The review is complete. .imd-findings.json holds ten substantiated findings, none above low. No file in the tree was changed; the scratch test was removed after running.

What was read in full: YoloToken, NftGate, DevPrices, UniswapV3SwapAdapter, ParamsRegistry with VaultParams (bounds and version 1), TextRules and TextLib, SwarmQuestion and SwarmQuestionBuilder, VotePower, AttestationChecker with OracleAttestation, BuybackBurner, script/LaunchPlan.sol, the two protected tests and the Pashov mindset section. TaskVault was read only where the in-scope contracts depend on it, such as the owner used by cancelTask and the zero-amount guard before the adapter call. CaseDesk, DisputeDesk, YoloLockHub and the extras belong to later launches and were not audited. The fork rehearsal needs a mainnet archive RPC and was not run. The full 686-test suite could not be run in the time budget because via-IR compilation of the test tree takes over ten minutes per invocation. A scratch test confirmed four of the reproductions below.

No defect of consequence found. The token's buy and sell taxes, the on-top sell arithmetic, the minute 30 and 60 boundaries, the gate consumption, the factory and PoolManager exemptions, and the constructor arguments all match the brief. No contract uses DELEGATECALL, SELFDESTRUCT, a proxy or an initializer. Every post-deployment setting is the one the brief names.

Findings, for the adapter to record in ADAPTATION.md:

• Low, BuybackBurner.sol:76. DevPrices does not override the inherited one-step renounceOwnership. One call by the dev wallet kills setBuybackWallet, the price setters and TaskVault.cancelTask forever. Confirmed by test.
• Low, ParamsRegistry.sol:208. Pause new tasks, then renounce ownership: the pause and the attester set become permanent. Confirmed by test.
• Low, ParamsRegistry.sol:176. Timelocked proposals never expire. A forgotten attester removal executes a year later by anyone. Confirmed by test.
• Info, ParamsRegistry.sol:86. cancelParams leaves the cancelled proposal visible in pendingParams(). Confirmed.
• Info, ParamsRegistry.sol:175. proposeAttester accepts address(0), unlike the constructor. The checker still refuses it, so no bypass. Confirmed.
• Info, VotePower.sol:38. mayVote reverts rather than returning false when the NFT or registry address holds no code. Mainnet addresses have code. Confirmed.
• Info, UniswapV3SwapAdapter.sol:58. amountIn 0 passes through as SwapRouter02's contract-balance sentinel. The vault already refuses zero.
• Info, YoloToken.sol:136. A non-factory LP's liquidity removal is gated and taxed like a buy, the mirror of the documented add-liquidity limit.
• Info, BuybackBurner.sol:124. pull() makes the burner call any caller-chosen address. No value can move.
• Info, YoloToken.sol:125. whitelistActive() says true while every buy reverts SnapshotNotSealed. Confirmed.

Untested edges worth noting: nothing in the suite exercises renounceOwnership, a stale proposal, or the whitelistActive view against an unsealed gate.

The work is complete. The project arrived launchable, so the delivery is ADAPTATION.md alone, with no change to any line of code.

What I verified

• Every launch rule for a custom-token launch holds as the code arrived: the token mints its whole 1e27 supply to the factory once, nothing can mint after launch, the factory and PoolManager are exempt so the swarm share, claims and the seed move whole, no contract is owned by the factory or IMD, no forbidden opcodes, no unlinked libraries, every constructor takes only addresses and integers with no external call.
• The brief's constructor arguments match the plan in script/LaunchPlan.sol exactly.
• On mainnet the genesis NftGate and YoloSplitter exist, the gate's writer is the project wallet, and every counterparty address holds code. The snapshot is still unsealed and openAt is about 15 hours away, both recorded as operational notes.
• forge build passes. forge test with the verifier's fuzz seed: 686 passed, 0 failed, 3 skipped. The fork rehearsal against the live factory at block 26,236,321 passes both tests.

Audit findings

All ten imported findings reproduce exactly as described. I reproduced each in a scratch test and recorded them in ADAPTATION.md as notes without a code change, as the brief instructs. None is a loss of funds or a permission bypass. They are owner foot-guns, view inconsistencies, and accepted schedule consequences.

One risk to flag

The custom-token floor test buys from the pool and sells everything back in one run. With this token that only succeeds at a block time at least one hour after openAt, since buys revert before openAt and a full sell in minutes 0 to 60 cannot pay the on-top tax. This is the requester's fixed design and the fork rehearsal handles it by warping. I documented the exact clock matrix so the floor can be run knowingly. It cannot be changed here without changing the token, which the brief forbids.

launch.json was not written. The manifest step owns it, and the values it needs are listed in ADAPTATION.md.

The review is complete and .imd-findings.json holds four findings and a coverage row for all 113 listed entry points.

What I found

1. Medium: the pinned custom-token admission floor cannot pass for this token at any single block timestamp. The floor's trade test deploys, buys and sells everything back without warping. The constructor needs openAt >= block.timestamp, a buy needs the opposite, so only T == openAt admits both, and there the sell of the whole balance reverts because the 30% sell tax is taken on top of the amount. At forge's default timestamp the constructor itself reverts and every floor test fails in setUp. ADAPTATION.md's note assumed the floor could run an hour after openAt, which the constructor bound excludes. Proof attached: test/scratch/FloorClock.t.sol fails with ERC20InsufficientBalance on the current code. The resolution is a scope decision (warp between deploy and trade in the floor run, or a tax rule the brief forbids), not a src change.
2. Low: the whole launch reverts BadOpenAt if mined at or after 21 Oct 2026 12:00 UTC. About 14.5 hours remained at review time; the only remedy the brief allows is moving openAt up to 15:00 UTC.
3. Low: minutes 0-30 are closed to everyone unless the NftGate is sealed strictly before openAt. The gate was unsealed at the last mainnet read.
4. Info: AttestationChecker accepts expiresAt == 0 and never checks issuedAt, diverging from the protocol's reference consumer. No exploit without an attester key.

What I verified

• Traced YoloToken, DevPrices, ParamsRegistry, BuybackBurner, the swap adapter, VotePower, TextRules, SwarmQuestionBuilder and AttestationChecker against the Execution Trace, Periphery and First Principles guides. Constructor arguments in the brief, script/LaunchPlan.sol and ADAPTATION.md agree. The attestation struct and type string match the oracle reference.
• Build succeeds. The YoloToken, DevPrices, BuybackWallet and Directory suites pass. No fork run (FORK_URL unset).

Not reached: the launch 0 vestings and the launch 2 and 3 contracts beyond their reads of launch 1 contracts. Those rows are marked unreached in the coverage record. No repository file outside test/scratch/ and .imd-findings.json was changed.

The working tree is clean apart from the findings file (which git ignores), and the review is complete.

Outcome. No critical or high defect in the assigned area. The eight support contracts and the token hold against the Access Control, Trust Gap and Asymmetry checklists. Five notes are recorded in .imd-findings.json, each with a reproduction I ran in scratch tests (since deleted), plus a coverage row for every one of the 113 listed entry points and three invariants.

Findings recorded

• Low, YoloToken sell path. A spender approved for X YOLO moves X plus the sell tax out of the holder's wallet when the destination is the PoolManager in the first hour. Approved 70, holder loses 100, with 30 going to the project wallet. The design is fixed by the brief, so this is a note on the allowance invariant.
• Low, ParamsRegistry attester proposals. Add and remove proposals for one address are independent keys executed by anyone, so the executor's order decides the outcome when both are pending. A later proposal does not supersede an earlier one. The owner must cancel explicitly.
• Info, ParamsRegistry.proposeParams overwrites a pending proposal and restarts its clock without a cancellation event.
• Info, BuybackBurner.setBuybackWallet accepts a wallet that cannot receive ETH, after which the ETH branch of forward reverts while the ERC-20 branch works. Recoverable by the dev.
• Info, launch clock. The token constructor reverts if the launch is mined after openAt, which is roughly one day out. The NftGate was also unsealed at the reviewed block.

Coverage. Holds on 38 rows, finding on 8, unreached on 70. The unreached rows are the core and extras launches (CaseDesk, DisputeDesk, most of TaskVault, YoloLockHub, YoloPredict, YoloSweeter, trophies, directory, HiddenList) and the already-deployed genesis vestings, which are outside the assigned area. Within TaskVault I did trace the parts that touch my contracts: cancelTask, burn, sweepTreasury, withdraw and withdrawTo, the adapter call, and the oracle callback's checker.

Verification. Four scratch tests passed on the current code, confirming each reproduction. Constructor arguments in the brief match script/LaunchPlan.sol word for word. No file in the repository was changed.

The review is complete. The findings file is written, validated, and the working tree is clean.

Outcome. No critical, high or medium defects in the math of this launch. The buy and sell tax formulas, the gate allowance bookkeeping, the DevPrices step guard, the registry bounds and the adapter's path checks all hold at every boundary I traced, including second 1799, 1800, 1801, 3599 and 3600 after opening. Three findings are recorded in .imd-findings.json, none requiring a code change:

• Low, scale mismatch between two fixed inputs. DevPrices starts YOLO at $0.001, while the fixed economics open the pool at 15,000 IMD × $5.5 over one billion tokens, which is $0.0000825 per YOLO. The gap is 12.1x. The only consumer is the doer stake bonus, so a doer earns the full 4% with a lock worth one twelfth of the reward until the owner corrects it. The 10x step guard means the correction takes two setter calls, not one. Verified in a scratch test, since deleted.
• Info, view versus write rounding. The two tax views divide to whole basis points first, while transfers multiply the full numerator into the amount. At second 1801 the view says 2998 bps and a one million YOLO buy actually pays 33.33 YOLO more than that implies. An integrator should use the exact per-amount view for sells and expect the gap on buys.
• Info, expiry boundary. The attestation checker accepts an attestation with a zero expiry forever and never reads the issue time, where the protocol's reference consumer rejects both. Only a trusted attester can produce such a signature, so no bypass.

Coverage. All 113 listed entry points have a row, plus six invariant rows. The 31 entry points of this launch's nine contracts, the lock hub and the splitter are marked holds or finding with a one-line reason. The remaining 82 rows for the core desks, the vault, the vesting contracts and the launch 4 modules are honestly marked unreached, as they are outside this launch's math area and the budget.

Housekeeping. The scratch test under test/scratch was removed, no file under src, script or test changed, and git status --porcelain is empty. The existing ADAPTATION.md notes were not duplicated.

I wrote .imd-findings.json with 8 findings and coverage rows for all 113 entry points. Only 9 of those rows come from my own tracing; the other 104 are marked unreached. No tracked files changed, and the scratch test folder is deleted.

The blocking finding (high). The launch cannot pass the admission check as the brief specifies it. Two specialists reported this (the economics area as high, the flow area as medium) and I merged them. That check (Token.protected.t.sol) deploys the token, then buys and sells back the whole amount bought, all at one block time:

• Before openAt: the buy reverts with TradingNotOpen.
• After openAt, or at forge's default time of 1: the constructor (src/token/YoloToken.sol:74) reverts with BadOpenAt, so setup fails.
• Exactly at openAt: the buy goes through, but selling it all back reverts. The 30% sell tax comes on top of the amount sold, out of a wallet that holds only the amount bought.

I ran the specialist's attached proof and it fails for exactly that reason: ERC20InsufficientBalance(trader, 571428571428571428572, 1e21). Every behaviour involved is fixed by the brief, so this is a clash between the brief and the admission check, not a coding error. The owner or whoever runs the check has to decide, for example by moving the clock forward between deploying and trading. Also, ADAPTATION.md says the check passes at a time at least openAt + 3600; that time can't be reached.

Other merged findings:

• Medium – deadline. Mined after openAt (1792584000), the launch reverts as a whole. That leaves about 14.5 hours from the review's chain time, or about 3 more if openAt is moved to the 1792594800 limit. The NftGate also has to be sealed before openAt, and it was still unsealed when checked. Otherwise minutes 0–30 stay closed to everyone.
• Low – starting price. DevPrices starts YOLO at $0.001, about 12 times the pool's opening price of $0.0000825. A doer therefore gets the full 4% stake bonus with a twelfth of the YOLO the reward is worth. The owner can correct it with two price calls.
• Low – allowance. In the first hour, a transferFrom into the PoolManager takes the allowance plus the sell tax from the owner's wallet.
• Low – signer proposals. Opposite proposals for the same signer can both be pending, and whoever executes them chooses the order, and so the result.
• Info:
  • The project wallet's own trades are effectively untaxed.
  • AttestationChecker treats expiresAt == 0 as never expiring.
  • The tax view functions round down by up to 1 basis point.

Dropped:

• The point that setBuybackWallet accepts a wallet that can't receive ETH: only the owner can cause it, and nothing is lost.
• The note that proposeParams replaces a pending proposal silently: owner-only, no funds at stake.
• The whitelistActive() view: it changes no funds.
• The test isolation note: it's about the test setup, not a defect in the contracts.

Coverage: I traced and marked as working correctly the YOLO approve, three BuybackBurner functions and DevPrices.setYoloPriceUsd. Four entry points are tied to findings: token transfer and transferFrom, and the two signer-proposal functions. The CaseDesk, DisputeDesk, TaskVault and vesting entry points weren't checked by me.

I added three edge-case tests and one invariant test, all to test/LaunchSupportAudit.t.sol, the only file changed. The full suite passes with the verifier's fuzz seed: 718 passed, 0 failed, 3 skipped. The three skipped are the fork tests, which need a mainnet RPC; I had none, so the fork rehearsal is still to be run against live state.

Why the last attempt failed: a build here from scratch takes about 10 minutes (182 files, via_ir is on). That is where the rejected attempt was killed. To avoid adding to it, I put everything in the existing test file rather than a new one; after that, rebuilding and running the file took about 12 seconds. I didn't touch any configuration.

What the new tests cover:

• Seal timing: a gate sealed exactly at openAt keeps minutes 0–30 shut (SnapshotNotSealed). A gate sealed one second before opens them, and that wallet's 500,000 YOLO allowance is then fully used.
• Transfers that skip the gate: the PoolManager moving YOLO to itself, and a zero-value buy by a wallet not in the snapshot, touch neither the gate nor the tax.
• Gate write rules: only the writer may record or seal, and after the seal nothing can be recorded or sealed again (AlreadySealed). The stored block, wallet and NFT counts, allowance and snapshot hash are as written.
• Invariant over random calls in minutes 0–30:
  • Inputs: buys of random size by snapshot wallets holding 1, 2 and 3 NFTs and by one outsider, plus direct calls to consume from a contract other than the token.
  • Checks after every call:
    • The gate books exactly what each wallet bought, and never more than 500,000 YOLO per NFT.
    • The outsider holds nothing.
    • Buys in this window pay no tax, so the project wallet holds 0.
    • Every YOLO that leaves the pool is accounted for, and the supply stays at 1,000,000,000.
  • Refused buys: each one must revert with the exact error, NotWhitelisted or NftAllowanceExceeded with the remaining and requested amounts.

I found no new defect, so I wrote no .imd-findings.json. The earlier tests in the file, including the burner and supply invariants, are unchanged and still pass.

forge build never finished: the run was terminated (exit 143) before compilation completed. Neither forge build nor forge test has a result on this machine. The rules treat a build this machine kills for time as no reason to stop, because the verifier builds with more time.

The submission is unchanged. launch.json is the accepted manifest, I checked it by reading it against the brief, and no other file was touched.

The review is written to .imd-findings.json and the tree is clean. Nothing else is needed.

Outcome: the two blocking findings from the last round are still open, and the six advisory ones are settled as notes. No new defect was found in the revision.

Settled findings

• High, still open. The admission floor's buy-then-sell-all round trip passes at no block timestamp. The constructor needs the clock at or before openAt, a buy needs it at or after, and at openAt itself the 30% on-top sell tax makes a whole-balance sell revert. I re-ran my proof under test/scratch on this tree and it still fails with ERC20InsufficientBalance. The author agrees with the fact and correctly says no change the brief permits can fix it. Since src is unchanged, the floor as pinned cannot admit this token, so the finding stays. The resolution belongs to the owner or the floor operator.
• Medium, still open, operational. The launch reverts BadOpenAt if mined at or after openAt. The manifest now pins openAt in launch.json, which is where the brief's fallback to 1792594800 would be applied. Roughly 10.5 hours remain. The gate must also be sealed strictly before openAt.
• Six advisory notes (DevPrices start price, transferFrom plus tax, contradictory attester proposals, project wallet self-tax, AttestationChecker zero expiry, bps view rounding) all reproduced again, are recorded in ADAPTATION.md, and need no change.

Checked this round

• The new launch.json: schema keys, lowercase addresses, nine unique names, constructor argument counts and order against every constructor, economics copied verbatim, notes length, totalSupply. All correct.
• src and script are byte-identical to the previous round.
• The token, launch-support, buyback and YOLO test files pass (95 tests). The full suite did not finish within my time budget in two attempts, so I could not confirm the 686-test count myself. The author reports 686 passing and no source changed.

Coverage: 115 rows. 42 hold, 1 finding, 72 unreached. The unreached rows are the core and modules contracts that this manifest does not deploy.

The responses file sits in the repository root as the harness expects (its own exclude rule hides it from git, as with the scratch directory), and the only tracked change is ADAPTATION.md. The work is complete.

Outcome: no code changed. Every finding was reproduced on this tree and answered in .imd-responses.json, and ADAPTATION.md records the second round.

The high finding (floor round trip) reproduces exactly as the reviewer said. The proof copied under test/scratch fails with ERC20InsufficientBalance on the trader, 571.43 YOLO left against a 1,000 YOLO settle, because the 30% on-top sell tax moves 428.57 YOLO to the project wallet first. I answered it "disputed" again, because the proof asserts behaviour the brief forbids: a whole-balance sell succeeding in minutes 0-30. No permitted change makes it pass, since src/ and script/ are fixed and openAt may only move later. ADAPTATION.md now also states the wider point: the pinned floor fails at every timestamp before openAt on the buy and at every timestamp after it on the constructor, so even a zero minute-0 sell tax would not rescue it. The resolution stays with the owner or the floor operator, which the reviewer's own second-round text agrees with.

The six advisory findings and the ten imported audit findings reproduce, are by design or outside what the brief lets me change, and are each answered with a pointer to their existing ADAPTATION.md note.

Verification on this machine:

One thing to note for whoever reads the next check: the previous attempt was stopped during this same cold build, and nothing in the sources changed between the two attempts, so the build time on the check machine is the only risk left. The fork rehearsal was not rerun this round since no source changed since it last passed.

The last attempt was rejected because it ran out of time, not because a test failed. A full forge build on this repo takes about 10 minutes here (via_ir, 182 files), and repeated rebuilds used up the time. So this revision is deliberately small: one change, in one file, test/LaunchSupportAudit.t.sol.

What I added: an invariant test for YoloSplitter, the address that receives the launch's leftover YOLO. It holds 75% of the supply until someone calls split, and no test had driven it with random call sequences. A handler makes random deposits from 0 to 800M on two tokens and calls split. When less than the fixed 527,777,777 has arrived, it checks the call reverts with NotArrived(balance). After every sequence the test checks that:

• what the splitter holds plus what its five recipients hold equals everything deposited, and supply never changes;
• done flips once per token, never reopens, and nothing is paid out before it flips;
• after a split, the incentives, dev, team and stabilizer addresses each hold exactly their fixed share;
• the treasury vesting holds everything else that left the splitter, including anything that arrives after the split.

Results with the verifier's seed:

• Full suite: 719 passed, 0 failed, 3 skipped (722 in total; the brief's figure of 686 was a lower count).
• The 3 skips are the fork tests, which need a mainnet RPC. None is available here, so the mainnet rehearsal through the live factory and Universal Router is still owed.
• New invariant: 64 runs × 40 calls, 0 reverts.
• Build cost of the change: recompiling only this file took about 14 seconds.

Not changed: nothing in src/, script/ or any configuration. I found no new defect, so there is no .imd-findings.json. The audit findings from earlier rounds are already recorded as notes in ADAPTATION.md, which this task can't edit.

The full build and non-fork test run completed with exit code 0 after all. That closes the one item I had reported as unverified.

Result of the full run

The scratch reproduction of the finding is among the passing suites. Fork tests were excluded because they need a mainnet RPC and are not part of the verifier's offline run.

State of the deliverable, unchanged from my last message

• launch.json is the only modified file. openAt moved from 1792584000 to the brief's maximum 1792594800, with the notes recording the original value, the exception applied, and the chain and gate state at the time.
• .imd-responses.json answers the finding as fixed, with the reproduction and the reasoning for applying the exception.
• No .imd-blocked.json was written. Nothing in src, script, test or any configuration file changed.

What remains outside my control

• The project wallet still has to write and seal the NftGate snapshot before 15:00 UTC on 21 Oct 2026, or minutes 0-30 after opening refuse every buy.
• If the launch is not mined by 15:00 UTC the token cannot deploy at all, and the brief says the job then fails.

Review complete. The findings file is written at .imd-findings.json with 8 findings and a 115-row coverage record (113 entry points plus two invariants, 104 answered holds or finding, 11 unreached).

Settlement of my earlier findings

• Finding 1, high, still open. The pinned floor's buy-then-sell-all round trip still passes at no block timestamp. No line of src/ or script/ changed, so all three attached proofs still fail on this tree with the same ERC20InsufficientBalance revert. I also re-ran the proof shifted to the manifest's new openAt of 1792594800 and it fails identically. The author's dispute is correct on the facts but changes nothing: every step is the brief's fixed behaviour, and the only exit is the owner's or the floor operator's (warp between deployment and the trades, or a design decision). It stays blocking so the launch is not admitted on a claim the floor cannot confirm.
• Finding 2, fixed as far as the brief allows. launch.json now sets openAt to the brief's maximum, 1792594800 (15:00 UTC today). I confirmed the constructor deploys at the current chain time and at 15:00 UTC exactly, and reverts one second later. The manifest is schema-clean with notes at 3,993 characters. Residual deadlines are the brief's own rule, not defects: the launch must be mined before 15:00 UTC, and the gate must be sealed strictly before it. ADAPTATION.md line 157 still quotes the old 12:00 seal deadline, which is stale but not wrong. Downgraded to low.
• Findings 3 to 8. All reproduce unchanged and the author agrees; recorded as settled notes with no change needed.

Verification on this tree

Nothing new reported. I re-read the token, burner, prices, registry, adapter, gate, splitter, vestings and the core desks and vault for guards and state flow and found no new reproducible defect. Entry points marked unreached are the settlement arithmetic paths in CaseDesk.step, DisputeDesk.settle, vote, callSwarm and the HiddenList vote counter, which I traced only to their guards within the time budget. Scratch tests were removed; the working tree holds only the findings file as new.