Implemented the pinned source with only the permitted hook additions and new token.

• Token: LaunchToken — BLACKOUT/BLACKOUT, fixed 1 billion supply.
• Hook: V4Market — required hash and 21,982-byte runtime verified.
• Pool key: (native ETH, $token, 12500, 60, $hook).
• Deployed addresses and new launch number: pending IMD deployment; 1628 is the existing bootstrap.

forge build and formatting pass. Tests: 355 passed, 0 failed, 6 fork checks skipped, using the required seed.

Launch parameters and operational handoff.

The review is complete and the findings file is written. Nothing else is needed: the tree is unchanged apart from .imd-findings.json, and the scratch test directory has been removed.

Result: the hook's math holds. One low-severity boundary defect was confirmed and recorded.

What I checked, against the Math Precision, Boundary and Numerical Gap guides

• Buy tax packing and rounding. The beforeSwap fee and the afterSwap expected consumption both use the same floored formula, so the PartialFill check can never misfire on rounding. Fuzzed across all four tax steps and odd inputs.
• TWAP ring buffer. The 32-slot ring, the clip to the last 31 minutes and the 31-minute warm-up are consistent. A fuzz of random swap cadences and random read times never hit a stale slot. Cumulative arithmetic cannot overflow at any price inside the accepted spot bounds.
• Sell surcharge decay. The stored fee never falls below the 1% floor or exceeds the 15% cap. The excess subtraction cannot underflow.
• Spot price bounds. The production opening price of 1e8 tokens per ETH yields 1e26, far inside the accepted range. The upper bound is reached only at a sqrt price of 1e11 times 2^96.
• Delta packing and settlement. The int256 shift preserves sign, the hook's ETH balance always equals the three held sums, and every take or settle path balances within the unlock.
• Hook flags. The 0x10cc mask matches the five enabled permissions bit for bit.
• FeeRouter paths that feed the hook and the Params bounds for the surcharge coefficients were traced and hold.

The finding (low): buy, sell and quote gate on the 30-minute launch window but then call twap, which needs 31 minutes. For exactly one minute after the tax reaches its final step, every system path reverts with NotConfigured instead of TooEarly, while the status views already say the window is over. No funds are at risk. A scratch Foundry test confirmed the revert at 30m and 30m59s and success at 31m.

Coverage: all 165 entry points have rows, plus five invariant rows. The hook, StandardMarket, LaunchToken, the relevant FeeRouter functions, Params.set and RewardPool are answered. The remaining game modules are marked unreached because they lie outside the hook math area and the budget was spent on the launch contracts.

Review complete. The findings file is at .imd-findings.json in the repository root and no source file was changed.

Outcome: no defect found in the assigned area. I checked the V4Market hook and LaunchToken against the Access Control, Trust Gap and Asymmetry guides and found no reproducible failure. The file carries one info-level entry and a full coverage record.

What I verified on the hook, with concrete tracing:

• Callback access. Every callback requires the PoolManager as caller and the immutable pool id as key. afterInitialize additionally requires the sender to be the launch factory and is one-shot. The existing suite and the pinned creation hash test pass on this tree.
• Delta symmetry. Buy tax is returned as a specified-currency delta and taken from the manager, so the swapper pays the full input and afterSwap refuses partial fills. Sell charges are returned as an unspecified-currency delta and taken in the same amount. The hook's ETH balance always equals its three held counters because receive accepts only the manager.
• Bind trust chain. The permissionless bind can only land on module 6 of the registry the pinned Desk bound to. The registry is proven by factory CREATE2 over this build's GameRegistry initcode, and the two toolchain pins in ModuleCode are identical, so the hook cannot be left unbindable by a toolchain mismatch. FeeRouter's team is a constant, so a permissionless deployer cannot capture the 10% team share.
• Privileged actors. The Desk can move the three sell coefficients the hook reads at keys 24 to 26, which I confirmed map to the Sell keys in the Params enum. Changes are bounded, limited to 10% per day, and clipped by the 15% cap. This is the info entry, with the exact call.
• System buy and sell paths. Only the bound router may call them, the hook's own swaps skip callbacks under v4's self-call guard, and the accounting mirrors the pool path's 1%.
• Token. Plain OpenZeppelin ERC-20, one mint of 1e9e18 to the deployer, no owner or extra paths.

Coverage record:

The holds rows cover every V4Market, StandardMarket, StandardAdapter, MarketFactory, LaunchToken, Params, RewardPool and FeeRouter entry point plus the bind, register and escrow paths. The unreached rows are the game modules outside the hook area (FarmCore, FarmRewards epochs, Season, PackSale, GridOperator, Enhancement, Billboards, Economy, StarterClaim and most of SwarmDesk), where I read guards but did not trace effects within the budget. The slither leads in the hook (arbitrary-send-eth, weak-prng) are false positives: recipients are forced to the proven router and the modulo is ring-buffer indexing. The Civic warTop lead is a mapping and needs no initialization.

Review complete. The findings file is written and valid, and the proof test fails on the current tree for the stated reason.

Outcome. The assigned area (Execution Trace, Periphery, First Principles) traces clean on the hook's core paths, with one low-severity finding. The creation-code hash and runtime size match the assignment exactly (0xedb2d58f…, 21,982 bytes), the HookPermissions additions agree with flags 0x10cc, and LaunchToken is a plain fixed-supply OZ ERC-20 with no admin surface.

Finding 1 (low), src/V4Market.sol:272. A sell larger than the pool's ETH, sent with the extreme price limit that standard routers use, reverts in afterSwap instead of partially filling. After the range is drained, v4 walks the price to the limit, so spot() computes a value above its 1e40 bound and raises InvalidValue, which v4 wraps as WrappedError. The same sell with a limit just above the range fills partially. No funds are at risk and nothing is bricked, since the revert also prevents any swap from leaving the price out of bounds. The proof under test/scratch/SellExceedsEth.t.sol fails here and would pass once the hook handles that terminal state.

What I verified in depth and found to hold:

• Buy accounting: the specified-delta fee equals the amount taken, the hook's delta nets to zero, and the PartialFill check equals ethIn - fee on both sides.
• Sell accounting: the charge is bounded at 15% of output and returned as the unspecified delta after the take.
• The TWAP ring always holds the 30-minute window once the 31-minute gate opens, so twap() cannot revert NotConfigured for buy, sell, quote or the sell surcharge.
• The hook's ETH balance always equals the three held totals, so flushFees leaks nothing.
• Bind proofs: the embedded registry creation code uses identical launch and repo toolchain pins.
• System buy and sell callbacks settle exactly the swap delta, with callbacks correctly suppressed on self-swaps per the vendored v4-core.

Coverage record. All 160 entry points have a row. The hook, StandardMarket, StandardAdapter, LaunchToken, MarketFactory, GameRegistry.register, SwarmDesk.bind and the FeeRouter paths touching the hook are holds or finding. The 121 game-module entry points outside the hook control flow are marked unreached, honestly, since my budget went to the assigned area.

Not re-reported. The accepted float-before-settlement take and unbound-hook retention items were confirmed in the trace but left out as duplicates.

Created launch.json. No existing files changed.

• Token: LaunchToken — BLACKOUT/BLACKOUT.
• Hook: V4Market, permissions 0x10cc.
• Pool key: (native ETH, $token, 12500, 60, deployed V4Market) on chain 4663.
• Deployment addresses and launch number: unavailable in this manifest-only task.

Offline build passed. Tests with the prescribed seed: 355 passed, 0 failed, 6 fork tests skipped. The pinned creation-code hash and runtime size match.

The findings file is in place at the repository root, valid JSON, excluded from git by the harness's own exclude rule. The scratch directory is removed and the tree has no stray files. Nothing further is needed from the environment, so here is the review.

Economics review of V4Market (BLACKOUT launch hook)

Outcome. The hook's swap economics hold. I found one low-severity guarantee gap with a concrete reproduction and one informational behaviour, both recorded in .imd-findings.json with a coverage row for every one of the 160 listed entry points.

What I traced and confirmed (Economic Security, Invariant, Flow Gap guides):

• Buy path: the launch tax or 1% share equals input times bps over ten thousand, is taken from the manager float and repaid by the returned specified delta, so the swapper pays exactly the input and the hook's delta nets to zero. The afterSwap exact-fill check matches beforeSwap's arithmetic and v4's swap delta construction.
• Sell path: the charge is computed on actual ETH output, the returned unspecified delta equals the amount taken, and the fee cannot fall below 1% or exceed 15% under any Params value within bounds.
• Held-ETH conservation: the three held counters always equal the hook's balance. Flush zeroes and pays all three, and the router's routing cannot underflow.
• The 30-minute harmonic TWAP ring always has the minute-30 observation or extrapolates correctly, so neither sells nor system buys can be bricked by a missing slot.
• View and execution math agree: quote, quoteSell and maxSellBatch match the buy and sell callbacks. Router slippage bounds hold system buys and sells within 1.5% of TWAP.

Finding 1, low. Liquidity changes are not hooked, so a holder exits tokens to ETH with no sell charge by minting a token-only range just below spot and removing it after buyers walk through it. Measured on a real PoolManager: a direct sale of 10 BLACKOUT netted 8.80 ETH with 0.98 ETH taken by the hook, while the same tokens exited through a position returned 10.38 ETH and paid the hook nothing. Fixing it would require new hook flags, which is a scope decision for the author.

Finding 2, info. The surcharge ratchet decays only 100 bps per 10 minutes. After one capped dump, an unrelated small seller 10 minutes later still paid 1471 bps even though price and imbalance had recovered. This matches the documented progressive design, so it is a note, not a block.

Coverage. All V4Market, StandardMarket, LaunchToken, FeeRouter, MarketFactory, StandardAdapter and Params entry points are marked holds or finding with reasons. The 121 game-module and SwarmDesk entry points are honestly marked unreached as they are outside the assigned economics area and were not traced within budget.

Added tests and documentation, with production files unchanged.

Validation: 382 passed, 0 failed, 6 fork tests skipped. Both invariant campaigns passed 49,152 random calls. forge build passed.

Token: LaunchToken. Hook: V4Market. Pool key: (ETH, LaunchToken, 12500, 60, V4Market).

No deployment occurred, so deployed addresses and a launch number were not generated.

The review is complete and .imd-findings.json is written at the repository root. No tracked file was changed; only the findings file and my scratch tests under test/scratch/ exist.

Verdict on the launch. The hook deploys and launches as specified. The V4Market creation code hash matches the required value exactly, the runtime is 21,982 bytes, the manifest's constructor words are in declaration order with lowercase addresses, the permissions list matches getHookPermissions and address flags 0x10cc, and the launch token is a plain OpenZeppelin 5.0.2 ERC-20 minting the full supply once to its deployer. Nothing blocks admission.

Findings kept, all reproduced against the real v4 PoolManager:

• Low. A sell larger than the pool's ETH, sent with the router-default extreme price limit, reverts in afterSwap because spot() exceeds its 1e40 bound. The specialist's proof fails on this tree with the exact WrappedError and the tight-limit control passes. The pool cannot be bricked by it.
• Low. The sell charge is bypassed by exiting through a token-only liquidity range, since the hook has no liquidity callbacks. My test shows 10 tokens pay 0.98 ETH to the hook on the swap path and 0 on the LP path, with the holder receiving more ETH. Fixing it changes the hook flags, so it is the author's scope call.
• Low. For the minute between 30 and 31 minutes after initialization, buy, sell, quote and quoteSell revert NotConfigured because the launch-tax guard and the TWAP warm-up disagree. Confirmed at +30m and +30m59s, working at +31m.
• Info. The surcharge ratchet keeps unrelated sellers near the 15% cap for about 140 minutes after one capped sell. Documented design.
• Info. Trust map: the Desk moves the surcharge coefficients within bounds, and the Desk's binder fixes the fee destination. No loss path.

The five specialist findings merged cleanly with no duplicates across areas. My own pass over the hook, covering delta accounting, the TWAP ring, the bind proofs, the float take and the factory's zero-liquidity fee collect, found nothing beyond them. The Slither and Aderyn lines on the hook are false positives: the ETH sends go only to the proven FeeRouter, and the modulo uses are ring-buffer indices.

Coverage. All 160 entry points have a row. Hook, token, FeeRouter, StandardAdapter, StandardMarket, MarketFactory, EndowmentEscrow, Params, GameRegistry and RewardPool entry points carry real verdicts. The remaining game modules from the already-deployed L1 launch are marked unreached, honestly, since no specialist verified them and they are not contracts this launch deploys.