Approved workflow

Implemented BCAP and BlockOutflowCapHook, with vendored dependencies, ABI exports, and deployment documentation.

Verified:

• Offline forge build
• All 30 project tests and 9 supplied protected checks
• forge fmt --check
• ABI consistency

Deployment parameters and service responsibilities are documented in README.md. Independent review and deployment remain separate workflow stages.

Created the gas report, benchmarks, and .gas-snapshot. Build, all 76 tests, and snapshot verification pass.

Hook runtime: 3,529 bytes. Three oversized existing test harnesses are explicitly reported as size defects.

Commit blocked: .git is read-only. The ignored artifacts/ files also require force-adding.

Created launch.json.

• Schema, constructor, and runtime permission checks passed.
• Opening price matches rehearsal tick 138180.
• Notes: 1,645/4,000 characters.
• forge build passed; forge test: 78 passed.

Only launch.json is included in submission changes.

This content was flagged for possible cybersecurity risk. If this seems wrong, try rephrasing your request. If you’re doing authorized security work that requires more cyber permissive safeguards, apply for Daybreak access via https://platform.openai.com/settings/organization/status-and-access before retrying.

Review complete. The findings are written to .imd-findings.json at the repository root, and no other file in the working tree was touched (scratch experiments ran in a copy under /tmp).

Outcome: no blocking defect found. The hook implements the approved rule exactly, and every attack vector in this assignment was exercised against the real v4-core PoolManager with concrete inputs. Findings are ranked one low and four info.

What I checked and how it held up

• Griefing lockout (low, design-inherent). One actor buying the full allowance and selling it back inside one transaction locks out every other buyer in that block. Measured cost per block, day extrapolation, and the attacker's ending BCAP balance:

  Metric	Value
  ETH lost per block (fees only)	~0.0153 ETH
  Gas per block	~205k to 309k
  Full capped day (7,200 blocks)	~110 ETH
  Attacker BCAP held after each block	0
  Honest 1-wei buy in that block	reverts BlockCapExceeded

  If the attacker is also the dominant in-range LP, about 45% of the ETH-side fee returns immediately as position fees. On Sepolia the real cost is zero. This is exactly the requested design (per-pool per-block cap, sells never refund, no swapper identity), so mitigation is a scope decision, not a code fix.

• int128 casts and delta signs. Positive currency1 output only arises on zeroForOne swaps in v4-core's delta construction, so the widening cast is safe. Exact-output sells produce a negative amount1 and are never counted. Extreme inputs (int128.max exact output, 5,000 ETH exact input, uint128.max exact input) all revert cleanly with allowance unchanged.

• Block and timestamp boundaries. Same-block timestamp advance does not reset. The second before expiry caps, the expiry second does not, and status reports frozen accounting only while inactive. A new block resets. Multiple buys in one unlock accumulate.

• Uncounted BCAP routes. Liquidity removal, pools where BCAP is currency0 (a 3,000,000 BCAP buy passed with allowance untouched), and pools without the hook all move BCAP uncounted. All are consistent with the approved per-pool design. The Hooks library skips afterSwap when the hook itself is the swapper, but this hook has no swap-initiating function, so that bypass is unreachable.

• Manifest. The initialPrice equals tick 138180 exactly (about 1,001,800 BCAP per ETH, roughly 998 ETH fully diluted). Constructor argument and permissions match the source.

Test coverage notes (info). The invariant handler fuzzes only exact-output buys. The committed gas snapshot drifts on a fuzz mean, which matters only if CI enforces it.

Committed as 6cf8cb2 on top of the pinned source commit; the full repository bundle is 1.3 MB, well inside the 8 MiB limit, and the working tree is clean.

What was delivered

• web/: Vite 8 + React 19 + TypeScript 7 + viem source, package.json, package-lock.json, build config, .gitignore (node_modules only), README, and scripts for building/verifying the manifest, the browser pass and the contrast table.
• dist/: the static export (6 files, about 589 KB, relative base) plus imd-deployment.json, which copies launchId, chainId, sourceCommit, attestationHash, both contracts with their handoff abiHash, the byte-for-byte ABI copies under dist/abi/, SHA-256 of every other exported file, and the network block from network.json unchanged. The app loads this file and the ABIs at runtime and re-checks each ABI's canonical keccak against the handoff; no address, chain, RPC or ABI map exists in source.
• docs/frontend-validation.md (Better Interface coverage, findings, fixes, commands, browser evidence, limitations), docs/DESIGN.md, and docs/validation/ with the browser report and nine screenshots.

Validation results

• Typecheck clean; 28 Vitest interaction/unit tests pass against a mocked JSON-RPC node and mocked EIP-1193 wallet, including the 4902 → wallet_addEthereumChain path, the over-cap warning, decoding of the real BlockCapExceeded payload captured from Sepolia, approve-then-sell, rejection and confirmation flows.
• Browser pass (headless Chromium via playwright-core, export served under /preview/): live Sepolia reads at 1280/900/375/320 px with no overflow and no console errors, a visible focus ring at all 22 Tab stops, live quotes (0.01 ETH → 495,993.9357 BCAP; 1 ETH → decoded over-cap revert), and a live PoolSwapTest.swap simulation for a funded address that reached the wallet and was rejected by script. No transaction was broadcast.
• Fixed during review: control-border contrast (1.61:1 → 3.68:1), raw NotEnoughLiquidity text on sell quotes, skip-link focus target, favicon 404.

Decisions and limitations to be aware of

• Swaps use PoolSwapTest as the approved workflow and this assignment require; quotes and prices use the network block's V4Quoter and StateView. Exact input only; the slippage minimum is enforced by pre-sign simulation since that router has no on-chain minimum.
• DESIGN.md is at docs/DESIGN.md, not the repository root, because the root is outside this assignment's write scope.
• Untested on the live chain: real buys, sells and approvals, Outflow rows from real events (none exist yet), real wallet extensions, and manual screen-reader, forced-colors and native-zoom checks.