Summary

Documentation-only change to docs/Vulnerabilities_list_tokenomics.md.

#27 — BuyBackBurner buyBack unused in default operation (new item)

Records the operating decision that BuyBackBurner.buyBack is not exercised in production, which keeps the item #14 class (BalancerPriceOracle single-block steerability) unreachable in practice:

• Both swap-path whitelists (mapV2Oracles, mapV3Pools) are empty on the deployed proxies and owner-gated, so the permissionless buyBack entry has no reachable code path (reverts at the whitelist gate).
• Collected funds flow via the oracle-free, non-swap transfer(token) path (OLAS → bridge2Burner, other tokens → treasury).
• _buyOLAS / _buyOLASV3 and the whitelist setters are retained as compatibility surface (V3-only if ever re-enabled); populating mapV2Oracles on a Balancer-path proxy is not planned and should be flagged in review.

No funds at risk on the deployed system; posture is "no code change" with governance-event monitoring.

#26 — broaden the planned code fix (existing item)

Expands the "Planned code fix" to the actual scope of the upcoming LiquidityManagerCore implementation upgrade:

• guard fail-closed on both triggers (new-pool + inactive-pool);
• decreaseLiquidity owner-supplied minAmount0/1 carve-out (exits stay live, sandwich-bounded);
• increaseLiquidity amountMin anchored to the TWAP center; collectFees burn-only-collected;
• the same release closes refactor: reward payouts to follow the CEI pattern #15/test: close to full coverage #16 (to be removed when the impl is live);
• adds the deploy-before-seed sequencing invariant and the intended fail-closed liveness residual.

Notes

• Docs-only; no contract/script changes. CI compile/lint/test surface is unaffected (ESLint runs on JS/TS only).
• Per repo convention, refactor: reward payouts to follow the CEI pattern #15/test: close to full coverage #16 will be removed (not annotated "FIXED") once the LM impl is live.