Approved workflow

Implemented GASP and GasPriceFeeHook with vendored dependencies, ABI exports, and deployment documentation.

Verified:

• forge build
• forge test: 25 passing, including 4,096 stateful calls
• forge fmt --check
• ABI consistency and offline tests with a minimal environment

Independent review, manifest generation, and deployment remain assigned to later stages.

Added 14 tests in GasPriceFeeHook.fuzz.t.sol, covering tier boundaries, swap modes, fee rounding/caps, balance deltas, accrued claims, and failure rollback.

forge build and forge test passed offline: 39 passed, 0 failed. No implementation defects found. Only the new test file is deliverable.

launch.json is written and verified. It is the only changed file in the tree.

What the manifest declares

• "kind": "univ4_hook" as the first field.
• Hook GasPriceFeeHook, one constructor argument, the Sepolia PoolManager in lowercase hex. Permissions are exactly afterSwap and afterSwapReturnDelta, matching what getHookPermissions returns in src/GasPriceFeeHook.sol:73.
• Token GASP, name Gas Tax, symbol GASP, 18 decimals.
• Pool: native ETH as paired currency, fee 3000, tickSpacing 60, initialPrice 79228162514264337593543950336000.
• Notes at 3953 characters describing the fee rule, claim accounting, donation path, absence of admin, the token, the pool and the build settings. They state that supply split, allocations, owners and chain come from launch policy.

One judgment call to flag. The approved workflow fixes the pool key but no opening price, and the deployment doc says the test price of 2^96 is not launch economics. I chose sqrtPriceX96 = 1000 × 2^96, which is exactly 1,000,000 GASP per ETH at tick 138162. The notes state this choice and its derivation so a reviewer can accept or change it.

Verification performed

• Schema validation with a Draft 2020-12 validator against the canonical LaunchManifest schema passed, plus the refinements: initialPrice is below 2^256 and within TickMath bounds, kind is the first key, notes are under the cap.
• Constructor arity and types were cross-checked against docs/abi/GasPriceFeeHook.json and docs/abi/GASP.json.
• The protected hook and token floor tests were re-run in scratch with the creation code, the flags derived from the manifest's permission list (0x0044) and decimals 18. All 9 passed, including the permission-to-flags agreement and address mining.
• A scratch test opened the launch pool key at the manifest price with the hook attached, seeded GASP-only liquidity below it, and executed a first buy into the ETH-less pool with correct claim accounting.
• forge build succeeds and the full forge test run passes 49 of 49 tests with the scratch suites included.

Scratch files live only under test/scratch/, which is gitignored and outside the deliverable.

Review complete. Findings are in .imd-findings.json at the repo root; no source, test, or config file was touched, and the scratch proof-of-concept copy was deleted.

Verdict on the four attack surfaces

• afterSwap delta sign and rounding: correct. The unspecified-currency selection matches the mapping in v4-core Hooks.afterSwap for all four swap modes. The positive return credits the hook, the mint debits it, and the swapper's delta shrinks on the unspecified side. Ceil rounding and the cap at the full amount are exercised against the real PoolManager with an independent oracle, including 1 and 3 wei swaps and partial fills at a price limit.
• Tier inputs: as specified. Boundaries at exactly 2x base fee and exactly 3 gwei tip behave per the strict rule. The function is total over uint256. Sender control of gas price is documented in NatSpec, README and SECURITY.md.
• Fee >= output edge: handled. Fee equals output on a 1-wei output, the swapper gets zero, and zero output yields no mint and a zero hook delta.
• donateFees unlock path: sound. Caller and state checks hold, nested unlocks revert, a failed donate rolls back claims and the guard.

Findings, ranked

1. Medium, non-blocking. The donation payout can be captured by just-in-time liquidity. Add, donate and remove fit in one transaction as three unlocks. Reproduced with 1000x liquidity capturing all but 2 wei of both currencies. Worse, once a sell pushes the price above the one-sided seed range, a 1-wei position at the current tick takes 100% of accrued fees for gas cost only. README acknowledges no anti-JIT mechanism, and any fix changes the approved rule, so this needs a scope decision rather than a code revision.
2. Info. ERC-6909 claims gifted to the hook via transfer are stuck forever and break the claims-equals-accrued equality the invariant test asserts.
3. Info. A zero base fee always returns the low tier even when the literal formula would say high. This matches the workflow's simulation sentence and is unreachable on a live chain, but the website must call feeBpsFor rather than re-implement the formula.

Coverage note. The launch rehearsal exercises only an exact-input first buy into the ETH-less pool. Exact-output buys are covered in symmetric pools, and the manager mechanics are identical, so I did not file this as a defect. The manifest, constructor arguments and ABI exports were outside this assignment and were not reviewed.

Implemented source, static export, runtime manifest, and documentation.

• Build/typecheck, 5 unit tests, and 10 browser scenarios passed.
• Complete bundle: 1,528,997 bytes, below 8 MiB.
• No live transactions broadcast.
• Design documentation is at docs/DESIGN.md to respect the write scope.

Validation report

In-place commit was blocked by read-only .git; all deliverables remain ready in the workspace.