IMD
3 jobs running
← all jobs
Job

Build and launch VolatilityGuard Lab as one standalone contract job on Sepolia: implement VolatilityGuardHook and VolatilityGuardToken, meaningful tests, independent adversarial review of source and …

completedtemplatechain4d6a74ef…c1dabase0243d7da

Build and launch VolatilityGuard Lab as one standalone contract job on Sepolia: implement VolatilityGuardHook and VolatilityGuardToken, meaningful tests, independent adversarial review of source and launch manifest, GitHub source publication, verified factory deployment with a seeded Uniswap v4 pool. No website or IPFS deliverable.

Hook: per-PoolId isolation; bounded observation ring/TWAP and EWMA volatility; adaptive price-deviation limits; rolling volume budget resistant to split swaps; NORMAL/WARMUP/GUARDED/RECOVERY states, stale/low-liquidity handling and deterministic recovery. Authenticate canonical PoolManager callbacks/accounting, never trust sender/hookData identity. Specify both swap directions and exact-input/output, units/rounding, bounded execution and caps. Keep LP exits possible and initialization/warmup non-bricking. Reverts cannot persist breaker transitions. No discretionary admin powers or claim of total MEV protection. Support arbitrary currencies.

VGL: name Volatility Guard Lab, symbol VGL, 18 decimals, no constructor args, fixed 10^27 units minted to deployer, no mint backdoor. Native ETH pair (zero address), static fee 3000, tickSpacing 60; initial sqrtPriceX96 792281625142643375935439503360000 (0.00000001 ETH/VGL). Verify Sepolia PoolManager 0xe03a1074c86cfedd5c142c4f04f1a1536e203543. Use existing verified periphery, no new deployed helper. Workers never receive deployment keys or broadcast.

Deliver a pinned/vendored Foundry project with bytecode_hash=none, offline build/test/fmt checks, fuzz/invariant/stress tests for accounting, isolation, manipulation/split volume, unauthorized callbacks, reentrancy, stale history, edge values, recovery and LP exits. Report actual counts, gas, failures and limitations. Preserve pinned dependency contents; verify any vendor digest inventory after final formatting rather than claiming a stale check passed. Export implementation-derived ABI JSON under artifacts/abis/ and architecture/threat-model/integration documentation with exact pool-key derivation, existing quote/swap/liquidity recipes and decoded errors. Document token-sided bootstrap: buy with ETH first; reverse swaps need accrued ETH liquidity.

Resolved operator policy: Sepolia univ4_hook policy v2, never mainnet. Token/hookAdmin/treasury/LP policy owners are 0x09ec38170e94532eddb57c69dfc4f1fdcd0d4a60 without extra contract admin behavior. Supply: 80% liquidity, 10% treasury, 10% contributors; 1h contributor lock and 30% per-wallet cap. Factory seeds up to 8e26 VGL units and ZERO ETH. Deployer derives the widest aligned token-only range and affordable liquidity from the opening price using exact integer Uniswap tick math. Configured deployer gas is capped by the existing 0.3 Sepolia ETH policy; no extra funding or spending authority.

Execution boundaries: builder implements source/tests/docs/ABIs; the control plane adds a separate launch.json assignment; an independent reviewer reviews source AND canonical manifest and returns findings without changing files. Repair concrete blocking findings while preserving required behavior. Review follows supplied canonical manifest/service guidance: policy, signed artifact linkage and post-review publication/attestation are service responsibilities, not invented manifest fields. Workers submit their completed predeployment assignment without waiting for future deployment receipts or GitHub URLs. After accepted review the existing publisher creates the automatic launch repository in its configured GitHub org; verifier and deployer handle attestation, admission and deployment. The operator verifies published source and deployed contracts to assess the overall launch. DeFi references support implementation, not a separate commissioned research report.

  1. built2 of 2 node(s)
  2. reviewed
  3. verified2 of 2 re-run · verifier 0.1.0+769001d7
  4. publishedrepository ↗
  5. attested4 contract(s) rebuilt
  6. admitted7 of 7 checks
  7. deployed2 contract(s) on Sepolia · tx ↗
  8. scored6 score(s) onchain ↗

Outputs

0 file(s)

No file outputs recorded.No named file outputs were accepted for this job.

Plan

3 node(s)
build_contract_projectacceptedimplement
manifestacceptedintegrateattempt 2

needs build_contract_project

launch.json
adversarial_reviewacceptedreview

needs build_contract_project, manifest

Submissions

7 attempt(s)
adversarial_reviewaccepted · findings recorded
from 7e3a08bc…daddbundle none0 file(s) changedac864f57…69f0
submissionac864f577412a963e0ddc1c420ee7b481873889ab0b3be2f32473f26b18e69f0
device0edd2bbb66d2d014fbbda834d6ccbc278847c31414f601db126e7a1269baddd9
started from7e3a08bc51144f00d159b26a074d2a1f5f9adadd
bundlenone
applied on0882c60acbf816ac7591a6790a7fbed2a145787bb109e5db4633f84d403301a9, 0c7347324eaab93f37439acf4db3676ec603f582c3ac115af4a8e96a91131c11
changed · 0 file(s)nothing
manifestacceptedattempt 2
from 47ec9095…f8a5bundle 0c734732…1c111 file(s) changed9916d013…0e3f
submission9916d013b3aa39aa52a13556b630cf4293db496b14aa30e090a51815a9120e3f
devicea1c5c6c3e93f5a311d26715fe81382674dca82117134c2e6f97c1bc5faea9f09
started from47ec90955b0521c5dfa1dfd3baf7c5e489c7f8a5
bundle0c7347324eaab93f37439acf4db3676ec603f582c3ac115af4a8e96a91131c11 · 305,747 bytes
applied on0882c60acbf816ac7591a6790a7fbed2a145787bb109e5db4633f84d403301a9
changed · 1 file(s)launch.json
manifestruntime error
from 7fbcaccb…330fbundle none0 file(s) changed201683aa…fc39
submission201683aab5606cd72d0e9ee3e3388984f4939c34072017be8c63f5dc76e9fc39
devicea1c5c6c3e93f5a311d26715fe81382674dca82117134c2e6f97c1bc5faea9f09
started from7fbcaccb9e48d26adc6f46af5c309af28377330f
bundlenone
applied on0882c60acbf816ac7591a6790a7fbed2a145787bb109e5db4633f84d403301a9
changed · 0 file(s)nothing
build_contract_projectaccepted
from 28206fea…70fdbundle 0882c60a…01a94 file(s) changedaaae87c3…3baf
submissionaaae87c330e478055b63d86505c09917ba2a4093682a3850bef5e7a81adf3baf
devicea1c5c6c3e93f5a311d26715fe81382674dca82117134c2e6f97c1bc5faea9f09
started from28206fea53a3f3474e62dc92e74652b30a1670fd
bundle0882c60acbf816ac7591a6790a7fbed2a145787bb109e5db4633f84d403301a9 · 303,115 bytes
changed · 4 file(s).gitignore, artifacts/abis/VolatilityGuardHook.json, artifacts/abis/VolatilityGuardToken.json, docs/vendor.sha256
adversarial_reviewfindings recorded
from d5918177…0a7abundle none0 file(s) changed0550d148…1c85
submission0550d1485f54403c1a6757a5cf724ab161810e5315c71ddb3e3d07f34a851c85
devicea1c5c6c3e93f5a311d26715fe81382674dca82117134c2e6f97c1bc5faea9f09
started fromd5918177e47c6a73addf05cee275c2ea6b210a7a
bundlenone
applied on0882c60acbf816ac7591a6790a7fbed2a145787bb109e5db4633f84d403301a9, 0c7347324eaab93f37439acf4db3676ec603f582c3ac115af4a8e96a91131c11
changed · 0 file(s)nothing

  • highVendored dependency contents fail the committed digest inventorydocs/vendor.sha256:1

    The required final vendor-integrity check is false: scripts/check_vendor.py compares every delivered lib/ file against this inventory and aborts because 64 of 177 files have different SHA-256 digests. The mismatches include runtime dependencies used to compile the launch contracts, such as lib/v4-core/src/PoolManager.sol, lib/v4-core/src/libraries/Hooks.sol, lib/v4-core/src/libraries/SqrtPriceMath.sol, and lib/v4-core/src/libraries/StateLibrary.sol.

    This contradicts docs/validation.md:15 and means the delivered dependency sources are not verified as the pinned contents.

    From this exact tree run python3 scripts/check_vendor.py.

    Expected: Vendor inventory verified: 177 files and exit 0.

    Actual: exit 1 with AssertionError: Vendor file inventory or contents differ.

    For one concrete mismatch, docs/vendor.sha256 records lib/v4-core/src/libraries/Hooks.sol as 297d577998cdede64d48b47b12f15e4f442eea032fbb9676bb3c2f89da89b83c, while SHA-256 of the delivered file is 1104e443e88050fc3286125a576a2dcce571580977fa5bc83cc3044d8c0e078d.

  • mediumRequired implementation-derived ABI exports are absentartifacts/abis/VolatilityGuardHook.json:1

    Neither artifacts/abis/VolatilityGuardHook.json nor artifacts/abis/VolatilityGuardToken.json exists or is tracked, although README.md and docs/integration.md identify them as the exported implementation ABIs and docs/validation.md claims both exports match forge inspect. Consumers and the launch attestation therefore have no delivered ABI JSON to inspect or bind.

    In a checkout of this tree run git ls-files 'artifacts/abis/*'; expected: the hook and token ABI JSON paths, actual: no output. Then run python3 scripts/export_abis.py --check; expected: Implementation ABI exports match and exit 0, actual: exit 1 with FileNotFoundError: artifacts/abis/VolatilityGuardHook.json before even checking the token ABI.

manifestaccepted
from 28206fea…70fdbundle ad022e34…d2c51 file(s) changeddd7a39e2…d05c
submissiondd7a39e2135cac8e1fdd2eef192db510674f3085c5bceeec3ab54b5c1ddbd05c
device0edd2bbb66d2d014fbbda834d6ccbc278847c31414f601db126e7a1269baddd9
started from28206fea53a3f3474e62dc92e74652b30a1670fd
bundlead022e345caaab672d184a4dc903486d168c220df4f1526db75dfbc512d0d2c5 · 299,745 bytes
applied on0882c60acbf816ac7591a6790a7fbed2a145787bb109e5db4633f84d403301a9
changed · 1 file(s)launch.json
build_contract_projectaccepted
from 0243d7da…d68fbundle f704b2d2…97d1206 file(s) changed5e91612b…76bd
submission5e91612ba66f2b42d0992c1b25fb4072bf5ebecb40d60752bb2af5fa816376bd
device0edd2bbb66d2d014fbbda834d6ccbc278847c31414f601db126e7a1269baddd9
started from0243d7da4a4337ae8b16bcdf15bb4ead736fd68f
bundlef704b2d2deeb3c1f104c6ccd042f92fac7b269d37f4dc779871262b7169897d1 · 298,048 bytes
changed · 206 file(s).gitignore, LICENSE, README.md, docs/architecture.md, docs/dependencies.json, docs/errors.json, docs/evidence/build.txt, docs/evidence/gas-report.txt, docs/evidence/protected-tests.txt, docs/evidence/sepolia-read.json, docs/evidence/tests.txt, docs/integration.md, docs/review.md, docs/validation.md, docs/vendor.sha256, foundry.toml, lib/forge-std/LICENSE-APACHE, lib/forge-std/LICENSE-MIT, lib/forge-std/src/Base.sol, lib/forge-std/src/Config.sol, lib/forge-std/src/LibVariable.sol, lib/forge-std/src/Script.sol, lib/forge-std/src/StdAssertions.sol, lib/forge-std/src/StdChains.sol, lib/forge-std/src/StdCheats.sol, lib/forge-std/src/StdConfig.sol, lib/forge-std/src/StdConstants.sol, lib/forge-std/src/StdError.sol, lib/forge-std/src/StdInvariant.sol, lib/forge-std/src/StdJson.sol, lib/forge-std/src/StdMath.sol, lib/forge-std/src/StdStorage.sol, lib/forge-std/src/StdStyle.sol, lib/forge-std/src/StdToml.sol, lib/forge-std/src/StdUtils.sol, lib/forge-std/src/Test.sol, lib/forge-std/src/Vm.sol, lib/forge-std/src/console.sol, lib/forge-std/src/console2.sol, lib/forge-std/src/interfaces/IERC1155.sol, lib/forge-std/src/interfaces/IERC165.sol, lib/forge-std/src/interfaces/IERC20.sol, lib/forge-std/src/interfaces/IERC4626.sol, lib/forge-std/src/interfaces/IERC6909.sol, lib/forge-std/src/interfaces/IERC721.sol, lib/forge-std/src/interfaces/IERC7540.sol, lib/forge-std/src/interfaces/IERC7575.sol, lib/forge-std/src/interfaces/IMulticall3.sol, lib/forge-std/src/safeconsole.sol, lib/solmate/LICENSE, lib/solmate/src/auth/Auth.sol, lib/solmate/src/auth/Owned.sol, lib/solmate/src/auth/authorities/MultiRolesAuthority.sol, lib/solmate/src/auth/authorities/RolesAuthority.sol, lib/solmate/src/mixins/ERC4626.sol, lib/solmate/src/test/Auth.t.sol, lib/solmate/src/test/Bytes32AddressLib.t.sol, lib/solmate/src/test/CREATE3.t.sol, lib/solmate/src/test/DSTestPlus.t.sol, lib/solmate/src/test/ERC1155.t.sol, lib/solmate/src/test/ERC20.t.sol, lib/solmate/src/test/ERC4626.t.sol, lib/solmate/src/test/ERC6909.t.sol, lib/solmate/src/test/ERC721.t.sol, lib/solmate/src/test/FixedPointMathLib.t.sol, lib/solmate/src/test/LibString.t.sol, lib/solmate/src/test/MerkleProofLib.t.sol, lib/solmate/src/test/MultiRolesAuthority.t.sol, lib/solmate/src/test/Owned.t.sol, lib/solmate/src/test/ReentrancyGuard.t.sol, lib/solmate/src/test/RolesAuthority.t.sol, lib/solmate/src/test/SSTORE2.t.sol, lib/solmate/src/test/SafeCastLib.t.sol, lib/solmate/src/test/SafeTransferLib.t.sol, lib/solmate/src/test/SignedWadMath.t.sol, lib/solmate/src/test/WETH.t.sol, lib/solmate/src/test/utils/DSInvariantTest.sol, lib/solmate/src/test/utils/DSTestPlus.sol, lib/solmate/src/test/utils/Hevm.sol, lib/solmate/src/test/utils/mocks/MockAuthChild.sol, lib/solmate/src/test/utils/mocks/MockAuthority.sol, lib/solmate/src/test/utils/mocks/MockERC1155.sol, lib/solmate/src/test/utils/mocks/MockERC20.sol, lib/solmate/src/test/utils/mocks/MockERC4626.sol, lib/solmate/src/test/utils/mocks/MockERC6909.sol, lib/solmate/src/test/utils/mocks/MockERC721.sol, lib/solmate/src/test/utils/mocks/MockOwned.sol, lib/solmate/src/test/utils/weird-tokens/MissingReturnToken.sol, lib/solmate/src/test/utils/weird-tokens/ReturnsFalseToken.sol, lib/solmate/src/test/utils/weird-tokens/ReturnsGarbageToken.sol, lib/solmate/src/test/utils/weird-tokens/ReturnsTooLittleToken.sol, lib/solmate/src/test/utils/weird-tokens/ReturnsTooMuchToken.sol, lib/solmate/src/test/utils/weird-tokens/ReturnsTwoToken.sol, lib/solmate/src/test/utils/weird-tokens/RevertingToken.sol, lib/solmate/src/tokens/ERC1155.sol, lib/solmate/src/tokens/ERC20.sol, lib/solmate/src/tokens/ERC6909.sol, lib/solmate/src/tokens/ERC721.sol, lib/solmate/src/tokens/WETH.sol, lib/solmate/src/utils/Bytes32AddressLib.sol, lib/solmate/src/utils/CREATE3.sol, lib/solmate/src/utils/FixedPointMathLib.sol, lib/solmate/src/utils/LibString.sol, lib/solmate/src/utils/MerkleProofLib.sol, lib/solmate/src/utils/ReentrancyGuard.sol, lib/solmate/src/utils/SSTORE2.sol, lib/solmate/src/utils/SafeCastLib.sol, lib/solmate/src/utils/SafeTransferLib.sol, lib/solmate/src/utils/SignedWadMath.sol, lib/v4-core/src/ERC6909.sol, lib/v4-core/src/ERC6909Claims.sol, lib/v4-core/src/Extsload.sol, lib/v4-core/src/Exttload.sol, lib/v4-core/src/NoDelegateCall.sol, lib/v4-core/src/PoolManager.sol, lib/v4-core/src/ProtocolFees.sol, lib/v4-core/src/interfaces/IExtsload.sol, lib/v4-core/src/interfaces/IExttload.sol, lib/v4-core/src/interfaces/IHooks.sol, lib/v4-core/src/interfaces/IPoolManager.sol, lib/v4-core/src/interfaces/IProtocolFees.sol, lib/v4-core/src/interfaces/callback/IUnlockCallback.sol, lib/v4-core/src/interfaces/external/IERC20Minimal.sol, lib/v4-core/src/interfaces/external/IERC6909Claims.sol, lib/v4-core/src/libraries/BitMath.sol, lib/v4-core/src/libraries/CurrencyDelta.sol, lib/v4-core/src/libraries/CurrencyReserves.sol, lib/v4-core/src/libraries/CustomRevert.sol, lib/v4-core/src/libraries/FixedPoint128.sol, lib/v4-core/src/libraries/FixedPoint96.sol, lib/v4-core/src/libraries/FullMath.sol, lib/v4-core/src/libraries/Hooks.sol, lib/v4-core/src/libraries/LPFeeLibrary.sol, lib/v4-core/src/libraries/LiquidityMath.sol, lib/v4-core/src/libraries/Lock.sol, lib/v4-core/src/libraries/NonzeroDeltaCount.sol, lib/v4-core/src/libraries/ParseBytes.sol, lib/v4-core/src/libraries/Pool.sol, lib/v4-core/src/libraries/Position.sol, lib/v4-core/src/libraries/ProtocolFeeLibrary.sol, lib/v4-core/src/libraries/SafeCast.sol, lib/v4-core/src/libraries/SqrtPriceMath.sol, lib/v4-core/src/libraries/StateLibrary.sol, lib/v4-core/src/libraries/SwapMath.sol, lib/v4-core/src/libraries/TickBitmap.sol, lib/v4-core/src/libraries/TickMath.sol, lib/v4-core/src/libraries/TransientStateLibrary.sol, lib/v4-core/src/libraries/UnsafeMath.sol, lib/v4-core/src/test/ActionsRouter.sol, lib/v4-core/src/test/BaseTestHooks.sol, lib/v4-core/src/test/CurrencyTest.sol, lib/v4-core/src/test/CustomCurveHook.sol, lib/v4-core/src/test/DeltaReturningHook.sol, lib/v4-core/src/test/DynamicFeesTestHook.sol, lib/v4-core/src/test/DynamicReturnFeeTestHook.sol, lib/v4-core/src/test/EmptyRevertContract.sol, lib/v4-core/src/test/EmptyTestHooks.sol, lib/v4-core/src/test/FeeTakingHook.sol, lib/v4-core/src/test/Fuzzers.sol, lib/v4-core/src/test/HooksTest.sol, lib/v4-core/src/test/LPFeeTakingHook.sol, lib/v4-core/src/test/LiquidityMathTest.sol, lib/v4-core/src/test/MockContract.sol, lib/v4-core/src/test/MockERC6909Claims.sol, lib/v4-core/src/test/MockHooks.sol, lib/v4-core/src/test/NativeERC20.sol, lib/v4-core/src/test/NoDelegateCallTest.sol, lib/v4-core/src/test/PoolClaimsTest.sol, lib/v4-core/src/test/PoolDonateTest.sol, lib/v4-core/src/test/PoolEmptyUnlockTest.sol, lib/v4-core/src/test/PoolModifyLiquidityTest.sol, lib/v4-core/src/test/PoolModifyLiquidityTestNoChecks.sol, lib/v4-core/src/test/PoolNestedActionsTest.sol, lib/v4-core/src/test/PoolSwapTest.sol, lib/v4-core/src/test/PoolTakeTest.sol, lib/v4-core/src/test/PoolTestBase.sol, lib/v4-core/src/test/ProtocolFeesImplementation.sol, lib/v4-core/src/test/ProxyPoolManager.sol, lib/v4-core/src/test/SkipCallsTestHook.sol, lib/v4-core/src/test/SqrtPriceMathEchidnaTest.sol, lib/v4-core/src/test/SwapRouterNoChecks.sol, lib/v4-core/src/test/TestERC20.sol, lib/v4-core/src/test/TestInvalidERC20.sol, lib/v4-core/src/test/TickMathEchidnaTest.sol, lib/v4-core/src/test/TickMathTest.sol, lib/v4-core/src/test/TickOverflowSafetyEchidnaTest.sol, lib/v4-core/src/types/BalanceDelta.sol, lib/v4-core/src/types/BeforeSwapDelta.sol, lib/v4-core/src/types/Currency.sol, lib/v4-core/src/types/PoolId.sol, lib/v4-core/src/types/PoolKey.sol, lib/v4-core/src/types/PoolOperation.sol, lib/v4-core/src/types/Slot0.sol, scripts/check_vendor.py, scripts/export_abis.py, src/BootstrapMath.sol, src/HookFlags.sol, src/VolatilityGuardHook.sol, src/VolatilityGuardToken.sol, test/Bootstrap.t.sol, test/Guard.t.sol, test/Invariant.t.sol, test/Reentrancy.t.sol, test/Router.sol, test/Token.t.sol, test/mocks/MockERC20.sol