Delivered Sorphera contracts, tests, documentation, deployment manifest, and ABI exports. See README.md.

Checks passed: forge build, 34 local tests, 2 Sepolia read-only checks, and forge fmt --check.

Launch remains gated: the verified public FWA Sepolia deployment lacks the required builder attribution. Sales default to disabled; compatible dependencies and funded VRF configuration are required. No deployment was performed.

Updated launch.json with three accepted contracts, matching constructor arguments, dependency order, and activation notes.

Validated schema constraints and compiled constructor ABIs. forge build succeeded; all 34 tests passed.

Only launch.json changed outside permitted scratch output. Sales remain disabled pending compatible FWA dependencies, owner configuration, and VRF funding.

Saved .imd-findings.json: no substantiated defects in the assigned area, with coverage for all 37 entry points.

All 34 existing Foundry tests passed. Live integration was not rerun. Production files remain unchanged.

Saved .imd-findings.json with no substantiated findings and coverage for all 37 entry points.

All 34 offline tests passed. Live Sepolia end-to-end integration was not run. Implementation files remain unchanged.

Saved .imd-findings.json with no substantiated findings and coverage for all 37 entry points.

All 34 existing tests and 5 temporary math/boundary checks passed. Temporary tests were removed; contracts and configuration are unchanged. Live integration remains unverified.

Added adversarial tests and five stateful invariants. forge build and forge test pass: 49 tests, including 16,384 invariant calls.

Reported one medium-severity NFT custody/deadline defect in .imd-findings.json, with a reproduced failing proof.

Production contracts and configuration are unchanged. Live Sepolia integration remains unverified by this work.

Review complete. The findings file is written at .imd-findings.json with 4 findings and a 41-row coverage record, and the working tree has no tracked changes.

What I kept from the specialists

• High, with proof. A single FWA NFT that cannot be delivered to a round vault keeps the vault's request pending forever. The draw gate in requestDraw has no time bound, so the round never finalizes, its exported prize and held fees become unclaimable, and every future round of that game is blocked. The proof at test/scratch/StuckNFTFreezesGame.t.sol fails on the current code with the reconciliation revert and passes with a one-line fix that I verified by a temporary patch, then restored.
• Low. An NFT physically delivered before the settlement deadline but reconciled after it does not count as eligible, so the round cancels while holding a secured asset. I lowered this from the tester's medium because the author documents it and it only needs nobody to call the permissionless reconcile in time.
• Low. The vault factory is permissionless, so anyone can emit spoofed discovery events that the documented keeper and frontend flow consumes. No funds are reachable.
• Low. A late FWA allocation after an NFT-round cancellation is still kept as an NFT, leaving the refund cohort an indivisible asset behind a unanimous vote instead of ETH. Documented tradeoff, reported for the author's decision.

What I dropped. Nothing was dropped; all four specialist findings reproduced in scratch tests. Nothing new surfaced in my own pass beyond those. The static analysis leads were benign on inspection, and the slither send-ETH warning targets an immutable address.

Coverage. All 37 entry points are answered. Three are tied to the high finding, two to the low findings, and the rest hold. One assumption is marked unreached: offline mocks cannot confirm that the live FWA pool keeps the listing purchaser and uses status 4 after settlement and depositor reclaims. If it does not, reconciliation would never become terminal on the real pool, so that should be verified on the compatible Sepolia deployment before activation.

All four findings reproduced on the accepted tree, and all four are fixed. The suite now has 40 passing tests, forge build and forge fmt --check pass, ABIs and manifest are regenerated, and .imd-responses.json answers each finding.

High: stuck NFT froze the game (src/SorpheraVault.sol). The reviewer's scenario reproduced exactly: pending stayed 1 and requestDraw reverted a year later. The cause was the line that forced the request back to pending whenever FWA named the vault as stuck recipient. A Settled listing whose NFT the vault does not hold is now terminal for pending accounting. The vault emits DeliveryStuck, records no custody, and recoverNFT stays callable forever. A later recovery is recorded as a late in-kind recovery routed by the originating round's entitlements. Two new tests cover the ETH game proceeding to a winner with the asset recoverable only by that winner, and an NFT round with nothing else secured cancelling at its deadline.

Low: custody before deadline, reconciled after. Reproduced and judged real. The vault's ERC-721 receive hook now stamps a receipt time per token, keyed by the calling collection. Reconciliation passes that time to the lottery, so delivery before the deadline counts even when recorded after it. Delivery after the deadline still cancels, and the cancel decision still happens only inside requestDraw.

Low: permissionless factory. Reproduced and fixed. The factory is now owned and the owner binds the lottery once with setLottery. Only that lottery can create vaults, and validateLaunch refuses an unbound factory. The factory constructor gained an owner argument, so launch.json now passes $owner to it. The README lists the setter under "After launch".

Low: late allocation after cancellation kept as NFT. Reproduced and judged real. Settlement after a round is Cancelled now takes the ETH depositor bid, read from round state, never from the caller. The test shows the per-ticket refund rising and conservation holding. Assets FWA forces into the vault after cancellation still follow the documented shared-cohort path.

Docs updated in README, docs/OPERATIONS.md, docs/TESTING.md, frontend/README.md, and the frontend JSON exports. The scratch reproduction file was removed, so no stray files remain outside the delivered paths.

The full suite passes: 59 tests across three suites, 0 failures, and only paths under test/ changed. No findings file is needed this round.

What I found

The implementer's revision (commit 5ce3812) changed four things my previous suite depended on: the factory now takes an owner and must be bound to the lottery once with setLottery, the vault's ERC721 hook stamps a receipt time that reconciliation passes to recordNFT, settlement after an NFT-round cancellation takes the ETH bid instead of keeping the NFT, and a stuck FWA delivery is now terminal rather than pending. My fixture and one adversarial test no longer compiled against that code. The custody-deadline defect I reported last round is fixed by the receipt stamp.

I read the revised paths adversarially and did not find a reportable defect. The hook is callable by anyone, but the stamp is keyed by caller, so a forged stamp cannot reach the real collection's entry. Stale stamps are not reachable with a compliant collection because a token cannot leave a vault and return to it within one round.

What I changed

• test/helpers/SorpheraFixture.sol: new factory constructor and the one-time lottery binding.
• test/SorpheraAdversarial.t.sol: fixed the recordNFT caller test and added one vault impersonating another round. New tests cover a forged receipt stamp, the strict deadline boundary (receipt exactly at the deadline cancels), a 512-run property that receipt time rather than reconcile time decides cancellation, a stuck asset recovered into a rolled round that belongs only to the next winner while expired tickets get nothing, and a second lottery that cannot validate against or create vaults through the bound factory.
• test/SorpheraInvariant.t.sol: the handler now drives forced FWA cashouts, forced NFT deliveries, rejected deliveries parked as stuck, and their recovery. A new invariant checks the fixed outcome rules on every round: cancelled rounds hold no VRF request and release no fees, drawn rounds hold exactly one bound request and release held fees once, zero-ticket rounds skip VRF, NFT draws always freeze inventory, the tie-break winner is an indexed matching ticket, eligible inventory never exceeds group inventory, and every recorded asset carries a receipt stamp. The pinned lifecycle now also drives a cancellation with a pending request, the late forced delivery into that cancelled round, and the refund claims.
• test/README.md: describes the new coverage and records that last round's finding is fixed and nothing is open.

Still owed outside this suite

Live Sepolia runs remain blocked by the published pool's missing builder attribution, as docs/DEPENDENCIES.md records. Everything here runs against the local mocks, and the receipt-stamp coverage assumes FWA's forced deliveries use safeTransferFrom.

Review complete. The findings file is written and validated; no source or tracked files were changed.

Outcome of settling last round's four findings

• High, stuck NFT freezes the game (a16d5bf3): fixed. Reconcile now treats a Settled-but-undelivered listing as terminal and emits DeliveryStuck. I re-ran the original scenario and the draw, claims, fee release and the next round all proceed, and a recovery a year later is claimable only through round-1 entitlements. I also checked the verified FWAV2 source from Sourcify: every exit from an Allocated listing sets status Settled, and Withdrawn is used only for Active or Staged listings, so the new terminal rule has no gap.
• Low, permissionless factory.create (3b6f5940): fixed. The factory is owner-bound once via setLottery, create is lottery-only, and validateLaunch cross-checks the binding.
• Low, keepNFT after cancellation (d3c3fcea): fixed. settle reads the round's cancelled status and takes the ETH bid; the cohort's per-ticket refund rose from 0.0025 to 0.007 ETH in my re-run.
• Low, custody before deadline reconciled after (4854c268): not fixed against the real dependency. This is the one finding I kept. The fix stamps receipt time in the vault's ERC721 receiver hook, but verified FWAV2 delivers finalizeUnsettled and depositorReclaimBacking with plain transferFrom plus an ownerOf check. The hook never runs on exactly those paths, so the stamp is zero, the fallback is reconciliation time, and the round still cancels. The author's test passes only because the mock's finalizeUnsettled uses safeTransferFrom, and docs/TESTING.md states that assumption explicitly. Severity stays low. My scratch test leaves the chain in the real post-delivery state and fails on this tree with "round cancelled: 7 != 3"; its source is attached as the proof.

Second pass. I read all changed lines as new code and the rest of the contracts once more. Nothing else rose to a reproducible defect. Two notes went into coverage rows rather than findings: the router cannot re-register the same pool after an FWA rewards-module swap, which is fail-closed by design, and anyone can route their own FWA purchase through the router, which only adds builder credit to the company.

Coverage. All 41 entry points are answered, plus four rows for the prior findings: 41 holds, 4 finding, 0 unreached.