Restored the exact fixed commit, preserving all 498 files.

Passed: build, formatting, 175 Foundry tests, five release gates, 11 protected checks, and both stages on a recorded Sepolia fork.

No public deployment or activation occurred. Blockers remain: platform bad_path_count, pending independent review/new launch records, and an unverified owner-signing path for stage 2.

Complete evidence and handoff · Source package

Not delivered: artifacts/unlock-sepolia-f0149886-source-package.sha256, artifacts/unlock-sepolia-f0149886-source-package.tar.gz. Under artifacts/, only this step's named outputs leave the machine.

Updated only launch.json, correcting provenance and release notes while preserving matching constructor arguments and permissions.

Verified pinned commit f0149886…. Build, official manifest check, 175 Foundry tests, five release-gate tests and 11 protected tests passed.

No deployment broadcast. Recorded blockers remain: import bad_path_count, independent review/admission and verified stage-2 signing. No activated pool is claimed.

The review is complete and .imd-findings.json holds the result.

Outcome. The permission model of the UNLK hook bundle holds. I found no undisclosed bypass, escalation path, unprotected initializer, confused deputy, or asymmetric paired write. All 175 project tests pass on this tree, and seven extra scratch probes I wrote under test/scratch/ also pass. Those probes confirm that a direct PoolManager swap with a spoofed nonce is refused, that even the factory identity cannot remove seed principal, that non-owner staging and activation and a second activation revert, that an outsider cannot bind the oracle, and that re-entering swap from a native withdrawal leaves the router ledger backed.

Findings file. Four findings, all at info severity, each with a reproduction executed locally. They are the material trust gaps the brief requires to be disclosed, not code defects, and the author already documents three of them:

• The chain treasury can mint official-pool sell quota for any wallet by opening a funded reward round. A plain transfer recipient of the same balance gets none.
• A PoolManager protocol fee halts all official trading permanently, with no recovery path inside the launch.
• The setup authority is also the payer wallet, alone picks the activation block, and already holds a 7.5M UNLK quota at activation. Activation-timing priority is the one point the docs do not state.
• Quotas bind only the official pool. A transfer-only holder sold 1,000,000 UNLK on a hook-less ETH/UNLK pool with no quota, no fee split and no oracle checkpoint.

Coverage. All 28 listed entry points have a row, plus four invariant and manifest rows. Four entry points point at the info findings above, the rest hold. Not reached in depth: numeric precision of the seed-depth and TWAP math, sustained-manipulation economics, and a fresh Sepolia fork rehearsal, which belong to other specialists or needed an RPC I did not have.

No repository files were changed. Only .imd-findings.json and the two scratch test files, which are mine and not kept, were written.

Review complete. The findings file is written at .imd-findings.json with two findings and a coverage row for all 28 entry points plus three invariants.

What I checked (Economic Security, Invariant, Flow Gap guides). I traced the quota formula, every writer of eligible and sold, the router's settlement accounting, the TWAP and FDV derivation, the milestone cadence, allocation verification against the factory's real launch order, and claim evidence certification. I ran the full suite (175 pass) and added production-shaped probes on a token-only pool with no local ETH depth: the quota boundary rejects q+1 wei and accepts q, buy/sell round trips do not increase net exit, price never exceeds the seed's upper tick, and the first sell at the opening price reverts cleanly.

Findings.

• Medium, with proof. Stage 1 (beforeInitialize) accepts any factory and pool manager on Sepolia, while stage 2 (_verifyServices, feed and registry pins) refuses non-pinned code hashes forever. A redeployed or upgraded platform service produces a launch that succeeds, locks the 87% seed in a position that can never shrink, and can never activate. The scratch test test/scratch/SepoliaPinAsymmetry.t.sol fails on current code and passes once the same chain-gated check runs at initialization.
• Low. The $100K first tier is reached at the opening price with no trades once ETH/USD is at or above about $5,008, since the 20 ETH opening cap already values the supply at $39,936 at $2,000/ETH. Measured locally: FDV $101,838 at $5,100/ETH with zero swaps, tier 1 confirmed after the 2h window plus 6h of calls.

Not reached or only partly reached. The real Sepolia Chainlink feed path through fdvUsd was never exercised in the fork rehearsal; the recorded rounds pass the sanity checks by inspection only. Disclosed risks (sustained manipulation, protocol-fee halt, treasury round powers, other-pool bypass) were confirmed as documented and not re-reported.

Review complete. The findings file is at .imd-findings.json with two findings and a coverage row for every one of the 28 listed entry points plus four invariants.

What I found

• Low: oracle liquidity flag after a reserve-draining sell. The pool holds only the factory's token-side seed, so an exact-input sell larger than the ETH reserve partially fills and v4 walks the spot price through the empty region to the seller's price limit. The pool is then economically identical to its launch state, but checkpoint() in src/UnlkOracle.sol:99 classes it illiquid until the next buy. Every TWAP sample is invalid for that period plus the following two hours, and the resulting gap over 10 minutes restarts any 6-hour or 24-hour confirmation run. Any holder whose quota covers the reserve can do this repeatedly at near-zero cost. The payer's credit alone suffices while the pool holds under about 0.15 ETH. I reproduced it locally against the fixture: slot0 tick parked at 887271, latest observation liquid == false, twapTick() reverting after two hours of checkpoints. It fails closed and moves no funds, which is why it is low rather than medium.
• Info: the owner stage-2 script has no chunked certification path. script/Stage2.s.sol:55 calls certifyRound only, which reverts for more than 1024 recipients after deployCompanions has already broadcast. The contracts and docs support the chunked path; no executable in the tree runs it.

What held under tracing

• Router settlement: msg.sender-only sourcing, exact pre/post balance deltas in single and batch paths with mixed native input and output, ETH refunds and proceeds as pull credits, one expected callback with re-checked operation hash.
• Hook swap gating: router-only sender, nonce-bound context, pending-operation clearing, sign-correct buy credit and sale quota, fee pin.
• Stage 2: staged companions pinned by address and codehash, every stage-1 check re-run, all checks before all writes, factory distribution order makes the remainder wallet the recorded payer.
• Evidence adapter: complete-tree certification with uniqueness, heap-order encoder matches OpenZeppelin's layout, per-account single attestation.
• Principal lock and fee collection via zero-delta remove, plus the milestone state machine's reset and one-tier-per-confirmation rules.

Not reached in depth: the Sepolia rehearsal and network verification scripts under rehearsal/ and scripts/, and the Python release tooling beyond the claim-tree encoder. The 175-test suite passes locally. The scratch test under test/scratch/ is verification only and not a submitted proof.

The review is complete. The findings file is valid JSON, the quoted snippet matches line 147 of the router exactly, the scratch test is removed, and the working tree holds only .imd-findings.json.

Outcome. The math in my area holds up. I found one low-severity defect and no critical, high or medium issues. The file records one finding and 31 coverage rows covering all 28 listed entry points plus three arithmetic invariants.

What I checked, against the Math Precision, Boundary and Numerical Gap guides:

• Quota arithmetic in afterSwap and remainingQuota. Floor division matches the specified Q formula, casts are in range, and sales count executed input only.
• The oracle. The TWAP floor on the negated tick rounds ETH-per-UNLK down, the result stays within tick bounds, the FDV chain cannot overflow in either sqrt-price branch, and the window logic rejects any illiquid second.
• Milestone cadence. The 4-minute and 10-minute boundaries are inclusive, 6h/24h confirmations advance one tier only, and invalid samples neither advance nor reset.
• Seed geometry. The on-chain seed gives principal 869,999,999.999999999999997987 UNLK and 17.37 ETH depth, inside the policy band with the documented 2.3% margin. The floor passes up to opening tick 177480 and fails from 177540.
• Router settlement. Relative balance equalities hold for single swaps and mixed native and token batches, refunds are exact, and the callback settles and takes exactly the executed deltas.
• Merkle evidence. Heap indexing, the n=1 edge, chunked reduction order and cross-chunk uniqueness are all sound.
• Token receipts. Initial allocations accumulate only from the minter until it empties, so later transfers cannot rewrite them.

The finding (low). An exact-input sell with the default price limit is accepted as a partial fill. Because the official pool has only the seed position, the swap drains the in-range ETH and then steps through the empty region above the seed at zero cost. On the native-only fixture, after a 0.001 ETH buy, the payer's 7.5M quota sell consumed only 50,076 UNLK, took all 0.0009875 ETH, and parked the tick at 887271. The oracle correctly flagged the pool illiquid, which suspends milestone sampling until a buy restores the range and a further 2h window passes. Accounting stays exact and no rights are lost, so this is a griefing vector that is cheap only while the pool holds little ETH. The suggested fix is to reject a post-swap price above the seed's upper tick in afterSwap, or clamp the sell price limit in the router.

Not covered. I did not re-run the Sepolia fork rehearsal or the network pin checks, and I did not audit the access-control, economic or execution-trace areas assigned to the other specialists beyond what the math required. All 175 local tests pass.

Added adversarial token tests and fee-custody invariants, modifying only test/.

• forge build passed.
• 186 tests passed; no failures or skips.
• 11 protected checks and five release-gate tests passed.
• Published source and artifact hashes remain unchanged.

Review and reproduction notes.

No Sepolia deployment or activation was performed.

I kept two findings and wrote them to .imd-findings.json, with a coverage row for each of the 28 entry points: 23 hold and 5 are linked to a finding. No other repository file changed; the scratch tests I ran are deleted.

1. Medium: a launch can create a pool that can never activate (src/UnlkHook.sol:189)

• The gap: beforeInitialize only checks who opens the pool and its shape. Stage 2 (deployCompanions and configureAndActivate) also requires, on Sepolia, that the factory, PoolManager, fee contract and registry code match fixed hashes built into the hook.
• Impact: if those services don't match the hashes, stage 1 still succeeds and the 87% seed (about 870M UNLK) is locked in the pool for good. Every stage-2 call then reverts, so trading never starts. The hook's own comments say a launch that can never activate should fail in the launch transaction instead.
• Evidence: I ran the specialist's proof test on this tree. It fails with "next call did not revert as expected", which is the defect it describes, so it is attached to the finding.
• Fix: run the same Sepolia hash check inside beforeInitialize.

2. Low: a large sell can pause milestone progress (src/UnlkOracle.sol:99)

• Merged: this combines the audit_math and audit_flow findings, which share one cause.
• The gap: a sell bigger than the pool's ETH moves the price past the top of the seeded range, all the way to the seller's price limit (tick 887271). The oracle then marks the pool illiquid. Price readings fail until 2 hours of normal trading have passed, and any milestone confirmation in progress starts over.
• What it doesn't do: no funds are lost, and no quota or credit changes.
• Evidence: I reproduced it in a scratch test with the production-style token-only seed:
  • alice buys 0.05 ETH, then the payer sells its full 7.5M UNLK quota;
  • the tick ends at 887271 and the latest price record is marked illiquid;
  • two hours later, updateMilestone() returns false and fdvUsd() reverts.

Dropped findings

• Disclosed by design: treasury reward-round powers, the protocol-fee trading halt and the other-pool bypass are all deliberate behaviour that the launch notes list as unresolved risks. They are disclosures, not code defects.
• Not code defects:
  • The payer, who is also the setup wallet, can trade first after activation. Nothing in the brief requires a neutral opening.
  • The first unlock tier ($100K) is reached with no trades once ETH/USD is at or above about $5,008. That follows from the policy's opening price and the brief's tier schedule.
  • The stage-2 script has no chunked-certification path for more than 1,024 recipients, but delivery/OPERATIONS.md gives the exact chunked calls (submitLeaves/reduce), and certification is open to anyone.
• Static-analysis leads (router reentrancy and balance checks, the uninitialized-variable warnings, the HookDeployer "initializer", the unchecked ETH send in withdrawNative): I traced each one and none is a real problem.

Both findings reproduced on the starting tree and both are fixed. The tree builds, all tests pass, the format check passes, and the answers are in .imd-responses.json.

Finding d2d6b0db (medium): fixed. The reviewer's proof failed on the starting tree as reported. beforeInitialize in src/UnlkHook.sol now calls the same Sepolia service pin check that both stage-2 calls run, so on chain 11155111 an unpinned factory, pool manager, fees or registry reverts the launch transaction with InvalidConfig instead of seeding a pool that can never activate. The registry pin moved into that single check, and the duplicate in the launch-record verifier was removed. The hook runtime is 24,359 bytes, 217 bytes under the EIP-170 limit. Evidence:

• The proof now passes.
• New test/SepoliaPins.t.sol (8 tests) refuses local services, each single unpinned or lookalike service, and accepts the pinned code. The accepting path etches the recorded Sepolia runtime bytes, which hash to the pins, and initializes through the real PoolManager code with the real factory address as sender.
• The recorded-block fork rehearsal of both stages through the real Sepolia factory passed at block 11,906,030 on the public Sepolia endpoint. The result is in delivery/checks/revision-fork.txt.

Finding 9224491b (low, advisory): judged real and fixed. Reproduced with the reviewer's steps: the draining sell left the tick at 887271 and the FDV unreadable two hours later. A drain-and-buy-back costs only two LP fees on the reserve and stalls tier confirmation for a window, so it is far cheaper than the disclosed sustained manipulation. The router in src/UnlkSwapRouter.sol now bounds every swap's price limit to the seed range read from the hook's existing getters. A reserve-draining sell ends at the seed's upper boundary, the launch state, which the oracle classes liquid. No TWAP, feed, depth or confirmation rule changed. On Sepolia the seed range is provably the only liquidity because the verified factory reaches the pool only from launch and fee collection. New test/SeedBoundary.t.sol (4 tests) covers the drain, an empty-reserve sell, a tighter caller limit and buys. Two accepted credit tests that sold from the launch state into local-only depth above the seed now make the fixture's warm-up buy first.

Consequences recorded. UnlkHook and UnlkSwapRouter bytecode now differ from commit f0149886; the other four artifacts are byte-identical. The reviewed router creation hash was regenerated, the hook creation hash pinned in the deployer test was updated, and the artifact records, ABIs and source digest list were regenerated. The revision is documented in docs/REVISION_2026-10-13.md, with notes added to the README, delivery handoff, security review, deployment doc, both status files and the historical records.

Results on this machine. 208 delivered Foundry tests pass (209 with the proof copy in scratch), the unmodified protected suite passes with 11, the Python release gate passes with 5, and the format check passes. Foundry here is 1.7.1, and its formatter also rewrapped one expression in each of three accepted test files that the format check otherwise rejects, so those formatting-only edits are kept.

Not done. Nothing was broadcast, the memory directory refused writes, and independent re-review of the revised build remains a release gate along with the previously disclosed risks.

Done. The manifest at launch.json is verified against the accepted tree and only its test-count line changed.

What I found

• The existing manifest already described the hook correctly. Constructor words are $poolManager, $token, $factory, $owner, matching the declaration order manager, token, launchFactory, setupAuthority in src/UnlkHook.sol.
• The eight declared permissions match getHookPermissions exactly, confirmed programmatically from the source. No return-delta permissions are declared or implemented.
• Token fields are UnlkToken, UNLOCK, UNLK, 18 decimals. Pool fields are native ETH, fee 12500, tickSpacing 60 and the one-to-one placeholder price, as the launch facts require.
• The first key is kind with value univ4_hook. Notes are 3989 characters, under the 4000 cap.
• The source hash list from the published commit matches every file except launch.json, which is the deliverable revised last round.

What I changed

One sentence in notes. It claimed 175 Foundry tests, but the current accepted tree runs 187 tests in 40 suites. The line now reports the counts I actually reproduced today.

Verification run on this machine

The working tree shows only launch.json modified. No .imd-blocked.json was needed since every manifest value comes from the launch facts or the repository.

Still outside this task

Nothing was broadcast. Independent review, admission, Sepolia pin verification against current policy, fork rehearsal and both deployment stages remain platform operations, as the notes state. Stage 1 alone would mean pool deployed, trading inactive.

All work is done and verified. Final state of the tree: only files under test/ changed.

What this revision needed. No reviewer findings were attached to this round, but the implementation changed underneath my accepted tests in the other contributor's revision: beforeInitialize now runs the Sepolia service pins at stage 1, and the router clamps every swap's price limit to the seed range read from the hook. My two earlier suites still pass unchanged on the revised code, so I left them alone and added coverage for the changed router mechanism.

What I added, in test/SeedRangeLimitProperties.t.sol, on the Sepolia-faithful token-only seed with no local quote depth:

• Failure paths the clamp creates. A launch-state sell is refused with the exact v4 error PriceLimitAlreadyExceeded(ceiling, ceiling) and leaves nonce, sold, balance and approval untouched. An exact-output sale past the reserve is refused as slippage with no state change. A buy whose limit sits at the current price is refused with no refund credit.
• Exact clamp semantics under fuzz. For caller limits drawn below the price, inside the range, and above the ceiling, executing the request equals executing the hand-clamped limit, compared on success or exact revert data, input, output, end price, sold, eligible and nonce. A tighter caller limit is honoured and a partial fill ends exactly on it.
• Oracle readability after a drain. A quota-sized sale into a small reserve stops on the ceiling, trading resumes at once, and the TWAP is priced a window later with every observation liquid.
• Invariant campaign over random buys, exact-input and exact-output sales with limits from the whole v4 range, time advances, payer sync and withdrawals, with fail-on-revert on. The price never leaves the seed range, every observation is liquid, the seed principal and the manager's assets equal executed flows, and sold matches a ghost ledger and the quota formula. Only four exact refusals are tolerated and each is checked to leave the price unchanged.

Results. Full suite: 205 tests across 45 suites, zero failures or skips. The new campaign ran 6,144 handler calls with zero unexpected reverts. Build and test logs are refreshed in test/results/, and the revision is documented in test/TESTING_ADDITIONS.md.

Defects. None reproduced in the implementation, so no findings file was written. Two mistakes surfaced during development were in my own test harness and were fixed there.

Unchanged limits. These are local checks only. The package still has no public Sepolia deployment, transactions, source verification, sealed activation evidence or independent review, and the disclosed sustained-manipulation, protocol-fee halt, treasury reward-round and other-pool bypass limitations stand as documented.

Review complete. The findings file is valid JSON with 2 info-level notes and 30 coverage rows, and the tree holds no modifications outside the findings file and the scratch directory.

Both prior findings are settled as fixed.

• Medium, stage 1 accepting services stage 2 refuses. The hook's beforeInitialize now runs the same four Sepolia code-hash pins as stage 2, with the factory hash checked before its getters are read. My attached proof passes on the revised tree, the author's 8 new pin tests pass, and the 11 supplied protected tests still pass on a local chain id. The hook runtime is 24,359 bytes with 217 bytes of margin, and the initcode stays well under the limit.
• Low, drain sell parking the tick at 887271. The router now clamps every price limit to the seed range read from the hook. A reserve-draining sell stops exactly at the seed's upper boundary, which the oracle classes liquid, and the operation hash covers the clamped params on both sides. The author's 4 boundary tests pass, and the regenerated reviewed-code hash matches the build.

Verification run on this tree. The full suite passed with no failures across 40 suites, the protected admission suite passed, and the reviewed-code hash check matched all four creation hashes.

Two info notes, neither reopening the work.

• The delivery table and the manifest notes still quote the pre-revision hook size and test count. The attestation binds real hashes, so this is stale evidence to refresh, not a deployment risk.
• At the policy opening price the first unlock tier confirms from the ETH/USD feed alone once ETH is at or above roughly $5,008. I reproduced this with a scratch test: tier 1 and p=3500 with zero swaps at $5,100, tier 0 at the recorded $2,514. This follows from the brief's own tier schedule and opening cap, which the author may not change, so it is a disclosure item only.

The specialists' other items were either duplicates of the settled findings or the disclosures the security review already carries. No new defect was found.