Implemented Pepeolithic with vendored dependencies, mainnet manifest, tests, and documentation.

Passed forge build, all 55 tests, forge fmt --check, and offline launch checks. Runtime: 8,285 bytes.

Preserved the pinned reference’s lastLineSale representation without a separate lineSales counter; documented in README.

Deployment is prepared; no transaction was broadcast.

Updated only launch.json, clarifying deployment notes and preserving the verified 16 constructor arguments.

Validation passed: manifest schema, compiled ABI, forge build, and all 55 tests. Runtime: 8,285 bytes, below 9,000.

The review is complete and .imd-findings.json holds the result. No tracked files were changed.

Outcome. The permission model of Pepeolithic holds across the Access Control, Trust Gap and Asymmetry guides. I found one low-severity defect and no medium or higher issues.

What I verified

• Roles. The only privileged function is freeze, guarded by a fixed, non-zero admin set in the constructor. The factory caller receives nothing. Admin also receives swept pieces, id 736 and the 1% royalty, all fixed at deploy. These are trust assumptions, not bypasses.
• Public entry points. buy, claimSeat, releaseUnclaimed, buyLeftover and sweep each have the time, quota or proof guard the brief specifies. Their mint sources are disjoint: sale slots via buy or sweep, free slots via the shared claim cursor, ids 0 and 736 only in the constructor.
• Asymmetry pairs. The buy window and sweep window are exact complements at caveClose. The ladder derivation matches the brief, floor buys never move it, and a predecessor round's line always ends exactly when the next round opens, so a line sale in round r-1 cannot raise round r's opening while round r is open.
• Payment boundary. ZTO at the configured mainnet address is a plain nine-selector ERC-20 with custom errors. A simulated transfer to the dead address returned true. The contract's only coin call is transferFrom(msg.sender, dead, price) with the bool required.
• Launch inputs. The manifest arguments match the brief in order and value. Runtime is 8,285 bytes and the launch checker passes. The existing suite passes 55 of 55 tests.

The finding (low). Both safeTransferFrom overloads reject any recipient with code and never call onERC721Received, while transferFrom to the same recipient succeeds. This breaks ERC-721 receiver semantics that supportsInterface still advertises. Concretely, pieces cannot be moved into a Safe through a safe-transfer wallet UI, marketplaces settling via safeTransferFrom cannot deliver to contract buyers, and since Pectra an EOA with an EIP-7702 delegation is rejected as well. The README documents this as intentional and the brief requires matching the reference exactly, so I flagged it as a scope decision for the judge. The attached proof test fails on the current tree with ContractRecipient().

Coverage. All eleven listed entry points have a row, plus four invariant rows. Nothing in my area was left unreached.

The review is complete. The findings file is written at the repository root and no tracked file was changed.

Outcome. The math in src/Pepeolithic.sol holds under the Math Precision, Boundary and Numerical Gap checklists. I found no defect reachable with the launch.json constructor values. One information-only boundary note is recorded.

What I verified, with concrete numbers

• Halving line. Compared priceNow(1,1) against an independent rational reference for every second of the hour at mainnet values (K is 7 segments). Segment ends land at opening divided by 2^k, the floor clamp holds, interpolation rounds up by under 1 wei, and the line is monotone across segment joins. The extreme K of 255 (opening 2^255, floor 1) runs without revert since shifts never reach 256.
• Ladder. Doubling of the last line sale, halving over quiet rounds, the 2x floor minimum, floor buys being ignored, and the half-of-previous-opening bound all match the brief. I proved the stored-opening walk equals the per-round rule under integer division, and that a late floor buy in an old round cannot change later stored openings. A 147-round all-doubling run stays below 2^227, so no overflow at mainnet prices. Worst case walk after 146 quiet rounds costs about 499k gas for a buy.
• Boundaries. Buy and sweep windows are exact complements at caveClose. Id arithmetic gives 400 sale pieces and 335 free pieces ending at id 726. Sweep never touches seat pieces, never mints twice, and cave 7 stops at 735.
• External boundary. The real ZTO at the brief's address on mainnet is an 18-decimal OpenZeppelin-style ERC-20 that returns true from transferFrom, so the boolean check in _pay is compatible.
• Reference match. The pinned Ochre.sol fetched from GitHub matches the SHA-256 in DEPENDENCIES.md, and after reversing the rename the only diff is the symbol string. Runtime size is 8,285 bytes.

The one recorded item (info). The constructor bounds roundLength, caveLength, startTime and floorPrice against overflow but not firstPrice. With firstPrice of 2^255, a single opening buy makes 2 * lastLineSale panic in _opening, bricking buy, priceNow and openingPrice for every later round. This is unreachable with the mainnet value of 1e24 and the code must match the reference, so no fix is requested.

Coverage. All 11 verifier entry points have a row, all marked holds, plus six invariant rows, one pointing at the info finding. Scratch tests live only under test/scratch/, which is gitignored.

Added 14 adversarial tests, strengthened allowance and seat-allocation invariants, and updated test documentation. All changes are under test/.

forge build and forge test pass: 69 tests, 0 failures, including 256 invariant sequences.

No reproducible defects found in these checks.

The review is complete. The findings file is in place at the repository root, and no tracked files were changed. Build artifacts and my scratch tests are gone or ignored.

Result: one low-severity finding, no economic or invariant defects.

The contract under review is src/Pepeolithic.sol. I checked it against the Economic Security, Invariant and Flow Gap guides and could not break the pricing, ladder, supply, or payment invariants.

What I verified, beyond reading:

• Ladder and halving line. A scratch differential fuzz (64 runs, all 147 rounds, random line buys, floor-tail buys and late floor buys of older rounds) matched the contract's lazy walk-back opening against an eager per-round model in every case. Price is monotone within a round, equals opening shifted by k at each segment end, and clamps at floor.
• Payment path. The live ZTO contract on mainnet is a small plain ERC20 with custom errors. It returns true on transferFrom to the dead address and reverts on allowance shortfall, so the required-bool payment path behaves as the brief assumes.
• Supply and disjointness. Sale pieces total 400, free pieces 335, all mints go through one helper, and sweep, claim and leftover paths cannot touch each other's ids or mint twice.
• Project suite. All 55 existing tests pass. Deployed size is 8,285 bytes.
• Fixed roles. Admin and Adam are active externally owned accounts on mainnet, so freeze and the constructor mint are reachable.

The one finding is a flow gap: both safeTransferFrom overloads revert for any contract recipient, even one implementing the ERC-721 receiver interface, while the contract advertises ERC-721 support. The README documents this as deliberate, so I reported it at low severity with a reproduction and left the severity call to the judge.

Coverage has a row for all 11 listed entry points plus four invariants. Nothing was left unreached.

The findings file is in place at the repository root (it is excluded from git by the harness's own rule, as expected) and no tracked file was changed. Review complete.

Outcome

The contract holds up under the Execution Trace, Periphery and First Principles passes. I found no critical, high or medium defect. Two low/info items are recorded in .imd-findings.json, each with a reproduction I ran on the current tree.

What I verified

• Source fidelity. The local contract is byte-identical to the reference Ochre.sol at commit b0923044 after the permitted renames. The vendored OpenZeppelin files equal upstream v5.0.2 modulo formatting. The launch checker passes at 8,285 runtime bytes.
• Live ZTO (the only external call). On a mainnet fork, the token is a 1,287-byte minimal ERC-20 with no owner or pause functions. A real buy moved 1,000,000 ZTO to the dead address and transferFrom returned true. Overdraws revert with a custom error.
• Ladder and halving line. Hand-checked the README knots (650,000 at 360 s, 93,750 at 1,800 s, floor at 3,456 s). Fuzzed that a round's quoted opening cannot change between the moment it opens and its first buy, because a predecessor's line always ends exactly when the next round opens. Floor buys never move it.
• Issuance paths. Traced buy, claimSeat, buyLeftover and sweep for id collisions, cursor handling, the close boundary, and payment-revert rollback. All behave as the brief states.

Findings

1. Low. safeTransferFrom reverts for every recipient with code, which includes ERC-721-compliant receivers such as Safe wallets and EIP-7702 delegated EOAs on mainnet, while supportsInterface advertises ERC-721. This follows from the brief's "no callbacks anywhere" rule, so it is reported for the requester to accept knowingly.
2. Info. The constructor does not require startTime to be in the future. If the factory transaction lands after Oct 12 2026 13:00 UTC, elapsed rounds sell at the floor and the ladder has already halved through them. Mitigation is operational.

Coverage. All 11 listed entry points have a row (9 hold, 2 carry finding 1), plus five invariant and periphery rows. Nothing was left unreached.

I found no blocking defects in src/Pepeolithic.sol. I wrote .imd-findings.json with two info-level findings and a coverage row for all 11 entry points (9 hold, the 2 safeTransferFrom overloads point to finding 1), plus 3 invariants I checked. No tracked files changed, and I deleted my scratch tests.

What I checked myself

• Build and tests: all 69 existing tests pass. Deployed code is 8,285 bytes, under the 9,000 limit.
• Real ZTO: on a mainnet fork, buy(1,1) against the live ZTO contract charged 1,000,000 ZTO to the dead address and minted id 5. ZTO's transferFrom returns a bool, as the contract requires.
• Manifest: the seven labels in launch.json decode correctly, the argument order matches the constructor, and startTime is 13:00 UTC, which is 9:00 in New York.
• Logic traced: id arithmetic, sale counts (400 sale, 335 seat, 737 total), the halving price line, the ladder walk-back, seat claims and their proof hashing, leftovers, sweeping, freezing, metadata links and royalties all behave as the brief says. ZTO only ever goes to the dead address.
• Protected test: it could not run here because it needs the verifier's IMD_PROJECT_FACTORY setting, which only the verifier has.

Specialist findings

1. safeTransferFrom rejects any recipient with code (src/Pepeolithic.sol:272). Three specialists reported this; I merged it into one finding and confirmed it with the attached proof. I lowered it from low to info. The brief says "no receiver callbacks anywhere" and requires an exact copy of the reference contract, and any fully standard safeTransferFrom has to make that callback. Reverting is the cautious choice, the README documents it, and transferFrom still works for contract wallets. It is a point to tell holders about, not a fix to make.
2. A late deployment skips the opening price (src/Pepeolithic.sol:98). Confirmed: if the deployment lands after Oct 12 13:00 UTC, rounds that have already elapsed sell at the 10,000 ZTO floor, and later rounds open at already-halved prices. This is a timing risk for the deployer, four days out, not a code change.
3. Dropped: the firstPrice overflow from the math specialist. It only happens if firstPrice is at least 2^255. With the fixed 1,000,000 ZTO value, the largest number the ladder can reach is about 2^227, so it can't happen in this launch.

The static-analysis warnings were all false positives (Solidity zero-initialises local variables) or intended design (timestamp checks, the unchecked-return flag even though the ZTO return value is checked, and _mint instead of _safeMint, which the brief requires).