Refused by Codex's safety filter

• highSeason prize recipients are the winning guild's members when anyone calls close, so outsiders who join after the season ends can dilute or take the prizesrc/Season.sol:145

  _finalize reads guilds.membersOf(guildId) at the moment the permissionless close() finishes, not the membership at season end. Guilds.join is open to anyone until the guild has 32 members, and a majority of current members can expel. So once the season's final standings are known and fixed, outsiders can join a top-three guild at no risk before close runs.

  They then share the prize equally with the real players. If they outnumber the existing members they can also expel them first and take the whole share. The caller picks when close runs, so the attacker can settle, join, expel and close in consecutive transactions.

  The README/REVIEW F4 'late joiners' mitigation only covers joins after close. The brief says the top three guilds' prizes are 'split equally among their members'. Under this snapshot, the members at settlement time can be people who never played the season.

  Needed fix: snapshot eligible members at season end, for example by recording membership checkpoints in Guilds or by requiring a join time at or before seasonEndTime(season) (Guild has foundedAt but members have no joinedAt). Alternatively, refuse to count members who joined after the last epoch of the season.

  whole finding

  Verified with a Foundry PoC on PactsBase (4-epoch seasons, price 1e18, fee 1000 bps).

  (1) Epoch 0: alice founds guild 1, buys 10 troops and captures tile 0.

  Bob founds guild 2 and buys 1000 troops, so the season-0 pool is 101e18.

  (2) warp and settle through epoch 4, so season 0 has ended and is fully settled; tilesAtSeasonEnd(1,0)=1, and guild 1 is first with alice as its only member.

  (3) carol.join(1) and dave.join(1). carol proposes KIND_EXPEL(alice), dave votes yes (2 of 3), carol calls executeExpel.

  (4) Anyone calls season.close(0,100).

  Result: claimable(0,alice)=0 and claimable(0,carol)=claimable(0,dave)=25.25e18, so alice's entire 50.5e18 first prize goes to two addresses that joined after the season ended.

  Expected: the first prize goes to the guild's members at season end (alice gets 50.5e18).

  Without the expel step alice still loses two thirds of it to the post-season joiners.

  whole reproduction

• mediumAny single member, including one who just joined, can spend the whole guild treasury on troops without a vote; 90% goes to other guilds' tile incomesrc/Realm.sol:196

  buyTroopsFromTreasury only checks guilds.isMember(guildId, msg.sender). It needs no proposal or majority, while distributeTreasury and bonds (via pacts) do need votes. Membership is open, so any outsider can join a guild and turn its whole treasury into troops in one call.

  That treasury holds harvested income, returned or slashed bonds and member donations made with fundTreasury. Of the cost, feeBps goes to Season, and cost - fee enters incomePool of the current epoch. That income is shared per tile among all holders, so most of it goes to other guilds, possibly the attacker's own guild after they leave.

  The same call lets one member front-run signPact so that lockBond reverts with InsufficientTreasury, blocking a pact the majority approved. This contradicts the brief's 'no function can move player funds except the rules above': one member can move the treasury out of the guild's control with no vote.

  Fix: make treasury spending a voted proposal kind like KIND_DISTRIBUTE, or limit the amount a single member can spend.

  whole finding

  Verified with a Foundry PoC.

  (1) Epoch 0: bob founds guild 2, buys 10 troops and captures tile 0.

  After settlement guild 2 holds the only tile.

  Alice founds guild 1 and calls fundTreasury(1, 100e18).

  (2) carol (an outsider) calls join(1), then realm.buyTroopsFromTreasury(1, 100), then leave(). treasury(1) goes 100e18 -> 0 with no proposal or vote.

  (3) Warp one epoch, settle and harvest(2): treasury(2)=99e18, which is 9e18 from bob's own purchase plus 90e18 from guild 1's treasury.

  Season got 10e18.

  Expected: guild 1's treasury can only leave through a majority-voted action.

  Actual: one unvoted joiner moved all of it, 90% to a rival guild.

  whole reproduction

• mediumOld attack proposals never expire and do not name the defender, so one member can later trigger a betrayal slash the guild never voted forsrc/Realm.sol:255

  An attack proposal's data holds only (tile, troops). Its passing yes votes persist indefinitely, and any single member may call declareAttack whenever hasMajority still holds. Nothing ties execution to the epoch or holder that existed when members voted.

  A proposal passed to attack an unheld or enemy tile can therefore be executed epochs later, after the tile has passed to a guild that is now a pact partner. That is logged as betrayal (defender = holder at declaration), so the whole bond goes to the partner. One member, possibly working with the partner, can cost the guild its bond plus the committed troops without a vote on attacking that partner.

  Fix: bind attack proposals to an epoch (reject if currentEpoch() differs from the proposal's creation epoch) and/or to the expected defender in the payload, reverting when holder[tile] differs.

  Verified with a Foundry PoC.

  Epoch 0: alice founds guild 1, bob joins, and carol founds guild 2.

  Each guild buys 10 troops.

  Alice proposes attack(tile 7, 3 troops) and bob votes yes (2/2), but nobody executes it.

  Carol captures unheld tile 7.

  Settle, so holder(7)=2.

  Epoch 1: both treasuries are funded with 50e18.

  Guilds 1 and 2 pass mirrored pact proposals (10 epochs, 50e18 bonds each), and alice calls signPact.

  Bob alone then calls realm.declareAttack(staleProposal); it succeeds because the epoch-0 yes votes still count.

  Warp, settle, settlePact(0): lockedBonds(1)=0 and treasury(2)=100e18.

  Expected: the guild's bond is slashed only for an attack the majority chose against its partner.

  Actual: a vote on an unheld tile turned into a partner betrayal.

  whole reproduction

• mediumOutsiders can join a guild, expel its members and take the whole treasury through distributeTreasurysrc/Realm.sol:451

  distributeTreasury pays treasury / membersOf(guild).length to the current members after a majority of current members votes yes. Join is open (up to 32 members) and gives an equal vote right away, so any guild with k <= 15 members can be taken over by k+1 fresh addresses. They join, expel the original members (the majority's KIND_EXPEL), then pass and execute KIND_DISTRIBUTE, taking everything the treasury holds.

  That includes member donations made with fundTreasury to back bonds, harvested tile income, released bonds and bonds slashed to the guild as a betrayal victim. The same applies to any guild whose members have all left: the first joiner is a 1/1 majority. Open join and majority expel are in the brief, but distributeTreasury is an added payout route.

  Its equal split among whoever is a member at execution lets new members take funds earned or deposited before they joined. Fix preserving the brief: count only members who joined before the proposal was created or before the funds accrued (a membership join epoch or tenure requirement for voting and payout), or pay out according to contributions.

  whole finding

  Verified with a Foundry PoC.

  Alice founds guild 1 and funds its treasury with 300e18. carol and dave join guild 1 (3 members). carol proposes KIND_EXPEL(alice), dave votes yes (2/3), carol calls executeExpel. carol proposes KIND_DISTRIBUTE, dave votes yes (2/2), carol calls realm.distributeTreasury. carol and dave together receive 300e18 and alice receives 0.

  Expected: funds alice deposited are not claimable by addresses that joined afterwards.

  Actual: the whole treasury goes to the newcomers in 5 transactions at no cost beyond gas.

  whole reproduction

• lowPacts with zero bonds are accepted, so an unbacked pact with a throwaway guild earns honour banners at no costsrc/Diplomacy.sol:469

  _matchTerms rejects only duration 0. ownBond and partnerBond may both be 0, although the brief describes pacts 'backed by token bonds'. A zero-bond pact makes betrayal free (slash of 0). It also meets claimHonourBanner's hadPactDuring requirement, so any player can found a second guild from another address and sign a 1-epoch, 0-bond pact.

  Both guilds then claim an honour banner every season without risking any tokens. The honour banner stops showing that a bonded pact was kept.

  Fix: require bondA != 0 && bondB != 0, or a minimum bond, in _matchTerms.

  Verified with a Foundry PoC.

  In season 0, alice founds guild 1 and bob founds guild 2.

  Each proposes packPactData(partner, 1, 0, 0), and alice calls signPact, which succeeds with no treasury.

  Warp 4 epochs (season 0 ended). alice calls claimHonourBanner(0,1) and bob calls claimHonourBanner(0,2): both mint, and banners.balanceOf(alice)+balanceOf(bob)=2.

  Expected: honour requires a pact actually backed by bonds.

  Actual: two banners with no tokens ever at risk.

Refused by Codex's safety filter

• mediumPact signing snapshot excludes an attack on the partner declared earlier in the signing epoch; atomic declare-then-sign captures the partner's tile under the pact and turns the victim's retaliation insrc/Diplomacy.sol:122

  signPact stores logAB = realm.attackLogLength(a, b) at signing and _firstAttack only inspects entries at index >= logAB. An attack declared in the same epoch, moments (or the same transaction) before signPact, is therefore never a betrayal even though it resolves at the end of the pact's startEpoch, inside the window, on a tile the partner holds. Nothing in signPact checks hasAttacked[currentEpoch][a][partnerTile] or the last log entry's epoch.

  The partner's members voted on the pact terms before the attack existed and get no chance to withdraw support, because declareAttack and signPact can be issued back to back by the same member of guild A.

  Consequences: (1) guild A takes guild B's tile while the pact is active and its bond is never at risk; (2) B cannot answer for duration epochs without becoming the recorded betrayer; if B counterattacks in the next epoch, _betrayal reports byB only and settlePact pays B's bond to A.

  README lists 'attacks in flight when a pact is signed' as a known limitation, but the brief requires that attacking a pact partner is slashed automatically, and the limitation as written does not mention that the victim's bond is the one that ends up slashed. Boundary x invariant seam: the snapshot boundary (log index at signing) is compared against an invariant stated in epochs (attacks in [startEpoch, endEpoch] on partner tiles are betrayals).

  Minimal fix: in signPact, revert (or treat as betrayal) when the last entry of realm's attack log a->b or b->a has epoch == start, i.e. an unresolved attack on the partner exists in the signing epoch; equivalently snapshot the index of the first log entry with epoch >= start instead of the current length.

  whole finding

  Production parameters (1 PACT per troop, 10% fee); guild 1 = Alpha (alice), guild 2 = Beta (bob); each buys 10 troops and funds its treasury with 5e18.

  Epoch 0: Beta attacks tile 0 with 1 troop; settle at epoch 1 -> holder(0) == 2, garrison 1.

  Epoch 1: both guilds pass mirrored pact proposals packPactData(partner, 3, 5e18, 5e18).

  Alice then, in sequence, declareAttack(tile 0, 5 troops) and signPact(pa, pb): signPact succeeds, isActive(0) == true, betrayalOf(0) == (false, 0, false, 0).

  Epoch 2: settle -> holder(0) == 1 (Alpha took its partner's tile while the pact runs).

  Bob's guild retaliates with an attack on tile 0 (4 troops).

  Epoch 3: settlePact(0) -> brokenBy == 2, treasury(1) == 10e18 (own bond back plus Beta's 5e18), Beta's lockedBonds slashed to 0.

  Expected: Alpha's declaration on a partner-held tile in the pact's first epoch is Alpha's betrayal (byA true), Beta's later attack is retaliation, Alpha's 5e18 goes to Beta.

  whole reproduction
  proof · a Foundry test the fix has to pass

  // SPDX-License-Identifier: MIT
  pragma solidity 0.8.26;
  
  import {Test} from "forge-std/Test.sol";
  import {LaunchToken} from "src/LaunchToken.sol";
  import {Guilds} from "src/Guilds.sol";
  import {Realm} from "src/Realm.sol";
  import {Diplomacy} from "src/Diplomacy.sol";
  
  /// @dev An attack on the partner's tile declared in the signing epoch, immediately before
  /// signPact (same transaction is possible), is excluded by the signing snapshot. The attacker
  /// captures the partner's tile while the pact is in force, keeps its bond, and the partner's
  /// natural retaliation in the next epoch is recorded as the only betrayal, so the victim's bond
  /// is slashed to the attacker.
  contract PactSnapshotTest is Test {
      uint256 constant EPOCH = 1 hours;
      uint256 constant SEASON = 4 hours;
      uint256 constant GENESIS = 1_700_000_000;
      uint256 constant BOND = 5e18;
  
      address factory = makeAddr("factory");
      address alice = makeAddr("alice"); // guild 1, attacker
      address bob = makeAddr("bob"); // guild 2, victim
  
      LaunchToken token;
      Guilds guilds;
      Realm realm;
      Diplomacy diplomacy;
  
      function setUp() public {
          vm.warp(GENESIS);
          vm.startPrank(factory);
          token = new LaunchToken();
          guilds = new Guilds();
          realm = new Realm(address(token), address(guilds), EPOCH, SEASON, 1e18, 1000);
          token.transfer(alice, 1_000e18);
          token.transfer(bob, 1_000e18);
          vm.stopPrank();
          diplomacy = realm.diplomacy();
          vm.prank(alice);
          token.approve(address(realm), type(uint256).max);
          vm.prank(bob);
          token.approve(address(realm), type(uint256).max);
  
          vm.prank(alice);
          guilds.found("Alpha");
          vm.prank(bob);
          guilds.found("Beta");
          vm.prank(alice);
          realm.buyTroops(1, 10);
          vm.prank(bob);
          realm.buyTroops(2, 10);
          vm.prank(alice);
          realm.fundTreasury(1, BOND);
          vm.prank(bob);
          realm.fundTreasury(2, BOND);
  
          // Epoch 0: Beta captures tile 0 with one troop.
          _attack(bob, 0, 1);
          vm.warp(GENESIS + EPOCH);
          realm.settle(100);
          assertEq(realm.holder(0), 2);
      }
  
      function test_attackDeclaredJustBeforeSigningIsABetrayal() public {
          // Epoch 1: both guilds pass mirrored pact proposals (3 epochs, 5 PACT each).
          bytes32 dataA = diplomacy.packPactData(2, 3, BOND, BOND);
          bytes32 dataB = diplomacy.packPactData(1, 3, BOND, BOND);
          vm.prank(alice);
          uint256 pa = guilds.propose(3, dataA);
          vm.prank(bob);
          uint256 pb = guilds.propose(3, dataB);
  
          // Alice, in one go: attack Beta's tile 0 with 5 troops, then sign the pact.
          _attack(alice, 0, 5);
          vm.prank(alice);
          try diplomacy.signPact(pa, pb) {}
          catch {
              // Refusing to sign over an in-flight attack on the partner is an acceptable fix.
              return;
          }
  
          // The attack on the partner's tile inside the pact window must count as Alpha's betrayal.
          (bool byA,, bool byB,) = diplomacy.betrayalOf(0);
          assertTrue(byA, "attack on partner tile in the signing epoch is not a betrayal");
          assertFalse(byB);
  
          // Epoch 2: the attack resolves and Alpha holds Beta's former tile while the pact runs.
          vm.warp(GENESIS + 2 * EPOCH);
          realm.settle(100);
          assertEq(realm.holder(0), 1);
          // Beta retaliates in epoch 2.
          _attack(bob, 0, 4);
  
          // Epoch 3: settle the pact. Alpha betrayed first, so its bond goes to Beta.
          vm.warp(GENESIS + 3 * EPOCH);
          diplomacy.settlePact(0);
          assertEq(realm.treasury(2), 2 * BOND, "victim should receive the betrayer's bond");
          assertEq(realm.treasury(1), 0, "betrayer should lose its bond");
      }
  
      function _attack(address who, uint256 tile, uint256 count) internal {
          bytes32 data = realm.packAttackData(tile, count);
          vm.prank(who);
          uint256 id = guilds.propose(2, data);
          vm.prank(who);
          realm.declareAttack(id);
      }
  }

  whole proof

• lowOpen join lets sybils dilute a winning guild's prize and seize its majority (treasury, bonds, troops) with no defence; spec-inherent trust assumption that must stay documentedsrc/Guilds.sol:85

  join(guildId) has no approval step and only checks the ban list and the 32-member cap, while Season._finalize splits each rank's prize equally among guilds.membersOf(guildId) at closing time and Guilds.hasMajority recounts current members.

  Both are the brief's design (open join, one member one vote, split equally among members), so this is a documented trust assumption rather than a permission bypass, but the concrete exposure should be understood by the judge and stay in the README: a wallet needs no tokens, only gas.

  With a majority of sybils the attacker also passes KIND_DISTRIBUTE and KIND_ATTACK proposals and expels the founders, so the guild's treasury (harvested income, returned bonds, donations) is paid out mostly to the sybils and its troops can be thrown away. Possible mitigations change the agreed design (invite-only join, member snapshot at season end for prizes) and need a scope decision; the minimal non-design change is none.

  whole finding

  Beta (guild 2, sole member bob) holds tile 0 at the end of season 0; prize pool 2e18 (fees on two 10-troop purchases).

  After settle of epoch 4, 31 fresh addresses call guilds.join(2) and one of them calls season.close(0, 10).

  Result: claimable(0, bob) == 31250000000000000 (1e18 / 32) and each sybil also has claimable 31250000000000000; bob keeps 1/32 of the 50% share instead of all of it.

  Majority variant: two sybils join a one-member guild, propose kind 4 (distribute) and vote yes -> hasMajority true (2*2 > 3); distributeTreasury pays treasury/3 to each sybil.

  Expected under the brief: the same, so no fix is proposed; the finding documents the material risk and its precondition (any guild with fewer than 17 members that is not kept full).

  whole reproduction

• lowZero-bond, one-epoch pacts between colluding guilds satisfy the honour-banner rule every seasonsrc/Season.sol:187

  claimHonourBanner only requires hadPactDuring(guild, firstEpoch, lastEpoch) and no betrayal. Diplomacy._matchTerms accepts ownBond == 0 and partnerBond == 0 and duration == 1, and lockBond(guild, 0) succeeds with an empty treasury. Two guilds controlled by one player can therefore sign a 0/0 pact lasting a single epoch in the last epoch of each season and mint an honour banner for each guild every season without ever risking a token.

  Banners carry no token value, so impact is limited to devaluing the trophy the brief describes ('finished a season without breaking a pact' presupposes a pact that was backed by something). Minimal fix if the intended meaning is a backed pact: require bondA != 0 && bondB != 0 in _matchTerms, or require the pact to overlap at least N epochs of the season in hadPactDuring.

  Player controls alice (guild 1) and bob (guild 2), no tokens spent.

  In the last epoch of season 0 (epoch 3 with 4-epoch seasons): alice proposes packPactData(2, 1, 0, 0), bob proposes packPactData(1, 1, 0, 0); signPact(pa, pb) succeeds (lockBond with 0 twice).

  Warp to epoch 4: claimHonourBanner(0, 1) by alice and claimHonourBanner(0, 2) by bob both mint (kind 2).

  Repeat every season.

  Expected per the brief: an honour banner rewards a guild that kept a bonded pact; actual: it is claimable with zero bond and a one-epoch pact at the season's tail.

  whole reproduction

• infoREADME manifest example uses a `name` key that the LaunchManifest schema rejects; launch.json itself is validREADME.md:66

  The canonical LaunchManifest schema defines contracts items as {contract, constructorArgs} with additionalProperties false. The README's JSON example adds "name": "Guilds" / "name": "Realm" to each item.

  The committed launch.json omits name and validates (kind evm_project, token with no constructor args, Guilds before Realm, Realm args $token, $contract:Guilds, 3600, 604800, 1000000000000000000, 1000 matching the constructor (address, address, uint256 x4) and the tested production parameters; pool fields per guidance; initialPrice 2^96 below 2^256). Only the documentation example is wrong.

  Fix: drop the name keys from the README example.

  Validate the README example object under the schema: contracts[0] has property name not permitted by additionalProperties:false -> validation error. Validate launch.json: passes.

Refused by Codex's safety filter

• highAny member can spend the whole guild treasury on troops and immobilise them without a vote; open join turns this into a treasury drain by one hostile walletsrc/Realm.sol:196

  Realm.buyTroopsFromTreasury (line 196) and Realm.reinforce (line 231) are guarded only by guilds.isMember. Guilds.join is open to anyone (Guilds.sol line 85) and needs no approval. So a wallet that has never played can join a guild and, in the same block, convert the guild's entire treasury (harvested tile income, returned pact bonds, member donations) into troops and then move every pooled troop onto a garrison, from which troops can never be moved back.

  The tokens leave the treasury permanently: feeBps goes to the Season prize pool and the remainder enters incomePool[currentEpoch], which settle() pays per tile to every guild on the map. If the attacker's own guild holds tiles it receives that share. Repeating the call after each settlement (the victim's own per-tile share is harvested back into its treasury and is spendable again) converges the whole treasury to the other tile holders.

  The approved workflow states 'no function can move player funds except the rules above', and the rules put guild actions behind a majority vote; distributeTreasury correctly requires a KIND_DISTRIBUTE majority, but spending the same treasury on troops does not.

  Impact: loss of withdrawable player funds of an identifiable victim (the guild's members) by an unprivileged actor at the cost of one join transaction. Fix that keeps the design: execute buyTroopsFromTreasury only from a passed guild proposal (a new kind, e.g. KIND_SPEND with count packed in data, validated like distributeTreasury with proposalUsed and hasMajority); gate reinforce the same way or fold it into the attack vote, since reinforcement also disposes of pooled troops.

  whole finding

  State: Realm at production parameters (troopPrice 1e18, feeBps 1000).

  Guild 1 = {alice}, holds tile 5 (50 troops in the pool after capture) and treasury 1000e18 from alice's fundTreasury.

  Guild 2 = {mallory}, holds tile 0.

  Calls: (1) eve (any wallet) -> Guilds.join(1).

  (2) eve -> Realm.buyTroopsFromTreasury(1, 1000).

  Result on current code: treasury(1) == 0, incomePool[currentEpoch] == 900e18, 100e18 sent to Season.

  (3) eve -> Realm.reinforce(5, troops(1)) : troops(1) == 0, garrison(5) == 1100; guild 1 can no longer declare any attack.

  (4) next epoch, anyone -> settle(100): pendingIncome(2) == 499.5e18 (mallory's guild harvests half of alice's donation because it holds 1 of 2 tiles), pendingIncome(1) == 499.5e18 which eve can spend again the same way.

  Expected: eve alone cannot spend the treasury; treasury(1) stays 1000e18 until a majority vote authorises it.

  Measured in test/scratch: 'victim treasury after 0', 'attacker pending income 499500000000000000000'.

  whole reproduction
  proof · a Foundry test the fix has to pass

  // SPDX-License-Identifier: MIT
  pragma solidity 0.8.26;
  
  import {Test} from "forge-std/Test.sol";
  import {LaunchToken} from "src/LaunchToken.sol";
  import {Guilds} from "src/Guilds.sol";
  import {Realm} from "src/Realm.sol";
  
  /// @notice Finding: a single hostile joiner (no vote, no majority) empties a guild's treasury.
  /// `Realm.buyTroopsFromTreasury` and `Realm.reinforce` only check membership, and `Guilds.join`
  /// is open. Tokens the victim guild could have paid out with a distribute vote are converted into
  /// troops: 10% goes to the prize pool and 90% into the epoch income pool, which the attacker's
  /// own guild harvests in proportion to the tiles it holds.
  ///
  /// Fails on the current code (the drain succeeds) and passes once spending the treasury on troops
  /// requires a passed guild proposal, exactly like `distributeTreasury`.
  contract TreasuryDrainByJoinerTest is Test {
      uint256 internal constant EPOCH = 1 hours;
      uint256 internal constant SEASON = 4 hours;
      uint256 internal constant PRICE = 1e18;
      uint256 internal constant FEE_BPS = 1000;
  
      address internal factory = makeAddr("factory");
      address internal alice = makeAddr("alice"); // sole legitimate member of the victim guild
      address internal mallory = makeAddr("mallory"); // founder of the attacker guild, holds tile 0
      address internal eve = makeAddr("eve"); // mallory's second wallet, joins the victim guild
  
      LaunchToken internal token;
      Guilds internal guilds;
      Realm internal realm;
  
      function setUp() public {
          vm.warp(1_700_000_000);
          vm.startPrank(factory);
          token = new LaunchToken();
          guilds = new Guilds();
          realm = new Realm(address(token), address(guilds), EPOCH, SEASON, PRICE, FEE_BPS);
          token.transfer(alice, 10_000e18);
          token.transfer(mallory, 10_000e18);
          vm.stopPrank();
          vm.prank(alice);
          token.approve(address(realm), type(uint256).max);
          vm.prank(mallory);
          token.approve(address(realm), type(uint256).max);
      }
  
      function test_singleJoinerCannotSpendGuildTreasuryWithoutAVote() public {
          // Victim guild 1: alice donates 1000 PACT to back a future pact bond.
          vm.prank(alice);
          uint256 victim = guilds.found("victim");
          vm.prank(alice);
          realm.fundTreasury(victim, 1000e18);
          assertEq(realm.treasury(victim), 1000e18);
  
          // Attacker guild 2 captures tile 0 so it is the only income earner on the map.
          vm.prank(mallory);
          uint256 attacker = guilds.found("attacker");
          vm.prank(mallory);
          realm.buyTroops(attacker, 10);
          uint8 kindAttack = guilds.KIND_ATTACK();
          bytes32 attackData = realm.packAttackData(0, 10);
          vm.prank(mallory);
          uint256 proposal = guilds.propose(kindAttack, attackData);
          vm.prank(mallory);
          realm.declareAttack(proposal);
          vm.warp(block.timestamp + EPOCH);
          realm.settle(100);
          assertEq(realm.holder(0), attacker);
  
          // eve joins the victim guild (open membership) and immediately spends its whole treasury on
          // troops. No proposal, no vote, no majority.
          vm.prank(eve);
          guilds.join(victim);
          uint256 epoch = realm.currentEpoch();
          vm.prank(eve);
          vm.expectRevert(); // expected: a member alone may not spend the guild treasury
          realm.buyTroopsFromTreasury(victim, 1000);
  
          // On the current code the call above succeeds, so these hold the fixed behaviour.
          assertEq(realm.treasury(victim), 1000e18, "treasury was spent without a vote");
          assertEq(realm.incomePool(epoch), 0, "victim treasury leaked into the income pool");
  
          // And the attacker's guild must not be able to harvest the victim's money next epoch.
          vm.warp(block.timestamp + EPOCH);
          realm.settle(100);
          assertEq(realm.pendingIncome(attacker), 0, "attacker guild earned the victim treasury");
      }
  }

  whole proof

• highPrize split uses the member list at close time, so wallets that join the winning guild after the season ended take the prizesrc/Season.sol:145

  Season._finalize reads guilds.membersOf(guildId) when close() completes (line 145) and gives every current member an equal claimable share (line 147-151). close() can only run after settledEpoch >= (season+1)*epochsPerSeason, i.e. strictly after the season is over, and Guilds.join is open.

  Any wallet can therefore join a top-three guild after the season has ended and before (or in the same transaction as) the closing call and be paid out of a prize the guild earned entirely before that wallet existed. A guild of k members can be diluted by 32-k joiners, so a solo winner keeps 1/32 of its prize while sybils take 31/32.

  The guild has no defence: expulsion needs a strict majority that the joiners now hold, and pre-filling the guild to 32 wallets is not a rule of the game. README lists open membership as a limitation and REVIEW.md F4 calls late joining 'mitigated' because joining after close earns nothing, but the window between season end and close is unbounded and the closing call itself is permissionless, so the attacker controls it.

  Impact: theft of the fee-funded prize pool from the guild members who won it, by an unprivileged actor at gas cost only. Minimal fix preserving the design: Guilds records joinedAt per (guild, member) (updated in _add) and exposes it; _finalize skips members whose joinedAt >= realm.seasonEndTime(season) when computing members.length and assigning claims (the skipped share rolls over as unassigned amounts already do).

  Alternatively snapshot the member list when the season's last epoch is settled.

  whole finding

  State: production parameters, epochsPerSeason 4 in the test. alice founds guild 1, buys 1000 troops (prizePool[0] == 100e18) and captures tile 0; she is the only player all season.

  Warp past the season, settle(100) so settledEpoch == 4 and tilesAtSeasonEnd(1, 0) == 1.

  Calls: 30 fresh wallets each call Guilds.join(1); then sybil0 calls Season.close(0, 100).

  Result on current code: claimable(0, alice) == 1612903225806451612 (50e18 / 31) and each sybil has claimable 1612903225806451612 with claimRank 1, and each can call claimPrize(0) to receive the tokens and a victory banner.

  Expected: claimable(0, alice) == 50e18 and post-season joiners have no claim.

  Measured: 'post-season joiners diluted the winner: 1612903225806451612 != 50000000000000000000'.

  whole reproduction
  proof · a Foundry test the fix has to pass

  // SPDX-License-Identifier: MIT
  pragma solidity 0.8.26;
  
  import {Test} from "forge-std/Test.sol";
  import {LaunchToken} from "src/LaunchToken.sol";
  import {Guilds} from "src/Guilds.sol";
  import {Realm} from "src/Realm.sol";
  import {Season} from "src/Season.sol";
  
  /// @notice Finding: `Season._finalize` splits a winner's prize among the members the guild has at
  /// the moment `close` runs, and `close` can only run after the season has ended. Because
  /// `Guilds.join` is open, anyone can join the winning guild after the season ended and before
  /// closing (in the same transaction as the closing call) and take a share of a prize that the
  /// guild earned entirely before they existed. The guild cannot prevent it: expulsion needs a
  /// majority that the joiners now outnumber.
  ///
  /// Fails on the current code (alice, who won the season alone, is left with 1/31 of the first
  /// prize) and passes once members who joined after the season end are excluded from the split.
  contract PrizeCaptureByLateJoinersTest is Test {
      uint256 internal constant EPOCH = 1 hours;
      uint256 internal constant SEASON = 4 hours;
      uint256 internal constant PRICE = 1e18;
      uint256 internal constant FEE_BPS = 1000;
  
      address internal factory = makeAddr("factory");
      address internal alice = makeAddr("alice");
  
      LaunchToken internal token;
      Guilds internal guilds;
      Realm internal realm;
      Season internal season;
  
      function setUp() public {
          vm.warp(1_700_000_000);
          vm.startPrank(factory);
          token = new LaunchToken();
          guilds = new Guilds();
          realm = new Realm(address(token), address(guilds), EPOCH, SEASON, PRICE, FEE_BPS);
          token.transfer(alice, 10_000e18);
          vm.stopPrank();
          season = realm.season();
          vm.prank(alice);
          token.approve(address(realm), type(uint256).max);
      }
  
      function test_walletsJoiningAfterSeasonEndDoNotShareThePrize() public {
          // alice founds guild 1, buys 1000 troops (100 PACT of fees -> season 0 prize pool) and
          // captures tile 0. She is the only player and the only member of her guild all season.
          vm.prank(alice);
          uint256 winner = guilds.found("alice-guild");
          vm.prank(alice);
          realm.buyTroops(winner, 1000);
          uint8 kindAttack = guilds.KIND_ATTACK();
          bytes32 attackData = realm.packAttackData(0, 100);
          vm.prank(alice);
          uint256 proposal = guilds.propose(kindAttack, attackData);
          vm.prank(alice);
          realm.declareAttack(proposal);
          assertEq(season.prizePool(0), 100e18);
  
          // Season 0 ends and is fully settled. Guild 1 holds tile 0 at season end.
          vm.warp(block.timestamp + SEASON);
          realm.settle(100);
          assertEq(realm.settledEpoch(), 4);
          assertEq(realm.tilesAtSeasonEnd(winner, 0), 1);
  
          // Thirty wallets that never played join the winning guild after the season ended, then one
          // of them closes the season in the same transaction.
          address[] memory sybils = new address[](30);
          for (uint256 i; i < sybils.length; ++i) {
              sybils[i] = makeAddr(string.concat("sybil", vm.toString(i)));
              vm.prank(sybils[i]);
              guilds.join(winner);
          }
          vm.prank(sybils[0]);
          season.close(0, 100);
          assertTrue(season.result(0).closed);
          assertEq(season.result(0).winners[0], winner);
  
          // The first prize is 50% of the pool. It was earned by alice alone and must be hers.
          uint256 firstPrize = 100e18 * season.FIRST_SHARE() / 100;
          assertEq(season.claimable(0, alice), firstPrize, "post-season joiners diluted the winner");
          for (uint256 i; i < sybils.length; ++i) {
              assertEq(season.claimable(0, sybils[i]), 0, "a wallet that joined after the season end has a prize");
              assertEq(season.claimRank(0, sybils[i]), 0, "a wallet that joined after the season end has a rank");
          }
      }
  }

  whole proof

• mediumOpen join lets an outsider buy a strict majority of any guild with at most 15 members and vote its treasury and bonds to itself; the documented defence (expulsion) cannot work against that majoritysrc/Guilds.sol:85

  Guilds.join (line 85) admits any non-banned wallet while the guild has fewer than 32 members, and Guilds.hasMajority (line 186) counts one vote per current member. For a guild with k <= 15 members an attacker joins k+1 wallets and holds a strict majority immediately.

  That majority can (a) pass KIND_DISTRIBUTE and call Realm.distributeTreasury, paying (k+1)/(2k+1) of the treasury to the sybils; (b) pass a KIND_PACT proposal mirroring a proposal of the attacker's own guild with a large bond funded from the victim treasury, sign it, then pass and declare a KIND_ATTACK on a tile of the attacker's guild, which Diplomacy.settlePact turns into a slash of the victim's bond to the attacker's guild treasury; (c) pass KIND_EXPEL against every legitimate member so the guild, its tiles and future income become the attacker's.

  README's 'Assumptions and known limitations' names dilution and says the only defence is expulsion by majority or keeping the guild full, but once the joiners are the majority no expulsion can pass, so the stated defence does not hold for the case that matters. This is reported as a material trust assumption of the accepted design rather than a coding error: the approved workflow requires open founding and joining, so the fix is a scope decision.

  Options that keep 'anyone can join': admission by guild vote (KIND_INVITE) or founder approval, a minimum membership age (e.g. one epoch) before a member's vote and prize share count, or a voting cap per join epoch. Any of these needs an explicit design change and should be recorded in README either way.

  whole finding

  State: guild 1 = {alice}, treasury 799.5e18 after an earlier harvest and a 300e18 donation. Calls: eve -> join(1); fred -> join(1); eve -> propose(KIND_DISTRIBUTE, 0) (auto yes); fred -> vote(p, true). hasMajority(p) == true because 2*2 > 3 (measured 'majority with 2 of 3 true'). eve -> Realm.distributeTreasury(p): eve receives 266.5e18 and fred 266.5e18 of alice's money (measured 'eve received 266500000000000000000'). alice cannot expel them: a KIND_EXPEL proposal needs 2 yes votes of 3 members and the sybils vote no. Expected by the workflow's intent: a guild's treasury moves only by a decision of the guild that earned it.

  whole reproduction

• lowPassed proposals never expire, so a counterparty can activate a stale pact proposal at a moment of its choosing and pair it with an already-voted attack to slash the proposer's bondsrc/Diplomacy.sol:101

  Guilds.propose stores no deadline and Diplomacy.signPact (line 101) accepts any two unused KIND_PACT proposals that still have a majority among the current members.

  A guild that once voted a pact offer (bond B) that was never signed keeps that offer live indefinitely unless a member flips to no. Later, when that guild publicly votes a KIND_ATTACK on a tile the intended partner holds, the partner can create the mirroring KIND_PACT proposal, call signPact (locking the offering guild's bond B from its treasury), and wait for any member of the offering guild to execute the attack proposal; the declaration is logged after the pact's snapshot, so settlePact slashes B to the partner.

  The offering guild voted for both actions, so this is largely a governance-hygiene risk, but the missing expiry is what makes an old vote usable against its authors months later.

  Fix: store createdAt (already in Proposal) and reject execution in Realm.declareAttack, Realm.distributeTreasury and Diplomacy.signPact when block.timestamp exceeds createdAt plus a bounded validity (for example one season), or let the proposer cancel.

  whole finding

  Epoch 0: guild A (alice) proposes KIND_PACT(partner B, duration 10, ownBond 500e18, partnerBond 0) and funds treasury 500e18; B never matches.

  Epoch 20: A votes KIND_ATTACK on tile T held by B (public).

  B (bob) proposes KIND_PACT(partner A, duration 10, ownBond 0, partnerBond 500e18) and calls signPact(pA, pB): succeeds, lockedBonds(A) == 500e18.

  Alice then calls declareAttack(attackProposal) in epoch 20: attackLog[A][B] gains epoch 20 >= startEpoch 20.

  Epoch 21: anyone calls settlePact: slashBond(A, B, 500e18), treasury(B) += 500e18.

  Expected: a pact offer voted in epoch 0 should not be executable in epoch 20 without a fresh vote.

  whole reproduction

• lowHonour banners are free to farm: two sybil guilds sign a zero-bond one-epoch pact and each mints an honour banner every seasonsrc/Season.sol:180

  Season.claimHonourBanner (line 180) requires only that the guild was founded before the season end, was party to a pact overlapping the season, and betrayed none. Diplomacy._matchTerms accepts ownBond == 0 and partnerBond == 0 and any duration >= 1, and pacts need no tiles or troops.

  Two guilds founded by one person with one wallet each can therefore sign a zero-bond pact every season and mint two honour banners per season with no stake and no game participation, devaluing the trophy that the workflow describes as 'one to any guild that finished a season without breaking a pact'. No funds move, so severity is low.

  Possible fix within the design: require a non-zero bond on at least one side, a minimum pact duration, or that the guild held a tile during the season (tilesAtSeasonEnd > 0) to qualify.

  Season 0: mallory founds guild 1, eve founds guild 2.

  Each proposes KIND_PACT with partner the other, duration 1, ownBond 0, partnerBond 0 (auto majority in a one-member guild). mallory calls signPact(p1, p2) at epoch 0: lockBond(1, 0) and lockBond(2, 0) succeed.

  Warp past epoch 3 (season 0 ended). mallory calls claimHonourBanner(0, 1) and eve calls claimHonourBanner(0, 2): both mint.

  Repeat each season with a new pact.

  Expected: an honour banner should reflect a pact that carried a stake or a guild that took part in the season.

  whole reproduction

• infoThree of the five game contracts are created inside Realm's constructor and are not manifest entries; evidence that they pass the floor's runtime and opcode checkssrc/Realm.sol:157

  Realm creates Diplomacy and Season (line 157-158) and Season creates Banners, so launch.json lists only Guilds and Realm and the protected floor scans only those two runtimes. This is not a defect: the child creation code is embedded in Realm's creation bytecode, so the attestation of Realm's creation-bytecode hash binds them transitively, and the manifest wiring cannot express the mutual trust otherwise.

  For the manifest reviewer: I scanned the compiled runtimes of all six contracts (out/.json deployedBytecode, skipping PUSH immediates) and found no DELEGATECALL, CALLCODE or SELFDESTRUCT; sizes are Realm 12385, Diplomacy 7980, Season 7507, Banners 5295, Guilds 4565, LaunchToken 1753 bytes, all under EIP-170, and Realm's init code is 35358 bytes plus arguments, under the EIP-3860 cap. docs/abi/.json are byte-identical to the compiled ABIs. launch.json is schema-valid (notes 1053 chars, longest constructor argument 19 chars, Guilds precedes Realm) and its constructor arguments match the production parameters in script/Deploy.s.sol and the token name and symbol in LaunchToken.sol.

  The frontend and the publication step must obtain the three child addresses from Realm.diplomacy(), Realm.season() and Season.banners(), which the notes state.

  whole finding

  Not a failing input. Verification: forge build; python scan of out/{Realm,Diplomacy,Season,Banners,Guilds,LaunchToken}.sol/*.json deployedBytecode for opcodes 0xf4, 0xf2, 0xff outside PUSH data returns an empty list for every contract.

Failed on the agent's machine.

Refused by Codex's safety filter

Refused by Codex's safety filter

• mediumsignPact accepts a pact while an attack on the partner from the previous, unsettled epoch is still unresolved; it then captures the partner's tile inside the window without betrayal, and the partner'ssrc/Diplomacy.sol:119

  The R2 fix (AttackInFlight) only refuses signing when the last attack-log entry between the two guilds has the current epoch. declareAttack requires settledEpoch == currentEpoch, but signPact does not, so once a new epoch starts and nobody has settled yet, an attack declared in the previous epoch is still unresolved but its log epoch differs from start, and signing succeeds.

  The attack then resolves at settlement inside the pact window (startEpoch = signing epoch, but the capture is applied to holder[] after the pact exists), takes the partner's tile, and is not a betrayal because its log index is below the signing snapshot logAB. The victim cannot answer: any attack it declares on the taken tile after signing is a betrayal by the victim and slashes its own bond to the attacker.

  The attacker controls the timing: declare in the last block of epoch e, sign in the first block of epoch e+1, before anyone calls settle. The partner's standing passed pact proposal is all that is needed, and passed proposals normally stand for up to a day. This is the same gap R2 closed for the same-epoch case, moved across the epoch boundary; the docstring's claim 'such an attack still resolves inside the pact window, so it must be settled first' is not enforced.

  Minimal fix preserving the refusal design: in signPact revert unless realm.settledEpoch() == start (every earlier epoch, and so every earlier attack, is resolved), or compare the last log entry against realm.settledEpoch() instead of start (revert when lastAttackEpoch >= settledEpoch). Alternatively take the snapshot logAB/logBA as of the last settled epoch so unresolved attacks count as betrayal.

  whole finding

  PactsBase parameters (1h epochs, price 1e18).

  Epoch 0: alice founds guild 1, bob founds guild 2, each buys 20 troops; bob captures tile 5; warp, settle.

  Epoch 1: both fund 50e18; bob's guild passes a pact proposal (partner 1, 10 epochs, 50e18/50e18). alice's guild declares an attack on tile 5 with 8 troops (defender = 2), then passes the mirrored pact proposal.

  Warp into epoch 2 without calling settle (settledEpoch=1 < currentEpoch=2). alice calls diplomacy.signPact(pa, pb).

  Expected: revert AttackInFlight (an unresolved attack on the partner exists), or the capture counts as betrayal by guild 1.

  Actual: signPact succeeds and locks 50e18 from each treasury; realm.settle(100) then sets holder(5)=1; betrayalOf(pactId) returns byA=false, byB=false and isActive(pactId)=true.

  If bob's guild attacks tile 5 back in epoch 2, settlePact after that epoch slashes guild 2's 50e18 bond to guild 1: treasury(1)=100e18, lockedBonds(2)=0.

  Net: guild 1 gains a tile for free and, if the victim responds, its 50e18 bond.

  Proof test: test/scratch/Proof_PriorEpochAttackSign.t.sol fails on this tree with 'a pre-signing attack that resolves inside the pact window must count as betrayal'; it passes if signPact reverts in this state or if the capture is classified as betrayal.

  whole reproduction
  proof · a Foundry test the fix has to pass

  // SPDX-License-Identifier: MIT
  pragma solidity 0.8.26;
  
  import {Test} from "forge-std/Test.sol";
  import {LaunchToken} from "src/LaunchToken.sol";
  import {Guilds} from "src/Guilds.sol";
  import {Realm} from "src/Realm.sol";
  import {Diplomacy} from "src/Diplomacy.sol";
  
  /// @dev A pact can be signed while an attack on the partner, declared in the previous epoch, is
  /// still unresolved because that epoch has not been settled. The attack then resolves inside the
  /// pact window, takes the partner's tile, and is not a betrayal; the partner's retaliation is.
  /// Fails on the current code (signPact succeeds and the capture is not a betrayal); passes once
  /// signPact refuses unresolved attacks between the two guilds or counts them as betrayal.
  contract Proof_PriorEpochAttackSign is Test {
      uint256 constant EPOCH = 1 hours;
      uint256 constant SEASON = 4 hours;
      uint256 constant PRICE = 1e18;
      uint256 constant GENESIS = 1_700_000_000;
  
      address factory = makeAddr("factory");
      address alice = makeAddr("alice");
      address bob = makeAddr("bob");
  
      LaunchToken token;
      Guilds guilds;
      Realm realm;
      Diplomacy diplomacy;
  
      function setUp() public {
          vm.warp(GENESIS);
          vm.startPrank(factory);
          token = new LaunchToken();
          guilds = new Guilds();
          realm = new Realm(address(token), address(guilds), EPOCH, SEASON, PRICE, 1000);
          token.transfer(alice, 1_000e18);
          token.transfer(bob, 1_000e18);
          vm.stopPrank();
          diplomacy = realm.diplomacy();
          vm.prank(alice);
          token.approve(address(realm), type(uint256).max);
          vm.prank(bob);
          token.approve(address(realm), type(uint256).max);
      }
  
      function _attack(address who, uint256 tile, uint256 count) internal {
          vm.startPrank(who);
          uint256 id = guilds.propose(guilds.KIND_ATTACK(), realm.packAttackData(tile, count));
          realm.declareAttack(id);
          vm.stopPrank();
      }
  
      function test_pactSignedOverUnsettledPriorEpochAttack() public {
          // epoch 0: alice founds guild 1, bob founds guild 2 and captures tile 5
          vm.prank(alice);
          uint256 g1 = guilds.found("A");
          vm.prank(bob);
          uint256 g2 = guilds.found("B");
          vm.prank(alice);
          realm.buyTroops(g1, 20);
          vm.prank(bob);
          realm.buyTroops(g2, 20);
          _attack(bob, 5, 5);
          vm.warp(block.timestamp + EPOCH);
          realm.settle(100);
          assertEq(realm.holder(5), g2);
  
          // epoch 1: both guilds fund treasuries; bob's standing pact offer to guild 1 passes
          vm.prank(alice);
          realm.fundTreasury(g1, 50e18);
          vm.prank(bob);
          realm.fundTreasury(g2, 50e18);
          uint8 kindPact = guilds.KIND_PACT();
          bytes32 offerB = diplomacy.packPactData(g1, 10, 50e18, 50e18);
          bytes32 offerA = diplomacy.packPactData(g2, 10, 50e18, 50e18);
          vm.prank(bob);
          uint256 pb = guilds.propose(kindPact, offerB);
          // alice declares an attack on bob's tile 5, then passes the mirrored pact proposal
          _attack(alice, 5, 8);
          vm.prank(alice);
          uint256 pa = guilds.propose(kindPact, offerA);
  
          // epoch 2 begins; epoch 1 is not settled, so alice's attack is still unresolved
          vm.warp(block.timestamp + EPOCH);
          assertLt(realm.settledEpoch(), realm.currentEpoch());
          vm.prank(alice);
          (bool signed,) = address(diplomacy).call(abi.encodeWithSelector(Diplomacy.signPact.selector, pa, pb));
  
          if (!signed) return; // refusing to sign over an unresolved attack is a valid fix
  
          // the pact is signed; epoch 1 now resolves inside the window and takes bob's tile
          uint256 pactId = diplomacy.pactCount() - 1;
          realm.settle(100);
          assertEq(realm.holder(5), g1, "alice captured the partner's tile inside the window");
          (bool byA,,,) = diplomacy.betrayalOf(pactId);
          assertTrue(byA, "a pre-signing attack that resolves inside the pact window must count as betrayal");
      }
  }

  whole proof

• lowPrior finding 16903711 (treasury takeover via join, expel, distributeTreasury): not fixed; author keeps it as the brief's open-membership design and documents it. Recorded as a trust assumption, not asrc/Realm.sol:489

  Re-ran the original reproduction on this tree: it still succeeds unchanged (5 transactions, newcomers receive all 300e18 alice deposited). The author's answer (REVIEW.md R4, README 'Assumptions and known limitations') is that open join, one vote per member from joining and majority expulsion are required by the brief, so k+1 fresh wallets holding the majority is the brief's design, and a voting age would change 'one vote per member'.

  Assessment: the argument holds in substance. Without distributeTreasury a captured guild's funds would still be controllable by the takeover majority (spent on troops, locked as bonds with an accomplice guild and slashed to it), and there would be no route at all for tile income to reach players other than the 10% fee prize. The residual is disclosed in README in plain terms, including the 1-of-1 majority of the first joiner of a memberless guild.

  A tenure requirement for KIND_DISTRIBUTE and KIND_EXPEL votes would reduce it but is a design decision beyond the brief; leaving it to the judge as a scope decision rather than a code defect.

  whole finding

  Same as before, verified on this tree (test/scratch/Recheck.t.sol test_F4_takeoverDistributeStillPossible): alice founds guild 1 and fundTreasury(1, 300e18); carol and dave join; carol proposes KIND_EXPEL(alice), dave votes yes, carol executeExpel; carol proposes KIND_DISTRIBUTE, dave votes yes, carol calls realm.distributeTreasury(proposal).

  Result: carol+dave balances rise by exactly 300e18; alice gets 0.

  Expected under the disclosed design: this is possible; the README now states it.

• infoPrior finding e565eaa2 (post-season joiners share or take the prize): fixedsrc/Season.sol:148

  _finalize now calls _eligibleMembers, which keeps only members with guilds.joinedAt(guild, member) < realm.seasonEndTime(season); joinedAt is set on every join and reset on rejoin. Re-ran the original reproduction: carol and dave join guild 1 after season 0 ended and before close; claimable(0,carol)=claimable(0,dave)=0. Without the expel step alice receives the full 50.5e18.

  Residual (not a new finding, inherent in the brief's majority expel): if the post-season joiners also expel alice before close, nobody in guild 1 is eligible, the whole 101e18 pool rolls to season 1 and alice loses her 50.5e18; the joiners gain nothing directly. The same denial is possible during the season by the same rule, so it is the disclosed open-membership assumption, not a gap in this fix.

  test/scratch/Recheck.t.sol test_F1_noExpel and test_F1_postSeasonJoinersGetNothing: 4-epoch season, alice's guild holds tile 0, bob's guild buys 1000 troops (pool 101e18); warp and settle 4 epochs; carol (and dave) join guild 1; season.close(0,100). claimable(0,alice)=50.5e18 and claimable(0,carol)=0 without expel; with expel, all claimable are 0 and prizePool(1)=101e18.

• infoPrior finding 69c0490c (lone member spends the treasury on troops): fixedsrc/Realm.sol:215

  buyTroopsFromTreasury now takes a proposal id and goes through _consumeProposal(KIND_BUY_TROOPS), which checks kind, unused, membership, isLive and hasMajority, then marks the proposal used. A joiner alone can no longer move the treasury; front-running signPact to starve lockBond now needs a majority.

  test/scratch/Recheck.t.sol test_F2_loneMemberCannotBuyFromTreasury: alice founds guild 1 and funds 100e18; carol joins (2 members); carol proposes KIND_BUY_TROOPS(100) and calls realm.buyTroopsFromTreasury(pid) with only her own yes vote. Result: revert NoMajority; treasury(1) stays 100e18.

• infoPrior finding a64c1aab (stale attack proposal fired at a later pact partner): fixedsrc/Realm.sol:310

  Three layers now bind an attack vote to its state: the payload carries the expected defender (packAttackData binds holder[tile] at proposal time; declareAttack reverts WrongDefender when holder[tile] differs), proposals expire one day after creation (Guilds.isLive checked by every executor), and a proposal older than the active pact's signedAt reverts ProposalPredatesPact. Re-ran the original sequence and the variant where the vote already named the partner as defender.

  test/scratch/Recheck.t.sol test_F3_staleAttackCannotBetray and test_F3_proposalPredatesPact: (a) vote to attack unheld tile 7, carol's guild captures it, pact signed between the two guilds, bob calls declareAttack(stale): revert WrongDefender; a proposal packed against guild 2 becomes ProposalExpired after 1 day. (b) vote to attack tile 7 held by guild 2, then sign a pact with guild 2 one second later, bob calls declareAttack: revert ProposalPredatesPact.

• infoPrior finding 7bb8c07e (zero-bond pacts farm honour banners): fixed as far as the brief allowssrc/Diplomacy.sol:271

  _matchTerms now requires each bond to be at least realm.troopPrice() (BondTooSmall). A pact now always has a stake that betrayal forfeits. Residual documented in README: a player running two guilds can still lock 1 PACT per side for one epoch each season to mint two honour banners; the banner has no token value.

  test/scratch/Recheck.t.sol test_F5_zeroBondRejected: alice and bob found guilds 1 and 2, each proposes packPactData(partner, 1, 0, 0), alice calls signPact: revert BondTooSmall.

• infoCoverage of the Economic Security, Invariant and Flow Gap passes on this revisionsrc/Realm.sol:369

  Covered: income accumulator and carry (_distribute/_harvest/_setTiles: perTile floors, remainder carried, rewardDebt reset after harvest, exact because acc is a multiple of 1e18); troop conservation in _tally/_applyAttacks/_loss (loss strictly below force, survivors returned or garrisoned); bond conservation across lockBond/releaseBond/slashBond and settlePact's single-settlement guard; Season pool accounting (fees transferred before recordFee, 50/30/20 shares floor per member, unassigned shares roll over, claimable cleared before transfer, claimRank lets zero-prize winners mint); season checkpoints (tilesAtSeasonEnd binary search returns the last checkpoint at or before the season, stable once the last epoch is settled, close requires that settlement and closes in order); proposal lifetime and majority recount among current members; guild takeover economics; pact timing seams between declareAttack, settle and signPact (the medium finding above).

  Not reached: gas of Season.close with hundreds of guilds beyond the author's chunking test, and the frontend.

  Static-analysis leads checked: the divide-before-multiply lines are the intended floor-then-carry pattern; the uninitialized-state and strict-equality lines are false positives (mapping of arrays, epoch/index comparisons); the reentrancy lines involve only the fixed launch ERC-20 and Banners._mint with no callbacks; the unsafe-casting lines in Banners are bounded by season, guild and rank ranges.

  whole finding

  Not a defect. The full suite passes on this tree (forge test: 129 passed) and the scratch rechecks in test/scratch/Recheck.t.sol pass as described in the entries above.

Refused by Codex's safety filter

• mediumsignPact accepts a pact while an attack on the partner from the previous, unsettled epoch is still unresolved; the attacker takes the partner's tile inside the window without betrayal and the partner'src/Diplomacy.sol:119

  The round-2 fix for the in-flight attack (AttackInFlight) only refuses signing when the last attack-log entry between the two guilds carries the current epoch (Diplomacy.sol line 119, _lastAttackEpochIs compared against start = realm.currentEpoch()). Realm.declareAttack requires settledEpoch == currentEpoch, but signPact does not, and Realm resolves attacks only when someone calls settle.

  So an attack declared in the last block of epoch e is still unresolved in the first block of epoch e+1, its log entry (epoch e) differs from start (e+1), and signPact succeeds. The snapshot logAB then excludes that entry, the capture is applied at the next settle while the pact is active, and _firstAttack never reports it.

  The victim cannot answer: any attack it declares on the taken tile after signing is its own betrayal, and settlePact slashes the victim's bond to the attacker. The attacker controls the timing entirely (declare late in epoch e, sign early in epoch e+1 before anyone settles; the partner's passed pact proposal stays live for a day).

  This is the same root cause as my round-1 finding 349911bd (signing snapshot hides an unresolved attack), moved across the epoch boundary; the docstring at Diplomacy.sol lines 105-106 ('such an attack still resolves inside the pact window, so it must be settled first') and README's 'the pact can only be signed once the epoch has ended' are not what the code enforces, because resolution happens at settlement, not at the epoch end.

  Reported by audit_economics 6f1ed049; reproduced with its proof and with an extended scratch test that carries the scenario through to the slash. Minimal fix preserving the refusal design: in signPact require realm.settledEpoch() == start (revert otherwise, e.g. EpochNotSettled), so every earlier attack is resolved before the snapshot is taken and the existing same-epoch check covers the rest; anyone can call settle first in the same transaction, so nothing is blocked.

  Alternatively revert when the last log entry's epoch >= realm.settledEpoch().

  whole finding

  Fixture: LaunchToken, Guilds, Realm(token, guilds, 3600, 14400, 1e18, 1000); alice founds guild 1, bob founds guild 2, each buys 20 troops.

  Epoch 0: bob attacks tile 5 with 5; warp one epoch, settle(100): holder(5) == 2.

  Epoch 1: both fundTreasury 50e18; bob proposes KIND_PACT packPactData(1, 10, 50e18, 50e18); alice proposes and declares KIND_ATTACK packAttackData(5, 8) (defender 2, log entry epoch 1), then proposes the mirrored pact.

  Warp one epoch without settling: settledEpoch == 1, currentEpoch == 2. alice calls diplomacy.signPact(pa, pb).

  Actual (measured, test/scratch/Proof_6f1ed049433f.t.sol and Recheck.t.sol test_New_priorEpochAttackFullConsequence): signPact succeeds, lockedBonds(1) == lockedBonds(2) == 50e18; settle(100) sets holder(5) == 1; betrayalOf(pactId) returns byA == false, byB == false and isActive == true. bob attacks tile 5 with 4 in epoch 2; after one more epoch and settle, settlePact(pactId) gives brokenBy == 2, lockedBonds(2) == 0 and treasury(1) == 100e18 (own bond back plus the victim's 50e18).

  Expected: signPact reverts AttackInFlight while an unresolved attack between the two guilds exists, or the capture counts as byA.

  The attached proof fails on this tree with 'a pre-signing attack that resolves inside the pact window must count as betrayal' and passes with either fix.

  whole reproduction
  proof · a Foundry test the fix has to pass

  // SPDX-License-Identifier: MIT
  pragma solidity 0.8.26;
  
  import {Test} from "forge-std/Test.sol";
  import {LaunchToken} from "src/LaunchToken.sol";
  import {Guilds} from "src/Guilds.sol";
  import {Realm} from "src/Realm.sol";
  import {Diplomacy} from "src/Diplomacy.sol";
  
  /// @dev A pact can be signed while an attack on the partner, declared in the previous epoch, is
  /// still unresolved because that epoch has not been settled. The attack then resolves inside the
  /// pact window, takes the partner's tile, and is not a betrayal; the partner's retaliation is.
  /// Fails on the current code (signPact succeeds and the capture is not a betrayal); passes once
  /// signPact refuses unresolved attacks between the two guilds or counts them as betrayal.
  contract Proof_PriorEpochAttackSign is Test {
      uint256 constant EPOCH = 1 hours;
      uint256 constant SEASON = 4 hours;
      uint256 constant PRICE = 1e18;
      uint256 constant GENESIS = 1_700_000_000;
  
      address factory = makeAddr("factory");
      address alice = makeAddr("alice");
      address bob = makeAddr("bob");
  
      LaunchToken token;
      Guilds guilds;
      Realm realm;
      Diplomacy diplomacy;
  
      function setUp() public {
          vm.warp(GENESIS);
          vm.startPrank(factory);
          token = new LaunchToken();
          guilds = new Guilds();
          realm = new Realm(address(token), address(guilds), EPOCH, SEASON, PRICE, 1000);
          token.transfer(alice, 1_000e18);
          token.transfer(bob, 1_000e18);
          vm.stopPrank();
          diplomacy = realm.diplomacy();
          vm.prank(alice);
          token.approve(address(realm), type(uint256).max);
          vm.prank(bob);
          token.approve(address(realm), type(uint256).max);
      }
  
      function _attack(address who, uint256 tile, uint256 count) internal {
          vm.startPrank(who);
          uint256 id = guilds.propose(guilds.KIND_ATTACK(), realm.packAttackData(tile, count));
          realm.declareAttack(id);
          vm.stopPrank();
      }
  
      function test_pactSignedOverUnsettledPriorEpochAttack() public {
          // epoch 0: alice founds guild 1, bob founds guild 2 and captures tile 5
          vm.prank(alice);
          uint256 g1 = guilds.found("A");
          vm.prank(bob);
          uint256 g2 = guilds.found("B");
          vm.prank(alice);
          realm.buyTroops(g1, 20);
          vm.prank(bob);
          realm.buyTroops(g2, 20);
          _attack(bob, 5, 5);
          vm.warp(block.timestamp + EPOCH);
          realm.settle(100);
          assertEq(realm.holder(5), g2);
  
          // epoch 1: both guilds fund treasuries; bob's standing pact offer to guild 1 passes
          vm.prank(alice);
          realm.fundTreasury(g1, 50e18);
          vm.prank(bob);
          realm.fundTreasury(g2, 50e18);
          uint8 kindPact = guilds.KIND_PACT();
          bytes32 offerB = diplomacy.packPactData(g1, 10, 50e18, 50e18);
          bytes32 offerA = diplomacy.packPactData(g2, 10, 50e18, 50e18);
          vm.prank(bob);
          uint256 pb = guilds.propose(kindPact, offerB);
          // alice declares an attack on bob's tile 5, then passes the mirrored pact proposal
          _attack(alice, 5, 8);
          vm.prank(alice);
          uint256 pa = guilds.propose(kindPact, offerA);
  
          // epoch 2 begins; epoch 1 is not settled, so alice's attack is still unresolved
          vm.warp(block.timestamp + EPOCH);
          assertLt(realm.settledEpoch(), realm.currentEpoch());
          vm.prank(alice);
          (bool signed,) = address(diplomacy).call(abi.encodeWithSelector(Diplomacy.signPact.selector, pa, pb));
  
          if (!signed) return; // refusing to sign over an unresolved attack is a valid fix
  
          // the pact is signed; epoch 1 now resolves inside the window and takes bob's tile
          uint256 pactId = diplomacy.pactCount() - 1;
          realm.settle(100);
          assertEq(realm.holder(5), g1, "alice captured the partner's tile inside the window");
          (bool byA,,,) = diplomacy.betrayalOf(pactId);
          assertTrue(byA, "a pre-signing attack that resolves inside the pact window must count as betrayal");
      }
  }

  whole proof

• infoRound-1 findings settled: all eight fixes confirmed against the revised code; open-membership majority takeover remains a documented trust assumptionsrc/Realm.sol:215

  Each round-1 finding was re-run on this tree. (1) a62b2333 lone member spends treasury: fixed; buyTroopsFromTreasury(proposalId) goes through _consumeProposal(KIND_BUY_TROOPS). (2) 349911bd same-epoch attack hidden by the signing snapshot: fixed for the same-epoch case by AttackInFlight; the cross-epoch variant is the medium finding above.

  (3) 6cf74d92 stale attack proposal fired at a later pact partner: fixed by PROPOSAL_LIFETIME/isLive, defender bound in the attack payload (WrongDefender) and ProposalPredatesPact via Pact.signedAt. (4) ad886ecf post-season joiners dilute the prize: fixed; _finalize uses _eligibleMembers with joinedAt < seasonEndTime.

  The treasury-takeover variant (k+1 fresh wallets expel the founders and distribute) still executes as described and is left by the author as the brief's open-membership design, now stated plainly in README including the 1-of-1 majority of a memberless guild's first joiner; I accept that as a trust assumption needing a scope decision, not a code defect. (5) 16f8539c lone member reinforces the whole pool: fixed; reinforce(proposalId) requires KIND_REINFORCE majority.

  (6) 2560c5ff zero-bond honour pacts: mitigated; _matchTerms requires each bond >= troopPrice (BondTooSmall); the minimum-bond two-guild residual is documented. (7) 0b455eea honour banner to post-season joiner: fixed; claimHonourBanner checks joinedAt < seasonEndTime (JoinedAfterSeason). (8) 7bdde2fa README example name key: fixed; README has no name keys and launch.json is unchanged and schema-valid.

  ABI exports under docs/abi match the current build output for all six contracts.

  Full suite: 135 project and scratch tests pass; the only failure is the new medium's proof. The audit_flow, audit_math and audit_permissions areas reported nothing this round; the static-analysis lines (uninitialized mapping of arrays, floor-then-carry divisions, epoch/index strict equalities, reentrancy through the fixed launch ERC-20 and Banners._mint without receiver callbacks, bounded casts in Banners) were checked and do not reproduce as defects.

  whole finding

  Proofs Proof_a62b233349c6, Proof_349911bd535c, Proof_6cf74d92207c and Proof_ad886ecfd5ce copied to test/scratch/ and run with forge test --match-path: all four pass on this tree (they failed on the previous tree with the messages recorded in round 1).

  Scratch Recheck.t.sol: test_R1_treasuryNeedsVote (erin joins guild 1 with 100e18 treasury, proposes KIND_BUY_TROOPS(100) alone, buyTroopsFromTreasury reverts NoMajority, treasury stays 100e18); test_R5_reinforceNeedsVote (erin joins, proposes KIND_REINFORCE(tile 0, 90) alone, reinforce reverts NoMajority, troops(1) stays 90); test_R6_zeroBondRefused (mirrored 0/0 pact proposals, signPact reverts BondTooSmall); test_R7_honourBannerLateJoiner (1-epoch pact in season 0, erin joins after the season end, claimHonourBanner reverts JoinedAfterSeason, alice then mints and owns the banner).

  All pass.

  Not a defect.

  whole reproduction