> For the complete documentation index, see [llms.txt](https://docs.gage.cash/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.gage.cash/protocol/bounty-targets.md). # Bounty target inventory Current gage bounty target inventory, partner lending, native V2 custody, Earn strategies and shared legacy dependencies. **Robinhood Chain mainnet, chain ID 4663. Customer funds in partner lending and native V2 are the primary research target.** Read the [bounty policy and rules](/protocol/bug-bounty.md) and [agent research checklist](/ai-agents/security-research.md) before testing. This inventory is generated from the release manifest and the publication of each Intent generation it names. The [machine-readable version](https://gage.cash/bounty-scope.json) contains the same targets, dependencies and discovery rules. Compare it with the [app deployment manifest](https://gage.cash/api/deployment), then verify bytecode, bindings, configuration and assets at your recent fork block. Bindings of every native V2 engine, adapter and Intent generation, and the nonempty code of every listed contract, were checked at block **91,567,109**. This is not a balance census or an independent audit, and the date on this list does not prove a vulnerable configuration remains live. ## Include every partner strategy * **Partner strategies and their helpers:** IntentFactory.count() and vaults(i), or isVault(address); the VaultCreated and VaultHelpers events name each strategy with its asset policy and lender market (IntentVault.ASSET\_POLICY() and LENDER\_MARKET()). Every strategy runs the factory's fixed creation code, keccak256 VAULT\_INIT\_HASH; check its USDG, shares, funded loans and recovered collateral. Every strategy a listed IntentFactory creates is covered from its creation, with its asset policy and lender market. Identify a strategy by its address and a loan by its core and loan ID. ## Include the per-loan accounts * **Per-loan collateral accounts:** GageV2Vault.getLoan(id).account; enumerate loanCount() and loan events. Check the clone vault(), collateral, token/NFT ownership and recovery state. * **Per-loan adapter party accounts:** GageLegacyAdapter.adapterId(engine, loanId), then loan(adapterId).borrower, .lender and .legacyId. Trace the legacy deal and each party clone; never count the same assets twice. These runtime-created clones are covered when created by the listed gage deployments. Implementations can have no balance while their clones hold customer collateral or settlement claims. Identify a position by chain, engine/vault and loan/deal ID. ## Primary: partner lending customer funds | Contract | Mainnet address | Research scope | | --------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | IntentFactory | [`0x20a908d82885cf4e990a9f8f3f5a483687660822`](https://robinhoodchain.blockscout.com/address/0x20a908d82885cf4e990a9f8f3f5a483687660822) | Creates every partner strategy from one fixed creation code (VAULT\_INIT\_HASH); admits creators and the filler, names the fill router, quote signer and protocol fee recipient, and classifies tokens. | | GageV2Vault (Intent core) | [`0x856e4232469b957150cb29a8ce9b60059449e87e`](https://robinhoodchain.blockscout.com/address/0x856e4232469b957150cb29a8ce9b60059449e87e) | Loan accounting for partner-funded loans: fractional lender units, reclaim rights, repayment, default recovery and USDG credits. Only strategies of its IntentFactory can fund (the bound funder gate). | | GageV2TokenRegistry (Intent core) | [`0x09c52d590bd9c764fbe58e6ff8b6e31bae892670`](https://robinhoodchain.blockscout.com/address/0x09c52d590bd9c764fbe58e6ff8b6e31bae892670) | Token collateral admission, per-token limits, terms and fees of the partner core, and the pause of its new loans. | | GageV2Rewards (Intent core) | [`0x5f653337f0B017aa60dbF977Cbc4e48Aa71ffA3c`](https://robinhoodchain.blockscout.com/address/0x5f653337f0B017aa60dbF977Cbc4e48Aa71ffA3c) | Reward entitlement of the partner core's loans, the funder gate bound once to the IntentFactory, and claims through its adapter. | | GageV2TokenCollateralAccount implementation (Intent core) | [`0x92073EE56E033Fd13300DB0E1Db472A2655E1175`](https://robinhoodchain.blockscout.com/address/0x92073EE56E033Fd13300DB0E1Db472A2655E1175) | Template for per-loan token custody clones. The funded clones, not this template balance, are the custody targets. | | GageV2CashoutRouter (Intent core) | [`0x3e7dc9bd908f5ba5aae43238c915e4f28a073ea7`](https://robinhoodchain.blockscout.com/address/0x3e7dc9bd908f5ba5aae43238c915e4f28a073ea7) | Flash repayment and collateral sale through the admitted exit routes or, through cashOutVia, one of KyberSwap's routers the owner admits as executor; callbacks and payout recipient. | | GageLegacyAdapter (Intent core) | [`0x789637f1f3fde2760d66b365f2cf7e30d2c7f6ca`](https://robinhoodchain.blockscout.com/address/0x789637f1f3fde2760d66b365f2cf7e30d2c7f6ca) | Connects native loans to legacy settlement and reward reserves; internal receipts and per-loan party accounts. | | GageLegacyParty implementation (Intent core) | [`0x888E571586fc14D2250aB54D6815C773525def4E`](https://robinhoodchain.blockscout.com/address/0x888E571586fc14D2250aB54D6815C773525def4E) | Template for distinct borrower/lender settlement clones. Include the actual clones and their balances/claims. | | IntentFillRouter | [`0xf8560439d914fe1fc2c1a2faa5b19ed46f73208d`](https://robinhoodchain.blockscout.com/address/0xf8560439d914fe1fc2c1a2faa5b19ed46f73208d) | Executes signed fill plans: funds a listing whole from one or more partner strategies at once and routes execution fees to the protocol fee recipient. | | IntentQuoteVerifier | [`0x80ec8893cec448cd43578c9d1e5a4bee71a7db53`](https://robinhoodchain.blockscout.com/address/0x80ec8893cec448cd43578c9d1e5a4bee71a7db53) | Verifies the rates service's signed plans and quotes (allocation per strategy, pricing evidence, fees, lifetimes) before a fill or a secondary purchase. | | LoopRouter | [`0xacfffd412dd838d3ede489bc4b79e19505769bad`](https://robinhoodchain.blockscout.com/address/0xacfffd412dd838d3ede489bc4b79e19505769bad) | Leverage loops: buys more of the pledged token through admitted Uniswap pools or an admitted aggregator executor (KyberSwap's routers), then lists, fills and pays out one loan on the partner core in one transaction. | | RolloverRouter | [`0x85829427103E33F3c8D6B06Ebb3aAd7185b0feDa`](https://robinhoodchain.blockscout.com/address/0x85829427103E33F3c8D6B06Ebb3aAd7185b0feDa) | Loan rollover: repays a running loan on the partner core with PoolManager flash liquidity, lists the same collateral for the same borrower and funds the new loan on a signed plan, in one transaction; runs the standing roll instructions holders set, inside the limits it checks on chain, and returns collateral repaid to it only to the loan's holder. | | PrivateBorrowRouter | [`0xc62DA1872bf3C9922e8C22Be4b29b5317b4bAa21`](https://robinhoodchain.blockscout.com/address/0xc62DA1872bf3C9922e8C22Be4b29b5317b4bAa21) | Private borrowing: withdraws a piece of a screened deposit from the pool the Entrypoint registers, lists it for the borrower the proof names and funds it with a signed plan, in one transaction; per-token caps, the screener's root attestation, the owner's attester and cap switches. | | GradeRegistry | [`0x897b15ea30923f9adbea4637aaee98722480cb3d`](https://robinhoodchain.blockscout.com/address/0x897b15ea30923f9adbea4637aaee98722480cb3d) | Loan grades and modeled costs the grade publisher posts; partner strategies and the quote verifier refuse a listing without a current grade. | | MorphoV2ReserveLens | [`0x653a22564c7ae7c37511dee025342afec2c20a16`](https://robinhoodchain.blockscout.com/address/0x653a22564c7ae7c37511dee025342afec2c20a16) | Reads what the Morpho reserve can pay out now; partner strategies size exits and funding by it. | | IntentVault creation code, part 1 of 2 | [`0xd36c4bf618b084cd517d79bbd34607178f1cabf4`](https://robinhoodchain.blockscout.com/address/0xd36c4bf618b084cd517d79bbd34607178f1cabf4) | Data contract holding half of the creation code every partner strategy is deployed from; keccak256 of both halves is the factory's VAULT\_INIT\_HASH. Never executed. | | IntentVault creation code, part 2 of 2 | [`0x3a4086a4daea168f8ecc00d03d6a45ee52719330`](https://robinhoodchain.blockscout.com/address/0x3a4086a4daea168f8ecc00d03d6a45ee52719330) | Data contract holding half of the creation code every partner strategy is deployed from; keccak256 of both halves is the factory's VAULT\_INIT\_HASH. Never executed. | | IntentFactory (GLD generation) | [`0x0966d92887d41796fcf6f77159d543b1565fec0d`](https://robinhoodchain.blockscout.com/address/0x0966d92887d41796fcf6f77159d543b1565fec0d) | Creates every partner strategy from one fixed creation code (VAULT\_INIT\_HASH); admits creators and the filler, names the fill router, quote signer and protocol fee recipient, and classifies tokens. | | GageV2Vault (GLD generation) | [`0xf2b98f79040b4157373093cdda2a4f2cb3c838d8`](https://robinhoodchain.blockscout.com/address/0xf2b98f79040b4157373093cdda2a4f2cb3c838d8) | Loan accounting for partner-funded loans: fractional lender units, reclaim rights, repayment, default recovery and USDG credits. Only strategies of its IntentFactory can fund (the bound funder gate). | | GageV2TokenRegistry (GLD generation) | [`0x1b7208b92586fbf7eb246234832530efdecfeb86`](https://robinhoodchain.blockscout.com/address/0x1b7208b92586fbf7eb246234832530efdecfeb86) | Token collateral admission, per-token limits, terms and fees of the partner core, and the pause of its new loans. | | GageV2Rewards (GLD generation) | [`0x24772Df730EEed3961b4712e99F33Cf0fe257A7E`](https://robinhoodchain.blockscout.com/address/0x24772Df730EEed3961b4712e99F33Cf0fe257A7E) | Reward entitlement of the partner core's loans, the funder gate bound once to the IntentFactory, and claims through its adapter. | | GageV2CashoutRouter (GLD generation) | [`0x4fb133edc4b72b81b2804b00b4e843ad34deca84`](https://robinhoodchain.blockscout.com/address/0x4fb133edc4b72b81b2804b00b4e843ad34deca84) | Flash repayment and collateral sale through the admitted exit routes or, through cashOutVia, one of KyberSwap's routers the owner admits as executor; callbacks and payout recipient. | | IntentFillRouter (GLD generation) | [`0x5f4c6be5cb0695f7a795debbed326d760dc30566`](https://robinhoodchain.blockscout.com/address/0x5f4c6be5cb0695f7a795debbed326d760dc30566) | Executes signed fill plans: funds a listing whole from one or more partner strategies at once and routes execution fees to the protocol fee recipient. | | IntentQuoteVerifier (GLD generation) | [`0xfaf4e55307aef8e074ef409dbbfe125c5d156322`](https://robinhoodchain.blockscout.com/address/0xfaf4e55307aef8e074ef409dbbfe125c5d156322) | Verifies the rates service's signed plans and quotes (allocation per strategy, pricing evidence, fees, lifetimes) before a fill or a secondary purchase. | | GradeRegistry (GLD generation) | [`0x620ca1fdc07001ee4c631e82e645b11d56e57eb8`](https://robinhoodchain.blockscout.com/address/0x620ca1fdc07001ee4c631e82e645b11d56e57eb8) | Loan grades and modeled costs the grade publisher posts; partner strategies and the quote verifier refuse a listing without a current grade. | | IntentAssetFeeProcessor (GLD generation) | [`0x2d509cb5ed7b0a61c65c604e2b5ca4aab93e1eb9`](https://robinhoodchain.blockscout.com/address/0x2d509cb5ed7b0a61c65c604e2b5ca4aab93e1eb9) | The protocol fee recipient of a lend-asset generation: holds its fees in its asset and converts them, in clips its keeper sizes, into USDG for the GAGE floor (DealFeeRouter) through one canonical V3 pool. | | IntentClosedReserve (GLD generation) | [`0xb150d62186fb136b1d1541c74c1591235293c42f`](https://robinhoodchain.blockscout.com/address/0xb150d62186fb136b1d1541c74c1591235293c42f) | The reserve of a lend-asset generation: an ERC-4626 over its asset that takes nothing, so its strategies keep idle cash themselves. | | RolloverRouter (GLD generation) | [`0x87A8C18c63A7f5957cB533389c20b80962d4E8A8`](https://robinhoodchain.blockscout.com/address/0x87A8C18c63A7f5957cB533389c20b80962d4E8A8) | Loan rollover: repays a running loan on the partner core with PoolManager flash liquidity, lists the same collateral for the same borrower and funds the new loan on a signed plan, in one transaction; runs the standing roll instructions holders set, inside the limits it checks on chain, and returns collateral repaid to it only to the loan's holder. | | IntentVault creation code, part 1 of 2 (GLD generation) | [`0x3b5520b2b81528c5ea11634f518f19dcb8c37d08`](https://robinhoodchain.blockscout.com/address/0x3b5520b2b81528c5ea11634f518f19dcb8c37d08) | Data contract holding half of the creation code every partner strategy is deployed from; keccak256 of both halves is the factory's VAULT\_INIT\_HASH. Never executed. | | IntentVault creation code, part 2 of 2 (GLD generation) | [`0x1c15d80a372f6c2104ace9303f70eeac0318326f`](https://robinhoodchain.blockscout.com/address/0x1c15d80a372f6c2104ace9303f70eeac0318326f) | Data contract holding half of the creation code every partner strategy is deployed from; keccak256 of both halves is the factory's VAULT\_INIT\_HASH. Never executed. | | IntentFactory (NVDA generation) | [`0xcb848a80801bfcdb7fa43a6729013ecf319a000b`](https://robinhoodchain.blockscout.com/address/0xcb848a80801bfcdb7fa43a6729013ecf319a000b) | Creates every partner strategy from one fixed creation code (VAULT\_INIT\_HASH); admits creators and the filler, names the fill router, quote signer and protocol fee recipient, and classifies tokens. | | GageV2Vault (NVDA generation) | [`0x380a536b1c8bf9e8c1035413497f767f76d30b6e`](https://robinhoodchain.blockscout.com/address/0x380a536b1c8bf9e8c1035413497f767f76d30b6e) | Loan accounting for partner-funded loans: fractional lender units, reclaim rights, repayment, default recovery and USDG credits. Only strategies of its IntentFactory can fund (the bound funder gate). | | GageV2TokenRegistry (NVDA generation) | [`0x8c73694f6394cb2054307b02646e2399a7f54045`](https://robinhoodchain.blockscout.com/address/0x8c73694f6394cb2054307b02646e2399a7f54045) | Token collateral admission, per-token limits, terms and fees of the partner core, and the pause of its new loans. | | GageV2Rewards (NVDA generation) | [`0x5f0359CEE3f48cDa6afD4De2a111b62dfde51908`](https://robinhoodchain.blockscout.com/address/0x5f0359CEE3f48cDa6afD4De2a111b62dfde51908) | Reward entitlement of the partner core's loans, the funder gate bound once to the IntentFactory, and claims through its adapter. | | GageV2CashoutRouter (NVDA generation) | [`0xdc5c966e05279fb860b4986c7483e431f1a3d482`](https://robinhoodchain.blockscout.com/address/0xdc5c966e05279fb860b4986c7483e431f1a3d482) | Flash repayment and collateral sale through the admitted exit routes or, through cashOutVia, one of KyberSwap's routers the owner admits as executor; callbacks and payout recipient. | | IntentFillRouter (NVDA generation) | [`0xda8bb629cfd4ffd8e0e00d7bf96fba35bbf354f4`](https://robinhoodchain.blockscout.com/address/0xda8bb629cfd4ffd8e0e00d7bf96fba35bbf354f4) | Executes signed fill plans: funds a listing whole from one or more partner strategies at once and routes execution fees to the protocol fee recipient. | | IntentQuoteVerifier (NVDA generation) | [`0xffc963221cad7c370c1443daa7c43568c73a8566`](https://robinhoodchain.blockscout.com/address/0xffc963221cad7c370c1443daa7c43568c73a8566) | Verifies the rates service's signed plans and quotes (allocation per strategy, pricing evidence, fees, lifetimes) before a fill or a secondary purchase. | | GradeRegistry (NVDA generation) | [`0x1aea6ba46beee96b936ceaa36481316b7b579ee1`](https://robinhoodchain.blockscout.com/address/0x1aea6ba46beee96b936ceaa36481316b7b579ee1) | Loan grades and modeled costs the grade publisher posts; partner strategies and the quote verifier refuse a listing without a current grade. | | IntentAssetFeeProcessor (NVDA generation) | [`0xca929749af2cd4c72fbf291c8c880d5b0b6ffbe3`](https://robinhoodchain.blockscout.com/address/0xca929749af2cd4c72fbf291c8c880d5b0b6ffbe3) | The protocol fee recipient of a lend-asset generation: holds its fees in its asset and converts them, in clips its keeper sizes, into USDG for the GAGE floor (DealFeeRouter) through one canonical V3 pool. | | IntentClosedReserve (NVDA generation) | [`0x24e81017982ac7fb78f17419c727410e893cc222`](https://robinhoodchain.blockscout.com/address/0x24e81017982ac7fb78f17419c727410e893cc222) | The reserve of a lend-asset generation: an ERC-4626 over its asset that takes nothing, so its strategies keep idle cash themselves. | | RolloverRouter (NVDA generation) | [`0x5d1308A9B8FBe849053E4Fc8E8BE9cD1a5c1D492`](https://robinhoodchain.blockscout.com/address/0x5d1308A9B8FBe849053E4Fc8E8BE9cD1a5c1D492) | Loan rollover: repays a running loan on the partner core with PoolManager flash liquidity, lists the same collateral for the same borrower and funds the new loan on a signed plan, in one transaction; runs the standing roll instructions holders set, inside the limits it checks on chain, and returns collateral repaid to it only to the loan's holder. | | IntentVault creation code, part 1 of 2 (NVDA generation) | [`0x949e40a4aa48abd3e3b88ceb68256c013a6e6bcd`](https://robinhoodchain.blockscout.com/address/0x949e40a4aa48abd3e3b88ceb68256c013a6e6bcd) | Data contract holding half of the creation code every partner strategy is deployed from; keccak256 of both halves is the factory's VAULT\_INIT\_HASH. Never executed. | | IntentVault creation code, part 2 of 2 (NVDA generation) | [`0x54e4e06ccff51291576bc7029de9b297c161c9da`](https://robinhoodchain.blockscout.com/address/0x54e4e06ccff51291576bc7029de9b297c161c9da) | Data contract holding half of the creation code every partner strategy is deployed from; keccak256 of both halves is the factory's VAULT\_INIT\_HASH. Never executed. | | IntentFactory (HIMS generation) | [`0x48a234770e74d907071b8d310f06cf253a846e9d`](https://robinhoodchain.blockscout.com/address/0x48a234770e74d907071b8d310f06cf253a846e9d) | Creates every partner strategy from one fixed creation code (VAULT\_INIT\_HASH); admits creators and the filler, names the fill router, quote signer and protocol fee recipient, and classifies tokens. | | GageV2Vault (HIMS generation) | [`0x359bb9751f5c2cfdce5d034a9742e7a0a3ac8e54`](https://robinhoodchain.blockscout.com/address/0x359bb9751f5c2cfdce5d034a9742e7a0a3ac8e54) | Loan accounting for partner-funded loans: fractional lender units, reclaim rights, repayment, default recovery and USDG credits. Only strategies of its IntentFactory can fund (the bound funder gate). | | GageV2TokenRegistry (HIMS generation) | [`0x0b07d49dbfb4f6932e4f11bd0b74d5f9adc5dd59`](https://robinhoodchain.blockscout.com/address/0x0b07d49dbfb4f6932e4f11bd0b74d5f9adc5dd59) | Token collateral admission, per-token limits, terms and fees of the partner core, and the pause of its new loans. | | GageV2Rewards (HIMS generation) | [`0x50EDf2Be5C6dA2cF82BB853DD008639A180309F3`](https://robinhoodchain.blockscout.com/address/0x50EDf2Be5C6dA2cF82BB853DD008639A180309F3) | Reward entitlement of the partner core's loans, the funder gate bound once to the IntentFactory, and claims through its adapter. | | GageV2CashoutRouter (HIMS generation) | [`0x4a9ef39ca35ff26e4f21099e8dd8914c1df8bb14`](https://robinhoodchain.blockscout.com/address/0x4a9ef39ca35ff26e4f21099e8dd8914c1df8bb14) | Flash repayment and collateral sale through the admitted exit routes or, through cashOutVia, one of KyberSwap's routers the owner admits as executor; callbacks and payout recipient. | | IntentFillRouter (HIMS generation) | [`0x81495ca59861b17af926fad46d8b2d9f547479b7`](https://robinhoodchain.blockscout.com/address/0x81495ca59861b17af926fad46d8b2d9f547479b7) | Executes signed fill plans: funds a listing whole from one or more partner strategies at once and routes execution fees to the protocol fee recipient. | | IntentQuoteVerifier (HIMS generation) | [`0x64921900c30540514951f19cd37c93c86be33998`](https://robinhoodchain.blockscout.com/address/0x64921900c30540514951f19cd37c93c86be33998) | Verifies the rates service's signed plans and quotes (allocation per strategy, pricing evidence, fees, lifetimes) before a fill or a secondary purchase. | | GradeRegistry (HIMS generation) | [`0x8bd57dab6cccb38979cf19edcc276eb16b09046b`](https://robinhoodchain.blockscout.com/address/0x8bd57dab6cccb38979cf19edcc276eb16b09046b) | Loan grades and modeled costs the grade publisher posts; partner strategies and the quote verifier refuse a listing without a current grade. | | IntentAssetFeeProcessor (HIMS generation) | [`0x36077c5c5cad4f7192fece13d4be9fa5598480ea`](https://robinhoodchain.blockscout.com/address/0x36077c5c5cad4f7192fece13d4be9fa5598480ea) | The protocol fee recipient of a lend-asset generation: holds its fees in its asset and converts them, in clips its keeper sizes, into USDG for the GAGE floor (DealFeeRouter) through one canonical V3 pool. | | IntentClosedReserve (HIMS generation) | [`0x41140cb9628ae2d5077933ea8188f6de5c87e130`](https://robinhoodchain.blockscout.com/address/0x41140cb9628ae2d5077933ea8188f6de5c87e130) | The reserve of a lend-asset generation: an ERC-4626 over its asset that takes nothing, so its strategies keep idle cash themselves. | | RolloverRouter (HIMS generation) | [`0x6b563aD0058c369472968D64c3D4Ad63C86c6513`](https://robinhoodchain.blockscout.com/address/0x6b563aD0058c369472968D64c3D4Ad63C86c6513) | Loan rollover: repays a running loan on the partner core with PoolManager flash liquidity, lists the same collateral for the same borrower and funds the new loan on a signed plan, in one transaction; runs the standing roll instructions holders set, inside the limits it checks on chain, and returns collateral repaid to it only to the loan's holder. | | IntentVault creation code, part 1 of 2 (HIMS generation) | [`0xa50522b74835c1d7b59b35c60d8bcc3648ddd776`](https://robinhoodchain.blockscout.com/address/0xa50522b74835c1d7b59b35c60d8bcc3648ddd776) | Data contract holding half of the creation code every partner strategy is deployed from; keccak256 of both halves is the factory's VAULT\_INIT\_HASH. Never executed. | | IntentVault creation code, part 2 of 2 (HIMS generation) | [`0x8c0a18033f2cef497c7b395170f78f878bd9f0da`](https://robinhoodchain.blockscout.com/address/0x8c0a18033f2cef497c7b395170f78f878bd9f0da) | Data contract holding half of the creation code every partner strategy is deployed from; keccak256 of both halves is the factory's VAULT\_INIT\_HASH. Never executed. | ## Primary: native V2 customer funds | Contract | Mainnet address | Research scope | | ----------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------- | | GageV2Vault (original) | [`0x22658055b70b8b09616b1e0953f2a51cc66cf493`](https://robinhoodchain.blockscout.com/address/0x22658055b70b8b09616b1e0953f2a51cc66cf493) | Loan accounting, fractional lender units, reclaim rights, repayment, default recovery and USDG credits. | | GageV2Registry (original) | [`0x1d9f88705d398cd13af4e35a74ef21253734f153`](https://robinhoodchain.blockscout.com/address/0x1d9f88705d398cd13af4e35a74ef21253734f153) | Live collateral admission, limits and route configuration; qualify an unauthorized path into user funds. | | GageV2BridgeRewards (original) | [`0xb1a4EB7B43d129617B2C5BaeF97B1A95b189Eb81`](https://robinhoodchain.blockscout.com/address/0xb1a4EB7B43d129617B2C5BaeF97B1A95b189Eb81) | V2 reward entitlement, closure cutoff and claims through the shared adapter. | | GageV2CashoutRouter (original) | [`0x38e37cc00427dd2a930d2a31e29e4104530d671b`](https://robinhoodchain.blockscout.com/address/0x38e37cc00427dd2a930d2a31e29e4104530d671b) | Flash repayment, collateral sale, callbacks and payout recipient. | | GageV2EntryRouter (original) | [`0x88168bd379a69a8429f1d3ceebe18783995ddc12`](https://robinhoodchain.blockscout.com/address/0x88168bd379a69a8429f1d3ceebe18783995ddc12) | ETH conversion, funding and refund of unused input. | | GageV2ZapRouter (original) | [`0xdea3b7b6f57c63cce013a64ba42020c10af083ad`](https://robinhoodchain.blockscout.com/address/0xdea3b7b6f57c63cce013a64ba42020c10af083ad) | Token/ETH conversion into LP collateral and loan creation. | | GageV2CollateralValidator (original) | [`0x0427fB6ab83B121a6C84B9F78B1cBbE87B8A835d`](https://robinhoodchain.blockscout.com/address/0x0427fB6ab83B121a6C84B9F78B1cBbE87B8A835d) | Validates the actual token or LP collateral accepted into custody. | | GageV2CollateralAccount implementation (original) | [`0x78Cefe229dC4EeDC6520fC099Cc9Ac0fff5585A4`](https://robinhoodchain.blockscout.com/address/0x78Cefe229dC4EeDC6520fC099Cc9Ac0fff5585A4) | Template for per-loan custody clones. The funded clones, not this template balance, are the custody targets. | | GageV2Vault (lender sales) | [`0x08561c817a5bf5230f91c001800449f047e4c07d`](https://robinhoodchain.blockscout.com/address/0x08561c817a5bf5230f91c001800449f047e4c07d) | Loan accounting, fractional lender units, reclaim rights, repayment, default recovery and USDG credits. | | GageV2Registry (lender sales) | [`0x5fbac7654c309eaeaa0a3bb9f4dc6d6dde04c7aa`](https://robinhoodchain.blockscout.com/address/0x5fbac7654c309eaeaa0a3bb9f4dc6d6dde04c7aa) | Live collateral admission, limits and route configuration; qualify an unauthorized path into user funds. | | GageV2BridgeRewards (lender sales) | [`0xD855c721C82a773135B0C1B67305d78c6dd35696`](https://robinhoodchain.blockscout.com/address/0xD855c721C82a773135B0C1B67305d78c6dd35696) | V2 reward entitlement, closure cutoff and claims through the shared adapter. | | GageV2CashoutRouter (lender sales) | [`0x8f0ddfbb88a4a70ef4c82ab237eb8407c6b6d866`](https://robinhoodchain.blockscout.com/address/0x8f0ddfbb88a4a70ef4c82ab237eb8407c6b6d866) | Flash repayment, collateral sale, callbacks and payout recipient. | | GageV2EntryRouter (lender sales) | [`0x346f21b71792a7f181860738ee90867f5688fde7`](https://robinhoodchain.blockscout.com/address/0x346f21b71792a7f181860738ee90867f5688fde7) | ETH conversion, funding and refund of unused input. | | GageV2ZapRouter (lender sales) | [`0x53d0e390438fbeec6440403458641bfa7ec29178`](https://robinhoodchain.blockscout.com/address/0x53d0e390438fbeec6440403458641bfa7ec29178) | Token/ETH conversion into LP collateral and loan creation. | | GageV2CollateralValidator (lender sales) | [`0x5e8688BB96D04898DAC62C832EC7755FA9334C02`](https://robinhoodchain.blockscout.com/address/0x5e8688BB96D04898DAC62C832EC7755FA9334C02) | Validates the actual token or LP collateral accepted into custody. | | GageV2CollateralAccount implementation (lender sales) | [`0xd92790053d8Bc920E5b9e47Dc69ca35C19709395`](https://robinhoodchain.blockscout.com/address/0xd92790053d8Bc920E5b9e47Dc69ca35C19709395) | Template for per-loan custody clones. The funded clones, not this template balance, are the custody targets. | | GageV2Vault (V3, no grace) | [`0xfee799ade96229c2c128bc5ed9e55f8d9d01a7e9`](https://robinhoodchain.blockscout.com/address/0xfee799ade96229c2c128bc5ed9e55f8d9d01a7e9) | Loan accounting, fractional lender units, reclaim rights, repayment, default recovery and USDG credits. | | GageV2Registry (V3, no grace) | [`0x17cfddae7247042a857326c2bb2abe43343e5d33`](https://robinhoodchain.blockscout.com/address/0x17cfddae7247042a857326c2bb2abe43343e5d33) | Live collateral admission, limits and route configuration; qualify an unauthorized path into user funds. | | GageV2BridgeRewards (V3, no grace) | [`0x7C2E47fe32C391bc9Dd6d8895559D67eF5651f21`](https://robinhoodchain.blockscout.com/address/0x7C2E47fe32C391bc9Dd6d8895559D67eF5651f21) | V2 reward entitlement, closure cutoff and claims through the shared adapter. | | GageV2CashoutRouter (V3, no grace) | [`0x895285fdbbec09eada41fc3784117d5177427acc`](https://robinhoodchain.blockscout.com/address/0x895285fdbbec09eada41fc3784117d5177427acc) | Flash repayment, collateral sale, callbacks and payout recipient. | | GageV2EntryRouter (V3, no grace) | [`0x699b3f84d8c90789da766a524e7ea50522ac1132`](https://robinhoodchain.blockscout.com/address/0x699b3f84d8c90789da766a524e7ea50522ac1132) | ETH conversion, funding and refund of unused input. | | GageV2ZapRouter (V3, no grace) | [`0xcf5d008e1ea2359223bf721e96c9c28b46cd3eeb`](https://robinhoodchain.blockscout.com/address/0xcf5d008e1ea2359223bf721e96c9c28b46cd3eeb) | Token/ETH conversion into LP collateral and loan creation. | | GageV2CollateralValidator (V3, no grace) | [`0x28790088216D10Ec81f477cE85F4F706dB648FD7`](https://robinhoodchain.blockscout.com/address/0x28790088216D10Ec81f477cE85F4F706dB648FD7) | Validates the actual token or LP collateral accepted into custody. | | GageV2CollateralAccount implementation (V3, no grace) | [`0x7A0CbEFC777c99DCa06A14c6BF5688Ac768b7AeF`](https://robinhoodchain.blockscout.com/address/0x7A0CbEFC777c99DCa06A14c6BF5688Ac768b7AeF) | Template for per-loan custody clones. The funded clones, not this template balance, are the custody targets. | | GageLegacyAdapter (V3) | [`0x2166a547bc27fef846c9858e3101b84d1a8d994e`](https://robinhoodchain.blockscout.com/address/0x2166a547bc27fef846c9858e3101b84d1a8d994e) | Connects native loans to legacy settlement and reward reserves; internal receipts and per-loan party accounts. | | GageLegacyParty implementation (V3) | [`0x4E7faE22CFb408399E3d0c810bEd46Ed7A7C62cD`](https://robinhoodchain.blockscout.com/address/0x4E7faE22CFb408399E3d0c810bEd46Ed7A7C62cD) | Template for distinct borrower/lender settlement clones. Include the actual clones and their balances/claims. | | GageLegacyAdapter (earlier engines) | [`0x647d46c0577453be8c75039f829740b5d2e44938`](https://robinhoodchain.blockscout.com/address/0x647d46c0577453be8c75039f829740b5d2e44938) | Connects native loans to legacy settlement and reward reserves; internal receipts and per-loan party accounts. | | GageLegacyParty implementation (earlier engines) | [`0xAbc5F5B52baC8ED7CC44727ee184973Ff2b71930`](https://robinhoodchain.blockscout.com/address/0xAbc5F5B52baC8ED7CC44727ee184973Ff2b71930) | Template for distinct borrower/lender settlement clones. Include the actual clones and their balances/claims. | ## Earn strategies: depositor funds | Contract | Mainnet address | Research scope | | ----------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | EarnVault: Gage USDG Stocks | [`0x36b438761AA271d9852549F54E88283987977B7a`](https://robinhoodchain.blockscout.com/address/0x36b438761AA271d9852549F54E88283987977B7a) | Earn strategy (third design): pooled USDG deposits and one share price, loans through the V3 engine, permissionless settlement, redemptions up to free liquidity and recovered collateral in side pockets. | | EarnVault: Gage USDG Memes | [`0xc04a365061E5D3CF7f614cF353494294b0E3F0c9`](https://robinhoodchain.blockscout.com/address/0xc04a365061E5D3CF7f614cF353494294b0E3F0c9) | Earn strategy (third design): pooled USDG deposits and one share price, loans through the V3 engine, permissionless settlement, redemptions up to free liquidity and recovered collateral in side pockets. | | EarnFactory | [`0x124d74D5626D392E937c3410c0325eA464700682`](https://robinhoodchain.blockscout.com/address/0x124d74D5626D392E937c3410c0325eA464700682) | Creates Earn strategies from fixed creation code and names their fill router, quote signer and protocol fee recipient. | | GradeRegistry (Earn) | [`0x0250ADfA79Ab2E303AF4C434c62F92f55DD38e50`](https://robinhoodchain.blockscout.com/address/0x0250ADfA79Ab2E303AF4C434c62F92f55DD38e50) | Collateral grades the Earn strategies read before funding; nothing here moves value. | | HybridVault: Gage USDG Mix | [`0x1e95DD1EC0a80133D132279B2afA9182d9d63ca4`](https://robinhoodchain.blockscout.com/address/0x1e95DD1EC0a80133D132279B2afA9182d9d63ca4) | Earn strategy (second design): depositors' shares, exits, loans through the lender-sales engine and recoveries; no longer listed in the app. | | HybridFees: Gage USDG Mix | [`0x5E1Ef58e11f9d2F53Df84678bD82D48ae50774a4`](https://robinhoodchain.blockscout.com/address/0x5E1Ef58e11f9d2F53Df84678bD82D48ae50774a4) | Splits a second-design strategy's performance fees between its curator and the protocol floor; both shares are pull-only. | | HybridVault: Gage USDG Stocks | [`0x21A8771DC8C260B12C916820ba8168B01Ab619BC`](https://robinhoodchain.blockscout.com/address/0x21A8771DC8C260B12C916820ba8168B01Ab619BC) | Earn strategy (second design): depositors' shares, exits, loans through the lender-sales engine and recoveries; no longer listed in the app. | | HybridFees: Gage USDG Stocks | [`0x19baB029303d163Ad2BA2fd854bf4cC60412100D`](https://robinhoodchain.blockscout.com/address/0x19baB029303d163Ad2BA2fd854bf4cC60412100D) | Splits a second-design strategy's performance fees between its curator and the protocol floor; both shares are pull-only. | | HybridFactory | [`0x1544b5E7BD7ab57fCcb991586694a8ACF054868B`](https://robinhoodchain.blockscout.com/address/0x1544b5E7BD7ab57fCcb991586694a8ACF054868B) | Created the second-design Earn strategies from its stored creation code. | ## Private lane: screened deposits (0xbow Privacy Pools v1.3.0, deployed unchanged by gage) | Contract | Mainnet address | Research scope | | --------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Privacy Pools Entrypoint (proxy) | [`0xde0140E41656aB6BB8D5a5a86f6c12e0f8a23C58`](https://robinhoodchain.blockscout.com/address/0xde0140E41656aB6BB8D5a5a86f6c12e0f8a23C58) | The Entrypoint proxy gage deployed for its pools, owned by the Safe: deposits, association-set roots, pool registration, fees and its upgrade path. 0xbow's code, unchanged: a finding in it is also reported to 0xbow. | | Privacy Pools Entrypoint implementation | [`0x9B1248fA8B80f69156a79008dFD10AF1dF45c018`](https://robinhoodchain.blockscout.com/address/0x9B1248fA8B80f69156a79008dFD10AF1dF45c018) | The Entrypoint implementation behind gage's proxy (0xbow's v1.3.0 build, unchanged). | | WithdrawalVerifier | [`0x1A278A4B19b647a1c9cEd76fe344940BF3d9Dd90`](https://robinhoodchain.blockscout.com/address/0x1A278A4B19b647a1c9cEd76fe344940BF3d9Dd90) | Groth16 verifier of withdrawal proofs for gage's pools (0xbow's v1.3.0 build, unchanged). | | CommitmentVerifier (ragequit) | [`0x5CAf3d1C64d97347E067f73e7B9Af6e389c1663B`](https://robinhoodchain.blockscout.com/address/0x5CAf3d1C64d97347E067f73e7B9Af6e389c1663B) | Groth16 verifier of take-back (ragequit) proofs for gage's pools (0xbow's v1.3.0 build, unchanged). | | PrivacyPoolComplex: PONS | [`0x76A253C460E8674dBa2EB378CA663BEE7729B9c6`](https://robinhoodchain.blockscout.com/address/0x76A253C460E8674dBa2EB378CA663BEE7729B9c6) | A depositors' pool of one token: deposits, withdrawals by proof, take-backs and the nullifier set (0xbow's v1.3.0 build, unchanged). | | PrivacyPoolComplex: CASHCAT | [`0xD23a5acE1EC9Ba3Bfe181e1b81f7a14b8E1F812E`](https://robinhoodchain.blockscout.com/address/0xD23a5acE1EC9Ba3Bfe181e1b81f7a14b8E1F812E) | A depositors' pool of one token: deposits, withdrawals by proof, take-backs and the nullifier set (0xbow's v1.3.0 build, unchanged). | | PrivacyPoolComplex: STONKBROKER | [`0x5da5FFb642F8b9f56732F4386AD23241Ab0969Bf`](https://robinhoodchain.blockscout.com/address/0x5da5FFb642F8b9f56732F4386AD23241Ab0969Bf) | A depositors' pool of one token: deposits, withdrawals by proof, take-backs and the nullifier set (0xbow's v1.3.0 build, unchanged). | | PrivacyPoolComplex: DELTA | [`0x4eb9214505915C40a481DaE4D07f974450D5f896`](https://robinhoodchain.blockscout.com/address/0x4eb9214505915C40a481DaE4D07f974450D5f896) | A depositors' pool of one token: deposits, withdrawals by proof, take-backs and the nullifier set (0xbow's v1.3.0 build, unchanged). | | PrivacyPoolComplex: HOOKR | [`0xa544D5917ED667E4ac428FcA3FeeCd116e1a3f73`](https://robinhoodchain.blockscout.com/address/0xa544D5917ED667E4ac428FcA3FeeCd116e1a3f73) | A depositors' pool of one token: deposits, withdrawals by proof, take-backs and the nullifier set (0xbow's v1.3.0 build, unchanged). | ## Legacy custody and shared settlement dependencies | Contract | Mainnet address | Research scope | | --------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------- | | Original DealVault | [`0x3D979740785ABd8b7Dd5c2Ff7Bf100CBe86fcBDF`](https://robinhoodchain.blockscout.com/address/0x3D979740785ABd8b7Dd5c2Ff7Bf100CBe86fcBDF) | Existing direct positions and the adapter-backed legacy leg of V2; settlement and withdrawal rights remain covered. | | CollateralRegistry / Borrow LP Zap: CollateralRegistry | [`0x67B40102C474BA599Dfa4c58E77f5Bc20b933C2d`](https://robinhoodchain.blockscout.com/address/0x67B40102C474BA599Dfa4c58E77f5Bc20b933C2d) | Include when this live dependency can affect customer custody, repayment, withdrawals or authorized input transfers. | | EntryRouter | [`0xa68a6Ab69c0f7672FD3669B6F214424f9652E9D9`](https://robinhoodchain.blockscout.com/address/0xa68a6Ab69c0f7672FD3669B6F214424f9652E9D9) | Include when this live dependency can affect customer custody, repayment, withdrawals or authorized input transfers. | | FeeSink | [`0xbE2066a95CF3eCc28c9665E5B024C3f8A313E19F`](https://robinhoodchain.blockscout.com/address/0xbE2066a95CF3eCc28c9665E5B024C3f8A313E19F) | Include when this live dependency can affect customer custody, repayment, withdrawals or authorized input transfers. | | DealFeeRouter | [`0xEaE95cD11e1105BF1E82033c918ff17f931B0245`](https://robinhoodchain.blockscout.com/address/0xEaE95cD11e1105BF1E82033c918ff17f931B0245) | Include when this live dependency can affect customer custody, repayment, withdrawals or authorized input transfers. | | ReinvestRouter | [`0x855283Dc751E05EBeb911032752ca0c5f4D95905`](https://robinhoodchain.blockscout.com/address/0x855283Dc751E05EBeb911032752ca0c5f4D95905) | Include when this live dependency can affect customer custody, repayment, withdrawals or authorized input transfers. | | Meme / USDG LP: DealVault | [`0xc23A08282AA1A9141C6fD7A29e7dFbFe841cC6B6`](https://robinhoodchain.blockscout.com/address/0xc23A08282AA1A9141C6fD7A29e7dFbFe841cC6B6) | Separate extension deployment; qualify impact on existing collateral, funding or withdrawable credits. | | Meme / USDG LP: CollateralRegistry / CASHCAT / USDG zap: CollateralRegistry | [`0x0e06d3d954d43A2e66A6D719fc0181e665c22f8d`](https://robinhoodchain.blockscout.com/address/0x0e06d3d954d43A2e66A6D719fc0181e665c22f8d) | Extension dependency; trace its binding and the exact customer assets exposed. | | Meme / USDG LP: EntryRouter | [`0x98Ae89Aaaf362508436bD649680215442662c0A5`](https://robinhoodchain.blockscout.com/address/0x98Ae89Aaaf362508436bD649680215442662c0A5) | Extension dependency; trace its binding and the exact customer assets exposed. | | Meme / USDG LP: FeeSink | [`0xAf7703F8D41Da5140A8407aa0725E4f44A8e88A7`](https://robinhoodchain.blockscout.com/address/0xAf7703F8D41Da5140A8407aa0725E4f44A8e88A7) | Extension dependency; trace its binding and the exact customer assets exposed. | | PONS / WETH LP: DealVault | [`0xe3628a01eaca2e7b0EC71Ed7bA616b997fEf9cDE`](https://robinhoodchain.blockscout.com/address/0xe3628a01eaca2e7b0EC71Ed7bA616b997fEf9cDE) | Separate extension deployment; qualify impact on existing collateral, funding or withdrawable credits. | | PONS / WETH LP: CollateralRegistry | [`0x38e9D1c40bCf6cD630b01C4a11a7bCe8BcfDE51f`](https://robinhoodchain.blockscout.com/address/0x38e9D1c40bCf6cD630b01C4a11a7bCe8BcfDE51f) | Extension dependency; trace its binding and the exact customer assets exposed. | | PONS / WETH LP: EntryRouter | [`0x85A2c1Ca936d2528032B2BEb8ACd3e4D99826AAd`](https://robinhoodchain.blockscout.com/address/0x85A2c1Ca936d2528032B2BEb8ACd3e4D99826AAd) | Extension dependency; trace its binding and the exact customer assets exposed. | | PONS / WETH LP: FeeSink | [`0x9bB55eD269D0096D50ecD08e34C283362d215f32`](https://robinhoodchain.blockscout.com/address/0x9bB55eD269D0096D50ecD08e34C283362d215f32) | Extension dependency; trace its binding and the exact customer assets exposed. | | Borrow LP Zap: DealVault | [`0x73efE72F500F01Da3042a4BB03C647D200021bf5`](https://robinhoodchain.blockscout.com/address/0x73efE72F500F01Da3042a4BB03C647D200021bf5) | Separate extension deployment; qualify impact on existing collateral, funding or withdrawable credits. | | Borrow LP Zap: EntryRouter | [`0x08321397515d8787C2422241E3A389b74Bd075e6`](https://robinhoodchain.blockscout.com/address/0x08321397515d8787C2422241E3A389b74Bd075e6) | Extension dependency; trace its binding and the exact customer assets exposed. | | Borrow LP Zap: LPZapRouter | [`0x430f91a2f4cdAA20DFe818163D2280c111987B66`](https://robinhoodchain.blockscout.com/address/0x430f91a2f4cdAA20DFe818163D2280c111987B66) | Extension dependency; trace its binding and the exact customer assets exposed. | | Borrow LP Zap: FeeSink | [`0x87CA030782bF45fC48A3df9627C121b762EFaD4C`](https://robinhoodchain.blockscout.com/address/0x87CA030782bF45fC48A3df9627C121b762EFaD4C) | Extension dependency; trace its binding and the exact customer assets exposed. | | CASHCAT / USDG zap: DealVault | [`0x4D52435086570D0A442320A843E0BfBEF2A57F8C`](https://robinhoodchain.blockscout.com/address/0x4D52435086570D0A442320A843E0BfBEF2A57F8C) | Separate extension deployment; qualify impact on existing collateral, funding or withdrawable credits. | | CASHCAT / USDG zap: EntryRouter | [`0xd5Dc7071904b9B76Ec3f515f341C6166ADe6B962`](https://robinhoodchain.blockscout.com/address/0xd5Dc7071904b9B76Ec3f515f341C6166ADe6B962) | Extension dependency; trace its binding and the exact customer assets exposed. | | CASHCAT / USDG zap: LPZapRouter | [`0x5613D91DeE54dDdAeb11167350b24a796F1287Ae`](https://robinhoodchain.blockscout.com/address/0x5613D91DeE54dDdAeb11167350b24a796F1287Ae) | Extension dependency; trace its binding and the exact customer assets exposed. | | CASHCAT / USDG zap: FeeSink | [`0x440B11b7F4843A49C9Ef1eE9212B7C139721033d`](https://robinhoodchain.blockscout.com/address/0x440B11b7F4843A49C9Ef1eE9212B7C139721033d) | Extension dependency; trace its binding and the exact customer assets exposed. | ## Shared rewards, liquidity and supporting contracts | Contract | Mainnet address | Research scope | | ------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------- | | GAGE | [`0x7163aE1B5AeA2f09EBc609C52b4dcAc0a7a4bC2d`](https://robinhoodchain.blockscout.com/address/0x7163aE1B5AeA2f09EBc609C52b4dcAc0a7a4bC2d) | Assess demonstrated user claims, funded rewards or gage-controlled liquidity separately from principal and protocol revenue. | | sGAGE | [`0x78c88CF8F6E612955526cEB501be82BF3279Bd5d`](https://robinhoodchain.blockscout.com/address/0x78c88CF8F6E612955526cEB501be82BF3279Bd5d) | Assess demonstrated user claims, funded rewards or gage-controlled liquidity separately from principal and protocol revenue. | | Emissions | [`0x6784E12e3cf4A5bbd71406ad30Ef693D819a976C`](https://robinhoodchain.blockscout.com/address/0x6784E12e3cf4A5bbd71406ad30Ef693D819a976C) | Assess demonstrated user claims, funded rewards or gage-controlled liquidity separately from principal and protocol revenue. | | DealRewards | [`0x5B95978dbE6193E9510aff8a8d78A92d84e6340d`](https://robinhoodchain.blockscout.com/address/0x5B95978dbE6193E9510aff8a8d78A92d84e6340d) | Assess demonstrated user claims, funded rewards or gage-controlled liquidity separately from principal and protocol revenue. | | Drip | [`0x3f2b11467C0EAbdc7f0D5910193BA012BbCc08Ff`](https://robinhoodchain.blockscout.com/address/0x3f2b11467C0EAbdc7f0D5910193BA012BbCc08Ff) | Assess demonstrated user claims, funded rewards or gage-controlled liquidity separately from principal and protocol revenue. | | LPRewards | [`0x57Ea11d7250C7Ee3127eFa9d0e2b114348C5ba19`](https://robinhoodchain.blockscout.com/address/0x57Ea11d7250C7Ee3127eFa9d0e2b114348C5ba19) | Assess demonstrated user claims, funded rewards or gage-controlled liquidity separately from principal and protocol revenue. | | LPHook | [`0xB6D2C8A9bbd0468E2904a7E9B3Ab3De36e07C500`](https://robinhoodchain.blockscout.com/address/0xB6D2C8A9bbd0468E2904a7E9B3Ab3De36e07C500) | Assess demonstrated user claims, funded rewards or gage-controlled liquidity separately from principal and protocol revenue. | | GageZapRouter | [`0xc94c999c6c85542283e4136bcf7a4f29f652bce0`](https://robinhoodchain.blockscout.com/address/0xc94c999c6c85542283e4136bcf7a4f29f652bce0) | Assess demonstrated user claims, funded rewards or gage-controlled liquidity separately from principal and protocol revenue. | | CreatorFeeSplitter | [`0x042fed6722e57093D97a4527ad622472ccC8A7be`](https://robinhoodchain.blockscout.com/address/0x042fed6722e57093D97a4527ad622472ccC8A7be) | Assess demonstrated user claims, funded rewards or gage-controlled liquidity separately from principal and protocol revenue. | | CompoundingSeedTimelock | [`0x93cF65E925BA231a32358a59f6d97D948Cd0674e`](https://robinhoodchain.blockscout.com/address/0x93cF65E925BA231a32358a59f6d97D948Cd0674e) | Assess demonstrated user claims, funded rewards or gage-controlled liquidity separately from principal and protocol revenue. | | GageV2ZapQuoter | [`0xDfb215909ce14A328445f8e931Dbc93108a7D0b1`](https://robinhoodchain.blockscout.com/address/0xDfb215909ce14A328445f8e931Dbc93108a7D0b1) | Read-only quote helper; a quote/UI discrepancy alone does not prove user-fund loss. | | CompoundingSeedBootstrap | [`0x71B41Cf96e88A31516c09576F68088f117E68aE0`](https://robinhoodchain.blockscout.com/address/0x71B41Cf96e88A31516c09576F68088f117E68aE0) | One-use transaction that seeded the GAGE/sGAGE pool and handed the position to CompoundingSeedTimelock; already executed. | ## Dependencies, not targets | Dependency | Addresses | Why it is not a target | | ------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Third-party tokens | 72 addresses, listed in the [scope JSON](https://gage.cash/bounty-scope.json) | USDG, WETH and the admitted collateral tokens. A bug in how a listed gage contract handles a token can qualify when its gage impact is shown on a local fork; the token contract itself is not a target. | | Uniswap v3 and v4 infrastructure, pools and pool hooks | 74 addresses, listed in the [scope JSON](https://gage.cash/bounty-scope.json) | PoolManager, the position managers, Permit2, StateView, the Universal Router, the V3 factory and every pool, including the flash pool that lends to the cash-out and leverage routers, and the hooks of third-party pools. | | Morpho Vault V2 reserve | [`0xbeeff033f34c046626b8d0a041844c5d1a5409dd`](https://robinhoodchain.blockscout.com/address/0xbeeff033f34c046626b8d0a041844c5d1a5409dd) | The ERC-4626 reserve holding the idle USDG of the Earn and partner strategies runs Morpho's code; the strategies that deposit into it, and gage's MorphoV2ReserveLens, are listed above. | | KyberSwap's routers (third-party executors) | [`0x6868D319c8c9A78F7d39DC3602C5c917315132D7`](https://robinhoodchain.blockscout.com/address/0x6868D319c8c9A78F7d39DC3602C5c917315132D7), [`0x6131B5fae19EA4f9D964eAc0408E4408b66337b5`](https://robinhoodchain.blockscout.com/address/0x6131B5fae19EA4f9D964eAc0408E4408b66337b5) | KyberSwap's Router V3 and MetaAggregationRouterV2, which the leverage router and the partner core's cash-out router may call as admitted executors (Router V3 first); read executorAllowed(address) on each router on chain. Neither is gage's code. A gage router failing to bound what it approves to or receives from them can qualify. | | Pons launchpad | [`0xFEd2332f6650747Af8250314C76F43aE08abC137`](https://robinhoodchain.blockscout.com/address/0xFEd2332f6650747Af8250314C76F43aE08abC137), [`0x7eD598BcEf8bd9Edd8C97A195C6d13f40801EC7e`](https://robinhoodchain.blockscout.com/address/0x7eD598BcEf8bd9Edd8C97A195C6d13f40801EC7e) | The bonding curve and factory GAGE launched through. | | gage cards: the TOKEN2049 claim NFTs | [`0x8F046f55e1FD63F89D3824C8C2bBa08E8dEb538B`](https://robinhoodchain.blockscout.com/address/0x8F046f55e1FD63F89D3824C8C2bBa08E8dEb538B), [`0x19E0bbEB76751DdA6B5Ad57F3daC44764EdD44B3`](https://robinhoodchain.blockscout.com/address/0x19E0bbEB76751DdA6B5Ad57F3daC44764EdD44B3), [`0xFAe9E31E74798A5B030A1FC9eDBF7B46D8667c32`](https://robinhoodchain.blockscout.com/address/0xFAe9E31E74798A5B030A1FC9eDBF7B46D8667c32) | GageCards and its two renderers (the art renderer falls back to the first for ids from 38). Collectibles claimed from the metal cards handed out at TOKEN2049: not part of the lending protocol, holding no lending funds, and read by no loan, deposit, reward or fee contract. | | Lookalike tokens, not gage's | [`0xc4e61671c30428adae35c6ca5cc98ed6e8a17c91`](https://robinhoodchain.blockscout.com/address/0xc4e61671c30428adae35c6ca5cc98ed6e8a17c91) | Named on gage's pages only as warnings: TIBBIR OFFICIAL is not Ribbita (TIBBIR), the admitted collateral. Not gage's, never admitted and never called by a listed contract. | | Owner and operator accounts | 5 addresses, listed in the [scope JSON](https://gage.cash/bounty-scope.json) | The deployment account, the founders' Safe, curators, fee recipients, the filler and the grade publisher own or operate contracts. Expected admin powers are not vulnerabilities; an actual permission bypass is. | | Poseidon hash libraries | [`0x3333333C0A88F9BE4fd23ed0536F9B6c427e3B93`](https://robinhoodchain.blockscout.com/address/0x3333333C0A88F9BE4fd23ed0536F9B6c427e3B93), [`0x4443338EF595F44e0121df4C21102677B142ECF0`](https://robinhoodchain.blockscout.com/address/0x4443338EF595F44e0121df4C21102677B142ECF0) | poseidon-solidity's PoseidonT3 and PoseidonT4 at their canonical addresses, which gage's pools link: pure hash functions deployed by their authors' deterministic deployer, not by gage. | Every contract address in the deployment manifest, and in the publication of each Intent generation it names, is listed in a group or named under exclusions. The generator refuses an address it cannot classify, and any contract that is not part of the mainnet release. A new deployment therefore cannot enter the manifest unclassified. Third-party token contracts, Uniswap managers, pools, Permit2, flash-liquidity providers and chain infrastructure are dependencies, not independently authorized targets. Model gage integration failures on a local fork. Count only assets gage can actually move or corrupt; aggregate manager balances and total token market cap are not exposed customer funds. ## Boundaries and changing deployments Legacy does not mean out of scope: include existing user assets, unwithdrawn balances, open claims, and any legacy function still used by V2. Retired engines and Earn strategies that no longer take new money still hold customer loans and deposits. A historical-only bug or a reward condition requiring an owner to re-enable it is research context until current reachability and qualifying impact are shown. Already-submitted reports are assessed against the policy and state applicable when submitted. This is a discovery inventory, not a closed list that excludes a newly deployed gage custody clone or a connected contract proven to control the same user funds. Report the deployment and binding evidence. Refresh it after changes to nativeV2.engines, nativeV2.adapter, intentV1, vaultMarkets or shared contract wiring. *Inventory verified 2026-10-18.* --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.gage.cash/protocol/bounty-targets.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.