Review complete. The findings are in .imd-findings.json at the repository root (valid JSON, every path, line and snippet verified against the tree). No source file was changed; the only writes are the findings file and one scratch test under test/scratch/, both git-ignored.

Verdict. The hook is in good shape for an immutable, zero-fee launch hook. The one launch-blocking item is in the manifest, not the Solidity. No critical or high defects, so no proof files are attached.

Findings written

• Medium, launch.json line 9. The hook's fourth constructor parameter is declared address quote_, and the manifest writes it as a hand-typed zero address to mean native ETH. The manifest rules refuse stand-in addresses outside Currency-typed fields, and there is no $pairedCurrency placeholder, so this manifest cannot pass. Suggested fix keeps the ABI and vectors intact: declare the parameter as Currency (same ABI type), or drop it and bind the quote from the PoolKey in _validateInitialization.
• Low, launch.json line 30. No pool.initialPrice; the free-text openingPrice and the top-level economics object are non-schema keys and are silently dropped, so the owner's 90% seeding decision reaches nobody. Notes still point at a contracts/ prefix that does not exist at this commit.
• Low, PulseTreasury line 159. When no liquidity is reachable within the 1% price limit, pulse() succeeds with a zero-fill swap. The hook then files it as a 0-wei sell (heat 5→4, pressure −1000) and the 15-minute window is consumed. Reproduced with a scratch test on this tree. Fix: revert when nothing was bought.
• Info, README line 31. README says 45-minute pulse idle (code: 15 minutes), calls the token "SEQ" (symbol is IDM), and cites 127 tests (207 run).
• Info, coverage statement. Lists what was read, what was verified, and what could not be reached.

What was checked and found sound. All five contracts in src/ plus the hook, treasury and token tests, the protected floor tests, and the pinned v4-core initialize and afterSwap paths. Callback gating, factory-only single-pool binding, flags 0x3040 versus permissions and manifest, no return deltas or fund handling, no liquidity callbacks blocking the factory's fee collect, afterSwap gas under budget, SPEC section 3 clause-by-clause conformance including the Euclid and dropSeed tables, slot 0/1 layout, whale-threshold orientation and saturation, and the token's fixed supply with no admin path. forge build and forge test pass on this tree.

Not reached. The live LaunchFactory and PoolManager on Robinhood Chain 4663 (no fork rehearsal), the IMD manifest validator itself (rules taken from the assignment text), the TypeScript port that SPEC requires to match bit for bit (not in this repository), and scripts/validate-vectors.py was not run.

The adaptation is complete and verified: forge build passes, the delivered suite runs 208 tests with 0 failures under the verifier's fuzz seed, the vector validator passes on unchanged vectors, and the formatter reports the tree clean.

What changed, and why

• Hook constructor in src/SequencerHook.sol. The audit's medium finding reproduces: the fourth argument was a hand-written zero address for native ETH, which the manifest check refuses. The quote is no longer an argument. The hook binds it from the PoolKey the factory opens in afterInitialize, native ETH for this launch, and an ERC20 on either side still works. The manifest now writes six values: $poolManager, $token, $factory and the three thresholds. Packed state words stay in slots 0 and 1, SPEC section 3, events and vectors are untouched.
• Treasury zero-fill in src/PulseTreasury.sol. The low finding reproduced on the unmodified tree: a pulse with no reachable liquidity returned (0, 0) and the hook filed it as a 0-wei sell, cooling heat and burning the idle window. It now reverts NoFill and leaves the state untouched, with a test.
• Reference manifest. The committed launch.json lacked pool.initialPrice, carried non-schema keys and the zero-address argument. Since launch.json belongs to the manifest step and a broken one in the tree rejects the work, it is renamed to launch.reference.json with corrected content.
• Docs. README pulse idle 45 min corrected to 15 min, token SEQ corrected to IDM, stale counts updated, non-existent contracts/ and bin/ instructions removed, and an IMD launch section added. SPEC section 9's opening sentence fixed, section 3 untouched. Launch notes and the Sepolia script comment updated.
• Tests. Six hook suites updated for the new signature. A new binding test replaces the one whose premise was a constructor-given quote. The constructor-rejection and fresh-hook tests now cover pre-init state, the binding and a second initialization.

What was not changed

The coverage finding is informational only. The token already meets the launch token rules. The hook has no owner, so no $owner argument was needed.

Deployment and addresses

The brief asks for verified deployed hook, token and pool addresses and launch receipts. Per the launch rules, IMD's deployer launches through the factory after this work is accepted, so no transaction was broadcast and no address was invented. The deployed addresses will come with the launch itself.

Files touched: src/SequencerHook.sol, src/PulseTreasury.sol, test/SequencerHook.t.sol, test/PulseTreasury.t.sol, script/DeploySepolia.s.sol, README.md, SPEC.md (section 9 only), IMD_LAUNCH_NOTES.md, launch.json renamed to launch.reference.json, and the new ADAPTATION.md listing each change against its rule or finding.

Created launch.json with matching constructor arguments, permissions, and required IDM/ETH pool settings. Only the manifest changed.

forge build succeeded; all 208 tests passed with the supplied fuzz seed. Both vector sets validated.

Verified Robinhood deployment addresses and receipts remain pending, explicitly documented in the manifest.

I found no access-control defect in the hook, the token or the treasury, and one low-severity issue in the treasury. The results are in .imd-findings.json: 1 finding and 11 coverage rows, covering all 9 entry points plus 2 checks I added. No repository files were changed, and the full test suite passes (208 tests, 0 failures).

Finding 1 (low): the treasury can strand a small amount of ETH for good. src/PulseTreasury.sol:125

• Cause: anyone can send ETH to the treasury through receive(), but the only way ETH leaves is pulse(). Each pulse is capped at 1% of the balance and set to zero if that is below MIN_PULSE (0.000025 ETH).
• Failing state: with a balance of 0.00249 ETH, the cap is 2.49e13 wei, below 2.5e13. So pulse() reverts NoBudget() on every call, and since the contract has no owner and no withdraw function, nothing can move the ETH.
• Why it matters: in silence each pulse spends 1% of the balance, so the balance always shrinks toward this floor. Once fees stop arriving, up to about 0.0025 ETH stays locked. I gave it no Foundry proof because only critical and high findings need one.

What holds, and why:

• Hook (SequencerHook):
  • Every enabled callback accepts calls only from the PoolManager.
  • Both initialize callbacks accept only the launch factory, only once, and only the sorted IDM/ETH pair at fee 12500 and tick spacing 60. They repeat the same checks, so neither is a weaker path.
  • The address flags (0x3040) match the reference manifest's permissions.
  • There is no owner, setter, return delta or fund handling.
  • The remove-liquidity callbacks are never called, so the factory's fee collection isn't blocked.
• Token (SequencerToken): no privileged roles. The supply is fixed at 1e27, minted once to the deployer, and allowances are handled the standard way.
• Treasury pulse(): anyone may call it, but it needs 15 minutes without a swap. Every swap resets the hook's last-swap time, so nobody can move the price and then trigger a pulse in the same transaction or block. That makes the 2% price limit, which is computed from the current price, safe as documented.
• Treasury unlockCallback: it needs both the PoolManager as caller and a temporary flag that only pulse() sets.
• Treasury burn(): it sends only the treasury's own IDM to 0x…dEaD.
• Treasury's state read: it reads the hook's packed state words with the same layout encode() writes.

Static-analysis leads I set aside:

• Slither, strict equalities: these are == 0 guards that just revert, so they can't be exploited.
• Slither, uninitialized locals: these are meant to start at zero.
• Slither, ignored return values: these are deliberate.
• Aderyn, reentrancy: no external call can re-enter.
• Aderyn, "locks ether": this is the same issue as Finding 1.

Not covered: the launch factory's own code. The treasury depends on the payer calling setRequester to point fees at it, and payouts the factory keeps as owed can't be withdrawn by the treasury. Both are trust assumptions written in TREASURY-RUNBOOK.md. I couldn't check them because the factory's source isn't verified on the explorer.

The review is complete and the findings file is written and validated.

Outcome. The hook and token hold up under the Execution Trace, Periphery and First Principles checks. Both contracts are manager-gated, factory-bound, single-pool, with no owner, fee, return delta or fund path. The project's own 208 tests and both vector suites pass on this tree. I found one low-severity defect and no critical or high issues, so no proof file was attached.

The finding is in src/SequencerHook.sol at the direction/size derivation in afterSwap. A swap that moves no funds is still written into the composition as a sell. On the launch pool, seeded single-sided with IDM below the opening tick, anyone can submit a sell into the empty side: v4 returns a (0, 0) delta, the caller pays nothing, yet the hook increments swapCount, pushes pressure to -1000, resets lastTs, and the pool price is left parked at the caller's limit. Two concrete consequences, both reproduced in a scratch test that passes on this tree:

• The treasury's pulse computes its price limit as 99% of the parked spot price, which sits above all liquidity, so after the idle window reopens pulse() reverts NoFill until a real buyer moves the price back. The free sell also resets lastTs, closing the window again.
• A 1-wei exact-input buy with liquidity present is fully swallowed by the rounded-up LP fee and is filed as a sell, although the caller swapped in the buy direction.

No funds are at risk, and the treasury spends nothing, so I rated it low. The suggested fix is a SPEC-level decision for the requester: skip the write when both delta components are zero, consider the input side when classifying direction, and derive the pulse limit from the nearest initialized tick rather than spot alone.

Coverage. All nine listed entry points have rows: seven hold, two reference the finding (afterSwap and pulse). Three additional rows record the beforeInitialize invariant, the SequencerState library, and the manifest shape in launch.reference.json, which matches the six-argument constructor and the 0x3040 permission set. There is no launch.json in the tree yet, which is expected before the manifest step. Nothing outside .imd-findings.json and test/scratch/ was written.

The review is complete. No tracked file changed; the findings file and the scratch test are in place and ignored by git.

Outcome. The math in SequencerState, SequencerHook, QuoteCalibration and PulseTreasury holds against SPEC §3 and the three guides: the packed-word codec, the whale threshold product and clamps, the EMA, bpm and pressure bounds, the ladder and scan in accumulate, the Euclid and drop-seed tables, and the treasury's exp2/log2 inverse and price-limit arithmetic all check out with concrete values. The existing 208 tests pass. I found no fund-loss or blocking defect, so no finding carries a proof file.

Findings written to .imd-findings.json (two low, two informational, all reproduced on a real PoolManager in test/scratch/EmaDrift.t.sol):

• Low: treasury pulses erode the EMA they are sized from. Each pulse is sized 24 units under the size EMA and then enters that EMA, which only moves down in silence. After 52 pulses (13 hours of silence) the EMA sits at the 710 floor, the next pulse files as glitch rather than the documented hat, and the first 0.0125 ETH trade files as kick.
• Low: dust sells drag the EMA to the floor cheaply. A 1-wei IDM sell yields 0 ETH, so its size is clamped to the floor before the EMA update. 27 such sells cost 27 wei of IDM plus gas and pin the EMA at 710, after which any buy of about 0.00007 ETH or more is a kick.
• Info: one-sided EMA rounding. The spec's floor formula falls for any input below the EMA but rises only for inputs 8 or more units above it. This is the mechanism behind the two findings above and is spec-mandated.
• Info: a 1-wei ETH exact-input buy is filed as a sell, because v4 floors its output to 0 IDM. Consistent with the spec's definition and equivalent in effect to a dust sell.

Coverage. All nine listed entry points have a row: seven hold, pulse() and afterSwap point to the findings above. Extra rows record the transition bounds, the accumulate ladder, the calibration constants and the reference manifest as holding. One row is marked unreached: an ERC20 quote on currency1 with non-18 decimals, which is outside the launch configuration.

Review complete. The findings file is written at .imd-findings.json with 3 findings, 15 coverage rows, and one proof test.

What I found

• Medium, PulseTreasury.pulse(): the price limit is 1% below the pool's current sqrtPrice, but in v4 the current price can sit far from any liquidity. A sell larger than the ETH side runs the price through empty ticks to the swapper's limit at no cost, which leaves the pool at tick 887271. From there the pulse swap buys nothing and reverts NoFill, while nextPulse() still reports ready. The treasury's only function is unavailable exactly during silence, until an unrelated buy re-anchors the price. Reproduced with the real PoolManager in the launch shape (IDM-only seed at FDV 10 ETH). Proof test attached. Suggested fix: use MIN_SQRT_PRICE + 1 as the limit since spend is already capped, or clamp the limit to the nearest initialized tick.
• Low, SequencerHook.afterSwap: the whale threshold is read at the post-swap tick. The same parked-price sell makes the threshold collapse to 0.005 ETH, so a sell that extracted 0.0197 ETH is filed as a whale (track wipe, root change, Movement) although the pool's real FDV puts the threshold at 0.0635 ETH. No funds at stake. Any fix touches the SPEC §3 transition the task says to preserve, so I flagged it as a design decision.
• Info, PulseTreasury.burn(): permissionless burn means the runbook's "burn or hold" question is already decided by the code.

What held in my area: pulse spend bounds and settle accounting, reentry guards on the unlock callback, the hook's no-fund and zero-delta invariants, one-pool binding at fee 12500, token supply conservation, sandwich economics of the pulse, and the reference manifest's constructor order and permissions. All 9 verifier entry points have a row. The existing 208 tests pass unchanged.

Not reached: the LaunchFactory claimFees and setRequester seam, since the factory source is not in the tree.

Added failure-path, fuzz, launch integration, and token/treasury invariant tests under test/.

Validation passed: 230 tests, 49,152 randomized handler calls with the required seed, and all 684 vectors. Production files remain unchanged.

No new defect reproduced. Robinhood deployment addresses and receipts remain unverified; the tree contains launch.reference.json, not launch.json.

I've finished the review and written it to .imd-findings.json: five findings, none critical or high. I ran each one against the code in scratch Foundry tests. The repo's own suite passes, and I changed no project files (I deleted the scratch directory afterwards).

Kept findings, most severe first:

1. Medium: the treasury's pulse can be blocked for the cost of gas (src/PulseTreasury.sol:147). pulse() caps the price at 99% of the pool's current price. On the launch pool all liquidity is IDM below the opening price. So any IDM sell set to run to the maximum price moves the price to the top of the range without trading anything. After that, every pulse() reverts with NoFill(), while nextPulse() still says it is ready. This lasts until some real buyer brings the price back down. No funds are lost, but the "after 15 minutes of silence anyone can pulse" guarantee is broken. This merges two specialists' reports. The attached proof test fails today with NoFill(). The fix is outside SPEC section 3.
2. Low: the whale check uses the price after the swap, even when that price has run past all liquidity (src/SequencerHook.sol:172). A sell that empties the ETH side leaves the price at tick 887271, where the threshold drops to its 0.005 ETH minimum. A sell of 0.01975 ETH was then treated as a whale: a new pattern ID, a wiped track and a Movement event. Two specialists' reports merged.
3. Low: swaps that move nothing, or 1 wei, are still recorded as sells (src/SequencerHook.sol:170). A swap with zero amounts on both sides changed swapCount, pressure and lastTs. That pushes back the next pulse by 15 minutes. About 27 such swaps also pull the size average down to its 710 floor. Three specialist reports merged.
4. Low: pulses lower the size average they are based on (src/PulseTreasury.sol:122). Fifty-two pulses in a row, about 13 hours of silence, take it from 854 to 710. From then on a pulse no longer plays as the "quietest voice" (hat) the code's comment describes.
5. Low: up to 0.0025 ETH gets stuck in the treasury (src/PulseTreasury.sol:125). Below that balance the 1% spending cap is less than the smallest allowed pulse, so pulse() reverts and nothing can withdraw the ETH. The amount is dust.

Findings 2 and 3 follow SPEC section 3 to the letter, and you've asked for that section to stay exactly as it is. Fixing them is your call, and would mean changing the spec and regenerating the test vectors.

Dropped: the specialists' notes that burn() can be called by anyone (that matches the no-owner design) and that the averages round downward (the spec requires it and it does no harm).

Coverage: every listed entry point has a row, plus launch.json and the "hook moves no funds" check. In launch.json the six hook constructor arguments and the three permissions match the code, the 12500 fee is accepted, and the notes are 2,177 characters. Nothing stops the factory from deploying it: the hook is 9,484 bytes, with nothing to set up after deployment. There are no deployed Robinhood Chain addresses or launch receipts yet; the deployment step still has to produce them.

The harness's own .git/info/exclude keeps .imd-responses.json out of the tree, so it is collected by the harness rather than committed. The work is complete.

Outcome. The reopened medium finding reproduced and is fixed. The reviewer's proof now passes, the full suite passes with the verifier's fuzz seed, and the vectors still validate.

Check	Result
Proof_a3a45cc2990a.t.sol (copied to test/scratch)	failed on the starting tree, passes now
forge build	clean
forge test with the verifier's fuzz seed	214 passed, 0 failed (224 with scratch)
scripts/validate-vectors.py	130 v1 + 554 v2 cases valid

The fix is in src/PulseTreasury.sol and keeps SPEC section 9's 1.99% price rule. It changes only what the limit is measured from. A new view, priceAnchor(), returns the pool price when the pool has active liquidity, so every ordinary pulse is unchanged. When a free sell has parked the price above every position, it walks the tick bitmap to the nearest initialized tick at or below the current tick, which is the top of the liquidity the pulse will reach, and the limit applies from there. If no such tick exists, nextPulse() reports not ready and pulse() reverts NoFill before swapping, so the hook never records the empty swap. I did not take the reviewer's open-limit alternative because the price cap is what keeps a sandwich of a pulse unprofitable against the pool fee, per SPEC section 9.

Tests added in test/PulseTreasury.t.sol cover the proof's scenario, a partial fill stopped exactly 1% under the anchor, view-and-call agreement across park, empty pool and far-below liquidity, dust liquidity, and gas. One existing test asserted ready == true on an empty pool, which the finding asked to change, and now asserts the opposite.

Advisory findings, all reproduced in scratch tests and answered in .imd-responses.json:

• Whale at parked tick and zero-delta sells: disputed. Both follow SPEC section 3.3 literally, which this task must preserve with its vectors. Recorded for the requester in ADAPTATION.md.
• Pulses drag the EMA: disputed. SPEC section 9 states this side effect itself, with the same figures I measured.
• Dust under 0.0025 ETH stranded: documented in SPEC section 9, README and runbook, the reviewer's own option. No code change.

Docs updated: ADAPTATION.md section 5 and an advisory section, SPEC section 9's limit bullet and gas figures, README, TREASURY-RUNBOOK.md. One residual is stated there: a parked price plus a dust position spanning it still yields NoFill, which needs a position rather than a swap.

I left launch.json as it was: I checked it against the current source and found nothing to change. No findings came with this revision. forge build passes, and forge test with the verifier's fuzz seed passes all 214 tests in 11 suites.

What I checked against the source:

• Contracts: the hook is SequencerHook and the token is SequencerToken, named "Intelligent Dance Market" with symbol "IDM". The token's constructor takes no arguments.
• Hook constructor arguments, in order: "$poolManager", "$token", "$factory", then three thresholds. The thresholds are 1250000000000000, 12500000000000000 and 62500000000000000 wei (0.00125, 0.0125 and 0.0625 ETH), matching QuoteCalibration. The constructor reverts if any of them is zero or out of order. The hook has no owner argument, so there is no $owner.
• Permissions: getHookPermissions returns beforeInitialize, afterInitialize and afterSwap, and the manifest lists the same three. Both initialization callbacks accept only the factory, fee 12500 and tick spacing 60, so the hook accepts the listed fee.
• Pool: paired currency is native ETH (the zero address), fee 12500, tick spacing 60, initial price 79228162514264337593543950336.
• Schema: the first field is "kind": "univ4_hook", and the notes are 2,177 characters, under the 4,000 cap.

Not delivered: the brief asks for deployed hook, token and pool addresses and launch receipts on Robinhood Chain (4663). None exist in the project, and no transaction was sent. The project's Sepolia deployment records don't count as evidence for chain 4663. The notes say this, and the addresses and receipts will come from the launch service's deployment step.

The commit since my last round (868c91b) changed only PulseTreasury, its tests and docs. That contract is not deployed by this manifest, so the manifest stays accurate.

I added tests for the revised treasury's new price-anchor logic (priceAnchor()), and found one new defect. I'm reporting it in .imd-findings.json rather than writing a test that treats it as correct. forge build succeeds and forge test with the verifier's seed passes: 245 tests, 0 failed, 0 skipped. Nothing outside test/ changed except that findings file, and nothing is committed yet.

New file test/PulseTreasuryAnchor.t.sol:

• Targeted tests:
  • Launch state: at launch the anchor equals the opening price.
  • Parked price: after a free sell parks the price at any height (fuzzed, 1,000 runs), the anchor stays at the top of the seeded liquidity and the pulse still buys.
  • Price gap: with a gap about 8 bitmap words wide between two positions, the anchor walks down to the lower position's top.
  • Unreachable liquidity: when the only liquidity sits above the price, or the price is below every position, there is nothing to buy. nextPulse reports not ready, pulse() reverts NoFill, and nothing changes.
  • Return from a park: a buy that stops exactly on the top tick puts the pool back in range, and the next pulse is ordinary.
  • Recovery: after a dust park, one real buy brings pulses back.
• Invariant campaign (256 runs × depth 64): random parks, buys, liquidity removal and restore, and time passing. After every step:
  • priceAnchor() matches a separate calculation from the one known position.
  • nextPulse is ready exactly when there is liquidity to reach.
  • Every pulse ends within 1% under its anchor.
  • The treasury's ETH and IDM match its pulses, and every swap is recorded.

Finding (low), src/PulseTreasury.sol:162: the revision notes in ADAPTATION.md say a dust position at a parked price makes pulse() revert NoFill. It doesn't. In a scratch test:

• What happens: pulses "succeed", each paying 2 wei for about 60 wei of IDM. Each one resets the 15-minute silence window.
• Placement: the dust positions don't need to span the price.
• Cost: each liquidity-1 position (a few wei plus gas) cancels one pulse. Four positions cancelled four pulses in a row, and the fifth was ordinary.
• Impact: no funds are at risk, and any real buy ends it. But it weakens the guarantee this revision was meant to restore: after 15 minutes of quiet, anyone can buy.

The finding includes the exact reproduction and possible fixes.

Not covered:

• I couldn't re-run the vector validator script because python3 isn't installed on this machine; it passed in the earlier round.
• These tests don't verify any deployed Robinhood Chain (4663) addresses or launch receipts. That remains launch-stage work.

test/ADVERSARIAL_TESTS.md is updated to describe the new suite and the finding.

Review complete. The findings file is written at .imd-findings.json with one low finding and an 11-row coverage record. Git status shows nothing tracked changed; only the findings file and my scratch tests under test/scratch/ exist, which are ignored.

Settled from last round

• Medium, parked price blocks pulse (a3a45cc2): fixed. My attached proof, copied to the scratch directory, now passes against the revised code. The new priceAnchor() view measures the 1% limit from the nearest initialized tick at or below slot0 when active liquidity is zero, and nextPulse() uses the same check. The full suite also passes, with 245 tests.
• Low, stranded ETH under 0.0025 ETH (d1b58ea3): accepted as documented. SPEC section 9, README and the runbook now state that remainder is unspendable until new ETH arrives, which was the first option the finding offered.
• Three disputed lows (whale threshold at the post-swap tick, zero-delta swaps filed as sells, pulses dragging the EMA): dropped. Each reproduces as before, but the author is right that all three follow SPEC section 3 or section 9 as written, which this task must preserve exactly. SPEC section 9 explicitly documents the EMA drag. They are recorded in ADAPTATION.md for the requester and are not defects of this task.

One finding kept, low

The independent tester's dust-position report reproduces and is the residual of the fix. Any initialized tick qualifies as the anchor, including the upper tick of a liquidity-1 position. On the launch shape an attacker mints such positions between the seed top and a parking tick, parks the price with an IDM sell past the empty ETH side, and each pulse then buys about 60 wei of IDM for 2 wei of ETH while still being filed by the hook and resetting the 15-minute window. One more sell of a few hundred wei of IDM re-arms all the positions. No ETH is lost, but the restored guarantee that a pulse buys a hat-sized amount after 15 minutes of silence is deniable for gas only, and the ADAPTATION.md residual text describes it wrongly. A self-contained proof is attached that fails now for that reason and will pass once a minimum fill or a liquidity-aware anchor is in place. The choice of fix is the requester's, since SPEC section 9 fixes the 1% rule.

Nothing new found. The static-analysis leads are benign on inspection: the strict equalities are zero checks, the uninitialized locals are assigned before use, the reentrancy lead is the transient flag set before the unlock, and the locked-ether lead is the documented design. The manifest matches the constructor order, hook permissions and launch fee tier.