Refused by Codex's safety filter

• mediumDeployOrbital makes the script contract the hook's first owner, so under broadcast the owner-only guardian wiring reverts with NotOwnerscript/DeployOrbital.s.sol:76

  deploy() passes address(this) (the script contract) as the hook's owner at lines 68/72, then calls d.hook.setGuardian(...) and d.hook.transferOwnership(cfg.owner) at lines 76-77. run() wraps deploy() in vm.startBroadcast(), under which every external call at the script's depth is sent from the broadcaster EOA, not from the script contract (the script contract has no on-chain existence or key).

  The hook's onlyOwner modifier compares msg.sender (broadcaster) with owner (script contract address) and reverts NotOwner. Deploy.t.sol only exercises deploy() without broadcast, where the test contract is both address(this) and msg.sender, so the suite never sees this.

  Consequence: the documented 'Order of operations' step 1 (README) cannot complete. In the default run forge's pre-flight simulation reverts and nothing is sent, so the breaker cannot be deployed through this script at all.

  If the run is forced through (--skip-simulation / --resume), the token and the hook are deployed but the hook is left with owner = a dead address and guardian = address(0): pause/unpause/setFee/setGuardian/transferOwnership are unreachable forever and the circuit breaker can never be wired. The IMD factory path that passes owner and guardian as constructor args is unaffected; this only breaks the Reactive wiring script the README tells the operator to use.

  Fix: predict the CREATE2 hook address first, deploy OrbitalDepegCallback against the predicted address, then deploy the hook with owner = cfg.owner and guardian = address(callback) directly in the constructor (no post-deploy owner calls); or at minimum use msg.sender rather than address(this) as the interim owner.

  whole finding

  Mirror run(): from inside the script contract call vm.startBroadcast(broadcaster); deploy(cfg) with cfg.create2Deployer = DEFAULT_CREATE2_DEPLOYER (what run() sets).

  Trace: new OrbitalToken (ok) -> Create2Deployer::create2 hook (ok, owner = script contract) -> new OrbitalDepegCallback (ok) -> OrbitalHook::setGuardian(callback) reverts NotOwner() because msg.sender is the broadcaster.

  Expected: d.hook.owner() == cfg.owner and d.hook.guardian() == address(d.callback).

  Actual: revert NotOwner(); see test/scratch/DeployBroadcast.t.sol (fails on this tree with [FAIL: NotOwner()]).

  whole reproduction
  proof · a Foundry test the fix has to pass

  // SPDX-License-Identifier: MIT
  pragma solidity 0.8.26;
  
  import {Test} from "forge-std/Test.sol";
  import {PoolManager} from "v4-core/src/PoolManager.sol";
  import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
  import {DeployOrbital} from "script/DeployOrbital.s.sol";
  import {OrbitalHook} from "src/OrbitalHook.sol";
  
  contract MintableToken {
      uint8 public constant decimals = 18;
      mapping(address => uint256) public balanceOf;
      mapping(address => mapping(address => uint256)) public allowance;
  
      function approve(address s, uint256 a) external returns (bool) {
          allowance[msg.sender][s] = a;
          return true;
      }
  
      function transfer(address to, uint256 a) external returns (bool) {
          balanceOf[msg.sender] -= a;
          balanceOf[to] += a;
          return true;
      }
  
      function transferFrom(address f, address to, uint256 a) external returns (bool) {
          allowance[f][msg.sender] -= a;
          balanceOf[f] -= a;
          balanceOf[to] += a;
          return true;
      }
  }
  
  /// @notice Mirrors `DeployOrbital.run()`: the script contract itself starts a broadcast and then
  /// calls `deploy(cfg)` internally (same call depth), exactly as `run` does. Under broadcast the
  /// external calls made at that depth are sent from the broadcaster, while `address(this)` -- the
  /// hook's first owner -- is the script contract. `setGuardian` therefore reverts with `NotOwner`.
  contract DeployBroadcastTest is Test, DeployOrbital {
      function test_deployUnderBroadcastRevertsNotOwner() public {
          PoolManager manager = new PoolManager(address(this));
  
          address[] memory basket = new address[](2);
          basket[0] = address(new MintableToken());
          basket[1] = address(new MintableToken());
          uint8[] memory decs = new uint8[](2);
          decs[0] = 18;
          decs[1] = 18;
          uint256[] memory ks = new uint256[](2);
          ks[0] = 0.5e18;
          ks[1] = 0.7e18;
  
          address broadcaster = makeAddr("broadcaster");
          vm.deal(broadcaster, 100 ether);
  
          Config memory cfg = Config({
              poolManager: IPoolManager(address(manager)),
              owner: makeAddr("multisig"),
              basket: basket,
              decimals: decs,
              kNorms: ks,
              feePpm: 300,
              callbackProxy: makeAddr("reactive-callback-proxy"),
              rvmId: makeAddr("reactive-deployer"),
              create2Deployer: DEFAULT_CREATE2_DEPLOYER // what `run()` uses under broadcast
          });
  
          vm.startBroadcast(broadcaster);
          Deployed memory d = deploy(cfg);
          vm.stopBroadcast();
  
          assertEq(d.hook.owner(), cfg.owner, "ownership handed to the multisig");
          assertEq(d.hook.guardian(), address(d.callback), "callback wired as guardian");
      }
  }

  whole proof

• lowThe breaker emits a new paid callback on every out-of-band AnswerUpdated, draining the callback contract's ETH and re-pausing after the owner's unpause while the depeg lastssrc/reactive/OrbitalDepegReactive.sol:104

  react() has no latch: every log whose price is out of band emits a Callback, regardless of whether one was already sent. Chainlink aggregators emit AnswerUpdated on every deviation/heartbeat round, and a real depeg (e.g. USDC, March 2023) lasts days with many rounds outside a 2% band. Each Callback is delivered to OrbitalDepegCallback.depeg(), which calls guardianPause() (idempotent, so the extra calls do nothing) and is then charged by the callback proxy through pay() (OrbitalDepegCallback.sol:71-75), with the reactive copy charged in REACT as well. Two consequences.

  1. Economics: the callback contract's ETH and the Lasna contract's REACT are spent on N-1 useless deliveries per depeg episode; once drained, Reactive stops delivering, so the breaker is unfunded exactly when the next coin moves.
  2. Access asymmetry with the owner-only unpause(): the design says a human reviews and resumes, but while the feed is still out of band every subsequent round re-pauses the pool straight after the owner unpauses, and a delivery delayed by an unfunded callback contract re-pauses on a stale round after the owner has already judged the situation safe. depeg() carries roundId but never checks it against the last one acted on. Suggested fix: on the reactive side keep a 'tripped' flag that is set on the first out-of-band round and only re-armed when a round comes back in band (or by the owner), so one Callback is sent per excursion; on the callback side record the last roundId acted on and ignore older rounds. This preserves the fail-safe (first out-of-band round still pauses immediately).

  whole finding

  Deploy OrbitalDepegReactive(origin, feed, 1301, callback, 500000, 1e8, 200) and OrbitalDepegCallback(proxy, hook, rvmId, owner) with 0.05 ETH; prank SERVICE and call react() five times with topic_1 = 0.9e8 and roundId 1..5.

  Expected: one Callback for the excursion (the pool is already paused after round 1).

  Actual: five Callback events; delivering each through a proxy that charges 0.01 ETH per delivery (as the real proxy does via pay()) calls guardianPause() five times and leaves the callback contract at 0 wei (test/scratch/BreakerRefire.t.sol logs: callbacks emitted = 5, guardianPause calls = 5, balance left = 0).

  Then: owner calls hook.unpause(); the next out-of-band round (or a late-delivered earlier one) calls depeg() again and the pool is paused again with no new information.

  whole reproduction

Refused by Codex's safety filter

• highOrbitalDepegReactive.react() rejects the ReactVM's real caller (the RVM id), so the depeg circuit breaker can never firesrc/reactive/OrbitalDepegReactive.sol:90

  react() only proceeds when msg.sender is the system contract 0x0000000000000000000000000000000000fffFfF. Inside a ReactVM that address has no code (the contract itself relies on that to set isReactVm = true) and it is not the sender of react() transactions.

  Verified against the live Reactive Lasna network (chain 5318007, RPC https://lasna-rpc.rnk.dev/): rnk_getRnkAddressMapping(0x6ba34385d9018cfa3341db62b68b5a55839fe71f) returns rvmId 0xa7d9aa89cbcd216900a04cdc13eb5789d643176a, and every react(LogRecord) transaction in that RVM (selector 0x0d152c2c, e.g. rnk_getTransactionByNumber(0xa7d9..., 0xdbd4) hash 0xcd26b9578bf6fde2d3305dce2887d62ff5b13aab13e6b41bbe7f8eced200f25e, to 0xe74c8c9823404a5039fd682c8b9335b096f514fd) has from == 0xa7d9aa89... == the RVM id, i.e. the EOA that deployed the reactive contract, with the reactive contract as the direct to.

  So msg.sender inside react() is the RVM id (== owner here, since owner = msg.sender of the constructor). reactive-lib's AbstractReactive accordingly guards react() with vmOnly only and has no system-contract sender check.

  On this code every delivered AnswerUpdated log reverts with NotSystemContract(), no Callback is ever emitted, OrbitalDepegCallback.depeg is never invoked and OrbitalHook.guardianPause() never runs: the keeper-free breaker, the core deliverable of this build, is permanently dead while the operator keeps paying REACT for the failed reactive transactions.

  The repository's own test (test/Reactive.t.sol:77, vm.prank(SERVICE);) pranks the system-contract address and therefore cannot detect this.

  Fix: in react(), require isReactVm and accept the ReactVM's actual sender (msg.sender == owner, the RVM id) instead of SERVICE; keep the SERVICE check only for pay() on the Reactive Network copy. Update test/Reactive.t.sol to prank the deployer EOA. Note also that the RVM id injected into the callback payload is this same deployer address, so OrbitalDepegCallback.rvmId must be set to it (the README already says so).

  whole finding

  State: OrbitalDepegReactive deployed on Reactive Lasna from EOA D (= RVM id) with a Chainlink aggregator as feed; isReactVm == true in the RVM copy.

  Input: the ReactVM delivers an out-of-band log, i.e. a transaction from D to the reactive contract calling react(LogRecord{chain_id: originChainId, _contract: feed, topic_0: keccak256('AnswerUpdated(int256,uint256,uint256)'), topic_1: uint256(int256(0.97e8)), topic_2: 42, ...}).

  Expected: DepegDetected and Callback(1301, callbackContract, gasLimit, depeg(...)) emitted, pool paused on Unichain Sepolia.

  Actual: react() reverts NotSystemContract() because msg.sender (D) != 0x...fffFfF; nothing is emitted, the hook is never paused.

  Foundry: deploy with vm.prank(D), then vm.prank(D, D); reactive.react(rec) -> reverts NotSystemContract().

  The attached test fails on the current code with exactly that error and passes once react() accepts the RVM id as caller.

  whole reproduction
  proof · a Foundry test the fix has to pass

  // SPDX-License-Identifier: MIT
  pragma solidity 0.8.26;
  
  import {Test} from "forge-std/Test.sol";
  import {Vm} from "forge-std/Vm.sol";
  import {IReactive} from "src/reactive/IReactive.sol";
  import {OrbitalDepegReactive} from "src/reactive/OrbitalDepegReactive.sol";
  
  /// @notice Inside the ReactVM, `react()` transactions are sent *from the RVM id* — the EOA that
  /// deployed the reactive contract (verified against Reactive Lasna: `rnk_getRnkAddressMapping` and
  /// the `from` field of live `react(LogRecord)` transactions, selector 0x0d152c2c). The system
  /// contract 0x…fffFfF has no code in the ReactVM and is never the caller. `OrbitalDepegReactive.react`
  /// requires `msg.sender == SERVICE`, so every delivered log reverts with `NotSystemContract` and the
  /// circuit breaker can never emit a `Callback`. This test models the real caller and fails on the
  /// current code; it passes once `react` accepts the ReactVM's actual sender.
  contract ReactSenderTest is Test {
      uint256 constant ORIGIN_CHAIN = 11155111;
      uint256 constant DEST_CHAIN = 1301;
      address feed = makeAddr("chainlink-aggregator");
      address callbackTarget = makeAddr("orbital-depeg-callback");
      address rvmId = makeAddr("reactive-deployer"); // the EOA that deploys the reactive contract
  
      OrbitalDepegReactive reactive;
  
      function setUp() public {
          // Deployed from the RVM id EOA, exactly like `forge create` from the breaker operator's key.
          vm.prank(rvmId);
          reactive = new OrbitalDepegReactive(ORIGIN_CHAIN, feed, DEST_CHAIN, callbackTarget, 500_000, 1e8, 200);
          assertTrue(reactive.isReactVm(), "no system contract code here, as in the ReactVM");
          assertEq(reactive.owner(), rvmId);
      }
  
      function logRecord(int256 price, uint256 roundId) internal view returns (IReactive.LogRecord memory) {
          return IReactive.LogRecord({
              chain_id: ORIGIN_CHAIN,
              _contract: feed,
              topic_0: uint256(keccak256("AnswerUpdated(int256,uint256,uint256)")),
              topic_1: uint256(price),
              topic_2: roundId,
              topic_3: 0,
              data: abi.encode(block.timestamp),
              block_number: 1,
              op_code: 0,
              block_hash: 0,
              tx_hash: 0,
              log_index: 0
          });
      }
  
      /// The ReactVM delivers a depeg log: the transaction's `from` is the RVM id, so `msg.sender`
      /// inside `react` is the RVM id. The breaker must emit `Callback` for an out-of-band price.
      function test_reactFromRvmIdEmitsCallbackOnDepeg() public {
          IReactive.LogRecord memory rec = logRecord(0.97e8, 42);
          vm.recordLogs();
          vm.prank(rvmId, rvmId); // msg.sender and tx.origin are the RVM id, as in a live ReactVM tx
          reactive.react(rec);
          Vm.Log[] memory logs = vm.getRecordedLogs();
          bytes32 sig = keccak256("Callback(uint256,address,uint64,bytes)");
          bool emitted;
          for (uint256 i = 0; i < logs.length; i++) {
              if (logs[i].topics[0] == sig) {
                  emitted = true;
                  assertEq(uint256(logs[i].topics[1]), DEST_CHAIN, "destination chain");
                  assertEq(address(uint160(uint256(logs[i].topics[2]))), callbackTarget, "callback target");
                  bytes memory payload = abi.decode(logs[i].data, (bytes));
                  assertEq(bytes4(payload), bytes4(keccak256("depeg(address,address,int256,uint256)")));
              }
          }
          assertTrue(emitted, "depeg must request a cross-chain callback when the ReactVM delivers the log");
      }
  }

  whole proof

• lowNo hysteresis/deduplication: after the owner's unpause the next still-out-of-band feed update re-pauses the pool, and every update during a sustained depeg bills the callback contractsrc/reactive/OrbitalDepegReactive.sol:104

  react() emits a Callback for every AnswerUpdated whose price is outside the band, with no memory of having already tripped and no re-arm condition.

  The design says resuming is the owner's reviewed decision, but the owner's unpause() is undone by the very next feed round while the price is still outside the band (Chainlink feeds publish on every heartbeat, typically hourly, and on each deviation threshold), so during a sustained but orderly depeg - exactly the case the tick isolation is built to trade through - trading can only be resumed by disabling the breaker (hook.setGuardian(0) or callback.setRvmId(0)), which is not documented and defeats the breaker for any second coin.

  Each redundant callback also costs a destination transaction that the callback proxy charges to OrbitalDepegCallback via pay(); per Reactive docs an under-funded callback contract is blocklisted, so a long depeg can silently exhaust the contract and disable the breaker for a later, unrelated depeg.

  Fix: in react(), track a tripped flag in the RVM copy and only emit when the price transitions from in-band to out-of-band (re-arm when a price returns in-band), and/or have OrbitalDepegCallback skip the hook call when hook.paused() is already true; document the operator procedure for resuming during a sustained depeg.

  whole finding

  Sequence (reproduced with the repo's mock proxy in Foundry): 1) react(AnswerUpdated price 0.97e8, round 42) -> Callback -> proxy.deliver -> depeg -> hook.paused() == true.

  2. owner calls hook.unpause() -> paused == false.

  3. next heartbeat round: react(price 0.97e8, round 43) -> Callback emitted again -> proxy.deliver -> hook.paused() == true again, with no owner action.

  Expected per the design: the pause is a one-shot fail-safe that a human reviews and resumes; actual: the pool cannot stay unpaused while the feed reads 0.97, and each round costs the callback contract ETH.

  whole reproduction

• lowBreaker subscribes to an immutable aggregator address; a Chainlink aggregator rotation silently disables it with no way to re-pointsrc/reactive/OrbitalDepegReactive.sol:27

  AnswerUpdated is emitted by the aggregator implementation behind the Chainlink proxy, so (as the README notes) feed must be the aggregator, not the proxy.

  Chainlink rotates aggregator implementations (the proxy's aggregator() changes, the old aggregator stops emitting). feed is immutable and subscribe()/unsubscribe() can only re-create the same subscription, so after a rotation the reactive contract never receives another log, react() is never called, and the circuit breaker is silently dead with no on-chain signal (no PriceInBand/DepegDetected events, no revert).

  Recovery requires redeploying OrbitalDepegReactive; because the RVM id is the deployer, it must be redeployed from the same EOA or OrbitalDepegCallback.setRvmId must be updated.

  Fix: make the feed address updatable by the owner on the Reactive Network copy (unsubscribe old, subscribe new) and mirror it to the RVM copy via a callback, or subscribe by topic with _contract = 0 and filter on the proxy's current aggregator() in react(); add a liveness check (last update timestamp) to the operator runbook.

  whole finding

  State: OrbitalDepegReactive deployed with feed = A1 (current USDC/USD aggregator).

  Chainlink later deploys A2 and calls proxy.proposeAggregator/confirmAggregator so proxy.aggregator() == A2 != feed.

  Input: USDC prints 0.90e8 via A2's AnswerUpdated.

  Expected: breaker pauses the pool.

  Actual: the subscription (originChainId, A1, AnswerUpdated topic) matches nothing; react() is never invoked; the hook stays unpaused.

  Observable check: proxy.aggregator() != reactive.feed() while reactive.subscribe() cannot change feed (immutable, line 27, set once at line 63).

  whole reproduction

Refused by Codex's safety filter

• mediumTick pin/unpin state desynchronises from the interior position by one rounding unit, so a pinned tick never rejoins the interior and return trades are mispricedsrc/OrbitalHook.sol:821

  Seam: boundary x precision x invariant. The hook keeps two representations of a tick's status: the stored boundaryMask and the derived position alphaIntNorm = floor((alpha - kb) * WAD / r_int) (OrbitalMath.sol:139-141). The invariant the code documents (OrbitalHook.sol:547 'Ticks with kNorm below it are boundary', and the paper) is that a tick is pinned iff alphaIntNorm >= kNorm. _nextCrossing only re-synchronises the two when a trade's start/end positions bracket kNorm with one-sided comparators: a pinned tick is unpinned only if k <= aNow (line 826) and an interior tick is pinned only if k >= aNow (line 816). Nothing else ever repairs the mask.

  When a trade crosses a plane the code lands exactly on it via planeStep and the state after the crossing reads alphaIntNorm == kNorm with zero fractional part. From that resting state every ordinary interior deposit (_tokenShare floors val * radius / c.r per token, so S grows by slightly less than r does) and every partial withdrawal from the pinned tick move alphaIntNorm to kNorm - 1 while the mask is untouched (deposit only rewrites the bit when L.radius == 0, line 361). Now k <= aNow is false for every subsequent return trade, so the tick stays pinned on its boundary circle while the interior travels all the way back to (and through) the peg. Measured: with TIGHT (k=0.74, r=1e24) and WIDE (k=1.15, r=2e24), the 250_000e18 B->A return trade pays the trader 291_196.58 A in the desynchronised state versus 302_257.79 A on the clean path where the tick rejoins at its plane (reference path differs only by an extra 100 A dumped first) - about 3.7% worse execution, with the surplus accruing to the interior LPs because the frozen tick's reserves depend only on the shared direction w-hat. The same state also leaves the tick's LP holding the depeg-skewed reserve vector (518_523 A / 340_756 B for r=1e24 at the peg instead of a balanced share) and makes the sphere invariant with the tick counted as interior read -4.9e46 instead of ~0.

  Trigger is unprivileged: any trader can compute the exact pin amount off-chain (quoteExactInput/binary search; it is 287_443_796_572_854_664_222_089 wei here) and any LP (even with MIN_RADIUS = 1e9) supplies the rounding nudge; a large interior LP profits from every later return trade. The mirror case (interior tick left above its plane, never pinned, unbounded depeg exposure) uses the same comparator at line 816; I could not reach it with a single trade because planeStep lands slightly before the floor-based position reaches k, but the fix below covers both.

  Fix (minimal, keeps design): reconcile the mask with the position at the start of _simulate (for each level with radius: pin if interior and k < aNow, unpin if pinned and k > aNow; a one-unit mismatch is ~1e-6 wei of reserves so flipping without a plane step is harmless), and/or make _nextCrossing treat ticks already past the comparison point as crossed. Verified: with that reconciliation the attached proof passes.

  whole finding

  Setup: three 18-dec basket tokens, levels kNorms=[0.74e18,1.15e18], fee 400 ppm; LP deposits 1e24 radius at level 0 and 2e24 at level 1.

  (1) Exact-in swap A->B of 287_443_796_572_854_664_222_089 wei (smallest amount that pins level 0; found by binary search on boundaryMask).

  State: boundaryMask == 1, alphaIntNorm() == 0.74e18 exactly.

  (2) LP deposits any radius at level 1 (1e24 used; 1e9 behaves the same).

  State: boundaryMask == 1, alphaIntNorm() == 0.74e18 - 1.

  (3) Exact-in swap B->A of 250_000e18.

  Expected: level 0 unpins at its plane and alphaIntNorm() ends ~0.7321e18 with boundaryMask == 0.

  Actual: alphaIntNorm() == 732_052_469_882_506_119 (far below 0.74e18) and boundaryMask == 1; the trader receives 291_196_577_874_549_749_487_140 wei of A instead of ~302_257_788_034_580_550_221_671 on the clean path.

  Variant for step (2): withdraw(0, any radius) by the level-0 LP gives the same -1 shift.

  Proof test: test/scratch/TickDesync.t.sol (fails on current code at 'tight tick must have rejoined the interior: 1 != 0').

  whole reproduction
  proof · a Foundry test the fix has to pass

  // SPDX-License-Identifier: MIT
  pragma solidity 0.8.26;
  
  import {Test} from "forge-std/Test.sol";
  import {PoolManager} from "v4-core/src/PoolManager.sol";
  import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
  import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
  import {PoolKey} from "v4-core/src/types/PoolKey.sol";
  import {Currency} from "v4-core/src/types/Currency.sol";
  import {SwapParams} from "v4-core/src/types/PoolOperation.sol";
  import {TickMath} from "v4-core/src/libraries/TickMath.sol";
  import {PoolSwapTest} from "v4-core/src/test/PoolSwapTest.sol";
  import {OrbitalHook} from "src/OrbitalHook.sol";
  import {HookFlags} from "src/HookFlags.sol";
  
  /// @dev Minimal 18-decimal ERC-20 for the proof (no dependency on other test files).
  contract ProofToken {
      uint8 public constant decimals = 18;
      mapping(address => uint256) public balanceOf;
      mapping(address => mapping(address => uint256)) public allowance;
  
      function mint(address to, uint256 amount) external {
          balanceOf[to] += amount;
      }
  
      function approve(address spender, uint256 amount) external returns (bool) {
          allowance[msg.sender][spender] = amount;
          return true;
      }
  
      function transfer(address to, uint256 amount) external returns (bool) {
          balanceOf[msg.sender] -= amount;
          balanceOf[to] += amount;
          return true;
      }
  
      function transferFrom(address from, address to, uint256 amount) external returns (bool) {
          if (allowance[from][msg.sender] != type(uint256).max) allowance[from][msg.sender] -= amount;
          balanceOf[from] -= amount;
          balanceOf[to] += amount;
          return true;
      }
  }
  
  /// @title TickDesync
  /// @notice A tick pinned to its plane must rejoin the interior when the interior's normalised
  /// position (`alphaIntNorm`) falls back below its `kNorm` (OrbitalHook.sol:547 "Ticks with kNorm
  /// below it are boundary"). This test drives the pool to the exact pin point of the tight tick,
  /// makes an ordinary interior deposit (whose floor rounding moves `alphaIntNorm` to `kNorm - 1`),
  /// then trades back towards the peg. `_nextCrossing` only unpins ticks with `k <= aNow`, so the
  /// tight tick stays pinned while the position ends far below its plane.
  contract TickDesyncTest is Test {
      uint160 constant FLAGS = HookFlags.BEFORE_INITIALIZE | HookFlags.BEFORE_ADD_LIQUIDITY | HookFlags.BEFORE_SWAP
          | HookFlags.BEFORE_SWAP_RETURN_DELTA;
      uint160 constant SQRT_PRICE_1_1 = 79228162514264337593543950336;
      uint256 constant K_TIGHT = 0.74e18;
      uint256 constant K_WIDE = 1.15e18;
      uint256 constant R = 1_000_000e18;
      uint256 constant TIGHT = 0;
      uint256 constant WIDE = 1;
  
      PoolManager manager;
      PoolSwapTest router;
      OrbitalHook hook;
      ProofToken a;
      ProofToken b;
      ProofToken c;
      PoolKey keyAB;
      address lp = makeAddr("lp");
      address trader = makeAddr("trader");
  
      function setUp() public {
          manager = new PoolManager(address(this));
          router = new PoolSwapTest(manager);
          a = new ProofToken();
          b = new ProofToken();
          c = new ProofToken();
          address[] memory basket = new address[](3);
          basket[0] = address(a);
          basket[1] = address(b);
          basket[2] = address(c);
          uint8[] memory decs = new uint8[](3);
          decs[0] = 18;
          decs[1] = 18;
          decs[2] = 18;
          uint256[] memory ks = new uint256[](2);
          ks[0] = K_TIGHT;
          ks[1] = K_WIDE;
          bytes memory code = abi.encodePacked(
              type(OrbitalHook).creationCode,
              abi.encode(IPoolManager(address(manager)), address(this), address(this), basket, decs, ks, uint24(400))
          );
          bytes32 salt = mine(code);
          hook = new OrbitalHook{salt: salt}(
              IPoolManager(address(manager)), address(this), address(this), basket, decs, ks, uint24(400)
          );
          (address c0, address c1) = address(a) < address(b) ? (address(a), address(b)) : (address(b), address(a));
          keyAB = PoolKey(Currency.wrap(c0), Currency.wrap(c1), 0, 60, IHooks(address(hook)));
          manager.initialize(keyAB, SQRT_PRICE_1_1);
          fund(lp);
          fund(trader);
          vm.startPrank(lp);
          hook.deposit(TIGHT, R, maxes());
          hook.deposit(WIDE, 2 * R, maxes());
          vm.stopPrank();
      }
  
      function test_pinnedTickFailsToRejoinInterior() public {
          // 1. Smallest exact-in A->B amount that pins the tight tick: the trade lands exactly on
          //    the plane and the remaining input is too small to move alphaIntNorm off kNorm.
          uint256 lo = 1e18;
          uint256 hi = 600_000e18;
          while (hi - lo > 1) {
              uint256 mid = (lo + hi) / 2;
              uint256 snap = vm.snapshotState();
              swap(true, -int256(mid));
              bool pinned = hook.boundaryMask() & (1 << TIGHT) != 0;
              vm.revertToState(snap);
              if (pinned) hi = mid;
              else lo = mid;
          }
          swap(true, -int256(hi));
          assertEq(hook.boundaryMask(), 1 << TIGHT, "tight tick pinned at its plane");
          assertEq(hook.alphaIntNorm(), int256(K_TIGHT), "position sits exactly on the plane");
  
          // 2. Any interior deposit now rounds the position down by one unit while the mask is kept.
          vm.prank(lp);
          hook.deposit(WIDE, 1e24, maxes());
          assertEq(hook.boundaryMask(), 1 << TIGHT, "still pinned");
          assertLt(hook.alphaIntNorm(), int256(K_TIGHT), "but the position is below the plane");
  
          // 3. Trade back towards the peg. The interior ends near its equal-price point, far below
          //    kNorm, so by the hook's own definition the tight tick must be interior again.
          swap(false, -int256(250_000e18));
          int256 pos = hook.alphaIntNorm();
          assertLt(pos, int256(K_TIGHT) - 1e15, "position far below the tight plane");
          assertEq(hook.boundaryMask() & (1 << TIGHT), 0, "tight tick must have rejoined the interior");
      }
  
      // ---- helpers ----------------------------------------------------------------------------
  
      function swap(bool aForB, int256 amount) internal {
          bool z = Currency.unwrap(keyAB.currency0) == address(a) ? aForB : !aForB;
          vm.prank(trader);
          router.swap(
              keyAB,
              SwapParams(z, amount, z ? TickMath.MIN_SQRT_PRICE + 1 : TickMath.MAX_SQRT_PRICE - 1),
              PoolSwapTest.TestSettings(false, false),
              ""
          );
      }
  
      function maxes() internal pure returns (uint256[] memory m) {
          m = new uint256[](3);
          m[0] = type(uint256).max;
          m[1] = type(uint256).max;
          m[2] = type(uint256).max;
      }
  
      function fund(address who) internal {
          a.mint(who, 1e9 * 1e18);
          b.mint(who, 1e9 * 1e18);
          c.mint(who, 1e9 * 1e18);
          vm.startPrank(who);
          a.approve(address(hook), type(uint256).max);
          b.approve(address(hook), type(uint256).max);
          c.approve(address(hook), type(uint256).max);
          a.approve(address(router), type(uint256).max);
          b.approve(address(router), type(uint256).max);
          c.approve(address(router), type(uint256).max);
          vm.stopPrank();
      }
  
      function mine(bytes memory code) internal view returns (bytes32) {
          bytes32 h = keccak256(code);
          for (uint256 i = 0; i < 500_000; i++) {
              address p = address(uint160(uint256(keccak256(abi.encodePacked(bytes1(0xff), address(this), bytes32(i), h)))));
              if (HookFlags.matches(p, FLAGS)) return bytes32(i);
          }
          revert("no salt");
      }
  }

  whole proof

Refused by Codex's safety filter

• criticalTick-crossing detection compares only segment endpoints; a return trade through the peg leaves a tick pinned in a state the torus model cannot represent, after which a deposit breaks the invariant andsrc/OrbitalHook.sol:806

  _nextCrossing (line 806) decides whether a segment crosses a tick plane from alphaIntNorm before and after the whole segment. The interior's normalised position is not monotonic along a trade: a trade back toward the peg drives the interior through its own equal point, where the position bottoms out at sqrt(N)-1 (below every k) and rises again.

  With a tick pinned, the tick must unpin when the position passes k on the way down (and may re-pin on the way up); the endpoint test sees 'went up' and looks only for interior ticks to pin, so nothing happens. The pool continues with the tick pinned while the interior's off-peg component now points against the pinned ticks' (global ||w|| < sb).

  The consolidated torus assumes the two are parallel: _toPlane (line 792) only targets ||w|| = sb + r*s, so the plane cannot be hit again (planeStep clamps a negative discriminant and either skips the flip, leaving a pinned tick below the interior position, or flips at a point off the torus); and the pinned ticks' reserves are k*r/sqrtN + s*r*w_hat with the global direction (line 694), so once a later interior deposit (_tokenShare, line 700) scales the interior enough to flip the global direction, every pinned tick's holdings jump to the opposite side of its circle with no trade, and F drops to about -2% of r^2.

  The next solveOut prices against that broken surface and gives the excess to whoever trades first. All of this is reachable by honest activity (deposit, a round trip, deposit) and trivially by an attacker who performs the round trip and the deposit, then takes the excess with one wei; the loss falls on every LP pro rata to their share of _x.

  Fix direction: split every trade segment at the point where the interior's w vanishes (or wherever alphaIntNorm reverses), check boundary ticks against the minimum of the path, and never allow the interior onto the lower arc while a tick is pinned (assert ||w|| >= sb after each segment).

  whole finding

  N=3 basket (A, B 18 dec; C 6 dec), ticks k = [0.74e18, 0.95e18, 1.15e18], fee 400 ppm, pools B/C. lp1: deposit(WIDE=2, 1e24). lp2: deposit(TIGHT=0, 3e24). trader: exact-in 500,000e6 C -> B (boundaryMask becomes 1: tight pinned; alphaIntNorm 0.766). trader: exact-in the 399,169.55 B received -> C (no LevelCrossed event; mask stays 1; alphaIntNorm ends at 0.7735 after having passed through 0.732; hook.reserves() give ||w|| = 0.092e24 < sb = 0.3775e24). lp3: previewDeposit(MID=1, 3e24) then deposit with it.

  Expected: pinned tick holdings unchanged by a deposit; invariant() ~ 0; quoteExactInput(A, B, 1 wei) <= a few wei.

  Actual: levelReserves(TIGHT)[A] jumps 1.128e24 -> 1.436e24 and [C] 1.590e24 -> 0.973e24; invariant() = -1.15e48 (r^2 = 4.9e49); quoteExactInput(A, B, 1) = 267,445,618,316,636,312,994,140 wei (~267k B for 1 wei of A); a further exact-in 774,816e6 C -> B leaves boundaryMask = 1 with alphaIntNorm = 0.737 < k = 0.74 and again no LevelCrossed.

  Proof test: test_returnTradeThroughThePegLeavesTickPinnedAndBreaksTheTorus.

  whole reproduction

• criticalDeposits are priced off a virtual reserve vector that can sit inside the sphere; a dust-sized pool (first deposit at MIN_RADIUS, or withdrawals leaving wei of radius) lets an attacker skim later LPs asrc/OrbitalHook.sol:700

  _levelVector/_tokenShare price an interior deposit as (x_k - xBound_k) * radius / r_int, i.e. proportionally to the raw virtual vector _x, with no projection onto the sphere. _x is allowed to sit inside the torus (F < 0): every exact-in swap adds the sub-unit remainder of its output back to _x (x[j] += wadOut - rawOut * scale[j], line 311), and when the output rounds to zero raw units the entire input stays in the pool.

  MIN_RADIUS is 1e9 WAD (1e-9 tokens), so the first depositor can open a pool whose reserves are ~4e8 wei; against that pool any exact-in trade into the 6-decimal coin whose output is below 1e12 WAD is a pure donation that moves _x far inside the sphere (tens of percent on one axis, repeatable up to the pole).

  A later honest deposit of radius R is computed from that skewed vector, so the LP pays R/1e9 times the attacker's donation in excess tokens, and the next trade (one raw unit of USDC) is solved by solveOut down to the surface, handing the whole excess to the trader. The honest LP's withdrawal is short by that amount. Cost to the attacker: one raw unit of USDC plus ~1e8 wei.

  The same inheritance happens after every full exit (_x keeps residual dust across totalRadius == 0, line 651-660), so seeding the pool at launch only protects the first epoch.

  Fix direction: price deposits (and the first deposit) from the point projected onto the sphere/torus, or require F to be within a tight relative band before accepting a deposit; raise MIN_RADIUS to a real amount; clear _x when totalRadius reaches zero. Second trigger, no attacker needed: withdraw has no residual floor, so a position can be reduced to a few wei of radius (e.g. withdraw(level, held - 3)).

  With totalRadius = 3 the reserves are 2 wei each and alphaIntNorm is integer noise (1.0 instead of 0.732); the next deposit into an empty tick (_levelVector, line 665-670) derives boundary = alphaIntNorm > kNorm from that noise, so a 3e24 deposit into the tight tick opens pinned against a 3-wei interior (boundaryMask = 1, consolidated r = 3, F = 1.4e47), i.e. the deadlocked pinned-only configuration of the medium finding, created by two ordinary calls.

  Interior deposits in that state are priced from wei-level x - xBound scaled by radius/3 (anything from 0 to astronomically large).

  whole finding

  N=2 basket (A 18 dec, C 6 dec), one full-range tick k=0.7e18, fee 400 ppm.

  (1) attacker: deposit(0, MIN_RADIUS=1e9) -> pays ~2.9e8 wei A and 1 raw unit of C.

  (2) attacker: exact-in swap 5e7 wei A -> C; output < 1 unit so the trader receives 0 and _x_A grows by 5e7 (invariant() < 0).

  (3) victim: previewDeposit(0, 1e24) then deposit with that preview -> pays ~3.43e23 A and ~2.93e17 raw C.

  (4) attacker: exact-in swap of 1 raw unit of C -> A.

  Expected: <= ~2e12 wei of A (one unit at par, fee and rounding included).

  Actual: 49,979,998,374,094,699,314,022 wei (~49,980 A).

  (5) victim: withdraw(0, 1e24) returns ~5e22 wei less A than deposited (about 14.6% of the A it paid in).

  Proof test: test_dustPoolSkimsLaterDepositors.

  Second trigger: seed WIDE 1e24; withdraw(WIDE, 1e24 - 3) -> reserves() = [2, 2, 2], totalRadius = 3, alphaIntNorm() = 1e18; deposit(TIGHT, 3e24, previewDeposit(TIGHT, 3e24)) -> boundaryMask() = 1, consolidated() = (3, 2.22e24, 0.3775e24), invariant() = 1.425e47, alphaIntNorm() = 4.5e23 (expected: the deposit opens interior at 0.732 and invariant() ~ 0).

  whole reproduction

• mediumPool deadlocks when only pinned (boundary) liquidity remains: no interior deposit and no swap is possible until the pinned LP leavessrc/OrbitalHook.sol:668

  _levelVector reverts NoInteriorLiquidity for a deposit into an empty tick whenever the consolidated interior radius is zero (line 668), and _step reverts the same way for every swap (line 746). Once a tick is pinned (which the design intends during a depeg) and the LPs of the interior ticks withdraw -- the exact sequence the circuit breaker encourages: pause, LPs exit, owner resumes -- the pool has totalRadius > 0 but r_int = 0.

  From then on nobody can open an interior position, no trade can bring the price back toward the peg (which is the only way a pinned tick ever unpins), and the pool stays dead until the pinned LP(s) voluntarily withdraw everything. A single abandoned MIN_RADIUS position in a tight tick holds the whole basket hostage forever. Funds are not locked (withdraw works), but the pool cannot recover.

  The README (Known limitations) says this needs the whole basket to sit far off-peg at once; it needs one pinned tick and one withdrawal.

  Fix direction: allow an interior deposit when r_int == 0 by opening a fresh interior sphere at the pinned ticks' plane (the point _x is fully determined by kb, sb and the direction w), or let the owner/anyone re-seed the interior.

  whole finding

  N=2 basket, ticks k=[0.5e18 (tight), 0.7e18 (wide)]. pinnedLp: deposit(TIGHT, 1e24). interiorLp: deposit(WIDE, 2e24).

  Trader dumps A for B (3 x 300k) until boundaryMask == 1 (tight pinned). interiorLp: withdraw(WIDE, 2e24) -> consolidated() returns r_int = 0, totalRadius = 1e24. newLp: deposit(WIDE, 1e24, max).

  Expected: succeeds (positions(WIDE,newLp) == 1e24) and a 1e18 swap B->A then succeeds.

  Actual: deposit reverts NoInteriorLiquidity (0x7b6098c1); every swap reverts NoInteriorLiquidity wrapped in v4's WrappedError.

  Proof test: test_interiorDepositPossibleWhenOnlyPinnedLiquidityRemains.

  whole reproduction
  proof · a Foundry test the fix has to pass

  // SPDX-License-Identifier: MIT
  pragma solidity 0.8.26;
  
  import {Test} from "forge-std/Test.sol";
  import {PoolManager} from "v4-core/src/PoolManager.sol";
  import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
  import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
  import {PoolKey} from "v4-core/src/types/PoolKey.sol";
  import {Currency} from "v4-core/src/types/Currency.sol";
  import {SwapParams} from "v4-core/src/types/PoolOperation.sol";
  import {TickMath} from "v4-core/src/libraries/TickMath.sol";
  import {PoolSwapTest} from "v4-core/src/test/PoolSwapTest.sol";
  import {OrbitalHook} from "src/OrbitalHook.sol";
  import {HookFlags} from "src/HookFlags.sol";
  
  contract USD {
      string public name = "USD";
      string public symbol = "USD";
      uint8 public constant decimals = 18;
      uint256 public totalSupply;
      mapping(address => uint256) public balanceOf;
      mapping(address => mapping(address => uint256)) public allowance;
  
      function mint(address to, uint256 amount) external {
          totalSupply += amount;
          balanceOf[to] += amount;
      }
  
      function approve(address spender, uint256 amount) external returns (bool) {
          allowance[msg.sender][spender] = amount;
          return true;
      }
  
      function transfer(address to, uint256 amount) external returns (bool) {
          balanceOf[msg.sender] -= amount;
          balanceOf[to] += amount;
          return true;
      }
  
      function transferFrom(address from, address to, uint256 amount) external returns (bool) {
          if (allowance[from][msg.sender] != type(uint256).max) allowance[from][msg.sender] -= amount;
          balanceOf[from] -= amount;
          balanceOf[to] += amount;
          return true;
      }
  }
  
  /// @notice Finding: once every remaining tick is pinned (interior radius 0), no LP can open an
  /// interior position and no swap can run, so the pool is dead until the pinned LP voluntarily
  /// leaves. Expected: an LP can always deposit into an empty interior tick; the paper's geometry
  /// defines the point (the pinned ticks' plane) and a fresh interior sphere can be opened there.
  /// Actual: `deposit` reverts `NoInteriorLiquidity`, and every swap reverts the same way.
  contract PinnedOnlyDeadlockTest is Test {
      uint160 constant SQRT_PRICE_1_1 = 79228162514264337593543950336;
      uint160 constant FLAGS = HookFlags.BEFORE_INITIALIZE | HookFlags.BEFORE_ADD_LIQUIDITY | HookFlags.BEFORE_SWAP
          | HookFlags.BEFORE_SWAP_RETURN_DELTA;
      uint256 constant R = 1_000_000e18;
      uint256 constant TIGHT = 0;
      uint256 constant WIDE = 1;
  
      PoolManager manager;
      PoolSwapTest router;
      OrbitalHook hook;
      USD a;
      USD b;
      PoolKey key;
      address pinnedLp = makeAddr("pinnedLp");
      address interiorLp = makeAddr("interiorLp");
      address newLp = makeAddr("newLp");
      address trader = makeAddr("trader");
  
      function setUp() public {
          manager = new PoolManager(address(this));
          router = new PoolSwapTest(manager);
          a = new USD();
          b = new USD();
          address[] memory basket = new address[](2);
          basket[0] = address(a);
          basket[1] = address(b);
          uint8[] memory decs = new uint8[](2);
          decs[0] = 18;
          decs[1] = 18;
          uint256[] memory ks = new uint256[](2);
          ks[0] = 0.5e18; // N = 2: (√2 − 1, 1/√2] = (0.414, 0.707]
          ks[1] = 0.7e18;
  
          bytes memory code = abi.encodePacked(
              type(OrbitalHook).creationCode,
              abi.encode(IPoolManager(address(manager)), address(this), address(0), basket, decs, ks, uint24(400))
          );
          bytes32 salt;
          bytes32 h = keccak256(code);
          for (uint256 i = 0;; i++) {
              address p = address(uint160(uint256(keccak256(abi.encodePacked(bytes1(0xff), address(this), bytes32(i), h)))));
              if (HookFlags.matches(p, FLAGS)) {
                  salt = bytes32(i);
                  break;
              }
          }
          hook = new OrbitalHook{salt: salt}(
              IPoolManager(address(manager)), address(this), address(0), basket, decs, ks, uint24(400)
          );
          (address c0, address c1) = address(a) < address(b) ? (address(a), address(b)) : (address(b), address(a));
          key = PoolKey(Currency.wrap(c0), Currency.wrap(c1), 0, 60, IHooks(address(hook)));
          manager.initialize(key, SQRT_PRICE_1_1);
  
          address[4] memory who = [pinnedLp, interiorLp, newLp, trader];
          for (uint256 i = 0; i < 4; i++) {
              a.mint(who[i], 1e27);
              b.mint(who[i], 1e27);
              vm.startPrank(who[i]);
              a.approve(address(hook), type(uint256).max);
              b.approve(address(hook), type(uint256).max);
              a.approve(address(router), type(uint256).max);
              b.approve(address(router), type(uint256).max);
              vm.stopPrank();
          }
      }
  
      function maxAmounts() internal pure returns (uint256[] memory m) {
          m = new uint256[](2);
          m[0] = type(uint256).max;
          m[1] = type(uint256).max;
      }
  
      function swap(address who, bool aForB, int256 amount) internal {
          bool z = (Currency.unwrap(key.currency0) == address(a)) == aForB;
          vm.prank(who);
          router.swap(
              key,
              SwapParams(z, amount, z ? TickMath.MIN_SQRT_PRICE + 1 : TickMath.MAX_SQRT_PRICE - 1),
              PoolSwapTest.TestSettings(false, false),
              ""
          );
      }
  
      function test_interiorDepositPossibleWhenOnlyPinnedLiquidityRemains() public {
          vm.prank(pinnedLp);
          hook.deposit(TIGHT, R, maxAmounts());
          vm.prank(interiorLp);
          hook.deposit(WIDE, 2 * R, maxAmounts());
  
          // A depeg of A pins the tight tick.
          for (uint256 i = 0; i < 10 && hook.boundaryMask() == 0; i++) {
              swap(trader, true, -int256(300_000e18));
          }
          assertEq(hook.boundaryMask(), 1 << TIGHT, "tight tick pinned");
  
          // The interior LP leaves (for example after the circuit breaker paused and was lifted).
          vm.prank(interiorLp);
          hook.withdraw(WIDE, 2 * R, new uint256[](2));
          (uint256 rInt,,) = hook.consolidated();
          assertEq(rInt, 0, "no interior radius left");
          assertGt(hook.totalRadius(), 0, "but the pool is not empty");
  
          // EXPECTED: a new LP can open the (empty) full-range tick and trading resumes.
          // ACTUAL: deposit reverts NoInteriorLiquidity, and so does every swap; the pool is dead
          // until `pinnedLp` chooses to withdraw.
          vm.prank(newLp);
          hook.deposit(WIDE, R, maxAmounts());
          assertEq(hook.positions(WIDE, newLp), R);
          swap(trader, false, -int256(1e18)); // trade back toward the peg must be possible again
      }
  }

  whole proof

• lowPinned (boundary) ticks keep earning swap fees in proportion to their radius although they provide no liquidity to those tradessrc/OrbitalHook.sol:326

  _execute credits _feeGrowth[i] += feeWad * WAD / totalRadius (line 326) and _settleFees pays every position by radius, regardless of whether its tick is interior or pinned. A pinned tick's reserves are frozen on its plane (that is the depeg isolation the design sells), so trades executed against the interior are served entirely by interior liquidity, yet the pinned tick is paid the same fee per unit of radius.

  Interior LPs subsidise pinned LPs; in a prolonged depeg the pinned (safe) positions earn the fees generated by the risk the interior positions carry. The paper (and Uniswap v3's out-of-range positions) pay only active liquidity. The README documents 'in proportion to radius', so this is a design choice, but it inverts the stated LP incentive.

  Fix direction: accrue fees per unit of interior radius only (track feeGrowth against r_int and snapshot a tick's growth when it pins/unpins).

  whole finding

  N=2, pinnedLp deposit(TIGHT, 1e24), interiorLp deposit(WIDE, 2e24), dump A until TIGHT is pinned.

  Then swap exact-in 100,000 A -> B (fee = 40 A). levelReserves(TIGHT) does not change (within 1e12 wei), yet pendingFees(TIGHT, pinnedLp)[A] grows by 13,333,333,333,333,000,000 wei (a third of the fee) and the interior LP gets two thirds.

  Expected: pinned earns 0, interior earns 40 A.

  Proof test: test_pinnedTickEarnsNoFeesFromTradesItDoesNotServe.

  proof · a Foundry test the fix has to pass

  // SPDX-License-Identifier: MIT
  pragma solidity 0.8.26;
  
  import {Test} from "forge-std/Test.sol";
  import {PoolManager} from "v4-core/src/PoolManager.sol";
  import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
  import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
  import {PoolKey} from "v4-core/src/types/PoolKey.sol";
  import {Currency} from "v4-core/src/types/Currency.sol";
  import {SwapParams} from "v4-core/src/types/PoolOperation.sol";
  import {TickMath} from "v4-core/src/libraries/TickMath.sol";
  import {PoolSwapTest} from "v4-core/src/test/PoolSwapTest.sol";
  import {OrbitalHook} from "src/OrbitalHook.sol";
  import {HookFlags} from "src/HookFlags.sol";
  
  contract USD {
      string public name = "USD";
      string public symbol = "USD";
      uint8 public constant decimals = 18;
      uint256 public totalSupply;
      mapping(address => uint256) public balanceOf;
      mapping(address => mapping(address => uint256)) public allowance;
  
      function mint(address to, uint256 amount) external {
          totalSupply += amount;
          balanceOf[to] += amount;
      }
  
      function approve(address spender, uint256 amount) external returns (bool) {
          allowance[msg.sender][spender] = amount;
          return true;
      }
  
      function transfer(address to, uint256 amount) external returns (bool) {
          balanceOf[msg.sender] -= amount;
          balanceOf[to] += amount;
          return true;
      }
  
      function transferFrom(address from, address to, uint256 amount) external returns (bool) {
          if (allowance[from][msg.sender] != type(uint256).max) allowance[from][msg.sender] -= amount;
          balanceOf[from] -= amount;
          balanceOf[to] += amount;
          return true;
      }
  }
  
  /// @notice Finding: a pinned (boundary) tick keeps earning swap fees in proportion to its radius
  /// although it provides no liquidity to the trades that pay them. Expected (Orbital paper, and
  /// Uniswap v3's out-of-range positions): a tick that is pinned earns nothing from trades executed
  /// against the interior. Actual: `_feeGrowth` is credited per unit of *total* radius.
  contract PinnedTickEarnsFeesTest is Test {
      uint160 constant SQRT_PRICE_1_1 = 79228162514264337593543950336;
      uint160 constant FLAGS = HookFlags.BEFORE_INITIALIZE | HookFlags.BEFORE_ADD_LIQUIDITY | HookFlags.BEFORE_SWAP
          | HookFlags.BEFORE_SWAP_RETURN_DELTA;
      uint256 constant R = 1_000_000e18;
      uint256 constant TIGHT = 0;
      uint256 constant WIDE = 1;
  
      PoolManager manager;
      PoolSwapTest router;
      OrbitalHook hook;
      USD a;
      USD b;
      PoolKey key;
      address pinnedLp = makeAddr("pinnedLp");
      address interiorLp = makeAddr("interiorLp");
      address trader = makeAddr("trader");
  
      function setUp() public {
          manager = new PoolManager(address(this));
          router = new PoolSwapTest(manager);
          a = new USD();
          b = new USD();
          address[] memory basket = new address[](2);
          basket[0] = address(a);
          basket[1] = address(b);
          uint8[] memory decs = new uint8[](2);
          decs[0] = 18;
          decs[1] = 18;
          uint256[] memory ks = new uint256[](2);
          ks[0] = 0.5e18;
          ks[1] = 0.7e18;
  
          bytes memory code = abi.encodePacked(
              type(OrbitalHook).creationCode,
              abi.encode(IPoolManager(address(manager)), address(this), address(0), basket, decs, ks, uint24(400))
          );
          bytes32 salt;
          bytes32 h = keccak256(code);
          for (uint256 i = 0;; i++) {
              address p = address(uint160(uint256(keccak256(abi.encodePacked(bytes1(0xff), address(this), bytes32(i), h)))));
              if (HookFlags.matches(p, FLAGS)) {
                  salt = bytes32(i);
                  break;
              }
          }
          hook = new OrbitalHook{salt: salt}(
              IPoolManager(address(manager)), address(this), address(0), basket, decs, ks, uint24(400)
          );
          (address c0, address c1) = address(a) < address(b) ? (address(a), address(b)) : (address(b), address(a));
          key = PoolKey(Currency.wrap(c0), Currency.wrap(c1), 0, 60, IHooks(address(hook)));
          manager.initialize(key, SQRT_PRICE_1_1);
  
          address[3] memory who = [pinnedLp, interiorLp, trader];
          for (uint256 i = 0; i < 3; i++) {
              a.mint(who[i], 1e27);
              b.mint(who[i], 1e27);
              vm.startPrank(who[i]);
              a.approve(address(hook), type(uint256).max);
              b.approve(address(hook), type(uint256).max);
              a.approve(address(router), type(uint256).max);
              b.approve(address(router), type(uint256).max);
              vm.stopPrank();
          }
      }
  
      function maxAmounts() internal pure returns (uint256[] memory m) {
          m = new uint256[](2);
          m[0] = type(uint256).max;
          m[1] = type(uint256).max;
      }
  
      function swap(address who, bool aForB, int256 amount) internal {
          bool z = (Currency.unwrap(key.currency0) == address(a)) == aForB;
          vm.prank(who);
          router.swap(
              key,
              SwapParams(z, amount, z ? TickMath.MIN_SQRT_PRICE + 1 : TickMath.MAX_SQRT_PRICE - 1),
              PoolSwapTest.TestSettings(false, false),
              ""
          );
      }
  
      function test_pinnedTickEarnsNoFeesFromTradesItDoesNotServe() public {
          vm.prank(pinnedLp);
          hook.deposit(TIGHT, R, maxAmounts());
          vm.prank(interiorLp);
          hook.deposit(WIDE, 2 * R, maxAmounts());
  
          for (uint256 i = 0; i < 10 && hook.boundaryMask() == 0; i++) {
              swap(trader, true, -int256(300_000e18));
          }
          assertEq(hook.boundaryMask(), 1 << TIGHT, "tight tick pinned");
  
          uint256 idxA = hook.tokenIndex(address(a)) - 1;
          uint256 pinnedBefore = hook.pendingFees(TIGHT, pinnedLp)[idxA];
          uint256 interiorBefore = hook.pendingFees(WIDE, interiorLp)[idxA];
  
          // This trade is served entirely by the interior (wide) tick: the pinned tick's reserves
          // do not move (see levelReserves), yet it is credited a third of the fee.
          uint256[] memory pinnedReservesBefore = hook.levelReserves(TIGHT);
          swap(trader, true, -int256(100_000e18));
          uint256[] memory pinnedReservesAfter = hook.levelReserves(TIGHT);
          assertApproxEqAbs(pinnedReservesAfter[idxA], pinnedReservesBefore[idxA], 1e12, "pinned tick did not trade");
  
          uint256 fee = 100_000e18 * 400 / 1_000_000; // 40 A
          uint256 interiorEarned = hook.pendingFees(WIDE, interiorLp)[idxA] - interiorBefore;
          uint256 pinnedEarned = hook.pendingFees(TIGHT, pinnedLp)[idxA] - pinnedBefore;
  
          // EXPECTED: the whole fee goes to the liquidity that served the trade.
          // ACTUAL: pinnedEarned ≈ 13.33 A, interiorEarned ≈ 26.67 A.
          assertEq(pinnedEarned, 0, "pinned tick earned fees without providing liquidity");
          assertApproxEqAbs(interiorEarned, fee, 1e6, "interior tick earns the whole fee");
      }
  }

  whole proof

• infoRounding in deposit/withdraw shares is not strictly pool-favoured, and realReserves can over-state backing by one WAD-wei per withdrawalsrc/OrbitalHook.sol:690

  (a) _tokenShare scales the WAD-precision direction dir by sb and radius, so a deposit immediately followed by a withdrawal of the same radius can return a few wei more than was paid (observed +89,884 wei on a 1.68e24 deposit, ~5e-20 relative) or a few hundred thousand wei less. Not exploitable (gas dwarfs it) but the direction is not controlled.

  (b) realReserves/_virtualFloor subtract floor(xMinNorm * cumulativeRadius / WAD) while withdraw credits floor(xMinNorm * radius / WAD) per call, so after n withdrawals the reported real reserve can exceed claim backing by up to n WAD-wei (1e-18 token each); the invariant suite allows exactly that.

  (c) Round trips can gain up to one raw unit of the least precise basket coin (1e-6 USDC), not 'a few wei' as the README states, because an exact-in trade keeps its sub-unit remainder inside the sphere for the next trader.

  testFuzz_depositWithdrawCycleNeverProfits counterexample args=[8192, 950000000000000000, 300000000000000000000000]: withdraw returned 1680177182533038417887806 vs deposit 1680177182533038417797922 (+89,884 wei). Invariant handler sequence deposit(32,1e12,0); swapExactOut(1.15e18,13696,true,18); deposit(96833011,4096,1.7e38); roundTrip(4096,22585,false,1060): round-trip gain ~2e12 wei after a sub-unit USDC remainder was scaled by a deposit.