Approved workflow

cancelOrder checkpoints the caller's earned credit (line 329) and then discards it: the credit and the fees collected by the cancel are redistributed to whoever still holds liquidity at that tick (line 364), and a final canceller redeems the whole currency totals.

The per-owner Q128 growth accounting introduced by the local patch already computes exactly what the canceller earned, so the forfeiture is no longer needed to stop skimming, yet it lets an unprivileged party skim in the other direction: anyone holding 1 unit of liquidity (about 3 wei of TKPF at tick 137760) at the same tick receives 100% of a larger owner's accrued ETH and TKPF fees the moment that owner cancels.

While the price is inside the range, placeOrder reverts InRange, so the attacker joins either speculatively in advance (dust at every popular tick is nearly free, see the gas griefing note in docs/GAS.md) or by front-running the cancel once the price is back above the range.

Only fees are at risk, not principal, and README.md states the policy, so whether to keep it is a scope decision; if changed, paying the canceller its checkpointed feeCredits (and keeping only the cancel-collected fees of the remaining liquidity for the remaining owners) preserves every other behaviour and the claim-conservation invariants tested in test/Accounting.t.sol.

_getTick recomputes the tick from sqrtPriceX96 with TickMath.getTickAtSqrtPrice, while the PoolManager records slot0.tick = tickLower - 1 when a zeroForOne swap ends exactly on an initialized tick boundary. In that state the pool has crossed the order's tick, removed the order's liquidity from the active range and converted the position entirely to ETH, yet the hook computes tickLower == the order tick, excludes it from the crossed list (lines 708-714) and does not fill.

The derived guard at src/TakeProfitHook.sol:61 (sqrtPriceX96 > getSqrtPriceAtTick(tickLower)) also treats equality as unfilled. Any following oneForZero swap re-enters the range and sells the owner's ETH back for TKPF, so an owner whose target was reached and fully executed by the pool ends up unfilled.

Nobody profits directly, and the next buy that moves strictly below the tick does fill, so impact is a missed fill rather than a loss; the workflow's own rule 'a range the price is still inside is not filled' does not apply here because the pool itself reports the price below the range.

Manifest: constructorArgs [0xE03A1074c86CFeDd5C142C4F04F1a1536e203543] matches the constructor(IPoolManager) and the approved Sepolia PoolManager; permissions [afterInitialize, afterSwap] match getHookPermissions and encode to 0x1040 under Hooks.ALL_HOOK_MASK using the same bit constants as v4-core Hooks.sol and src/HookFlags.sol; initialPrice 78588986356927097284479352776873 equals TickMath.getSqrtPriceAtTick(138000) and round-trips to tick 138000; pool fee 3000 / spacing 60 / pairedCurrency zero match the hook's TICK_SPACING and native-currency0 requirement; token name/symbol/decimals match LaunchToken. docs/abi/TakeProfitHook.json and docs/abi/LaunchToken.json are entry-for-entry identical to forge inspect output.

The pinned protected floor (Hook.protected.t.sol, Token.protected.t.sol) passes against the real creation code with the Sepolia manager address etched (9/9).

ETH-side restriction: placeOrder is the only route to _handlePlaceCallback (unlockCallback is onlyPoolManager and the hook only calls unlock from placeOrder/cancelOrder/withdraw with fixed encodings); placeTakeProfit dispatches to the override; zeroForOne=true reverts EthSideOrder before any state change; no path lets one owner's funds back an ETH-side position.

Manipulator fill-and-swap-back: filled liquidity is removed from the pool and held as ERC-6909 claims, a reverse swap opens a new order id and cannot touch old proceeds (test_newOrderAfterFillGetsNewIdAndSwapBackCannotReopenFill); the manipulator pays fees and slippage and the owner receives the range price it asked for.

Reentrancy: a recipient that calls poolManager.swap directly while cancelOrder's unlock is open can fill the same order mid-cancel; state remained consistent (order filled, remaining owner withdrew 10,425,834,546,641,892 wei, hook claims ended at zero); nested placeOrder/cancelOrder/withdraw revert with AlreadyUnlocked.

Withdraw rounding: pro-rata principal and fee credits round down and the final owner receives currency totals, so claims are always redeemable; the fuzz suites confirm conservation.

Settlement of the previous round, each re-run independently against the vendored real PoolManager (TakeProfitFixture, pool at tick 138000, TKPF-only seed) with a scratch test that was deleted afterwards.

1. Empty-gap gas DoS [was high]: FIXED. lib/uniswap-hooks/src/general/LimitOrderHook.sol _fillOrders now reads StateLibrary.getTickBitmap per 256-interval word and only calls _fillOrder for initialized bits inside [lower, upper]; src/TakeProfitHook.sol _fillOrders skips traversal for the ETH-selling direction. The free 1-wei sell to MAX_SQRT_PRICE-1 still parks slot0 at tick 887271 and the cursor at 887220 but costs 395,658 gas (was 54,971,135) and the following 1 ETH buy costs 581,682 gas (was 232,314,580) and delivers TKPF; the funded variant (sell 982,965.74 TKPF for 0.997 ETH, then 0.01 ETH buy) costs 500,448 / 561,598 gas. Bitmap masking was checked for bit 0 and bit 255, negative words, exact word-boundary stops and stale bits (test_bitmapHandlesNegativeWordsAdjacentOrdersAndExactBoundaries). Dense fills remain the documented limit (docs/GAS.md: 140 filled ranges at 23.3M gas, 200 above 30M); that is inherent to per-tick fills in the approved design and buyers can split swaps, so it is not reopened.
2. Dust-joiner fee capture on cancel [was medium]: FIXED. cancelOrder now pays the canceller its checkpointed feeCredits plus a pro-rata share of freshly collected fees (liquidity before removal) and mints only the remainder as claims for remaining owners. Re-run: after five partial-buy/reversal cycles and BOB placeOrder(key,137760,false,1), ALICE cancel receives 78,018,177,223,762 wei ETH and 75,282,093,457,514,739,373 wei TKPF of fees; BOB's cancel receives 1 wei ETH and 0 TKPF; hook claims end at 0 for both currencies.
3. Exact-boundary missed fill [was low]: FIXED. _getTick reads slot0.tick, so a buy limited at getSqrtPriceAtTick(137760) leaves tick 137759, cursor 137700, order filled, hook position liquidity 0, proceeds 10,410,230,911,197,140 wei ETH, and the owner withdraws exactly that after a reversal; a buy stopping at tick 137761 stays unfilled. Attacks from the request that fail: ETH-side orders (placeOrder/placeTakeProfit revert EthSideOrder before any state; unlockCallback is PoolManager-only and only reached via fixed encodings from place/cancel/withdraw); withdraw rounding (principal and credits round down, final owner takes currency totals; Accounting fuzz suites pass, 48/48 tests); fill-and-swap-back (filled liquidity is removed and held as ERC-6909 claims, a reverse swap opens a new order id; test_newOrderAfterFillGetsNewIdAndSwapBackCannotReopenFill); mid-cancel reentrancy: a cancel recipient that calls poolManager.swap directly during ALICE's non-final cancel and buys to tick 137700 fills the order mid-cancel, after which currency totals (10,425,834,546,641,892 wei ETH / 15,056,418,691,502,947,875 wei TKPF) equal the hook's claim balances exactly, BOB's final withdraw receives both totals and hook claims end at 0; nested placeOrder/cancelOrder/withdraw revert with AlreadyUnlocked. Manifest: constructorArgs [0xE03A1074c86CFeDd5C142C4F04F1a1536e203543] matches constructor(IPoolManager) and the approved Sepolia PoolManager; permissions [afterInitialize, afterSwap] match getHookPermissions and Hooks.AFTER_INITIALIZE_FLAG|AFTER_SWAP_FLAG == 0x1040 == HookFlags constants; the pinned protected floor deployed the real creation code (creationCode ++ abi.encode(manager)) by CREATE2 at an address carrying 0x1040 and passed 9/9 (3 hook, 6 token) with IMD_POOL_MANAGER set to the Sepolia address; initialPrice 78588986356927097284479352776873 == TickMath.getSqrtPriceAtTick(138000) and round-trips to tick 138000; pool fee 3000 / tickSpacing 60 / pairedCurrency zero match TICK_SPACING and the native-currency0 requirement; token name Takeprofit / symbol TKPF / decimals 18 match LaunchToken. docs/abi/TakeProfitHook.json (41 entries) and docs/abi/LaunchToken.json (19 entries) are entry-for-entry identical to forge inspect