I've replaced the sampled IMD/USD source with direct current-price reads. Build, the full test suite, forge fmt --check and the recorded-block mainnet fork all pass. I made no git commit or push, because this task doesn't allow changes under .git/. So there is no published commit yet: the uploader has to publish these files, and the commit SHA comes from that. Independent review of this revision is still pending.

What changed

• New price source: src/mainnet/ImdSpotUsdSource.sol has no stored state. Its price is the IMD/ETH v4 pool's current price × Chainlink ETH/USD, read directly from the pool's on-chain state each time.
  • Pool checks: chain 1, the PoolManager's deployed code, the pool's exact key (tested to hash to its pool id), IMD's code, 18 decimals, a nonzero price, the 1% fee and nonzero in-range liquidity.
  • Chainlink checks: the feed's deployed code, 8 decimals, a positive answer, a completed round, a sane timestamp and an age of at most 90 minutes.
  • Math: exact 512-bit, works in either currency order, and always rounds down, so rounding can never open a gate early.
• Unchanged: the UNLK/IMD oracle and the hook keep their logic.
  • The hook only accepts the new source; it now rejects the old sampler's code.
  • Activation needs one valid current price, with no waiting period and no observation history.
  • Bad price data still only blocks new gate advancement; trading, transfers and claims keep working.
• Removed from the active price path: sample(), the 48h warm-up, observation windows, rate clamps, the minimum-depth screen and the keeper. ImdSampledUsdSource stays in the tree as historical.
• Updated: the stored code commitments and the export script (ImdReviewedCode.sol, scripts/mainnet/artifacts.py), ARTIFACTS.json with sizes and ABIs, the PrepareImd deployment script, the fixtures, the candidate UI text in web/src/NextRelease.tsx, and the README. The new docs/mainnet/SPOT_PRICE.md holds the design, the deployment checklist, the accepted risk and the open items.

Results

• Code commitments: python3 scripts/mainnet/artifacts.py --check passes, including the contract-size and constructor checks.

• forge test with the required fuzz seed: 402 passed, 0 failed, 0 skipped. This includes a new SpotOracle.t.sol covering:

  • the exact rounding-down result;
  • the extreme ends of the price range (no overflow);
  • stale, zero, negative, incomplete-round, future-dated and wrong-decimals Chainlink data;
  • uninitialized pool, zero liquidity, wrong fee, wrong chain and wrong deployed code;
  • a manipulated price moving the result immediately;
  • no sample() function and no stored history.

  V4Activation.t.sol adds activation rolling back cleanly on an uninitialized pool, stale feed or zero liquidity; activation in the same block once the price is valid; and the old sampler being rejected.

• Fork run at recorded block 26204722 with the real factory, PoolManager, Universal Router, Permit2, IMD, IMD/ETH pool and Chainlink: 94 passed, 0 failed.

  • Activation happens in the recorded block with no time travel and no price mock; recorded IMD/USD is about $6.8188.
  • The run also covers normal trades, quota rejection, fees, irreversible gates, rollback and both token orders.
  • The gate-boundary cases in that suite substitute price fixtures after activation, as labelled.
  • The only time skip is the factory's 1-hour lock on the native claim, after activation.
  • publicnode no longer serves this old block, so I ran it through eth.drpc.org.
  • Outputs are in docs/mainnet/spot-results/.

Accepted by you (not fixed)

• A move in either pool, even within one transaction or via a flash loan, can open gates early and permanently, including the $50M global bypass. No resistance to manipulation is claimed, and the attack tests stay.
• Shared-executor quota pooling remains disclosed.

Still open (not covered by that acceptance)

• Inde