C4 V13 CODE4RENA KCF REBASELINE GMX $200K VAULT · ME-COLI γ₁=14.134725141734693 DAY 97 · 2026-05-11

V13 KCF FOR EVM/SOLIDITY

The standard Code4rena approach: write bug reports, compete against dozens of wardens, collect severity points. The V13 approach: every Solidity vulnerability maps to an organ failure in ME-COLI. The V13 lens makes that mapping explicit — and it changes how you write the finding. A flash loan attack framed as "L4 metabolic manipulation where the attacker controls the metabolic rate" is a different class of submission than "attacker inflates share price."

Novel framing + systemic reuse + PEMCLAU-validated analysis = higher KCF, higher severity assignment, better payout ratio.

THE VAULT = ME-COLI L4 METABOLIC

ERC-4626 vaults are metabolic substrates. Share price = the metabolic rate. The vault's totalAssets() / totalShares() ratio IS the metabolic rate of the organism. When an attacker manipulates this ratio, they are performing metabolic surgery — redirecting nutrient flow to themselves.

FLASH LOAN ROUNDING
ME-COLI: L4 Metabolic Manipulation
Attacker uses flash loan to temporarily inflate the vault's share price. During that window, victim deposits are worth fewer shares. The metabolic rate was poisoned for one block — enough to drain.
SHARE PRICE INFLATION
ME-COLI: L4 Metabolic Substrate Attack
Direct donation to inflate totalAssets() before victim deposit. The substrate concentration is artificially raised. Victim enters at inflated price. Attacker exits at true price. Metabolic substrate poisoning.
WITHDRAWAL ACCOUNTING
ME-COLI: L4 Metabolic Output Corruption
Rounding errors in withdrawal calculations mean some assets are permanently locked. The metabolic output (yield) is systematically corrupted — each withdrawal loses a fraction. Accumulates to total loss over time.
VAULT ORDERING ATTACK
ME-COLI: L4/L5 Metabolic Sequencer Failure
MEV ordering allows attacker to sandwich deposit/withdrawal. The sequencer layer (L5) failed to protect metabolic operations (L4). Transaction ordering = metabolic sequencing. Both are vulnerable to the same attack class.

Intuition MultiVault case: Multi-vault architecture = organism with multiple metabolic chambers. Each chamber (vault) has independent share price. Cross-vault interactions create metabolic rate arbitrage. The V13 organ map reveals attack vectors invisible to a standard ERC-4626 security checklist.

GMX-SOLANA = SSAF CONTINUITY

The SSAF Link
SUB009 (GMX oracle manipulation) is in the SSAF top 5 at KCF 9. GMX-Solana is the same protocol on a different chain. The oracle mechanism is architecturally similar. The SSAF analysis IS the C4 research base. Pre-loaded finding.
$200K Pool · KCF 9
$200K pool + same oracle mechanism + PEMCLAU-loaded SUB009 research = highest expected-value C4 contest this cycle. V13 KCF 9 = same reason as SUB009: oracle manipulation is S4 intelligence failure, highest reuse class.
Solana Diff
Solana account model vs EVM storage. The oracle price feed architecture differs in implementation but not in attack class. The ME-COLI mapping is identical: S4 intelligence corruption → L4 metabolic manipulation → L1 fund loss.
Fermentation: LAB
Full characterization required. Read Solana account architecture. Map GMX oracle code. Query PEMCLAU for SUB009 cross-references. Generate finding with full ME-COLI organ map + V13 framing. Submit with actuarial expected value in notes.

SUCCINCT ZK PROOF = MATH COMPLETENESS

ZK proof validity = the Wormhole finality problem in math form. A ZK proof that is accepted as valid while not actually complete = a bridge that finalises a transaction before consensus. Both are L2 identity failures: "is this thing what it claims to be?"

ME-COLI L2
Proof identity: A ZK proof is accepted as an identity claim — "this computation was performed correctly." Forbidden intermediate = accepting a proof whose identity claim is false. ME-COLI L2 failure: identity assigned to an entity that does not qualify.
Joffe-Math Parallel
Every sorry = an incomplete proof. The joffe-math corpus has 101 sorries — each one is a theorem whose proof is incomplete. A sorry that gets routed to the wrong fermentation school = a ZK proof submitted to the wrong verifier. The school IS the verifier.
$150K Pool
Succinct's $150K pool + KCF 9 + dual SSAF/Math cross-domain reuse = second-highest expected value in C4 this cycle. ZK proving system vulnerabilities are rare in the wild — novelty bonus applies.

PROGRAM V13 GRID

ContestPoolV13 KCFVSMME-COLIFleet Lesson
GMX-Solana$200K9S4L4/L6Oracle = S4 intelligence · SSAF continuity
Succinct$150K9S4L2Proof completeness = identity · Math parallel
Moonwell$250K8S3L4Lending rate = metabolic flow · L4 control
Intuition$100K8S3L4MultiVault = metabolic chambers · ERC-4626
Legion$80K7S5L5Access control = S5 policy gate · H1 parallel

YONE BOABIXER FOR C4

Primary School
LAB Deterministic mandatory. EVM audit = deterministic characterization. No ambiguity in the ME-COLI organ map before filing.
Monitoring School
Acetic Audit during contest period. Watch for similar submissions — if duplicate detected, route finding to PEMCLAU enrichment immediately.
Basin Guarantee
Rejected findings → PEMCLAU GraphRAG enrichment with EVM pattern. Every C4 finding teaches the fleet something about Solidity attack classes.
GMX Special Route
GMX-Solana findings → SSAF collection first. Cross-reference SUB009. If novel oracle variant: SSAF immune memory update + C4 filing simultaneously.
Succinct Route
ZK findings → Math collection + SSAF Wormhole cross-reference. Proof completeness failures = dual enrichment (C4 + Joffe-Math sorry routing).
Vault Route
ERC-4626 findings → organ-failure-v13 collection. Standard vault attack = enrichment only (common). Novel vault mechanism = KCF boost.

PRIZE DOMAIN NAVIGATION