# Legacy Founder booster recovery

The deployed LP pool is `0x5d173cd1faf703269e3c7483625be7955e315bd1`. Its full source and ABI remain unavailable, but the previously blocked **specific recovery operation now has direct local-fork evidence**.

Historical successful explorer calldata `0x78b325a60000000000000000000000000000000000000000000000000000000000000001` with 1 CRO was replayed against current chain state on a disposable localhost fork. The function-selector match is `withdrawBoosters(bool)`, flag true. No mainnet transactions have been sent by this research.

At fork block 94,012,862, wallet `0xB54aaE2303fC8C8ea2109acF6cF56dD312D2A796` had Founder #74, #629 and #432 in `boostersOf(wallet)` and all three NFTs were owned by this LP pool. The position had zero staked LP and zero stored rewards, and the wallet held 50,000 FEED.

The exact historical call with 1 CRO:

- Simulated successfully, then executed successfully in the local fork.
- Returned all three Founder NFTs to that wallet.
- Emptied `boostersOf(wallet)`.
- Left the LP stake at zero and FEED balance unchanged.
- Produced three Founder `safeTransferFrom(pool,wallet,id)` calls and no other nested contract calls in the recorded call trace.
- Required no new NFT approval or FEED approval from the user.
- Used 235,304 gas in the local fork; live gas pricing and estimates must be obtained again.

The same call with zero CRO reverted with `Fee not paid`. Flag false also returned all three NFTs for this zero-LP/zero-reward position. **The boolean's full semantics remain unverified**; the equivalence of two outcomes at zero rewards does not prove equivalence for other positions.

The runtime hash at the tested state was `0x450e12d1a16bd58cee2ba04a532e285910c34480f0d43cce5502a4cc03b00512`. The configured staking token was UNI-V2 `0x22edb24af7041550eb99f24cfb74b1be4c86e4b9`, reward token FEED, booster token the active Founder contract.

A safe narrowly scoped recovery flow should pin this runtime and token configuration; read current boosters/custody/LP/reward state; use the exact historical calldata with flag true; preview that **all boosters** will return, the 1 CRO contract fee and separate network gas; simulate with the actual connected wallet; and verify the final receipt plus ownership and empty booster list after the user signs. If custody, runtime, fee simulation or the zero-LP/zero-reward assumptions change, stop and review the changed state. This is not permission to expose arbitrary LP methods, withdraw others' NFTs or assert that the complete contract has been audited.

Evidence:

- `outputs/booster-withdrawal-fork-evidence.json`: reproducible fork state, exact calldata, results and ownership readbacks.
- `outputs/booster-trace-true-1.json`, `outputs/booster-trace-false-1.json`: local execution traces.
- `scripts/verify-booster-fork.mjs`: read-only upstream and strictly localhost transaction harness.
- [Historical successful withdrawal](https://explorer.cronos.com/tx/0xfeec2ffa70f365d668d98039a5c0dddfc120384294417a4d2ba061b1b3ec1f04).
- [LP pool explorer](https://explorer.cronos.com/address/0x5d173cd1faf703269e3c7483625be7955e315bd1).

Fresh boundary verification at block 94,013,089: 999,999,999,999,999,999 wei reverted with Fee not paid; 1,000,000,000,000,000,000 wei succeeded; 1,000,000,000,000,000,001 wei also succeeded. Pool CRO balance increased by the entire submitted value. Therefore send exactly 1 CRO, without excess. Later UI validation must also require the reward period to have ended.