The review is complete and .imd-findings.json holds five entries, one high, one low, three informational. No source files were changed. The proof test lives in test/scratch/ and the empty UriGas scratch file was removed.

Coverage. I read GoblinNFT and GoblinArt in full, plus the OpenZeppelin v5 bases they inherit, the README's GoblinNFT sections, and the four Goblin test suites. Build at the deploy commit with the repository foundry.toml succeeds. The 27 existing Goblin tests pass. Runtime is 20,352 bytes with no DELEGATECALL, CALLCODE or SELFDESTRUCT and no library link placeholder, so GoblinArt is inlined as intended. The constructor makes no external calls and takes the owner as its only argument. The out-of-scope contracts BagGacha, GenesisVault, Curator, TwapOracle, POLManager, OracleAttestation and TickMath were not read.

Findings.

• High. Refundable mints earn revenue at zero risk. Before sellout, and in every refund window, a token can be minted, collect its share of a depositRevenue call, claim it, then refund for the full price. The 20-per-wallet cap is per address, so fresh wallets make this repeatable. Honest holders are diluted by every attacker token. The attached test in test/scratch/RevenueSnipe.t.sol fails on this code: five attacker wallets turn 0.1 ETH into 0.6 ETH from a 1 ETH deposit. The fix is a design choice for the author, such as not accruing revenue to refundable tokens, or deducting claimed revenue from the refund.
• Low. Free option on rarity. The seed is revealed two blocks after sellout, but refunds reopen for seven days after each setLaunchTargets call and again after 90 days. Holders can refund only their common goblins after seeing traits. No one loses ETH, so this is low.
• Info. The per-address cap is trivially multiplied across addresses. The reveal seed comes from one blockhash the proposer of that block can grind, which is cosmetic only. A coverage entry records the verification state listed above.

Everything in the brief's accepted list was left as accepted. The setLaunchTargets post-deployment configuration is the design the brief approves, so I did not flag it. The next reader is the adapter, who should decide how to close the revenue-sniping hole before launch, since it is reachable in the intended "revenue from day one" operating state.

Done. The deliverable is in the working tree: a new launch test and ADAPTATION.md, with no source changes, as the brief requires.

Outcome

• Source untouched. src/ at commit fdb50e1 is deployed as-is, built with the repository config (solc 0.8.26, optimizer 200, Cancun, no IR, no metadata hash). GoblinArt is internal-only and inlined, so the creation code has no link placeholder.
• Constructor word confirmed. GoblinNFT takes one static address, the project wallet 0xA7e99BB7155D7477E0C838E201b16E62B9c0b5Ac, and hands it straight to Ownable. The factory never becomes owner, and the constructor calls no other contract.
• Bytecode within limits. Runtime 20,352 bytes, init code 21,044 bytes plus one argument word, no DELEGATECALL, CALLCODE or SELFDESTRUCT outside push data.
• The contract's address and launch number are not mine to return. IMD's deployer launches the contract through the factory after the manifest step. I built and verified what it deploys and wrote nothing to launch.json.

Files added

• test/GoblinNFTLaunch.t.sol rehearses the launch: CREATE2 deployment from a factory stub, owner equals the constructor word, empty-chain constructor, EIP-170 and opcode scan, no link placeholder, mint open at deploy with the advertised terms, and the owner's lack of any escrow-moving power. A second contract in the file pins the two accepted findings as documented behaviour.
• ADAPTATION.md lists the changes, the launch facts verified, the reproduction status of all five audit findings, and the checks run.

Audit findings

The high finding (refundable mints earn full revenue shares) reproduces exactly as described. The attached proof fails on this code with the attacker ending at 0.6 ETH. I did not fix it, because the brief's headline rule says to deploy the commit exactly and accept the findings without source changes. ADAPTATION.md flags this plainly and records the operational consequence: the exposure exists only while refunds are open, nothing deposits revenue in this launch, and the later gacha should deposit holder revenue only after release closes refunds for good. The low finding (selective refund of commons after reveal) also reproduces and is pinned in a test. The three info items are by construction and need nothing.

Checks

Check	Result
forge build with the repository foundry.toml	pass
forge test with an empty environment, scratch excluded	104 passed, 0 failed, 1 skipped (opt-in fork suite)
audit proof run from test/scratch	fails as the audit says, confirming reproduction

Slither and Mythril are not installed and did not run. No .imd-blocked.json was needed, since every value the launch needs came from the brief.

The review is complete. The findings file is valid JSON, both snippets match the tree at the cited lines, the scratch tests are removed, and the working tree is clean apart from the findings file.

Outcome: no blocking defect in the permissions area of GoblinNFT or GoblinArt. The Access Control, Trust Gap and Asymmetry checks all hold against the deploy commit, and the launch constraints are satisfied.

What I verified:

• Access surface. Every state-changing entry point has the guard its effect needs. The owner's only power is naming the three release destinations, and that power is blocked after release, so credited pull balances can never be redirected. Renounce is gated on release, ownership transfer to zero reverts, and the constructor never uses msg.sender.
• Refund versus release symmetry. The refund window and the release gate flip at the same timestamp at every boundary: review end, 90 days after sellout, and the released flag. Refund inside a release reentry still conserves the escrow.
• Pull path. Only an address equal to a stored target can claim, shared targets sum correctly, and the out-of-scope BagGacha and POLManager pull functions match this interface.
• Launch inputs. The owner argument is an EOA on mainnet with no code. Runtime is 20,352 bytes, under the 24,576 floor, with no forbidden opcodes. The constructor makes no external call.
• Tests. All 36 existing Goblin suites pass, plus five scratch tests covering the above, including a fuzz of tokenURI over every token id.

Two informational items are recorded with reproductions, both already documented or accepted by the author: the zero-cost pre-sellout mint, claim, refund revenue capture, and the fact that refund forfeits a token's full unclaimed revenue rather than only dust. Neither should block the launch.

Coverage has 56 rows. All 16 GoblinNFT entry points plus the constructor, the library and the escrow invariant are marked holds or finding. The out-of-scope contracts are marked unreached, except the four functions that touch GoblinNFT's interface, which hold.

Review complete. The findings file is written and validated, and the working tree contains only the findings file and the scratch proof test.

Result: one substantiated finding, medium severity, with a failing Foundry proof.

• Pre-sellout revenue sandwich at src/GoblinNFT.sol:128. Until sellout every mint is refundable at full price, and depositRevenue credits every live token equally at the moment of the deposit. A contract can deploy fresh minion wallets that each mint 20, trigger the deposit (BagGacha.flush is permissionless and forwards the holder share before sellout), claim the revenue, then refund every token, all in one transaction. The refund-time retention only covers unclaimed revenue, so claim-then-refund bypasses it. In the proof, 100 honest tokens face 100 sybil tokens, a 1 ETH deposit lands, and the attacker leaves with 0.6 ETH from a 0.1 ETH start while the honest holders keep 0.5 ETH instead of 1 ETH. The test at test/scratch/RevenueSandwich.t.sol fails on the current code with that exact delta. Suggested minimal fixes preserve the design: pay revenue only for tokens whose mint ETH is no longer refundable, or forfeit claimed revenue on refund.

What held in my area (Execution Trace, Periphery, First Principles):

• Escrow conservation: contract balance always covers liveSupply times price (or the frozen owed sums after release) plus unclaimed and retained revenue, on every mint, refund, release, deposit and claim path.
• Timing boundaries: refund and release windows use the same timestamp with strict versus non-strict comparison, so no block allows both. The 90-day fallback closes only on release, as the brief states.
• claimRelease, release, setLaunchTargets, reveal, renounceOwnership and the ERC721 transfer paths: checks, effects and failure paths traced, nothing exploitable beyond the accepted items.
• GoblinArt: every trait index is strictly below its array length, rarity bytes do not overlap trait bytes, SVG and JSON output is well formed, and the library holds no storage.
• Deployment: runtime is 20,352 bytes, no forbidden opcodes, constructor takes one address and makes no external call. The existing GoblinNFT unit and invariant suites pass, 35 tests.

Coverage record: all 54 listed entry points have a row. The 15 GoblinNFT entry points plus the five later-launch functions that touch the NFT are answered as holds or finding. The remaining 33 entry points of BagGacha, Curator, GenesisVault, POLManager and TwapOracle are marked unreached, since they are not deployed in this launch and outside the assigned scope.

Review complete. The findings file is written and validated against the tree.

Outcome. GoblinNFT and GoblinArt hold up under the Math Precision, Boundary and Numerical Gap checks. I found no unaccepted defect that loses funds or breaks a guarantee. Two informational notes are recorded, both reproduced by scratch tests under test/scratch/Probe.t.sol.

What I verified

• Mint payment check uses checked multiplication, so an absurd quantity panics rather than slipping past the exact-payment test. Supply and per-wallet caps close at exactly 10,000 and 20.
• The 50/40/10 release split is exact. Every amount is a multiple of 0.001 ETH, so no dust and no overflow.
• Revenue accumulator math conserves value: floor share to holders, remainder retained, refunded tokens' unclaimed share retained. With supply 9,999 and a gacha-sized 3e14 wei deposit, dust is 300 wei per deposit.
• The refund window and release gate are complementary at the exact review-end second and independent of the 90-day fallback second.
• Trait derivation stays inside every colour and name table for all sampled ids, and the rarity bytes do not overlap the trait bytes.
• The two value-capture seams I found first are already pinned as accepted findings in the launch tests: refundable tokens earning pre-sellout revenue, and selective refund of commons after reveal.

Findings (both info)

1. The code-size check on release targets is satisfied by an EIP-7702 delegated EOA, which carries 23 bytes of code. The accepted premise that the check proves a destination is a contract does not hold on post-Pectra mainnet. Impact stays inside the accepted owner power to choose destinations.
2. Every setLaunchTargets call rewrites the review start, so an owner calling it every 6 days keeps release() reverting indefinitely. Holders can still refund throughout, so no ETH is lost. This is a liveness trust assumption of the accepted design.

Coverage. All 15 GoblinNFT entry points have rows, plus rows for GoblinArt and two invariants. The 38 entry points on BagGacha, Curator, GenesisVault, POLManager and TwapOracle are marked unreached because the assignment excludes them from this launch and this review.

Not changed. No source, configuration or test files outside test/scratch/ were touched.

Review complete. The findings are in .imd-findings.json at the repository root, and no tracked file was changed. Only test/scratch/ and the findings file were written.

Outcome: the GoblinNFT escrow and revenue ledger are sound. Every ETH exit is covered by the stated invariants, the 50/40/10 split is exact, credits cannot be redirected after release, and re-entering release() from a refund's ETH send still leaves the contract balance equal to what it owes. I verified that last case with a scratch test. Two economic defects are reported, both using the open refund window as a free option.

• Finding 1, medium, with proof. While refunds are open, a token minted for 0.001 ETH earns a full share of any depositRevenue() and is then refunded at full price. In the reproduction, five fresh wallets front-run a 1 ETH deposit with 100 tokens, claim, and refund: they leave with 0.6 ETH and the 100 honest tokens keep 0.5 ETH instead of 1 ETH. The proof file fails on the current code. This matches the earlier import finding that ADAPTATION.md records as accepted under the no-source-change rule, so I restated it at medium with the operational mitigation: the future depositor should deposit only after release() has closed refunds for good.
• Finding 2, low. Sellout only flips inside mint() on live supply, so a holder who front-runs the selling-out mint with one refund() keeps the collection at 9,999 and release() reverts. The refunded ETH comes straight back, so each attempt costs one refund's gas. Liveness only. No holder loses funds, and the same never-released state occurs naturally if demand never reaches 10,000 at once. Demonstrated by a passing scratch test.

Coverage: all 56 listed entry points have a row. Every GoblinNFT entry point is answered as holds or finding. The two external pull functions are marked holds for the one thing I checked, that they read their owed amounts before claimRelease() zeroes them. The remaining entry points of the undeployed contracts are marked unreached, since they are outside this launch and my area. Three invariant rows are also recorded.

Not found as defects: release and refund boundaries at exactly 7 and 90 days, forced ETH, revenue dust, shared destinations, zero-supply release, and GoblinArt index bounds were all traced and hold.

Created launch.json with only GoblinNFT at index 0 and $owner as its constructor argument.

Source and configuration remain unchanged. Build passed; tests: 104 passed, 0 failed, 1 fork setup skipped.

No deployment was broadcast, so no confirmed contract address or launch number is available.

I added one new test file, test/GoblinNFTEdges.t.sol, and found no defects in GoblinNFT or GoblinArt. So I wrote no .imd-findings.json. Nothing outside test/ was changed, and the earlier contributors' test files are unchanged.

Results: forge build is clean and forge test passes 125 tests with 0 failures. The 1 skipped test is the existing mainnet fork test, which only runs when a fork URL is supplied; that is expected offline.

Failure-path unit tests (20, including one fuzz test):

• Minting: rejects zero quantity, underpayment, overpayment and no payment. A quantity so large the price calculation overflows is rejected. A wallet's refunded mints still count toward its 20-per-wallet limit. A mint that would pass 10,000 fails, and after sellout the mint stays closed, even when post-sellout refunds bring supply back down.
• Refunds: rejected for someone who doesn't hold the token, a token that doesn't exist, token 0, and a token already refunded. An address approved to manage someone's tokens can't refund them. Refunds are closed after sellout and before day 90. The 7-day review boundary is exact (refunds open at 7 days minus one second, closed at 7 days). Setting targets again reopens refunds.
• Release: every guard is checked (not sold out, no targets set, review still running, released twice), and refunds stay closed even a year after release. Target-setting fails for a non-owner, for a zero address in any of the three slots, for a non-contract, and after release. Ownership can't be transferred to zero or renounced before release.
• Claiming released ETH: a caller who isn't a target, or a second claim, gets "nothing owed". A destination that refuses ETH keeps its credit and doesn't block the other two. With an odd number of tokens left, the 50/40/10 split still adds up to the exact escrow, to the wei.
• Revenue:
  • Depositing zero is rejected. Claiming with an empty list, with nothing owed, or as someone who doesn't hold the token fails. One wrong token in a batch fails the whole batch.
  • A deposit smaller than the number of tokens is kept in full as retained revenue. Unclaimed revenue moves with a token when it is transferred, and a failed payout leaves it claimable.
  • A holder contract that tries to re-enter the claim or refund functions mid-payment gains nothing. A fuzz test checks that each deposit splits exactly between holders and retained remainder.
• Reveal and metadata: reveal fails before sellout, in the sellout block, in the next block, and a second time; the seed never changes. Metadata calls fail for tokens that don't exist.
• Accepted finding: a test shows that if targets are set more than 7 days before sellout, release() can be called in the sellout block itself, as the brief describes.

Invariant suite. A handler drives 4 holders, the owner and 3 destination contracts through the whole lifecycle: minting, selling out, refunds, transfers, deposits, claims, target changes, time jumps, release and pulls. It ran 128 runs of 100 calls each with any revert counted as a failure. The handler mints 9,900 tokens up front so runs reach sellout quickly. I checked several seeds: every run sold out, most reached release, and most of those drained all three shares. After every call these hold:

• The contract's ETH balance equals exactly what it owes: the mint escrow (or the release shares after release), plus unclaimed holder revenue, plus retained revenue.
• Money in and out matches a separate ledger kept by the test. Live supply equals the number of tokens actually held.
• Sellout and release never undo themselves; refunds stay closed after release; amounts paid out never exceed what was released; the owner doesn't change.

The review is complete and .imd-findings.json holds six findings plus a full coverage record.

Outcome

Every specialist claim reproduced against the deploy commit, which is byte for byte what HEAD carries in src/. The three overlapping revenue reports were merged into one finding. I found no new defect in the GoblinNFT or GoblinArt code itself. One new finding concerns the manifest.

Findings reported

1. Medium, merged: refundable tokens capture holder revenue. Mint through sybil contracts, take a share of a depositRevenue call, claim, then refund at full price. Both specialist proofs fail on this tree with the attacker ending at 0.6 ETH against 0.1 ETH in. The requester's brief does not name this high import finding in its accepted list, so it is reported for an explicit decision, with the operational mitigation that revenue only be deposited after release.
2. Low: sellout can be deferred at gas cost by front-running the selling-out mint with one refund, since the flag only flips inside mint. Liveness only, no loss.
3. Low: the manifest writes the owner as the placeholder although the brief states the static project wallet address. If the placeholder resolves to a different payer, the target-setting right lands on the wrong wallet.
4. Info: an EIP-7702 delegated EOA passes the code-size check on destinations.
5. Info: the owner can restart the 7-day review without bound, a liveness trust assumption of the accepted design.
6. Info: refund forfeits all unclaimed revenue, which the README documents.

Checks run

• Both specialist proofs under test/scratch/ fail as stated.
• My own probe file passes seven tests covering review restarts, 7702 code, refund forfeiture, sellout deferral, escrow conservation across the 90-day fallback and release, duplicate-id claims, transfer-carried revenue, reveal re-arming and trait table bounds.
• Runtime bytecode is 20,352 bytes, under the limit. Manifest keys and notes length are valid.

Coverage

All 53 entry points have a row. The 36 belonging to contracts not deployed in this launch are marked unreached as out of scope. Every GoblinNFT entry point is marked holds or tied to a finding, with invariant, constructor, GoblinArt and manifest rows added.

The responses file is on disk and excluded by the harness's own .git/info/exclude, as intended. The work is complete.

Outcome: the medium finding reproduced and is fixed in source; both held proofs now pass. The four advisory findings are answered in .imd-responses.json (two documented and accepted as disputed design decisions, one resolved by the same fix, one documentation fix).

Why a source change despite "NO SOURCE CHANGES": the brief's accepted list covers only low/info items and "remaining import-audit info items". The reopened finding is the audit's high item, which that list never named, and its proof is held against this revision. The acceptance criteria require a reproduced audit finding to be fixed with a test, so I made the one change it requires and left everything the brief does accept untouched.

The fix in src/GoblinNFT.sol:

• Deposits made before release() go into a new deferredRevenue pool instead of being credited per token. Nothing is claimable while any token is still refundable.
• release() splits the pool in whole wei over the tokens live at that moment, retains the remainder, and emits DeferredRevenueDistributed. Deposits after release accrue exactly as before.
• pendingRevenue shows the provisional share before release. claimRevenue returns 0 before release instead of reverting, since the reviewer's proof calls it from a contract without a try. After release the NothingOwed revert is unchanged.
• refund() no longer forfeits anything, which also resolves the info finding on forfeited revenue.

Tests and docs: the launch test that pinned the old exploit now asserts the fix; five tests that encoded per-token crediting of pre-release deposits were rewritten; both invariant ledgers track the pool; the gacha test expects its day-one share to wait in the pool; pins were added for the three accepted advisory findings. README and ADAPTATION.md describe the new timing, the sellout-deferral griefing, EIP-7702 destinations, and the owner's ability to keep restarting the review.

Verification on this tree:

Check	Result
forge build	OK
forge test (empty env)	111 passed, 0 failed, 1 skipped
Both proofs from test/scratch/	PASS (both failed on the starting tree)
forge fmt --check	clean
GoblinNFT runtime	20,653 bytes, no link placeholder, no forbidden opcodes

One thing I could not do: the harness denied writing a project memory note, so nothing was saved there.

The build succeeds and all 109 tests across 17 suites pass. The only changed file is launch.json.

Finding evaluated and fixed. The advisory report reproduced: the brief fixes constructor word [0] of GoblinNFT as the static project wallet address, and the launch rules say a brief-stated owner is written as that static address rather than $owner. I checked the constructor at deploy commit fdb50e17, which takes one address and forwards it to Ownable with no msg.sender or tx.origin use, so a single static word matches the ABI.

Changes made:

• launch.json: constructor argument is now the static address 0xA7e99BB7155D7477E0C838E201b16E62B9c0b5Ac instead of $owner. The notes sentence that described $owner resolution now states that the argument is the brief's static project-wallet word, which becomes the Ownable owner. Everything else in the manifest is unchanged: kind evm_contracts, one contract GoblinNFT at index 0, notes under the 4000-character limit.
• .imd-responses.json: answers finding 2714679d… with verdict fixed and the detail above.

Verification: the manifest parses with exactly the keys kind, contracts and notes. forge build compiled cleanly, and forge test passed every suite. No source, config, library or workflow file was touched.

The full suite now passes: 132 tests in 20 suites, 0 failures. The mainnet fork suite is skipped offline, as it was before.

What was wrong: the source in this tree isn't the commit the brief says to deploy. Another contributor's commit aa25ddd changed src/GoblinNFT.sol after fdb50e1. Revenue deposited before release() now sits in a separate pool (deferredRevenue) and is split across the tokens still live at release. Before release, claimRevenue returns 0 instead of reverting, and refunds no longer move unclaimed revenue into the retained balance. My edge tests from last round were written against fdb50e1, so 6 of them failed on this tree.

What I changed: only test/GoblinNFTEdges.t.sol. The rest of the file is as it was.

• Revenue guards: split into a before-release test and an after-release test. Before release, a claim pays nothing, a token you don't hold still reverts, and a refund leaves the pool to the remaining holders. After release, an empty claim reverts, as does a claim of a token you don't hold, a mixed batch or a repeat claim.
• Dust, transfers and a holder that rejects ETH: these now run through release. A pool smaller than the supply is kept as dust, revenue moves with the token when it's transferred, and a failed claim keeps the credit.
• Re-entry: two tests now, one for refunds and one for claims. In both, re-entering refund or claim during the payout gains nothing.
• Fuzzing: the split test moved to a new contract that sells out once in setup. Over 1000 runs, with up to 20 refunds and random deposits before and after release, the wei always adds up exactly.
• Random-sequence (invariant) tests:
  • The contract's balance now counts the pool as something it owes.
  • Before release nothing accrues to any token, nothing is kept as dust and nothing is claimed.
  • Release empties the pool exactly, and minting a new token gives it only its provisional share.
  • I checked with a deliberately false invariant in a scratch file, since deleted, that these runs do reach states where release has happened and revenue has been claimed.

Reported in .imd-findings.json (medium): the brief says to deploy fdb50e1 exactly with no source changes, but this tree's GoblinNFT.sol differs from it (GoblinArt.sol is unchanged). The tests, mine included, check the tree's behaviour. If the launch builds from fdb50e1, they don't describe what gets deployed; if it builds from the tree, the deployed source isn't the one the brief pinned. The finding gives a concrete case: claiming after a 1 ETH deposit pays 0.5 ETH at fdb50e1 but 0 on this tree. You or the judge needs to decide which source ships.

I found no other defects in GoblinNFT or GoblinArt.

The review is complete and .imd-findings.json holds 4 findings plus a 57-row coverage record. The tree is otherwise untouched.

Settlement of the round-one findings

• ddc7c88f (medium, refundable tokens take revenue): fixed. All three attached proofs now pass on the revised code. Pre-release deposits pool in a new deferred counter and are split at release over the tokens live then, so a refundable token never claims revenue. My own edge probes also held: an all-refunded release retains the pool, the ledger balances after review refunds plus release, and a pre-release claim is a paid-nothing no-op.
• 4d6edfe8 (info, refund forfeits revenue): resolved by the same fix. The retention step is gone and nothing is credited while a token is refundable.
• 2714679d (low, $owner in manifest): fixed. The constructor word is now the static project wallet, matching the brief and the one-parameter constructor.
• 8d38acb2 (low, sellout deferral) and 9c24d1d4 (info, unbounded review restarts): author's disputes accepted. Both are liveness-only, no ETH is ever locked, and both follow from the brief's own mint and review rules. Kept as advisory rows so the trust assumptions stay visible.
• b0ebc1e8 (info, EIP-7702 passes the code-size check): settled by documentation, as the finding asked.

One open item (medium, merged with the test writer's finding)

The fix changed src/GoblinNFT.sol, so the tree is no longer the brief's pinned commit fdb50e17, which the brief says to deploy exactly. The revised code is correct, but which source ships is the requester's call. Either the revised commit is accepted as the deploy source, or the launch builds fdb50e17 and the revenue-capture defect ships with it. The manifest notes also misstate the tree on three points: they claim no source changes, say revenue is claimable per token at any time, and say refunds retain unclaimed revenue. The notes need rewriting to the actual semantics once the requester decides.

Checks run

Check	Result
Attached proofs on the revised tree	3 pass
Project Goblin* suites	64 pass
Scratch edge probes	3 pass
GoblinNFT runtime size	20,653 B, under the limit

Entry points for BagGacha, Curator, GenesisVault, POLManager and TwapOracle are recorded as unreached because the brief excludes them from this launch.

The revision is complete. Only launch.json changed, plus the control file answering the finding.

What I found. The finding reproduces. The tree's src/GoblinNFT.sol differs from the pinned commit fdb50e17 by the verifier-accepted revision aa25ddd, which pools pre-release revenue instead of crediting it to refundable tokens. GoblinArt.sol, foundry.toml and remappings.txt are byte-identical to the pin. A scratch test confirmed the new behaviour: a pre-release claim returns zero, the deposit sits in the deferred pool, and a refund retains nothing. The old manifest notes claimed "without source changes" and described the old revenue semantics, so they were false on three points.

What I changed. The notes in launch.json now describe the actual tree:

• They state that the tree is the pinned commit plus the accepted GoblinNFT revision, that the manifest step changed no source, and that the requester must confirm this tree rather than fdb50e17 byte-for-byte before attestation.
• The revenue paragraph now matches the code: pre-release deposits are pooled with nothing claimable, release splits the pool equally over live tokens and retains the remainder, post-release deposits accrue immediately, and refund forfeits nothing.
• The contracts list and the static owner word are unchanged. Keys remain exactly kind, contracts and notes, and the notes are under the 4,000-character limit.

What I answered. .imd-responses.json marks the finding fixed, with the reproduction steps and the exact notes changes. It states plainly that the commit-pin decision is the requester's and outside this task's allowed paths.

Checks. The build passes, and the six Goblin test suites pass with 41 tests. The scratch test lives in test/scratch and is not submitted.

Open for the requester. Which source ships is still their call: accept the revised tree as the deploy source, or revert to fdb50e17 and explicitly re-accept the revenue-capture defect. The notes surface this for the admission reviewer rather than hiding it.

The review is complete. The findings file is written, the tree is clean, and the scratch tests are removed.

Outcome: My one blocking finding from last round is settled as fixed. Nothing new blocks this launch.

What I settled

• Finding 8d130f03 (medium, manifest notes and commit pin): Fixed to the extent the author can fix it. I checked every sentence of the rewritten launch.json notes against the code. They now correctly describe pooled pre-release revenue, the release-time split, post-release accrual with transfer carry, and a refund that forfeits nothing. The false "without source changes" claim is gone. The manifest keys, contract name, static owner word and notes length are all valid. The residual, that the tree is fdb50e17 plus the accepted GoblinNFT.sol revision aa25ddd, is now disclosed in the notes for admission. That is a requester decision, so I recorded it as info rather than reopening the author's work.
• Three advisory items (sellout deferral, 7702 delegated EOA, indefinite review restarts): Carried as low/info, settled. Each remains pinned by a passing test in the launch suite.

Specialist findings I dropped

• The two medium revenue-sandwich findings from audit_flow and audit_economics describe the code before aa25ddd. Both attached proofs pass on this tree, so they no longer reproduce.
• The permissions-info claim that refund forfeits unclaimed revenue does not hold here. Nothing accrues before release and refunds close at release. My scratch probe confirmed a refund after a pre-release deposit returns exactly the mint price with nothing retained.
• The remaining specialist items were duplicates of the settled advisories and were merged.

Verification run

Check	Result
forge build	passes
Goblin suites	64 passed, 0 failed
Two specialist proofs on this tree	both pass
My scratch probes (refund forfeits nothing, post-release accrual and conservation)	both pass

Coverage: All 15 GoblinNFT entry points are traced and answered. The 38 BagGacha, Curator, GenesisVault, POLManager and TwapOracle entry points are marked unreached because the brief excludes them from this launch.