Delivered the pinned PvPad contracts, vendored dependencies, eight ABI exports, and updated deployment documentation. Preserved economics and genesis-poison protections; added five callback safety tests.

Verified:

• forge build
• forge test: 172 passed
• forge fmt --check
• All ABI exports match

Manifest generation, independent launch review, Sepolia deployment, and hosting remain assigned to subsequent contributors/services.

Created launch.json with matching token metadata, ordered constructor dependencies, $owner roles, and native ETH pool settings.

Validation passed: schema and ABI checks, forge build, and all 172 tests. Only launch.json changed outside scratch.

Review complete. Findings are written to .imd-findings.json and no tracked file was changed.

Outcome. The permission model in the Access Control, Trust Gap and Asymmetry areas holds on every main path. I found no critical, high or medium defect. Three entries are reported, one low and two informational trust assumptions.

Findings

• Low, PvPadFactory.receive(). The guard checks that the sender is a registered curve, not that the transfer is the graduation sweep. A sell with the factory as recipient passes the guard, and the ETH is stranded with no withdrawal path. This contradicts the README claim that mistaken transfers are refunded by revert. Reproduced in a scratch test. Harm is limited to the caller who chose that recipient.
• Info, WorkerSubsidy.setEpoch. The single updater key can reserve the whole pot under a one-leaf root paying itself and claim at once. Correctly guarded, documented in SPEC and README as a mainnet blocker, recorded as the custody assumption the manifest reviewer must check against policy.
• Info, PvPadHook.bindPool. Provenance is self-attested, so a stranger can bind a look-alike "PVP" pool on the official hook and receive its own 1% skim. Verified it cannot touch real or future launch keys, cannot record into the real escrow, and cannot nest a swap on a real pool. Recorded so the frontend stage indexes only from the factory.

Verification done

• Full suite passes: 172 tests, 0 failures. ABI exports match the build.
• Scratch tests under test/scratch/ confirm the locked-ETH path, the spoof binding, and that strangers cannot bind real or predicted keys or become fee recorders.
• Static-analysis leads were checked. The arbitrary-send and reentrancy flags on claimWorker, retryDeferred, withdraw and flushDeferredFees are guarded by committed payees, storage-keyed destinations and restore-on-catch. The encodePacked, locks-ether and uninitialized-local flags are false positives.

Coverage. All 40 listed entry points have rows, plus three invariant rows. One row is unreached: no launch.json exists yet, so the resolved constructor beneficiaries for genesisCreator and initialUpdater could not be checked against policy. That check belongs to the review that runs after the manifest assignment.

The review is complete. The findings file is written at the repository root, the scratch directory is removed, and the tree has no other changes.

Outcome. The math area is clean. The curve, hook and graduation arithmetic hold under every failure mode in the Math Precision, Boundary and Numerical Gap guides. I report one info-level item and no medium or higher defects.

What I verified in depth

• Bonding curve. The cap formula remaining + (remaining-1)/99 nets exactly the remaining distance and one wei less lands one wei short, for every remainder. Both outputs round down, so the reserve product never decreases. I confirmed this over 300 alternating buys and sells. A full exit after many buys leaves one wei in the reserve.
• Hook fee legs. The exact-input fee and the exact-output gross-up satisfy the same identity, so the trader nets exactly what was specified and the fee is one percent of the gross leg. I traced the delta signs through the vendored v4 Hooks.afterSwap for all four swap modes, and the take-then-credit sequence nets to zero for the hook.
• Graduation seeding. The canonical price uses FullMath so the shifted intermediate cannot truncate. LiquidityAmounts rounds liquidity down, and I proved the v4 round-up amounts can never exceed the swept ETH or tokens, so settle cannot fail. Dust after 300 trades was 1466 wei and 970 token units.
• Escrow and deferred shares. Summed per-trade king halves never exceed half the aggregate, and the coldest record path fits inside the 150k and 200k gas stipends. A 63/64 gas-starvation attempt cannot force deferral without reverting the whole trade.
• Worker pot and king. Window checks are short-circuit ordered so no underflow, claim and recycle windows are disjoint, and the price bump cannot overflow within reachable claim counts.

The one finding (info). Both fee formulas floor, so any ETH leg under 100 wei pays zero fee on the curve and on the hook. Ten 99-wei curve buys paid 0 wei while a single 990-wei buy pays 9 wei. Gas dwarfs the wei avoided, so it cannot be farmed and no invariant is affected. It is recorded so the author can document or change the rounding policy.

Coverage. All 40 listed entry points have a row, plus three invariant rows. The six trade entry points reference the info finding; everything else holds. The ABI exports in docs/abi match the compiled artifacts for all eight contracts, and the full suite of 172 tests passes offline with a clean environment.

Added tests under test/ covering batch-swap failures, atomic rollback, fee attribution, asset conservation, and locked liquidity, including randomized invariant sequences.

Offline forge build and forge test pass: 182 passed, 0 failed, 0 skipped.

No new contract defects found in this coverage.

The review is complete. Findings are written to .imd-findings.json with coverage rows for all 40 listed entry points plus 6 invariant rows. No source files were changed, and the scratch tests I used for probes were removed.

Outcome. The economics hold. I found no critical, high, or medium defects in the Economic Security, Invariant, or Flow Gap areas. The curve, hook, escrow, king, and worker accounting all conserve value exactly as SPEC.md requires, and the existing suite of 172 tests passes.

Findings reported (2 low, 3 info, each with a measured reproduction):

• Low, BondingCurve unprotected overloads. buy(address) and sell(uint256,address) hard-code zero slippage and no deadline. A 1 ETH victim buy at the curve opening can be sandwiched for 0.55 ETH of bot profit, with the victim receiving 48.5% fewer tokens than quoted.
• Low, hook fee take before settlement. The hook pulls its ETH fee from the PoolManager during the swap callback, before the trader settles. A swap whose fee exceeds the manager's native balance reverts. On a manager holding only this pool's 4.2 ETH, a 500 ETH exact-input buy reverts while 100 ETH succeeds. This is a liveness bound, not a loss, and is far looser on the shared live manager.
• Info, crown price compounding. The claim price grows 10% per claim regardless of the amount paid. After 121 claims the crown costs over 1,000 ETH and the sitting beneficiary effectively holds the platform's 50% share permanently. This matches the frozen spec and is recorded as an economic assumption.
• Info, privileged roles. The updater can allocate the whole worker pot to itself with a one-leaf root, and the genesis creator is a perpetual 50% beneficiary. Both are documented trust assumptions, and no manifest is present yet, so the manifest reviewer must verify the resolved $owner arguments against policy.
• Info, parallel venue. A curve buyer can open a hookless pool for the same token before graduation and trade with no pad fee. The README discloses this. A measured 0.1 ETH trade on such a pool skimmed zero fee.

Coverage gaps. None within my area. I traced every listed entry point and verified all five spec invariants by reading the code and by confirming the existing conservation and fuzz tests exercise them. Static analysis leads (arbitrary-send, reentrancy flags) were checked and found to be by-design pull payments or guarded paths, so none were promoted.

The findings file is validated (all 40 entry points covered, snippet matches the tree), scratch tests are removed, and the working tree shows no changes beyond the findings file. The review is complete.

Review outcome

I audited the control flow of the PvPad contracts against the Execution Trace, Periphery and First Principles guides, tracing every listed entry point through its guards, state writes, external calls and failure paths, and probing the leads that reasoning alone could not settle with scratch Foundry tests against the vendored Uniswap v4 PoolManager.

One finding, low severity. The factory's receive() is documented as refusing all plain ETH except a curve's graduation sweep, but it only checks that the sender is a registered curve. A curve sell whose recipient is the factory therefore passes the guard and the seller's ETH is locked permanently. The same recipient gap lets buys park tokens in the curve or factory outside reserves. Reproduced on this tree:

Call	Result
sell(balance, address(factory)) after a 1 ETH buy	succeeds, 0.9801 ETH locked in factory
direct factory.call{value: 1}("")	reverts as documented
buy{value: 0.1 ETH}(address(curve))	tokens left in curve outside tokenReserve

Impact is confined to a caller supplying a wrong recipient, so it is reported as low with the one-line fix noted in _checkTrade.

Everything else in my area holds. Points verified beyond reading:

• Graduation deposit never needs more ETH or tokens than the sweep delivered across 256 random buy and sell histories, so graduation cannot brick on rounding.
• Factory constructor gas with all 16 genesis candidates poisoned at either price extreme is about 8.5M, under the Sepolia per-transaction cap.
• The canonical price is not a tick-boundary price, so a realigned pool carries the same tick as a freshly initialized one.
• Gas-starving a buy cannot force fee deferral; deferral only arises from a real escrow revert.
• Hook delta sign conventions for all four swap modes were checked against the vendored v4 swap and hook libraries.
• ABI exports match the build, runtime sizes fit EIP-170, and the full suite passes (172 tests).

Not reached. No launch.json exists yet, so manifest review is limited to confirming the README's constructor-argument table matches the constructors; the mined hook salt and live-PoolManager fork simulation remain service evidence, as the changelog already records.

The static-analysis leads (arbitrary send, reentrancy, unused returns) were each traced; the sends go to merkle-committed or storage-keyed destinations and the reentrancy paths are closed by guards or revert atomically, so none was promoted. Output is in .imd-findings.json with the finding and 45 coverage rows.

The review is complete. The findings record is at .imd-findings.json in the repository root, and no tracked file was changed. Only the ignored scratch directory and the findings file were written.

Outcome. The audit holds up. Every specialist finding reproduced against the code, none rises above low, and my own pass with the Pashov and Trail of Bits checklists found nothing the four specialists missed. The project's 182 tests pass, the ABI exports match the build, and formatting is clean. The manifest validates against the schema and discloses both roles that resolve from $owner.

Kept findings, after merging duplicates.

• Low. Recipient check only rejects the zero address. A curve sell paid to the factory passes the factory's receive guard and strands the seller's ETH, contradicting the README guarantee. Merged from the permissions and flow specialists, who reported the same root cause from either side. Reproduced with exact amounts.
• Low. Unprotected buy and sell overloads. They hard-code zero minimum output and no deadline. The sandwich reproduction matched the economics specialist's numbers to the wei.
• Low. Hook takes its ETH fee before the trader settles. A swap whose fee exceeds the PoolManager's native balance reverts. Reproduced, including the exact wrapped revert selector, and the control that the same swap succeeds once the manager holds more ETH.
• Five info items recorded as trust assumptions or documented economic properties, each with a reproduction: the updater's one-leaf drain of the worker pot combined with the perpetual genesis-creator share, look-alike pool bindings on the shared hook, crown price compounding, the fee-free parallel pool a transferable token allows, and fee truncation below 100 wei.

What I verified myself beyond the specialists. The deployment-floor opcode scan passes on every runtime, which the project's own tests did not actually check despite the README saying so. The curve's 150k-gas fee delivery never defers even on the coldest storage path. Graduation succeeds across fuzzed buy and sell paths and with stranded ETH in the factory. The static-analysis leads about reentrancy, arbitrary sends and hash collisions were each traced and dismissed as guarded or structurally impossible.

Coverage. All 40 entry points have a verdict, with 32 holding and 8 pointing at a finding, plus three invariant rows. No entry point is unreached. No finding carries a proof file, since none is high or critical.