Implemented OG, the ETH-fee hook, NFT rewards, Dutch auctions, launch wiring, ABIs, and documentation.

• Build and formatting checks pass.
• Offline: 35 passed, 1 explicit fork skip.
• Mainnet fork: 36 passed, no failures.
• SPEPE minting verified open: 1,242 minted.
• Independent review completed; claim-timing issue fixed.

See README and validation results. No transactions broadcast; launch price and liquidity parameters remain documented deployment inputs.

Done. The findings file is written and validated; scratch tests are removed and the tree is otherwise untouched (only .imd-findings.json is new).

Summary — Math Precision / Boundary / Numerical Gap review

Result: no fund-affecting defects found in the assigned area. One info finding reported.

What I verified (empirically, with scratch Foundry tests, since removed)

• Hook fee math, all 4 swap modes — 3000-run fuzz with random amounts, 5 price-limit regimes (full and partial fills, including tick-crossing across concentrated positions), launch decay at 0–120 min, protocol fee enabled, and the ERC-6909 claims fallback. In every run fee/gross == rate within 1 wei, team == gross/100, normal + surplus + team == fee, and QuoteMismatch never fired. I also proved algebraically that for exact-output sells gross − floor(gross·rate/WAD) == requested always, and that surplus ≥ 0 (so fee − baseFee cannot underflow).
• Dust boundaries — 1–99 wei swaps round fees to zero without reverting; the only reverts I hit were v4's own SafeCastOverflow when my test asked for more than the pool held (identical without the hook).
• Distributor accrual/stream — scaled credit/debt, no retroactive rewards, _vested() exact at streamEnd, no division by zero, backlog − _vested() never underflows; 50×1-wei fees to two L3 holders stayed solvent; claims-path exit after a 40 ETH 50%-fee buy paid exactly pending.
• Auction price — startPrice ≤ 1e28 is bounded by total supply so wadLn input is never 0; decay/floor continuous and monotone.

The one finding (info)

_schedule() re-applies the full 30 days to the remaining backlog on every empty→active transition. Repro: 30 ETH backlog, sole L1 holder exits at day 29 (paid 29 ETH), another activates → the last 1 ETH takes a further 30 days (pending at the original day-30 end is 0.033 ETH, not 1 ETH). No loss or misdirection; it is a pause/restart reading of "streamed linearly over 30 days" the author should confirm.

Coverage

All 21 listed entry points have rows (20 holds, exit → finding 1), plus three invariant rows. Nothing was left unreached.

Outside my area but worth the economics reviewer's eye (not reported as findings): the auction start price is tracked per tokenId, while the brief's "10× the previous auction's sale price" and the single "last sale price" view could be read as global.

Review complete. The findings file is written and validated, and the tree is otherwise untouched (the findings file and scratch probes are both gitignored).

Outcome: no access-control, trust-gap or asymmetry defect found in the hook, distributor or auction. One low-severity spec-conformance finding recorded.

What I checked in my area

• Every state-changing entry point the verifier listed, with its guard traced to the caller it assumes. All callbacks authenticate the PoolManager, the self-quote is self-only and always reverts, claim redemption and team payment are permissionless but parameterless with fixed destinations, and the distributor's three fee intake functions are hook-only with matching value checks.
• Paired surfaces diffed: direct fee take vs ERC‑6909 claim fallback, activate vs activateWithETH, exit vs auction buy, pending view vs exit payout, schedule vs checkpoint. The claim fallback and direct branch produce identical entitlement at swap time, and the unfunded counter always equals outstanding claims.
• Executed probes under test/scratch/Probe.t.sol: forcing the claim path by draining the manager inside an attacker's unlock, then exiting; reentering the auction and activate from an exit payout; redeeming inside a foreign unlock; a sole holder activating with ETH. All behaved as the design intends.
• External assumptions verified against mainnet: the collection is plain OpenZeppelin ERC‑721 with no burn, pause or transfer gate; the team wallet is an EOA; the mainnet PoolManager holds about 51,800 ETH so the claim fallback is practically unreachable without the drain trick. Shipped ABIs and recorded source hashes match the tree.

The one finding (low): OGAuction.list computes the 10x start price from that tokenId's own last sale, while the brief's wording ("the previous auction's sale price", single "last sale price" view) reads as a global ratchet. Reproduction and the executed probe output are in the file. The README documents the per-token choice, so this may be an accepted interpretation rather than a bug.

Coverage record: 24 rows, 23 holds, 1 finding, none unreached. Static-analysis leads (reentrancy, strict equalities, write-after-write on the buying flag) were traced and none reached an exploitable state.

Added adversarial tests, fuzz properties, randomized invariants, mainnet fork checks, and a review under test/.

• Build passed.
• Offline suite: 54 passed, 2 fork suites skipped.
• Mainnet fork: all 3 tests passed.
• New invariants: 20,480 calls passed.
• Verified minting open at block 26,146,970.
• No confirmed contract defects found.

Review complete. The findings file is written and validated, and no source files were changed (scratch tests live only under test/scratch/).

Outcome: no critical, high or medium defect found in the economics. The fee math, launch decay, weighted accrual, backlog streaming, exit payout and auction pricing all behave as specified. I recorded two findings and a full coverage record in .imd-findings.json.

Findings

• Low, auction start price semantics. The brief says the start price is max(10x the previous auction's sale price, 500,000 OG) and lists one "last sale price" view. The code keys the last sale by tokenId, so after any NFT sells at 500,000 OG the next exited NFT still lists at 500,000 instead of 5,000,000. The README documents the per-token choice, so the judge should settle which reading the requester meant. Reproduced in a scratch test.
• Info, stranded weight. An active NFT sent by plain transfer to the dead address or a contract with no exit path keeps its weight in totalWeight forever. Its share of every future fee accrues to pending ETH nobody can withdraw and other holders are permanently diluted. Nobody profits, so it is griefing at the cost of the NFT plus burned OG, and it follows from the brief's rule that rewards travel with the token. Reported for documentation.

What I verified and how

• Proved analytically that the exact-output sell quote always reproduces the real swap delta, that the launch surplus can never underflow, and that the 2.5/1 split holds for all four modes.
• Wrote a 2,000-run fuzz over buy and sell, exact input and output, random price limits and every second of the launch hour against the real pool. No quote mismatch, no split error, no ETH left in the hook, and distributor accounting always equals the ETH received.
• Confirmed the vendored v4 delta semantics the hook depends on, and checked on mainnet that the team wallet is an EOA and that SPEPE is a plain OpenZeppelin v5 ERC-721 with no burn, transfer hooks or operator filter.
• Ran the mainnet fork lifecycle test against live SPEPE at two blocks. It passes. One run at "latest" reverted because of an RPC transient and passed when pinned to the same block.

Coverage

All 22 listed entry points have rows. Twenty are holds, two reference the findings above (OGAuction.list and OGDistributor.exit). Four extra rows record the invariants I checked: ETH solvency, weight conservation, the fee split and decay, and the live fork lifecycle. Nothing in my area was left unreached.

The findings file exists and is deliberately excluded from git by the harness. The working tree is otherwise clean, scratch tests are removed, and no source file was changed.

Review result

The assigned area (Execution Trace, Periphery, First Principles) was covered in full across all four contracts, and I found no critical, high or medium defect. The findings file holds two low findings and one informational note, with coverage rows for all 21 listed entry points plus four invariants.

What I verified

• Traced every hook callback through the v4 PoolManager's delta accounting for all four swap modes. I proved on paper that the exact-output sell's adjusted swap amount equals the quoted gross on full fills, and that partial fills re-bind at the same price limit, so QuoteMismatch is unreachable. A 1500-run fuzz over amounts, price limits, launch elapsed 0 to 2 hours and all modes confirmed the fee relation, the 1% team share, zero hook balance, claim totals equal to ERC-6909 balances, and redeemability after every swap.
• Deployed the hook against the live mainnet PoolManager on a fork. The shipped fork test only uses a fresh manager, so the self-quote's reliance on the live manager skipping hook callbacks for the hook's own swap had never been exercised. All modes, activateWithETH with a real SPEPE owner, and exit pass there.
• Probed flows the shipped suite skips: claim redemption after a sell drains pool ETH, ETH activation on a fresh manager followed by exit, exit-to-empty and re-activation in one block, repeated launch-hour stream restarts followed by full streaming, upgrades mid-stream, and exit while the team wallet rejects ETH. All behave as intended. Rounding analysis shows surplus is exactly zero after the launch hour, so normal buys can never restart the 30-day stream.
• Confirmed SPEPE's deployed bytecode exposes a standard ERC-721 surface with no burn, pause or staking selectors, the team address is a plain EOA, and the shipped ABIs match the compiled output.

Findings written

1. Low: the auction start price keys on the same tokenId's last sale, not "the previous auction's sale price" as the brief words it. An NFT exiting for the first time always starts at 500,000 OG even after another NFT just sold for more.
2. Low: an activated NFT moved by plain transferFrom into the auction or distributor keeps its weight forever. There is no path to clear it, so all other holders are diluted permanently for a 50,000 OG cost.
3. Info: the live-manager coverage gap above, recorded with the evidence that it now passes.

No proofs were attached because nothing reached high or critical severity.