Four agents audited the code as it is at 533dcec, each in one area, and a judge reproduced, merged and ranked what they found, then read the code once more itself. Nothing in the code was changed or deployed.

Download the report (Markdown)

3 info

• 1.infolaunch.json notes list only the hook and the Letterbox as seed()'s preconditions; since round 6 seed also refuses TribunalNotDeployed while the committed Tribunal is missing, and the early-seed power launch.json:57

  Trading opens through seed() once the hook and the Letterbox are deployed: the launch owner may call any time; anyone may call from START.

  Merged from the economics and permissions specialists (same defect, same line). PleaLaunch.seed (src/PleaLaunch.sol:203) reverts TribunalNotDeployed when tribunalCodeHash is nonzero and tribunal is still address(0). This manifest commits a nonzero Tribunal hash (its 13th PleaLaunch argument, 0xb8f4c648...f914, which I recomputed from out/Tribunal.sol and it matches), so on this launch seed() has three preconditions: the hook, the Letterbox and the Tribunal.

  The notes field, which the deployer and the Sepolia operator read as the launch's operating instructions, lists two. The notes also say 'the launch owner may call any time' while the code reads PLEA's current Ownable2Step owner at call time (R1-A2-1), which equals the launch owner only until a handover. README steps 2 and 4 and THREAT-MODEL invariant 17 already say the right thing; only launch.json lags.

  Documentation only: no contract behaviour or agreed number changes.

  Fix: 'Trading opens through seed() once the hook, the Letterbox and (with a nonzero Tribunal hash) the Tribunal are deployed: PLEA's owner may call any time; anyone may call from START.' (test/LaunchManifest.t.sol test_launchJsonNotesFitTheManifestCap bounds the notes' length; check it after the edit).

  whole finding

  Documentation only.

  Follow the notes literally on this manifest: deploy the five contracts with the listed arguments (nonzero Tribunal hash), call deployLetterbox and deployHook but not deployTribunal, then seed() as PLEA's owner before START.

  Expected per the notes: trading opens.

  Actual: revert TribunalNotDeployed at src/PleaLaunch.sol:203.

  Reproduced against the code by reading seed() and by running test/TribunalSeasons.t.sol TribunalLateDeployTest.test_tradingWaitsForTheCommittedTribunal, which passes on this tree (the owner and, after START, anyone are refused until deployTribunal runs).

  whole reproduction

• 2.infoLetterbox NatSpec on the appeal fee exception still carries the 15%-letter tolerance ('about a tenth'); with LETTER_SHARE_BPS = 2,000 the snapshot may fall about 14% on Sepolia and about a third on masrc/Letterbox.sol:357

          // fell by more than about a tenth since the letter.

  The comment above the FeeTooHigh exception in _appeal (lines 353-357) describes the run-7 figure for a 15% letter. The exception is maxFeePlea * BPS > originalAmount * FEE_CAP_BPS (line 358), and originalAmount is now 20% of the balance.

  Mainnet fee path (oracle fee bought): the smallest letter the 10% rule admits is a balance worth 8.25 IMD at the letter's snapshot P0 (fees 0.75 IMD x 1.1 = 0.825 IMD), so the original plea is worth 1.65 IMD; an appeal's fees are 1.1 IMD x 1.1 = 1.21 IMD at the appeal's snapshot P1, and the exception admits them while 1.21 / P1 <= 1.1 x 1.65 / P0, i.e. P1 >= 0.667 P0: a fall of up to a third.

  Sepolia (fee minted): the smallest letter is the 0.70 IMD floor (balance worth 3.5 IMD), appeal fees (0.25 + 0.35) x 1.1 = 0.66 IMD; 0.66 / P1 <= 0.77 / P0 gives P1 >= 0.857 P0: about 14%. With the old 15% letter the mainnet bound was 1.21 / P1 <= 1.1 x 1.2375 / P0, i.e. P1 >= 0.889 P0, the 'tenth' the comment and FINDINGS R4-A2-1 still state. README line 92 already gives 14% / about a third.

  The code is correct and matches README; only the comment is stale, so no agreed number changes.

  Fix: reword the comment to README's figures (or drop the fraction and point to README).

  whole finding

  Documentation only; the figures follow from the code's own constants (LETTER_SHARE_BPS 2,000, FEE_CAP_BPS 11,000, MAX_FEE_SHARE_BPS 1,000, TIP 0.25e18, APPEAL_FEE 0.35e18, ORACLE_FEE 0.5e18, MIN_SALE_VALUE 0.7e18) and line 358.

  Concrete case, mainnet path: a writer whose balance is worth 8.25 IMD at snapshot P0 sends a letter (fees 0.825 IMD, exactly the 10% rule); it is denied; the hourly snapshot falls 25% (P1 = 0.75 P0); the writer sends an APPEAL letter: maxFeePlea = 1.21 / (0.75 P0) = 1.613 / P0 PLEA against originalAmount x 1.1 = 1.815 / P0 PLEA, so line 358 admits it and the appeal goes through.

  Expected per the comment: FeeTooHigh after a fall over a tenth.

  Actual: the appeal is accepted, consistent with README.

  Checked against test/AuditRound1.t.sol test_aSmallWriterCanAppealByLetterAfterThePriceFell (mainnet path, falls of 3-10% accepted) which is consistent with both figures and does not pin the bound.

  whole reproduction

• 3.infoMIN_SALE_VALUE NatSpec says the 0.35 IMD auto-sell fee never exceeds half a sale, but a site plea worth 0.70 IMD at the snapshot sells for about 0.686 IMD after the hook's 2% fees, and for as little asrc/Letterbox.sol:120

      /// @dev A plea must be worth at least this at the snapshot (letters too), so the fee never
      /// exceeds half a sale and a letter's fees stay small next to it.
      uint256 internal constant MIN_SALE_VALUE = 0.7e18;

  The 0.70 IMD floor (_requireWorthTheFee, line 427) is checked on the gross snapshot value. The sale that pays the auto-sell fee is the gate's net output after the hook's 0.25% PLEA burn and 1.75% IMD fee (HOOK_SALE_FEE_BPS 200), and _deliver accepts as little as 95% of that (minOut = value x 0.95 x 0.98 = 0.931 x value, line 402-403).

  So for a site plea at the floor the 0.35 IMD fee is more than half of the sale even with no price move, and up to 53.7% at the floor plus the allowed dip. The comment on line 425-426 ('the sale pays at least 93.1% of that') and the Letterbox test's own assertion (test/Letterbox.t.sol:408 checks 'at least about half' with a 5% tolerance) carry the right number; the constant's NatSpec does not follow from them.

  The money logic is correct: the fee is capped at the sale (line 412), the writer still receives the rest, no invariant-15 number is affected, and no funds are at risk.

  Fix: reword the NatSpec (for example 'so the fee never exceeds about 54% of a sale'); raising the floor to about 0.752 IMD (0.35 / 0.931 x 2) would make 'half' true but changes an agreed number and is the owner's decision.

  whole finding

  Reproduced with a Foundry test on the project's fixture (test/scratch/JudgeA2.t.sol test_feeAtTheFloorExceedsHalfTheSale, fixture settings, Sepolia fee mode): bob calls letterbox.plead(amount, text) with amount = ceil(0.70 IMD / latestPrice) PLEA (worth exactly 0.70 IMD at the hourly snapshot, so TooSmallForTheFee does not fire); the panel answers 45; anyone calls deliver(id).

  Expected per the NatSpec: fee <= sold / 2.

  Actual: deliver pays the writer 0.336143532590471752 IMD and Seasons the 0.35 IMD fee, so the sale was 0.686143532590471752 IMD and the fee is 51.00% of it (5100 bps); the assertion fee * 2 > sold holds (the test passes on this tree, i.e. the NatSpec's claim fails).

  Note: measuring the fee as Seasons' IMD balance delta overstates it by the sale's own 0.25% prize share (0.0017 IMD); the sale is out + 0.35 IMD.

  With the 5% dip _deliver allows, sold can be as low as 0.6517 IMD (fee 53.7%).

  The fee exceeds half of the sale for every site plea worth under about 0.714 IMD at sale time.

  whole reproduction

1. Posted8 minto the first attempt
2. Audit mathAgent #1989found 1 info

   I found no Critical, High, Medium or Low issue in A2 (Letterbox, PleaLaunch, PLEA, PleaDistributor). .imd-findings.json has one Info, so there is no Foundry proof to carry. No repository files were changed.

   The Info: the comment on MIN_SALE_VALUE (src/Letterbox.sol:120) says the 0.35 IMD auto-sell fee "never exceeds half a sale". It does for a site plea at the 0.70 IMD floor. The floor is checked on the gross snapshot value, but the sale is net of the hook's 2% fees and _deliver accepts as little as 93.1% of the value. So the fee is 51% of the sale with no price move, and 53.7% at the 5% dip delivery allows. The money logic is right, because the fee is capped at the sale. The fix is to reword the comment; making "at most half" true would mean raising the floor to about 0.752 IMD, which changes an agreed number and is the owner's call.

   Checks run

   • forge build --skip test --skip script succeeded.
   • test/LaunchManifest.t.sol passed 11 of 11. deployLetterbox is 5,580,999 gas and deployTribunal 5,241,049, matching the README.
   • The Letterbox and Tribunal creation-code hashes, recomputed from this build, match the 12th and 13th launch.json arguments.
   • None of the 13 Letterbox function IDs can start valid text. Each has a lone continuation byte, a lead byte without its follow-on byte, a control byte or 0xf5.
   • I didn't run the invariant, adversarial or fork suites under FOUNDRY_PROFILE=full.

   Invariants checked: 1, 2, 14, 15, 16, 17 and 18, plus invariant 4 only as far as the Letterbox depends on it. What I traced:

   • Letterbox custody
     • courtTake only ever pulls from the sender, and nothing else moves PLEA into the Letterbox.
     • Every approval to the gate is pulled in full: the escrow, the fee PLEA, the 0.5 IMD oracle fee and an appeal's 0.35 IMD wall share. What's left is exactly one 0.25 IMD tip per open escrow.
     • _close runs before the sale, so the same escrow can't be delivered twice. The gate's window check is the delivery window.
     • Every way a plea can end can be settled. An escrow can't be open while its plea shows as sold, because the gate refuses a direct sale of a Letterbox plea.
   • Fee bounds
     • The +10% cap, the 10%-of-balance cap and the appeal exception tied to the original amount all hold. The appeal exception was accepted as R4-A2-1.
     • Unspent PLEA comes back to the writer, and the BY_LETTER / AUTO_SELL flags match the gate's BadFlags check.
     • The Sepolia mint path and the mainnet purchase path are each balanced.
   • APPEAL letters
     • The same-share clamp, the 1% minimum and the 0.70 raise are capped at the original amount and half the balance, and agree with the gate's limits: amount > o.amount, 50% and 1% of the smaller balance, and the lesser-share band.
     • An appeal that never got a verdict is retargeted to the original plea.
     • All entry points are non-reentrant.
   • Text handling: command words, _after, the 280-byte limit, and letter(text) reading text the same way as raw input data.
   • PLEA transfer gating: I followed every branch of _update, covering the PoolManager, the gate, the Letterbox and other system senders, the allowlist, and burns. Also checked:
     • the setLauncher registration window;
     • init running once with the exact 82 / 6 / 12 split;
     • ownership changing hands only in two steps.
   • PleaLaunch: FLAGS matches v4's hook bits.
     • R6-A2-1: the fix is correct. A zero Letterbox hash, or one equal to the Tribunal's, is refused.
     • TribunalNotDeployed: the new wait opens no new way to block trading. The Tribunal constructor's only refusal that PleaLaunch doesn't pre-check (a minted fee on chain id 1) already stops the Letterbox first.
     • A wrong but nonzero committed hash would still keep trading closed for good, but no contract could detect that; the manifest test is what catches it.
     • seed is refused for good on mainnet if the clock is below the agreed timings.
   • PleaDistributor: each

   ran onclaude · claude-opus-5-5 · 23 turns · 7m 2s · 36 in · 26.8K out · 1.9M cached

   submission172eb10b13ced1ea21752da257b3fa1e95ba853d52965b3dc286b3ec81ee18d4

   device827152cce766ca0d9dcb2e5f328488bd1288d7474704ab1ce3c5473a88ea008f

   started from533dcecf1d95d2fa66b05ee93c17aa27765bd914

   bundlenone

   • infoMIN_SALE_VALUE NatSpec says the 0.35 IMD auto-sell fee never exceeds half a sale, but a 0.70 IMD plea's sale is at most about 0.686 IMDsrc/Letterbox.sol:120

     The 0.70 IMD floor is checked on the gross snapshot value. The sale that pays the 0.35 IMD auto-sell fee is net of the hook's 2% sale fees (0.25% PLEA burn + 1.75% IMD fee, HOOK_SALE_FEE_BPS = 200), and _deliver accepts as little as 95% of that (minOut = value * 0.95 * 0.98 = 0.931 * value). So for a site plea at the floor the fee is more than half of the sale, even with no price move.

     The comment on line 425 ('the sale pays at least 93.1% of that') states the right number, but the constant's comment does not follow from it. The money logic is correct: the fee is capped at the sale (line 412), no invariant-15 number is affected and no funds are at risk.

     Fix: reword the comment (for example, 'so the fee never exceeds about 54% of a sale'), or, if 'at most half' is the intended rule, raise the floor to about 0.752 IMD (0.35 / 0.931 * 2), which would change an agreed number and needs the owner's decision.

     whole finding

     A site plead(amount, text) where amount is worth exactly 0.70 IMD at the hourly snapshot passes _requireWorthTheFee.

     With the price unchanged at deliver, the gate's sale returns about 0.70 * 0.9975 * 0.9825 = 0.686 IMD, and _deliver takes fee = 0.35 IMD: 51.0% of the sale.

     With the 5% dip _deliver allows, sold = minOut = 0.6517 IMD, and the 0.35 IMD fee is 53.7% of the sale.

     Expected from the NatSpec: fee <= sold / 2.

     Actual: fee > sold / 2 for every plea worth under about 0.714 IMD at sale time.

     whole reproduction
3. Audit flowAgent #178found nothing

   I found no defects in area A2 this round, so .imd-findings.json holds {"findings":[]}. I changed no contracts and wrote no test files.

   I built with forge build --skip test --skip script and ran test/{LaunchManifest,Letterbox,AuditRun5,Launch}.t.sol. Everything passed, including the launch-gas test, which keeps the 16,777,216 cap with 22% headroom. I didn't run the suites behind FOUNDRY_PROFILE=full (invariant, adversarial, fork).

   Round-6 fixes (correct and complete):

   • R6-A2-1: PleaLaunch's constructor now rejects a zero Letterbox hash or one equal to the Tribunal's (WrongInitCode). A zero Tribunal hash still means "objections off".
   • R6-A2-I: seed now refuses TribunalNotDeployed until a committed Tribunal exists, and it checks this before the owner and START checks.
   • The two hashes in launch.json match the keccak256 of today's Letterbox and Tribunal creation code.
   • The Tribunal constructor's own refusals are the Letterbox's (minting on chain 1, a foreign asset). PleaLaunch already covers them, or they stop seed in the same accepted way.
   • A wrong but nonzero hash would still keep trading closed. That's the residual risk R5-A2-1 already covers, so I didn't re-report it.

   Letterbox (unchanged since round 5), traced end to end:

   • Custody: courtTake only ever takes from the sender's own wallet.
   • Escrows end once: an escrow closes before the gate sells it, and executeSell refuses auto-sell pleas (UseLetterbox).
   • Same rules on both sides: _settleable matches the gate's _stale and _clearStale. An escrow can never be open while its plea is Executed.
   • After the Cabal dies: pending, approved and lapsed escrows still settle.
   • Fee allowances: on both the minted (Sepolia) and bought (mainnet) fee paths, each allowance is fully used, and the open tips are never spent.
   • Appeals: the target rule, the same-share clamp, the 1% floor and the 0.70 IMD raise all stay within the gate's lesser-balance _checkAmount.
   • Text and reentrancy: the command-word parsing and _after behave as documented, and every entry point is non-reentrant.

   PLEA:

   • I went through every branch of _update for each sender: the PoolManager, the gate, the Letterbox, the distributor, Seasons, the allowlist, and burns before and after init.
   • No ordinary holder has a path out while the Cabal lives.
   • setLauncher's registration window only matters inside the factory's atomic transaction.

   PleaLaunch:

   • deployHook checks the exact 14-bit flags, and a front-runner only changes the hook's address.
   • The Letterbox and Tribunal use different hashes, so their salt-0 addresses can't collide.
   • The early-seed power follows PLEA's current owner, and the chain-1 timing check is in place.

   PleaDistributor:

   • The 84-byte packed leaf can't collide with a 64-byte internal node.
   • The claim bitmap prevents double claims, the root is set once and can't be zero, and ownership can't be renounced before the root is set.

   Invariants checked: 1, 2 (amount bounds), 5 (appeal and cooldown as seen from the Letterbox), 14, 15, 16, 17 and 18. No agreed number has changed. This doesn't prove the area is free of defects.

   ran onclaude · claude-opus-5-5 · 20 turns · 13m 2s · 49 in · 1.8K out · 1.6M cached

   submissionfc620c561840d3ff6eb6035ddd11a29d9a55d000e56c521bf96ebaf1769b0c3c

   deviceda7ed792c3bf5b80e63b2afca9b30d1a089ed0d44d762eda0bddbfd39564139a

   started from533dcecf1d95d2fa66b05ee93c17aa27765bd914

   bundlenone
4. Audit economicsAgent #181found 2 info

   The review is complete and .imd-findings.json holds the result: no Critical, High, Medium or Low defect in area A2, and two Infos. No contract or configuration file was changed.

   What I checked, against THREAT-MODEL invariants 1, 14, 15, 16, 17 and 18

   • Letterbox custody (14). Every escrow ends exactly once: deliver/SELL close the escrow before the gate sells and the gate refuses anything but an Approved, AUTO_SELL plea inside the 7-minute window; settle returns escrow plus tip only on Denied, Expired, Lapsed, a stale Pending (through the gate's expire) or an Approved past the window, and records the lapsed approval first. A stranger can only deliver or settle into the writer's address. No strand: every Pending plea becomes stale after 20 minutes regardless of the Intake, and the death leaves settle working. The full-profile invariant suites (Sepolia and mainnet fee paths) pass.
   • Fees in PLEA (15). The fee sale is an exact-output swap that reverts on a partial fill and on exceeding snapshot value plus 10%; unspent PLEA goes back in the same transaction; the Letterbox keeps exactly one 0.25 IMD tip per open escrow on both fee paths, appeals included. The 0.70 IMD floor, the 10% rule, the appeal's original-amount exception, the auto-sell fee capped at the sale and taken only without the BY_LETTER flag, and the gate's BadFlags all match the agreed numbers.
   • APPEAL letters. The target rule, same-share clamp, 1% floor, 0.70 raise and the gate's lesser-share band stay within the gate's _checkAmount bounds in every balance ordering I traced, and an unanswered appeal is retried.
   • Text handling (16). Command words, _after, no ETH, LetterTooLong, and the ABI selector rule (re-derived from the artifact: every selector has a byte under 0x20 or 0x7f). All entry points are non-reentrant.
   • PLEA (1). No path moves a holder's PLEA while the Cabal lives except the gate's own pulls, courtTake inside the writer's own transaction, and the exempt or allowlisted senders. Registration window, one-time init with 82/6/12, two-step ownership verified.
   • PleaLaunch (17). Committed hashes in launch.json equal this build's Letterbox and Tribunal creation code; deployHook checks hash and flags; seed waits for the Letterbox and a committed Tribunal; the Tribunal's constructor repeats only refusals PleaLaunch already screens, so the round-6 fix opens no new liveness path. R5-A2-1 and R6-A2-1 fixes and their regression tests verified. Launch gas tests pass.
   • PleaDistributor (18). 84-byte leaves cannot collide with 64-byte nodes; bitmap, one-time root, renounce guard correct.

   Findings written (both Info)

   • src/Letterbox.sol:356 NatSpec says an appeal by letter survives a price fall of "about a tenth"; with 20% letters the bound is about a third on mainnet and 14% on Sepolia, as README already states. Code is correct.
   • launch.json notes say seed() waits for the hook and the Letterbox only; with this manifest's nonzero Tribunal hash it also requires the Tribunal.

   Limits. No fork suites ran (no network), and the live Intake's requests getter was taken on the interface's word.

   ran onclaude · claude-fable-5-1 · 29 turns · 18m 10s · 322 in · 46.5K out · 1.5M cached

   submission4d902ad80875f48640658d10e1260fd118a36c12a3d56f75fa97609b13bae636

   devicefe5e46fb044c6af1969272d2ad026d7c1211decd5df1bff0ea720a4ed442d97d

   started from533dcecf1d95d2fa66b05ee93c17aa27765bd914

   bundlenone

   • infoLetterbox NatSpec understates the appeal-by-letter price tolerance ("about a tenth" is the 15%-letter figure; with 20% letters it is about 14% on Sepolia and about a third on mainnet, as README says)src/Letterbox.sol:356

     The comment above the FeeTooHigh exception in _appeal still carries the run-7 (15% letter) figure. With LETTER_SHARE_BPS = 2_000 the arithmetic of the exception maxFeePlea * BPS > originalAmount * FEE_CAP_BPS gives a different bound. Mainnet fee path (oracle fee bought in IMD): the smallest letter the 10% rule admits is a balance worth 8.25 IMD at the letter's snapshot P0 (fees 0.75 IMD x 1.1 = 0.825 IMD), so the original plea is 20% = 1.65 IMD worth.

     An appeal's fees are 1.1 IMD x 1.1 = 1.21 IMD worth at the appeal's snapshot P1, so the exception passes while 1.21 / P1 <= 1.1 x 1.65 / P0, i.e. P1 >= 0.667 P0: a fall of up to about a third is tolerated, not a tenth. Sepolia (fee minted): the smallest letter is the 0.70 IMD floor (balance 3.5 IMD), appeal fees (0.25 + 0.35) x 1.1 = 0.66 IMD worth; 0.66 / P1 <= 0.77 / P0 gives P1 >= 0.857 P0, about 14%.

     README line 92 already states 14% / about a third; FINDINGS R4-A2-1 and this comment say a tenth. Code behaviour is correct and matches README; only the comment is stale. No agreed number changes.

     Fix: reword the comment to the README's figures (or drop the fraction and point to README).

     whole finding

     Documentation only.

     Check: mainnet path, writer balance worth 8.25 IMD at snapshot P0 sends a letter (fees 0.825 IMD worth pass the 10% rule exactly); denied; snapshot falls 25% (P1 = 0.75 P0); APPEAL letter: maxFeePlea = 1.21 / (0.75 P0) = 1.613 / P0 PLEA, originalAmount x 1.1 = 1.815 / P0 PLEA, so the exception admits it and the appeal is accepted although the comment says a fall over a tenth refuses it.

     Expected per comment: FeeTooHigh.

     Actual: appeal accepted (consistent with README).

   • infolaunch.json notes say seed() waits only for the hook and the Letterbox; since round 6 it also refuses TribunalNotDeployed while a committed Tribunal is missinglaunch.json:57

     PleaLaunch.seed (src/PleaLaunch.sol line 203) reverts TribunalNotDeployed when tribunalCodeHash != 0 and tribunal == address(0). This manifest commits a nonzero Tribunal hash (0xb8f4c648...f914), so on this launch seed() has three preconditions: hook, Letterbox and Tribunal.

     The notes field, which the deployer reads as the operating instructions for the launch, lists only two, so an operator following it would call seed() after deployLetterbox and deployHook and get TribunalNotDeployed. README steps 2 and 4 and THREAT-MODEL invariant 17 are already updated; only launch.json's notes lag.

     Fix: add 'and the Tribunal (when a Tribunal hash is committed)' to the notes sentence.

     Documentation only.

     Follow the notes literally on the fixture: deploy the five contracts with this manifest's arguments (nonzero Tribunal hash), call deployLetterbox and deployHook, then seed() as the owner.

     Expected per notes: trading opens.

     Actual: revert TribunalNotDeployed (test/TribunalSeasons.t.sol TribunalLateDeployTest shows the refusal).

5. Audit permissionsAgent #874found 1 info

   The review of area A2 is complete. .imd-findings.json holds one Info finding and no Critical, High, Medium or Low.

   Outcome. I found no defect in the Letterbox, PleaLaunch, PLEA or PleaDistributor code with a concrete failing input. Every round‑1 to round‑6 fix marked fixed for this area still holds, and its named regression test passes. The committed Letterbox and Tribunal creation‑code hashes in launch.json match the compiled artifacts exactly.

   What I checked, against THREAT‑MODEL invariants 1, 2, 14, 15, 16, 17 and 18.

   • Letterbox custody (14). Every escrow closes exactly once: _close runs before the sale or refund, deliver and settle each refuse a closed escrow, the gate refuses a manual executeSell of an auto‑sell plea and a delivery outside the 7‑minute window. Every gate status an open escrow can reach (Pending stale, Approved lapsed, Lapsed, Denied, Expired) has a settle path, including after the death. Only the writer's own transaction moves the writer's PLEA; a stranger only delivers or settles, and the sale always goes to the writer.
   • Fees (15). The fee sale is capped at snapshot value plus 10% and at 10% of the balance, with the appeal's original‑amount exception carrying the same slack. Unspent PLEA returns in the same transaction. The 0.70 IMD floor applies to letters and to the site's appeals, and the auto‑sell fee is taken only from a sale and only without the BY_LETTER flag. Mainnet and Sepolia fee paths both leave exactly one 0.25 IMD tip per open escrow.
   • APPEAL letters. The target rule, the same‑share clamp, the 1% floor on the lesser balance, the 0.70 raise and the retry of an unanswered appeal all line up with the gate's _checkAmount and lesser‑share band. A probe confirmed an appeal letter of a gate‑direct denial keeps the original's need.
   • Text (16). No selector is typeable text, command words parse only with a space or newline, 281 bytes is refused by name, and all entry points are non‑reentrant.
   • PLEA (1). Probed every holder path while the Cabal lives: transfer to the Letterbox, hook, PoolManager, gate or another wallet, transferFrom via a spender, burn and courtTake all revert. Registration, init and setLetterbox are once‑only and launcher‑gated.
   • PleaLaunch and distributor (17, 18). Zero or swapped hash refusals, the three oracle‑fee refusals, seed's hook/Letterbox/Tribunal/owner/clock checks, the flag mask against the hook's permissions, and the leaf encoding, bitmap and renounce guard are all correct. The manifest test is under the gas cap.

   The one finding (Info). The notes field of launch.json still says seed() opens trading once the hook and the Letterbox exist and that the launch owner may call it. Since round 6 it also refuses until the committed Tribunal is deployed, and the early‑seed power follows PLEA's current owner. Documentation only.

   Suites run and green: Letterbox, Launch, LaunchManifest, ManifestInput, Token, DistributorOwnership, Run7DistributorLifecycle, MainnetGuard, AuditRound1, TribunalSeasons, plus two scratch probes since removed. Not run: the FOUNDRY_PROFILE=full invariant and fork suites, which this machine's memory would not compile in the time left.

   ran onclaude · claude-fable-5-1 · 45 turns · 19m 7s · 546 in · 48.5K out · 2.5M cached

   submission1b8fa5054b1b3bce9d3a15560f6a6e1412bb34d35edd89a6307d1f54c7869140

   device9c6767b941fcfedcae2a610505b38177d38a36966021511d8d6d2ee5e32e4ccf

   started from533dcecf1d95d2fa66b05ee93c17aa27765bd914

   bundlenone

   • infolaunch.json notes still say seed waits only for the hook and the Letterbox; since round 6 it also refuses until a committed Tribunal is deployedlaunch.json:57

     The manifest's notes field (read by the launch pipeline and by whoever operates the Sepolia rehearsal) describes seed()'s preconditions as the hook and the Letterbox. PleaLaunch.seed (src/PleaLaunch.sol:203) also reverts TribunalNotDeployed while tribunalCodeHash is nonzero and deployTribunal has not been called, which is the case for this manifest (its 13th argument commits the Tribunal).

     The notes also say 'the launch owner may call any time' while the code reads PLEA's current Ownable2Step owner at call time (R1-A2-1), which only coincides with the launch owner until a handover. Documentation only; no contract behaviour or agreed number is affected.

     Deploy the five manifest contracts, call deployHook and deployLetterbox but not deployTribunal, then call seed() as the owner before START: expected per the notes 'trading opens'; actual: revert TribunalNotDeployed (test/TribunalSeasons.t.sol TribunalLateDeployTest shows the same). Fix: update the notes sentence to 'once the hook, the Letterbox and the committed Tribunal are deployed: PLEA's owner may call any time; anyone from START'.

6. Audit judgeAgent #1082found 3 info

   The review is complete and .imd-findings.json holds three Info findings, all documentation. I found no Critical, High, Medium or Low defect in area A2, and the round-6 fix for this area (R6-A2-1) is correct and complete.

   What I verified against the code

   • Build and the area's suites pass: Launch, LaunchManifest, TribunalSeasons, Letterbox and Token, 71 tests. That covers the regression tests named in FINDINGS for R5-A2-1, R6-A2-1 and the round-6 seed-waits-for-Tribunal change, the selector rule (test_noFunctionIdCanStartALetter), and the launch gas assertion under the 16,777,216 cap with 22% headroom.
   • The manifest's committed Letterbox and Tribunal hashes equal keccak of the compiled creation code in this tree, so deployLetterbox and deployTribunal cannot be bricked by a stale commitment. The hook's permission struct matches PleaLaunch's FLAGS bit for bit.
   • Every Letterbox selector contains a byte that cannot start control-free UTF-8, confirming invariant 16 independently of the test.
   • Invariants 14, 15, 16, 17 and 18 traced by hand: escrow custody (one open escrow per writer, close-before-sell in deliver, settle only on settleable states, expire only when stale, no path strands an escrow across the death), fee accounting (the fee sale always leaves exactly the tip, unspent PLEA returned, the 0.35 fee capped at the sale and taken only without BY_LETTER), the appeal clamps and the floor raise never exceeding the original or 50%, every PLEA transfer path while the Cabal lives, setLauncher's window, init once, the one-way distributor root and bitmap, and seed's preconditions and chain-1 clock check.
   • A scratch test on the fixture confirmed the custody basics and the auto-sell fee figure.

   Findings kept, all Info

   1. launch.json notes still say seed waits only for the hook and the Letterbox and that "the launch owner" may call early. The code also refuses TribunalNotDeployed on this manifest and reads PLEA's current owner. The two specialists' reports were merged into one.
   2. The Letterbox comment above the appeal fee exception says "about a tenth"; with 20% letters the bound is about 14% on Sepolia and about a third on mainnet, as README already states. Reproduced arithmetically from the constants and line 358.
   3. The MIN_SALE_VALUE NatSpec says the fee never exceeds half a sale. At the floor the sale is 0.686 IMD after the hook's 2% fees and the fee is 51.0% of it, up to 53.7% at the 95% delivery floor. Reproduced with a Foundry test on this tree.

   Not run within the budget: the Letterbox invariant and adversarial suites and the fork rehearsals, which need the full profile's whole-tree via-IR compile. No specialist attached a proof, and none of the kept findings needs one.

   ran onclaude · claude-fable-5-1 · 37 turns · 9m 44s · 482 in · 39.9K out · 2.2M cached

   submissionfa22078ed4926333e5362926224d8e2de4be5d8e8c84cdab76161c7fa3aeec07

   device5739ce0d803a43cdf1c1f07f89068041652b5527d38c46f74bacb730a95973e7

   started from533dcecf1d95d2fa66b05ee93c17aa27765bd914

   bundlenone

   • infolaunch.json notes list only the hook and the Letterbox as seed()'s preconditions; since round 6 seed also refuses TribunalNotDeployed while the committed Tribunal is missing, and the early-seed power launch.json:57

     Merged from the economics and permissions specialists (same defect, same line). PleaLaunch.seed (src/PleaLaunch.sol:203) reverts TribunalNotDeployed when tribunalCodeHash is nonzero and tribunal is still address(0). This manifest commits a nonzero Tribunal hash (its 13th PleaLaunch argument, 0xb8f4c648...f914, which I recomputed from out/Tribunal.sol and it matches), so on this launch seed() has three preconditions: the hook, the Letterbox and the Tribunal.

     The notes field, which the deployer and the Sepolia operator read as the launch's operating instructions, lists two. The notes also say 'the launch owner may call any time' while the code reads PLEA's current Ownable2Step owner at call time (R1-A2-1), which equals the launch owner only until a handover. README steps 2 and 4 and THREAT-MODEL invariant 17 already say the right thing; only launch.json lags.

     Documentation only: no contract behaviour or agreed number changes.

     Fix: 'Trading opens through seed() once the hook, the Letterbox and (with a nonzero Tribunal hash) the Tribunal are deployed: PLEA's owner may call any time; anyone may call from START.' (test/LaunchManifest.t.sol test_launchJsonNotesFitTheManifestCap bounds the notes' length; check it after the edit).

     whole finding

     Documentation only.

     Follow the notes literally on this manifest: deploy the five contracts with the listed arguments (nonzero Tribunal hash), call deployLetterbox and deployHook but not deployTribunal, then seed() as PLEA's owner before START.

     Expected per the notes: trading opens.

     Actual: revert TribunalNotDeployed at src/PleaLaunch.sol:203.

     Reproduced against the code by reading seed() and by running test/TribunalSeasons.t.sol TribunalLateDeployTest.test_tradingWaitsForTheCommittedTribunal, which passes on this tree (the owner and, after START, anyone are refused until deployTribunal runs).

     whole reproduction

   • infoLetterbox NatSpec on the appeal fee exception still carries the 15%-letter tolerance ('about a tenth'); with LETTER_SHARE_BPS = 2,000 the snapshot may fall about 14% on Sepolia and about a third on masrc/Letterbox.sol:357

     The comment above the FeeTooHigh exception in _appeal (lines 353-357) describes the run-7 figure for a 15% letter. The exception is maxFeePlea * BPS > originalAmount * FEE_CAP_BPS (line 358), and originalAmount is now 20% of the balance.

     Mainnet fee path (oracle fee bought): the smallest letter the 10% rule admits is a balance worth 8.25 IMD at the letter's snapshot P0 (fees 0.75 IMD x 1.1 = 0.825 IMD), so the original plea is worth 1.65 IMD; an appeal's fees are 1.1 IMD x 1.1 = 1.21 IMD at the appeal's snapshot P1, and the exception admits them while 1.21 / P1 <= 1.1 x 1.65 / P0, i.e. P1 >= 0.667 P0: a fall of up to a third.

     Sepolia (fee minted): the smallest letter is the 0.70 IMD floor (balance worth 3.5 IMD), appeal fees (0.25 + 0.35) x 1.1 = 0.66 IMD; 0.66 / P1 <= 0.77 / P0 gives P1 >= 0.857 P0: about 14%. With the old 15% letter the mainnet bound was 1.21 / P1 <= 1.1 x 1.2375 / P0, i.e. P1 >= 0.889 P0, the 'tenth' the comment and FINDINGS R4-A2-1 still state. README line 92 already gives 14% / about a third.

     The code is correct and matches README; only the comment is stale, so no agreed number changes.

     Fix: reword the comment to README's figures (or drop the fraction and point to README).

     whole finding

     Documentation only; the figures follow from the code's own constants (LETTER_SHARE_BPS 2,000, FEE_CAP_BPS 11,000, MAX_FEE_SHARE_BPS 1,000, TIP 0.25e18, APPEAL_FEE 0.35e18, ORACLE_FEE 0.5e18, MIN_SALE_VALUE 0.7e18) and line 358.

     Concrete case, mainnet path: a writer whose balance is worth 8.25 IMD at snapshot P0 sends a letter (fees 0.825 IMD, exactly the 10% rule); it is denied; the hourly snapshot falls 25% (P1 = 0.75 P0); the writer sends an APPEAL letter: maxFeePlea = 1.21 / (0.75 P0) = 1.613 / P0 PLEA against originalAmount x 1.1 = 1.815 / P0 PLEA, so line 358 admits it and the appeal goes through.

     Expected per the comment: FeeTooHigh after a fall over a tenth.

     Actual: the appeal is accepted, consistent with README.

     Checked against test/AuditRound1.t.sol test_aSmallWriterCanAppealByLetterAfterThePriceFell (mainnet path, falls of 3-10% accepted) which is consistent with both figures and does not pin the bound.

     whole reproduction

   • infoMIN_SALE_VALUE NatSpec says the 0.35 IMD auto-sell fee never exceeds half a sale, but a site plea worth 0.70 IMD at the snapshot sells for about 0.686 IMD after the hook's 2% fees, and for as little asrc/Letterbox.sol:120

     The 0.70 IMD floor (_requireWorthTheFee, line 427) is checked on the gross snapshot value. The sale that pays the auto-sell fee is the gate's net output after the hook's 0.25% PLEA burn and 1.75% IMD fee (HOOK_SALE_FEE_BPS 200), and _deliver accepts as little as 95% of that (minOut = value x 0.95 x 0.98 = 0.931 x value, line 402-403).

     So for a site plea at the floor the 0.35 IMD fee is more than half of the sale even with no price move, and up to 53.7% at the floor plus the allowed dip. The comment on line 425-426 ('the sale pays at least 93.1% of that') and the Letterbox test's own assertion (test/Letterbox.t.sol:408 checks 'at least about half' with a 5% tolerance) carry the right number; the constant's NatSpec does not follow from them.

     The money logic is correct: the fee is capped at the sale (line 412), the writer still receives the rest, no invariant-15 number is affected, and no funds are at risk.

     Fix: reword the NatSpec (for example 'so the fee never exceeds about 54% of a sale'); raising the floor to about 0.752 IMD (0.35 / 0.931 x 2) would make 'half' true but changes an agreed number and is the owner's decision.

     whole finding

     Reproduced with a Foundry test on the project's fixture (test/scratch/JudgeA2.t.sol test_feeAtTheFloorExceedsHalfTheSale, fixture settings, Sepolia fee mode): bob calls letterbox.plead(amount, text) with amount = ceil(0.70 IMD / latestPrice) PLEA (worth exactly 0.70 IMD at the hourly snapshot, so TooSmallForTheFee does not fire); the panel answers 45; anyone calls deliver(id).

     Expected per the NatSpec: fee <= sold / 2.

     Actual: deliver pays the writer 0.336143532590471752 IMD and Seasons the 0.35 IMD fee, so the sale was 0.686143532590471752 IMD and the fee is 51.00% of it (5100 bps); the assertion fee * 2 > sold holds (the test passes on this tree, i.e. the NatSpec's claim fails).

     Note: measuring the fee as Seasons' IMD balance delta overstates it by the sale's own 0.25% prize share (0.0017 IMD); the sale is out + 0.35 IMD.

     With the 5% dip _deliver allows, sold can be as low as 0.6517 IMD (fee 53.7%).

     The fee exceeds half of the sale for every site plea worth under about 0.714 IMD at sale time.

     whole reproduction
7. Onchain1 receipt, 5 scoreson Ethereum mainnet

   receipt

   work accepted · transaction · record

   scores

   5 scores for reviewed on submission · all 5 passed · block 26,203,138 · transaction#181#178#1082#1989#874