Wrote one high-severity finding to .imd-findings.json. Source and configuration files remain unchanged.

High — the wrong immutable PoolManager disables trading. The constructor accepts any nonzero manager at TollgateHook.sol:112. The manifest supplies the mainnet literal, while the pool exists on Sepolia’s different manager.

Concrete trigger: a router calls Sepolia’s manager through unlock → swap(K, SwapParams(true, -1 ether, 4295128740), ""). The manager invokes beforeSwap; onlyPoolManager rejects its address at line 130. The wrapped error is:

WrappedError(
  0x1c8cf326d47eca16913cd84feb20ec1ee15440cc,
  0x575e24b4,         // beforeSwap selector
  hex"f655705d",       // OnlyPoolManager()
  hex"a9e35b2f"        // HookCallFailed()
)

The outer selector is 0x90bfb865. All four otherwise-valid swap modes fail this way. Invalid calls can fail earlier in PoolManager. The 0x00CC flags enable beforeSwap, afterSwap, and their return deltas; afterSwap is never reached here.

Initialization, liquidity additions/removals, and donations invoke no hook callbacks. The position owner can therefore withdraw the seeded TOLL through normal position management. The pool is unusable for trading, but this hook does not trap LP principal.

With no successful fee accrual, payCreator() reverts NothingDue; burnEth() reverts TooSoon during the initial cooldown and NothingToBurn thereafter. Donated claims on the real manager, tokens transferred directly to the hook, and forcibly delivered ETH have no recovery path. The supplied facts establish no such donations or accumulated fee balance.

The deployment documentation explicitly expected replacing the literal when changing chains and catching mistakes in a fork rehearsal. Local lifecycle tests instead deploy a fresh manager; the protected checks omit the lifecycle. For the next launch, use the target chain’s manager, add a constructor code-length check and/or enforce the chain-ID/manager pairing, re-mine the salt, and redeploy. Rehearse swaps against the real target-chain manager using the final manifest arguments before launch.

Assuming the correct manager, I found no additional substantiated defect:

These branches are at TollgateHook.sol:201. PoolManager subtracts the positive hook delta from the caller’s delta. Minting the fee as claims creates an equal hook debit, so settlement balances.

• Partial fills: Lines 236–238 check the raw pool delta. A −1 ETH exact-in buy requires raw amount0 = −0.98 ETH; −0.97 ETH reverts with wrapped PartialFill. Token-specified modes require raw amount1 == amountSpecified. Reversion rolls back the swap, fees, and logs.
• Rounding: Line 274 floors each fee. Two fully filled 49-wei buys pay zero hook fee; one 98-wei buy pays one wei. Splitting can dodge the fee, but the rounding benefit is below one wei per component swap. Trading 1 ETH entirely in chunks of at most 49 wei requires at least 20,408,163,265,306,123 swaps. This disclosed b