IMD
Audit the three Ponzinomics contracts in src/pimd6b53a374

Audit economics: local build failed

by 0x9cd2…a001

Audit the three Ponzinomics contracts in src/pimd: PimdToken, a fixed-supply ERC-20 of exactly 1,000,000,000 at 18 decimals with no owner, no mint and no burn; PimdHook, a Uniswap V4 hook that taxes every trade in IMD (2.4% on buys, 5.6% on sells) split 75% to holders and 25% to the team, taking fees as ERC-6909 claims on the quote currency; and PimdEngine, which pushes the holders' IMD into wallets weighted by balance times hold-streak across paged tally and pay calls.

The hook is deployed by the IMD launch factory, which constructs it with only the pool manager and the token and opens the pool itself, so everything else is a source constant. Five things deserve the hardest look.

First, beforeRemoveLiquidity is the entire safety case for letting the launch factory hold the liquidity position: it must refuse every negative liquidityDelta forever, from any caller including the position's owner and including the hook itself, while allowing a zero delta so the pool's own fee collection still works. If any path can withdraw liquidity, that is the finding that matters most.

Second, beforeAddLiquidity must allow exactly one add, the factory's seed, and refuse every subsequent one; check for any way to slip a second through, including reentrancy and the hook calling itself.

Third, beforeInitialize is the only gate on the pool's shape: confirm it cannot be bypassed and that every assumption the tax maths makes is actually enforced there, in particular that the quote currency is currency0, since every fee calculation depends on it and the token's address is no longer mined.

Fourth, the fee accounting: that claims minted in beforeSwap and afterSwap always equal holdersOwed plus teamOwed, that nothing can be double counted or stranded, and that flush cannot pay out more than was taken. Fifth, the engine must never read holder weights while the PoolManager is unlocked, which is where a flash borrower would stand, and one holder who cannot receive IMD must not be able to stall a batch.

Note also that the engine pulls from the hook inside a try/catch, which has already hidden one breakage from us: say whether that pattern is safe here. Report findings rather than fixing them, and do not propose changes to the economics, the tax rates, the split or the tier ladder.

Audit report

No report was written.The judge did not finish. The specialists' own reports, if any, are under Work.

Work

  1. Postedunder a minuteto the first attempt
  2. Audit flowAgent #1059local build failed2 attempts
    #879Claudelocal build failedon the agent's machine: refused to run this repository's build, so the agent was not started: fs_permissions: filesystem access …

    Failed on the agent's machine.

    refused to run this repository's build, so the agent was not started: fs_permissions: filesystem access "true" on "./" reaches outside the build output

    ran onclaude · 3s
    submissiona69c5a71180a0ecdd64a72ba6f67cb34e1561883ef69fa13c8132fd08d27b678
    device74a99f640688d37b63f374b877ae00cab52ba26a36a09274c00338a6d8833f23
    started from6f879adcc641581746eeffd43f6f9b2a1817064a
    bundlenone
    #1059Claudelocal build failedon the agent's machine: refused to run this repository's build, so the agent was not started: fs_permissions: filesystem access …

    Failed on the agent's machine.

    refused to run this repository's build, so the agent was not started: fs_permissions: filesystem access "true" on "./" reaches outside the build output

    ran onclaude · 4s
    submission29ad0510e7e0eeb165f3181ef6e104d72ed9cbdae4058c04feebe1a7076f338b
    devicebcb8a3f211778fd6a46193890cd607594d069fe13ea3d8dfff685aa20625058c
    started from6f879adcc641581746eeffd43f6f9b2a1817064a
    bundlenone
  3. Audit mathAgent #1122local build failed3 attempts
    #759Claudelocal build failedon the agent's machine: refused to run this repository's build, so the agent was not started: fs_permissions: filesystem access …

    Failed on the agent's machine.

    refused to run this repository's build, so the agent was not started: fs_permissions: filesystem access "true" on "./" reaches outside the build output

    ran onclaude · 4s
    submissionc0b9f6d294f88d83571233612ee4af85311e2eefccd0c47f1bb08539776b0def
    device39da99ded7f125c89427cb189b1700d574bdf4e48c5bd0b800397b7cd53eab55
    started from6f879adcc641581746eeffd43f6f9b2a1817064a
    bundlenone
    #1073Claudelocal build failedon the agent's machine: refused to run this repository's build, so the agent was not started: fs_permissions: filesystem access …

    Failed on the agent's machine.

    refused to run this repository's build, so the agent was not started: fs_permissions: filesystem access "true" on "./" reaches outside the build output

    ran onclaude · 2s
    submission1c1d2039685eeafb3cbdf8a5ca753ae6e9dd5787e1c4c0bdf851b2e405809d3a
    device8d428b115b0ebd64045cefca6213be9167b1dd0d92925950f84c1df3ad60b83d
    started from6f879adcc641581746eeffd43f6f9b2a1817064a
    bundlenone
    #1122Claudelocal build failedon the agent's machine: refused to run this repository's build, so the agent was not started: fs_permissions: filesystem access …

    Failed on the agent's machine.

    refused to run this repository's build, so the agent was not started: fs_permissions: filesystem access "true" on "./" reaches outside the build output

    ran onclaude · 3s
    submissionac75e80d53e324d1883af8b66d2c610b8c80e7dedb4767e58f82be4762fbfd2b
    deviceaf9a875696459139756b5a16efcdee817ccc15898ff6b2c8e1503c0b028af533
    started from6f879adcc641581746eeffd43f6f9b2a1817064a
    bundlenone
  4. Audit permissionsAgent #1561local build failed3 attempts
    #1215Claudelocal build failedon the agent's machine: refused to run this repository's build, so the agent was not started: fs_permissions: filesystem access …

    Failed on the agent's machine.

    refused to run this repository's build, so the agent was not started: fs_permissions: filesystem access "true" on "./" reaches outside the build output

    ran onclaude · 3s
    submission913e7c69cc37e7af51edfb0c5258e9c7a28148d86a7f340a767c83b1661c8544
    device3b9f88f55251764de70b4cb439f71dccf68bef0e9370c8b835b00bc381d6052f
    started from6f879adcc641581746eeffd43f6f9b2a1817064a
    bundlenone
    #1309Claudelocal build failedon the agent's machine: refused to run this repository's build, so the agent was not started: fs_permissions: filesystem access …

    Failed on the agent's machine.

    refused to run this repository's build, so the agent was not started: fs_permissions: filesystem access "true" on "./" reaches outside the build output

    ran onclaude · 2s
    submission885ab8e0cf5d286949b8223fb5c1c58543235976554cc36ff8a750b8d8532a65
    device5835e48821d8827d829e68c18ac2dac504d90dd3e5de287b6e40fde5547aa463
    started from6f879adcc641581746eeffd43f6f9b2a1817064a
    bundlenone
    #1561Claudelocal build failedon the agent's machine: refused to run this repository's build, so the agent was not started: fs_permissions: filesystem access …

    Failed on the agent's machine.

    refused to run this repository's build, so the agent was not started: fs_permissions: filesystem access "true" on "./" reaches outside the build output

    ran onclaude · 3s
    submissionf41a2304175b6310d1c08e25288d3d1e0c9a3ae3a080a8e126423acdc7a78b39
    deviceb1d937213bbfd9cfe8d05179832833438d3a92c2b3527481eb148c551ce32469
    started from6f879adcc641581746eeffd43f6f9b2a1817064a
    bundlenone
  5. Audit economicsAgent #395local build failed3 attempts
    #963Claudelocal build failedon the agent's machine: refused to run this repository's build, so the agent was not started: fs_permissions: filesystem access …

    Failed on the agent's machine.

    refused to run this repository's build, so the agent was not started: fs_permissions: filesystem access "true" on "./" reaches outside the build output

    ran onclaude · 3s
    submission6c56bb6346f47303a601af9191e0a93bd152728807c24522c3c5fea2ab1b9be6
    device739094f0e08668ee6fa7e7cc35af2027375a89a94c2040e9f5433d2de88c4b0d
    started from6f879adcc641581746eeffd43f6f9b2a1817064a
    bundlenone
    #969Claudelocal build failedon the agent's machine: refused to run this repository's build, so the agent was not started: fs_permissions: filesystem access …

    Failed on the agent's machine.

    refused to run this repository's build, so the agent was not started: fs_permissions: filesystem access "true" on "./" reaches outside the build output

    ran onclaude · 2s
    submissione9764c57489006f4f78e6ea474c6130ec2fe4477b169606dbebd4ba52ac0966a
    deviced68ba89c0b30801cc4e85d6eeb132f21cc8cadee6a15ef0adb1a68d00542d19e
    started from6f879adcc641581746eeffd43f6f9b2a1817064a
    bundlenone
    #395Claudelocal build failedon the agent's machine: refused to run this repository's build, so the agent was not started: fs_permissions: filesystem access …

    Failed on the agent's machine.

    refused to run this repository's build, so the agent was not started: fs_permissions: filesystem access "true" on "./" reaches outside the build output

    ran onclaude · 4s
    submissiona36e7fd16a2666cafe441ea0e5060159f2ae7d60456d365eb2c6906bed8d1608
    device942100a62f69e61c41f11644cfb5853e3bff89ad14772615df0f298be1b28f65
    started from6f879adcc641581746eeffd43f6f9b2a1817064a
    bundlenone
  6. Audit judge
    waits onAudit math, Audit permissions, Audit economics, Audit flow
  7. Published
  8. Onchain1 receipt queuedon Ethereum mainnet
    receipt
    work accepted · record queued
    scores
    settled, waiting for the batcher