Approved workflow

The work is complete and committed as 31cd11b on main. The working tree is clean.

What was delivered

• src/CBRK.sol: Breaker (CBRK), 1,000,000,000 tokens with 18 decimals, zero-argument constructor, minted once to the deployer, no owner or mint path. Built on OpenZeppelin ERC20 v5.7.0.
• src/CircuitBreakerHook.sol: implements IHooks directly with exactly beforeSwap and afterSwap enabled and validated in the constructor. beforeSwap records the block's pre-swap sqrtPriceX96 per PoolId and emits ReferenceSet. afterSwap reverts with Tripped(ref, new) outside the band ref·sqrt(0.9) ≤ new ≤ ref·sqrt(1.1), computed with FullMath.mulDiv against inward-rounded Q96 constants. Zero deltas, no fee, no funds, no admin. Pools whose currency0 is not native ETH are ignored. Every callback checks msg.sender == PoolManager. Views for the site: currentReference, currentBand, allowedBand, isWithinBand, wouldTrip.
• src/HookFlags.sol: the library the protected floor test imports, plus an allocation-free CREATE2 salt miner.
• script/Deploy.s.sol: constants only, no environment reads, deploy() covered by a test.
• docs/abi/CBRK.json and docs/abi/CircuitBreakerHook.json, a README covering assumptions, deployment parameters, operational responsibilities and review targets, and lib/VERSIONS.md recording the vendored dependency pins.

Verification

The launch rehearsal initializes at the documented price, seeds one-sided CBRK with zero ETH taken, and lands a 1 ETH first buy in the ETH-less pool. It also shows a 20 ETH first buy tripping and the same amount succeeding when split across blocks. The suite covers 9.9% passing and 10.1% tripping in both directions, inclusive band edges, cumulative same-block trips, swap-back, new-block reset, dust, exact-in and exact-out both ways, a non-ETH pool, per-pool state, all ten callbacks refusing outside callers, and fuzzed sizes with truthful revert reasons.

Assumptions to flag

• The workflow does not state the opening price or seed size. The rehearsal uses tick 152040 (about 4.0 million CBRK per ETH) and a 500 million CBRK seed from that tick down to about 9,900 CBRK per ETH. These live in test/utils/LaunchParams.sol and the README; only the "small" and "oversized" buy sizes depend on them.
• v4-core is vendored from main (commit 46c6834), not the v4.0.0 tag, because the protected test imports PoolOperation.sol, which the tag does not have.
• Griefing is possible by design: pushing the price to the band edge blocks further same-direction moves for that block. This is documented and tested, not mitigated.

Next for other assignments: the manifest node needs the flags 0x00C0, the creation code from Deploy.hookCreationCode(), and the pool key in the README. The independent review should start from the "Operational responsibilities" section, which lists the attack surfaces the workflow asks for.

The work is complete. Recap for a reader who only sees this message:

Deliverables (all within the allowed paths; the build and full suite pass, 87 tests, 0 failures)

• test/GasReport.t.sol: 35 new tests in three contracts. They measure swaps on two identical pools that differ only in the hook field, the two callbacks in isolation, every public function of every repository contract, and both deployments. Ceiling assertions turn a cost regression into a failing test.
• .gas-snapshot: forge snapshot of the full suite.
• artifacts/gas.md: the report. artifacts/gas-report.txt holds the raw forge test --gas-report output with a note on how forge meters top-level calls.

Sizes. No contract exceeds 24,576 bytes, so there is no size defect to report. The hook is 5,318 bytes and the token 2,469. Uniswap's own PoolManager compiles to 24,009 bytes (567 under the limit) but is not deployed by this launch.

Gas per swap. The hook's overhead on top of an identical hook-less swap, measured as execution gas with cold state, is the same in both directions:

A routine hooked buy bills 112,842 gas as a transaction versus 99,451 without the hook. A tripped swap costs its sender 83,559 gas and leaves no state.

Callbacks. afterSwap costs 9,963 gas; beforeSwap costs 6,289 in a block's later swaps, 19,105 for a block's first swap, and 53,305 once per pool. Both stay under the guidance's hard ceilings; the 50,000 target is exceeded only on that one first-ever swap.

Things worth knowing, none of them defects. The two reference slots could be packed into one to save about 22,100 gas on a pool's first swap and 5,000 on each block's first swap. Nothing in either callback loops or grows with input. Salt mining costs about 233 gas per candidate and runs off chain.

Measurement notes. Foundry meters each top-level call from a test as its own transaction, including 21,000 intrinsic gas plus calldata, and consecutive calls into the same contract leak about 4,500 gas of warmth. The tests place a separating call before every measurement and split intrinsic gas out from the encoded calldata; the resulting numbers match forge test --isolate and reconcile exactly with EVM storage pricing (the 34,200 gap between the first two rows is two writes moving from fresh to rewrite).

No findings file was written because no defect was found. The artifacts/ directory is excluded from git by the harness's own .git/info/exclude, alongside the other designated output paths, so it is left for collection from the working tree.

Created gas report, benchmarks, and .gas-snapshot.

• Offline build, all 179 tests, and snapshot verification pass.
• Hook runtime: 5,318 bytes.
• Three existing oversized test harnesses are explicitly reported as defects.

Commit blocked: .git is read-only. Files remain local; ignored artifacts/ also requires force-adding.

Created launch.json with matching contract metadata, permissions, constructor argument and pool price.

Schema validation and forge build passed. forge test: 186 passed, zero failures. Notes: 1,527/4,000 characters.

Only launch.json is deliverable; verification files remain under excluded test/scratch/.

Review complete. Findings are in .imd-findings.json at the repo root; no source, test, doc or config file was touched (git shows the tree clean apart from the findings file).

One high finding, one documented acceptance.

• High: zero-cost cross-block reference ratchet. The reference is whatever slot0 holds before the block's first swap, and the launch pool has no liquidity above the opening tick. A caller with no CBRK, no ETH and no approvals can sell 1 wei exact-in with the price limit set to the block's upper band edge. Nothing is exchanged, the delta is (0, 0), and slot0 lands exactly on the inclusive edge, so afterSwap passes. Next block the reference is 10% higher. After two such blocks, every buy of any size trips because a buy must slide back below the opening price, which is more than 10% under the reference. A defender's free walk-down is undone by a same-block re-push, so whoever is last in the block wins. Measured cost per push: 48k to 92k gas, zero tokens. I reproduced both sequences in a scratch copy against a real PoolManager with exact sqrtPriceX96 values in the finding. The README's claim that the attacker pays fees and slippage is false for the launch pool. Any remedy changes the approved reference semantics or the seed shape, so it needs a scope decision rather than a patch.
• Info: one-block edge griefing with live liquidity. Documented with its call sequence as the workflow asked. It costs a real trade and is already accepted in the README, manifest notes and tests.

Checked and found correct:

• Both sqrt constants are the exact tightest inward integers, confirmed independently in Python. Lower edge uses ceil with the rounded-up constant, upper uses floor with the rounded-down constant.
• Band maths cannot overflow: FullMath handles the 257-bit product, and results are uint256 so the upper edge past the uint160 range is safe. The fuzz over the full sqrt-price domain covers it.
• The reference is captured in beforeSwap from slot0 before any state change, including the pool's first swap and after a tripped attempt, which leaves no state.
• No same-block path moves the price without reaching afterSwap. Liquidity, donate and initialize do not move slot0, and v4's self-call skip is unreachable because the hook never calls the PoolManager.
• Manifest price equals tick 152040, constructor and permissions match source, ABI exports list every function, event and error, and the full suite passes offline (181 tests).

This content was flagged for possible cybersecurity risk. If this seems wrong, try rephrasing your request. If you’re doing authorized security work that requires more cyber permissive safeguards, apply for Daybreak access via https://platform.openai.com/settings/organization/status-and-access before retrying.

The revision is complete. Both findings reproduced, one led to a code change and the other to a documentation change.

The high finding is real and is now closed for the reported sequence. On the one-sided launch pool, a 1 wei sell with its price limit at the band's upper edge slid through the empty range above the opening tick, exchanged nothing, and became the next block's reference. A 1 ETH buy in the next block then tripped. The hook's afterSwap now reverts with a new PhantomSwap error when the pool's swap delta is zero in both currencies. The band check still runs first, so out-of-band phantom moves keep reporting Tripped. No ordinary trade is affected, and a real sell that drains the pool's ETH and slides on keeps a non-zero delta.

What I changed:

• src/CircuitBreakerHook.sol: the zero-delta rule, the new error, and updated doc comments.
• test/LaunchRehearsal.t.sol: the reported attack replayed and refused, next-block buys of three sizes passing, the arithmetic of a pushed reference, a drain-and-slide sell judged only by the band, and the in-band slide test now expecting PhantomSwap.
• test/utils/CircuitBreakerFixture.sol: revert and decode helpers for the new error.
• docs/abi/CircuitBreakerHook.json regenerated. README gains a "Reference ratchet through empty liquidity" section, the new selector, the new creation-code size, and the new deterministic-deployer salt and address.
• .imd-responses.json answers both findings.

One residual needs a launch-owner decision, stated plainly in the README and pinned by a test. The rule raises the attacker's cost from zero to a few wei, not to a real trade. An attacker who parks a dust ETH-only position just above the opening tick can sell dust CBRK through it with a non-zero delta and still walk the reference up 10% per block. Closing that requires either a two-sided factory seed or a different reference definition than the approved raw pre-block price. Both are outside this assignment, so I left the approved reference definition and seed shape alone, as the reviewer recommended.

The advisory finding on one-block edge griefing with live liquidity is accepted behaviour. No code changed. The README bullet now carries the reviewer's exact call sequence and states the attacker's real cost, and no longer implies that cost applies on the one-sided launch pool.

Verification, all offline: build clean, 56 tests pass, formatting check passes, and the deploy script dry run lands the hook at the address the README states with flags 192.

The revision is complete and verified. The rejected attempt's file no longer exists; I repaired the accepted test/gas suite instead of rewriting it.

Why the previous run failed. After my accepted round, another contributor added a PhantomSwap check to afterSwap that reverts on a zero swap delta. My direct-callback gas test passed a zero BalanceDelta, so it now reverted. The full suite showed exactly that one failure and nothing else.

What changed (only test/gas/**, .gas-snapshot, artifacts/gas.md):

• test/gas/PublicFunctionGas.t.sol: the in-band afterSwap measurement now passes a real non-zero delta. Two new tests measure the PhantomSwap and Tripped revert paths of afterSwap directly, asserting the exact revert reason.
• test/gas/GasFixture.sol: added a measureRevert helper and a measureTrippedSwap fixture that sends an oversized first-in-block buy through the router, checks the wrapped Tripped error, and confirms no state or reference survives.
• test/gas/SwapGas.t.sol: added test_gas_swap_hook_buy_tripped to both block-position suites.
• .gas-snapshot regenerated with forge snapshot --offline, and --check confirms it matches.
• artifacts/gas.md written: every contract's runtime and initcode size, per-function gas for the hook, token, script, PoolManager, routers, mock and library constants, and a notes section.

Results.

Headline numbers in the report. The hook adds 19,489 gas to a block's first swap and 10,673 to every later swap in that block, identical across buy, sell, exact-in and exact-out. The pool's very first swap ever pays 53,689 once for the zero-to-non-zero reference slots. A tripped swap burns 55,921 to 64,737 gas. CircuitBreakerHook is 5,396 bytes and CBRK 2,469 bytes, so there is no size defect and no findings file was needed.

Done. The only tracked change is launch.json.

What I changed. The manifest's structured fields were already correct against the source, so I left them alone. The notes were stale: the accepted hook now also reverts with PhantomSwap when a swap exchanges nothing in either currency, added after the independent review's reference-ratchet finding, and the old notes never mentioned it. The revised notes describe the accepted implementation:

• The phantom-swap refusal, why it exists, and that the band check runs first.
• The residual dust-liquidity ratchet exposure and the one-block edge griefing, both as the README documents them.
• Pool key, opening tick and price derivation, the single PoolManager constructor argument, permission bits 0x00C0 with constructor validation, PoolManager-only callbacks, no fee, deltas, funds or admin, the integrator views, and ABI paths.

Verification.

One of my scratch tests could not use deployCodeTo because the repo forbids filesystem reads, so I confirmed the permissions by reading the source and relying on the repo's own flag tests instead. The scratch files under test/scratch/ are the only other additions and are discarded before submission.

This content was flagged for possible cybersecurity risk. If this seems wrong, try rephrasing your request. If you’re doing authorized security work that requires more cyber permissive safeguards, apply for Daybreak access via https://platform.openai.com/settings/organization/status-and-access before retrying.

The free edge push from my high finding is fixed, and the griefing note is settled. But the harm behind the high finding is still reachable for a few wei, so I've reported one medium finding. It needs a decision from the launch owners, not a code patch. I changed no repo files; the findings are in .imd-findings.json.

High finding a8a8d7ba: the zero-cost push is fixed. afterSwap now reverts with PhantomSwap when a swap exchanges nothing in either currency (src/CircuitBreakerHook.sol:170). I reran the attack as I originally reported it and it is now refused. Normal trading isn't affected: with the 0.30% fee, even a 1-wei trade into liquidity pays 1 wei of fee, and any real price move costs at least 1 wei of input. So no legitimate swap has a zero delta.

New medium finding: the dust version of the same attack locks buys indefinitely. The author documented that an attacker can still push the reference up 10% per block by parking a tiny ETH position above the opening price. That write-up understates it. I reproduced the following in a scratch copy under /tmp:

• Setup: over two blocks the attacker makes two dust pushes, spending 2 wei of ETH and 5 wei of CBRK. They then remove their dust positions and stop.
• The pool freezes: the price now sits about 21% above the opening price, with no liquidity between it and the seeded range. Any swap that stays inside the band trades nothing and reverts PhantomSwap. Any swap that reaches liquidity falls outside the band and reverts Tripped.
• Result: in every later block, every swap through the router the site uses fails. That includes 1 ETH buys, exact-out buys and 1-wei moves in either direction.
• The new rule made it worse: before this round's fix, anyone could walk the price back down for free. Now that walk-down is refused as well.
• Recovery: someone has to add their own liquidity in the empty range and walk the price down over about two blocks. That works, but ordinary buyers and the site can't do it, and the attacker can re-lock for a few wei at any time.

The approved brief only accepts griefing that blocks others for one block. Fixing this properly means a two-sided seed or a different reference definition, or explicitly accepting the lock. That choice belongs to the launch owners. At minimum, the README and the launch.json notes should say that the lock stays in place after the attacker stops and that router swaps can't undo it.

Griefing note (info): settled. It's reproduced by test_griefing_edgePushBlocksSameDirectionForTheBlock and documented with the exact call sequence, and the new rule doesn't affect it. No further finding.

Other areas in scope: nothing new found.

• Sqrt constants: I recomputed both. SQRT_0_9_X96 is floor+1 (rounded up) and SQRT_1_1_X96 is exactly floor, so both lean inward as intended.
• Band maths: the bounds round inward and the 512-bit arithmetic can't overflow. Results wider than 160 bits are handled.
• Reference capture: the reference is set in beforeSwap before the price changes, including on the first swap ever.
• Price moves that skip afterSwap: I found no way to move the price in a block without reaching afterSwap.
• Tests and ABI: the ABI export matches the compiled contract, and forge test --offline passes all 187 tests.