The work is complete and verified. Here is the standing recap.

Outcome. The Sepolia test release of UNLOCK (UNLK) is prepared, rehearsed end to end on a Sepolia fork at a recorded block, and documented. No public Sepolia transaction was sent, because this job holds no funded key and IMD's release service launches only after acceptance. UNLK is not live on Sepolia or Ethereum mainnet, and the docs say so plainly.

Source import and baseline. The tree is the GitHub repository identity-md-launches/launch-1309-unlk at commit eb37eb6d…, imported as ordinary files with its vendored libraries. The baseline reproduced cleanly before any change (build, 118 tests, format, 407 dependency hashes).

Blocking finding and fix. IMD's worker manifest for univ4_hook deploys exactly the token and the hook, mines the hook salt itself, and has no companion slot or post-deploy call. The imported hook verified UnlkSwapRouter, UnlkOracle and MerkleClaimEvidence inside beforeInitialize, so the service could never have launched it, and the admission floor's initialization test would have refused it on an empty chain. I moved that verification to a permissionless post-launch activate(launchNumber) that is proven by the factory's own LaunchRegistry record, kept the factory-only initialization and seed rules, and made swaps, credits and milestones fail closed until activation. The owner binds the three companions to the hook's real address afterwards, with reciprocity checked on both sides. No control was removed, no admin rule path was added, and the $5M target, quotas and oracle rules are unchanged.

Sepolia references verified on chain. PoolManager 0xE03A1074c86CFeDd5C142C4F04F1a1536e203543 from IMD's chain table, and Chainlink ETH/USD 0x694AA1769357215DE4FAC081bf1f309aDC325306 with description, decimals and freshness checked. IMD publishes no Sepolia LaunchFactory, so the fork rehearsal deploys the Sourcify-verified factory sources as a labelled stand-in and impersonates its deployer.

Fork rehearsal, block 11897677. The log is in docs/validation/sepolia-fork-rehearsal.txt. It covers the launch, the PoolKey carrying the hook with fee 12500 and spacing 60, two buys, a within-quota sale, a rejected excess sale, a rejected foreign router, a native claim refused before and paid at release time, attest plus credit sync, the payer's one-time 3% credit, a transfer-only holder who cannot sell, 80/20 fee collection with principal untouched, and a refused liquidity removal. Tiers above 25% are reported as unreachable in public testing and are exercised only in labelled local fixtures.

Checks. forge build clean, forge test 121 passed with an empty environment, forge fmt --check clean, high lint clean, artifacts within size limits, 12 ABIs exported, and the hook, token and companions carry no DELEGATECALL, CALLCODE or SELFDESTRUCT.

Still open, disclosed. ORC-01 economic manipulation risk, confirmation of one leaf per account per round in the real contributor tree, the owner's three post-launch binding transactions, and an independent review. The readiness list and operational responsibilities are in docs/SEPOLIA_RELEASE.md and docs/DEPLOYMENT.md.

The review is complete. Findings and the coverage record are in .imd-findings.json at the repository root. Every snippet matches its cited line, and the only working-tree changes are that file and the ignored test/scratch/ directory.

Scope covered. I audited the permission model of all seven source contracts against the Access Control, Trust Gap and Asymmetry guides, mapped every role and one-shot binding, diffed the paired surfaces (before/after callbacks, the three configureHook-style bindings, swap vs swapBatch, syncPayer vs syncRewards), and traced the launch-then-activate lifecycle through IMD's verified factory sources. The build and all 121 existing tests pass. The coverage record answers all 28 listed entry points plus one invariant row, none marked unreached.

Findings (3, none above low). The access model itself is tight: every callback is PoolManager-only, the factory is the only initializer and liquidity sender, the router is the only swap sender with the trader read from its own context, and no post-launch setter exists beyond three once-only bindings. The gaps are in the reciprocity checks that guard the one irreversible moment:

• Low, src/UnlkSwapRouter.sol:66. The router binding and activate never verify the router's PoolManager, while the oracle pair does. A router built on another manager passes activation, every swap then reverts, and nothing can be rebound. Confirmed by a scratch test.
• Low, src/UnlkHook.sol:170. beforeInitialize accepts any paired currency, but activate requires it to equal the oracle's immutable quote. A mis-paired launch succeeds atomically, seeds 87% of supply, and can never activate. Confirmed by a scratch test. The suggested fix runs the oracle check at launch only when the oracle address has code, so the admission floor still passes.
• Info, src/UnlkHook.sol:369. syncPayer credits the manifest's $owner with no on-chain tie to the factory's remainderTo. Already disclosed in the docs as an operational check; recorded so the judge sees it was examined.

Not reported. The protocol-fee halt (GOV-01), the parallel one-hour tier confirmation, and the setup authority's ability to leave the launch unactivated are documented design choices and trust assumptions with no unprivileged amplifier, so they are not findings. I did not reach economic calibration of the TWAP manipulation cost (ORC-01), which belongs to another specialist. No finding reached critical or high, so no proof files are attached.

No tracked file changed. The review is complete and .imd-findings.json holds the result.

Outcome. The math in the hook, oracle and router holds up under the Math Precision, Boundary and Numerical Gap checklists, with one substantiated defect at the seam between the oracle's depth floor and the milestone thresholds.

Finding 1 (medium, with Foundry proof). The oracle's 10 ETH quote-depth floor makes the $100,000 tier unreachable at its own threshold. With the policy's 20 ETH opening market cap, the ETH held inside the token-only seed is a pure function of the price ratio to the opening price, and it only reaches 10 ETH once FDV is about 49.65 ETH. At the Sepolia ETH/USD answer the release doc records ($2556), the pool holds 6.9 ETH when FDV is exactly $100k, so every observation is marked illiquid, fdvUsd reverts, and the tier stays at 0 until FDV is about $127k. The nominal rule only works while ETH is below about $2014. The proof seeds the pool exactly as the rehearsal script does, buys 7.4 ETH (FDV $103k, depth 7.31 ETH), runs 95 minutes of five-minute confirmations, and asserts tier 1. It fails on the current code and was verified to pass once the floor is lowered. The fix is a scope decision for the requester, since both inputs are committed rules: resize the floor to the opening cap, raise the cap, or amend the documented table.

What held. Quota rounding matches between remainingQuota and afterSwap, sale and buy accounting sides are correct for ETH as currency0, the TWAP floors in both currency orders, the FDV scale chain and Chainlink normalization are correct, router balance equalities are exact for mixed native and ERC-20 batches, and the try/catch in milestone updates cannot be gas-griefed into a confirmation reset.

Coverage. All 28 listed entry points have a row, plus four invariant rows. Two rows (updateMilestone, checkpoint) reference the finding; the rest hold. Static-analysis leads in my area (divide-before-multiply, strict equalities, timestamps) were traced and are intentional or harmless.

Left in place. Only the ignored findings file and test/scratch/ with the proof test and the generator script.

Review complete. The findings file is written and validated, and the tree is otherwise untouched (only the gitignored test/scratch/ and .imd-findings.json were created).

Outcome. The control-flow area holds up: I traced every hook callback, the router's settlement path, the oracle's accumulator, the claim adapter and the activation sequence, and found no exploitable execution-flow defect in the Solidity. Three low-severity findings are reported, each with a concrete reproduction.

Findings written to .imd-findings.json:

• Payer credit is not tied to the remainder recipient. The hook credits the $owner word with 30M eligible on syncPayer without checking that wallet received the factory's 3% remainder, which is a separate policy input. With remainderTo pointing elsewhere, the owner gets 7.5M of unbacked sale quota and the real recipient cannot sell. Reproduced locally in a scratch test.
• Rehearsal misattributes the milestone failure. On the Sepolia fork at the recorded block, the feed is 4776 s old after the warp against a 5400 s limit, so it is fresh. The read fails because the pool is below the 10 ETH depth floor, which means the real Chainlink path was never exercised. A 12 ETH buy plus 31 minutes on the same fork makes fdvUsd succeed at about $144.6k, so tier 1 is exercisable with labelled data.
• Stale design text in the integration matrix and the security review still describe pre-launch companion binding and bind-time balance checks that the code no longer has.

Verification performed. Build and all 121 tests pass offline. Published ABIs match the compiled ones and the handoff inventory verifies. The admission-floor protected test passes 4/4 against the built hook with the Sepolia PoolManager address, ETH pairing, fee 12500 and spacing 60 (the floor file needed local shims for two library symbols absent from the vendored libs). Exploratory tests confirmed fail-closed behaviour for a sell into an ETH-empty pool, correct partial fill and refund on a pool-draining buy, and consistent accounting when a withdrawal re-enters a swap.

Coverage. All 28 listed entry points have rows: 26 hold, syncPayer and activate reference finding 1. One row is marked unreached: the economic cost model for the disclosed ORC-01 manipulation risk and the one-leaf-per-account property of IMD's tree, both outside the control-flow area.

The findings file is in place at the repository root (the harness excludes it from git deliberately, same as test/scratch/). Everything is verified, so here is the recap.

Outcome

The submitted tree builds, passes forge fmt --check, and passes forge test with 179 tests and 1 skipped (the fork variant, which needs a URL). I also ran the new Sepolia fork suite against live Sepolia at the latest block, and all 14 scenarios passed on the real Uniswap v4 PoolManager and Chainlink feed, with the live pool returning exactly the recorded sale proceeds. The recorded block itself needs an archive node, which the public endpoint does not offer. No public transaction was sent and UNLK is not live anywhere.

What I added under test/

• SepoliaRelease.t.sol: the release shape offline (ETH as currency0, tick 177240 from the 20 ETH policy cap, token-only seed, 87% pool share, owner as payer). It reproduces the recorded fork rehearsal's exact numbers and runs every release scenario: PoolKey carries the enforcing hook, rejected excess sale with the exact wrapped QuotaExceeded, transfer-only holder, stranger router, native claim at release time with separate credit sync, 80/20 fee split, principal protection, unreachable tiers reported then exercised on labelled data. SepoliaForkReleaseTest reruns it on a fork when UNLK_SEPOLIA_FORK_URL is set.
• FailurePaths.t.sol: constructor guards for every contract, each beforeInitialize term, bound-key checks on all callbacks, inactive hook refuses swaps, seed range recorded once, removal and activation guards, oracle binding guards, router field boundaries, batch limits, callback and receive guards.
• MerkleRounds.t.sol: a four-leaf tree in the distributor's leaf shape proving one claim and one attestation per recipient per round, non-redirectable proofs, treasury-only later rounds, and swept rounds.
• NativeInvariants.t.sol: a ten-action handler over the ETH-holding router with ETH and UNLK conservation, router custody equals credits, ledgers equal ghosts, quotas, fixed principal and bindings, plus a fully-unlocked variant.
• README.md describing the suites and the fork command. Two one-line edits to existing test files: virtual on a fixture function and formatting of a file that already failed the formatter.

Findings reported in .imd-findings.json

• Medium: the admission-floor hook suite imports v4-core/src/types/PoolOperation.sol and calls fail(string), neither of which exists in the vendored libraries. With those two shims applied in scratch, all 11 floor tests pass on the real creation code. The fix is in lib/, outside my paths.
• Low: the hook's payer word and the factory's remainderTo are never cross-checked, so a manifest mismatch credits the 3% to a wallet holding nothing. A scratch proof fails on the current code.
• Low: the fixed 100,000,000 UNLK ceiling in reward credit permanently disables synchronization for an account that crosses it through treasury rounds.
• Info: the documented one-leaf-per-account assumption, which the launch step must confirm on the real tree.

The review is complete. .imd-findings.json is in the repository root with 6 findings and a 32-row coverage record covering all 28 listed entry points plus 4 invariants. No tracked file was changed; the only additions are the findings file and two scratch tests under test/scratch/, which git ignores.

Headline finding (high, with a Foundry proof). The permanent $5M full unlock is purchasable by a single unprivileged actor for roughly the cost of one LP fee leg. Using the actual Sepolia release parameters, I reproduced it end to end in test/scratch/SingleActorPermanentUnlock.t.sol, which fails on the current code at its final assertion:

The causes are the tier-independent 10 ETH depth floor, the self-funded confirmation cadence, quota-capped counter-sellers, and the fact that the unlocking swap can be the first leg of the actor's own swapBatch while the second leg dumps the whole position atomically. This is the author's disclosed ORC-01; my report quantifies it as a reachable defect in the committed rule set rather than an abstract risk, and lists fixes that keep the $5M target.

Other findings.

• Low: a within-quota sale that dips pool ETH below the 10 ETH floor erases everyone's in-progress tier confirmation and poisons the TWAP for 30 minutes. Verified in a second scratch test, pool going from 11.0 to 9.26 ETH.
• Low: syncPayer credits 30M eligibility to the manifest $owner with no on-chain tie to the factory's remainderTo. A mismatch grants 7.5M of selling rights to a wallet holding nothing.
• Low: attest trusts one leaf per account per round. The real IMD tree was not available, so this property is unverified for the launch, and a duplicate leaf over-credits eligibility.
• Low: activate depends on the unpublished Sepolia LaunchFactory exposing the mainnet registry and distributor shape. A deviation closes the pool forever with 87% of supply locked, and the package has no pre-launch check against the real $factory.
• Info: a non-zero v4 protocol fee halts every swap permanently, already disclosed as GOV-01.

Coverage. Router settlement, hook authentication, quota accounting, principal protection, oracle math, claim evidence and token behavior all traced and marked holds. The full existing suite of 121 tests passes. Nothing was left unreached.

Not verifiable here. The actual contributor Merkle tree, the Sepolia $factory address and whether $owner equals the service's remainderTo are launch-step inputs outside this repository, so those three items stay as stated preconditions for the test release.