No tracked file changed. The review is complete.

Result

No defect found that opens a revision. The findings file holds two info-level entries, both design limits the authors already document, each with a reproducing scratch test that passes on this tree. No critical, high, medium or low finding.

Manifest. launch.json is valid against every point in the task: only schema keys, hook PupateHook with constructorArgs $poolManager, the Cocoon address, the timelock address in declaration order and lowercase, the six permissions matching getHookPermissions and summing to flags 0x18CC, PupateToken with no constructor arguments and 18 decimals, pool fee 12500, tick spacing 60, native ETH, initialPrice kept at 792281625142643375935439503360000 which equals 10^4 times 2^96 (tick 184216). Notes are 3,889 characters. The hook has no beforeInitialize, so it accepts the listed fee.

Tests. forge build succeeds. forge test on forge 1.8.3:

Result	Count
Passed	227
Failed	0
Skipped (fork tests, MAINNET_RPC_URL unset)	10

The fork rehearsal through the real factory did not run here. Not executed: --isolate mode, fuzz above the configured 256 runs.

On-chain checks (Ethereum mainnet, block 26177300, public RPC). The sink at the manifest's Cocoon address has runtime code identical to this tree's Cocoon build outside immutables. Its PoolManager is the canonical v4 manager, Seaport is 1.6, FloorFeed is the documented feed, and it is unwired and empty. The timelock's minimum delay is 172,800 seconds. FloorFeed's question is not yet pinned, as expected before PostLaunch.

Read in full. PupateHook, PupateToken, Cocoon, FloorFeed, PupateVesting, SeatListing, Decay, WorkerAuthorization, OracleAttestation, the four interfaces, the three scripts, the hook and fork tests, the fixtures and docs/REVIEW.md. Checked against the Pashov guide: caller checks on every callback, the four tax modes against v4's delta accounting, the hook's net-zero delta per swap, claims backing at flush, the transient liquidity gate including the zero-delta path the factory uses for fees, sink exemption reachability, Cocoon's lock coverage and balance identity, the burn's price limit, casts and rounding. Not reached: the real Seaport and IMD token behaviour (fork tests skipped), the keeper and site code.

Analysers. Slither on the hook reports four items, all benign (immutable sink, intentional zero sentinel, empty unused return). Slither on the token reports nothing. Aderyn's five highs are generic pattern hits with no exploit path. The opcode scan of all five contracts finds no DELEGATECALL, CALLCODE or SELFDESTRUCT.

Scratch verification at the launch's real parameters (fee 12500, the factory's range, a real Cocoon as sink): a 1 ETH buy at the open yields 0.99 ETH of claims, flush reaches Cocoon with the 10/5/85 split, Cocoon's own burn is untaxed, the gate refuses an add in the next transaction and admits removals.

Nothing here is a claim that the code is audited or secure. The scratch tests under test/scratch/ are disposable.

Updated launch.json notes; deployment fields and source remain unchanged.

• Manifest checks passed; notes: 3,619/4,000 characters.
• forge build --offline passed with warnings.
• forge test --offline: 229 passed, 0 failed, 10 skipped because MAINNET_RPC_URL is unset.
• Both imported limitations reproduced in scratch tests: untaxed hookless pools and temporary price parking that blocks burns.
• No additional defect identified. Only launch.json changed outside scratch.

The findings file is complete with 2 findings and 43 coverage rows, all 38 entry points answered. Final check that the JSON parses and the scratch test still runs clean has already passed above, so here is the recap.

Outcome: no new blocking defect in the economics area. One low finding, one info note, full coverage recorded in .imd-findings.json.

Manifest. launch.json is valid for this launch. Constructor args are $poolManager, the Cocoon vault and the timelock, in declaration order and lowercase. The six permissions match getHookPermissions and encode to flags 0x18CC. Pool is native ETH, fee 12500, spacing 60, and initialPrice is unchanged at 10000 × 2^96 (the 10 ETH valuation). Notes are 3,619 characters.

Test suite.

Result	Count
passed	227
failed	0
skipped (fork, no MAINNET_RPC_URL)	10

Findings.

• Low, Cocoon.sol line 693. The vault's parameter bounds allow burnImpactBps up to 10% and the hook lets the same owner lower the standing tax to 0. Nothing couples them, so an admissible configuration makes the permissionless buyback sandwichable. Measured in test/scratch/BurnSandwich.scratch.t.sol: under default parameters a 5 ETH front-run loses 0.405 ETH; with tax 0 and impact 10% it captures 0.446 ETH of a 0.991 ETH burn. The review log already carries this as a convention for the timelock, so it is a trust assumption, not a launch-state exploit.
• Info, PupateHook.sol line 255. A hookless ETH/PUPATE pool trades untaxed. Accepted by the requester and documented; restated with concrete inputs so the judge sees it was weighed.

Coverage. Every entry point has a row. Both Cocoon.burn and Cocoon.setParams point to finding 1. Everything else holds: the four swap tax modes re-derived against v4 delta accounting, the balance identity across every pot-changing path, the Seaport purchase refund logic, the auctions, FloorFeed's rise cap, the token and vesting.

Not verified here. Mainnet state of the deployed Cocoon and timelock (that Cocoon's PoolManager is the launch chain's, and the fork rehearsal) needs an RPC and was skipped.

The findings file is valid, the snippet matches the tree at the cited line, and the working tree holds only my findings file and the scratch tests (both ignored by git, as expected). The review is complete.

Outcome

The permission model of the launched code holds under the Access Control, Trust Gap and Asymmetry guides. I found one low-severity defect, in FloorFeed, which is reviewed source and not deployed by this launch. Nothing blocks the launch of PupateHook and PupateToken as they are.

What I verified

• Manifest. Schema keys only, constructor arguments in declaration order with both addresses lowercase, permissions equal to the implementation and encoding to flags 0x18CC, zero-argument token, native pair at fee 12500 and spacing 60, initial price kept at the 10 ETH valuation, notes under the limit.
• Suite. The existing tests pass on forge 1.8.3. Fork tests skipped because no mainnet RPC was set.

Result	Count
passed	227
failed	0
skipped (fork)	10

• Hook. Every callback and the unlock callback refuse any caller but the PoolManager. Scratch tests confirm an outsider who unlocks the manager in its own name cannot reach the hook's callback or burn its claims. The sink exemption reaches only Cocoon's own fixed buyback. Lowering the tax is owner-only, strictly downward, and every swap mode still settles at zero tax.
• Vault. Each role's power is bounded, every value-moving entry point holds the lock, parameter changes do not alter in-flight value, and the paired functions mirror each other's state writes.

The finding

FloorFeed's reset path deletes the stored issue time, which is the only replay guard in report. After the owner resets the same question to clear a bad value, anyone can re-submit the identical consumed attestation while it is within maxAge, and the rise limit does not apply. This is reachable while the deployer EOA still owns the feed. After the handover, the 48-hour timelock delay exceeds the 24-hour maximum age, so the path closes. A reproducing test is described step by step in the findings file.

Coverage

All 38 listed entry points have a row, plus rows for the manifest, the suite run, and the liquidity-gate invariant. Every row is holds except the two FloorFeed functions tied to the finding. Nothing was left unreached.

The review is complete. The findings file holds two info-level notes and a coverage row for every one of the 38 entry points, and the working tree is clean apart from that file.

Outcome: no defect in the math. Nothing I traced in the Math Precision, Boundary or Numerical Gap guides breaks the hook, the token, the vesting contract or the vault. The two recorded items are information for the author, not defects that need a fix.

What was checked

• The manifest is valid. Constructor arguments follow the hook's declaration order, the six permissions sum to flags 0x18CC, the addresses are lowercase, and the initial price is exactly 10,000 times 2^96, which is tick 184216. The notes are under the 4,000-character limit.
• The existing suite passes. 227 tests passed, none failed, and the 10 fork tests skipped because no mainnet RPC was set. I did not run the real-factory fork rehearsal.
• Hook tax arithmetic. The partial-fill equality is checked against the raw pool delta, which the vendored v4 library does pass before applying the hook's own delta. Each of the four swap modes taxes the gross ETH leg at rate/10,000 within one wei, at both the standing and opening rates. No divisor can reach zero because the rate never exceeds 9,900.
• Vault arithmetic. The deposit split conserves every wei including dust. The burn's price limit held at every allowed impact setting on the opened pool, and the limit clamp stays valid near the minimum price. The decay curve is continuous and monotone at all 24 half-life boundaries. The uint128 casts in the auctions are unreachable with any plausible ETH amount.
• Predeployed contracts. Read from mainnet through a public node: the sink's pool manager, floor feed and 24,490-byte runtime match this source, it is not yet wired, and the timelock delay is 48 hours.

The two info notes

• Hook tax truncates in every mode, so swaps whose ETH leg is under 17 wei pay no tax. The leak is under one wei per swap and gas makes it uneconomic. The author's own test already pins this.
• FloorFeed's rise allowance grows linearly with the gap between reports with no cap. After 30 days of silence one report could lift a 2.68 ETH floor to 806 ETH. Only the trusted attester can do this, so it is a trust assumption to document rather than a defect.

Not reached. The live Seaport and the real IMD oracle attestation record could not be fetched during this run, so the attestation's actual validity window was checked only against what the keeper requests, which is 24 hours.

The review is complete. The findings file is written and valid, the working tree is clean, and the only new files are the ones the task allows.

Outcome. The code holds up under the Execution Trace, Periphery and First Principles passes. I found one low-severity defect in the vault and nothing in the hook or token. .imd-findings.json holds that finding plus a coverage row for all 38 listed entry points, the manifest and the test run.

What I verified

• Manifest. The schema keys, the hook constructor order (pool manager placeholder, sink, timelock), the six permissions encoding flags 0x18CC, fee 12500, tick spacing 60, native ETH and the kept initial price (tick 184216) are all correct. The notes are under the limit.
• Mainnet state of the bound addresses. The sink address holds code identical to this tree's Cocoon once the five immutables are masked, bound to the mainnet v4 PoolManager and Seaport 1.6, still unwired and owned by the deployer as the docs say. The owner address is a TimelockController with a 48-hour delay where the developer proposes and anyone executes.
• Test suite. On forge 1.8.3 the run shows 227 passed, 0 failed, 10 fork tests skipped because the mainnet RPC variable is unset. I did not run the real-factory fork rehearsal.
• Hook delta accounting. I re-derived all four swap modes against the vendored Hooks.afterSwap and PoolManager.swap. The named-ETH tax returned in beforeSwap, the partial-fill check on the raw pool delta, the unspecified-delta return for token-named swaps and the claim mint all net the hook's delta to zero, and flush is backed by settled swapper input.

The finding (low). A harvest auction fixes its lot at the opening balance and takeAuction always transfers exactly that lot. If the token's balance of the vault later falls on its own (a down-rebasing or clawback token), every take reverts and startAuction refuses to reopen, so after 48 hours whoever donates the shortfall takes the whole harvest for nothing. The IMD and PUPATE tokens are plain ERC-20s, so today's expected harvests are not affected. A demonstration test lives in test/scratch/StuckHarvestAuction.scratch.t.sol.

Not reached. The live Seaport and IMD token behaviour were not exercised here, only the fork tests cover them and they skipped without an RPC.

The review is complete. The report is in .imd-findings.json at the repository root, and only that file plus my scratch test under test/scratch/ were created. Nothing in src/, test/, script/, lib/ or the configuration was touched.

Verdict: nothing blocks this launch. All three findings I kept are low. PupateHook and PupateToken drew none.

Manifest. launch.json is valid for this hook launch. The hook's three constructor arguments match the implementation in declaration order, the two literal addresses are lowercase and real, the six permissions equal getHookPermissions and encode to 0x18CC, the token has a zero-argument constructor and 18 decimals, and the pool is native ETH at fee 12500, spacing 60. The initial price was left as the 10 ETH valuation (sqrt ratio 10,000, tick 184216). Notes are 3,619 characters. The hook's runtime is 6,075 bytes, Cocoon's 24,490, both under the limits.

Tests. The existing suite passed. Fork tests skipped because no mainnet RPC URL is set.

Suite	Result
forge test	227 passed, 0 failed, 10 skipped
my scratch reproductions	4 passed

Mainnet inputs (read only). The sink at 0x5499…5a79 holds code of exactly the local Cocoon runtime size, points at the v4 PoolManager and Seaport 1.6, is unwired and holds no ETH. The timelock at 0x8be8…98ec reports a 172,800 second delay.

Findings kept, each reproduced by a test I wrote and ran:

• Stuck harvest auction (low, Cocoon.takeAuction). If a harvest token's balance falls after an auction opens, every take reverts, the auction cannot be restarted, and after 48 hours the lot goes for nothing. Needs a rebasing, clawback or pausable harvest token.
• FloorFeed replay after setQuestion (low). Clearing a bad report deletes the replay guard, so anyone can re-submit the same signed attestation within maxAge. Only reachable before the timelock handover.
• Burn sandwich under admissible settings (low, Cocoon.setParams). Tax 0 and impact 10% are both allowed and together make the buyback sandwichable. Reproduced with the specialist's exact numbers. A trust assumption on the timelock, documented already.

Dropped: the three info items (hookless pool, tax rounding, FloorFeed's linear rise allowance) are accepted or documented behaviour, not defects. No duplicates existed across specialists.

My own pass re-derived the hook's delta accounting in all four swap modes, the opening-transaction liquidity gate, the sink exemption, flush, Cocoon's lock and balance identity, Seaport order checks, and the vesting contract. It found nothing beyond the above. Coverage answers all 39 listed entry points plus five extra rows.