole position’s owed fees; the withdrawer only receives fees * shares / totalSupply after protocol and manager cuts. Leftover fees stay idle for other LPs.
• Mint/swap callbacks require msg.sender == pool. The vault never starts a swap; the swap callback is unused.
• rebalance is permissionless when rebalanceDelegate == 0, else manager/delegate, and still needs checkCanRebalance (period, min tick move, TWAP deviation, tick bounds). Manager emergencyBurn returns tokens to the vault, not the manager. sweep cannot move token0/token1.
• Factory and vault cap protocol and manager fees at 20% each (20e4 / 1e6). Combined 40% cannot underflow 1e6 - protocol - manager.

Not submitted.

2026-09-03: DeFi Saver V3 executor + FL + auth (e623f20)

Immunefi program defisaver ($350,000, kyc: false). GitHub asset defisaver-v3-contracts/tree/main/contracts (excluding mocks and views), added 24 Sep 2025. Local clone /tmp/reviews/defisaver-v3 at e623f20. No mainnet interaction. First slice: the wallet execution spine, not protocol-specific actions.

Files: contracts/core/RecipeExecutor.sol, contracts/core/strategy/{StrategyExecutor,StrategyExecutorCommon,ProxyAuth,SafeModuleAuth,BotAuth,WalletAuth,SubStorage,SubProxy}.sol, contracts/auth/{Permission,DSProxyPermission,AdminAuth}.sol, contracts/actions/flashloan/{FLAction.sol,helpers/FLHelper.sol}.

Checked for: a bot executing a sub it does not own; a strategy hash mismatch that still runs; FL callback from a non-lender or a swapped recipe; leftover execute-permission on the wallet after FL; Aave modes / onBehalfOf that opens debt on a third party; executeActionsFromFL callable without a live FL.

Result: no user-exploitable finding on this slice.

• executeRecipe is meant to be delegatecalled from the user’s wallet. Direct calls run actions in the RecipeExecutor’s own context (no user inventory).
• Strategy path: BotAuth owner-approved callers, stored strategySubHash must match, sub must be enabled. ProxyAuth / SafeModuleAuth are onlyExecutor. Triggers run before actions; one-shot strategies deactivateSub as the wallet (owner). Changeable triggers update via the same owner check.
• FL: RecipeExecutor grants the FL action execute / module rights, calls executeAction on FLAction (not a delegatecall), then revokes. Callbacks require the matching lender and, where the interface has an initiator, address(this). Funds go to the encoded wallet; payback is an exact balance check (stETH 2-wei faucet exception). _executeRecipe re-enters the wallet → executeActionsFromFL (skips index 0). UniV3 verifies getPool(token0, token1, fee).
• Aave/Spark modes / onBehalfOf are user-chosen. Debt mode still has to satisfy the payback balance check, so a third-party credit-delegate cannot be left with unpaid FL debt through a successful callback.
• SubProxy.subscribeToStrategy (wallet context) enables ProxyAuth / SafeModuleAuth. Sub ids are wallet-owned.

Remaining DFS: exchangeV3, protocol actions/* (Aave/Morpho/Compound/Liquity/…), tx-saver, triggers. Not submitted.

2026-09-03: Jito stake-deposit-interceptor (dbd8ce4)

Immunefi program jito ($250,000, KYC). In-scope tree jito-foundation/stake-deposit-interceptor. Local clone /tmp/jito-interceptor at dbd8ce4. No mainnet interaction. Three published audits (Offside 2024-11, Certora 2024-12, Certora Coinbase integration 2026-03).

Files: stake_deposit_interceptor/src/{processor,state,state/hopper,instruction,error,entrypoint}.rs. API / cranker / CLI not reviewed (off-chain).

Checked for: init that binds the wrong pool mint or a writable vault an attacker owns; update that a non-authority can flip fee_wallet / whitelist program; deposit that credits a receipt to a third party without the staker’s authorize; claim that drains the vault past lst_amount; permissionless post-cooldown claim to a non-owner ATA; whitelist deposit that skips the list; hopper rebate or WithdrawFromHopper that a user can point at themselves.

Result: no user-exploitable finding.

• Init caps initial_fee_bps at 10_000, derives the authority PDA from stake_pool + base, and forces vault to the ATA of that PDA. Stake-pool program and mint owners are checked. The authority account does not sign (the pool manager later points stake_deposit_authority at the PDA).
• Update is current-authority signer only. Existing receipts snapshot cool_down_seconds / initial_fee_bps at deposit, so a later admin raise does not reprice them.
• DepositStake CPIs SPL DepositStake signed by the interceptor PDA and records vault.amount delta. owner is an instruction arg because the stake account’s withdrawer is already the PDA (same as vanilla SPL stake-pool after Authorize). Receipt PDA is deposit_receipt + pool + base.
• Claim: during cooldown the owner must sign; after cooldown the path is permissionless but destination ATA owner must equal receipt.owner and fee ATA owner must equal fee_wallet. Transfers use transfer_checked with the authority PDA. Receipt closes to owner. Linear fee uses div_ceil (rounds against the depositor; 1-lamport dust case is tested).
• Whitelisted deposit / withdraw require the signer in jito_whitelist_management and CPI through the stored stake-pool program. Destination of minted LST is caller-chosen by design (Coinbase path). Hopper rebate is min(fee_lamports, hopper - rent); empty hopper does not fail the withdraw. Hopper drain is authority-only.

Jito interceptor on-chain program treated as exhausted. Restaking restaking_* / vault_* and jito-solana / mev-programs remain. Do not submit. Payment requires user KYC.

2026-09-03: Money on Chain V2 governance machines (d770477)

Same Immunefi program moneyonchain ($10,000, kyc: true). Local clone /tmp/reviews/moneyonchain at d770477. Core / queue / V4 swapper already logged. No mainnet interaction.

Files: contracts/governance/{InterimGovernor,Governed, Stoppable,MocUpgradable}.sol, contracts/governance/changerTemplates/{Governance, AddBucket,EditBucket,AddPeggedToken,EditPeggedToken, UpgraderUUPS}ChangerTemplate.sol.

Checked for: a permissionless execute() that changes governor, upgrades a UUPS proxy, or grants TP minter roles; changeGovernor callable by a non-changer; pauser that can unpause without being pauser or authorized; UUPS _authorizeUpgrade open.

Result: no user-exploitable finding.

• Changer execute() is intentionally ungated. The productive calls (changeGovernor, addBucket, editBucket, addPeggedToken, editPeggedToken, upgradeTo) sit behind onlyAuthorizedChanger on the target. Areopagus (and InterimGovernor) only treat the current change contract / owner as authorized. A direct execute() from a random caller reverts on that check.
• InterimGovernor.executeChange / isAuthorizedChanger are owner-only. Production governor is Areopagus, not this file.
• Governed.changeGovernor is onlyAuthorizedChanger. Stoppable.pause is pauser-only; unpause is pauser or authorized changer. makeUnstoppable / setPauser are changer-only.
• MocUpgradable._authorizeUpgrade is onlyAuthorizedChanger.
• Add-bucket / add-TP templates also grantRole(MINTER/BURNER) on the TP; that needs admin on the token, which the changer does not have unless governance already arranged it.

V2 governance tree treated as exhausted. Remaining MoC: live Rootstock v1 proxy implementations (not this repo). Not submitted. Payouts need Immunefi KYC.

2026-09-03: DeFi Saver exchangeV3 + sell actions (e623f20)

Same Immunefi program (defisaver, $350,000, kyc: false). Same clone /tmp/defisaver-v3 at e623f20. No mainnet interaction. Follows the already-logged executor / FL / auth spine.

Files: contracts/exchangeV3/DFSExchange{Core,Helper,Data,WithTxSaver}.sol, registries/{WrapperExchangeRegistry,ExchangeAggregatorRegistry,TokenGroupRegistry}.sol, offchainWrappersV3/{OneInch,Zerox,Paraswap,Odos,KyberAggregator,Bebop,Pendle}Wrapper.sol, onchainWrappersV3/{Uniswap,UniV3,Kyber,Curve}WrapperV3.sol, contracts/actions/exchange/{DFSSell,DFSSellNoFee,LSVSell,LimitSell,LimitSellL2,LimitOrderSubProxy}.sol.

Checked for: an unregistered wrapper or aggregator call; off-chain takeOrder that keeps src and still returns false so _executeSwap double-spends; dest amount taken from a lying wrapper return; minPrice checked against pre-fee src; recipe fee divider of 1; Pendle calldata that spends more than the post-fee src; LimitSell gas fee above the fill; TxSaver injection of an unregistered wrapper.

Result: no user-exploitable finding.

• Off-chain path requires both ExchangeAggregatorRegistry and WrapperExchangeRegistry. On-chain sell requires the wrapper registry. Owner-only add/remove.
• takeOrder on the 1inch-style wrappers always sendLeftover src+dest+ETH to msg.sender (the wallet) before returning. A failed aggregator call refunds src, then the on-chain fallback spends the wallet’s refunded balance — not a second pull of already-consumed tokens. Zero dest on success reverts ZeroTokensSwapped.
• _sell records dest by wallet balance delta, not the wrapper return. Slippage is wmul(minPrice, srcAmount) after the DFS fee is subtracted (user-favorable vs the pre-fee amount). minPrice is caller-chosen except LimitSell, which requires it equal the trigger CURR_PRICE.
• Recipe DFSSell replaces any dfsFeeDivider other than 400 with TokenGroupRegistry.getFeeForTokens (standard 400, same-group 1000, banned src 0). Direct sells and DFSSellNoFee take no DFS fee. getFee is skipped when Discount.serviceFeesDisabled.
• Pendle does not patch calldata with the post-fee amount (documented: use DFSSellNoFee). A mismatch fails the call or refunds leftover; it does not spend more than the transferred src.
• LimitSell gas fee is capped at 20% of dest. TxSaver injects wrapper/off-chain data from transient storage set by the already-reviewed executor; injected addresses still hit the registries.

exchangeV3 + sell actions treated as exhausted. Remaining DFS: protocol actions/* (Aave / Morpho / Liquity / CurveUsd swappers / …) and tx-saver beyond the gas-cost hook already read here. Not submitted.

2026-09-03: DeFi Saver Morpho Blue actions (e623f20)

Same Immunefi program defisaver ($350,000, kyc: false). Same clone /tmp/reviews/defisaver-v3 at e623f20. No mainnet interaction.

Files: contracts/actions/morpho-blue/{MorphoBlueBorrow, MorphoBlueSupply,MorphoBlueWithdraw,MorphoBluePayback, MorphoBlueSupplyCollateral,MorphoBlueWithdrawCollateral, MorphoBlueSetAuth,MorphoBlueSetAuthWithSig, MorphoBlueReallocateLiquidity,MorphoBlueClaim, MorphoTokenWrap}.sol, helpers/MorphoBlueHelper.sol.

Checked for: borrow/withdraw onBehalf of a third party without Morpho authorization; SetAuth that a bot can flip on a wallet the user did not sign; claim that pulls another account’s merkle rewards; reallocate that drains a user’s Morpho position.

Result: no user-exploitable finding.

• Actions run via wallet delegatecall, so Morpho sees msg.sender as the wallet. onBehalf == 0 defaults to the wallet. Borrow / withdraw / withdrawCollateral against another onBehalf require Morpho isAuthorized. Tokens go to the recipe’s to.
• SetAuth calls setAuthorization as the wallet (user-signed recipe or official strategy). SetAuthWithSig only relays a valid Morpho authorization signature.
• Payback accrues, caps at current debt, and repays shares on max so leftover loan tokens are not over-pulled past debt (pull is the capped amount).
• ReallocateLiquidity is a thin PublicAllocator.reallocateTo loop. That path is permissionless on Morpho vaults; it does not touch the wallet’s position.
• Claim claims address(this) then withdrawTokens to to. Wrap deposits legacy MORPHO into the hardcoded wrapper for to.

Remaining DFS protocol actions: Aave / Liquity / CurveUsd / Fluid / Euler / … Not submitted.

2026-09-03: DeFi Saver Liquity V2 trove + SP (e623f20)

Same Immunefi program defisaver ($350,000, kyc: false). Same clone /tmp/reviews/defisaver-v3 at e623f20. No mainnet interaction.

Files: contracts/actions/liquityV2/trove/{LiquityV2Open, LiquityV2Borrow,LiquityV2Withdraw,LiquityV2Close, LiquityV2Adjust,LiquityV2AdjustZombieTrove, LiquityV2Payback,LiquityV2Supply,LiquityV2Claim}.sol, stabilityPool/{LiquityV2SPDeposit,LiquityV2SPWithdraw, LiquityV2SPClaimColl}.sol, helpers/LiquityV2Helper.sol.

Checked for: open/borrow on a trove the wallet does not own; close that sends more coll than the trove returned; payback past MIN_DEBT that bricks the trove; SP withdraw of another depositor; WETH max open that spends the gas-compensation lock as coll.

Result: no user-exploitable finding.

• Open always sets Liquity owner to address(this) (the wallet). troveId = keccak256(wallet, ownerIndex). 0.0375 WETH gas lock is pulled in addition to coll; WETH-max open subtracts that lock before openTrove. BOLD minted is sent to to.
• Borrow / withdraw / adjust / close / addColl call BorrowerOperations as the wallet. Liquity requires the caller to be owner or manager. A third-party troveId reverts.
• Close pulls entireDebt BOLD, then sends entireColl (+ gas lock if WETH market) to to. Payback / adjust-payback cap at entireDebt - MIN_DEBT.
• SP deposit/withdraw/claim use address(this) as the depositor. Gains are snapshotted, then claimed in the same call, then sent to the recipe recipients.

Remaining DFS protocol actions: Aave / CurveUsd / Fluid / Euler / Liquity V1. Not submitted.

2026-09-03: DeFi Saver Fluid T1 + liquidity logic (e623f20)

Same Immunefi program defisaver ($350,000, kyc: false). Same clone /tmp/reviews/defisaver-v3 at e623f20. No mainnet interaction.

Files: contracts/actions/fluid/vaultT1/{FluidVaultT1Open, FluidVaultT1Borrow,FluidVaultT1Withdraw}.sol, logic/liquidity/{FluidSupply,FluidBorrow,FluidWithdraw, FluidPayback}LiquidityLogic.sol, helpers/FluidVaultTypes.sol.

Checked for: operate on an NFT the wallet does not own; ETH wrap that deposits the wrong amount; max payback that keeps leftover borrow tokens; T1 helpers that accept a T2/T3 vault type.

Result: no user-exploitable finding.

• T1 actions hardcode T1_VAULT_TYPE. Liquidity libraries requireLiquidityCollateral / requireLiquidityDebt. operate is called as the wallet; Fluid requires the NFT owner. Open uses nftId == 0 so the vault mints to the wallet.
• ETH coll is unwrapped WETH then sent as msg.value. Borrow/withdraw can wrap ETH to WETH on the wallet then withdrawTokens to to. Wrap amount is the requested borrow or the vault-returned withdraw.
• Max payback pulls borrow * 10001/10000 + 5, uses type(int256).min, refunds dust to from, and clears leftover approval. signed256 reverts above int256.max.

Remaining Fluid: Dex T2/T3/T4 operate paths. Aave V3 / Comp / Spark / Liquity V1 follow. Not submitted.

2026-09-03: DeFi Saver Aave V3 money actions (e623f20)

Same Immunefi program (defisaver, $350,000, no KYC). Same clone /tmp/reviews/defisaver-v3 at e623f20. No mainnet interaction. Exchange/sell already logged; this slice is Aave V3 supply / withdraw / borrow / payback.

Files: contracts/actions/aaveV3/{AaveV3Supply,AaveV3Withdraw,AaveV3Borrow,AaveV3Payback}.sol.

Checked for: a fake AddressProvider that drains an approved pull; withdraw/borrow of another wallet’s position; onBehalf without Aave credit delegation.

Result: no user-exploitable finding.

• Token is getReserveAddressById on the pool returned by the caller-chosen market (or useDefaultMarket). Supply/payback pull from from (needs allowance if not the wallet).
• Borrow/withdraw move the wallet’s own position. onBehalf needs Aave credit delegation.
• A fake AddressProvider would need the wallet owner or a BotAuth bot to pass it in. Bots are owner-approved (already logged).

2026-09-03: DeFi Saver Comp V2/V3 + Spark + Liquity V1 (e623f20)

Same program and clone. Liquity V2 trove/SP already logged; this slice adds Comp, Spark, and Liquity V1, plus a V2 fake-registry note.

Files: contracts/actions/compoundV3/{CompV3Supply,CompV3Withdraw,CompV3Borrow,CompV3Payback,CompV3Transfer,CompV3Allow,CompV3Claim}.sol, contracts/actions/compound/{CompSupply,CompWithdraw,CompBorrow,CompPayback}.sol, contracts/actions/spark/{SparkSupply,SparkWithdraw,SparkBorrow,SparkPayback,SparkSpTokenPayback,SparkDelegateCredit}.sol, contracts/actions/spark/helpers/SparkHelper.sol, contracts/actions/liquity/trove/{LiquityOpen,LiquityClose}.sol, contracts/actions/liquity/stabilityPool/LiquitySPWithdraw.sol, contracts/utils/token/TokenUtils.sol.

Checked for: CompV3 withdraw/borrow/transfer of another account without allow; a fake Comet / Spark AddressProvider that makes withdrawTokens send the wallet’s existing balance; Spark delegate that a stranger can set; Liquity V1 close that over-pulls LUSD.

Result: no user-exploitable finding.

• CompV3 onBehalf == 0 defaults to the wallet. withdrawFrom / transferAssetFrom against another account need Comet allow. CompV3Allow calls allow as the wallet. Claim uses hardcoded COMET_REWARDS_ADDR and a receiver balance delta. A fake Comet cannot move a real position.
• Comp V2 getUnderlyingAddr is cToken.underlying() (cETH hardcoded). Withdraw uses a wallet balance delta. Borrow / supply to a fake cToken that returns NO_ERROR then withdrawTokens of the requested amount would drain existing wallet tokens of that underlying — owner-or-bot fake-target, same as Aave market. Payback caps at borrowBalanceCurrent.
• Spark resolves the pool via ISparkPoolAddressesProvider(_market).getPool() unless useDefaultMarket. Withdraw sends from the pool to to. Borrow then withdrawTokens(_to, amount) is the same fake-pool drain if the owner/bot passes a hostile AddressProvider. Delegate credit is approveDelegation as the wallet.
• Liquity V2 (already logged): money actions take IAddressesRegistry(market) as given. getDebtInFront whitelists WETH/wstETH/rETH, but open/adjust/close/SP do not. A fake registry that reports a huge entireColl / SP gain would make withdrawTokens send the wallet’s existing coll/BOLD; owner/bot only.
• Liquity V1 addresses are hardcoded in LiquityHelper. Close reads the wallet’s own trove debt/coll, pulls that LUSD, then wraps and sends coll to to. SP withdraw caps at the wallet’s compounded deposit.

Remaining DFS: curveusd, Fluid Dex T2/T3/T4, eulerV2, aaveV4 / leftover Aave, llamalend, mcd, tx-saver, triggers. Not submitted.

2026-09-03: DeFi Saver CurveUsd core money actions (e623f20)

Same Immunefi program (defisaver, $350,000, no KYC). Same clone /tmp/reviews/defisaver-v3 at e623f20. No mainnet interaction.

Files: contracts/actions/curveusd/{CurveUsdCreate,CurveUsdBorrow,CurveUsdWithdraw,CurveUsdSupply,CurveUsdAdjust,CurveUsdPayback,CurveUsdSelfLiquidate}.sol, helpers/CurveUsdHelper.sol, advanced/CurveUsdSwapper.sol (callback gate only).

Checked for: a fake controller that withdrawTokens of minted crvUSD from the wallet; borrow/withdraw of another user’s llamma position; payback onBehalfOf that closes and sends someone else’s coll to to; self-liquidate that pulls more crvUSD than needed and keeps it; swapper callback from a non-controller.

Result: no user-exploitable finding.

• Every money action checks isControllerValid: factory debt_ceiling != 0. A random AddressProvider-style fake cannot pass. Positions are the wallet’s create_loan / borrow_more / remove_collateral on that controller.
• Create / adjust / borrow then withdrawTokens of the requested crvUSD amount. If the controller minted less, the transfer reverts. Supply can credit onBehalfOf (donation). Payback caps at debt(onBehalfOf) and, on close, sends only the wallet’s balance deltas.
• Self-liquidate is liquidate(address(this)). Extra crvUSD pull is debt - collInCrvUsd + 1000 wei and leftover is returned to from. Outgoing amounts are post-liq deltas.
• Swapper callbacks require msg.sender to be a valid controller. setAdditionalRoutes is permissionless storage, but the action writes it in the same tx before the callback and _curveSwap deletes it. withdrawAll lets anyone sweep leftover swapper balances (no user position).

Remaining CurveUsd: lev-create / repay / self-liquidate-with-coll + transient variants. Remaining DFS: those, Fluid Dex T2–T4, eulerV2, aaveV4 / leftover Aave, llamalend, mcd, tx-saver, triggers. Not submitted.

2026-09-03: Jito restaking vault money path + NCN tickets (db90840)

Immunefi program jito ($250,000, KYC). In-scope trees jito-foundation/restaking/{vault_core,vault_program, restaking_core,restaking_program}. Sparse clone /tmp/jito-restaking at db90840. No mainnet interaction. Interceptor already logged (dbd8ce4). The restaking audit-competition page states slashing was not enabled at launch; this tree has no slash instruction (only DelegationState::slash math).

Files: vault_program/src/{mint_to,enqueue_withdrawal, burn_withdrawal_ticket,change_withdrawal_ticket_owner, update_vault_balance,initialize_vault_update_state_tracker, crank_vault_update_state_tracker,close_update_state_tracker, add_delegation,cooldown_delegation,initialize_vault, initialize_vault_with_mint,set_fees,delegate_token_account}.rs, vault_core/src/{vault,vault_staker_withdrawal_ticket, delegation_state}.rs, restaking_program/src/{initialize_ncn_vault_ticket, warmup_ncn_vault_ticket,initialize_ncn_vault_slasher_ticket, ncn_delegate_token_account,operator_delegate_token_account}.rs.

Checked for: empty-vault share inflation or a donate-then-update brick; mint that credits VRT without transferring ST; enqueue that locks another staker’s VRT; permissionless burn that pays a non-owner; reserved-VRT accounting that under-reserves ST so a later depositor funds an earlier withdrawal; update_vault_balance that mints unbounded fee VRT; crank that force-cools another operator’s stake for an attacker; ticket owner change without the old owner; restaking ticket warmup that a non-admin can flip; a user slash path.

Result: no user-exploitable finding.

• InitializeVault requires `initialize_token_amount

  0, temporarily zeros the deposit fee, mints 1:1 VRT to a burn-vault ATA, then restores the fee. vrt_supply is never zero on a live vault, so the donate-then-update_vault_balancebrick (tokens>0, vrt=0, later mints return 0) is not reachable.InitializeVaultWithMint` is a no-op stub.

• mint_to requires the depositor signer, classic SPL token only, rejects depositor==vault and depositor ATA==vault ATA, mint_with_fee + min_amount_out, and vrt_to_depositor == 0. Deposit fee is div_ceil against the depositor.
• Enqueue: staker+base sign; ticket PDA (program, vault, base); VRT moves to the ticket ATA; increment_vrt_enqueued_for_cooldown_amount. Burn is permissionless after current_epoch > unstake_epoch+1 but check_staker pins payout to the ticket’s staker ATA. Extra VRT sent to the ticket after enqueue is swept to the program fee wallet. Owner change needs the old staker.
• Reserved ST is calculate_burn_summary on the sum of enqueued + cooling + ready VRT. Individual ticket burns apply fees per ticket (div_ceil), so they take slightly more fee / less ST than the aggregate reserve. Conservative, not an extract. delegate subtracts that reserve plus already-delegated security from tokens_deposited.
• update_vault_balance treats ATA growth as rewards, takes reward_fee_bps in ST, mints the matching VRT to the fee wallet, then stores the full ATA as tokens_deposited. check_reward_fee_effective_rate aborts a zero fee mint when reward_fee_bps > 0.
• Epoch crank: only Greedy allocation; force cooldown is capped at that operator’s staked amount and additional_assets_need_unstaking. Close of the current epoch requires every operator updated and additional_assets_need_unstaking == 0, then copies tracker delegation and shifts VRT buckets at most two epochs. Old-epoch close is rent-only.
• Restaking tickets are NCN/operator-admin PDAs. Warmup/cooldown need the matching admin. Delegate token is admin approve(u64::MAX) of an NCN- or operator-owned ATA (not the vault ST). Slasher tickets store max_slashable_per_epoch but no instruction spends them. Vault delegate_token_account refuses the supported mint.

Jito restaking vault_* / restaking_* treated as exhausted at db90840. jito-solana and mev-programs remain. Not submitted. Payouts need Immunefi KYC.

2026-09-03: DeFi Saver CurveUsd advanced + transient (e623f20)

Same Immunefi program defisaver ($350,000, kyc: false). Same clone /tmp/defisaver-v3 at e623f20. Core CurveUsd money actions already logged; this slice is the leftover extended/transient path.

Files: contracts/actions/curveusd/advanced/{CurveUsdRepay, CurveUsdLevCreate,CurveUsdSelfLiquidateWithColl}.sol, advanced/transient/{CurveUsdRepayTransient, CurveUsdLevCreateTransient,CurveUsdSelfLiquidateWithCollTransient, CurveUsdSwapperTransient}.sol.

Checked for: lev-create that borrows for a third party; repay_extended callback that a non-controller can fire with leftover routes; transient ExchangeData that another recipe can overwrite in the same tx; leftover funds left on the swapper.

Result: no user-exploitable finding.

• Advanced actions write routes via _setupCurvePath then call repay_extended / create_loan_extended / liquidate_extended as the wallet. After the callback they withdrawAll on the swapper and _sendLeftoverFunds to to. Liquidate target is address(this).
• Transient actions write exData to BYTES_TRANSIENT_STORAGE in the same tx, then pass the registry swapper. The swapper decodes that blob and requires a valid controller msg.sender. Leftovers use a starting-balance snapshot so only the delta is sent to to. srcAmount == 0 reverts.

CurveUsd treated as exhausted. Remaining DFS: Fluid Dex T2–T4, eulerV2, aaveV4 / leftover Aave, llamalend, mcd, tx-saver, triggers. Not submitted.

Note on the non-transient leftover (same files): LevCreate / Repay / SelfLiquidateWithColl do not call isControllerValid (transient paths do). After repay_extended / liquidate_extended they _sendLeftoverFunds, which withdrawTokens(..., type(uint256).max) of crvUSD and collateral_token(). A fake controller whose collateral_token() is WETH would sweep the wallet’s WETH + crvUSD to to — owner-or-bot, same fake-target pattern already logged. Transient leftovers use a starting-balance snapshot.

2026-09-03: DeFi Saver Euler V2 actions (e623f20)

Same Immunefi program defisaver ($350,000, kyc: false). Same clone /tmp/defisaver-v3 at e623f20. No mainnet interaction.

Files: contracts/actions/eulerV2/{EulerV2Supply, EulerV2Withdraw,EulerV2Borrow,EulerV2Payback, EulerV2PaybackWithShares,EulerV2PullDebt, EulerV2CollateralSwitch,EulerV2ReorderCollaterals}.sol, helpers/{EulerV2Helper,MainnetEulerV2Addresses}.sol.

Checked for: borrow/withdraw of an account the wallet does not own; enableController on a stranger; pullDebt that loads a victim with debt; repayWithShares that burns another account’s eTokens; a fake vault that withdrawTokens of a requested amount.

Result: no user-exploitable finding.

• EVC is hardcoded 0x0C9a3dd6b8F28529d72d7f9cE918D493519EE383. Borrow / withdraw / repayWithShares / disableController go through IEVC.call(vault, account, …). EVC only accepts the account owner or an operator. account == 0 defaults to the wallet. Sub-accounts share the wallet’s 19-byte prefix.
• Supply deposits to account (donation if it is not the wallet) after a pull/approve. Payback caps at debtOf(account) and, on a full repay, disables the controller via EVC.
• pullDebt takes from’s debt onto account (the wallet / its sub-account). That is debt-relief for from, not an extract. repayWithShares burns shares of from via EVC (from must be wallet-owned).
• A hostile vault address is owner-or-bot fake-target (same class as Comp cToken / Spark AddressProvider). It cannot pass EVC as a real Euler account.

2026-09-03: DeFi Saver LlamaLend core money actions (e623f20)

Same program and clone. LlamaLend is the crvUSD-style controller fork; CurveUsd already logged.

Files: contracts/actions/llamalend/{LlamaLendCreate, LlamaLendBorrow,LlamaLendWithdraw,LlamaLendPayback}.sol, helpers/LlamaLendHelper.sol.

Checked for: a fake controller that withdrawTokens of minted debt from the wallet; borrow/withdraw of another user’s llamma position; payback onBehalfOf that closes and sends someone else’s coll to to.

Result: no user-exploitable finding.

• Create / borrow / withdraw do not call isControllerValid (unlike CurveUsd). isControllerValid exists (factory.controllers(id) == addr) but is unused here. A hostile controller plus withdrawTokens of the requested amount would drain the wallet’s existing debt/coll tokens — owner-or-bot fake-target, same class already logged for Comp / Spark. Positions on a real controller are the wallet’s (create_loan / borrow_more / remove_collateral).
• Payback caps at debt(onBehalfOf) and on close sends only wallet balance deltas. onBehalfOf repay is a donation.

Remaining LlamaLend: supply / self-liquidate / advanced swapper paths. Remaining DFS: those, aaveV4 / leftover Aave, mcd, tx-saver, triggers. Not submitted.

2026-09-03: DeFi Saver Fluid Dex T2/T3/T4 (e623f20)

Same Immunefi program defisaver ($350,000, kyc: false). Same clone /tmp/reviews/defisaver-v3 at e623f20. No mainnet interaction.

Files: contracts/actions/fluid/dex/{FluidDexOpen, FluidDexBorrow,FluidDexSupply,FluidDexWithdraw, FluidDexPayback}.sol, logic/dex/{FluidSupply,FluidBorrow,FluidWithdraw, FluidPayback}DexLogic.sol, helpers/{FluidDexTokensUtils,FluidDexModel, FluidVaultTypes}.sol.

Checked for: operate on an NFT the wallet does not own; Open that leaves a minted NFT if borrow fails; wrap that deposits the wrong ETH amount; max payback that keeps leftover debt tokens; T2/T3/T4 helpers that accept the wrong vault type.

Result: no user-exploitable finding.

• operate / operatePerfect run as the wallet. Fluid requires the NFT owner. Open is two-step in one tx: supply with nftId == 0 (vault mints to the wallet) then borrow. A failed borrow reverts the mint.
• T3 supply/withdraw use liquidity libraries (requireLiquidityCollateral). T2/T4 supply and T3/T4 borrow use DEX libraries (requireSmartCollateral / requireSmartDebt). Actions call requireDexVault first.
• shouldSendTokensAsWrapped only wraps when wrapEth is set and that side is native. If wrap is false, sendTokens is a no-op (vault already sent to to). Max withdraw wraps the vault-returned amount. Max payback pulls maxAmountToPull, uses type(int256).min, refunds dust as WETH if native, and clears leftover approval. signed256 reverts above int256.max.

Remaining DFS: LlamaLend leftover, aaveV4 / leftover Aave, mcd, tx-saver, triggers. Not submitted.

2026-09-03: DeFi Saver Aave V3 + GHO/Umbrella (e623f20)

Same Immunefi program defisaver ($350,000, kyc: false). Same clone /tmp/reviews/defisaver-v3 at e623f20. No mainnet interaction.

Files: contracts/actions/aaveV3/{AaveV3Supply, AaveV3Borrow,AaveV3Withdraw,AaveV3Payback, AaveV3ATokenPayback,AaveV3ClaimRewards, AaveV3CollateralSwitch,AaveV3SetEMode, AaveV3DelegateCredit,AaveV3DelegateWithSig, GhoStake,GhoUnstake}.sol, umbrella/{UmbrellaStake,UmbrellaUnstake, UmbrellaClaimRewards}.sol, helpers/AaveV3Helper.sol.

Checked for: borrow/withdraw onBehalf of a third party without Aave credit delegation; payback that over-pulls past debt; aToken repay of someone else’s debt from pulled tokens; claim that drains another account’s rewards; Umbrella stake without slippage or unwrap to the wrong asset.

Result: no user-exploitable finding.

• Actions run via wallet delegatecall, so Aave sees msg.sender as the wallet. onBehalf == 0 defaults to the wallet. Borrow against another onBehalf needs Aave approveDelegation. Supply / payback on behalf are Aave’s intended donate / repay paths. Withdraw always burns the wallet’s aTokens.
• Payback and aToken payback cap at getWholeDebt. aToken repay uses repayWithATokens for address(this) after pulling aTokens from from.
• DelegateCredit calls approveDelegation as the wallet. DelegateWithSig only relays a valid Aave debt-token signature.
• Claim rewards / Umbrella claim are msg.sender = wallet. GHO stake/unstake and Umbrella stake/unstake pull from from or burn the wallet’s shares, then send to to. Umbrella stake/unstake enforce minSharesOut / minAmountOut. Amount 0 only starts cooldown.

Aave V3 supply/borrow/withdraw/payback were already logged in a narrower slice; this pass adds aToken payback, delegation, GHO, and Umbrella. Remaining DFS: LlamaLend leftover, aaveV4, mcd, tx-saver, triggers. Not submitted.

Note on Dex wrap-path leftovers (same files): a fake vault that does not pay would make wrap-path withdrawTokens of the requested amount drain existing wallet tokens of that asset — owner-or-bot, same class already logged.

2026-09-03: DeFi Saver LlamaLend leftover + swapper (e623f20)

Same Immunefi program defisaver ($350,000, kyc: false). Same clone /tmp/reviews/defisaver-v3 at e623f20. No mainnet interaction. Core create/borrow/withdraw/ payback already logged.

Files: contracts/actions/llamalend/{LlamaLendSupply, LlamaLendSelfLiquidate,LlamaLendGetDebt}.sol, advanced/{LlamaLendLevCreate,LlamaLendBoost, LlamaLendRepay,LlamaLendSelfLiquidateWithColl, LlamaLendSwapper}.sol.

Checked for: self-liquidate of another user’s position; swapper callback from a fake controller; lev-create that spends wallet coll without a valid factory id; leftover sweep that sends more than the action’s delta.

Result: no user-exploitable finding.

• Supply onBehalfOf is a donate add_collateral. Self-liquidate calls liquidate(address(this)), pulls a 1000-wei buffer only if coll-in-debt < debt, refunds unused debt token to from, and sends the coll delta to to. Same un-gated controller + withdrawTokens fake-target class as the core slice.
• Lev-create / boost / repay / self-liquidate-with- coll require factory.controllers(id) == addr. Swapper callbacks revert unless msg.sender is that controller. Transient exData is written in the same tx. Leftovers use a starting-balance snapshot. withdrawAll returns leftover swapper balances to msg.sender (the wallet).
• GetDebt is a view.

LlamaLend treated as exhausted. Remaining DFS: aaveV4 / leftover Aave, mcd, tx-saver, triggers. Not submitted.

2026-09-03: DeFi Saver Aave V4 sig + premium (e623f20)

Same program and clone. No mainnet interaction.

Files: contracts/actions/aaveV4/{AaveV4DelegateBorrowWithSig, AaveV4DelegateWithdrawWithSig, AaveV4DelegateSetUsingAsCollateralWithSig, AaveV4SetUserManagersWithSig,AaveV4RefreshPremium}.sol.

Checked for: a recipe that sets a stranger’s managers or borrow/withdraw permits without their signature; premium refresh that mutates another account without Aave approval.

Result: no user-exploitable finding.

• Delegate / set-managers actions only relay EIP-712 signatures to hardcoded Taker / Config position managers or a caller-chosen Spoke. Aave verifies the signer.
• RefreshPremium defaults onBehalf to the wallet. On another onBehalf it goes through ConfigPositionManager *OnBehalfOf, which Aave gates (wallet must already be an approved manager). No tokens move.

Aave V4 listed wrappers treated as exhausted. Remaining DFS: mcd, tx-saver, triggers. Not submitted.

2026-09-03: DeFi Saver Maker MCD actions (e623f20)

Same Immunefi program defisaver ($350,000, kyc: false). Same clone /tmp/reviews/defisaver-v3 at e623f20. No mainnet interaction.

Files: contracts/actions/mcd/{McdOpen,McdSupply,McdWithdraw, McdGenerate,McdPayback,McdGive,McdMerge,McdClaim, McdDsrDeposit,McdDsrWithdraw,McdTokenConverter, McdBoostComposite,McdRepayComposite,McdRatio}.sol, helpers/{McdHelper,McdRatioHelper}.sol.

Checked for: generate/withdraw of a CDP the wallet does not own; Give that a bot can fire on a stranger’s vault; Cropper claim that steals another owner’s bonus; DSR withdraw of another pot pie; composite leftover DAI sent to the wrong address.

Result: no user-exploitable finding.

• McdOpen mints the CDP to address(this). Manager frob / give / shift / move / flux require the wallet to own the vault. Cropper paths resolve owns(vaultId) and frob as that owner; Cropper only accepts the owner’s authorized proxy.
• Payback caps at getAllDebt. Give reverts on 0x0. Claim crops with amount 0 and sends only the wallet’s bonus delta.
• DSR join/exit use pot.pie(address(this)) on max. Converter only routes DAI/USDS/MKR through hardcoded Sky converters.
• Boost/repay composites hardcode MCD_MANAGER_ADDR, sell via already-logged DFSSell, and send leftover DAI to the wallet owner. Strategy ratio checks revert if the ratio moves the wrong way.
• A caller-chosen joinAddr plus withdrawTokens of a requested amount is the same owner-or-bot fake-target class already logged for Comp / Spark / LlamaLend.

Maker MCD treated as exhausted. Remaining DFS: tx-saver, triggers. Not submitted.

2026-09-03: DeFi Saver TxSaver leftover (e623f20)

Same Immunefi program defisaver ($350,000, kyc: false). Same clone /tmp/reviews/defisaver-v3 at e623f20. No mainnet interaction. RecipeExecutor / BotAuth already logged; this slice is the TxSaver entry plus gas-cost helper.

Files: contracts/tx-saver/{TxSaverExecutor, BotAuthForTxSaver,TxSaverBytesTransientStorage, TxSaverGasCostCalc}.sol.

Checked for: a stranger calling executeTx without a Safe signature; injected exchange data that runs without the user’s signed recipe; gas-cost helper that over-charges past block gas.

Result: no user-exploitable finding.

• executeTx requires BotAuthForTxSaver.isApproved(msg.sender) (owner-gated add/remove). It then Safe.execTransaction to RecipeExecutor as DelegateCall with the user’s packed signatures. Safe verifies the signers. Deadline is checked when non-zero.
• Transient storage is written only by TxSaverExecutor in the same tx. Anyone can read it; only that tx’s sell/fee hook consumes it.
• Gas cost caps _gasUsed at block.gaslimit and converts via an injected ETH price (reverts if zero). Fee-from-position vs EOA is the user’s signed flag.

TxSaver treated as exhausted. Remaining DFS: triggers. Not submitted.

2026-09-03: DeFi Saver Aave V4 money actions (e623f20)

Same Immunefi program defisaver ($350,000, kyc: false). Same clone /tmp/defisaver-v3 at e623f20. No mainnet interaction. Signature-relay / premium already logged; this is contracts/actions/aavev4/ supply, borrow, withdraw, payback, and collateral-switch.

Files: contracts/actions/aavev4/{AaveV4Supply, AaveV4Borrow,AaveV4Withdraw,AaveV4Payback, AaveV4CollateralSwitch,AaveV4StoreRatio}.sol, helpers/{AaveV4Helper,MainnetAaveV4Addresses}.sol.

Checked for: borrow/withdraw of a third-party position without Aave manager approval; payback that over-pulls past debt; fake Spoke whose getReserve returns a real token so the trailing withdrawTokens drains the wallet.

Result: no user-exploitable finding.

• Giver / Taker / Config position managers are hardcoded. onBehalf == 0 defaults to the wallet. Other-account supply/repay go through GiverPositionManager; borrow/withdraw/ collateral-switch go through Taker / Config. Aave must already have enabled that manager and approved this wallet.
• Payback caps at getUserTotalDebt. Supply and payback pull from from (allowance).
• After borrow/withdraw the action sends spoke.getReserve(id).underlying of the returned amount to to. A fake Spoke plus that withdrawTokens is the same owner-or-bot fake-target class already logged. StoreRatio is a view helper.

Aave V4 money actions treated as exhausted. Remaining DFS: triggers. Not submitted.

2026-09-03: DeFi Saver triggers (e623f20)

Same program and clone. No mainnet interaction. StrategyExecutor / BotAuth already logged.

Files: contracts/triggers/{OffchainPriceTrigger, TokenBalanceTrigger,TrailingStopTrigger, ChainLinkPriceTrigger,TimestampTrigger, GasPriceTrigger,ClosePriceTrigger, AaveV3RatioTrigger,AaveV2RatioTrigger, AaveV4RatioTrigger,CompV3RatioTrigger, CompoundRatioTrigger,SparkRatioTrigger, MorphoBlueRatioTrigger,MorphoBluePriceTrigger, FluidRatioTrigger,LiquityRatioTrigger, LiquityV2RatioTrigger,McdRatioTrigger, CurveUsdCollRatioTrigger, CurveUsdHealthRatioTrigger, CurveUsdSoftLiquidationTrigger, CurveUsdBorrowRateTrigger}.sol plus the quote-price / debt-in-front / adjust-rate variants and helpers/TriggerHelper.sol.

Checked for: a stranger firing a strategy without the subscribed condition; Offchain price that a non-bot can set; LimitSell that accepts a 1-wei attested price and dumps the position; TokenBalance that reads a spoofable token.

Result: no user-exploitable finding.

• executeStrategy is BotAuth-gated and the StrategySub hash must match storage. Trigger callData is bot-supplied; subData is the user’s stored hash.
• Ratio / Chainlink / Morpho / Fluid / Liquity / MCD / CurveUsd / Spark / Comp / Aave quote-price triggers read on-chain oracles or protocol views. currRatio == 0 or a missing price returns false (no fire).
• OffchainPriceTrigger takes currentPrice from bot calldata, writes CURR_PRICE, and LimitSell requires minPrice == CURR_PRICE before _sell. A tiny attested price would weaken slippage to nearly zero. Only approved bots can pass that calldata — same owner-or-bot class already logged for LimitSell in the exchangeV3 slice.
• TrailingStopTrigger takes a Chainlink maxRoundId from the bot but prices come from getRoundInfo; the round must be after startRoundId.
• Token balance / timestamp / gas-price triggers are views on the subscribed addresses and thresholds.

DeFi Saver V3 treated as exhausted. Not submitted.

2026-09-03: DeFi Saver leftover Aave V2 (e623f20)

Same Immunefi program defisaver ($350,000, kyc: false). Same clone /tmp/reviews/defisaver-v3 at e623f20. No mainnet interaction. Aave V3 / V4 already logged; this is contracts/actions/aave/.

Files: contracts/actions/aave/{AaveSupply, AaveBorrow,AaveWithdraw,AavePayback, AaveCollateralSwitch,AaveClaimAAVE, AaveClaimStkAave,AaveUnstake}.sol, helpers/{AaveHelper,MainnetAaveAddresses}.sol. AaveSubProxy only registers boost/repay bundles against hardcoded Aave V2 market 0xB53C…c5.

Checked for: borrow through a fake AddressesProvider that then withdrawTokens a caller-chosen amount; payback leftover that sweeps more than the unused pull; claim of another account’s stkAave rewards.

Result: no user-exploitable finding.

• market is an unvalidated AddressesProvider. Borrow then withdrawTokens(tokenAddr, amount) — owner-or-bot fake-target, same class as Comp / Spark. Withdraw sends via the pool to to (max uses a to-balance delta). The 1–2 wei faucet top-up is hardcoded DYDX_FL_FEE_FAUCET.
• Payback caps at getWholeDebt. After repay it withdrawTokens(_from, tokensAfter) — the entire remaining wallet balance of that token, not only unused pull. Recipe leftover footgun to from, not a third-party extract.
• Claims / unstake hit hardcoded stkAave 0x4da2…0f5. amount == 0 on unstake only starts cooldown.

2026-09-03: DeFi Saver EtherFi + Lido + leftover utils (e623f20)

Same program and clone.

Files: contracts/actions/etherfi/{EtherFiStake, EtherFiStakeFromLido,EtherFiWrap,EtherFiUnwrap}.sol, lido/{LidoStake,LidoWrap,LidoUnwrap}.sol, utils/{ExecuteCall,SendToken,SendTokens, PullToken,TransferNFT,ChangeProxyOwner, HandleAuth,PermitToken,TokenizedVaultAdapter, KingClaim,SDaiWrap,SDaiUnwrap}.sol.

Checked for: stake that sends more eETH / stETH than the deposit minted; Lido ETH call that a fake recipient can keep; ERC4626 vault that withdrawTokens of a requested amount; ExecuteCall that a strategy bot can aim at an arbitrary target; KingClaim of another wallet’s merkle allocation.

Result: no user-exploitable finding.

• EtherFi / Lido addresses are hardcoded (eETH 0x35fA…ac2, weETH 0xCd5f…b7ee, liquidity pool, deposit adapter, stETH / wstETH). Stake / wrap send only the received-balance delta. Lido stake/wrap require the ETH call to succeed. StakeFromLido approves the adapter and passes an empty permit (deadline = max); minAmountOut is user-set.
• TokenizedVaultAdapter takes a caller-chosen ERC4626. Deposit/mint pull vault.asset(). A fake vault can keep the pull — owner-or-bot. Redeem/withdraw use the vault’s from allowance. Slippage (minOutOrMaxIn) is checked. Sky staked USDS uses a hardcoded vault + referral on mainnet.
• ExecuteCall / SendToken* / ChangeProxyOwner are owner-or-bot recipe primitives. PermitToken relays an exact EIP-2612 signature and requires the nonce to increment. KingClaim claims for address(this) on hardcoded 0x6Db2…B64 and sends the KING delta. SDaiWrap deposits to hardcoded sDAI.

Remaining DFS folders without a dedicated pass: renzo, sky, pendle, yearn, summerfi, uniswap, insta, lsv, merkel, fee, checkers, leftover utils (CreateSub / UpdateSub / ToggleSub / wrap-ETH). Not submitted.

2026-09-03: DeFi Saver Renzo / Sky / Pendle / Yearn / Uni (e623f20)

Same Immunefi program defisaver ($350,000, kyc: false). Same clone /tmp/reviews/defisaver-v3 at e623f20. No mainnet interaction.

Files: contracts/actions/renzo/RenzoStake.sol, sky/{SkyStake,SkyUnstake,SkyClaimRewards, SkyStakingEngineOpen,SkyStakingEngineStake, SkyStakingEngineUnstake,SkyStakingEngineClaimRewards, SkyStakingEngineSelectFarm}.sol, pendle/PendleTokenRedeem.sol, yearn/{YearnSupply,YearnWithdraw}.sol, uniswap/{UniswapClaim,v2/UniSupply,v2/UniWithdraw, v3/UniMintV3,v3/UniSupplyV3,v3/UniWithdrawV3, v3/UniCollectV3,v3/UniCreatePoolV3}.sol.

Checked for: Yearn withdraw of a fake yVault that withdrawTokens a requested underlying amount; Sky unstake that sends wallet tokens after a no-op withdraw; Pendle redeem that transfers PT to a hostile YT; Uni V3 decrease/collect of an NFT the wallet does not own.

Result: no user-exploitable finding.

• Renzo stake is hardcoded manager + ezETH and sends only the received-balance delta.
• Sky stake/unstake take a caller-chosen stakingContract. Stake approves and stakes. Unstake calls withdraw then withdrawTokens(stakingToken, amount) — a no-op fake farm drains existing wallet tokens of that asset. Owner-or-bot. Staking-engine free / lock send through the engine to to / urn index for address(this).
• Pendle redeem requires market.isExpired(), pulls PT, transfers it to readTokens().yt, then redeemPY + SY redeem with minAmountOut. A hostile market that names an attacker YT is owner-or-bot.
• Yearn supply uses hardcoded yearnRegistry.latestVault(token). Withdraw takes a caller-chosen yToken, pulls shares, vault.withdraw, and sends the underlying-balance delta. A fake vault that does not pay sends zero, not a requested amount.
• Uni V2 factory/router and Uni V3 position manager are hardcoded. V3 decrease/collect require the wallet to own tokenId. V2 removeLiquidity sends to to via the router.

Remaining DFS folders: summerfi, insta, lsv, merkel, fee, checkers, leftover utils (CreateSub / wrap-ETH). Not submitted.

2026-09-03: DeFi Saver Summer.fi / Insta / LSV / Merkl / fee / checkers (e623f20)

Same Immunefi program defisaver ($350,000, kyc: false). Same clone /tmp/reviews/defisaver-v3 at e623f20. No mainnet interaction.

Files: contracts/actions/summerfi/{SFProxyEntryPoint, SFApproveTokens,SummerfiUnsub,SummerfiUnsubV2}.sol, insta/{InstPullTokens,connectors/ConnectV2DefiSaver*.sol, connectors/resolver.sol}, lsv/{LSVSupply,LSVBorrow,LSVPayback,LSVWithdraw}.sol, merkel/MerklClaim.sol, fee/{GasFeeTaker,GasFeeTakerL2,GasFeeCalc}.sol, checkers/*RatioCheck*.sol, utils/{CreateSub,UpdateSub,ToggleSub,WrapEth,UnwrapEth}.sol.

Checked for: Summer.fi approve that sets allowance on a stranger’s SF proxy; Insta cast that drains another DSA; Merkl distinctTokens that withdrawTokens more than the claim minted; LSV fee that takes more than 10% of a real withdraw; GasFeeTaker that spends an unpiped wallet balance past the 20% cap.

Result: no user-exploitable finding.

• SFApproveTokens executes AAVEV3PaybackWithdraw on a caller-chosen sfProxy through hardcoded OperationExecutor / SetApproval 0x3CF2…bA5 (version- pinned in ServiceRegistry). AccountGuard must already permit this wallet. Spender defaults to the wallet; allowance is re-read after the call.
• SummerfiUnsub / UnsubV2 delegatecall hardcoded AutomationBot / AutomationBotV2 (0x6E87…01b / 0x5743…25E) to remove the wallet’s own triggers. SFProxyEntryPoint fallback delegatecalls RecipeExecutor; receive reverts.
• InstPullTokens casts BASIC-A withdraw on a caller-chosen DSA. Only a DSA that already authorized this wallet will succeed. ConnectV2DefiSaver fallbacks delegatecall a hardcoded RecipeExecutor from an Instadapp spell the DSA owner signed.
• LSV supply/borrow/payback only write the hardcoded profit tracker. Withdraw takes a performance fee (0% if discounted) capped at 10% of the stated LST amount, converted via hardcoded rETH/cbETH/wstETH/weETH/ezETH rates.
• MerklClaim hits the hardcoded distributor. Claiming for another users[] entry is the intended merkle path; distinctTokens then withdrawTokens from the wallet — owner-or-bot if those amounts exceed the claim. Docs say leave that array empty when claiming for someone else.
• GasFeeTaker caps gas at 20% of availableAmount (wallet balance if unpiped) plus a DFS fee floored at 5 bps. Checkers only revert a strategy when the post-action ratio moved the wrong way. CreateSub grants auth and stores a hash the wallet signed.

DeFi Saver leftover folders treated as exhausted. Not submitted.

2026-09-03: 0x Settler execute + Permit2 + RFQ/UniV3 (1df9087)

Immunefi program 0x ($1,000,000, kyc: true). In-scope GH tree is https://github.com/0xProject/0x-settler/tree/master/src. Web/API (Matcha, gasless, swap) are websites — not reviewed, no live-API probing. Local clone /tmp/0x-settler at 1df9087. No mainnet interaction.

Files: src/Settler.sol, src/SettlerMetaTxn.sol, src/SettlerBase.sol (_checkSlippageAndTransfer), src/core/{Permit2Payment,Basic,RfqOrderSettlement, UniswapV3Fork}.sol, src/allowanceholder/AllowanceHolder.sol, src/bridge/BridgeSettler.sol.

Checked for: a later action that spends a payer the taker did not authorize; forwarded Permit2 that accepts a forged empty sig; meta-txn that skips the witness-binding VIP; RFQ self-funded that transfers more taker tokens than the maker signed; UniV3 callback from a non-pool; AllowanceHolder that leaves a standing allowance; slippage check that sends the buy-token to the operator.

Result: no user-exploitable finding.

• takerSubmitted sets transient payer to _operator() (_msgSender()). After that, _msgSender() is the payer. Restricted targets are Permit2 and AllowanceHolder (ConfusedDeputy). executeWithPermit requires _isForwarded().
• Forwarded _transferFrom requires empty sig, nonce 0, and a live deadline, then AllowanceHolder transferFrom. Witness transfers (_transferFromIKnowWhatImDoing) revert ForwarderNotAllowed when forwarded.
• Meta-txn executeMetaTxn sets witness = keccak(slippage || actions hash) and payer = signed msgSender. First action must be a VIP that spends that witness (METATXN_TRANSFER_FROM / METATXN_UNISWAPV3_VIP). takerSubmitted on the meta-txn contract reverts. Operator cannot equal msgSender. Forwarded meta-txns revert. AllowanceHolder path on meta-txn reverts ConfusedDeputy.
• RFQ self-funded pays the maker from Settler’s taker-token balance (capped at maxTakerAmount, maker-favor rounding) then permitWitnessTransferFrom of the maker’s permit with a Consideration witness of the taker. RFQ VIP is commented out.
• UniV3 VIP / multi-hop: pool address is CREATE2 from a trusted factory+initHash (_uniV3ForkInfo). Callback is installed via _setOperatorAndCall; payer address(this) pays from Settler, payer 0 pays via Permit2/AllowanceHolder packed into callback data. Subsequent hops reset callback data to Settler+token.
• basicSellToPool rejects restricted targets, patches ppm of balance into calldata, and forbids empty-return to an EOA.
• AllowanceHolder exec sets an ephemeral allowance, ERC-2771-appends sender, rejects ERC20 targets via balanceOf probe. If sender != tx.origin the allowance is zeroed after exec.
• Slippage: minAmountOut==0 && buyToken==0 skips (unless mandatory). Else require Settler balance ≥ min and send the full (or exact-min) buy-token/ETH to slippage.recipient. Intentional leftover sweep of the last hop.
• BridgeSettler execute is takerSubmitted; first action may be TRANSFER_FROM VIP or a regular dispatch. No slippage helper here — remaining work is the per-bridge adapters.

Remaining 0x: other per-DEX adapters and the rest of src/bridge/. Not submitted.

2026-09-03: 0x Settler UniV2 / Velodrome / Across (1df9087)

Same Immunefi program 0x ($1,000,000, kyc: true). Same clone /tmp/0x-settler at 1df9087. No mainnet interaction. Execute / Permit2 / RFQ / UniV3 already logged.

Files: src/SettlerBase.sol (UNISWAPV2, VELODROME, POSITIVE_SLIPPAGE), src/core/{UniswapV2,Velodrome,Across}.sol.

Checked for: a user-supplied UniV2/Velo pool that is not a pair but still drains a later action’s tokens; Across spoke that is a restricted target; positive-slippage that sends more than leftover.

Result: no user-exploitable finding.

• UniV2 / Velodrome take a caller-chosen pool, read token0/token1 (or metadata), transfer ppm of Settler’s sell-token balance, then swap. A fake pool can only take tokens already in this Settler execution. minBuyAmount still applies. Permit2 / AllowanceHolder do not implement swap.
• POSITIVE_SLIPPAGE sends min(balance - expected, balance * maxPpm / BASIS) of leftover to recipient. Action data is in the signed / submitted list.
• Across overwrites inputAmount to the current Settler balance (or ETH balance) and scales outputAmount with 512-bit math, then calls ISpokePool.deposit on a caller-chosen spoke. Selector does not clash with restricted targets. Funds moved are this execution’s leftovers.

Remaining 0x: other DEX mixins (Maverick, Balancer, Bebop, EulerSwap, Dodo, Curve, UniswapV4, PancakeInfinity, Renegade, …) and Relay / NucleusTeller. Not submitted.

2026-09-03: Extra Finance LYF LendingPool + Velo manager

Immunefi program extrafinance ($100,000, kyc: false, updated 2026-09-02). Scope is Optimism etherscan addresses, no official GH tree in the program JSON. Sources from Sourcify exact-match plus ExtraFi/extra-contracts (repo documents mainnet-vs-fix diffs). No mainnet interaction.

Files: Sourcify /tmp/extrafinance/lendingpool contracts/lendingpool/{LendingPool, ExtraInterestBearingToken,StakingRewards}.sol, libraries/logic/ReserveLogic.sol, Payments.sol; Sourcify /tmp/extrafinance/velo contracts/VeloPositionManager.sol; Sourcify /tmp/extrafinance/rdist contracts/RewardsDistributor.sol. Live LendingPool 0xBB505c54D71E9e599cB8435b4F0cEEc05fC71cbD, VeloPositionManager 0xf9cFB8a62f50e10AdDE5Aa888B44cF01C5957055.

Checked for: redeem of another user’s eTokens; borrow without whitelist / credits; repay that inflates vault credits past actual debt; first-depositor exchange-rate inflation; Velo callback from a non-vault; staking withdraw of another user.

Result: no new user-exploitable finding.

• Borrow / repay require borrowingWhiteList[msg.sender] and debtPosition.owner == msg.sender. Credits and whitelist are owner-set per vault from VaultFactory.
• Mainnet repay adds credits using the requested amount before capping to debtPosition.borrowed. ExtraFi’s own BUG_FIXES_AND_MODIFICATIONS.md already labels this a known mainnet bug and says it is not externally exploitable because only whitelisted vaults call repay. The public repo already caps first. Vault position- logic implementations (registry ids 101–105) are not on Sourcify, so this slice cannot prove a user-controlled passthrough. Do not file the known credit bug without that vault path.
• eToken burn is onlyLendingPool and burns the pool’s own balance after transferFrom of the redeemer. withdrawByLendingPool is onlyLendingPool.
• First-depositor inflation is also in ExtraFi’s known-issues list; they say mainnet inits dead-share the first 10k eTokens in the same tx.
• unwrapWETH9 unwraps the contract’s full WETH balance (donation / leftover sweep, not another user’s position).
• Velo payToVaultCallback / payFeeToTreasuryCallback require msg.sender == factory.vaults(id). Liquidation / compound / range-stop are whitelist-or-flag gated.
• StakingRewards setReward / claim quirks are the same documented owner-gated known issues.

Remaining Extra Finance: vault implementations (not Sourcify), ExtraX account factory (0x345e8250cB11F61F0d8cFaBAC6be59A356309a58), Aave-fork Pool impl (0x0353b6221B23B8320202320Ca450EEB9fB0de9E5), veToken. Not submitted.

2026-09-03: 0x leftover Stargate / LayerZero / CCIP / Mayan / DeBridge (1df9087)

Same Immunefi program 0x ($1,000,000, kyc: true). Same clone /tmp/0x-settler at 1df9087. No mainnet interaction. Across / UniV2 / Velodrome already logged.

Files: src/core/{StargateV2,LayerZeroOFT, CCIP,Mayan,DeBridge}.sol, src/bridge/IBridgeSettlerActions.sol.

Checked for: a hostile pool/OFT/router that is Permit2 or AllowanceHolder; amount override that spends a later action’s tokens for a stranger; Mayan protocolAndData that calls an arbitrary target with Settler’s allowance.

Result: no user-exploitable finding.

• All five run only from BridgeSettler _dispatch inside one takerSubmitted / signed execute. They overwrite amountLD / giveAmount / tokenAmounts[0].amount / Mayan amountIn to this Settler’s current token (or ETH-minus-fee) balance, then safeApproveIfBelow the bridge.
• Stargate / LayerZero / CCIP take a caller-chosen pool / oft / router and call a fixed selector (sendToken / send / ccipSend). Comments note those selectors do not clash with Permit2 or AllowanceHolder. A fake pool can only keep tokens this execution already pulled — same authenticated-execution class as UniV2.
• Mayan / DeBridge use hardcoded MAYAN_FORWARDER (0x3376…3E2) and DLN_SOURCE (0xeF4f…EB66). Receiver / to / mayanProtocol bytes are in the taker’s action data.
• CCIP requires feeToken == 0 and exactly one tokenAmounts entry, then sends selfbalance() as native fee (excess is documented as a donation).

Remaining 0x: other DEX mixins (UniV4, BalancerV3, Curve, Dodo, EulerSwap, PancakeInfinity, …) and Relay / NucleusTeller. Not submitted.

2026-09-03: 0x Settler UniV4 + Relay + SETTLER_SWAP (1df9087)

Same Immunefi program 0x ($1,000,000, kyc: true). Same clone /tmp/reviews/0x-settler at 1df9087. No mainnet interaction. Stargate / LayerZero / CCIP / Mayan / DeBridge already logged in the leftover above.

Files: src/core/{UniswapV4,Relay}.sol, src/bridge/BridgeSettlerBase.sol (SETTLER_SWAP, Relay), src/chains/Mainnet/{Common,TakerSubmitted, MetaTxn}.sol (UniV4 / UniV4 VIP).

Checked for: a UniV4 hook that spends a payer the taker did not authorize; Relay that hits Permit2 or AllowanceHolder; SETTLER_SWAP to a counterfeit Settler.

Result: no user-exploitable finding.

• UniV4 unlocks via _setOperatorAndCall. Payer address(this) transfers from Settler; payer 0 uses Permit2 / AllowanceHolder packed into the VIP. Fills (pool key, hooks, hook data, ppm) are in the submitted / signed action. Global buy token is taken to recipient against minBuyAmount; leftover credit on other notes is swept to Settler. Incomplete fill refunds sell credit. Zero sell reverts.
• Relay transfers this execution’s full ERC20 / ETH balance to the action’s to. Native path is a raw call with requestId graffiti; ERC20 path is transfer. Neither selector clashes with Permit2 / AllowanceHolder.
• SETTLER_SWAP requires the target to be the current or previous Deployer NFT owner of the taker-submitted tokenId. Comment notes MEV can force the inner swap to its slippage limit; that is in-execution leftover, not another user’s custody.

Remaining 0x: other DEX mixins (Maverick, BalancerV3, Bebop, EulerSwap, Dodo, Curve, PancakeInfinity, Renegade, Ekubo, Hanji, NucleusTeller). Not submitted.

2026-09-03: 0x Settler Maverick / Dodo / BalancerV3 (1df9087)

Same Immunefi program 0x ($1,000,000, kyc: true). Same clone /tmp/reviews/0x-settler at 1df9087. No mainnet interaction. UniV4 / Relay / SETTLER_SWAP already logged.

Files: src/core/{MaverickV2,DodoV1,DodoV2, BalancerV3}.sol, src/chains/Mainnet/Common.sol (dispatch).

Checked for: a fake Maverick/Dodo pool that drains a later action; BalancerV3 vault callback that spends a payer the taker did not authorize; Dodo V1 quote-for-base that over-buys past minBuyAmount.

Result: no user-exploitable finding.

• Maverick V2 transfers ppm of Settler balance (or pool-balance delta when ppm==0), then swap with empty callback data so the pool does not flash-callback. minBuyAmount still applies. A fake pool can only take tokens already in this execution.
• Dodo V2 transfers then sellBase/sellQuote to recipient. Dodo V1 safeApproveIfBelows the caller-chosen pair, sells base with the pair’s own minReceiveQuote, or quote-for-base after local curve math and buyBaseToken(buyAmount, sellAmount). Slippage is checked before the buy call.
• Balancer V3 vault is hardcoded (0xbA13…9bA9). Unlock uses the same _setOperatorAndCall + notes pattern as UniV4. Payer address(this) transfers from Settler; payer 0 uses Permit2. Wrap/unwrap bits are in the signed fills. Global buy token is sendTo’d to recipient against minBuyAmount.

Remaining 0x: EulerSwap, Curve, PancakeInfinity, Bebop, Renegade, Ekubo, Hanji, NucleusTeller. Not submitted.

2026-09-03: Extra Finance ExtraX factory + Aave-fork Pool

Same Immunefi program extrafinance ($100,000, kyc: false, updated 2026-09-02). Same Sourcify + ExtraFi/extra-contracts method as the LYF slice. Live Optimism RPC https://mainnet.optimism.io used only for initialized / EIP-1967 views — no state-changing calls. No mainnet interaction beyond those reads.

Files: Sourcify exact_match ExtraX impl /tmp/extrafinance/xacct contracts/extra-x-account/ExtraXAccountFactory.sol (0x345e8250cB11F61F0d8cFaBAC6be59A356309a58); Safe creator /tmp/extrafinance/creator_safe …/SafeAccount130Creator.sol (0x1EEA0464D31F349D31FF7D318ce236F48AD92438); Coinbase creator /tmp/extrafinance/creator_cb …/CoinbaseAccountCreator.sol (0xd4b5D2A9F8e9Ec1883Ef997eB508EA6Cc12B240f); Sourcify match (not exact) Aave V3 fork /tmp/extrafinance/poolimpl contracts/core-v3/protocol/pool/Pool.sol (0x0353b6221B23B8320202320Ca450EEB9fB0de9E5) plus PoolConfigurator / AToken / VariableDebtToken under /tmp/extrafinance/{poolcfg,atoken,debt}. Live ExtraX proxy 0x90cF2763CC710B9Ce215584A89c77F70bbb96B44.

Checked for: uninitialized ExtraX proxy takeover; createAccountFor that assigns a Safe/Coinbase account to a stranger; import of an account the caller does not own; ExtraFi-specific money-flow in the Aave-fork Pool.

Result: no user-exploitable finding.

• Live proxy and impl both return initialized() == 1. EIP-1967 implementation is the ExtraX factory impl; admin is 0x750f7153e6c92a24089a34ec6afe65740c9bd40a. initialize is public initializable (once). Not an uninitialized-proxy takeover.
• createAccount / createAccountFor are public. They create a Safe 1.3.0 or Coinbase smart account owned by owner via official L2 factories (0xC228…10BC + singleton 0xfb1b…91EA; Coinbase 0x0BA5…428a). That is a gift, not a steal. Creators are onlyFactory. Nonce is keccak(factory, EXTRA_X_ACCOUNT_SEED, accType, owner, id).
• Live totalAccTypes == 2 and isAccountImportEnabled == false. Import, when enabled, calls validateAccountOwner (isOwner + singleton / implementation match).
• Aave-fork Pool is stock Aave V3 Supply / Borrow / Liquidation / FlashLoan / Validation. Grep found no ExtraFi-specific money-flow. Do not spend a later pass re-auditing Aave V3.
• Official extra-contracts repo still has only VaultFactory + IveToken for vault / veToken. Registry logic ids 101–105 and live vault 1 (0x2f8305…A33C) are Sourcify 404.

Remaining Extra Finance: vault position logic (not Sourcify) and veToken. Not submitted.

2026-09-03: Index Coop Set Protocol V2

Immunefi program indexcoop ($200,000, kyc: false, updated 2026-09-01). Scope is five Ethereum mainnet etherscan addresses, no GH tree in the program JSON. Sourcify exact_match fetched to /tmp/indexcoop/. No mainnet interaction.

These are Set Protocol V2 (Set Labs, Apache-2.0, Solidity 0.6.10).

Files: Controller.sol, SetTokenCreator.sol, DebtIssuanceModuleV2.sol + IssuanceValidationUtils.sol, StreamingFeeModule.sol, IntegrationRegistry.sol.

Checked for: a non-factory that registers a Set; issue/redeem that leaves the Set undercollateralized beyond the documented aToken ±1 wei tolerance; streaming fee that inflates past the committed max; a public adapter add.

Result: no user-exploitable finding.

• Controller initialize is onlyOwner once. addSet is onlyFactory. Factories / modules / resources / fees are owner-gated.
• SetTokenCreator.create deploys a new Set the caller manages and registers it via controller.addSet. Components / units / modules are checked; modules must already be enabled. Intended factory path.
• DIMV2 overrides V1 issue/redeem with looser post-transfer collateralization checks (aToken ±1 wei rounding). Still onlyValidAndInitializedSet, pulls components from msg.sender, mints/burns, and charges manager/protocol fees. V1 manager hooks stay onlyManagerAndValidSet. Equity in uses preciseMulCeil as a lower bound after the transfer.
• StreamingFee inflates Set supply to the manager (and protocol cut). feeStates are per Set. Max fee is committed at initialize (onlySetManager + pending Set). updateStreamingFee accrues first and requires the new fee < max.
• IntegrationRegistry add/edit/remove are onlyOwner and require controller.isModule.

Remaining Index Coop: none of the five in-scope addresses. Not submitted.

2026-09-03: 0x leftover Bebop / EulerSwap / Curve (1df9087)

Same Immunefi program 0x ($1,000,000, kyc: true). Same clone /tmp/0x-settler at 1df9087. No mainnet interaction. Maverick / Dodo / BalancerV3 already logged.

Files: src/core/{Bebop,EulerSwap, CurveTricrypto}.sol.

Checked for: Bebop that fills more taker tokens than Settler holds or sends maker proceeds to the operator; EulerSwap that spends a pool the account did not authorize as operator, or that incurs a second EVC controller; Curve callback that spends a Permit2 the taker did not sign.

Result: no user-exploitable finding.

• Bebop settlement is hardcoded _BEBOP = 0xbbbbbBB520d69a9775E85b458C58c648259FAD5F and is a restricted target. Taker fill is min(Settler balance, order.taker_amount); maker fill scales with that. amountOutMin applies before approve + fastSwapSingle. Calldata forces taker_address = address() (Settler) and receiver = recipient. Maker signature is required.
• EulerSwap sellToEulerSwap reads pool params/reserves first (safe because Euler admits only listed tokens), caps ppm of Settler balance at calcLimits (supply cap, cash, borrow cap, operator authorization). Curve solve then fastSwap to recipient if amountOut > 1. checkSolvency refuses a deferred-check account, refuses a second controller, and LTV-adjusts remaining collaterals against the single debt vault’s oracle. A fake pool can only take tokens already in this execution.
• Curve Tricrypto VIP derives the pool via CREATE2 from _curveFactory() + factoryNonce packed in poolInfo. Callback is installed with _setOperatorAndCall. Permit fields live in transient storage. Callback asserts payer == 0 and _transferFroms Permit2 / AllowanceHolder to msg.sender (the pool). Code-prefix hash check is commented out; a colliding CREATE2 at that nonce would still only spend the signed permit.

Remaining 0x: PancakeInfinity, Renegade, Ekubo, Hanji, NucleusTeller. Not submitted.

2026-09-03: 0x leftover Pancake / Renegade / Ekubo / Hanji / Nucleus (1df9087)

Same Immunefi program 0x ($1,000,000, kyc: true). Same clone /tmp/reviews/0x-settler at 1df9087. No mainnet interaction. Bebop / EulerSwap / Curve already logged.

Files: src/core/{PancakeInfinity,Renegade, EkuboV3,Hanji,NucleusTeller}.sol, src/chains/Mainnet/BridgeSettler.sol.

Checked for: Pancake / Ekubo lock that spends a stranger’s Permit2; Renegade that pays a maker more than this Settler holds; Hanji / Nucleus that hits Permit2 or AllowanceHolder.

Result: no user-exploitable finding.

• Pancake Infinity and Ekubo V3 use the same notes / VIP pattern as UniV4 against hardcoded vault / CORE. Payer address(this) transfers from Settler; payer 0 uses Permit2. Fills (hooks, pool manager id, fee) are in the signed action.
• Renegade approves a chain-specific GasSponsorV2, patches sell amount / tokens / recipient into opaque signed calldata, then subtracts maxRefundAmount from reported buy (conservative). minBuyAmount applies.
• Hanji is a caller-chosen book: approve or native ppm, market order, minBuyAmount.
• Nucleus Teller / WPAXG are hardcoded. bridge / depositAndBridge overwrite share or deposit amount to this Settler’s balance and forward selfbalance().

0x Settler listed leftover DEX / bridge mixins treated as exhausted. Not submitted.

2026-09-03: Extra Finance VeToken (LYF)

Same Immunefi program extrafinance ($100,000, kyc: false). Scope address 0xe0BeC4F45aEF64CeC9dCB9010d4beFfB13e91466 (Optimism). Sourcify match fetched to /tmp/extrafinance/vetoken/VeToken.sol. No mainnet interaction.

Checked for: withdraw of another user’s lock; depositFor that extends a stranger’s unlock time; transfer of voting-escrow balance.

Result: no user-exploitable finding.

• Curve-style voting escrow. Locks are per msg.sender. withdraw requires block.timestamp >= end and pays account (msg.sender) only.
• depositFor cannot create a lock or extend end; it only adds tokens to an existing unexpired lock. Tokens come from _msgSender() via safeTransferFrom.
• createLock / increaseAmount / increaseUnlockTime are msg.sender-scoped. Unlock is rounded to weeks and capped at MAX_TIME. checkpoint is permissionless bookkeeping.
• balanceOf is voting power, not an ERC-20 transferable balance.

Remaining Extra Finance in the Immunefi assets table: Aave-fork ACL / PoolAddressProvider / PoolConfigurator / AToken / DebtToken / EXTRA. Vault registry ids 101–105 are not listed on the program. Not submitted.

2026-09-03: Lista DAO Moolah + PublicLiquidator (ce72699)

Immunefi program listadao ($1,000,000, kyc: false, updated 2026-05-29). Newest in-scope adds that day: Moolah 0x8F73b65B4caAf64FBA2aF91cC5D4a2A1318E5D8C and PublicLiquidator 0x882475d622c687b079f149B69a15683FCbeCC6D9 (BSC). Official tree lista-dao/moolah cloned at ce72699. Sourcify exact_match for live Moolah. No mainnet interaction.

Files: src/moolah/Moolah.sol (borrow / repay / supplyCollateral / withdrawCollateral / liquidate / flashLoan / authorization), src/liquidator/PublicLiquidator.sol.

Checked for: borrow of another user’s position; liquidate of a healthy position; PublicLiquidator callback that spends a non-whitelisted pair or keeps leftover approval; flash loan that does not pull back.

Result: no user-exploitable finding in this first slice.

• Borrow / withdrawCollateral require _isSenderAuthorized unless a market provider or broker is set (then only that role). Supply and borrow also gate isWhiteList (empty list = open). Health is checked after share math; liquidity is totalBorrow <= totalSupply.
• liquidate requires the caller on the market’s liquidation whitelist (empty = open), exactly one of seized/repaid, and !_isHealthy. Collateral is sent, then onMoolahLiquidate, then transferFrom of repaidAssets. _isHealthyAfterLiquidate forbids leaving a dust unhealthy leftover below minLoan.
• liquidateBrokerPosition is msg.sender == brokers[id] and writes off shares without seizing collateral (broker-gated).
• Flash loan transfers out, callback, then transferFrom the same amount. Token blacklist is admin-set.
• PublicLiquidator isLiquidatable is an extra allowlist (Moolah open-liq / market / per-user), not the health check — Moolah still requires unhealthy. Flash paths call only pairWhitelist / smartProviders (MANAGER). NoProfit compares pre/post loan or collateral balances. Approvals are zeroed after the swap. onMoolahLiquidate is OnlyMoolah.

Remaining Lista: older lisUSD / slisBNB / clipper / gemJoin / distributor / PSM / OFT / strategy addresses, plus Moolah vault / IRM / broker / credit-loan in the same repo if a later pass wants depth. Not submitted.

2026-09-03: 0x leftover EulerSwap / Curve / Pancake / Bebop / Renegade / Ekubo / Hanji / Nucleus / MakerPSM (1df9087)

Same Immunefi program 0x ($1,000,000, kyc: true). Same clone /tmp/0x-settler at 1df9087 (log text also points at /tmp/reviews/0x-settler). No mainnet interaction. Earlier 0x slices already covered execute / Permit2 / RFQ / UniV3 / AllowanceHolder / BridgeSettler, UniV2 / Velodrome / Across / POSITIVE_SLIPPAGE, leftover bridges, UniV4 / Relay / SETTLER_SWAP, and Maverick / Dodo / BalancerV3.

Files: src/core/{EulerSwap,EulerSwapBUSL, CurveTricrypto,PancakeInfinity,Bebop, Renegade,EkuboV2,EkuboV3,Hanji, NucleusTeller,MakerPSM}.sol, src/core/pancakeInfinityForks/{PancakeInfinity,OrvexCL}.sol, src/chains/{Mainnet,Arbitrum,Base,Bnb,Optimism}/Common.sol (dispatch + hardcoded factory / vault / sponsor / teller).

Checked for: a fake Euler/Hanji pool that drains a later action; Curve VIP callback that spends a Permit2 the taker did not sign; Pancake / Ekubo lock callback that pays a vault the operator did not set; Bebop / Renegade settlement that rewrites receiver past recipient; Nucleus Teller that bridges a user’s WPAXG they did not send this execution; MakerPSM that spends constructor approvals for a caller-chosen fake PSM.

Result: no user-exploitable finding.

• EulerSwap transfers ppm of Settler balance (capped to the pool’s inLimit), then swap after local curve math. Slippage is checked before the swap. A fake pool can only keep tokens already in this execution. EulerSwapBUSL is the licensed curve library, not an entrypoint.
• Curve Tricrypto VIP is compiled out of the Mainnet mixin (//CurveTricrypto) and still live on Arbitrum. Pool is CREATE-derived from a hardcoded factory (0xbC07…EE8) plus the action’s factory nonce. The old bytecode-prefix check is commented out; CREATE from the real factory is the deputy check. Callback asserts payer == 0 and Permit2-transfers the signed token to msg.sender (the derived pool).
• Pancake Infinity vault is hardcoded (0x238a…e6c4 on BNB/Base; Orvex fork 0xFe7E…b0D). Lock uses the same _setOperatorAndCall + notes pattern as UniV4. Payer address(this) transfers from Settler; payer 0 uses Permit2. Hostile hooks are in the signed fills and can only move this execution’s notes. Global buy token is taken to recipient against minBuyAmount.
• Bebop settlement is hardcoded (0xbbbb…AD5F) and is a restricted target. Taker is overwritten to Settler; receiver is overwritten to recipient. Approval is this execution’s balance capped by order.taker_amount. Proportional maker fill is slippage-checked before swapSingle.
• Renegade calls a per-chain hardcoded GasSponsorV2 (Arbitrum 0xcE7a…EBcf, Base 0xD9E0…e80). Sell amount is this Settler’s balance capped by maxSellAmount. Calldata prefix overwrites recipient / buy / sell tokens. Returned buy amount subtracts maxRefundAmount before the slippage check when the refund is not already the buy token.
• Ekubo V2 core 0xe0e0…d444 and V3 core 0x0000…d701 are hardcoded. Same lock/notes pattern. V2 requires payer == address(this) (no VIP). V3 VIP pays via Permit2 to the operator-set core.
• Hanji is a caller-chosen pool. Settler approves ppm of balance (or sends native) and places a market order. A fake pool can only take tokens already in this execution.
• Nucleus Teller (0xeE98…59dF) and WPAXG (0x5cB5…F484) are hardcoded. bridge / depositAndBridge overwrite share/deposit amount to this Settler’s current balance. BridgeData.destinationChainReceiver is in the action. Excess native is documented as an endpoint refund to this contract.
• MakerPSM constructor max-approves only LitePSM / SkyPSM / UsddPSM / UsddGemJoin. Gem is USDT iff psm == UsddPSM, else USDC. A fake dai only changes the local balance read used to size the trade; the real PSM still pulls the approved stable. Oversized fake balanceOf makes the PSM revert when it cannot pull that much.

src/core/univ3forks/* are factory+initHash tables for the already-logged UniV3 path. OrvexCL is address constants only. 0x leftover DEX / teller mixins are exhausted.

Remaining 0x: none of the mixin trees. Not submitted.

2026-09-03: Enzyme Blue Bebop / ThreeOneThird / SharesSplitter (da3b870 + Sourcify)

Immunefi program enzymefinance ($200,000, kyc: false). Gated-redemption wrapper + share-price throttle already logged. This slice is the leftover etherscan adapters / splitter. No mainnet interaction.

Files: GH /tmp/reviews/enzyme-protocol da3b870 contracts/release/extensions/integration-manager/integrations/adapters/BebopBlendAdapter.sol, contracts/persistent/shares-splitter/{SharesSplitterFactory,SharesSplitterLib,TreasurySplitterMixin}.sol, contracts/persistent/global-config/GlobalConfigLib.sol (isValidRedeemSharesCall); Sourcify exact-match Base 0x5a1c0E89133C4Cd844A8B345370565f1368A79A8 (/tmp/reviews/enzyme-tot) ThreeOneThirdAdapter.sol + ThreeOneThirdActionsMixin.sol (added to Immunefi 25 May 2026). BebopBlendAdapter etherscan add is 17 Dec 2025; SharesSplitterFactory is 2022 (same tree).

Checked for: Bebop that sends maker proceeds off-vault or spends past the IM transfer; ThreeOneThird batch that nets spend/incoming so a later hop is unpaid; splitter redeem that cashes another user’s unclaimed shares.

Result: no user-exploitable finding.

• Bebop action is onlyIntegrationManager. parseAssetsForAction requires receiver == vault and isAllowedMaker (list id 0 is documented as any maker). IM Transfers taker_amount to the adapter, then checks the vault’s maker-token delta against minIncomingAssetAmount.
• ThreeOneThird takeOrder has no onlyIntegrationManager; it can only spend tokens already on the adapter (donation / leftover). IM still Transfers net spend assets and requires the vault incoming delta. parseAssets nets from/to per asset, applies ceilDiv(minToReceiveBeforeFees * (10000 - fee) / 10000), then leftover spend/incoming are pushed back to the vault.
• SharesSplitter init is factory-only once. Splits must sum to 100% with unique users. redeemShares claims only msg.sender’s share, then isValidRedeemSharesCall requires the vault accessor and a V4 redeem selector, and the encoded shares amount must equal the claimed amount. Recipient is intentionally unchecked (0x…aaaa).

Remaining Enzyme Blue leftover etherscan adapters: none of Bebop / ThreeOneThird / SharesSplitter. Extra Finance vault / veToken still not on Sourcify. Not submitted.

2026-09-03: Lista leftover PSM / LisUSD / clip-join / slisBNB (3e120da + 67e524c)

Same Immunefi program listadao ($1,000,000, kyc: false). Moolah + PublicLiquidator already logged. Official trees lista-dao/lista-dao-contracts at 3e120da and lista-dao/synclub-contracts at 67e524c. Immunefi HTML (scraped 04:00 UTC 3 Sep) lists lisUSD 0x0782…41E5, PSM(USDT) 0xaa57…eC0c, LisUSDPoolSet 0x37DB…D0Bf, clipCE / clipper rows, GemJoin rows, and slisBNB 0xB0b8…14A1. No mainnet interaction.

Files: contracts/{LisUSD,clip,join}.sol, contracts/psm/{PSM,VaultManager, LisUSDPoolSet,EarnPool}.sol, contracts/ListaStakeManager.sol, contracts/SLisBNB.sol.

Checked for: PSM buy that skips the lisUSD pull; LisUSDPoolSet withdraw that skips a user’s emission bucket; EarnPool that credits a stranger’s PSM fill; Clipper take of a healthy vault; GemJoin exit without vat slip; slisBNB mint without BNB / claim of another user’s unconfirmed request.

Result: no user-exploitable finding.

• PSM sell pulls token, pays amount - fee lisUSD, deposits the full token amount to VaultManager (onlyPSMOrManager). buy pulls amount lisUSD and withdraws amount - fee token to the caller. A 100% buyFee can increment fees without a pull — setBuyFee is MANAGER. Daily buy cap and minBuy apply.
• VaultManager leftover token stays in the vault when adapter points sum to zero; otherwise it distributes by point. Withdraw walks live adapters until remain == 0.
• LisUSDPoolSet shares accrue a synthetic duty (BOT, capped by maxDuty). Rate does not read the token balance, so donations do not inflate shares. Withdraw rounds shares up and requires the caller to drain emission weights first. depositFor is onlyEarnPool.
• EarnPool sells through a manager-set PSM whose token() must match, then depositFor(token, msg.sender, delta). Leftover lisUSD in EarnPool is a gift to the next depositor, not a steal.
• LisUSD mint is onlyMinter. Burn spends the holder or their allowance. DEFAULT_ADMIN is hardcoded TimeLock 0x07D2…5253.
• GemJoin / HayJoin join / exit are auth (Interaction-gated), not public Maker-style joins. Clipper take is also auth + Maker dust / chost rules; PublicLiquidator was the previous slice.
• slisBNB mint/burn is onlyStakeManager. Deposit mints against amountToDelegate + totalDelegated (not address(this).balance). Instant withdraw is whitelist-gated, burns the post-fee amount, and subtracts from the buffer. claimWithdraw only pays a confirmed uuid to that request’s user (or BOT-for-user). Two hardcoded incident addresses redirect to a recovery vault.

Remaining Lista: SnBnb strategy / OFT / older distributors / oracles, and lista-new-contracts (fa5dfa5, RWA / slisXAUE / LisAster) if those addresses are later added to Immunefi. Not submitted.

2026-09-03: Lista Moolah vault + Credit/Lending brokers (ce72699)

Same Immunefi program listadao ($1,000,000, kyc: false). Moolah core + PublicLiquidator already logged. Same clone /tmp/reviews/lista-moolah at ce72699. No mainnet interaction.

Files: src/moolah-vault/MoolahVault.sol (deposit / mint / withdraw / redeem / withdrawFor / redeemFor), src/credit-loan/{CreditBroker,CreditToken, libraries/MoolahOperateLib}.sol, src/broker/LendingBroker.sol.

Checked for: withdrawFor that burns a stranger’s shares without a provider; CreditBroker repay that clears another user’s Moolah debt with the caller as onBehalf; _tryWithdrawAndBurnDebt that withdraws credit tokens without burning; LendingBroker borrow that skips health.

Result: no user-exploitable finding.

• Vault withdraw/redeem go through ERC-4626 _withdraw (sender spends allowance of owner). withdrawFor / redeemFor require msg.sender == provider and pass the provider-supplied sender as that caller. Receiver is the provider. Deposit/mint whitelist the receiver.
• CreditBroker supply/borrow/ withdraw are msg.sender + merkle syncCreditScore. _tryWithdrawAndBurnDebt pulls debtOf credit tokens back to the user so the following sync can _safeBurn the excess. _repay pulls loan tokens from msg.sender and Moolah-repays onBehalf. Penalized positions must be paid in full. Liquidate is BOT and only marks penalized positions bad debt after liquidateBrokerPosition.
• LendingBroker dynamic/fixed borrow is msg.sender, then _validateDynamicPosition / _borrowFixed. Repay paths go through LendingBrokerOperatorLib and pull from the caller for onBehalf.
• MoolahOperateLib.supplyToMoolahVault documents MEV on interest supply; they say it is capped on credit markets. Not filed.

Remaining Lista: providers (SlisBNB / BNB / ERC20-LP), MasterVault + yield strategies, OFT / distributors / lista-new-contracts (fa5dfa5). Extra Finance leftover that is actually in the Immunefi assets table is Aave-fork ACL / PoolAddressProvider / PoolConfigurator / AToken / DebtToken / EXTRA — not vault registry ids 101–105. Not submitted.

2026-09-03: Lista SlisBNB / BNB / ERC20-LP providers (ce72699 + Sourcify)

Same Immunefi program listadao ($1,000,000, kyc: false). In-scope BSC adds: slisBNBProvider 0xfD31…819b (2024-12-04), ERC20TokenProvider 0x2725…aa57 (2025-04-29), BNBProvider 0x3673…5701 / 0x501b…35c9 and SlisBNBProvider 0x33f7…D5f (2025-05-27). Moolah + vault + PSM leftover already logged. Official tree lista-dao/moolah at ce72699. ERC20TokenProvider live proxy is OZ ERC1967; implementation 0x946e5C3d32d33128543B785a446B81eedbe74C05 is Sourcify ERC20LpTokenProvider (contracts/dao/erc20LpProvider/ERC20LpTokenProvider.sol, verified 2026-05-20). No mainnet interaction.

Files: src/provider/{SlisBNBProvider,BNBProvider}.sol (and ETHProvider.sol as the WETH twin — not an Immunefi asset), src/moolah-vault/MoolahVault.sol withdrawFor / redeemFor (already logged; re-read for the provider call), Sourcify ERC20LpTokenProvider.sol.

Checked for: SlisBNBProvider withdraw of another user’s Moolah collateral; permissionless syncUserLp that mints unbacked clis; BNBProvider withdraw/borrow that unwraps to an unauthorized receiver; ERC20-LP deposit that mints clis to a stranger or withdraw that skips the distributor burn.

Result: no user-exploitable finding.

• SlisBNBProvider supplyCollateral pulls slisBNB from msg.sender, supplies to Moolah onBehalf, then _syncPosition. withdrawCollateral requires _isSenderAuthorized (msg.sender == onBehalf or Moolah allowance). liquidate is onlyMoolah. LP rebalance converts userTotalDeposit through STAKE_MANAGER × userLpRate (MANAGER, ≤ 1e18) and mints/burns via _mintToMPCs / _safeBurnLp. If providers[id][TOKEN] is not this contract, recorded collateral is treated as 0 (intended unbind). delegateAllTo is disabled once slisBNBxMinter is set. Permissionless syncUserLp only remints to the recorded holder. Transferring clis away leaves leftover tokens in circulation (_safeBurnLp burns min(need, balance)); that is a receipt-token footgun, not a steal of slisBNB.
• BNBProvider wraps msg.value to WBNB and deposits only into manager-whitelisted vaults whose MOOLAH() / asset() match. withdraw/redeem call vault withdrawFor / redeemFor (msg.sender == provider) with the provider-supplied sender as the ERC-4626 spender, then unwrap to receiver. borrow / withdrawCollateral require isSenderAuthorized. Excess BNB on mint / repay is refunded to msg.sender. liquidate is an empty onlyMoolah hook.
• ERC20LpTokenProvider deposit / withdraw are msg.sender-scoped. _deposit transfers the LP token, depositFors the distributor, then rebalances clis to the chosen delegatee. withdraw calls withdrawFor(_amount, msg.sender) before rebalance. syncUserLp is permissionless bookkeeping. initialize compares _exchangeRate >= userLpRate against storage (still 0), so a bad first-time pair of rates can underflow newReservedLp — that is deploy/admin config, and later setUserLpRate requires _userLpRate <= exchangeRate. Live proxy has been serving since Apr
  2025. Not filed.

Remaining Lista: MasterVault + yield strategies, OFT / distributors / lista-new-contracts. Extra Finance in-scope leftover is Aave-fork ACL / config / aToken / EXTRA, not vault 101–105. Not submitted.

2026-09-03: Lista MasterVault + yield strategies (3e120da)

Same program. Official lista-dao/lista-dao-contracts at 3e120da. Immunefi lists Master Vault 0x986b…cc54 and Ceros / stkBNB / snBNB / bnbYieldConverter strategies (2024-02-22). PSM / clip-join already logged. No mainnet interaction.

Files: contracts/masterVault/MasterVault.sol, contracts/strategy/{BaseStrategy,SnBnbYieldConverterStrategy}.sol, contracts/old/strategy/{CerosYieldConverterStrategy,StkBnbStrategy}.sol.

Checked for: MasterVault mint without onlyProvider; withdrawETH that pays more BNB than burned shares; strategy withdraw callable by a stranger; FIFO distribute that pays the wrong recipient.

Result: no user-exploitable finding.

• depositETH / withdrawETH / withdrawInTokenFromStrategy are onlyProvider. Deposit mints amount - depositFee ceToken to the provider. Withdraw burns amount from the provider, pays amount - withdrawalFee from idle BNB, then pulls the shortfall from active strategies (debt-capped). withdrawInTokenFromStrategy burns first, then withdrawInToken on the strategy. allocate / retireStrat / migrateStrategy are manager.
• BaseStrategy deposit / withdraw are onlyVault. receive accepts BNB only from destination or strategist.
• SnBnb strategy _withdraw records FIFO {recipient, amount} and batches requestWithdraw permissionlessly (≥ 1h). _distributeFund pays the recorded recipient (5000 gas); failed sends go to manualWithdrawAmount (anyone can distributeManual to that recipient). withdrawInToken transfers convertBnbToSnBnb(amount) and decrements bnbDepositBalance. Harvest is strategist-only and sends surplus snBNB (holding − queued unstake − BNB-equivalent) to rewards.
• Ceros / StkBnb old strategies are the same onlyVault deposit/withdraw pattern plus a strategist panic that withdraws vault debt to the vault.

Remaining Lista: OFT / distributors / lista-new-contracts (fa5dfa5). Extra Finance in-scope leftover is the Aave-fork ACL / config / aToken / EXTRA set. Not submitted.

2026-09-03: Lista leftover strategy / OFT / distributors / providers (3e120da + 28a3c02 + fa5dfa5)

Same Immunefi program listadao ($1,000,000, kyc: false). PSM / LisUSD / clip-join / slisBNB already logged. Official trees lista-dao-contracts 3e120da, lista-token 28a3c02, lista-new-contracts fa5dfa5. Immunefi HTML (rechecked 04:03 UTC 3 Sep) lists snBNBStrategy / Ceros / stkBNB / bnbYieldConverter, ListaOFTAdapter 0x837C…E7B3, VenusAdapter(USDT), SlisBNBProvider / ERC20TokenProvider, Borrow / Collateral / Stake distributors, VeListaRevenueDistributor, VeListaInterestRebater, and LendingRewardsDistributor. No mainnet interaction.

Files: contracts/strategy/{BaseStrategy, SnBnbYieldConverterStrategy}.sol, contracts/old/strategy/CerosYieldConverterStrategy.sol, contracts/psm/VenusAdapter.sol, contracts/ceros/{ClisToken,provider/BaseTokenProvider,provider/SlisBNBProvider}.sol, contracts/{Interaction,libraries/AuctionProxy}.sol, lista-token/contracts/oft/ListaOFTAdapter.sol, lista-token/contracts/dao/{CommonListaDistributor,BorrowListaDistributor,CollateralListaDistributor,StakeLisUSDListaDistributor,VeListaRevenueDistributor}.sol, lista-new-contracts/src/{LendingRewardsDistributor,VeListaInterestRebater}.sol.

Checked for: a permissionless strategy withdraw that pays a stranger; Venus harvest that drains principal; provider release of another user’s token; daoBurn that leaves LP spendable after bark; OFT credit while paused; distributor claim of another user’s integral; merkle claim that pays the caller.

Result: no user-exploitable finding.

• SnBnb / Ceros strategies: deposit / withdraw are onlyVault. Harvest is onlyStrategist. FIFO unstake pays the recorded recipient; failed 5k-gas sends go to manualWithdrawAmount[recipient]. Yield is snBNB balance - snBnbToUnstake - convert(bnbDepositBalance) and underflows rather than over-harvest.
• VenusAdapter is onlyVaultManager. Public harvest sends interest above netDepositAmount to feeReceiver. Withdraw cannot exceed netDepositAmount.
• BaseTokenProvider provide / release are msg.sender. liquidation / daoBurn are PROXY. After dog.bark, dao.locked is 0 so daoBurn’s _syncLp burns leftover LP even though it ignores _amount. SlisBNBProvider mints a reserve cut to lpReserveAddress; releaseFor is migrator-only. withdrawLeftover pays dao.free of msg.sender.
• ClisToken mint/burn is onlyMinter; token is non-transferable.
• ListaOFTAdapter is LayerZero OFTAdapter plus pause and per-dest transfer limits. _debit / _credit are whenNotPaused.
• CommonListaDistributor snapshots are MANAGER (Interaction). claimReward pays msg.sender via the vault; vaultClaimReward is VAULT. VeListaRevenueDistributor distribute is BOT and splits to receiver + dEaD.
• LendingRewardsDistributor and VeListaInterestRebater merkle leaves encode chainid, account, totalAmount. Anyone may submit a proof; tokens go to _account. Pending root waits ≥6h (default 1 day). emergencyWithdraw is MANAGER.

Remaining Lista: price-feed oracles, Pancake V3 / BNB vault provider wrappers if they are not the same BaseTokenProvider path, and lista-new-contracts RWA / slisXAUE / LisAster (not in the Immunefi HTML). Not submitted.

2026-09-03: Extra Finance Aave-fork leftover (ACL / config / aToken)

Immunefi program extrafinance ($100,000, kyc: false). LYF + ExtraX + Pool skim + VeToken already logged. Remaining listed assets (2024-11-26) are Optimism Aave-v3-fork PoolConfigurator 0x9378…0ADC, AToken 0x2B27…662E, DebtToken 0xC0C8…d5E, PoolAddressProvider 0xA98c…721d, ACL 0x70Cd…595f, and EXTRA 0x2dad…8f8. Vault registry ids 101–105 are not in the assets table. Sourcify extracts under /tmp/extrafinance/{atoken, debt,poolcfg}. No mainnet interaction.

Files: protocol/tokenization/{AToken,VariableDebtToken}.sol, protocol/pool/PoolConfigurator.sol.

Checked for: aToken mint/burn without onlyPool; debt token that a user can mint to themselves; configurator initReserves / dropReserve callable by a non-admin.

Result: no user-exploitable finding. This is stock Aave v3 tokenization + configurator.

• AToken mint / burn / mintToTreasury / transferOnLiquidation / transferUnderlyingTo / updateTreasury are onlyPool. rescueTokens is onlyPoolAdmin. Scaled balances use getReserveNormalizedIncome.
• VariableDebtToken mint / burn are onlyPool. user != onBehalfOf spends borrow allowance. ERC-20 transfer / approve revert OPERATION_NOT_SUPPORTED.
• PoolConfigurator initReserves is onlyAssetListingOrPoolAdmins; dropReserve / treasury / interest-rate updates are onlyPoolAdmin; collateral / borrow flags are onlyRiskOrPoolAdmins; pause is onlyEmergencyOrPoolAdmin. Roles resolve through the addresses-provider ACL.

Remaining Extra Finance listed Solidity: EXTRA token (standard ERC-20, not pulled here). Vault 101–105 stay OOS. Not submitted.

2026-09-03: Lista new-contracts RWA / slisXAUE / LisAster / leftover distributors (fa5dfa5)

Same Immunefi program listadao ($1,000,000, kyc: false). Official tree lista-dao/lista-new-contracts at fa5dfa5. Immunefi HTML (scraped earlier 3 Sep) still lists the Moolah / PSM / slisBNB table; these RWA / XAUE / LisAster proxies are not on that table. Program text also invites out-of-table Lista assets when the impact matches. No mainnet interaction.

Files: src/rwa/{RWAEarnPool,RWAAdapter, OTCManager}.sol, src/slisXAUE/{SlisXAUE,XAUEAdapter, XAUTStaking}.sol, src/lisaster/{LisAster,LisAsterStaking, LisAsterDistributor,AsterVault, AsterRewards}.sol, src/{LendingRewardsDistributor, LendingRewardsDistributorV2, VaultDistributor,RewardsRouter, BeraChainVaultAdapter}.sol.

Checked for: EarnPool withdraw that pays a stranger; adapter notify that inflates share price for the next depositor; XAUE adapter interest on unowned shares; SlisXAUE mint without MINTER; LisAster claim that redirects payout; claimAndStake that stakes to the caller instead of the leaf account; distributor claim that pays msg.sender; VaultDistributor claim that skips the LP / merkle bind.

Result: no user-exploitable finding on in-scope table assets. Not submitted.

• RWAEarnPool deposit mints then transferFrom to the adapter (reverts together). Whitelist gates receiver on deposit and share transfer. requestWithdraw burns the caller, queues for receiver. claimWithdraw pays user, not the caller. convertToShares/Assets uses totalSupply+1 / totalAssets()+1. finishWithdraw is adapter-only.
• RWAAdapter vault / OTC / fee paths are BOT or MANAGER. _updateVaultAssets only notifies when vault NAV rose.
• SlisXAUE mint/burn is onlyRole (MINTER). XAUTStaking deposit and requestWithdraw sync adapter NAV first. claimWithdraw is self-only. Adapter NAV uses expectedShareBalance and fail-closes on a share deficit or NAV drop.
• LisAster stake/unstake are msg.sender. stakeFor is a permissionless gift. Distributor merkle leaf is (chainid, account, asterToken, cumulative). claim pays account. claimAndStake is self-only and deposits 1:1 into AsterVault then stakeFor.
• LendingRewardsDistributor / V2 claims pay _account after a chainid-bound proof. V2 leaf also binds address(this), claim.selector, and token. RewardsRouter transfers are BOT to a whitelisted distributor.
• VaultDistributor pulls _lpAmount into the contract and never returns it; the leaf binds that amount. MANAGER emergencyWithdraw is the only escape. Not filed: not on the Immunefi table, and a privileged rescue exists.
• BeraChainVaultAdapter user withdraw burns the caller’s LP 1:1. Manager/bot drains are privileged.

Remaining Lista: price-feed oracles / VeLista lock / airdrop. Extra Finance leftover listed Solidity is EXTRA token. Not submitted.

2026-09-03: Lista leftover price-feed oracles (fa5dfa5)

Same Immunefi program listadao ($1,000,000, kyc: false). Same clone /tmp/reviews/lista-new-contracts at fa5dfa5. Program text still excludes third-party oracle data (not oracle-manipulation / flash-loan attacks). No mainnet interaction.

Files: src/oracle/{LisAsterPriceFeed, wNLPPriceFeed,AtlasOracleAdaptor}.sol, src/oracle/priceFeed/sUSDSPriceFeed.sol.

Checked for: a feed that lets a caller set the answer; scale that wraps a negative Atlas price into a huge unsigned; wNLP / sUSDS rate that a stranger can inflate on-chain without touching the wrapper.

Result: no user-exploitable finding. Not submitted.

• LisAsterPriceFeed is ASTER * 0.8 from ResilientOracle peek. No admin. getRoundData stamps block.timestamp.
• AtlasOracleAdaptor rescales 1e18 → 1e8. ans <= 0 becomes 0 (ResilientOracle INVALID_PRICE).
• wNLP and sUSDS multiply the wrapper convert / getNlpByWnlp rate by peek(underlying). Rate has no timestamp (documented). Constructor / constants pin addresses.

Remaining Lista: VeLista lock / airdrop. Extra Finance leftover listed Solidity is EXTRA token. Not submitted.

2026-09-03: Yearn stYFI July leftover (YBC / funding / bonus / team) (69e262e)

Immunefi program yearnfinance ($200,000, kyc: false). July 1 2026 adds: Weight Aggregator 0x6973…ECd7, YBC Weight Aggregator 0xADB7…8D9, YBC 0xd6AF…B315, YBC Reward Distributor 0x5310…bbe1, YBC Election 0xe166…206C, Bonus Recipient 0xf03a…9e4C, Team Registry 0x9da4…2F29, Team impl 0xa59B…BF43, Team Accountant 0x1c22…DFD6, Revenue Recipient 0x5B5A…9587, Revenue Price Oracle 0xC1f9…E2E, Funding Distributor 0xbCc9…116b, Bonus Distributor 0xA660…1116, Bonus Price Oracle 0x7e41…b416, Staking Middleware 0x24b2…0A86. Official tree yearn/stYFI at 69e262e. No mainnet interaction.

Files: contracts/ybc/{YBC, YBCElection,YBCRewardDistributor, YBCWeightAggregator, YBCBonusRecipient}.vy, contracts/{WeightAggregator, FundingDistributor,BonusDistributor, Team,TeamRegistry,TeamAccountant, RewardClaimer,RewardDistributor}.vy.

Checked for: YBC claim that pays the caller instead of the member without a claimer gate; election execute of a failed vote; funding claim by a non-team; bonus claim by a non-owner; RewardClaimer that claims a stranger’s components into the caller.

Result: no user-exploitable finding. Not submitted.

• YBC add_member / remove_member are msg.sender == self via operator call. Election execute is permissionless only after the proposal epoch + 1 and _passed. Members cannot vote their own expulsion.
• YBCRewardDistributor claim requires claimers[msg.sender] and pays the claimer. RewardClaimer is the intended claimer: it calls claim(msg.sender) then transfers to _recipient (default caller).
• FundingDistributor claim is msg.sender == team and registry.is_team. Refund does not unwind used. Team claim_funding is owner-only. return_funding is permissionless donate-back.
• BonusDistributor claim is ITeam(_team).owner(). finalize_period is operator-or-unset.
• WeightAggregator hooks require depositors [msg.sender]. YBCWeightAggregator member hooks require upstream_members; stake hooks require upstream_weights.
• RewardDistributor claim pays msg.sender and unpacks that caller as a registered component.

Remaining Yearn stYFI: Feb 2026 core (StakedYFI / liquid lockers / veYFI distributor) if a later pass wants it. Twyne / Hashflow still unreviewed. Remaining Lista: VeLista lock / airdrop. Not submitted.

2026-09-03: Lista VeLista lock + airdrop (28a3c02)

Same Immunefi program listadao ($1,000,000, kyc: false). Official tree lista-dao/lista-token at 28a3c02. OFT / dao distributors already logged. No mainnet interaction.

Files: contracts/{VeLista, ListaAirdrop}.sol.

Checked for: lock that credits a stranger; claim / earlyClaim that pays the caller for another account; airdrop leaf collision or payout to msg.sender.

Result: no user-exploitable finding. Not submitted.

• lock / relockUnclaimed / extendWeek / claim / earlyClaim are msg.sender. increaseAmountFor is a permissionless gift (caller pays LISTA).
• claim requires the lock expired and not auto-lock, then pays the caller. earlyClaim is self-only, applies getPenalty, and zeros the position.
• ListaAirdrop leaf is keccak256(abi.encodePacked (account, amount)). claim pays account. Owner can change the root only before startTime. reclaim is owner after both reclaimPeriod and endTime.

Remaining Lista leftover: none of the named VeLista lock / airdrop / oracle slices. Extra Finance leftover listed Solidity (EXTRA) is logged below. Not submitted.

2026-09-03: Hashflow factory / pool / router (e41cfaa)

Immunefi program hashflow ($50,000, kyc: false). 8 Jun 2026 listed assets: HashflowFactory 0xdE82…DAb5, plus the three sibling pool/router rows. Official tree hashflownetwork/x-protocol at e41cfaa. No mainnet interaction.

Files: evm/contracts/ {HashflowFactory, HashflowRouter}.sol, evm/contracts/pools/ HashflowPool.sol.

Checked for: permissionless createPool; RFQ-T that pays a stranger without a MM signature; RFQ-M that skips the taker signature; x-chain fillXChain from an unauthorized messenger.

Result: no user-exploitable finding. Not submitted.

• Factory createPool is allowlisted. updatePoolImpl is owner and one-shot.
• Router RFQ-T pulls effectiveBaseTokenAmount from _msgSender and requires an authorized pool. Pool tradeRFQT is router-only, recovers the MM signer, and pays quote.trader. The RFQ-T hash binds trader / effectiveTrader / amounts / nonce / expiry / chainid. Partial fills scale quote tokens down only.
• RFQ-M requires the trader EIP-1271 / EOA signature and a unique txid, then pulls from quote.trader.
• fillXChain requires an authorized messenger and peer pool. Pool fillXChain is router-only and one-shots txid.

Remaining Hashflow: the listed Wormhole messenger (this pass below). There is no Aave portal row in the Immunefi table. Twyne GitHub is still private from this VM. Extra Finance leftover listed Solidity is EXTRA token. Not submitted.

2026-09-03: Extra Finance EXTRA token (Sourcify)

Immunefi program extrafinance ($100,000, kyc: false). Last listed leftover Solidity is Optimism EXTRA 0x2dAD3a13ef0C6366220f989157009e501e7938F8 (token row, 2023-08-30). Sourcify v2 exact match, verified 2024-08-08. Contract name EXTRA. Extract under /tmp/extrafinance/extra-token. No mainnet interaction.

Files: contracts/EXTRA.sol plus stock OZ ERC20 / Ownable.

Checked for: permissionless mint; mint that ignores the cap; ownerless mint via a public initializer.

Result: no user-exploitable finding. This is a capped owner-mint ERC-20. Closes Extra Finance listed Solidity (vault factory ids 101–105 stay off the table). Not submitted.

• Constructor sets an immutable supplyCap. mint is onlyOwner and reverts when totalSupply() + amount exceeds cap(). No burn, no permit, no hooks.
• Primacy of Impact still covers ExtraFi-owned Critical / High / Medium off-table assets; this pass only closes the EXTRA row.

2026-09-03: Hashflow Wormhole messenger (Sourcify)

Same Immunefi program hashflow ($50,000, kyc: false). Fourth 8 Jun 2026 listed asset: Hashflow Wormhole Messenger 0x0a09B370950f69ADC4c2FbF8677C7b0047599c9F. Sourcify v2 exact match, verified 2024-08-08. Contract name HashflowWormholeMessenger. Extract under /tmp/hashflow/wormhole. Factory / pool / router already logged (e41cfaa). No mainnet interaction.

Files: contracts/xchain/ {HashflowWormholeMessenger, HashflowXChainMessengerBase}.sol.

Checked for: tradeXChain from a non-router; a VAA from an unauthorized emitter that still fills; a permissioned-relayer bypass; payload amounts that ignore the source partial fill; replay of the slow + fast VAAs against the same txid.

Result: no user-exploitable finding. Listed Hashflow Solidity is now exhausted. Not submitted.

• tradeXChain is router-only and requires quote.srcChainId == hChainId. Payload quoteTokenAmount is the amount the router already scaled for a partial RFQ-T.
• publishMessage spends messageFee (doubled when a fast consistency level and a permissioned relayer are set). Excess msg.value stays on the messenger; withdrawFunds is owner. Self-grief, not theft.
• wormholeReceive requires a Guardian-valid VAA, a configured source H-chain, and vm.emitterAddress == the stored remote (left- padded). Destination addresses must be canonical EVM (high 12 bytes zero). A non-zero permissionedRelayer must be the caller.
• Router fillXChain still gates messenger + peer pool; pool fillXChain one-shots txid, so the slow and fast VAAs cannot double-pay.
• dstContract / dstCalldata are not MM- signed. Destination callback still requires the callee to opt in both the source caller and the messenger. Dust partial fills of an x-chain RFQ-T can burn dstTrader’s nonce; that is quote griefing, not a redirect.

2026-09-03: Magpie Wombat USDC deposit helper (Sourcify)

Immunefi program magpiexyz ($200,000, kyc: false). Listed 2023-01-13 asset “Main Pool USDC Deposit Helper” 0xb68F5247f31fe28FDe0b0F7543F635a4d6EDbD7F (BSC). Sourcify v2 exact match, verified 2026-06-03. Contract name WombatPoolHelper. Extract under /tmp/magpie/helper. The 26 Aug 2026 add is Primacy of Impact only. No mainnet interaction.

Files: contracts/wombat/ WombatPoolHelper.sol.

Checked for: deposit that stakes to the caller while pulling a stranger; withdraw that burns someone else’s receipt; native path that keeps the wrapped BNB.

Result: no user-exploitable finding. Listed Magpie Solidity is this helper; POI remains. Not submitted.

• deposit / depositLP measure stakingToken balance, call wombatStaking, then _stake the delta to msg.sender. A donated receipt is a gift to the next depositor, not a theft.
• depositNative wraps msg.value, approves exactly that amount, and deposits from the helper.
• withdraw pulls from Wombat for the caller, withdrawFors the same liquidity from MasterMagpie, then burns the receipt.
• harvest is anyone-calls into wombatStaking.

2026-09-03: Lista leftover CDP oracles (3e120da)

Same Immunefi program listadao ($1,000,000, kyc: false). This is the in-scope CDP oracle tree in lista-dao/lista-dao-contracts at 3e120da, not the already-logged lista-new-contracts LisAster / wNLP / Atlas / sUSDS feeds at fa5dfa5. Official HTML / unofficial mirror (3 Sep) lists eight oracle rows: ResilientOracle 0xf3af…c750 plus the STONE / solvBTC / BBTC / SolvBTC.BBN / USDF / asUSDF / USD1 pips. Read-only BSC eth_call only; no state-changing txs.

Files: contracts/oracle/ ResilientOracle.sol, BoundValidator.sol, HelioOracle.sol, PythOracle.sol, API3Oracle.sol, listed pip wrappers (StoneOracle, SolvBtcOracle, BBtcOracle, SolvBTCBBNOracle, xSolvBtcOracle, UsdfOracle, AsUsdfOracle, Usd1Oracle, SlisBnbOracle, BnbOracle, WeEthOracle, asBnbOracle, sUsdxOracle), and contracts/oracle/priceFeeds/* (Stone, SlisBnb, AsBnb, StableUsdt, StableAsUsdf, sUSDX, sUSDXLiquidation, USDXLiquidation, yUSD, yUSDFixed, sUSD1, sUSDe, xSolvBtc, uniBTC, mXRP, wsrUSD, wstUSR, wNLPUSDT, PufEth, WBETH, WstETH, lisUSD).

Checked for: a raw AggregatorV3 main with pivot disabled so a negative answer wraps through uint256(answer) into a huge CDP price; setTokenConfigs without onlyOwner; wrapper peek that returns (huge, true) on a failed inner price; composite feeds that skip positivity or staleness; convertToAssets / convertSnBnbToBnb donation inflation.

Result: no user-exploitable finding on the eight listed oracle addresses. Not submitted.

• getPriceFromOracle casts int256 answer to uint256 with no answer > 0 check (Venus’s original feed does check). If pivot is disabled, _getMainOraclePrice returns (mainPrice, true) with no BoundValidator. A negative aggregator answer would wrap. setTokenConfigs has no modifier but calls setTokenConfig, which is onlyOwner.
• Live getTokenConfig on ResilientOracle (BSC block ~119660895): solvBTC / USDT / USDF / USD1 / WBNB / ETH / BTC / USDe have pivot + fallback enabled. USDX / STONE / slisBNB / asUSDF / BBTC / xSolvBBN / sUSDX / yUSD / XRP are main-only (enabled [1,0,0]).
• Those main-only mains are Lista composites (or WINkLink BBTC/BBUSD), not raw Chainlink — except XRP 0x93a6…4fda (“XRP / USD”). Sampled Chainlink aggregators (XRP, solvBTC, USDT, ETH) have minAnswer = 1, so the wrap cannot fire on those feeds. XRP / yUSD / sUSDX are not on the 57-asset Immunefi table. BBTC’s WINkLink pair has no minAnswer; BBtcOracle still treats price <= 0 as (0, false). Do not file the wrap without a listed asset whose main is a raw feed that can return answer < 0 and pivot off.
• In-scope pip proxies (EIP-1967) all peek() successfully: STONE impl holds STONE + ResilientOracle; solvBTC / BBTC impls hold their token + ResilientOracle; USDF / asUSDF / USD1 impls hold the matching token. Live SolvBTC.BBN pip equals the solvBTC pip ($77,585.27), not the xSolvBtcPriceFeed USD print ($77,613.60). Source SolvBTCBBNOracle would double-count if both peeks were USD 8-dec; that path is not what the live pip returns.
• Wrapper peek() mostly returns has=true. ResilientOracle.peek reverts on invalid, so Interaction / collateralPrice never sees a silent stale-false. SolvBtcOracle / BBtcOracle extra-check price <= 0. WeEthOracle rejects price1 < 0 || price2 < 0 and 6h / 300s staleness.
• Composite latestRoundData mocks updatedAt = block.timestamp, so outer ResilientOracle staleness on the wrapper never fires. Nested latestRoundData still enforces its own window (Stone/ETH 24h+300s, sUSD1 24h+300s, xSolv / PufETH / wstETH 6h+300s, uniBTC / wsrUSD / wstUSR 24h+300s). mXRPPriceFeed ignores updatedAt and clamps the ratio to [1.0, 1.5] 8-dec; mXRP is not on the Immunefi table.
• HelioOracle is owner-set. Trusted. yUSDFixedPriceFeed is hardcoded 112400000 (1.124e8) and is the live yUSD main; not listed. sUSDXLiquidationPriceFeed / USDXLiquidationPriceFeed are documented emergency feeds; manager 0x8d38…B0c6 sets the rate. lisUSDPriceFeed is fixed 1e8.
• StableUsdtPriceFeed clamps USDT to [0.98, 1.02] 8-dec (protocol risk on a deeper depeg, by design).
• sUSDXPriceFeed / yUSDPriceFeed use ERC-4626 convertToAssets (1e18). SlisBnbPriceFeed uses convertSnBnbToBnb over amountToDelegate + totalDelegated, not the contract’s BNB balance, so a raw BNB donation does not inflate the rate.
• PythOracle uses getPriceUnsafe; freshness is only timeDeltaTolerance if that adapter is a ResilientOracle source. API3Oracle divides the 18-dec dAPI by 1e10 to 8-dec.
• BoundValidator rejects reportedPrice == 0 / anchorPrice == 0; ratios are 18-dec.
• Copy-paste notes, not filed: asBnbOracle constant AsBNB_TOKEN_ADDR is the slisBNB address (underprices asBNB if used as a pip; protocol-safe). sUsdxOracle.peek reads USDT, not sUSDX.

Lista CDP oracle + new-contracts oracle + VeLista lock / airdrop slices are now logged. Listed Extra Finance and Hashflow Solidity are exhausted. Not submitted.

2026-09-03: SparkLend sUSDC vault + PSM Variant1 actions (Sourcify)

Immunefi program sparklend ($5,000,000, kyc: false). Newest money-moving adds (15 Jul 2026): Ethereum SUSDC proxy 0xBc65ad17c5C0a2A4D159fa5a503f4992c7B545FE, SUSDC_IMPL 0xf943Cb8D5f06f2bBF352878ebEF3Ec5C537A20bA (UsdcVault, Sourcify exact match, verified 2025-04-29), and USER_ACTIONS_PSM_VARIANT1 0xd0A61F2963622e992e6534bde4D52fd0a89F39E0 (PSMVariant1Actions, verified 2024-09-11). Same impl is listed on Arb / Base / OP / Unichain. Extract under /tmp/spark/{usdc-vault, psm-actions}. No mainnet interaction.

Files: src/UsdcVault.sol, src/PSMVariant1Actions.sol.

Checked for: first-depositor share inflation via donated sUSDS; withdraw that burns a stranger without allowance; exit that transfers more sUSDS than shares; PSM helper that deposits a delta to the caller after a stranger’s pull.

Result: no user-exploitable finding. Not submitted.

• Vault shares are minted 1:1 with sUSDS received from susds.deposit / mint, not from a totalAssets/totalSupply ratio. Donated USDC or sUSDS does not mint shares. exit transfers exactly shares of sUSDS after _burn.
• deposit / mint pull USDC from msg.sender, sellGem through the immutable PSM wrapper, and credit receiver. PSM tin >= WAD halt-closes sells.
• withdraw / redeem pull sUSDS, _burn the owner (allowance if not sender), then buyGem to receiver. tout == type(uint256).max halt-closes buys. Rounding overestimates PSM fees and can leave USDS dust (documented).
• UUPS _authorizeUpgrade is auth (wards).
• PSMVariant1Actions swapAndDeposit measures the DAI delta after sellGem and deposits that to receiver. withdrawAndSwap / redeemAndSwap spend msg.sender’s 4626 allowance. Leftover DAI dust is documented.

Remaining SparkLend after this slice: ALM controllers (logged below at ce5cbd9) plus other-chain vaults / PSM3 and Robinhood / X Layer 13 Jul rows. Not submitted.

2026-09-03: Twyne Aave V3 operators (Sourcify)

Immunefi program twyne ($50,000, kyc: false). GitHub is private from this VM. Vault / wrapper / EVC / factory rows are still Sourcify 404. The three Aave V3 operators (listed June 2026) are exact Sourcify matches (verified 2026-03-06): Teleport 0x868a…bd78, Leverage 0x4519…4A4C, Deleverage 0x229f…5e91. Extract under /tmp/twyne-sourcify. No state-changing txs.

Files: src/operators/AaveV3{Leverage, Deleverage,Teleport}Operator.sol.

Checked for: a stranger flashloan that borrows from someone else’s vault; swap multicall that keeps the Morpho loan; teleport that pulls another user’s aTokens without being the borrower.

Result: no user-exploitable finding. Not submitted.

• executeLeverage / executeDeleverage / executeTeleport require isCollateralVault and borrower() == _msgSender(). onMorphoFlashLoan is Morpho-only. Morpho only callbacks the initiator, so encoded args stay the caller’s.
• Leverage pulls the borrower’s underlying / aTokens via Permit2, supplies Aave, depositATokens to the vault, then EVC-batch skim + borrow on behalf of that borrower. A hostile swapData can only strand this tx (Morpho repay reverts). Leftover aTokens on the operator are deposited to the current vault (donation).
• Deleverage swaps the flashloaned underlying to the target, repays the vault’s Aave debt, checks <= maxDebt, then redeemUnderlying on behalf of the borrower. Dust of target / underlying is sent to the borrower.
• Teleport repays the borrower’s existing Aave debt, Permit2-pulls their aTokens, deposits the wrapper into their vault, and borrows the flashloan amount back. debtAmount is clamped to the user’s live variable-debt balance.

Remaining Twyne: vaults, wrappers, EVC, factories (still Sourcify 404). Not submitted.

2026-09-03: Yearn stYFI February core (69e262e)

Immunefi program yearnfinance ($200,000, kyc: false). July YBC / funding / bonus leftover already logged. This pass is the 15 Feb 2026 stYFI core: StakedYFI 0x42b2…c016, liquid-locker depositors (StakeDAO / 1up / Cove), and the staking reward distributor pattern. Official tree yearn/stYFI at 69e262e. No mainnet interaction.

Files: contracts/{StakedYFI, LiquidLockerDepositor, StakingRewardDistributor}.vy.

Checked for: withdraw that pays a stream that is still locked; redeem of another account without allowance; reward claim that pays the subject instead of the claimer; first-depositor inflation (1:1 vault).

Result: no user-exploitable finding. Not submitted.

• StakedYFI is 1:1. deposit / mint pull from msg.sender and mint to _receiver. unstake burns the caller and starts a 14-day stream. withdraw / redeem spend allowance if _owner != msg.sender and only transfer the streamed (or hook-instant) amount. sweep cannot take asset.
• LiquidLockerDepositor is 1:scale. Transfers of shares are not implemented (only approve). unstake is msg.sender. _redeem enforces the same stream math and allowance.
• StakingRewardDistributor claim(_account) requires claimers[msg.sender] and pays msg.sender (the already-logged RewardClaimer pattern).

Remaining Yearn stYFI Feb: stYFIx / middleware / main RewardDistributor (this pass below). Not submitted.

2026-09-03: Yearn stYFI leftover stYFIx / middleware / main distributor (Sourcify)

Same Immunefi program yearnfinance ($200,000, kyc: false). February rows not in the prior StakedYFI / LL / StakingRewardDistributor pass: stYFIx 0x9C42…9d79 (DelegatedStakedYFI, Sourcify match, verified 2026-02-07), Staking Middleware 0xc32b…4C020 (verified 2026-02-18), Reward Claimer 0xA824…5e50 (verified 2026-02-22), and stYFI Main Reward Distributor 0xd319…5934 (RewardDistributor, verified 2026-02-18). Extract under /tmp/yearn/{styfix, styfi_mw,styfi_claimer, styfi_maindist}. Official tree still 69e262e. No mainnet interaction.

Files: contracts/{DelegatedStakedYFI, StakingMiddleware,RewardClaimer, RewardDistributor}.vy.

Checked for: stYFIx withdraw that pulls stYFI without the instant-whitelist assumption failing closed; middleware that lets a stranger set instant_withdrawal; main distributor claim by a non-component; RewardClaimer that claims a stranger’s components into the caller.

Result: no user-exploitable finding. Not submitted.

• DelegatedStakedYFI is 1:1 over YFI and deposits into StakedYFI. unstake burns the caller and staking.withdraws to itself (needs the stYFI instant-withdrawal whitelist). User assets then stream 14 days. sweep cannot take asset or staking.
• StakingMiddleware hooks require msg.sender == upstream. Instant whitelist and transfer blacklist are management.
• RewardClaimer claim calls each component claim(msg.sender) and forwards tokens to _recipient.
• RewardDistributor claim is nonreentrant and only pays msg.sender when that address is a packed component whose synced epoch is behind current.

Remaining Yearn stYFI Feb: veYFI / stYFIx / LL reward distributors and Vault V3.1.0 (23 Jun) if wanted. Not submitted.

2026-09-03: Balancer V3 Router (Sourcify)

Immunefi program balancer ($1,000,000, kyc: false). 23 Jun 2026 add: V3 Router (V2) 0xAE56…8Ea2. Sourcify v2 exact match, verified 2025-04-29. Contract name Router. Extract under /tmp/balancer/router. No mainnet interaction.

Files: contracts/{Router, RouterCommon,SenderGuard, VaultGuard}.sol.

Checked for: a hook that pulls Permit2 from a stranger; remove-liquidity that sends tokens to the caller instead of params.sender; swap that skips onlyVault; query path that mutates balances.

Result: no user-exploitable finding. Not submitted.

• External API functions saveSender(msg.sender) then _vault.unlock into the matching hook. Hooks are onlyVault + nonReentrant.
• addLiquidityHook / initializeHook pull params.sender via Permit2 (or wrap msg.value when wethIsEth) and settle the Vault. BPT is minted to: params.sender.
• removeLiquidityHook burns BPT from: params.sender and _vault.sendTo / unwraps WETH to that sender. Recovery hook is the same.
• swapSingleTokenHook takes tokenIn from params.sender and sends tokenOut to them. Deadline is block.timestamp.
• Queries are separate query* entrypoints; they do not settle.

Remaining Balancer 23 Jun rows: ProtocolFeeController and the V3 factory / oracle factory set (CompositeLiquidityRouter logged below). Not submitted.

2026-09-03: Yearn stYFI leftover LL redemption / LL+veYFI distributors (69e262e)

Same Immunefi program yearnfinance ($200,000, kyc: false). Official tree yearn/stYFI at 69e262e. February rows not in the StakedYFI / depositor / stYFIx / StakingMiddleware pass: LiquidLockerMiddleware, LiquidLockerRedemption (in-tree; no separate Immunefi row), LiquidLockerRewardDistributor 0x7eFc…A000, and VotingEscrowRewardDistributor (veYFI) 0x2548…e884. No mainnet interaction.

Files: contracts/{ LiquidLockerMiddleware, LiquidLockerRedemption, LiquidLockerRewardDistributor, VotingEscrowRewardDistributor}.vy.

Checked for: a stranger hook that credits another account’s LL weight; redeem that pays more YFI than the scale allows; exchange that underflows used into extra LL; reward claim that pays the subject instead of the claimer.

Result: no user-exploitable finding. Not submitted.

• LiquidLockerMiddleware forwards on_stake / on_unstake to downstream
  • aggregator. Both require msg.sender == upstream.
• redeem is enabled + epoch < lock. It increments used by _ll_amount // scale (must be > 0 and <= capacity), pulls LL tokens from the caller, and pays YFI minus a decaying fee (MAX_FEE 10% over 104 epochs). Dust below scale stays with the LL recipient. Fee YFI remains in the contract; sweep is management.
• exchange decrements used (Vyper underflow reverts), pulls YFI, and pays yfi * scale LL tokens from inventory.
• LiquidLockerRewardDistributor and VotingEscrowRewardDistributor claim(_account) require claimers[msg.sender] and pay msg.sender. Permissionless reclaim only moves expired rewards (bounty + reclaim_recipient).

Remaining Yearn: Vault V3.1.0 (23 Jun) if wanted. Not submitted.

2026-09-03: TermMax TMX token (Sourcify BSC)

Same Immunefi program termstructurelabs ($80,000, kyc: false). 24 Aug 2026 rows: TMX Ethereum and BNB 0x3c2F…0039. Ethereum Sourcify 404. BSC Sourcify exact match, flattened MyOFT.sol (Hardhat 2.28). Extract under /tmp/tmx-sourcify/bsc. V2 market / vault / router already logged. No state-changing txs.

Files: contracts/MyOFT.sol (LayerZero OFT v3 flatten).

Checked for: a public mint after deploy; _credit to an attacker; constructor mint on BSC.

Result: no user-exploitable finding. Not submitted.

• MyOFT is stock LayerZero OFT. _debit burns amountSentLD; _credit mints to _to (address(0) remaps to 0xdead).
• Constructor Ownable(_delegate). It mints 1e9 ether only when block.chainid == 1. The BSC bytecode therefore does not premint.
• No extra mint / burn entrypoints beyond OFT send/receive.

Remaining TermMax adapters (Kyber, OKX, Pancake, Kodiak, vault helpers) are still lower-priority copies of the already-logged approve-and-call pattern. Not submitted.

2026-09-03: Balancer V3 CompositeLiquidityRouter (Sourcify)

Immunefi program balancer ($1,000,000, kyc: false). 23 Jun 2026 row CompositeLiquidityRouter (V2) 0xb21A…5c8A. Sourcify exact match. Extract under /tmp/balancer-clr. The V3 Router row is already logged. No mainnet interaction.

Files: contracts/CompositeLiquidityRouter.sol (hooks + wrap helpers).

Checked for: a hook that mints BPT to the router; wrap that pulls a stranger; unwrap that sends tokens to msg.sender instead of params.sender.

Result: no user-exploitable finding. Not submitted.

• External add/remove functions saveSender (msg.sender) and _vault.unlock into onlyVault hooks. params.sender is that caller.
• Unbalanced / proportional add send BPT to: params.sender. Tokens are _takeTokenIn from that sender (Permit2 / ETH wrap).
• Proportional remove burns BPT from: params.sender and _sendTokenOut to them after optional buffer unwrap. minAmountsOut is checked per token.
• Buffer wrap/unwrap is the Vault’s erc4626BufferWrapOrUnwrap. Uninitialized buffers revert. Query paths are static-call only.

Remaining Balancer 23 Jun rows: ProtocolFeeController (this pass below) and the V3 factory / oracle factory set. Not submitted.

2026-09-03: Balancer ProtocolFeeController (Sourcify)

Immunefi program balancer ($1,000,000, kyc: false). 23 Jun 2026 leftover after Router + CompositeLiquidityRouter: ProtocolFeeController (V2) 0x212F…C2879. Sourcify exact match, verified 2025-05-21. Extract under /tmp/balancer/pfc. No mainnet interaction.

Files: contracts/{ProtocolFeeController, VaultGuard}.sol.

Checked for: fee collect / withdraw that pays a non-creator; split math that credits the caller; migratePool that overwrites live fee balances.

Result: no user-exploitable finding. Not submitted.

• collectAggregateFees is permissionless and only pulls the Vault’s aggregate cut into this contract (onlyVault hook).
• Protocol withdraw is authenticate. Creator withdraw with a recipient is onlyPoolCreator; the public overload pays _getPoolCreator(pool).
• Split math reconstructs the pre-aggregate notional then assigns protocol first; underflow on a rounding inversion fail-closes.
• migratePool copies percentages from the current Vault controller and cannot run when this contract is already the controller. Fee balances are not copied.

Remaining Balancer 23 Jun rows: V3 factory / oracle factory set (FixedPriceLBPoolFactory, Gyro2CLPPoolFactory, StableLPOracleFactory, LBPoolFactory this pass below, Stable / Weighted / ReClamm / StableSurge factories, EclpLPOracleFactory, GyroECLPPoolFactory). Not submitted.

2026-09-03: Spark ALM controller (ce5cbd9)

Immunefi program sparklend ($5,000,000, kyc: false). Listed GitHub rows marsfoundation/spark-alm-controller MainnetController.sol, ForeignController.sol, ALMProxy.sol, RateLimitHelpers.sol, plus live ALM_CONTROLLER / ALM_PROXY / ALM_RATE_LIMITS on Ethereum / Base / OP / Arb / Avalanche / Unichain / Robinhood / X Layer. Local clone /tmp/spark-alm at ce5cbd9. No mainnet interaction.

Files: src/{MainnetController,ForeignController,ALMProxy,ALMProxyFreezable,RateLimits,RateLimitHelpers,OTCBuffer,WEETHModule}.sol, src/libraries/{CCTPLib,ERC4626Lib,LayerZeroLib,PSMLib,AaveLib,ApproveLib}.sol.

Checked for: a relayer transferAsset to an unlisted destination; CCTP mintRecipient taken from the caller; 4626 deposit that mints to the relayer; LayerZero to override; OTC claim that unlocks a later send without returning value; take that pulls a user Spark vault; farm stake to an arbitrary farm without a rate-limit key.

Result: no user-exploitable finding. Not submitted.

• ALMProxy.doCall / doCallWithValue / doDelegateCall are CONTROLLER only. RateLimits decrease / increase is CONTROLLER only. Unset keys revert (zero-maxAmount).
• transferAsset burns LIMIT_ASSET_TRANSFER(asset, destination) before the proxy transfer. Same pattern on ForeignController.
• CCTP uses mintRecipients[domain] (admin-set). Zero recipient reverts. Dual global + domain rate limits.
• 4626 deposit mints shares to the proxy, requires minSharesOut and assets/shares <= maxExchangeRates[token]. Unset max rate is 0, so a deposit of assets > 0 reverts. Withdraw/redeem restore the deposit key using assets received.
• LayerZero to is layerZeroRecipients[eid]. Comment on the wrapper: keep the rate-limit key at zero until OFTs are integration-tested. minAmountLD is filled from quoteOFT.
• OTC first send is allowed because storage sent18 is still 0 at the ready check. Later sends need claimed + recharge >= sent * maxSlippage. Assets and the exchange buffer are admin whitelists. Compromised relayer + junk whitelist is their documented OTC trust assumption.
• Farm / Maple / Superstate / Spark-vault take / wstETH / weETH / Ethena prepare-approve are rate-limited (or destination-keyed). setDelegatedSigner is relayer-callable; SECURITY.md accepts Ethena’s off-chain checks. Dai↔USDS is 1:1 inside the proxy (no rate limit; accepted parity assumption).
• FREEZER can removeRelayer. Threat model treats the relayer as compromisable and bounds loss by rate limits. Users do not call these entrypoints.

Remaining SparkLend after this slice: SparkVault V2 (logged below) plus PSM3 / treasury controllers and the 13 Jul Robinhood / X Layer rows. Not submitted.

2026-09-03: SparkVault V2 (51c6d7a)

Immunefi program sparklend ($5,000,000, kyc: false). Listed GitHub row sparkdotfi/spark-vaults-v2 src/SparkVault.sol (“Spark Savings V2”). Local clone /tmp/spark-vaults-v2 at 51c6d7a. No mainnet interaction.

Files: src/SparkVault.sol (sUSDS-style pot).

Checked for: first-depositor inflation via a dust mint plus a raw asset donation; take by a non-taker; redeem that pays msg.sender instead of receiver; chi/VSR overflow that mints extra shares; taker depositing then redeeming other users’ liquidity.

Result: no user-exploitable finding. Not submitted.

• PPS is chi, not balance / supply. A raw donation does not change convertToShares. Initial chi == RAY so the first deposit is 1:1.
• take is TAKER_ROLE only and just _pushAssets. Liquidity can go below totalAssets() (assetsOutstanding). That is the ALM model already reviewed above; maxRedeem / maxWithdraw are capped by the token balance.
• Deposit/mint pull msg.sender and mint to receiver (not 0 / self). Taker cannot be sender or receiver. Redeem / withdraw burn owner (allowance if sender ≠ owner) and pay receiver.
• drip is the Maker pot _rpow. VSR is bounded to [RAY, MAX_VSR] (100% APY). UUPS initialize is initializer-gated; impl constructor disables initializers. Upgrade is admin-only.

Remaining SparkLend after this slice: PSM3 (logged later this pass) plus treasury controllers and the 13 Jul Robinhood / X Layer rows. Not submitted.

2026-09-03: Yearn Vault V3.1.0 (Sourcify)

Immunefi program yearnfinance ($200,000, kyc: false). 23 Jun 2026 rows: Vault V3.1.0 0xdD3F…7824 (Sourcify match, Vyper YearnV3Vault, verified 2026-06-19), Tokenized Strategy V3.1.0 0x310f…1e76 (exact match, TokenizedStrategy), Vault V3.1.0 Factory 0x310a…bcAC (match, YearnVaultFactory). Extracts under /tmp/yearn/{vault310,strat310,vfact310}. No mainnet interaction.

Files: YearnV3Vault.vy, src/TokenizedStrategy.sol, YearnVaultFactory.vy.

Checked for: first-depositor inflation via a 1-wei deposit plus a raw asset donation; redeem that pays msg.sender instead of receiver / burns a stranger; process_report that mints unlocked profit; factory fee unpack that points fees at the caller; strategy MINIMUM_SUPPLY bypass that lets a dust depositor steal a later deposit.

Result: no user-exploitable finding. Not submitted.

• Vault total_assets is total_idle + total_debt, not the ERC20 balance. A raw donation does not change PPS until process_report(self) (role-gated) accrues it into idle. Empty supply mints 1:1; `total_supply

  0andtotal_assets == 0 mints 0 shares (cannot mint zero`).

• Deposit pulls msg.sender and mints to recipient (cannot be address(0) or self). Redeem burns owner (allowance if sender ≠ owner) and pays receiver. Losses from the withdraw queue are capped by max_loss.
• Profit is locked as shares minted to the vault and unlocked over profit_max_unlock_time. Fees go to the accountant and the factory protocol_fee_config recipient.
• Factory deploy_new_vault is create2 + initialize. Protocol fee bps ≤ 5000. Custom vault fees still pay the default recipient. Governance is two-step.
• TokenizedStrategy 3.1.0 simulates constant accrual for convertTo* / totalAssets. MINIMUM_SUPPLY (1e3) confiscates profit into supply while under the floor. Deposit transfers first, then deployFunds, then mints. Withdraw freeFunds then pays receiver. report / tend are keeper-only.

Remaining Yearn listed Solidity after this slice: none of the 23 Jun V3.1.0 trio. Older 3.0.4 vault / factory rows were already in the table and were not re-read here. Not submitted.

2026-09-03: Balancer V3 LBPoolFactory (Sourcify)

Immunefi program balancer ($1,000,000, kyc: false). 23 Jun 2026 leftover factory row: V3 LBPoolFactory (V4) 0x6642…069A. Sourcify exact match, verified 2026-05-16. Extract under /tmp/balancer/lb_factory. WeightedPoolFactory 0x3326…1D99 and StablePoolFactory 0x4eFc…3228 are Sourcify 404 on Ethereum / Base / Arbitrum / Optimism / Polygon from this VM. No mainnet interaction.

Files: contracts/lbp/{LBPoolFactory, BaseLBPFactory,LBPValidation, LBPool,LBPCommon}.sol, @balancer-labs/v3-pool-utils/contracts/BasePoolFactory.sol.

Checked for: create that registers attacker bytecode as a Balancer pool; hook set to a stranger; add liquidity by a non-owner through an untrusted router; remove during the sale.

Result: no user-exploitable finding. Not submitted.

• create deploys the factory’s LBPool creationCode via create2 (salt binds msg.sender + chainid) and registers that pool as its own hook. Tokens are the two LBP tokens, STANDARD, sorted. Unbalanced liquidity is disabled.
• onRegister requires pool == address(this) and two STANDARD tokens.
• onBeforeAddLiquidity requires the trusted router and getSender() == owner(), and onlyBeforeSale.
• onBeforeInitialize is owner-via-getSender and onlyBeforeSale. Seedless LBPs reject a non-zero reserve amount. Init frontrun is the documented factory DoS, not a steal.
• onBeforeRemoveLiquidity reverts while the sale is live.

Remaining Balancer 23 Jun factories: ReClamm + LP oracle factories this pass below; FixedPrice LBP, Gyro2CLP, GyroECLP, StableSurge, plus Weighted / Stable (Sourcify 404). Not submitted.

2026-09-03: Balancer ReClamm factory + LP oracle factories (Sourcify)

Immunefi program balancer ($1,000,000, kyc: false). 23 Jun leftover: ReClammPoolFactory (V3) 0x3ccD…ab7FF (exact match, verified 2026-05-14), StableLPOracleFactory (V2) 0x765c…A93c (2026-02-27), WeightedLPOracleFactory (V2) 0x4b4b…85C6 (2026-04-04), EclpLPOracleFactory 0x301E…54B (2026-04-04). Extract under /tmp/balancer/{reclamm, stable_oracle,weighted_oracle, eclp_oracle}. FixedPrice LBP / Gyro2CLP / GyroECLP / StableSurge factories are still Sourcify 404. No mainnet interaction.

Files: contracts/{ReClammPoolFactory, lib/ReClammPoolFactoryLib, ReClammPool}.sol, contracts/{LPOracleFactoryBase, LPOracleBase,StableLPOracle, WeightedLPOracle,EclpLPOracle, *Factory}.sol.

Checked for: factory create that registers attacker bytecode; ReClamm hook used by a stranger pool; 1-token ReClamm that skips Vault min-token checks; factory oracle that overwrites a canonical feed set; TVL that credits a transient balance when the vault is locked.

Result: no user-exploitable finding. Not submitted.

• ReClamm create deploys the factory’s ReClammPool creationCode (helper vault must match) and registers that pool as its own hook. Donation is off; unbalanced liquidity is disabled. onRegister requires pool == address(this), two tokens, and those liquidity flags. Factory tokens.length <= 2 without an explicit min still fail-closes at onRegister.
• Init / add / remove hooks are onlyVault and scale virtual balances with supply. Price-range params are bounded in ReClammPoolFactoryLib.
• Oracle factories deploy a new oracle per (pool, flags, feeds) id. A junk feed list cannot replace an existing id. latestRoundData is TVL / BPT supply; sequencer uptime is checked when a feed is configured. shouldRevertIfVaultUnlocked is an integrator flag. Feeds are caller-chosen; isOracleFromFactory is not a price-feed whitelist.

Remaining Balancer 23 Jun factories: FixedPrice LBP, Gyro2CLP, GyroECLP, StableSurge, Weighted / Stable (Sourcify 404). Not submitted.

2026-09-03: Balancer leftover Sourcify-404 factories (official monorepo)

Immunefi program balancer ($1,000,000, kyc: false). 23 Jun 2026 rows still open after PFC / Router / CLR / LBPool / ReClamm / LP oracles: FixedPriceLBPoolFactory 0xeb1a…8758, Gyro2CLP 0x8902…ECC6, GyroECLP 0x04d5…69d1, StableSurge 0x187a…A6Ac, V3 Stable 0x4eFc…3228, V3 Weighted 0x3326…1D99. Sourcify v2 and repo.sourcify.dev full/partial match are 404 from this VM. create() bodies were read from official balancer/balancer-v3-monorepo main raw files (3 Sep; same BasePoolFactory pattern as the Sourcify-exact LBPool / ReClamm factories). No state-changing txs.

Files (GitHub main, not bytecode-matched): FixedPriceLBPoolFactory.sol, Gyro2CLPPoolFactory.sol, GyroECLPPoolFactory.sol, StablePoolFactory.sol, WeightedPoolFactory.sol, StableSurgePoolFactory.sol, BasePoolFactory.sol.

Checked for: a create that registers a pool the factory did not deploy; CREATE2 salt that omits the sender so a stranger can collide; a hook/role account the caller cannot set; StableSurge registering a stranger hook.

Result: no user-exploitable finding. Not submitted. Bytecode match is unverified here; do not file against these addresses until Sourcify/Etherscan confirms the same create().

• Every factory _creates (CREATE2 salt keccak(msg.sender, chainid, salt)) then registerPools in the same transaction. disable() is authenticate.
• Gyro factories revert unless tokens.length == 2. Stable / StableSurge cap at StableMath.MAX_STABLE_TOKENS. Weighted computes minTokenBalances via MinTokenBalanceLib.
• FixedPrice LBP requires projectTokenRate != 0 and blockProjectTokenSwapsIn (buy-only), then uses the same _registerLBP path (pool is the hook; poolCreator is a create argument).
• StableSurge hardcodes the factory’s StableSurgeHook. Other factories take poolHooksContract / roleAccounts as documented create args. protocolFeeExempt is always false.

23 Jun Balancer leftover is exhausted. Older Jan 2025 BatchRouter / BufferRouter rows are unchanged. Not submitted.

2026-09-03: Spark PSM3 (2b1a72a)

Immunefi program sparklend ($5,000,000, kyc: false). Listed GitHub row marsfoundation/spark-psm src/PSM3.sol, plus live PSM3 on Base 0x1601…47E, Optimism 0xe0F9…7F62, Arbitrum 0x2B05…7266, Unichain 0x7b42…312f. Local clone /tmp/spark-psm at 2b1a72a. Live totalShares() was read via eth_call only (Base ~3.41e24, OP ~1.57e24, Arb ~4.63e25). No state-changing txs.

Files: src/PSM3.sol, deploy/PSM3Deploy.sol, test/unit/{InflationAttack,DoSAttack}.t.sol.

Checked for: first-depositor inflation via a 1-wei share plus a USDC donation; deposit that mints 0 shares after a pre-seed donation (totalShares == 0 and totalAssets > 0); swap that pays a stranger; withdraw that burns another user’s shares; pocket drain by a non-owner.

Result: no submittable finding. Not submitted.

• README marks both attacks CRITICAL and requires a deploy-time seed of at least 1e18 shares. PSM3Deploy deposits 1e6 USDC (1e18 value) to address(0) so those shares cannot withdraw. In-repo tests show the unseeded 1-wei + 10m donation path and the pre-seed 0-share DoS.
• Live listed PSM3s already have ≫ 1e18 shares. The documented seed mitigation is in place. Do not file a test-suite attack against a seeded pool.
• Swaps are 1:1 USDC↔USDS or sUSDS via the immutable rate provider. minAmountOut / maxAmountIn bind the caller. Receiver cannot be 0.
• Deposit mints to receiver then pulls msg.sender. Withdraw burns msg.sender then pushes to receiver. USDC custody is pocket (Base live pocket is the PSM itself). setPocket is owner-only and moves the full USDC balance.

Remaining SparkLend: treasury / cap automator / ratio oracles (this pass below) and the 13 Jul Robinhood / X Layer rows. Not submitted.

2026-09-03: Spark CapAutomator + ratio oracles + CollectorController (Sourcify)

Immunefi program sparklend ($5,000,000, kyc: false). 5 Mar 2026 leftover: CapAutomator v1.1.0 0x4C13…F2eE (exact match, verified 2026-03-09), cbBTC/weETH/rETH ratio oracles (0x64B1…cCBC, 0x4C80…b7E4, 0xd0B3…8d06), plus Ethereum TREASURY_CONTROLLER 0x92eF…8F7a (CollectorController, verified 2025-06-23). Treasury proxy rows are InitializableAdminUpgradeabilityProxy only. Extract under /tmp/spark-leftover/{cap_auto, cbbtc_oracle,weeth_oracle, reth_oracle,treasury_ctrl}. No mainnet interaction.

Files: src/CapAutomator.sol, src/{CBBTC,WEETH,RETH}RatioOracle.sol, CollectorController.sol.

Checked for: a public exec that raises caps past max; same-block cap pump; ratio oracle that returns 1e18 on a dead feed; controller transfer by a non-owner.

Result: no user-exploitable finding. Not submitted.

• Cap config is DEFAULT_ADMIN_ROLE. exec / execSupply / execBorrow are UPDATE_ROLE. New cap is min(usage + gap, max). Increases respect increaseCooldown; decreases do not. A second update in the same block returns the current cap.
• Ratio oracles return 0 when a feed is non-positive (or the LST rate is 0). Kill-switch consumers treat that as a halt, not a peg. Feeds are immutable.
• CollectorController approve / transfer are onlyOwner and forward to the collector proxy.

Remaining SparkLend: the 13 Jul Robinhood / X Layer executor / receiver rows (ALM + Vault V2 on those chains already logged). Not submitted.

2026-09-03: Yearn leftover yYB token / operator / locker / staker / distributor (Sourcify)

Same Immunefi program yearnfinance ($200,000, kyc: false). 5 Jan 2026 rows: yYB Token 0x2222…9D6 (exact YToken), Operator 0x1111…4af9 (exact), Locker 0x0000…6A (exact), Boosted Staker 0x5D2e…AD91 (match, YearnBoostedStaker), Reward Distributor 0x1d02…746 (match, SingleTokenRewardDistributor). Extract under /tmp/yearn-yyb. Vault V3.1.0 + stYFI leftovers already logged. No state-changing txs.

Files: src/{YToken, Operator,Locker}.sol, YearnBoostedStaker.sol, SingleTokenRewardDistributor.sol.

Checked for: a stranger YToken.mint that skips the underlying transfer; Locker.execute that anyone can call; nftTransferCallback that mints without a lock increase; distributor claimFor that pays the claimer; staker stakeAsMaxWeighted that is permissionless.

Result: no user-exploitable finding. Not submitted.

• YToken.mint pulls token to the locker and Operator.lock unless msg.sender is the locker operator (NFT wrap path). sweep / setLocker are owner or operator.
• Locker.execute / safeExecute are owner or operator. Escrow increase_amount is blocked unless the operator calls. onERC721Received requires the escrow NFT and forwards to nftTransferCallback.
• Operator nftTransferCallback is locker-only and mints the lock-amount delta. lock is onlyLockers (yToken is authorized at construct). Gauge / DAO votes are role-gated.
• Staker stake / unstake use even amounts and checkpoints. stakeAsMaxWeighted is approvedWeightedStaker. stakeFor / unstakeFor need approvedCaller.
• Distributor claim / claimWithRange pay the account (or its configured recipient). claimFor needs approvedClaimer. Skipping weeks in a ranged claim is a documented self-lockout. pushRewards only moves a past week with zero adjusted global weight.

Yearn 23 Jun + Jan 2026 yYB leftovers are exhausted. Auction / splitter / 3.0.4 factory rows (this pass below). Not submitted.

2026-09-03: Yearn AuctionFactory leftover (Sourcify)

Immunefi program yearnfinance ($200,000, kyc: false). 29 Oct 2025 row: Auction Factory 0xbC58…7526. Sourcify exact match, verified 2025-11-26, AuctionFactory v1.0.3. Extract under /tmp/yearn-leftover/auction_fact. Splitter Factory 0xe28f…614D is a flattened Vyper match; 3.0.4 Vault Factory 0x770D…812F is YearnVaultFactory.vy (same pattern as the already-logged 3.1.0 factory). No mainnet interaction.

Files: src/Auctions/{AuctionFactory, Auction}.sol.

Checked for: factory create that initializes to an attacker receiver; take that sends from without pulling want; CoW isValidSignature that accepts a stranger receiver; kick that restarts a live auction.

Result: no user-exploitable finding. Not submitted.

• Factory clones the immutable Auction original via create2 and initializes want / receiver / governance / starting price.
• take is nonReentrant. It transfers _from to the taker, optional callback, then safeTransferFrom want from msg.sender to receiver. A failed pay reverts the take.
• CoW signature requires receiver == receiver, buyToken == want, buyAmount >= needed, feeAmount == 0.
• kick needs an enabled auction past AUCTION_LENGTH and a non-zero balance. enable / disable / sweep / forceKick are governance.

Remaining Yearn: splitter factory flatten and 3.0.4 vault factory (this pass below). Not submitted.

2026-09-03: Yearn splitter factory + 3.0.4 Vault Factory leftover (Sourcify)

Immunefi program yearnfinance ($200,000, kyc: false). 29 Oct 2025 rows: Splitter Factory 0xe28f…614D and Vault Factory 3.0.4 0x770D…812F. Factory Sourcify exact match (verified 2025-01-14, Vyper 0.3.7 flatten). ORIGINAL splitter 0x8e8e…6f69 Sourcify exact match (verified 2026-02-01). 3.0.4 factory is YearnVaultFactory.vy API 3.0.4, same pattern as the already-logged 3.1.0 factory. Extract under /tmp/yearn-leftover/{splitter_fact,splitter_impl,vault304_fact}. No mainnet interaction.

Files: Vyper_contract.vy (factory + impl), YearnVaultFactory.vy.

Checked for: factory newSplitter that leaves the clone uninitialized or points ORIGINAL at an attacker impl; initialize that can be replayed; unwrapVault that redeems to a stranger; distribute* that pays an attacker cut; fundAuction that anyone can drain; set* that a non-manager / non-splitee can flip; 3.0.4 deploy_new_vault that skips initialize or lets a stranger take protocol fees.

Result: no user-exploitable finding. Not submitted.

• Factory create_minimal_proxy_to the immutable ORIGINAL (0x8e8e…6f69) and initializes in the same tx. Permissionless deploy is intended.
• Impl initialize is one-shot (manager == 0). Manager, recipient, and splitee must be non-zero; split must be non-zero. Default maxLoss is 1.
• unwrapVault(s) are manager or splitee. Redeem sends assets to self with stored maxLoss.
• distribute* are manager or splitee. Manager cut is balance * split / 10_000; remainder to splitee. split == 10_000 pays the manager recipient only.
• fundAuction(s) are manager or splitee and transfer to the stored auction. auction starts unset; sending to 0 is a trusted-role burn.
• setMangerRecipient / setSplit / setMaxLoss / setAuction are manager-only. setSplitee is current-splitee-only. setSplit has no MAX_BPS cap (manager can brick distribute with unsafe_mul / unsafe_sub); trusted role, not a user finding.
• 3.0.4 factory deploy_new_vault is create2 (msg.sender, asset, name, symbol) + initialize. Protocol fee bps ≤ 5000. Custom vault fees still pay the default recipient. Governance is two-step. shutdown_factory is one-way.

Yearn 29 Oct 2025 leftover rows (AuctionFactory + splitter factory + 3.0.4 factory) are exhausted. Not submitted.

2026-09-03: GammaSwap vault May 2026 leftover + PositionManager

Immunefi program gammaswap ($40,000, kyc: false, Primacy of Rules, critical only, PoC required). 10 May 2026 leftover: VaultGammaPool 0xbd6e…311c (live factory protocol 3 impl), VaultBorrow / Repay / Rebalance / ExternalRebalance / Liquidation / ExternalLiq / BatchLiq / Short strategies, CPMMMath, VaultBatchLiquidation (listed; pool no-ops batch + external liquidate), and PositionManager proxy 0x3b72…98b0 → impl 0x3Cc1…fB37 (Sourcify exact PositionManagerExternalWithStaking). Sources: @gammaswap/v1-implementations@1.2.18 /tmp/gammaswap-impl e71dd91, v1-core /tmp/gammaswap-core 2312d0e, periphery Sourcify /tmp/gammaswap-pm (repo v1-periphery 6774367). Live factory 0xFD51…c20B owner 0x937f…C3Fb. getLoanObserver(1..15) all unset (zero addr, refType 0). Known issues list empty. No Arbitrum state-changing txs from this VM.

Files: contracts/pools/VaultGammaPool.sol, strategies/vault/**, libraries/cpmm/CPMMMath.sol, v1-core AbstractLoanObserverStore

• LibStorage.createLoan, PositionManager{,WithStaking,ExternalWithStaking}.sol, base/{Transfers,GammaPoolERC721,GammaPoolQueryableLoans}.sol.

Checked for: anyone opening a refType-3 interest-free loan; reserved-LP global counter theft; reserved borrowed invariant desync on repay; share-price inflation from reserved debt; no-op liquidation freezing funds; PositionManager callback paying a stranger; public clearToken / unwrapWETH stealing user funds in flight.

Result: no user-exploitable finding. Not submitted.

• createLoan(refId) reads getPoolObserverByUser from the factory. refType 3 requires an owner-set observer that implements ICollateralManager, an observed pool, and (if restricted) an allowlist. createLoan(0) is refType 0 and accrues interest. Live observers 1–15 are empty, so nobody can open a refType-3 loan today. Do not file “anyone can borrow interest-free.”
• _reserveLPTokens is loan-creator + refType 3 only. The reserved-LP counter is global: any other live refType-3 creator can unreserve. That is privileged-user griefing, not theft, and it is not live.
• Reserved LP is excluded from maxAssets, getAdjLPTokenBalance, and utilization (98% cap). Reserved borrowed invariant is excluded from interest in accrueBorrowedInvariant and added back as convertInvariantToLPRoundUp in totalReservedAssetsAndSupply. payLoanLiquidity decrements reserved borrowed invariant on refType-3 repay.
• VaultGammaPool.liquidateExternally and batchLiquidations return (0, []). Regular liquidate still hits VaultLiquidationStrategy. External / batch strategy contracts exist but are unreachable through the pool. Not a freeze of liquidatable debt.
• OOS: UniV2 issues in DeltaSwap unless GammaSwap materially changed them; “impacts affecting only the state of implementation contracts”; GS / timelock / staking capped at high; airdrop ineligible for medium. Program pays critical only.
• PositionManager: loans are owned by the PM; the NFT owner (or approved) gates borrow / repay / collateral. sendTokensCallback requires msg.sender is the computed GammaPool. createLoan uses PM as msg.sender for observer lookup. clearToken / unwrapWETH / refundETH sweep leftovers on the PM (UniV3-style dust), not funds sitting in a pool. UUPS _authorizeUpgrade is onlyOwner.

Remaining GammaSwap listed Solidity: 2024 factory / DeltaSwap / staking / GS / timelock / airdrop rows (staking / GS / timelock capped at high; airdrop medium ineligible). Spark 13 Jul Robinhood / X Layer rows are the same ALM + Vault V2 trees already logged. Next leftover: Olympus March 2026 migrator / Cooler / CCIP (olympus, $3.33M, no KYC) or Spark 15 Jul sUSDC impls. Not submitted.

2026-09-03: Olympus V1Migrator + Cooler V2 + CCIP + CD Facility (3f918a0)

Immunefi program olympus ($3,333,333, kyc: false, critical only: loss of treasury / user / bond funds). 2 Mar 2026 leftover is V1 Migrator 0x5131…B8B0. 20 Feb 2026 Cooler / CD / CCIP leftover includes MonoCooler 0xdb59…e7cC, Cooler v2 Migrator 0xe045…9F1c, CCIPCrossChainBridge 0xFbf6…143D, CD Facility 0xEBDe…9678, CD Auctioneer 0xF351…E39a. Official OlympusDAO/olympus-v3 3f918a0 (2026-09-01). Sourcify v2 returned HTTP 400 on checksummed addresses; used the public tree. No mainnet interaction.

Files: src/policies/V1Migrator.sol, policies/cooler/{MonoCooler, CoolerTreasuryBorrower, CoolerLtvOracle}.sol, periphery/{CoolerV2Migrator, bridge/CCIPCrossChainBridge}.sol, policies/deposits/ConvertibleDepositFacility.sol.

Checked for: merkle-free OHM v2 mint; migrator reminting after a root change without burning v1; Cooler V2 migrator flash loan that credits a stranger; MonoCooler borrow / withdraw without authorization; CCIP receive from an untrusted remote; CD convert minting OHM for a non-owner.

Result: no user-exploitable finding. Not submitted.

• V1Migrator.migrate is onlyEnabled, burns OHMv1 from msg.sender, then MINTR.mintOhm after a double-hashed merkle leaf (account, allocated). Partial claims are capped by _migratedAmounts for the current nonce. gOHM balanceTo/balanceFrom can dust; documented. setMerkleRoot increments the nonce (admin / legacy_migration_admin). rescue sweeps to that same role.
• CoolerV2Migrator.consolidate requires the caller owns each factory-created Cooler, lenders in CHREG, and DAI/USDS debt. Flash DAI (fee 0) repays V1, pulls gOHM from the owner, addCollateral / borrow on Cooler V2 for newOwner (needs authorization or a signature), converts USDS back, repays the flash. Leftover DAI/USDS refund to msg.sender.
• MonoCooler withdraw / borrow / applyDelegations need isSenderAuthorized. addCollateral can credit any onBehalfOf (donation); delegating for them still needs auth. repay is permissionless. Liquidation burns gOHM minus incentive and writeOffDebt. LTV oracle can only rise. setTreasuryBorrower is permissionless only while unset.
• CCIP send pulls OHM from the caller to a trusted remote. Receive requires the stored EVM remote, a single OHM amount, and transfers to the decoded recipient. Failed messages are retryable by anyone to that same recipient. withdraw is owner-only native dust.
• CD createPosition is ROLE_AUCTIONEER. convert is owner-only, withdraws the receipt into TRSRY, then mints OHM at the position’s conversionPrice. claimYield sends yield to TRSRY.

Remaining Olympus leftover: DepositManager / ReceiptToken / RedemptionVault, Clearinghouse v1.2, Heart / Operator / Emission, CCIP token pool (logged below), Governor Bravo, BondTeller / BondCallback, L2 MINTR / Roles / CrossChainBridge copies. Spark 15 Jul Ethereum UsdcVault is logged; L2 rows are UsdcVaultL2 (logged below). Not submitted.

2026-09-03: Spark leftover gov-relay Executor + SPARK_RECEIVER (6218d57)

Immunefi program sparklend ($5,000,000, kyc: false). Listed GitHub row marsfoundation/spark-gov-relay src/Executor.sol plus SPARK_EXECUTOR / SPARK_RECEIVER clones (including 13 Jul Robinhood / X Layer). Local clone /tmp/spark-gov-relay at 6218d57 (sparkdotfi mirror). Receivers are marsfoundation/xchain-helpers OptimismReceiver / ArbitrumReceiver / LZReceiver / AMBReceiver (raw master, 3 Sep). ALM + Vault V2 + PSM3 + Collector already logged. No state-changing txs.

Files: src/Executor.sol, deploy/Deploy.sol, xchain-helpers receivers.

Checked for: a stranger queue / execute that runs before the delay; receiver fallback that forwards without the bridge check; admin role that is left on the deployer after setUpExecutorPermissions.

Result: no user-exploitable finding. Not submitted.

• queue is SUBMISSION_ROLE (the receiver). execute is permissionless after executionTime and only while Queued. It marks executed before the calls. cancel is GUARDIAN_ROLE. Delay / grace-period updates and executeDelegateCall are DEFAULT_ADMIN_ROLE. The constructor also grants admin to address(this) so a queued self-call can reconfigure.
• Optimism receiver requires the L2 messenger and xDomainMessageSender == l1Authority. Arbitrum subtracts the standard alias. LZ / AMB check src eid / chain id and source authority. All functionCall the executor.
• Deploy grants SUBMISSION_ROLE to the receiver and revokes deployer DEFAULT_ADMIN_ROLE.

Remaining SparkLend after this write-up was the DSR / SSR tree; that pass is logged below. Robinhood / X Layer executor / receiver rows are the same gov-relay contracts. Not submitted.

2026-09-03: Spark leftover DSR/SSR xchain-ssr-oracle (4a23d1f)

Immunefi program sparklend ($5,000,000, kyc: false). Listed GitHub marsfoundation/xchain-ssr-oracle (live default tree is sky-ecosystem/xchain-ssr-oracle master 4a23d1f). DSR_* live rows are the README “Legacy Deployments (DAI)” of the same contracts. Receivers are marsfoundation/xchain-helpers bb76966 (OptimismReceiver / ArbitrumReceiver / AMBReceiver / LZComposeReceiver). ALM + Vault V2 + PSM3 + Collector + gov-relay already logged. No state-changing txs. Read-only eth_call only.

Files: SSRAuthOracle, SSRMainnetOracle, SSROracleBase, forwarders (Base / Optimism / Arbitrum / Gnosis / LZ), adapters (Chainlink / Balancer), script/Deploy.s.sol, xchain-helpers receivers.

Checked for: a stranger setSUSDSData; a receiver fallback that skips the bridge check; a forwarder that lets the caller pick a fake payload; first-update / maxSSR == 0 letting a stranger inflate chi; Arbitrum alias spoof.

Result: no user-exploitable finding. Not submitted.

• setSUSDSData is DATA_PROVIDER_ROLE. rho must be <= now and strictly increasing; ssr >= RAY; chi non-decreasing; optional chiMax only when maxSSR != 0. First update (rho == 0) skips those checks. Deploy grants DATA_PROVIDER to the receiver and renounces deployer admin.
• Live Base AuthOracle 0x65d946…f7a1 (~04:41 UTC 3 Sep): maxSSR = 0 (same on Arb / OP). Receiver 0x212871…8474 has DATA_PROVIDER, not admin. Zero is not admin. maxSSR = 0 is documented; a compromised provider can set a large chi, but the provider is the bridge receiver. Stored rho is 2026-08-20T12:56:47Z; views extrapolate.
• Forwarders are permissionless refresh() that SafeCast-pack live sUSDS and send to the immutable l2Oracle (the receiver). The caller cannot choose the payload.
• Optimism receiver: messenger 0x4200…0007 and xDomainMessageSender == l1Authority. Arbitrum subtracts the standard alias. AMB checks amb / source chain / authority. LZ compose checks src eid + source authority, then composes only from self via the endpoint.
• Mainnet refresh() copies sUSDS with raw uint96 / 120 / 40 casts (forwarders use SafeCast). Live ssr / chi are nowhere near those caps.
• Adapters are views. Chainlink latestRoundData uses roundId = 0. Balancer divides the binomial ray by 1e9. getAPR unchecked (ssr - RAY) is a view; the Auth path rejects ssr < RAY.

Remaining SparkLend after this write-up was SSR_RATE_SOURCE / KILL_SWITCH_ORACLE / SavingsDaiOracle; that pass is logged below. The xchain-ssr-oracle GitHub tree and DSR / SSR live rows are exhausted. Not submitted.

2026-09-03: Spark leftover SSRRateSource + KillSwitchOracle + SavingsDaiOracle (Sourcify)

Immunefi program sparklend ($5,000,000, kyc: false). Leftover oracle addresses after the DSR / SSR tree: SSR_RATE_SOURCE 0x57027B…9973 (Sourcify exact, verified 2024-12-28, SSRRateSource), KILL_SWITCH_ORACLE 0x909A86…be82 (exact, 2024-08-08, KillSwitchOracle), SavingsDaiOracle 0xb9E6DB…AB5f (exact, 2025-07-04). Extract under /tmp/spark-leftover-oracles. 15 Jul sUSDC / UsdcVault already logged. No state-changing txs. Read-only eth_call only.

Files: src/SSRRateSource.sol, src/KillSwitchOracle.sol, src/SavingsDaiOracle.sol.

Checked for: a stranger trigger that disables borrows while listed oracles are healthy; a threshold of zero that still counts; getAPR that underflows into a huge rate; getAnswer that multiplies a stale DAI round by current chi in a money path.

Result: no user-exploitable finding. Not submitted.

• SSRRateSource.getAPR is a view: (susds.ssr() - 1e27) * 365 days in 0.8 (reverts if ssr < RAY). Live 04:45 UTC: ~3.46e25 (3.46% APR ray).
• KillSwitchOracle.trigger is permissionless. The first trip requires a owner-listed oracle with latestAnswer > 0 and price <= threshold. After that, anyone can keep disabling borrow on remaining active reserves until reset (owner). Live: triggered = false, 6 oracles, owner 0x3300f198…8c4.
• SavingsDaiOracle is a view adapter: daiPrice * pot.chi / RAY. getAnswer(roundId) uses current chi against a historical DAI round (known inaccuracy; Aave paths use latestAnswer). Live latestAnswer ~1.18e8 (8-dec USD).

Remaining SparkLend listed oracle leftovers are exhausted (AAVE_ORACLE is the already-logged Aave V3 price oracle). Not submitted.

2026-09-03: KeeperHub #2105 claimed

Rechecked ~04:34 UTC 3 Sep. Issue #2105 is still open + accepted + confirmed, but comment and PR #2275 from tenk-earn (opened 04:27 UTC, targeting staging, Closes #2105, app/api/openapi/route.ts

• tests/unit/openapi-route.test.ts). Do not open a second

#2105 PR. This run’s #2105 spec is superseded. No KeeperHub implementation before the 6 Sep window; #2240 remains the other track.

2026-09-03: Spark X Layer SavingsVaultIntents leftover (Sourcify)

Immunefi program sparklend ($5,000,000, kyc: false). 18 Mar 2026 leftover: SPARK_SAVINGS_INTENTS 0x5bCD…1865 on X Layer (chain 196). Sourcify exact match, verified 2026-08-11, SavingsVaultIntents solc 0.8.27. Ctor admin 0x23d4…5FB3, relayer 0x8a25…39ab, maxDeadlineDuration 604800. Extract under /tmp/spark-leftover/intents. No mainnet interaction.

Files: src/SavingsVaultIntents.sol, src/interfaces/{ISavingsVaultIntents,IERC4626Like}.sol.

Checked for: request that binds a stranger’s shares; fulfill that redeems to an attacker or after the deadline; overwrite of another account’s request; a non-relayer fulfill; admin-less vault swap mid-flight.

Result: no user-exploitable finding. Not submitted.

• request is permissionless for the caller’s own (account, vault) slot. Vault must be whitelisted. Recipient cannot be 0. Assets from convertToAssets(shares) must sit in [min, max]. Deadline must be in (now, now + maxDeadlineDuration]. Caller must hold the shares and have approved this contract. Shares are not pulled at request time.
• A second request for the same vault overwrites the caller’s pending intent only.
• cancel deletes the caller’s slot.
• fulfill is RELAYER. It requires a matching non-zero requestId, rejects after deadline, deletes, then redeem(shares, recipient, account). The relayer cannot change shares or recipient. A later allowance revoke or share transfer makes redeem revert (user self-lock, not theft).
• Admin sets whitelist / bounds / maxDeadlineDuration (!= 0). Relayer is granted in the constructor.

Spark leftover oracle rows and 15 Jul Ethereum UsdcVault were logged in a parallel pass. L2 15 Jul SUSDC_IMPL rows are UsdcVaultL2 (logged below), not the Ethereum vault. Not submitted.

2026-09-03: Olympus DepositManager + RedemptionVault + Clearinghouse + Heart (3f918a0)

Same Immunefi program olympus ($3,333,333, kyc: false, critical only). 20 Feb leftover after the V1Migrator / Cooler V2 / CCIP / CD Facility pass: DepositManager 0xcb4E…bbf2, ReceiptTokenMgr 0xD98B…ddd1, DepositRedemptionVault 0x20a3…029Db, Clearinghouse v1.2 0x1e09…e0, Heart v1.7 0x5824…5ECB, Operator v1.5 0x6417…b52, EmissionManager v1.2 0xa61b…b6ff, CCIPBurnMintTokenPool 0xa558…e3aD. Official olympus-v3 3f918a0. Sourcify v2 HTTP 400 on several leftovers; used the public tree. No state-changing txs.

Files: src/policies/deposits/{DepositManager, ReceiptTokenManager, DepositRedemptionVault}.sol, policies/{Clearinghouse, Heart,Operator,EmissionManager}.sol, policies/bridge/CCIPBurnMintTokenPool.sol.

Checked for: a deposit operator withdrawing another operator’s liabilities; receipt mint by a stranger; redemption finish before redeemableAt; borrow-against-redemption without a committed receipt; Clearinghouse lendToCooler to a factory-foreign cooler; Heart beat minting unbounded OHM; CCIP pool _mint callable outside the router.

Result: no user-exploitable finding. Not submitted.

• DepositManager.deposit / withdraw / claimYield / borrowingWithdraw are ROLE_DEPOSIT_OPERATOR and keyed by msg.sender. Receipt token IDs bind (manager, asset, period, operator). Mint/burn require the token owner (ReceiptTokenManager). Solvency is `liabilities <= assets
  • borrowed`. Borrow capacity is the operator’s own liabilities minus already borrowed.
• Redemption start pulls unwrapped receipts, records msg.sender, and commits at the facility. Finish / cancel / borrow / repay are onlyValidRedemptionId for the owner. Finish waits for redeemableAt and refuses an unpaid loan. Default burns unpaid principal receipts and sends the buffer to TRSRY.
• Clearinghouse.lendToCooler requires factory.created and matching gOHM/reserve, pulls collateral from the caller, and clears the request itself. Defaults pay a capped keeper reward and burn leftover gOHM. defund is cooler_overseer.
• Heart.beat is frequency-gated and mints at most currentReward(). EmissionManager.execute and Operator.operate are heart. Operator.swap is the RBS wall with capacity + minAmountOut.
• CCIP pool _mint / _burn override Chainlink’s TokenPool hooks (onlyEnabled). Router / RMN still gate the external path.

2026-09-03: Olympus Governor Bravo + BondTeller + BondCallback (3f918a0)

Same program. Sourcify exact matches on GovernorBravoDelegate 0xa601…1B4, Delegator 0x0941…fcD, Timelock 0x953E…9c39, BondFixedTermTeller 0x007F…Fed6, BondCallback v1.1 0x73df…795e. Bond Manager 0xf577…B2A3 is BondManager.sol. Official tree 3f918a0. No state-changing txs.

Files: src/external/governance/{GovernorBravoDelegate, GovernorBravoDelegator,Timelock}.sol, src/policies/{BondCallback,BondManager}.sol, Bond Protocol BondFixedTermTeller / BondBaseTeller (Sourcify

• vendored src/test/lib/bonds). Also read L2 copies of OlympusMinter.sol and deprecated policies/CrossChainBridge.sol.

Checked for: a stranger initialize / _setImplementation; emergency propose / queue without the veto guardian; cancel of an emergency proposal by a non-proposer when proposalThreshold is 0; execute after a target codehash change; callback mint to a non-whitelisted teller; teller redeem that pays more underlying than shares burned; BondManager market create by a non-admin; L2 MINTR mint without kernel permission; LZ receive from an untrusted remote.

Result: no user-exploitable finding. Not submitted.

• Delegator constructor delegatecalls initialize (admin-only, reverts if timelock already set) then sets admin = timelock_. _setImplementation is admin-only and rejects address(0).
• propose requires prior votes above the percentage threshold. activate (anyone, after startBlock) locks quorum from current gOHM supply. Votes take min(startBlock, now-1) prior votes. Queue / execute require Succeeded / Queued and that the proposer still holds the captured threshold. Timelock execute re-checks the propose-time codehash.
• emergencyPropose / emergency queue / execute are vetoGuardian and only while gOHM.totalSupply < 1000e18. Emergency proposals store proposalThreshold = 0; cancel by a stranger hits votes >= 0 and reverts Cancel_AboveThreshold. Only the proposer (guardian) can cancel.
• BondCallback callback requires approvedMarkets[msg.sender][id_]. Whitelist / blacklist are callback_whitelist and the teller must match the aggregator. Quote tokens must already sit on the callback. OHM payout mints to the teller; inverse withdraws TRSRY (unwraps a configured 4626 first) and burns the received OHM. batchToTreasury / setOperator are callback_admin.
• Teller purchase pulls quote, pays protocol / referrer fees from the quote, then either callback (must return payout_ of the payout token) or transferFrom the market owner. Redeem / create are 1:1 with the ERC1155 supply after expiry. Protocol fee is requiresAuth and capped at 5%.
• BondManager market launch / settle / emergency withdraw are bondmanager_admin.
• L2 OlympusMinter mintOhm is permissioned + onlyWhileActive and spends mintApproval. Deprecated LZ CrossChainBridge lzReceive requires the endpoint and a stored trusted remote; mint goes to the decoded recipient. Failed messages retry the same payload hash.

Remaining Olympus leftover: CD Auctioneer / Limit Orders / CoolerFactory / LTV / TreasuryBorrower / Composites / RANGE / YRF / CHREG / RGSTY / DLGTE / RolesAdmin (this pass below). CDEPO module 0x0233…9F1c is still Sourcify 404. Not submitted.

2026-09-03: Spark UsdcVaultL2 (15 Jul L2 SUSDC_IMPL)

Immunefi program sparklend ($5,000,000, kyc: false). 15 Jul L2 SUSDC_IMPL rows are not the Ethereum UsdcVault already logged. Sourcify exact UsdcVaultL2 src/UsdcVaultL2.sol: Base 0x6ACC…7723 (verified 2026-06-30), Arbitrum 0xdC8D…92d6 (2026-06-19), Optimism 0x3a1d…CEA5 (2026-06-19). Unichain 0x1fcc…4C79 Sourcify 404 (same listing). Ethereum 0xf943…20bA remains UsdcVault. Extract under /tmp/spark-usdcvault-l2. Read-only. No state-changing txs.

Checked for: first-depositor share inflation; withdraw / redeem that spends vault sUSDS without burning the owner’s shares; exit that pays more sUSDS than shares; mint / swapExactOut taking a stranger’s USDC; UUPS upgrade without wards.

Result: no user-exploitable finding. Not submitted.

• Shares mint 1:1 with sUSDS received from psm.swapExactIn / swapExactOut, not from a totalAssets / totalSupply ratio. Donated USDC or sUSDS does not mint shares.
• deposit pulls USDC from msg.sender, swaps into this vault, then _mints amountOut. withdraw / redeem swap vault sUSDS to the receiver and then _burn the owner (allowance if not sender). A shortfall reverts the whole tx.
• exit burns shares and transfers that many sUSDS. Transfer to address(this) is rejected.
• UUPS _authorizeUpgrade is auth. initialize is disabled on the implementation.

Listed Spark leftover addresses after this correction: Unichain impl still unverified on Sourcify (treat as the same L2 vault). Not submitted.

2026-09-03: Olympus CD Auctioneer + Cooler leftovers + RANGE/YRF (3f918a0)

Same Immunefi program olympus ($3,333,333, kyc: false, critical only). Sourcify matches on ConvertibleDeposit Auctioneer 0xF351…E39a, CDAuctioneerLimitOrders 0x7d8f…Fc2e, CoolerFactory 0x30Ce…4216, CoolerLtvOracle 0x9ee9…e8dc, CoolerTreasuryBorrower 0xD58d…79B0, CoolerComposites 0x6593…57Fd, YieldRepurchaseFacility 0x271e…0692, OlympusRange 0x399c…0fb5, CHREG 0x69a3…43a4, RGSTY 0x8963…de48, DLGTE 0xD320…ad74. RolesAdmin is policies/RolesAdmin.sol (L2 copies of the same tree). Official olympus-v3 3f918a0. CDEPO 0x0233…9F1c Sourcify 404. No state-changing txs.

Files: policies/deposits/{ConvertibleDepositAuctioneer,LimitOrders}.sol, external/cooler/CoolerFactory.sol, policies/cooler/{CoolerLtvOracle,CoolerTreasuryBorrower}.sol, periphery/CoolerComposites.sol, policies/{YieldRepurchaseFacility,RolesAdmin}.sol, modules/{RANGE/OlympusRange,CHREG/OlympusClearinghouseRegistry,RGSTY/OlympusContractRegistry,DLGTE/OlympusGovDelegation}.sol.

Checked for: a stranger bid that mints a receipt at a stale price below minPrice; limit-order fillOrder that spends another user’s sUSDS or sweeps principal as yield; CoolerFactory generateCooler that overwrites a victim’s escrow; LTV decrease; TreasuryBorrower borrow without the cooler role; composites that borrow against a stranger without a signature; YRF endEpoch by a non-heart; DLGTE withdraw across policy namespaces.

Result: no user-exploitable finding. Not submitted.

• Auctioneer bid is onlyEnabled + period-enabled + nonReentrant. It prices from the decaying tick (floored at minPrice) and createPositions at the facility as ROLE_AUCTIONEER. Parameters are cd_emissionmanager / manager-or-admin.
• Limit orders hold USDS in sUSDS and track totalUsdsOwed. fillOrder withdraws only fill + incentive, bids with minOhmOut = preview, and sends the NFT + receipts to the order owner. sweepYield transfers only shares above previewWithdraw(totalUsdsOwed). cancelOrder is the owner and works while disabled.
• CoolerFactory clones with immutable owner / tokens / factory and sets created. Events are onlyFromFactory.
• LTV setOriginationLtvAt is admin-only and reverts CannotDecreaseLtv. Slope is capped.
• TreasuryBorrower borrow / repay / writeOffDebt are treasuryborrower_cooler. setDebt is admin.
• Composites pull collateral / debt from msg.sender, credit msg.sender on MonoCooler, and optionally setAuthorizationWithSig. Excess debt is refunded to the caller.
• YRF endEpoch is heart. initialize / adjustNextYield / shutdown are loop_daddy.
• RANGE / CHREG / RGSTY mutators are permissioned.
• DLGTE deposit / withdraw / applyDelegations are permissioned. Withdraw is capped by _policyAccountBalances[msg.sender][onBehalfOf].
• RolesAdmin grantRole / revokeRole are onlyAdmin with a two-step admin handoff.

Remaining Olympus leftover: CDEPO module 0x0233…9F1c (Sourcify 404). L2 OHM / gOHM token rows are standard tokens. 20 Feb money-moving leftovers that Sourcify or the public tree can open are exhausted. Not submitted.

2026-09-03: GammaSwap 2024 factory + DeltaSwap leftover

Immunefi program gammaswap ($40,000, kyc: false, Primacy of Rules, critical only, PoC required). 24 Mar 2024 leftover after the May 2026 vault pass: GammaPoolFactory 0xFD51…c20B (Sourcify exact, solc 0.8.21, core 2312d0e), DeltaSwapFactory 0xCb85…ffA8, DeltaSwapRouter02 0x5FbE…1e1b, DeltaSwapPair 0x755F…6EF0 (Sourcify exact), MinimalBeaconProxy + LockableMinimalBeacon. Extract under /tmp/gammaswap-core and /tmp/gammaswap-deltaswap. Read-only. No state-changing txs. UniV2 issues in DeltaSwap are OOS unless GammaSwap materially changed them. Staking / GS / timelock are capped at high; airdrop is medium-ineligible.

Files: contracts/GammaPoolFactory.sol, base/AbstractGammaPoolFactory.sol, utils/{LockableMinimalBeacon,MinimalBeaconProxy}.sol, libraries/AddressCalculator.sol, observer/AbstractLoanObserverStore.sol, DeltaSwap {DeltaSwapFactory,DeltaSwapPair,DeltaSwapRouter02}.sol.

Checked for: a stranger createPool that initializes a victim’s predicted address; beacon delegatecall to a swappable impl; factory execute by a non-feeToSetter; DeltaSwap swap that skips the K check when msg.sender == gammaPool for a spoofed pool; setGammaPool by a stranger; router fee calc that lets a swap drain reserves.

Result: no user-exploitable critical. Not submitted.

• createPool is permissionless unless the protocol is restricted. It validateCFMMs, salts by (cfmm, protocolId), create2s, then initializes in the same tx. addProtocol / updateProtocol / lockProtocol are owner-only. After lock, the beacon freezes _implementation().
• execute is feeToSetter only (admin-trusted arbitrary call). Pause is owner.
• Beacon proxy bytecode is calcMinimalBeaconProxyBytecode (factory + protocolId baked in), not the placeholder constants in the Solidity source.
• DeltaSwap is UniV2 plus a size-gated fee (dsFee when trade ≥ dsFeeThreshold of the liquidity EMA) and a gsFee path when msg.sender == gammaPool. gammaPool is set only by the factory to calcAddress(gsFactory, gsProtocolId, keccak256(pair, protocolId)). setGammaPool / updateGammaPool are gammaPoolSetter.
• Zero-fee small trades are designed. The K invariant still uses 1000 - fee. Router getAmountOut uses calcPairTradingFee.
• Staking rows Sourcify as GMX-style RewardTracker / Vester / StakingRouter (@gammaswap/v1-staking). Do not file high findings against them.

Remaining GammaSwap listed Solidity: staking / GS / timelock (high-capped) and airdrop (medium ineligible). Factory + DeltaSwap + May 2026 vault leftover are logged. Not submitted.

2026-09-03: Zest Protocol V2 market + vault leftover (f2fce52)

Immunefi program zest-protocol-v2 ($100,000, kyc: false, Clarity / Stacks). Listed Hiro principals under SP1A27…ADJ7: v0-6-market (newest listed market), v0-market-vault, v0-assets, v0-egroup, six v0-vault-* (sBTC / STX / stSTX / USDC / USDH / stSTXbtc) plus DAO executor / multisig / treasury. Official Zest-Protocol/zest-v2-contracts f2fce52 (2026-09-02) has v0-8-market as the current tree. Hiro v0-6-market source pulled read-only (/tmp/zest-v06.json). Repo extract under /tmp/zest-v2. No mainnet interaction.

Files: mainnet/contracts/market/{v0-8-market,v0-market-vault}.clar, vault/v0-vault-sbtc.clar, Hiro v0-6-market.clar.

Checked for: collateral add that credits a stranger; remove that pays a non-owner; borrow without a health check; repay that writes off another account without a pull; liquidate of a healthy or same-block borrower; vault system-borrow without market auth.

Result: no user-exploitable finding. Not submitted.

• collateral-add / supply-collateral-add / repay / liquidate require contract-caller == tx-sender. Account is contract-caller. Vault receive-tokens pulls that account.
• collateral-remove / borrow credit an optional receiver but still debit contract-caller. Borrow and remove check egroup LTV after the change.
• Market-vault money paths are check-impl-auth (contract-caller == impl). set-impl is dao-executor.
• Vault system-borrow / system-repay are check-caller-auth (authorized-contract map, DAO-set). Caps bind available assets and CAP-DEBT.
• Liquidation requires current-ltv >= LTV-LIQ-PARTIAL, rejects last-borrow-block == stacks-block-height, then repay + seize with min-collateral- expected. Same-block oracle borrow is blocked. v0-6 Hiro source has the same auth / same-block / healthy gates.

Remaining Zest leftover was DAO executor / multisig / treasury and the zvstBTC strategy vault; logged in the DAO + strategy pass below. Not submitted.

2026-09-03: GammaSwap staking + GS token + timelock + airdrop leftover

Immunefi program gammaswap ($40,000, kyc: false, Primacy of Rules, critical only: theft / freeze / insolvency). Custom OOS: GS, GSTimelockController, and staking are eligible for at most high (so they do not pay on this program); airdrop is not eligible for medium. Factory + DeltaSwap + May 2026 vault leftovers are already logged. This pass is the remaining 2024 staking / GS / timelock / airdrop rows. Sourcify exact (Arbitrum 42161). Read-only eth_call via https://arb1.arbitrum.io/rpc ~05:05 UTC 3 Sep. No state-changing txs.

Listing labels are swapped: listed GSTimelockController 0xb08d…3e83 is an ERC1967 proxy whose implementation 0x91fb…f2dd is GS (symbol GS, name GammaSwap); listed GS 0x3f7c…73f8 is GSTimelockController (minDelay 60). Airdrop 0x4c02…0f98 token() is the GS proxy.

Sources: staking router Sourcify /tmp/gammaswap-leftover/c582…4ae4

• tree /tmp/gammaswap-staking c3df0b0; GS impl /tmp/gammaswap-leftover/91fb…f2dd
• /tmp/gammaswap-gstoken 9e7e3d2; timelock /tmp/gammaswap-leftover/3f7c…73f8
• /tmp/gammaswap-timelock d3cfc85; airdrop /tmp/gammaswap-leftover/4c02…0f98.

Files: StakingRouter.sol, StakingAdmin.sol, RewardTracker.sol, RewardDistributor.sol, Vester.sol, FeeTracker.sol, BonusDistributor.sol, BeaconProxyFactory.sol, contracts/GS.sol (LZ V2 OFT + UUPS), GSTimelockController.sol, Airdrop.sol.

Checked for: public stake / stakeForAccount draining a tracker; uninitialized GS-token router accepting deposits; airdrop claim against a zero merkle root; OFT mint above MAX_SUPPLY or without a peer; timelock executeEmergency on an unlisted selector; permissionless addEmergencyCall.

Result: no user-exploitable finding. Not submitted. Would not pay even as high (GS / staking / timelock cap) or medium (airdrop).

• StakingRouter owner 0x937f…C3Fb. gsTokensInitialized is false; gs / esGs are zero. Live RewardTracker 0xd04F…4088 is in private staking / transfer mode, distributor == 0, totalSupply == 0. stake reverts when private; stakeForAccount is handler-only. Loan staking is a published known issue (unused). initializeGSTokens is owner-only and one-shot.
• GS is LayerZero V2 OFT
  • UUPS. Constructor / initialize mint once; later mint is OFT _credit (peer-gated) and _mint enforces MAX_SUPPLY 1.6e9. Live supply ~3.33e8. Proxy owner 0x9b2a…b3f1 (not the factory EOA). Upgrade is onlyOwner.
• Timelock minDelay is 60 seconds. Factory EOA 0x937f…C3Fb holds proposer / executor / canceller / emergency; it does not hold DEFAULT_ADMIN_ROLE. addEmergencyCall / removeEmergencyCall require msg.sender == address(this). executeEmergency is EMERGENCY_ROLE and only for a previously registered (target, func) id.
• Airdrop: isPaused == true, merkle roots 0 and 1 are zero, totalClaimed == 0, GS balance 0. claim reverts MerkleRootNotSet when the epoch root is zero (also Paused). updateRoot / withdraw / pause / UUPS are owner-only. Constructor _disableInitializers().

Listed GammaSwap Solidity is exhausted. Do not re-review factory / DeltaSwap / May 2026 vault. Olympus CDEPO is the official DEPOS module and is logged below. Next leftover: StackingDAO rewards / stakers / signers, TermMax adapters, Twyne Sourcify-404 vaults, Sky PAUFactory / Kicker / sky-oapp-oft, or Yearn 3.0.4 Tokenized Strategy / Vault V3. Not submitted.

2026-09-03: Zest Protocol V2 DAO + zvstBTC strategy leftover (f2fce52)

Immunefi program zest-protocol-v2 ($100,000, kyc: false, Clarity / Stacks). Listed Hiro principals include dao-executor / dao-multisig / dao-treasury. The zvstBTC strategy vault is in the official Zest-Protocol/zest-v2-contracts tree at f2fce52 (not a listed Hiro row; Primacy of Impact only if a finding existed). Local extract /tmp/zest-v2. No mainnet interaction.

Files: mainnet/contracts/dao/{dao-executor,dao-multisig,dao-treasury,dao-traits}.clar, mainnet/contracts/strategy-vault/{zvstBTC,zv-engine-stbtc-0,zv-ops-stbtc-0,zv-state-stbtc-0,zv-traits}.clar.

Checked for: proposal execution that skips the multisig impl; treasury withdraw that is not executor-gated; strategy share mint without a pull; redeem that pays a stranger; first-depositor inflation; claim double-fund; trader redirect of borrowed sBTC or removed collateral; ops sweep that drains state past funded-claim liability.

Result: no user-exploitable finding. Not submitted.

• dao-executor execute-proposal / set-impl require contract-caller == impl. init is deployer-once. as-contract so proposal scripts see tx-sender == dao-executor.
• Multisig signer management and impl schedule / execute / cancel are tx-sender == dao-executor. Propose / approve / execute are signer-gated. Execute requires matching script, threshold, unexpired, and either the 1-day timelock or the urgent flag (DAO trust). Impl replace has a 7-day timelock.
• Treasury withdraw is executor-only and pays the proposal- chosen recipient.
• zvstBTC mint / burn are engine-only. set-authorized-minter is state-only.
• Engine initialize seeds 1000 dead shares to the null principal. Deposit mints amount * supply / gross after crystallize; sBTC deposit converts first, then uses pre-deposit NAV. Request-redeem locks a share price and escrows shares. fund-claim pays min(quoted, live NAV) and can run after cooldown or by manager/engine. redeem always pays the stored user. Cancel is user-only and unfunded-only.
• State pulls / pays are engine- or ops-gated. Collateral to ops cannot drop the state stBTC balance below funded-claim-liability. Owner / trader / guardian are privileged; hot-role changes are immediate (admin trust).
• Ops open / borrow / close / unstack keep sBTC and stBTC inside ops → StackingDAO / Zest market → state. Borrow receiver is none (ops). Collateral remove receiver is zv-state. Close requires zero leftover scaled debt. Permissionless restack-ops-sbtc / sweep-ops-stbtc only return leftovers to state.

Listed Zest Clarity is exhausted. Next leftover is StackingDAO rewards / stakers / signers after the core deposit path logged below, not a second Zest pass. Not submitted.

2026-09-03: Olympus DEPOS / CDEPO (3f918a0)

Same Immunefi program olympus ($3,333,333, kyc: false, critical only). Listed leftover CDEPO 0x02331A4c97a4841084dF54d7c0eC04DD3f1A9F1c is still Sourcify 404. Official OlympusDAO/olympus-v3 3f918a0 + env.json map it to module OlympusDepositPositionManager (KEYCODE DEPOS), not a separate deposit vault. Renderer is PositionTokenRenderer. No state-changing txs.

Files: src/modules/DEPOS/{OlympusDepositPositionManager,DEPOS.v1,IDepositPositionManager,PositionTokenRenderer}.sol, plus the already-logged ConvertibleDepositFacility / BaseDepositFacility DEPOS call sites.

Checked for: permissionless mint of conversion rights; split to a stranger; wrap/unwrap that steals an NFT; transferFrom that leaves position.owner and ERC721 owner desynced; previewConvert that overpays OHM; facility convert that mints without burning receipts.

Result: no user-exploitable finding. Not submitted.

• mint / setRemainingDeposit / split / setAdditionalData / setTokenRenderer are Kernel permissioned. Only CDF requests mint / setRemainingDeposit / split.
• _create binds operator = msg.sender (the policy). CDF createPosition is ROLE_AUCTIONEER and mints remaining equal to DepositManager.deposit actualAmount.
• CDF split requires position.operator == this and position.owner == msg.sender. DEPOS split cannot be called by the holder.
• wrap / unwrap are onlyPositionOwner. Overridden transferFrom updates position.owner and _userPositions before Solmate transfer. Unwrapped IDs revert DEPOS_NotWrapped.
• CDF convert requires position.owner == msg.sender, operator == this, decrements remaining, then DepositManager.withdraw receipts from the caller and MINTR.mintOhm to the caller. NFT without receipts cannot convert.
• handlePositionRedemption / cancel are authorized-operator only (already-logged DepositRedemptionVault).
• Renderer is view-only metadata.

Listed Olympus leftover addresses that Sourcify or the public tree can open are exhausted. L2 MINTR / RolesAdmin / deprecated LZ bridge copies are the same tree already logged. Not submitted.

2026-09-03: Sky StarGuard + SubProxyMethods + PAU assembler (707c84d / 8ab9daf / c13e80f)

Immunefi program sky ($10,000,000, kyc: false). Feb 2026 leftover star-guard src/StarGuard.sol (main 707c84d). 6 Jul leftover subproxy-methods src/SubProxyMethods.sol (8ab9daf), pau-assemblers DefaultPAUAssembler.sol (dev c13e80f), and pau-administered-agent AdministeredAgent{,Factory}.sol (5e6b52f). Official clones under /tmp/sky-star-guard, /tmp/sky-subproxy-methods, /tmp/sky-pau-assembler, /tmp/sky-administered-agent. No mainnet interaction.

Files as named above plus deploy/StarGuardInit.sol.

Checked for: permissionless plot / exec of an unwhitelisted star spell; exec that keeps running after a codehash swap; SubProxyMethods transfer that drains a SubProxy without wards; assembler deploy that keeps DEFAULT_ADMIN on a live PAU; agent call without being an actor.

Result: no user-exploitable finding. Not submitted.

• StarGuard plot / drop / file / rely / deny are auth. exec is permissionless only after a plotted address, matching codehash, deadline, and isExecutable(). spellData is deleted before subProxy.exec. Afterwards subProxy.wards(this) == 1 or the tx reverts. Cantina + ChainSecurity reports are in-repo. Trust model is PauseProxy wards + trusted spells.
• SubProxyMethods is a one-function delegatecall helper. Direct calls move tokens from the helper (empty). Via SubProxy.exec it moves SubProxy inventory; that path is ward-gated.
• DefaultPAUAssembler.deploy is permissionless factory wiring. It is temporary admin, grants caller-supplied admins, then revokes itself. It cannot touch an already- deployed stack.
• AdministeredAgentFactory.deploy is a create. call / batchCall / sendValue are onlyActor. Last admin cannot be removed. Actors are trusted allocators for a new stack.

Remaining Sky leftover that this pass did not open: sky-oapp-oft after PAUFactory + Kicker logged below. Not submitted.

2026-09-03: Yearn Accountant leftover (Sourcify)

Immunefi program yearnfinance ($200,000, kyc: false). 29 Oct 2025 leftover Accountant 0x5A74Cb32D36f2f517DB6f7b0A0591e09b22cDE69 is not the already- logged stYFI TeamAccountant 0x1c22…DFD6. Sourcify exact match Accountant.sol:Accountant (verified 2024-08-08). Extract /tmp/yearn-accountant. No state-changing txs.

Files: Sourcify Accountant.sol (report, addVault / removeVault, redeemUnderlying, distribute, config / role handoff).

Checked for: a stranger adding their vault and pulling refunds; report approving the caller for the accountant’s entire asset balance; permissionless redeemUnderlying / distribute.

Result: no user-exploitable finding. Not submitted.

• addVault / removeVault are feeManager or vaultManager (the modifier name onlyVaultOrFeeManager does not let a vault add itself).
• report is onlyAddedVaults. Refunds approve the reporting vault for min(loss * refundRatio, idle asset). Shared-asset idle (fees from another vault) is trusted-vault inventory, not an external extract.
• redeemUnderlying is onlyFeeManager. distribute is feeManager or feeRecipient and always pays feeRecipient.
• Fee caps: management ≤ 2%, performance ≤ 50%. Health-check skips are one-shot and manager-set.

Remaining Yearn listed leftover: 3.0.4 Tokenized Strategy 0xD377…139c and 3.0.4 Vault V3 0xd806…00d if a later pass wants those impls (Factory 3.0.4 is already logged). Not submitted.

2026-09-03: StackingDAO cores + stBTC/STX reserve leftover (Hiro 13 Aug 2026)

Immunefi program stackingdao ($100,000, kyc: false, Primacy of Impact on Critical/High). Newest listed money path (13 Aug 2026): Hiro SP4SZE…VDPBG stacking-dao-core-stbtc-v1, stacking-dao-core-stx-v2, stacking-dao-core-ststxbtc-v2, plus stbtc-token, stbtc-reserve, data-stbtc-v1, stx-reserve-v2, data-stx-v2, withdraw-data-stbtc, stbtc-withdraw-nft. Official repo StackingDAO/stackingdao-smart-contracts updated the same day. Source pulled read-only from Hiro (/tmp/stacking-dao). No mainnet interaction.

Checked for: first-depositor inflation; share mint without a pull; idle withdraw that spends reserved backing; NFT withdraw that pays a non-owner or a missing ticket; ratio excluding pending/escrow shares incorrectly; stSTX vs stSTXbtc reserve mix-up; permissionless process-rewards skimming new deposits.

Result: no user-exploitable finding. Not submitted.

• stBTC / stSTX deposit computes shares from the pre-pull ratio (get-*-up rounds against the depositor), then pulls the full asset and mints. First deposit seeds 1000 dead shares on the core.
• init-withdraw escrows shares on the core, records the NFT ticket, and increments the reserved counter (does not require idle cash). withdraw is NFT-owner
  • unlock-height gated, deletes the ticket, pays the stored user amount, then burns escrowed shares. Missing tickets default to a zero payout.
• withdraw-idle burns the caller's shares and pays only idle - reserved. Idle fee stays in the pool (stBTC/stSTX) or goes to treasury (stSTXbtc).
• Ratio uses total - reserved over supply - pending (stBTC) / escrowed cores (stSTX). stSTXbtc is 1:1 and earmarked via stx-for-ststxbtc-idle; STX reserve pay/stack paths keep that bucket out of stSTX idle.
• Token mint/burn and reserve moves are dao.check-is-protocol (contract-caller). NFT mint/burn too.
• rewards-pox5-v1 process-rewards is called on deposit. The permissionless branch only streams already-queued sBTC into reserves. Commission on new inbound sBTC is keeper-only.

Remaining StackingDAO was rewards-stx / commission / strategy-v6 / stakers; logged in the strategy + rewards pass below. Native-pool / signer-managers if a later pass wants those admin wrappers. Not submitted.

2026-09-03: Yearn 3.0.4 TokenizedStrategy + Vault V3 leftover (Sourcify)

Immunefi program yearnfinance ($200,000, kyc: false). Remaining listed impls after Factory 3.0.4 + V3.1.0 + Accountant: 3.0.4 Tokenized Strategy 0xD377919FA87120584B21279a491F82D5265A139c (Sourcify match, TokenizedStrategy, solc 0.8.18, verified 2024-11-01, API_VERSION 3.0.4) and 3.0.4 Vault V3 0xd8063123BBA3B480569244AE66BFE72B6c84b00d (Sourcify match, YearnV3Vault, Vyper 0.3.7, verified 2025-01-14). Extract /tmp/yearn-304/{strat304,vault304}. These are implementation singletons used via clones; no state-changing txs.

Files: flattened TokenizedStrategy.sol (initialize, deposit / mint / withdraw / redeem, _deposit / _withdraw, report, tend), YearnV3Vault.vy (initialize, _deposit / _redeem, process_report, _total_assets).

Checked for: first-depositor 1-wei inflation plus a raw donation (3.0.4 has no MINIMUM_SUPPLY); deposit that credits a stranger or the vault; redeem that pays msg.sender instead of receiver; keeper-less report that unlocks profit immediately; process_report(self) by a non-role.

Result: no user-exploitable finding. Not submitted. Listed Yearn leftover impls are exhausted.

• Strategy totalAssets is a stored counter, not balanceOf. Empty supply mints 1:1; totalSupply > 0 and totalAssets == 0 mints 0. Donations sit idle until a keeper report / harvestAndReport; profit is locked as shares to the strategy and unlocked over profitMaxUnlockTime (default 10 days). _deposit pulls msg.sender, then deployFunds on the full loose balance, then totalAssets += assets (deposited amount only), then mints to receiver. Cannot deposit to address(this). _withdraw burns owner (allowance if sender ≠ owner) and pays receiver. report / tend are onlyKeepers. Performance fee ≤ 50%. initialize is one-shot (asset == 0).
• Vault _total_assets is total_idle + total_debt. Empty supply is 1:1; total_assets == 0 with supply > 0 mints 0. _deposit pulls msg.sender, increments idle, mints to recipient. _max_deposit is 0 for address(0) and self. _redeem burns owner and pays receiver. Losses from the withdraw queue are capped by max_loss. process_report is REPORTING_MANAGER. Impl __init__ sets asset = self so the singleton cannot be initialized. Factory 3.0.4 create2 + initialize is already logged.

Next leftover: Sky sky-oapp-oft, TermMax leftover adapters, Twyne Sourcify-404 vaults, or StackingDAO native-pool / signer-managers. Not submitted.

2026-09-03: Sky PAUFactory + Kicker leftover (fd5f09c / ed90ec2)

Immunefi program sky ($10,000,000, kyc: false). Remaining listed Solidity after StarGuard / SubProxyMethods / PAU assembler / AdministeredAgent: PAUFactory.sol (6 Jul 2026, sky-ecosystem/diamond-pau dev fd5f09c) and Kicker.sol (19 Nov 2025, dss-flappers ed90ec2). Official raw GitHub. No mainnet interaction.

Files: src/PAUFactory.sol, src/Kicker.sol.

Checked for: factory deploy* that re-points a live controller / proxy / rate-limit to a stranger; permissionless flap that sucks beyond the surplus threshold or pays the caller.

Result: no user-exploitable finding. Not submitted.

• PAUFactory stores an immutable beacon (non-zero). Every deploy* is a new of a fresh AccessControls / Controller / ALMProxy / ALMProxyFreezable / RateLimits. It cannot mutate an already- deployed PAU graph. Controller is wired with caller-supplied accessControls / proxy / rateLimits plus the factory beacon.
• Kicker rely / deny / file are wards. flap is permissionless only after `vat.dai(vow) >= vat.sin(vow) + kbump
  • khump. It vat.suck(vow, this, kbump)thensplitter.kick(kbump, 0). The kicker hope`s the splitter in the constructor. No caller payout.

Remaining Sky listed Solidity was sky-oapp-oft; logged in the OFT pass below. Not submitted.

2026-09-03: StackingDAO strategy-v6 + stakers + rewards leftover (Hiro 13 Aug 2026)

Same Immunefi program stackingdao ($100,000, kyc: false). Remaining admin / stacker path after the cores: Hiro strategy-v6, stx-staker-stacking-dao-v2, stbtc-staker-bond-1-v2, commission-sbtc-v1, rewards-stx-v2. Source pulled read-only (/tmp/stacking-dao). No mainnet interaction.

Checked for: strategy perform-* callable by anyone; staker that pulls reserve STX/sBTC without protocol auth; return-* that credits a stranger; commission skim that is not protocol-gated; permissionless process-rewards that folds new inbound STX to a non-reserve sink.

Result: no user-exploitable finding. Not submitted.

• strategy-v6 perform-* require contract-caller == manager. Bond / recall / rollover / stake / unstake also require an approved signer-manager. initialize / set-manager / set-approved-signer-manager are dao.check-is-protocol.
• STX / sBTC stakers are protocol-gated. They pull via reserve request-*-to-stack / request-stx-for-staking (reserved-aware) and return via return-*-from-stacking. PoX calls run as-contract.
• commission-sbtc-v1 add-commission pulls from tx-sender and is protocol-gated. Default signer bps is 10000 (all to signer-payout-v1). withdraw-treasury is protocol-gated.
• rewards-stx-v2 process-rewards is permissionless only for already-queued streaming STX to stx-reserve-v2. Folding new inbound STX and add-rewards are keeper-only.

Remaining StackingDAO was native-pool + signer-managers / signer-payout; logged in the native-pool pass below. Not submitted.

2026-09-03: Sky sky-oapp-oft leftover (0baba10)

Immunefi program sky ($10,000,000, kyc: false). Last listed Sky leftover after PAUFactory / Kicker: sky-ecosystem/sky-oapp-oft 0baba10 (19 Nov 2025 assets). Listed files SkyOFTAdapter.sol, GovernanceOAppSender.sol, programs/oft/src/state/oft.rs, programs/governance/src/state/governance.rs. Also read the money path around those: SkyOFTCore / SkyRateLimiter / SkyOFTAdapterMintBurn / GovernanceOAppReceiver, Solana send / lz_receive / withdraw_fee. Official raw GitHub (/tmp/sky-oapp). No mainnet interaction.

Checked for: adapter _credit that unlocks more than was locked; fee withdraw that pulls TVL; mint-burn _debit that burns less than it credits remotely; inbound without an LZ peer; Solana withdraw that ignores tvl_ld; governance _lzReceive that executes for a non-peer.

Result: no user-exploitable finding. Not submitted. Listed Sky leftover Solidity / Solana OFT is exhausted.

• Adapter _debit pulls amountSentLD from _from, rate- limits amountReceivedLD, and parks the fee in feeBalance. _credit is whenNotPaused, inbound-limited, and unlocks exactly _amountLD. Zero / token recipients go to 0xdead. withdrawFees and migrateLockedTokens are onlyOwner and exclude feeBalance from migration.
• Mint-burn adapter burns amountSentLD and mints the fee to itself; _credit mints to the recipient. Fee withdraw is owner rescue of the adapter balance.
• Unset rate-limit windows have limit == 0 so _calculateDecay returns 0 capacity (fail-closed).
• Governance sender sendTx requires canCallTarget (onlyOwner set). Receiver _lzReceive is peer-gated by OAppCore and does a raw call to the decoded target; targets must check messageOrigin.
• Solana Adapter send escrows amount_sent_ld and increments tvl_ld by amount_received_ld. Receive requires peer.peer_address == params.sender, clears via the endpoint, then unlocks / mints sd2ld(amount_sd). withdraw_fee is admin and requires escrow.amount - tvl_ld >= fee_ld.

Next leftover: Sky L1/L2 governance relays + TermMax leftover adapters (logged below), or Twyne Sourcify-404 vaults. Not submitted.

2026-09-03: StackingDAO native-pool + signer leftover (Hiro 13 Aug 2026)

Same Immunefi program stackingdao ($100,000, kyc: false). Remaining wrappers after strategy-v6 / stakers / rewards: Hiro native-pool-v1, native-pool-signer-manager, signer-manager-stacking-dao-v1, signer-manager-bond-1-v1, signer-payout-v1, signer-admin-v1. Source pulled read-only (/tmp/stacking-dao). No mainnet interaction.

Checked for: native-pool delegate that stakes a stranger's STX; signer validate-stake! that accepts any staker; claim-rewards that pays the caller; payout distribute that is not keeper- gated; admin bootstrap that seizes a manager before the DAO wires it.

Result: no user-exploitable finding. Not submitted. Listed StackingDAO Clarity leftover is exhausted.

• native-pool-v1 delegate / delegate-update / undelegate use tx-sender and the protocol-set native-pool-sm. The delegating flag is set only around the user's own PoX call.
• Native-pool signer validate-stake! requires is-delegating (staker, this). claim-staker-rewards pays tx-sender.
• Protocol signer- managers validate-stake! against an admin allowlist. claim-rewards forwards sBTC to the admin-set recipient, not the caller.
• signer-admin-v1 set-admin is dao.check-is-protocol with no self- bootstrap.
• signer-payout-v1 distribute is keeper-only. withdraw-residual is protocol-gated.

2026-09-03: Sky L1/L2 governance relay leftover (ff964bb / 82918f4)

Immunefi program sky ($10,000,000, kyc: false). Remaining listed relays after sky-oapp-oft: sky-ecosystem/lz-governance-relay master ff964bb and sky-ecosystem/op-token-bridge master 82918f4. Local clones /tmp/lz-gov-relay and /tmp/op-token-bridge. No mainnet interaction.

Files: lz-governance-relay/src/{L1,L2}GovernanceRelay.sol, op-token-bridge/src/{L1,L2}GovernanceRelay.sol.

Checked for: permissionless relay that executes a stranger spell; L2 file that re-points the OApp / L1 sender; OP messenger spoof (xDomainMessageSender unchecked).

Result: no user-exploitable finding. Not submitted.

• LZ L1 relayEVM / relayRaw / reclaim* are wards. The payload is L2GovernanceRelay.relay(target, targetData) via the already-reviewed GovernanceOAppSender (src sender must be allowlisted per dst target).
• LZ L2 relay is messageAuth: msg.sender == l2Oapp, srcEid == l1Eid, srcSender == l1GovernanceRelay. Execution is delegatecall. file requires msg.sender == address(this) (only via that relay).
• OP L1 relay is wards and always targets the immutable l2GovernanceRelay through the immutable messenger. L2 onlyL1GovRelay requires msg.sender == messenger and xDomainMessageSender == l1GovernanceRelay.

Remaining Sky listed relays are the older Optimism / Arbitrum / Starknet DAI-bridge copies of the same ward + messenger pattern. Not submitted.

2026-09-03: StackingDAO swap + rewards-pox5 leftover (Hiro 13 Aug 2026)

Same Immunefi program stackingdao ($100,000, kyc: false). Listed wrappers the native-pool pass did not open: Hiro swap-ststx-ststxbtc-v4, rewards-pox5-v1, reward-split-calculator-v1. Source pulled read-only (/tmp/stackingdao). No mainnet interaction.

Checked for: swap that mints stSTXbtc without locking idle; harvest of the already-logged paper PPS bump after pending stSTXbtc exit; permissionless process-rewards that skims new inbound sBTC.

Result: no user-exploitable finding. Not submitted. Listed StackingDAO money-path leftover that Hiro would open is exhausted (tracking / withdraw NFTs were reviewed with the cores).

• Forward swap pulls stSTX, quotes get-stx-per-ststx (round down), burns, mints value-v stSTXbtc, and lock-stx-for-ststxbtc. Reverse uses get-stx-per-ststx-up so shares round against the swapper, then unlocks only when idle covers amount + reserved withdrawals. get-stx-available subtracts stx-for-ststxbtc-idle. After init-withdraw of stSTXbtc the quoted stSTX PPS can rise (circulating get-stx-for-ststxbtc drops) but available idle does not, so the inflated quote fails ERR_INSUFFICIENT_IDLE the same way withdraw-idle does.
• rewards-pox5-v1 process-rewards is permissionless only for already-queued sBTC (split by protocol bps). Commission on new inbound sBTC and the fold are keeper-only. reward-split- calculator-v1 compute-and-apply is protocol-gated.

2026-09-03: TermMax leftover swap adapters (e314f3f)

Same Immunefi program termstructurelabs ($80,000, kyc: false). Remaining V2 adapters after the already-logged 1inch / LiFi / Odos / UniV3 / Pendle / TermMaxSwap set: KyberswapV2AdapterV2, OkxSwapAdapter, PancakeSmartAdapter, KodiakSwapAdapter, ERC4626VaultAdapterV2, StrataVaultAdapter, TerminalVaultAdapter, OndoSwapAdapter. Local clone /tmp/termmax-v2 at e314f3f. No mainnet interaction.

Checked for: adapter swap callable on the implementation; user calldata that pays a third party while returning a fake tokenOutAmt; vault redeem that credits a stranger; Ondo quote that spends a different asset than tokenIn.

Result: no user-exploitable finding. Not submitted. Listed TermMax leftover adapters are exhausted.

• Parent ERC20SwapAdapterV2.swap is onlyProxy (delegatecall from the router). Markets / adapters stay on the already-logged whitelist.
• Kyber scales via the immutable helper then functionCalls the immutable router. OKX / Pancake / Kodiak measure or decode output on the router and revert on LessThanMinTokenOut / InvalidTradeAmount. A payload that pays a third party yields zero observed output.
• 4626 / Strata deposit to recipient and redeem from address(this). Terminal instant paths leave output on the router and forward the balance (same intentional leftover-sweep as useBalanceOnchain).
• Ondo checks quote.asset against tokenOut (BUY) or tokenIn (SELL) and refunds unused input / USDon to the user-set refundAddress.

Next leftover: Sky Optimism / Arbitrum / Starknet DAI-bridge relays (logged below), Lombard EVM strategy leftover (logged below), or Twyne Sourcify-404 vaults. Not submitted.

2026-09-03: Sky Optimism / Arbitrum / Starknet DAI-bridge leftover

Immunefi program sky ($10,000,000, kyc: false). Remaining listed 2022 DAI-bridge trees after LZ / OP governance relays: sky-ecosystem/optimism-dai-bridge master bc3d63f, arbitrum-dai-bridge master ba5e986, starknet-dai-bridge main 380a6ed. Local clones /tmp/op-dai-bridge, /tmp/arb-dai-bridge, /tmp/sn-dai-bridge. No mainnet interaction.

Files: OP L1/L2GovernanceRelay, L1Escrow, L1/L2DAITokenBridge; Arb L1/L2GovernanceRelay, L1Escrow, L1/L2DaiGateway; Starknet L1DAIBridge, L1Escrow, L1EscrowMom, L1GovernanceRelay, l2_dai_bridge.cairo, l2_governance_relay.cairo.

Checked for: permissionless L2 relay / mint; withdrawal that unlocks escrow without a burn; escrow approve that is not ward-gated; Starknet consumeMessageFromL2 that pays a stranger who did not appear in the L2 payload; Arb router-decoded from that burns a non-caller without the official router.

Result: no user-exploitable finding. Not submitted. Listed Sky leftover that a public GitHub tree would open is exhausted (Twyne vaults are still Sourcify 404).

• OP / Arb L1 relays are wards. L2 relay is messenger + L1 counterpart gated and delegatecalls a trusted spell. OP L2 also checks the messenger slot did not change.
• Escrows only approve under wards. Starknet L1EscrowMom.refuse can only set allowance to 0.
• OP deposit locks DAI in escrow and mints on L2 only via onlyFromCrossDomainAccount. L2 withdraw burns msg.sender then unlocks the same amount on L1. Closed bridges still finalize in-flight messages and reject new ones.
• Arb outboundTransfer sets from = msg.sender unless msg.sender is the immutable official router. Extra hook data is rejected. L2 burns from and L1 finalizeInboundTransfer is onlyL2Counterpart.
• Starknet deposit pulls msg.sender into escrow under maxDeposit + ceiling. L2 handle_deposit requires from_address == l1 bridge. initiate_withdraw burns the L2 caller and posts [0, l1_recipient, amount]. L1 withdraw consumes that payload with msg.sender == l1_recipient, then may forward DAI to a caller-chosen address (same designated recipient). cancelDeposit rebuilds the original payload with msg.sender as the depositor.

Next leftover: Lombard EVM strategy leftover (logged below), Enzyme CreWorkflowConsumer, or Twyne Sourcify-404 vaults. Not submitted.

2026-09-03: Lombard EVM strategy shard leftover (7fe83e5)

Immunefi program lombard-finance ($250,000, kyc: true). 15 Jul 2026 leftover after the SVM tree: Shard.sol, BlocklistOracle.sol, MerkleAllowlistValidator.sol, and contracts/strategy/converters (listed live Ethereum 0xDde9…2dFD / 0xc94B…da16 / 0x5D84…6602 / 0x6647…CDd3 / 0xecc0…A777). Official clone /tmp/lombard-evm at 7fe83e5. No mainnet interaction.

Files as named plus ShardBaseUpgradeable.sol and ChainlinkConverter / ChainlinkCompositeConverter / DirectConverter.

Checked for: exec that skips the allowlist; merkle validatorArgs that forges a leaf; privileged exec callable by anyone; pullFromStrategy without the transfer role; blocklist check that an allowlisted sanctioned address bypasses; converter that uses a stale or pre-downtime answer.

Result: no user-exploitable finding. Not submitted.

• Shard.initialize is one-shot (initializer) and _disableInitializers on the impl. pullFromStrategy / pushToStrategy are SHARD_TRANSFER_ROLE. exec is nonReentrant, rejects to == this, and requires validator.isAllowed. The 3-arg exec is PRIVILEGED_EXECUTOR_ROLE only. setValidator is DEFAULT_ADMIN_ROLE.
• Merkle validator fail-closes on a zero root. Leaves bind LEAF_TYPE + chainid + address(this). Rules are packed and must be canonical (reserved flags 0, unused header fields 0, exact length, strictly increasing constraint offsets, expected ⊆ mask). Dynamic-ABI constraint limits are documented in-source (policy authoring, not a user bypass).
• Blocklist check reverts on the manual list first, then external sanction lists. Allowlist skips sanctions only. blockAccount / unblockAccount / allowAccount / sanction-list add are role-gated.
• Converters are view. Chainlink rejects answer <= 0, future updatedAt, heartbeat staleness, sequencer-down, zero startedAt, grace period, and pre-recovery answers. Composite is one mulDiv. Direct is 1:1.

Next leftover: Enzyme CreWorkflowConsumer (logged below), Silo V3 vaults (logged below), or Twyne Sourcify-404 vaults. Not submitted.

2026-09-03: Enzyme Onyx CreWorkflowConsumer leftover (7b48d24)

Immunefi program enzyme-onyx ($200,000, kyc: false). 2 Jul / 24 Feb leftover CreWorkflowConsumer.sol after the ACE issuance pass. Official clone /tmp/enzyme-onyx at 7b48d24 (same ACE commit). In-repo ChainSecurity QA notes nonce / expiry and deployment sequencing. No mainnet interaction.

Files: src/components/automations/chainlink-cre/CreWorkflowConsumer.sol, IReceiver.sol. Adjacent: LimitedAccessLimitedCallForwarder.executeCalls.

Checked for: onReport from a non-Keystone caller; metadata that swaps workflow owner; replay / skipped nonce; permissionless init that steals a live forwarder role; setAllowedWorkflowId by a stranger.

Result: no user-exploitable finding. Not submitted.

• onReport requires msg.sender == CHAINLINK_KEYSTONE_FORWARDER (immutable). Metadata must match stored workflow id / name and immutable ALLOWED_WORKFLOW_OWNER. expiresAt is block.timestamp <=. Nonce must be lastNonce + 1; storage updates before executeCalls.
• executeCalls on the configured forwarder requires isUser(consumer). A front-run init can point a not-yet-inited clone at a stranger forwarder (DoS of that instance until redeploy). It cannot become a user on the live protocol forwarder (addUser is onlyAdminOrOwner). In-repo QA already flags the sequencing.
• init is one-shot (forwarder != 0). setAllowedWorkflowId is onlyAdminOrOwner.

Next leftover: Silo V3 vaults (logged below) or Twyne Sourcify-404 vaults. Not submitted.

2026-09-03: Silo Finance V3 vaults (31b98b3)

Immunefi program silofinance-v2 (Silo Finance v2 & v3, $100,000, kyc: true). GitHub vault tree added 25 Mar 2026. Local clone /tmp/silo-v3 at 31b98b3. No mainnet interaction.

Files: silo-vaults/contracts/{SiloVault,PublicAllocator, SiloVaultsFactory,IdleVault,IdleVaultsFactory}.sol, libraries/{SiloVaultActionsLib,SiloVaultFactoryActionsLib}.sol, incentives/VaultIncentivesModule.sol.

Checked for: first-depositor inflation; lying market previewRedeem that inflates share price then deflates; balanceTracker that can be lowered without a real withdraw; PublicAllocator flow-cap underflow / unsorted duplicates; claiming-logic delegatecall without a timelock; IdleVault deposit-to-stranger; factory init that leaves the incentives module unbound.

Result: no user-exploitable finding.

• MetaMorpho-style allocator / curator / guardian / timelock. Caps require market.asset() == vault.asset(). Lowering a cap is instant; raising is timelocked. Market removal needs cap 0, no pending cap, and either zero market-share balance or removableAt elapsed.
• DECIMALS_OFFSET = 6 plus +1 virtual assets. IdleVault is the same offset and only ONLY_DEPOSITOR (the SiloVault) may mint/deposit (maxDeposit(other) == 0 and receiver must match).
• balanceTracker only ratchets up when the market reports more (_updateInternalBalanceForMarket). It decreases only by the exact ERC20 delta received (_checkAfterWithdraw). A lying high report can raise totalAssets() (fee / share price) but that is curator-trusted market risk; the tracker then blocks further supply until a guardian syncBalanceTracker.
• Fresh deposits forceApprove the exact amount, then reset to 1 wei. _priceManipulationCheck reverts if previewRedeem(gotShares) + threshold < assets (default threshold 1e6).
• PublicAllocator reallocateTo is permissionless but only if the vault set it as allocator. Withdrawals must be unique and address-sorted; maxOut / maxIn are uint128 with MAX_SETTABLE_FLOW_CAP = type(uint128).max / 2. Fee is exact msg.value.
• Incentives claiming logics run via delegatecall from the vault. Owner-submitted logics are timelocked; curator-submitted logics skip the timelock only when a trusted factory (itself owner-timelocked) reports createdInFactory. Notification receivers are owner-only.
• Factory clones the incentives module, deploys SiloVault with that address, then __VaultIncentivesModule_init binds vault.

Not submitted. Remaining Silo listed Solidity: core Silo / SiloConfig / SiloFactory / router / leverage / kink IRM / incentives / hooks, plus share tokens (core Actions logged below).

2026-09-03: Silo Finance V3 core Actions leftover (31b98b3)

Same Immunefi program silofinance-v2. Money path after the vault pass: silo-core/contracts/Silo.sol wrappers plus lib/{Actions,SiloLendingLib,Views}.sol. Local clone /tmp/silo-v3 at 31b98b3. No mainnet interaction.

Checked for: flash-loan reentrancy that borrows against accounting liquidity after tokens left; repay that burns more debt than it pulls; withdraw that skips solvency when the deposit silo is the collateral silo; transitionCollateral that mints unbacked shares; withdrawFees that spends protected assets; callOnBehalfOfSilo from a non-hook.

Result: no user-exploitable finding.

• Deposit / withdraw / borrow / repay / transition take siloConfig reentrancy, accrue, then mutate. Borrow forbids an existing other-silo debt, sets the other silo as collateral, then _checkLTVWithoutAccruingInterest. Withdraw / transition check solvency when depositConfig.silo == collateralConfig.silo.
• SiloLendingLib.borrow sizes from stored totalAssets[Debt] and requires borrowedAssets <= collateral - debt. Transfer is live ERC20; a flash-loan callback that tries to borrow more than the leftover balance reverts on safeTransfer. Flash loan itself does not change accounting (intentional) and only lends balance - protected.
• Repay converts, clamps shares to the borrower's debt balance, requires totalDebt >= assets, burns then transferFrom (commented fee-on- transfer ignore). Anyone may repay anyone.
• Transition withdraws with _asset == 0 (no transfer) and deposits the same assets onto the other share token. No extra tokens appear.
• withdrawFees subtracts protected from balanceOf(this) before paying DAO/deployer. Failed deployer transfer redirects to the DAO.
• callOnBehalfOfSilo is OnlyHookReceiver. Hook delegatecall is hook-admin trust.

Not submitted. Remaining Silo listed Solidity is logged below.

2026-09-03: Silo Finance V3 config / router / leverage / hooks leftover (31b98b3)

Same Immunefi program silofinance-v2. Remaining listed Solidity after vaults + Actions: SiloConfig, SiloFactory, SiloRouterV2 + implementation, LeverageRouter + LeverageUsingSiloFlashloanWithGeneralSwap, PartialLiquidation / PartialLiquidationExecLib, SiloHookV1/V2/V3, ShareDebtToken, plus a skim of DynamicKinkModel and SiloIncentivesControllerCompatible. Local clone /tmp/silo-v3 at 31b98b3. No mainnet interaction.

Checked for: setOtherSiloAsCollateralSilo from a non-silo; debt transfer that skips recipient solvency; router delegatecall that spends a stranger's leftover; leverage swap that keeps flash-loaned tokens; liquidation that seizes shares of a solvent user; V3 hook that still liquidates.

Result: no user-exploitable finding.

• Config is immutable except borrowerCollateralSilo. Only a silo can _setSiloAsCollateralSilo. onDebtTransfer is OnlyDebtShareToken, forbids a second-silo debt, and copies the sender's collateral silo only when the recipient has none. ShareDebtToken transfers need a receive allowance and require the recipient solvent after (transferWithChecks).
• Factory clones + initializes both silos and share tokens, mints the fee NFT to _deployer. Fee caps are owner-set (max 50% DAO / 15% deployer / 30% liquidation).
• Router multicall is nonReentrant + pause and delegatecalls the implementation. Deposit / withdraw / borrow / repay always use msg.sender as owner. Leftover on the router is the caller's to sweep (transferAll); next user can take it (documented).
• Per-user leverage clone, onlyRouter. Open: flash debt → swap → deposit to borrower → borrow debt+fee to repay flash. Close: flash maxRepay → repayShares → redeem → swap must cover flash+fee; leftover goes to borrower. GeneralSwapModule is a separate contract; leverage transfers sell tokens in, never approves the module. User calldata that pays elsewhere yields amountOut == 0 and reverts. onFlashLoan requires msg.sender == _txFlashloanTarget.
• Partial liquidation accrues, sizes via liquidationPreview (reverts UserIsSolvent), pulls debt from the caller, forwards share tokens with checks off, then repay. Empty collateral after seize reverts NoCollateralToLiquidate. V1/V2 beforeAction reverts; V3 liquidationCall is NotSupported (defaulting path is V2).
• IRM implementation is initializer-locked; RCUR_CAP is 1000% APR. Incentives gauge kill is owner-only.

Listed Silo V3 GitHub Solidity leftover is exhausted. Next leftover: PancakeSwap Infinity (logged below), Mux3 (logged below), or Twyne Sourcify-404 vaults. Not submitted.

2026-09-03: PancakeSwap Infinity leftover (61cd131 / 8261f8d / 33dbf5a)

Immunefi program pancakeswap ($1,000,000, kyc: false, not paused). Five GitHub SC assets added 30 Oct 2025. This pass is the Infinity trees only. Local clones: /tmp/pcs-infinity-core 61cd131 (single squash titled “Fix known issues (#263)”, 2 Sep 2026), /tmp/pcs-infinity-periphery 8261f8d (bin add-liquidity slippage #95, 2 Sep 2026), /tmp/pcs-infinity-ur 33dbf5a (BytesLib.toLengthOffset bounds #57, 22 Jul 2026). Hexens / OtterSec / Zellic PDFs ship in-tree. No mainnet interaction.

Immunefi known issues — do not refile: 1291 (UniversalRouter OnlyMintAllowed bypass via INCREASE_FROM_DELTAS + TAKE_PAIR), 1298 (CL MINT_POSITION_FROM_DELTAS / _increaseFromDeltas slippage; Uniswap v4-periphery #517), 1493 (exact-output partial fill). OFT issues go to LayerZero. Website scope is only pancakeswap.finance.

Files: core Vault / VaultToken / SettlementGuard / AppDeficit / VaultReserve / ProtocolFees / ProtocolFeeController / Hooks / CLPoolManager / CLPool / CLHooks / BinPoolManager / BinPool / BinHooks / BinHelper; periphery SlippageCheck / DeltaResolver / SafeCallback / BaseActionsRouter / InfinityRouter / CLPositionManager FROM_DELTAS / BinPositionManager add/remove; UR UniversalRouter / Dispatcher / InfinitySwapRouter / Payments / BytesLib / Lock.

Checked for: lock that releases with an unrepaid app reserve overdraft; hook that takes another app’s physical tokens via the shared vault pot; collectFee vs floored reserves; sync sandwich from a hook or token callback; donate on empty liquidity; first-bin share inflation; afterMint/afterBurn hook delta unbounded vs official routers; BIN_ADD_LIQUIDITY_FROM_DELTAS without amountMax / share min; UR INFI_SWAP forwarding position-manager actions; leftover TRANSFER of another user’s tokens; BytesLib length/offset OOB after #57.

Result: no user-exploitable finding beyond the listed known issues.

• Vault lock requires zero unsettled settler deltas and AppDeficit.count() == 0. Mid-lock _accountDeltaForApp floors reservesOfApp at 0 and records a transient per-(app, currency) deficit (the #263 JIT-hook underflow fix). Cross-app deposit cannot repay another app’s deficit (in-repo VaultAppDeficit test). take/mint/settle/clear/burn are isLocked. collectFee is registered-app only, not locked, and underflows while a deficit has floored the reserve. sync is public; a hook that resets VaultReserve after a user transfer zeros the next settle and the lock reverts (CurrencyNotSettled). Same lock, whole tx reverts.
• CL donate reverts NoLiquidityToReceiveFees. Bin donate reverts on empty active bin and, separately, if shareOfBin[active] < minBinShareForDonate (default 2**128, so donate is owner-gated).
• First bin mint locks MINIMUM_SHARE 1e3 and reverts if the minter would receive 0. Burns round down. Last burn that leaves only the min share drops the bin from the tree; reserves for the lock stay.
• Swap hook specified-delta cannot flip exact-in/out (HookDeltaExceedsSwapAmount). Unspecified afterSwap delta is paid by the caller. afterMint / afterBurn / CL after-modify hook deltas are unbounded — users opt into the hook. Official BinPositionManager now validateMaxIn plus per-bin minLiquidities (#95). CL FROM_DELTAS still uses validateMaxIn on principal only (known issue 1298).
• UR INFI_SWAP calls InfinityRouter._executeActions. That router only handles CL/Bin swaps and SETTLE/TAKE — not position-manager mint/increase. No OnlyMintAllowed command remains in 33dbf5a. TRANSFER / SWEEP move the router’s own balance; leftover from a caller who skipped SWEEP is the next caller’s (same Uniswap UR pattern). toLengthOffset reverts if 32*length + relativeOffset exceeds the input. Self-reentrancy via EXECUTE_SUB_PLAN is allowed; external reentrancy is not.
• Protocol fee is subtracted from bin / CL step input before reserves update and is collected from app reserves later. Controller is owner-set; protocolFeeForPool caps each direction at 0.4%.

Not submitted. Remaining Pancake listed Solidity: pancake-v3-contracts and pancake-swap-periphery (older V3/V2 trees added the same day). Next leftover: Mux3 (logged below) or Twyne Sourcify-404 vaults.