Four agents audited the code as it is at 2875ffb, each in one area, and a judge reproduced, merged and ranked what they found, then read the code once more itself. Nothing in the code was changed or deployed.

Download the report (Markdown)

1 medium4 low6 info

• 1.mediumcirculating() is deflated when a minter burns flash-minted imdUSD inside the loan: a borrower multiplies the redemption base-rate rise (and the savings uptake) at near-zero costsrc/ImdUSD.sol:145

          return totalSupply() - flashOutstanding();

  Q1 (supply) and Q5 (uptake). circulating() = totalSupply() - flashOutstanding() is what Redeemer._fee / Redeemer.redeem (src/Redeemer.sol:146-147,153) and LedgerBase._mintInterest (src/LedgerBase.sol:277-278) divide by so that a flash mint cannot dilute them. The counter in the transient slot is only ever moved by flashLoan itself (lines 159,167).

  A minter burn of the flash-minted tokens inside the loan (Ledger.adjust repay: dDebt < 0 burns from the caller) lowers totalSupply() by the amount burned while flashOutstanding() keeps the full loan, so circulating() under-reads the real supply by the burned amount.

  Call sequence (external caller = a borrower with debt D on a redeemable type): usd.flashLoan(self, usd, D, data) -> onFlashLoan: ledger.adjust(id, repay D) [burns D of the flash-minted tokens]; redeemer.redeem(ilk, X, maxFee, n, 0) on another position of the type: supplyBefore = circulating() + X = (S - D) and next base rate = decayed + X / (S - D) / divisor instead of X / S / divisor; ledger.adjust(id, borrow D) [cost: the 7-day upfront fee on D]; approve and return.

  The base-rate rise is multiplied by S / (S - D), bounded by flashCap (100k in BetaConfig) against a 300k chain cap: with the beta's lines a borrower holding a third of the supply triples every rise, and on a small book (the proof: 100k supply, 90k own debt) a 5k redemption lifts the ETH base rate (divisor 16) from 0.31% to 3.12%; on sIMD (divisor 2) the same lifts it to the 5% cap, which decays with a 12h half-life.

  Effect: redemption arbitrage on the type is priced out for hours and the attacker's own lowest-rate positions are shielded from redemption; the README's 'An honest large sIMD redemption can hold the fee at its 5% cap for hours' becomes reachable by a small redemption. The same deflation inflates uptake = saved / circulating() in _mintInterest for an accrual triggered inside the loan, pushing the split toward savers up to savingsShare.

  No underflow: every burnable amount is part of the pre-loan supply, so circulating() >= 0 (it can read 0, at which _fee returns FEE_CAP). Reachable with BetaConfig (flashCap 100k, chainLine 300k, ETH divisor 16, sIMD divisor 2): yes, with no precondition beyond holding a debt position.

  Smallest fix: make minter burns inside a flash loan reduce the in-flight counter first, e.g. in burn and _burn-reaching paths: uint256 f = flashOutstanding(); if (f != 0) _setFlashOutstanding(f - Math.min(f, amount)); (burning first what was flash-minted), or snapshot totalSupply() at the outermost flashLoan entry in a transient slot and have circulating() return min(totalSupply() - flashOutstanding(), snapshot) while a loan is in flight.

  Proof run (solc 0.8.26 via_ir): forge test --match-path test/scratch/ProofCirculating.t.sol -vv -> [FAIL: base rate rose far more than the redemption's share of the real supply: 31177354248881897 > 6244012590666484] with logs: real supply before the tx 100095890410958904109590; circulating() inside the loan, before the burn 100095890410958904109590; circulating() inside the loan, after repaying 90k 10023300806905610808784; honest rise 0.003122006295333242; actual rise 0.031177354248881897.

  The test passes once circulating() stops under-reading on a minter burn inside a loan.

  whole finding

  State: ETH type redeemable, redeemDivisor 16, flashCap 100k; bob 10k debt at 5%, attacker contract 90k debt at 6%; 10 days after the seal (launch base rate decayed).

  Input: attacker.run(90_000e18, 5_000e18).

  Expected: Redeemer.decayedBaseRate(ETH) rises by 5,000 / 100,096 / 16 = 0.312%.

  Actual: circulating() reads 10,023 inside the loan after the repayment, supplyBefore = 15,023 - 5,000 + 5,000, and the base rate rises 3.118% (10x).

• 2.lowFeeNotes.redeem pays a matured note from the Treasury's imdUSD while bad debt is booked and uncovered, against the Treasury's stated first call for bad-debt coversrc/peg/FeeNotes.sol:148

          uint256 bal = token.balanceOf(address(treasury));
          if (bal < face) revert TreasuryShort(bal);

  Q3 and Q4 (merged from three specialists). Treasury.sol:49 states 'nothing here is earmarked for notes, so bad-debt cover keeps first call on the balance', and Treasury.retireReserve (src/Treasury.sol:137) enforces that order for the other permissionless burn path by reverting BadDebtOutstanding while ledger.totalBadDebt() != 0.

  The note path has no such rule: FeeNotes.redeem checks only token.balanceOf(treasury) >= face and Treasury.payNote (src/Treasury.sol:184-188) transfers unconditionally to the notes contract's caller.

  Bad debt routinely outlives its liquidation whenever the in-transaction cover was best effort and failed (README 'Cover gas': a sleeve mid-bid, EdgeCoverFailed, an empty Treasury), and interest minted to the Treasury afterwards (noteRevenue) is then claimable by a matured note holder before anyone calls the permissionless Treasury.coverBadDebt; the hole stays in unbacked() and keeps the global brake on for every type.

  Call sequence: Parameters OPEN_NOTE_SERIES (48h) -> buyer FeeNotes.buy -> a liquidation books bad debt whose cover fails -> Ledger._mintInterest mints revenue to the Treasury -> holder FeeNotes.redeem(id, face) succeeds -> Treasury.coverBadDebt(ilk) covers less.

  Reachable with BetaConfig: FeeNotes is deployed dormant, so a governed series must be opened first; no other precondition.

  Smallest fix: in Treasury.payNote (or FeeNotes.redeem) if (ledger.totalBadDebt() != 0) revert BadDebtOutstanding();, mirroring retireReserve, or pay at most balance - totalBadDebt. If notes are meant to rank ahead of cover, change the Treasury NatSpec at line 49 instead.

  Proof run (solc 0.8.26 via_ir): forge test --match-path test/scratch/ProofNoteRedeemAheadOfBadDebt.t.sol -> [FAIL: bad-debt cover had first call on the Treasury balance: 1000000000000000000000 != 0] test_matureNoteCannotTakeTheBalanceThatCoversBookedBadDebt().

  whole finding

  State: Treasury holds 1,000 imdUSD of interest (meter 1,000, capacity 2,000); series opened (30 days, 5%, cap 1,000); buyer bought 1,000 face for 950 USDC; 37 days later the note has matured; the Ledger books 1,000 of bad debt (totalBadDebt = 1,000).

  Calls: buyer -> FeeNotes.redeem(1, 1_000e18); anyone -> Treasury.coverBadDebt(ilk).

  Expected (Treasury.sol:49, retireReserve's rule): redeem holds while bad debt is booked, coverBadDebt burns 1,000, totalBadDebt = 0.

  Actual: redeem succeeds, Treasury balance 0, totalBadDebt stays 1,000.

  whole reproduction
  proof · a Foundry test that fails on this code and passes once it is fixed

  // SPDX-License-Identifier: MIT
  pragma solidity 0.8.26;
  
  import {Test} from "forge-std/Test.sol";
  import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
  import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
  import {Treasury, ICoverable} from "src/Treasury.sol";
  import {FeeNotes, ITreasuryNotes} from "src/peg/FeeNotes.sol";
  
  contract NUSD is ERC20 {
      constructor() ERC20("imdUSD", "imdUSD") {}
      function mint(address to, uint256 a) external { _mint(to, a); }
      function burn(address from, uint256 a) external { _burn(from, a); }
  }
  
  contract NUSDC is ERC20 {
      constructor() ERC20("USDC", "USDC") {}
      function decimals() public pure override returns (uint8) { return 6; }
      function mint(address to, uint256 a) external { _mint(to, a); }
  }
  
  /// @dev The Ledger as the Treasury sees it: books bad debt, burns the coverer's imdUSD, reports interest.
  contract NLedger is ICoverable {
      NUSD public usd;
      Treasury public treasury;
      uint128 public bad;
      constructor(NUSD u) { usd = u; }
      function setTreasury(Treasury t) external { treasury = t; }
      function setBad(uint128 b) external { bad = b; }
      function totalBadDebt() external view returns (uint256) { return bad; }
      function cover(bytes32, uint256 amount) external {
          if (amount > bad) amount = bad;
          bad -= uint128(amount);
          usd.burn(msg.sender, amount);
      }
      function retire(uint256) external {}
      function ilkState(bytes32) external view returns (uint128, uint128, uint256, uint64, uint128) { return (0, 0, 0, 0, bad); }
      // Treasury.coverBadDebt reads ledger.params().edgeIlk(ilk): this contract answers both, with no edge types.
      function params() external view returns (address) { return address(this); }
      function edgeIlk(bytes32) external pure returns (bool) { return false; }
      function edgeBackstop() external pure returns (address) { return address(0); }
      /// @dev Interest minted to the Treasury and reported to its meter, as LedgerBase._mintInterest does.
      function pay(bytes32 ilk, uint256 amount) external {
          usd.mint(address(treasury), amount);
          treasury.noteRevenue(ilk, amount);
      }
  }
  
  /// Treasury.sol says: "nothing here is earmarked for notes, so bad-debt cover keeps first call on the balance", and
  /// `retireReserve` refuses while `totalBadDebt != 0` for that reason. A matured note redeems the same balance with no
  /// such check: the note holder is paid first and the booked bad debt stays uncovered.
  contract ProofNoteRedeemAheadOfBadDebt is Test {
      NUSD usd;
      NUSDC usdc;
      NLedger ledger;
      Treasury treasury;
      FeeNotes notes;
      address governor = makeAddr("governor");
      address buyer = makeAddr("buyer");
      bytes32 constant ILK = "ETH";
  
      function setUp() public {
          vm.warp(1_800_000_000);
          usd = new NUSD();
          usdc = new NUSDC();
          ledger = new NLedger(usd);
          treasury = new Treasury(governor, IERC20(address(usd)), address(this));
          ledger.setTreasury(treasury);
          treasury.wire(ICoverable(address(ledger)));
          notes = new FeeNotes(IERC20(address(usd)), IERC20(address(usdc)), ITreasuryNotes(address(treasury)), address(this));
          treasury.wireNotes(address(notes));
          // 1,000 imdUSD of interest in the meter: capacity 2,000 of face.
          ledger.pay(ILK, 1_000e18);
          uint256 id = notes.open(30 days, 500, 1_000e18);
          usdc.mint(buyer, 1_000e6);
          vm.startPrank(buyer);
          usdc.approve(address(notes), type(uint256).max);
          notes.buy(id, 1_000e18);
          vm.stopPrank();
          skip(7 days + 30 days); // matured
      }
  
      function test_matureNoteCannotTakeTheBalanceThatCoversBookedBadDebt() public {
          // A liquidation booked 1,000 of bad debt; the cover in its own transaction failed (e.g. EdgeBidOpen at the
          // time) and the Treasury's balance now equals the hole.
          ledger.setBad(1_000e18);
          assertEq(usd.balanceOf(address(treasury)), 1_000e18);
          assertEq(ledger.totalBadDebt(), 1_000e18);
          // retireReserve refuses while bad debt is booked...
          vm.expectRevert(Treasury.BadDebtOutstanding.selector);
          treasury.retireReserve(1);
          // ...a note redemption should hold for the same reason, or at least leave what the bad debt needs.
          vm.prank(buyer);
          try notes.redeem(1, 1_000e18) {} catch {}
          treasury.coverBadDebt(ILK);
          assertEq(ledger.totalBadDebt(), 0, "bad-debt cover had first call on the Treasury balance");
      }
  }

  whole proof

• 3.lowAnyone can burn the Treasury imdUSD that backs matured fee notes through retireReserve, so every note redemption reverts TreasuryShort until the Safe refillssrc/Treasury.sol:137

          if (ledger.totalBadDebt() != 0) revert BadDebtOutstanding();
          uint256 bal = token.balanceOf(address(this));
          ledger.retire(amount < bal ? amount : bal);

  Q3 and Q4. Treasury.retireReserve is permissionless and burns min(amount, balance, Ledger.reserveBacked) of the Treasury's imdUSD (Ledger.retire, src/Ledger.sol:386-391); it refuses only while bad debt is booked.

  FeeNotes pays matured notes from the same balance (Treasury.payNote) and FeeNotes.redeem reverts TreasuryShort while the balance is below face. reserveBacked grows with every ERC-4626 yield harvest (src/LedgerBase.sol:380 reserveBacked += credit; S-USDS, S-USDC-STEAKHOUSE and wstETH in the beta) and with reserve liquidations (src/LedgerSettlement.sol:184).

  So with no bad debt booked, any account burns, at gas cost only, the interest the notes were sold against, and every holder's redemption reverts until the Safe funds the Treasury through a 48h payout. No funds are stolen (the burn is against reserve-backed supply), but redemption of notes that the FeeNotes NatSpec says 'waits' only on a short Treasury can be denied at will whenever reserveBacked > 0, and the same call spends the imdUSD that would cover future edge bad debt.

  The README known issue on retireReserve (line 188) is stale (the code does check bad debt) and does not list this effect.

  Call sequence: harvests make reserveBacked R > 0 -> a series is sold and matures -> attacker Treasury.retireReserve(type(uint256).max) -> holder FeeNotes.redeem reverts TreasuryShort(0). Reachable with BetaConfig once a note series has been opened (OPEN_NOTE_SERIES) and a yield type has harvested.

  Smallest fix: burn only the balance above the notes' outstanding face: uint256 o = INotes(notes).outstanding(); uint256 free = bal > o ? bal - o : 0; ledger.retire(amount < free ? amount : free);, or make retireReserve governor-only. Proof run (solc 0.8.26 via_ir): forge test --match-path test/scratch/ProofRetireBlocksNotes.t.sol -> [FAIL: TreasuryShort(0)] test_retireReserveBurnsNoteBacking() (gas: 676029).

  whole finding

  State: reserveBacked = 1,000e18; Treasury balance 1,000e18 of noted interest; totalBadDebt = 0; a series (30 days, 5%) sold 900e18 face for 855 USDC and has matured.

  Call: attacker -> Treasury.retireReserve(type(uint256).max).

  Expected: FeeNotes.redeem(1, 900e18) then pays 900e18.

  Actual: the Treasury balance is 0 and redeem reverts TreasuryShort(0).

  proof · a Foundry test that fails on this code and passes once it is fixed

  // SPDX-License-Identifier: MIT
  pragma solidity 0.8.26;
  
  import "forge-std/Test.sol";
  import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
  import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
  import {Treasury, ICoverable} from "src/Treasury.sol";
  import {FeeNotes, ITreasuryNotes} from "src/peg/FeeNotes.sol";
  
  contract Tok is ERC20 {
      uint8 private immutable d;
      constructor(string memory n, uint8 d_) ERC20(n, n) { d = d_; }
      function decimals() public view override returns (uint8) { return d; }
      function mint(address to, uint256 a) external { _mint(to, a); }
      function burnFrom_(address from, uint256 a) external { _burn(from, a); }
  }
  
  /// Minimal Ledger: the parts Treasury calls (retire burns the caller's imdUSD against reserveBacked, like Ledger.retire).
  contract MiniLedger {
      Tok public token;
      Treasury public treasury;
      uint256 public reserveBacked;
      uint256 public totalBadDebt;
      constructor(Tok t) { token = t; }
      function setTreasury(Treasury t) external { treasury = t; }
      function setReserveBacked(uint256 r) external { reserveBacked = r; }
      function retire(uint256 amount) external {
          if (amount > reserveBacked) amount = reserveBacked;
          reserveBacked -= amount;
          token.burnFrom_(msg.sender, amount);
      }
      function cover(bytes32, uint256) external {}
      function ilkState(bytes32) external pure returns (uint128, uint128, uint256, uint64, uint128) {}
      function mintInterest(bytes32 ilk, uint256 amount) external {
          token.mint(address(treasury), amount);
          treasury.noteRevenue(ilk, amount);
      }
  }
  
  contract ProofRetireBlocksNotes is Test {
      Tok imd;
      Tok usdc;
      MiniLedger ledger;
      Treasury treasury;
      FeeNotes notes;
      address buyer = address(0xB0B);
      address attacker = address(0xBAD);
  
      function setUp() public {
          vm.warp(1_800_000_000);
          imd = new Tok("imdUSD", 18);
          usdc = new Tok("USDC", 6);
          ledger = new MiniLedger(imd);
          treasury = new Treasury(address(0x5AFE), IERC20(address(imd)), address(this));
          ledger.setTreasury(treasury);
          treasury.wire(ICoverable(address(ledger)));
          notes = new FeeNotes(IERC20(address(imd)), IERC20(address(usdc)), ITreasuryNotes(address(treasury)), address(this));
          treasury.wireNotes(address(notes));
      }
  
      function test_retireReserveBurnsNoteBacking() public {
          // Yield harvests booked 1,000 of reserve-backed supply; 1,000 of interest reached the Treasury.
          ledger.setReserveBacked(1_000e18);
          ledger.mintInterest("ETH", 1_000e18);
          assertEq(notes.capacity(), 2_000e18);
  
          // A series opens (Parameters) and a buyer pays USDC for 900 face.
          uint256 id = notes.open(30 days, 500, 1_000e18);
          usdc.mint(buyer, 1_000e6);
          vm.startPrank(buyer);
          usdc.approve(address(notes), type(uint256).max);
          notes.buy(id, 900e18);
          vm.stopPrank();
  
          vm.warp(block.timestamp + 37 days + 1);
          assertEq(imd.balanceOf(address(treasury)), 1_000e18, "Treasury holds the face");
  
          // No bad debt is booked, so anyone may burn the Treasury's whole balance against reserveBacked.
          vm.prank(attacker);
          treasury.retireReserve(type(uint256).max);
  
          // Expected: the matured note is still payable from the interest that backed it.
          // Actual: the Treasury balance is 0 and redeem reverts TreasuryShort(0).
          vm.prank(buyer);
          notes.redeem(id, 900e18);
          assertEq(imd.balanceOf(buyer), 900e18);
      }
  }

  whole proof

• 4.lowBackstop.deposit(amount, to) lets anyone occupy both of another user's pending slots; while buckets wait, two wei block the victim's own depositssrc/backstop/Backstop.sol:419

          else if (p[0].amount == 0) p[0] = Pend(uint64(day), a128);
          else if (p[1].amount == 0) p[1] = Pend(uint64(day), a128);
          else revert TooManyPending();

  Q7. deposit(amount, to) credits the two _pend[to] slots of any to. A third day-bucket for the same user reverts TooManyPending. Under normal conditions this does not block anyone (verified): a same-day deposit merges into the griefer's slot (lines 415-416), and from day D+2 the griefer's bucket converts in _convert() and _realize(to) frees the slot before the slot logic runs.

  The specialist's reproduction as written (griefer on D and D+1, victim on D+1) therefore does not reproduce.

  The block is real only while every bucket waits (_convert returns early: a held token unpriced and above DUST_VALUE, _lossOverRoom() on the edge sleeve, or the MAX_RATE stop): then a griefer who deposits 1 wei for the victim on two different days keeps the victim's deposit reverting TooManyPending until the victim calls cancelDeposit(2) themselves, and a griefer watching the mempool can re-fill a freed slot ahead of the victim's next deposit for 1 wei plus gas per attempt.

  Reachable with BetaConfig (deposits are permissionless) only in those waiting states.

  Smallest fix: let a deposit for to != msg.sender only merge into an existing slot of to (or refuse it), or key pending deposits by day so slots are never scarce.

  Verified with a scratch test (solc 0.8.26, deleted): test_depositForOthers_whileBucketsWait_blocks passes (expectRevert TooManyPending on the victim's deposit after two 1-wei deposits on consecutive days with the sleeve's held token unpriced), and test_depositForOthers_normalConditions_noBlock passes (no revert without the waiting state).

  whole finding

  State: blue sleeve holding 500 X (worth > DUST_VALUE at its last high) whose feed has gone unpriced, so _convert returns early.

  Day D: griefer deposit(1, victim); day D+1: griefer deposit(1, victim); day D+2: victim deposit(10_000e18, victim).

  Expected: the victim's deposit lands in day D+2's bucket.

  Actual: revert TooManyPending; it succeeds only after the victim calls cancelDeposit(2).

• 5.lowA matured Backstop bucket converts at the first call after maturity, so an idle sleeve's depositor picks the price its deposit converts atsrc/backstop/Backstop.sol:708

          if (h == n || openDays[h] + 2 > today) return;

  Q7 and Q10. A bucket of day D becomes convertible from the start of day D+2 but converts only when the next deposit, cancelDeposit, realize, requestWithdraw or openBid runs _convert(), at the nav then.

  While nobody calls in, the bucket's owner holds a one-sided option on the held collateral's next price: before a known rise (a pending Chainlink round, a signed swarm attestation anyone may relay) they call realize(self) at the old HIGH price and the update lands on their shares; through a fall they simply do not call and convert afterwards at the lower nav.

  Existing holders pay the difference, bounded by one oracle step times the collateral share of the pool times the bucket's share. The specialist's claim that the matured bucket can also be cancelled in full does not hold: cancelDeposit runs _convert() first and then skips converted buckets, so cancelling a matured bucket reverts NotReady (verified). The README's known issue covers this option only for the booked-loss case.

  Reachable with BetaConfig on both sleeves whenever they hold bid collateral and no other call touches the sleeve between maturity and the price move.

  Smallest fix: have the operator's keeper (or the Liquidator's mark) call realize at the start of every day so no matured bucket waits; or record the nav at the first sync/price read after maturity and convert at that figure. Verified with a scratch test (solc 0.8.26, deleted): cancelDeposit(1_000e18) on a bucket two days old reverts NotReady; the bucket converts in whichever call comes first.

  whole finding

  Blue sleeve with 500 imdUSD and 500 X at $1 (one holder, alice, 1,000 shares).

  Day 12: bob deposits 1,000.

  Day 14, no call since: a +100% X update is pending.

  Bob calls realize(bob) first: shares = 1,000 x supply / 1,000 nav, then X = $2: nav 2,500, alice 1,250, bob 1,250.

  Expected (bob converted at the maturity price or after the update): alice 1,500.

  Actual: 250 moved from alice to bob.

  Had the update been a fall, bob leaves the bucket unconverted until after it.

• 6.infoLedgerBase comment says closeBid counts an edge premium that arrives inside a bid; closeBid never counts it, the next sync doessrc/LedgerBase.sol:293

                  IEdgeSleeve(edge).sync(); // streams over 7 days; a no-op inside an open bid (closeBid counts it then)

  Q9. Backstop.sync() returns early while a bid is open (src/backstop/Backstop.sol:595) and Backstop.closeBid (532-563) neither calls sync nor adds the arrival to tracked; it only tolerates it in the usdAfter + repaid < usdBefore check. The premium the Ledger mints to the edge sleeve during liquidatePosition sits outside tracked + staged from closeBid until the next sync() (any deposit, realize, requestWithdraw, withdraw, coverBadDebt, sell, or an explicit sync).

  No funds are at risk and every exit syncs first; only the comment is wrong.

  Fix: reword to 'a no-op inside an open bid; the next sync streams it', or call sync() at the end of closeBid after clearing the transient slots. Verified with the specialist's test (solc 0.8.26): [FAIL: closeBid did not fold the mid-bid arrival into the stream: 5050000000000000000000 != 5000000000000000000000] and [PASS] test_nextSyncDoesCountIt.

  Edge sleeve with 10,000 vested imdUSD; a standing bid repays 5,000 for 2.75 WETH while the Ledger mints a 50 imdUSD premium to the sleeve mid-liquidation.

  After closeBid: balance 5,050, tracked + staged 5,000.

  Expected per the comment: 5,050 counted at close.

  Actual: 5,000; after sync(), tracked + staged = 5,050 and unvested() = 50.

• 7.infoImdUSD NatSpec says the keeper minter is set by the timelocked setter; at genesis Parameters.setGenesisKeeper sets it with no timelocksrc/ImdUSD.sol:18

  ///  - `keeper` is set once by the same timelocked setter: the v4 peg hook (src/peg/PegHook.sol), capped by

  Q1 (merged from three specialists). ImdUSD.setKeeper only checks msg.sender == bridgeSetter (Parameters). Parameters reaches it from the 48h SET_KEEPER proposal and from setGenesisKeeper (src/Parameters.sol:63-68): the wirer's pre-seal call with no proposal or ETA, which is the path the beta deploy uses.

  README invariant 8 describes this correctly; the token's own comment claims a 48h-public step the genesis path does not have. keeperCap is 0 at genesis, so no funds are affected.

  Fix: reword line 18 to 'set once by Parameters: at genesis by the deployer before the seal, otherwise through the timelock'.

  Deployer calls Parameters.setGenesisKeeper(hook) before Parameters.seal(): ImdUSD.keeper() becomes hook in the same transaction, no Proposed event for SET_KEEPER.

  Expected per the comment: a timelocked setter.

  Actual: instant.

• 8.infoAllocator's IBackstopSale NatSpec describes releaseForSale/settleSale, which do not exist; the real flow is sell + onBackstopSellsrc/peg/Allocator.sol:46

  /// Allocator may call either. `releaseForSale` sends `amount` of `collateral` to the Allocator; `settleSale` is called
  /// right after with the proceeds already transferred to the Backstop, so it can book them against that collateral.

  Q11 (merged from two specialists). The interface (lines 48-51) declares only imdUSD() and sell(token, amount, minOut, data). The actual flow is Backstop.sell -> transfer of the collateral to the Allocator -> IBackstopSeller.onBackstopSell callback -> the route pays imdUSD to the sleeve -> the sleeve checks its balance difference against minOut and 98% of the low price.

  An integrator reading the comment gets the order and the callback wrong. Related behaviour worth stating in the comment: when the route pulls less than amount, the unsold collateral stays in the Allocator (Backstop has already debited coll[token]) and only the whole-amount floor protects the sleeve.

  Fix: rewrite the comment to describe sell and onBackstopSell.

  grep -rn 'releaseForSale|settleSale' src/ finds only this comment.

  Expected: the comment names the interface's functions.

  Actual: it names two that do not exist.

• 9.infoBackstop header lists seats under the edge sleeve's standing bid; seats are an auction type no sleeve bids onsrc/backstop/Backstop.sol:16

  /// exist per chain: `blue` (ETH, BTC, staked stables) and `edge` (sIMD, seats, stocks). The edge sleeve also burns its

  Q8 (merged from two specialists). Liquidator.bite returns at if (c.auction) (src/Liquidator.sol:154-158) and opens IAuctionJoin before the standing-bid branch, and BetaConfig.backstopSpec lists only SIMD on the edge sleeve. README lines 29-30 say so correctly.

  Fix: change '(sIMD, seats, stocks)' to '(sIMD, later edge types)'.

  Mark and bite an unhealthy SEAT position: the Liquidator returns (0,0,0) after IAuctionJoin.open and Backstop.openBid is never called.

  Expected per the header: the edge sleeve bids.

  Actual: Dutch auction only.

• 10.infoMigrator NatSpec: 'toV1 is never blocked while it holds v1' is not true; toV1 is bounded by `outstanding`, not by the v1 heldsrc/Migrator.sol:13

  /// v1's own vault's risk carried into v2; `toV1` is never blocked while it holds v1. The count is kept

  Q6. toV1 runs outstanding -= amount first (line 45) and reverts with a 0x11 panic whenever amount > outstanding, even while the Migrator holds more v1 than that (v1 donated to it, which the same comment says is deliberately not counted). The behaviour is right (a donation must not create burn or mint room); the sentence is wrong.

  Fix: 'toV1 is bounded by outstanding (the v1 taken in through toV2), never by donated v1'.

  State: outstanding = 0 and 5e18 v1 transferred to the Migrator.

  A v2 holder calls toV1(1e18).

  Expected per the comment: succeeds (it holds v1).

  Actual: arithmetic underflow at Migrator.sol:45.

• 11.infoREADME known issue on Treasury.retireReserve is stale: the code does refuse while bad debt is bookedREADME.md:188

  - `Treasury.retireReserve` is permissionless and does not check outstanding bad debt.

  Q3 (merged from three specialists). Treasury.retireReserve (src/Treasury.sol:137) reverts BadDebtOutstanding while ledger.totalBadDebt() != 0, so the accepted risk as written no longer describes the code. The permissionless part still holds and has the fee-note effect reported above (anyone may burn the balance that backs matured notes).

  Fix: update the entry to 'retireReserve is permissionless (refuses while bad debt is booked); it can burn the balance matured fee notes draw on'.

  With Ledger.totalBadDebt() == 1 wei, call Treasury.retireReserve(1).

  README says it burns.

  Actual: revert BadDebtOutstanding().