Implemented the immutable 0.75% IMD-fee hook, fixed-supply token, vendored dependencies and deployment documentation.

• Build, formatting and 57 local tests pass.
• Eight Robinhood fork tests passed initially.
• A later fork rerun stopped with HTTP 429: “Free tier rate limit exceeded.”

No deployment was performed.

I wrote launch.json, and it's the only file changed. It parses as JSON, its first field is "kind": "univ4_hook", and the notes are 1,931 characters, under the 4,000 cap. forge build succeeds. forge test with the verifier's fuzz seed ran 57 tests and all passed; 2 were skipped, which I take to be the fork tests skipping because this machine has no Robinhood Chain RPC set up.

What the manifest says, taken from the code in the repository:

• Hook: TestHook, with constructor arguments ["$poolManager", "$token"] in declaration order.
• Permissions: beforeInitialize, beforeSwap, afterSwap, beforeSwapReturnDelta and afterSwapReturnDelta. These are exactly what getHookPermissions returns, and they match the 0x20cc address flags in src/TestHook.sol.
• No owner, factory or launch number: the hook takes no $owner, $factory or $launchNumber argument, because it has no owner or admin and every address and rate is fixed at deploy, as the brief asks.
• Token: TestToken, named "SIMD TEST 2 - DO NOT BUY", symbol SIMDTEST2, 18 decimals, no constructor arguments.
• Pool: paired with IMD at 0x5f7bb59365ce557c26dbcaa4ee9d39a4b95b7127, fee 12500, tickSpacing 60, initialPrice "79228162514264337593543950336". The hook's beforeInitialize only accepts calls from the PoolManager, only for this exact pool key with fee 12500, and returns the correct selector.
• Notes: these state that it is a test token not to be bought, give the logo URL, and describe the fee. The hook takes 0.75% of the IMD side of every buy and sell and pays it in IMD to the fixed vault at 0xa9d495…813a. If that payment can't be made during a swap, the hook keeps the fee as a claim and anyone can call flushFees() to send it to the vault, so a real swap never reverts.

The example manifest has no logo field, so I didn't add one and left the logo only in the notes.

I found no defects in the economics of TestHook / TestToken. .imd-findings.json contains an empty findings list and a coverage row for each of the 8 entry points, all marked holds, plus two invariant rows. Apart from that file, I changed nothing in the repository.

What I checked against v4-core's PoolManager.swap and Hooks.sol in lib/:

• Fee in every mode: the fee is always floor(gross executed IMD × 75 / 10000). I worked through all four cases:
  • Exact-input buy: a full fill pays floor(A·75/10000). A partial fill pays floor(P·75/9925), which comes to the same 0.75% of what was actually spent, P+f.
  • Exact-output buy: the fee is charged after the swap, so the trader pays P plus floor(P·75/9925).
  • Exact-input sell: the trader receives the IMD output minus floor(G·75/10000).
  • Exact-output sell: the trader still receives exactly the IMD amount they asked for.
• Swaps that only partly fill: for exact-input buys and exact-output sells the hook previews the swap first. I showed that the fee it charges based on that preview can never exceed its maximum estimate, and that the real swap then fills exactly what the preview did. So the fee worked out before the swap always equals the one paid after it. If they ever differed, the hook's balance with the pool manager would not settle and the swap would revert; that can't happen here.
• Who balances what: the fee the hook claims is cancelled exactly by what it pays out, either sent straight to the vault or recorded as an IMD claim (ERC-6909) it holds when the direct transfer fails. The preview always reverts, which rolls back its price change, fee growth and balance changes. Only the hook can call the preview, and the pool manager skips the hook's own callbacks when the hook is the one swapping, so it can't loop back on itself.
• Nothing can redirect the fee: the vault, IMD address and rate are constants. There are no setters, no owner, no hookData input and no time or block logic. The hook never approves anyone to move its IMD claims, and flushFees only ever pays the fixed vault.
• Static-analysis leads: Slither's divide-before-multiply warning on _fraction is a false positive; the formula is algebraically the same as floor(a·75/d) and can't overflow. The reentrancy-events warnings have no economic effect.
• Existing tests: I ran the suite: 57 passed and 2 were skipped. The skips are fork tests that only run when a Robinhood Chain RPC URL is configured.

Not covered:

• I didn't run any fork tests against live Robinhood Chain state.
• No test sets a protocol fee. My reasoning says it doesn't change the result, because the preview runs the same pool code the real swap does, but nothing exercises it.
• How the vault splits the fees each week and the claim contract holding the launch remainder are outside this code.

Two minor points, not reported as findings:

• The two fees apply one after the other, so a trade actually costs about 1.99%, not exactly 2%. The README already says this.
• Trades under 134 wei of IMD pay no hook fee because of rounding down. The amount is economically meaningless.

The review is complete and .imd-findings.json holds two info-level findings and fifteen coverage rows. No permission, trust-gap or asymmetry defect was found in the contracts.

Result for the assigned area (Access Control, Trust Gap, Asymmetry)

• Access control holds. Every callback the hook implements checks the caller is the PoolManager, and the quote entry point accepts only the hook itself and always reverts. The fee rate, vault, IMD address and LP tier are constants, with no owner, setter, fallback, receive, proxy or ERC-6909 approval anywhere. The pool id is fixed in the constructor, so only the launch pool can ever initialize on this hook, from any initializer and at any price.
• Trust gap holds. The payout path pays the constant vault directly and falls back to a self-held claim if the IMD transfer fails. Anyone may redeem claims, but only to the vault. A gas-forced fallback is infeasible, since the inner transfer would need to run out of gas with over six million gas still available.
• Asymmetry holds. The simulate-then-execute pair in beforeSwap and afterSwap agrees in every case I fuzzed. I added three extra fuzz tests in test/scratch covering any price limit, dust amounts at limits, tick crossings and multi-swap sequences in both currency orders. All passed with zero nonzero hook deltas, so no valid swap is reverted by the hook.

Verification I ran

• The offline suite passes with 57 tests.
• A copy of the verifier's protected hook floor, run with a factory probe and token probe, passes all four tests including initialization from the launch factory.
• On Robinhood Chain the hardcoded IMD address answers symbol IMD with 18 decimals, and both the vault and the PoolManager have code.

Findings written (both info)

1. The fork documentation describes the previous contributor's suite. README and VALIDATION.md give a command using a fork-url flag at block 108268099, but the current suite reads the endpoint from an environment variable and pins block 108279434. The documented command skips both suites, which I confirmed against a local anvil. No passing run of the current suite is recorded.
2. README still says no launch.json is included, while one is present and matches the implementation.

Not reached

The fork suite could not be executed here. The Pinax free tier returned HTTP 429 at setUp, and the official endpoint has no historical state at the pinned block. That row is marked unreached in the coverage record.

The review is complete. The findings file is written at the repository root, no tracked file was changed, and the scratch tests live under the gitignored test/scratch/ directory.

Outcome. The hook's control flow is sound in my area. I traced every swap mode, including partial fills at the price limit and dust amounts, and the fee the hook credits itself in beforeSwap always equals the fee it debits in afterSwap, so no swap can be stranded with an unsettled hook delta. A 3,000-run boundary fuzz against near-full partial fills confirmed this empirically. The preview path cannot recurse because the vendored PoolManager skips callbacks when the hook is the caller. The deferred-claim path, flushFees, and the pool binding behave as documented. The on-chain IMD token is an Ownable LayerZero OFT with standard ERC-20 transfers, so no fee-on-transfer or callback risk reaches the hook.

Findings written (4):

• Low, with proof: paying the vault with take inside afterSwap moves IMD out of the manager mid-unlock. A router that syncs IMD before the swap and settles after is credited the fee short and reverts with CurrencyNotSettled, while the same flow succeeds on an unhooked twin pool. This contradicts "the hook never reverts a real swap". The attached proof test fails on the current tree for that reason.
• Low: the fork test pins block 108279434, but the README command, VALIDATION.md and fork-evidence.json all record block 108268099, so the recorded fork pass does not describe the committed test.
• Info: the README says no launch.json is included, but one ships and is consistent with the hook.
• Info: the fee applies only to the launch pool. Anyone can open a hookless SIMDTEST2/IMD pool and trade fee-free, which is inherent to the requested plain-token design.

Coverage. All eight listed entry points have rows, plus six invariant rows. Seven entry points hold; afterSwap is marked as a finding for the router case.

Not verified. The live Robinhood fork suite could not run here: the public Pinax endpoint returned HTTP 429 during setUp for both tests I tried. The fork evidence remains as the author recorded it.

Review complete. The findings file is written at .imd-findings.json with 4 findings and 11 coverage rows.

What I audited. The Math Precision, Boundary and Numerical Gap passes over TestHook, with the Pashov mindset applied first. I traced all four swap modes in both currency orders: the fee reserved in beforeSwap via the reverting self-quote, the fee recomputed in afterSwap, and the hook's delta settlement. I confirmed the identities by hand and by scratch fuzzing: 8000 random partial-fill cases across multiple liquidity ranges, exhaustive tiny amounts 1 to 400 wei with full and partial fills, and swaps under the maximum protocol fee. The preview and real swap always agree, the hook's delta always nets to zero, and the fee always equals floor of 0.75% of gross executed IMD. The _fraction quotient-plus-remainder form is exact, so Slither's divide-before-multiply lead is a false positive.

Findings.

• Low, with proof. afterSwap pays the fee with take, which lowers the manager's IMD balance mid-swap. A router that syncs IMD before calling swap and settles afterwards sees its payment credited short by the fee, so every buy through it reverts with CurrencyNotSettled while sells succeed. Standard Uniswap routers sync right before transferring and are unaffected. The proof in test/scratch/SyncFirstRouterProof.t.sol fails on the buy today.
• Low. The fork suite pins block 108279434 and skips unless an environment variable is set, while the README, VALIDATION.md and fork-evidence.json document block 108268099 and a command that skips both fixtures. I ran the documented command and got two skips and no fork tests.
• Info. Fees floor to zero for IMD legs under 134 wei. Dust only, documented, not farmable.
• Info. README says no launch.json is included, but one is present and checks out against the implementation.

Not reached. The live Robinhood fork run. The public RPC has no historical state at the pinned block and the Pinax archive endpoint rate-limited during setUp, so that row is marked unreached rather than passed.

The review is done and written to .imd-findings.json: 3 findings, none critical or high, and coverage rows for all 8 entry points plus 3 invariants. The only source defect is the medium one, a hook revert on a class of routers. The other two are stale docs and evidence. I removed my scratch tests and changed no tracked files.

Findings kept

#	Severity	Finding	Merged from	How it was reproduced
1	Medium	At src/TestHook.sol:161, afterSwap pays the fee with a direct take(). A router that syncs IMD before the swap then fails every buy with CurrencyNotSettled.	audit_math, audit_flow	Ran both specialist proofs: each fails on the buy for that reason, and the sell through the same router passes.
2	Low	The fork command in the README runs no fork tests, and the recorded evidence is for an older suite and block (8 tests at 108268099; the tree has 22 at 108279434).	All three specialists who reported it	With ROBINHOOD_RPC_URL unset, the suite reports 0 passed, 2 skipped. I compared the block numbers across the test, README and docs.
3	Info	README.md:50 says no launch.json is included, but one is. The manifest itself matches the code.	All three specialists who reported it	Read the file and the README line.

Finding 1 severity: the specialists rated it low; I raised it to medium because it breaks the brief's "the hook never reverts a real swap", and the README's exclusions don't cover this case. No funds are lost, and V4Router and UniversalRouter should be unaffected because they sync right before transferring. A trial fix in a throwaway copy, minting the claim when IMD is the synced currency, made both proofs pass. The attached proof is the audit_math specialist's.

Dropped findings and tool leads

• Dust rounding (under 134 wei pays no fee): the README documents it, and each split trade still pays the LP fee and gas, so it isn't a defect.
• A second pool without the hook: this is inherent to a plain token with a pool hook, which is what the brief asked for.
• Slither divide-before-multiply: false positive; _fraction computes exactly floor(a*75/den).
• Slither and Aderyn low-severity lines: no defect came out of them.

My own pass

I found nothing the specialists missed. I traced whether the previewed fee can differ from the fee afterSwap charges, on full and partial fills, and it can't. A mismatch would have left the hook with an unsettled balance and reverted the swap.

Check	Result
Offline suite	57 passed, 2 fork fixtures skipped
Hook floor, with factory probe	4 passed
Fork suite at recent block 108314000, public RPC	22 passed

Limits

• Pinned fork block not run: the public RPC has no state for 108279434, so the 22 passes are from a scratch copy that changed only the block number.
• Other floor suites not run: I didn't run Owners, OwnToken or Token. Owners needs harness files that aren't in the tree. I read Owners in full, and its checks fit the hook since it has no owner or liquidity callbacks. I read only the start of OwnToken. The token rows rest on it being unmodified OpenZeppelin ERC-20.
• Possible floor compile problem, not reported as a finding: Hook.protected.t.sol calls fail(string), which the repo's lib/forge-std doesn't have. I added a small local helper to run it. This only matters if the verifier compiles that file against this lib/, which I can't see, and lib/ is off-limits to the author anyway.

I fixed the medium finding (swaps reverting for routers that sync IMD first) and answered all four findings in .imd-responses.json. forge build, forge test (with the given fuzz seed) and forge fmt --check all pass.

Medium: buys revert for routers that sync IMD before swapping. Fixed.

• Reproduced: on the starting tree, the reviewer's test_syncFirstRouterCanBuy failed with CurrencyNotSettled().
• Cause: the hook paid the fee out of the PoolManager in the middle of the swap. A router that syncs IMD before the swap and settles after it was then credited 0.75 IMD short, so the whole swap reverted.
• Change: in src/TestHook.sol, when IMD is the synced currency, the hook no longer sends the fee. It records it as a claim the hook holds inside the PoolManager, using the deferral path that was already there. Anyone can call flushFees() to send it, and it only ever goes to the fixed vault. Every other case still pays the vault directly.
• New test: test_syncFirstRouterBuysAndSellsWithFeeAccounted, run for both token orders. A buy through such a router holds back exactly 0.75 IMD, a sell pays the vault directly, and the flush delivers the held fee. The test fails with CurrencyNotSettled on the old hook and passes now, as do both of the reviewer's proof tests.
• Live check: the pinned fork block can't be read today. The public endpoint no longer keeps that old state, and Pinax rate-limits with HTTP 429. So I ran a throwaway copy of the fork suite with only the two block-pinning checks removed. It passed 8/8 against Robinhood Chain at block 108,318,098.
• Docs: I updated README.md and docs/VALIDATION.md to describe the new behaviour, the test count (59) and that live run.

Advisory findings:

• Fork-test docs describe a different suite (low): not reproducible. In this tree the fork test doesn't read ROBINHOOD_RPC_URL. It runs when you pass --fork-url, is pinned to block 108,268,099 and has 8 tests, which matches the README, docs/VALIDATION.md and docs/fork-evidence.json. The reviewer seems to have looked at a different version.
• README says there's no launch.json (info): not reproducible. There is no launch.json in this tree, so the README is accurate. I didn't add one, since the manifest step writes it.
• Fees total 1.990625%, not 2% (info): disputed. The brief asks for exactly 0.75%, and that's what the hook takes. The pool's 1.25% fee is then taken from what's left, so the two add up to slightly under 2%. The README already explains this, and raising the hook's rate to reach exactly 2% would break the brief.

Nothing is committed.

I made one small change to launch.json, in its notes. Everything else in the manifest already matched the code and is unchanged.

What I checked against the code:

• kind is the first field and is "univ4_hook".
• Hook: TestHook. Its constructor is (IPoolManager manager_, address token_), written as ["$poolManager", "$token"]. It has no owner, factory or launch-number argument because it has no admin.
• Permissions: beforeInitialize, beforeSwap, afterSwap, beforeSwapReturnDelta, afterSwapReturnDelta. These are exactly what getHookPermissions (src/TestHook.sol:64) returns, and they match the hook's address flags 0x20cc.
• Token: TestToken, named "SIMD TEST 2 - DO NOT BUY", symbol SIMDTEST2, 18 decimals, no constructor arguments.
• Pool: paired with IMD 0x5f7bb59365ce557c26dbcaa4ee9d39a4b95b7127, fee 12500, tickSpacing 60, initialPrice "79228162514264337593543950336". The hook's beforeInitialize accepts fee 12500.

The change: after the manifest was first written, the hook gained one more case where it holds the fee instead of paying it straight to the vault. If IMD is the pool manager's currently synced currency, it keeps the fee as a claim, so a pending IMD payment isn't under-credited. That claim goes to the fixed vault when anyone calls flushFees(). The notes now say this. They are 1,985 characters, well under the 4,000 cap.

Checks: forge build passes. With the given fuzz seed, forge test ran 59 tests: all passed, and 2 were skipped. The 2 skipped are fork tests, which skip when no Robinhood Chain RPC is configured, so the fork checks of the fee landing in the vault have not run against the live chain here. launch.json is the only file changed, and I haven't committed it.

The medium finding is fixed. The two advisory findings still stand in the tree under review, though the author's replies were accurate for their own branch. My review is written to .imd-findings.json: 2 findings, and all 8 entry points marked holds.

[medium] The sync-first router buy reverted with CurrencyNotSettled: fixed. _pay in src/TestHook.sol:164 now checks whether IMD is the PoolManager's synced currency. If it is, the hook records the fee as a claim it holds instead of sending it out mid-swap, and flushFees later pays it only to the fixed vault. I ran all three earlier proofs against the revised code and all pass (Proof_fcdfccacd77d, Proof_e3a0887ea581, Proof_4bd9dc4c08d3). The full suite gives 64 passed and 0 failed; the 2 Robinhood fork fixtures skip without an RPC URL. I also ran the fork suite against live Robinhood state at a recent block (108,335,000), changing nothing but the block number: 24 of 24 passed, including the new test of a sync-first router on the real PoolManager. The fix introduced nothing new that I could find: holding the fee as a claim is safe whatever was last synced.

Why the two advisory findings still stand. The author answered both as not reproducible, and their branch didn't have these problems. The tree being judged is that branch merged with two other contributors' reapplied commits (the fork tests and the manifest), and both problems show up there:

• [low] Fork documentation doesn't match the committed fork suite.

  • test/RobinhoodFork.t.sol reads ROBINHOOD_RPC_URL, pins block 108,279,434 and has 24 tests.
  • README.md:162 and docs/VALIDATION.md give a --fork-block-number 108268099 command that never sets that variable. Run that way, both fork fixtures skip and no fork test executes.
  • The docs and docs/fork-evidence.json still record "eight" tests and the hashes for block 108,268,099.
  • The public endpoint still can't serve state at 108,279,434 ("historical state ... is not available"), so the suite needs an archive node at its own pinned block.

  This is a problem with the evidence, not the code: the suite itself passes against live state.

• [info] README.md:50 says no launch.json is included, but one is in the tree. I checked the manifest against the revised hook and it matches: constructor arguments in declaration order, permissions, fee 12500, tick spacing 60 and the IMD address. Only the README sentence is wrong.

The four protected floor tests could not be run here: they import harness files (mocks/, floor/) that aren't in the repository. My scratch files are removed and no project files were changed.