PulseChain pDAI / forked Arbitrum flow audit
RPC: https://rpc.pulsechain.com (public read-only access; not Sophia)
Snapshot: block 27,824,343. Opening comparison: block 17,233,000.
Canonical PulseChain pDAI: 0x6b175474e89094c44da98b954eedeac495271d0f

1. Actual escrow, inherited stock, and exact balance reconciliation
The Maker/Arbitrum DAI escrow is 0xa10c7ce4b876998858b1a9e12b10092229539400, separate from gateway 0xd3b5b60020504bc3489d6949d545893982ba3011. This is not the OmniBridge token 0xefd766... .
Opening pDAI escrow balance: 159,145,134.987187630840187249.
Closing pDAI escrow balance: 0.
Canonical pDAI Transfer events after opening through snapshot: zero incoming, two outgoing. The two outgoing amounts sum exactly to the opening balance to the final wei. Full transaction traces show DAI.transferFrom, not DAI.mint. Thus these measured withdrawals released inherited L1 escrow stock, not newly minted pDAI and not postfork user deposits.
The gateway itself, generic gateway A3a7..., router72ce..., bridge8315..., outbox0b98..., rollup5ef0... and custom implementation1d60... have zero pDAI balances at both comparison blocks and no pDAI Transfer events in/out during the interval. Looking only at the gateway balance misses the actual escrow.

2. Large withdrawal
2023-09-04 14:30:45 UTC, block 18,225,801.
Transaction: 0xa7414c090b9430f71219a44669bdd15706d08a181c15bb26b0ac86f9fa25bb28
Amount: 159,144,999.999999991013703680 pDAI.
Caller and recipient: 0xcb5cf20b3e413b6984ae2c685a1ec151ad3736e2.
Top-level target: 0x5163d3c16e0b76c2b45a59ed20b7d8913bbb44d1.
Trace: caller -> wrapper5163 -> Outbox0b9857 (delegate implementation0ea7372338a589e7f0b00e463a53aa464ef04e17) -> Bridge8315 -> DAI GatewayD3b5 -> DAI.transferFrom(escrow,recipient,amount).
Gateway checks the Bridge's activeOutbox and Outbox.l2ToL1Sender(); that returns canonical L2DAIGateway 0x467194771dae2967aef3ecbedd3bf9a310c76c65. Receipt has OutBoxTransactionExecuted, WithdrawalFinalized, DAI Transfer and BridgeCallTriggered logs.

3. Exact proof/root admission link
The actual outbox-call calldata was decoded independently. It has 17 proof siblings, index 87,953. Recomputing the item hash and Merkle path according to the historical verified Outbox code gives root:
0x21728ec89a33fa8f916fcd625a93b7b0fb2a5e13758e4ec571cffe79dbb2379c
This equals the sendRoot in NodeConfirmed node 5,229 at block 18,225,799, 20 seconds before the withdrawal.
Root-admission transaction:
0xa64e90b22c3838b9dd44a3be3cabcb1dd18514cff10486ce49a68fff17ab830e
Timestamp: 2023-09-04 14:30:25 UTC.
Same EOA cb5cf, nonce304; withdrawal nonce305.
Trace: cb5cf -> wrapper5163 -> Rollup5ef0.confirmNextNode(bytes32,bytes32) selector0x5eb405d5 -> rollup implementationa0ed0562629d45b88a34a342f20deb58c46c15ff -> Outbox.updateSendRoot.
The claimed L2 block hash in NodeConfirmed is 0x0000000000000000000000000000000000000000000000000000000000000011. This is a newly admitted root on PulseChain, not simply an inherited root left untouched since the fork. The call is confirmNextNode, not forceConfirm; no force-confirm or current Maker/Sky governance action has been demonstrated for this transaction.
The proof establishes inclusion under the accepted root; this is not independent validation of an authentic L2 DAI burn or a functioning new PulseChain L2. Whether the assertion that produced this root was valid requires inspecting the node assertion and validation conditions. Do not equate a successful outbox call with a live sequencer.

4. Exact onward liquidation
All large-withdrawal pDAI was passed from cb5cf to 0x17de88a045c537d0f36ce6700b9709b90861244c in four transfers:
- 1,000,000 pDAI, block18226733, 2023-09-04 17:06:25 UTC, tx0xb2afc000fef7002dc4b6970cea951078c50c134db35690e842cbe9035ccddc21
- 58,145,000 pDAI, block18235265, 2023-09-05 16:52:15 UTC, tx0x52f996f582617b055c3b469c34fb7b170eade973b2f7f56a1948dc1b6535bc14
- 50,000,000 pDAI, block18238585, 2023-09-06 02:06:05 UTC, tx0xad7a3cd9ff3471b5dd86c802b4de64901a513a8562a509d6bda3817b37e12120
- 49,999,999.999999991013703680 pDAI, block18240413, 2023-09-06 07:11:45 UTC, tx0x6059c6c27b55b579941e83bf7db51f3e4fffe9d4d78750eab8603fd4c337388f
17de used contract 0xf9c7166cbd7c10810536f09136221e85251d6858 in 28 transactions between 2023-09-05 16:46:05 and 2023-09-06 13:33:55 UTC. All 28 receipts succeeded and full traces show no errors. Current owner() of f9c716 is 17de.
Exact aggregate input: 159,144,999 pDAI.
- 39,369,959.754 pDAI passed through Maker PSM 0x89b78cfa322f6c5de0abceecab66aee45393cc5a, burned through DaiJoin, and exchanged for forked USDC. The USDC was then sold for WPLS.
- 53,614,719.668 pDAI went into pool0x947b4633e32e0c7f2c76753b43f008480715416d for WPLS.
- 66,160,319.578 pDAI went into pool0xae8429918fdbf9a5867e3243697637dc56aa76a1 for WPLS.
Native PLS returned by executor f9c716 to17de: 4,251,213,736.024440079156912700 PLS before gas costs.
17de current pDAI balance: 0.999999991013703680. cb5cf current pDAI balance:0. Executor current pDAI balance:0.
The Maker interaction measured here is use of the inherited PSM for liquidation, not evidence that MakerDAO/Sky authorized the operation. No direct pDAI transfer to777main,77160,Liberty executor orD8d9 appeared in this initial beneficiary chain. Do not identify this 159M with777's claimed150M solely because amounts look similar. This audit stops at the measured swaps and does not assign downstream LP buyers to the withdrawing party.

5. Residual withdrawal
2026-09-01 13:43:25 UTC, block27,434,956.
Transaction:0xe2fc714214d0ca72f2d8f2c45486f30763766ad3d4250cab73ae285465bb1645
Amount:134.987187639826483569 pDAI, completing the escrow drain.
Caller:0xfbba783afda7b41ebb7473a914f0b6eb9f9139f3.
Recipient:0xa0b347117a878da9942fa5c31b87c773a2969913.
Top-level target:Outbox0b9857; selector0x0b8707f6, delegate target0x1d60c6bc8afb07518b1112643ad1610c4732f19c.
Full trace again reaches Bridge -> DAI Gateway -> DAI.transferFrom. This uses the later custom outbox implementation, not the 2023 proof entry point.
The residual recipient additionally received6,459.341269885912741762 and1.000014270687701620 pDAI from other sources; it later sent6,595.328471796426926951 pDAI to0x58ab37d02696a481e2e5b5779967f3f4d237baa9. Only134.987... is attributable to this escrow by direct transfer.

6. Prior CRV claim verified
2024-09-04 10:02:15 UTC, block21,325,924.
Transaction:0xaeddb6a0e68f4c53af47df47393a1c69d1c1b776a86e069d714e249a419190ec
Caller0xd04a2966b68f65f328d47656b3c15c45e21ebe5b invokes Outbox0b9857 selector0x08635a95, historical implementation0ea737 -> Bridge -> generic ERC20GatewayA3a7 -> CRV.transfer.
Amount:3,205,223.797939043808628930 CRV from0xa3a7b6f88361f48403514059f1f16c8e78d60eec to0x42543853a72edb6f1ff9bddab0cf4676187ec28a.
This corroborates a CRV exit, but it is not the only demonstrated token exit: the much larger pDAI-unit withdrawal is independently proven above. Token quantities are not dollar valuations.

Evidence files
summary.json contains exact integer/decimal balances and aggregate results; liquidation.csv lists each of28 swaps. escrow_withdraw_* files contain RPC transactions, receipts, blocks and full traces; root_admission_* andwithdrawal_root.json contain the root-admission proof; crv_* contains CRV evidence. All calls read public chain data. No transactions were signed or broadcast.
