Settlement (settlePrice) was hardened against a single-block price, but the baseline it is compared with was not. MarginaliaHook._postNote stores n.postPrice = MarginaliaPricer.postPrice(...), which is _spotInQuote (slot0 of a v4 pool, slot0 of a v3 pool, or the v2 reserves ratio) times the hub spot, all read in the posting block.

The author controls that block: a contract (class Agent is still accepted) sells X on the venue, posts the note through MarginaliaRouter.note, and buys X back, atomically. The recorded post price is the depressed one; targetBps is applied to it; the honest TWAP / adverse-extreme settlement price of an unchanged market then clears the target.

The deposit comes back, records[author].right and weekScore grow by difficulty(), and the author draws on the week's leaderboard pool (50% of every accrual, up to 10% per wallet, so ten wallets drain it). On a venue the author created (any hookless v4 pool, any v3/v2 factory pair) or on a thin pool the round trip costs only fees; on a deep pool a flash loan does the same. The mirror image for SELL calls is pump, post, unwind.

The balance-hold rule does not help: postBalance is read in the same block and a BUY call with postBalance 0 is always held.

The fix belongs to the same contract as the settlement rule: a post price that is not a single-block spot (the venue accumulator's TWAP over a trailing window for v3/v2; for v4 and the hub leg, for example, a post-time observation series or the adverse extreme of the posting block's price and a prior reading), or refusing the post when the spot moved in the same block.

onOracleResult accepts any signed, in-quorum bytes32[] and sets judgedSet[day] = true before the ranking is filtered. The filter runs later in judgedOf, which drops ids that are not this week's theses with a child. If nothing survives, payJudged reverts BadAnswer on every call, requestJudging reverts AlreadyRequested (judgedSet is true), and weekClosed returns false at line 149 for the same reason, so MarginaliaHook.sweep(2, week) reverts NotOpen forever.

The IMD left in thesisPool[week] (the pool minus the 0.5 IMD price already drawn) is unreachable by anyone, and the hook has no other path out of thesisPool. The same lock follows from the panel ranking only theses whose author posted no child, ids from another week, or short-form call ids.

A judged week with an empty top should be payable as 'no winner' (roll the pool forward, as payJudged already does for unranked slots) or weekClosed should treat it as closed so it can be swept.

The repository ships a launch.json for the MarginaliaHook launch: kind univ4_hook, a hook entry with $poolManager/$token/$factory, a token block and a pool block. This launch is evm_contracts with four contracts (MarginaliaRouter, MarginaliaJudge, MarginaliaTreasury, MarginaliaPricer), each with an empty constructorArgs list and no token or pool.

A launch.json present in the tree is checked as this launch's manifest, so the current file rejects the adapted work: wrong kind, unknown keys (hook, token, pool) and no contracts array. The adapter must replace it with {kind: 'evm_contracts', contracts: [four entries with constructorArgs: []], notes} or remove it so the manifest step writes it.

Note also that notes in the current file describe the previous version ('median of at least three on-chain price observations', 'one IdentityMD oracle ranking per day'), which no longer matches the code (adverse-extreme / TWAP settlement, weekly judging).

Trust gap (access x economics). validateVenue accepts any hookless Uniswap v4 pool (or any factory-canonical v3 pool at any fee tier, or a v2 pair) that contains X and is quoted in IMD/WETH/ETH, with the only depth requirement being getLiquidity != 0. Pool creation on the PoolManager is permissionless, so the author can be the sole liquidity provider of the venue the note is priced on.

The TWAP / adverse-extreme settlement in MarginaliaPricer and the permissionless observe() only defend against pumps that other traders would arbitrage; in a pool nobody else trades, every honest observation reads the author's price. The author therefore sets the window baseline (checkpointVenue + 1h), posts a BUY call with any targetBps, moves the dust pool with a few wei of IMD after the horizon, observes three times over an hour, and settles RIGHT.

The difficulty score uses postPrice * totalSupply() of the author's own token, so the mcap tier is 3. The positive score becomes a claim on the week's leaderboard pool (50% of every stamp, fee, forfeit and treasury drip), capped at 10% per wallet, which Sybil wallets lift. The same works for real tokens: a fresh v4 pool for USDC/WETH at an unused fee/tickSpacing, or a fresh v3 pool at an unused fee tier, is canonical and author-owned.

Cost: the 0.1 IMD stamp and gas; the 0.5 IMD deposit comes back.

Victims: honest writers whose leaderboard share is diluted, and the treasury's drips which are paid out to the attacker.

sellPotMarg (MarginaliaHook.sol:673-682) is judge-only and MarginaliaJudge.convertForfeits (MarginaliaJudge.sol:84-88, imdOut = hook.sellPotMarg(marg); with marg = the entire potMarg) is the only caller, so the pot can only ever be sold all at once. The slippage floor is 97% of router.postPrice(venue, true), which for a v4 venue is the MAXIMUM of the window's readings and the current spot (MarginaliaPricer.postPrice: _adverse(w.xMax, x, false)).

The exact-input sale pays the 1.25% LP fee (LP_FEE = 12_500), so its own price impact may not exceed about 1.8% of the pool's virtual MARG reserve (L / sqrtP for a concentrated position). Seam boundary x invariant: the floor is a fixed band against a pre-trade maximum, the quantity is forced to the full pot, and potMarg is monotone (every Wrong/VoidSold/retract/thesis forfeit adds to it, MarginaliaHook.sol:609).

Once potMarg > ~1.8% of virtual reserve, unlockCallback's if (imdOut < extra) revert InvalidUnlock(); (MarginaliaHook.sol:842) fires on every call, with an honest fresh window as much as with a manipulated one, and nothing can ever shrink the pot.

Forfeits never reach thesisPool / leaderboardPool / refundPool again (the _accrue(imdOut) at line 680 is never reached): the project's prize funding from forfeits is permanently broken, and the MARG sits as ERC-6909 claims in the hook forever.

Aggravating: because the floor is the window MAXIMUM, any genuine fall of more than ~1.75% in MARG within the 6-hour window also blocks conversion until the window expires, and anyone can pin the maximum high for 6 hours with a brief pump followed by checkpointVenue. Half the pot would clear the same floor (shown in the reproduction), so the all-or-nothing rule, not the band, is what fails.

Fix preserving the design: let the judge (or anyone) convert a caller-chosen slice bounded by the pot (e.g. convertForfeits(uint256 amount) forwarding to sellPotMarg(amount)), or have sellPotMarg cap the slice so the quoted impact stays inside the band, and base the floor on the window's spot/TWAP rather than its maximum.

fromSqrt truncates sqrtP^2 / 2^192 x 1e18 to an integer and, when X is token0, returns it even when it is 0 (line 288); when X is token1 it returns FullMath.mulDiv(1e18, 1e18, p) which is also 0 whenever p > 1e36 (line 290, no check on the result). The zero flows through _spotInQuote -> observe -> checkpoint/postPrice unchanged (FullMath.mulDiv(0, q, 1e18) = 0), and _postNote stores n.postPrice = 0 with no check (MarginaliaHook.sol:447).

At settlement (MarginaliaHook.sol:525) settlePrice * 10_000 >= n.postPrice * n.targetBps is 0 >= 0 for a BUY call and settlePrice * 10_000 <= 0 holds for a SELL call too, so the call is RIGHT whatever the market does, the deposit is returned, and _difficulty is computed with mcap = 0 (tier 1) giving a positive score that counts toward the week's leaderboard pool.

Seam boundary x precision x invariant: the invariant 'a call is falsifiable against its baseline' is only enforced when the baseline is non-zero, and the price math produces exactly 0 at a reachable edge.

The edge is reachable through the router's canonical-venue check: validateVenue accepts any hookless v4 pool with non-zero liquidity whose other asset is IMD/WETH/native, and the PoolManager lets anyone initialise such a pool at any tick in [MIN_TICK, MAX_TICK]; a price below 1e-18 quote per 1e18 X is reached just past tick -414,500 (X token0; fromSqrt(getSqrtPriceAtTick(-420000), true) == 0, while -414,486 still yields 1) or past +414,500 (X token1; fromSqrt(getSqrtPriceAtTick(414500), false) == 0), both legal ticks far inside [MIN_TICK, MAX_TICK].

Fix: revert EmptyPool() (or a dedicated error) when the computed price is 0 on either branch, and have _postNote reject postPrice == 0.

For v4 venues and the ETH->IMD hub leg, settlePrice is the extreme over the observation series that is least favourable to the call (minimum for BUY, maximum for SELL; lines 181-194). The brief states that 'any honest observation pins the price' and 'a two-block pump-observe-unwind moves neither rule'. That holds only in the direction that favours the author.

In the adverse direction a single observation taken in the same transaction as a swap is enough: observe (MarginaliaHook.sol:485-500) has no caller restriction and reads the pool's spot at that instant (line 496), so a contract can swap, call observe, and swap back atomically.

A competitor for the week's pro-rata leaderboard pool (or anyone who wants a deposit forfeited to the pot) can therefore turn every BUY call Wrong by one dump of X (or of ETH in the hub pool for WETH/native-quoted venues) and every SELL call Wrong by one pump.

The author then forfeits the whole deposit (0.5 IMD-equivalent) to the pot and loses difficulty score; the attacker's cost is the round-trip fees on the venue (LP fee twice, plus the hook's 3% quiet sell fee when the venue is the MARG pool itself) scaled by the size needed to cross the target, with no holding period and no exposure to arbitrage.

Seam boundary x invariant: the extreme operator makes the settlement a function of the single worst observation, so the one-hour span requirement constrains only the honest side. The 1-hour span and 20-block gap do not help because the manipulated observation can be any one of the series.

Fix preserving the design: settle v4 and hub legs on a time-weighted or median value of the series (e.g. the median of observations, or the hook accumulating its own tick cumulative in afterSwap and using a TWAP as for v3/v2), or require an extreme to be confirmed by a second observation at least OBS_GAP_BLOCKS later before it can set the price.

validateVenue accepts any hookless v4 pool whose key recomputes the id and that has non-zero liquidity (and any factory-created v3 pool / v2 pair). Anyone can create such a pool for a token they minted, be its only liquidity provider, and move its price for free: the IMD swapped in lands in their own position.

The settlement rule (adverse extreme over observations spanning an hour, MarginaliaPricer.settlePrice) assumes holding a pumped price for an hour costs something; on a venue with no other market there is no arbitrage, so holding costs nothing.

MarginaliaHook._difficulty then prices the win with mcap = postPrice * IERC20(n.x).totalSupply(), both attacker-chosen, so the call lands in tier 3 with a 100x target: log2(100)*sqrt(30)*3 ~ 1.09M score points against ~20k for an honest, correct +10% call on the launch pool. weekScore and weekTotal are dominated by the attacker, every honest leaderboardShare collapses, and with ten wallets (LEADERBOARD_CAP_BPS = 10% per wallet) the entire week's leaderboardPool (50% of every stamp, fee, forfeit and treasury drip) is paid to the attacker.

Cost per wallet: one stamp (0.1 IMD), the 1.25% LP fee on a ~1 IMD buy, gas; the deposit comes back because the call is RIGHT. The same self-controlled token also lets the author fake Traded class and position checks, since postBalance and the held test read that token.

The brief's guarantee for v4 venues and the hub leg is that a pump 'must be held for the whole span and any honest observation pins the price'. The series is capped at 16 observations and each new one is refused for 20 blocks after the last, so a sequence of 16 observations at the earliest allowed block fills the series in exactly 15 x 20 x 12 s = 3600 s, which satisfies OBS_MIN_SPAN.

An author who is first in each of those 16 blocks (a builder bundle, or simply front-running a public observe) does pump -> observe -> unwind inside one block each time; between blocks the price is honest, yet every honest observe reverts ObservationTooSoon, and after the sixteenth the window is closed with TooLate. settlePrice then sees only pumped readings.

On the launch pool the sandwiches are expensive (1.25% + 1.25% + 3% of the pump each), on any thin or self-owned v4 venue they are not; either way the pinning property the design relies on does not exist. For adverse-extreme venues extra observations can only hurt the author, so capping their count and spacing them per-note (instead of per-block or per-observer) only serves the squatter.

The canonical-venue check accepts any hookless v4 pool (or any factory v3 pool / v2 pair) with non-zero liquidity that contains X and is quoted in IMD, WETH or ETH. Creating such a pool is permissionless, so an attacker deploys a token X it alone holds, opens X/IMD with dust liquidity (L = 1e18, under one IMD of depth) and is the only LP and the only trader.

Every manipulation-resistance rule in MarginaliaPricer (TWAP span, adverse extreme, honest observers, 'a pump must be held for the whole span against every arbitrageur') assumes someone else has an incentive to trade the pool back; on a self-provisioned venue nobody does, so holding the pumped price for the whole settlement span costs nothing: the IMD the pump spends lands in the attacker's own position and comes back when it removes liquidity.

The attacker self-observes three times, settles RIGHT, gets its 0.5 IMD deposit back and books a score of log2(target) x sqrt(30/horizon) x tier, where it also controls the mcap tier (postPrice x totalSupply of its own token) and the target (any uint32 >= 11000: 100x in 1 day scores 1,088,592 against 10,000 for an honest 2x-in-30-days tier-1 call).

The leaderboard pool is 50% of every IMD accrual (quiet-sell fees, stamps, forfeits, treasury drips) and pays pro-rata by score with a 10% per-wallet cap, so one such note per wallet across ten wallets takes the entire weekly pool for ten stamps (1 IMD) and gas, every week.

SPEC section 10 still claims 'price resolution only returns or forfeits your own bond' and 'capped bond makes manipulation unprofitable'; since v0.4 the leaderboard pays IMD for score, and the previous round's 'self-priced venue' fix (canonical factories) does not close this because canonical pools of worthless tokens are free to create.

The same holds for a v3 pool or v2 pair the attacker creates through the canonical factory: the accumulator TWAP of a pool only it trades is whatever it sets.

The hold rule for a SELL call treats any observation where the author's X balance is above its post-trade balance as 'the author bought X', and settles VoidSold: the deposit is forfeited (2% to the keeper, 98% to potMarg), the author's record gets broken += 1 and score -= difficulty, and the week score drops. An ERC-20 balance can be raised by anyone with a plain transfer, so a third party voids any SELL call for one wei of X plus gas.

Who profits: the settling keeper (2% of the deposit, paid in MARG), every competitor for that week's leaderboard pool (the victim's positive score is reduced or erased, so their pro-rata share grows), and anyone wanting to damage a wallet's public record. The victim cannot defend: it cannot refuse an incoming transfer and cannot burn the dust without changing its balance again before the next observation.

BUY calls are not exposed the same way (a balance cannot be lowered by a third party), so SELL calls are strictly worse to post, which also biases the whole ledger. The SPEC's hold-rule intent ('selling on any venue breaks it') is not what the code checks: it checks for any increase.

Forfeited deposits accumulate in potMarg (retract, Wrong, VoidSold, settleThesis). The only path that spends potMarg is MarginaliaHook.sellPotMarg, which only the judge may call, and the judge's convertForfeits always passes the entire pot. sellPotMarg swaps that amount in one full-fill swap and requires imdOut >= 97% of the window-maximum price x amount (MarginaliaHook.sol:678-679, unlockCallback ACT_SELL at 839-842).

The sale itself pays the 1.25% LP fee and moves the price, so once the pot is larger than roughly 1.7% of average price impact on the launch pool, the floor fails for the whole pot even though a fraction would sell. Nothing reduces potMarg other than a successful full sale, and forfeits keep arriving, so the condition is absorbing: from that point the pot's forfeited MARG (the part of the pot that funds the leaderboard, thesis prize and refunds) can never be converted.

Nobody is paid to call convertForfeits, so the pot naturally grows between calls; a pool that thins out (LPs leave) or a quiet month is enough to cross the threshold. The hook's sellPotMarg accepts any amount <= potMarg, so the capability exists but is unreachable: the judge never asks for less.

A call needs three observations spanning an hour inside a six-hour window or it resolves VoidNoData, which returns the deposit and books no score. observe() pays nothing; the only keeper reward is 2% of a forfeited deposit (0.01 IMD, about one cent at IMD ~ 9 USD) paid on settle, and only for Wrong / VoidSold outcomes, which is far below the gas of three observations and a settlement on Ethereum mainnet.

So in practice the only party with an incentive to observe a call is its author, who observes only the calls that turned out right. The downside of a call (forfeit, negative score) is therefore optional while the upside (positive score, leaderboard share) is kept: post a BUY and a SELL call on the same token every day and observe whichever one the market confirmed.

Score is pro-rata money from the week's leaderboard pool (50% of all accruals), so this is a guaranteed positive expected value for the price of two stamps, regardless of any skill, and the public record never shows a wrong call. settle() has no deadline either, so the author also chooses the week its positive score is booked into (weekScore uses the week of settlement), while nobody has a reason to settle its wrong calls at all.

The design's mitigation ('anyone may observe') has no economic actor behind it.

Severity medium: no direct theft, but the leaderboard pool pays for coin flips and the published records are unfalsifiable.

A thesis is only judged if it is in weekTheses[week], and that array silently stops growing at MAX_DAY_NOTES = 256: a later thesis is still posted (stamp taken, 0.5 IMD deposit locked, status ThesisOpen, children allowed) but thesesOfWeek never returns it, so MarginaliaJudge.eligibleTheses, questionBody and judgedOf can never include it. The judge additionally truncates eligible theses to the first MAX_JUDGED = 120 by posting order (MarginaliaJudge.sol:96).

Neither limit is checked at posting, so an honest author pays for an entry that cannot win, and there is no event or revert telling it so.

Because a thesis's deposit is released by any child resolution (including VoidNoData with no observations, see finding 4), filling the judged set costs only stamps: 120 theses plus one child call each = 240 stamps = 24 IMD, after which every honest thesis that week is outside the 120 the panel sees, and the 30% thesis prize (plus rolled-forward leftovers) is ranked among the attacker's entries only.

The sweep path cannot recover the pool for honest writers either: thesisPool[w] is paid to whichever of the attacker's ids the panel ranks.

Merged from audit_flow, audit_permissions and audit_economics (same root cause). validateVenue accepts any hookless v4 pool whose key recomputes the id and whose liquidity is non-zero (and any factory v3 pool or v2 pair), with no depth, age or counterparty requirement. Pool creation on the PoolManager is permissionless, so an author can be the only LP and the only trader of the venue its note is priced on.

Every manipulation defence in MarginaliaPricer (adverse extreme over an hour of observations, 'any honest observation pins the price') assumes someone else has an incentive to trade the pump back; on a venue nobody else holds the token of, holding the pump costs nothing: the IMD spent on the pump lands in the attacker's own position.

MarginaliaHook._difficulty (line 626) then prices the win with mcap = postPrice x IERC20(n.x).totalSupply(), both attacker-chosen, so the call lands in tier 3 with any target: log2(100) x sqrt(30) x 3 = 1,088,592 score points against ~20,538 for an honest RIGHT +10% call on the launch pool. weekTotal is dominated by the attacker, every honest leaderboardShare collapses, and with ten wallets (LEADERBOARD_CAP_BPS = 10% each) the entire week's leaderboardPool (50% of every stamp, fee, forfeit and treasury drip) is paid out through claimLeaderboard for ten 0.1 IMD stamps; the deposits come back because the calls are RIGHT.

The same self-controlled token also makes the Traded class and the hold check meaningless. SPEC.md section 10 still claims 'price resolution only returns or forfeits your own bond', which stopped being true when the leaderboard started paying IMD for score.

Merged from audit_flow, audit_permissions, audit_math and audit_economics (same root cause). MarginaliaHook.sellPotMarg accepts any amount up to potMarg but only the judge may call it (line 674), and the judge's only path passes hook.potMarg() in full (lines 85-87).

The sale is one exact-input full-fill swap (unlockCallback ACT_SELL, line 839) that must return at least 97% of the router window's MAXIMUM MARG price for the whole amount (line 678: router.postPrice(venue, true) is the window max including the current spot) after the pool's 1.25% LP fee (line 842: if (imdOut < extra) revert InvalidUnlock()).

At infinitesimal size the output is 98.75% of spot, so 1.75% is left for price impact: for a concentrated position of liquidity L the full fill drops under the floor once the pot exceeds about 1.8% of L/sqrtP. potMarg is monotone: every Wrong, VoidSold, retract and thesis forfeit adds to it (line 609) and only a successful full sale subtracts, nobody is paid to call convertForfeits promptly, and LPs can leave.

So the condition is absorbing: from the moment it holds, no forfeited MARG ever reaches leaderboardPool, thesisPool or refundPool again; the project's prize funding from forfeits is permanently broken and the MARG sits as ERC-6909 claims in the hook. A tranche of a tenth of the pot clears the same floor, so the all-or-nothing rule, not the band, is what fails.

Merged from audit_permissions and audit_economics (same root cause). The hold rule reads IERC20(n.x).balanceOf(n.author) at every observation (line 497) and, for a SELL call, treats any observation whose balance is above postBalance as 'the author bought X back' and resolves VoidSold (line 523): _forfeit sends 2% of the deposit to the settling keeper and the rest to potMarg, records[author].broken += 1 and score -= difficulty.

A BUY call's rule (balance < postBalance) can only be broken by the author, but an ERC-20 balance can be raised by anyone with a plain transfer, so a third party voids any SELL call in the system for one wei of X plus gas. The victim cannot defend: it cannot refuse an inbound transfer and cannot burn the dust without changing its balance again before the next observation.

Who profits: the settling keeper (2% of the deposit), every competitor for the week's leaderboard pool (the victim's positive score is replaced by a negative one), anyone wanting to damage a wallet's public record. The SPEC's intent ('selling on any venue breaks it') is not what the code checks.

Merged from write_foundry_tests and audit_math (same root cause). fromSqrt truncates sqrtP^2 / 2^192 x 1e18 to an integer and, when X is token0, returns it even when it is 0 (line 288); when X is token1 it returns FullMath.mulDiv(1e18, 1e18, p) (line 290) which is 0 whenever p > 1e36, with no check on the result either. The v2 branch of _spotInQuote (line 240) has the same gap.

The zero flows through observe -> checkpoint -> postPrice unchanged (mulDiv(0, q, 1e18) = 0), MarginaliaHook._postNote stores n.postPrice = 0 with no check (line 447), and settle (line 525) resolves a BUY call with settlePrice * 10_000 >= 0 * targetBps, which is always true (a SELL call with settlePrice * 10_000 <= 0 is also RIGHT because the settlement reads 0 too). _difficulty computes mcap = 0 (tier 1) and still returns a positive score (log2(target) x sqrt(30/h)), so the call books leaderboard score and gets its deposit back whatever the market does.

The edge is reachable through the router's canonical-venue check: any hookless v4 pool with non-zero liquidity can be initialised by anyone at any tick in [MIN_TICK, MAX_TICK]; the price rounds to zero past tick -414,500 (X token0) or +414,500 (X token1), far inside the legal range. This is distinct from the self-venue finding: it is an arithmetic defect that survives any depth rule, since a genuinely priced pool for a token with a huge supply reads the same zero.

From audit_flow. The settlement guarantee for v4 venues and the hub leg is that 'any honest observation pins the price'. The series is capped at 16 observations and each new one is refused for 20 blocks after the last (lines 492-495), so 16 observations taken at the earliest allowed block fill the series in exactly 15 x 20 x 12 s = 3600 s, which is not < OBS_MIN_SPAN (line 512) and so settles.

An author who is first in each of those 16 blocks (a builder bundle, or front-running the public observe at the known block last+20) does pump -> observe -> unwind inside one block each time; between those blocks the price is honest, yet every honest observe reverts ObservationTooSoon, and after the sixteenth the window is closed with TooLate. settlePrice then sees only pumped readings.

On the launch pool each sandwich costs the 3% quiet sell fee plus two 1.25% LP fees on the pump size; on any thin or self-owned v4 venue it costs nothing. For adverse-extreme venues extra observations can only hurt the author, so capping their count and spacing them per note (not per observer) only serves the squatter.

From audit_math. For v4 venues and the hub leg settlePrice is the extreme over the observation series least favourable to the call (lines 181-194). The brief's 'a two-block pump-observe-unwind moves neither rule' holds only in the direction that favours the author.

In the adverse direction one observation taken in the same transaction as a swap is enough: observe (hook lines 485-500) has no caller restriction and reads the venue's spot at that instant, so a contract can swap, call observe and swap back atomically.

A competitor for the week's pro-rata leaderboard pool, or anyone who wants a deposit forfeited to the pot (and the 2% keeper reward), turns a BUY call Wrong with one dump of X (or of ETH in the hub pool for WETH/native-quoted venues) and a SELL call Wrong with one pump; the author forfeits the whole deposit and the difficulty score, the attacker pays only the round-trip fees scaled by the size needed to cross the target, with no holding period and no exposure to arbitrage.

The 1-hour span and 20-block gap do not help because the manipulated observation can be any one of the series. Severity medium rather than high because on the launch pool the round trip is expensive relative to the 0.5 IMD deposit (below), though on thin venues it is not.

From audit_flow, extended. Every observation reads IERC20(n.x).balanceOf(n.author) with a plain external call to a token the author chose. If the read reverts during the settlement window nobody can observe, settle() finds fewer than OBS_MIN observations and resolves VoidNoData (line 513), which books no score and leaves the deposit claimable (claimDeposit accepts VoidNoData, line 585).

A reentrant balanceOf does the same without reverting: the call happens before obs.push (line 498), so a balanceOf that calls observe(id) again sees obs.length still 0, passes the gap and cap checks, and sixteen nested calls fill the whole series in one block with one timestamp; honest observers then get TooLate and the span check (line 512) voids the call.

The author of a call on a token it controls (or any token whose owner can gate balanceOf) watches the outcome at the horizon: if RIGHT it lets observers in and banks the score; if WRONG it switches the read off for six hours and gets the deposit back with no penalty. The forfeit, the keeper reward and the negative score all disappear; the asymmetric payoff makes posting such calls strictly profitable in score.

From audit_economics. A call needs three observations spanning an hour inside a six-hour window or it resolves VoidNoData (lines 512-513), which books no score and returns the deposit. observe() pays nothing; the only keeper reward is 2% of a forfeited deposit (0.01 IMD) paid on settle and only for Wrong / VoidSold outcomes, below the gas of three observations and a settlement on mainnet.

So in practice the party with an incentive to observe a call is its author, who observes only the calls the market confirmed. The downside of a call (forfeit, negative score) is optional while the upside (positive score, leaderboard share) is kept: post a BUY and a SELL call on the same token every day and observe whichever one came true.

The leaderboard pool pays IMD pro-rata by score, so this has positive expected value for two stamps regardless of skill, and the public record never shows a wrong call. settle() has no deadline either, so the author also chooses the week its positive score is booked into (_bookWeekScore uses the week of settlement, line 654).

Leaderboard competitors do have a diffuse incentive to observe rivals' wrong calls, which bounds this below a guarantee, but the asymmetry is in the code: a void returns the deposit and costs nothing.

From audit_economics. A thesis is only judged if it is in weekTheses[week], and that array silently stops growing at MAX_DAY_NOTES = 256: a later thesis is still posted (stamp taken, ~0.5 IMD deposit locked, status ThesisOpen, children allowed) but thesesOfWeek never returns it, so MarginaliaJudge.eligibleTheses, questionBody and judgedOf can never include it.

The judge additionally truncates eligible theses to the first MAX_JUDGED = 120 by posting order (MarginaliaJudge.sol line 96). Neither limit is checked at posting, so an honest author pays for an entry that cannot win, with no revert or event saying so.

Because a thesis's deposit is released by any child resolution, including VoidNoData with no observations, filling the judged set costs only stamps: 120 theses plus one child call each = 240 stamps = 24 IMD, after which every honest thesis that week is outside the 120 the panel sees and the 30% thesis prize (plus rolled-forward leftovers) is ranked among the attacker's entries only.

Settled: NOT fixed; the author disputes it as design. Re-run against the revised tree: the v4 branch of validateVenue (line 209) still admits any hookless pool with non-zero liquidity, with no depth, age or counterparty requirement, and nothing between posting and payment distinguishes a venue that only the author ever trades.

The brief's own settlement guarantee ('a pump must be held for the whole span and any honest observation pins the price') is what fails here, not a venue preference: on a pool whose token nobody else holds there is no honest observation to pin anything and holding the pump costs nothing, because the IMD spent on it lands in the attacker's own position.

MarginaliaHook._difficulty (line 690, mcap = postPrice x IERC20(n.x).totalSupply()) then takes both the price and the supply from the attacker, so the win scores log2(100) x sqrt(30) x 3 = 1,088,592 against ~20,538 for an honest right +10% call on the launch pool, and leaderboardShare pays the 10% cap; ten wallets take 100% of every week's leaderboard pool (50% of all stamps, fees, forfeits and treasury drips) for 1 IMD of stamps.

The author's partial closures (empty v3 pools refused, zero prices refused, failed balanceOf is not a refundable void, 10% cap) do not touch this path: the proof needs a liquid v4 pool, a positive price and a working ERC-20.

The author is right that no fix fits inside 'do not change the contracts' logic' and that a depth floor only raises the attacker's cost (the pumped IMD comes back when it removes liquidity); the decision is the requester's, but until the requester either accepts the exposure in the brief or a change bounds what a self-priced call can draw (for example: score only calls priced on the launch pool or the hub leg, cap the claimed multiple, or derive the mcap tier from something the author does not choose), the loss path stands as reproduced.

SPEC.md section 10 still says price resolution only returns or forfeits the author's own bond, which stopped being true when the leaderboard started paying IMD for score.

Settled: the dust variant (1 wei) is fixed and testAStrangersDustTransferDoesNotVoidASellCall confirms it. The fix does not fully hold: _broken (lines 530-537) still declares a SELL call void on any balance growth above max(10% of postBalance, DEPOSIT x 1e18 / postPrice), and an ERC-20 balance can be raised by anyone.

For an author who holds little or none of X at posting (a SELL call posted through router.note needs no X at all; postBalance for a note on MARG is only the ~0.4 MARG the 1 IMD swap delivers), the tolerance is the deposit's worth, so a gift of 0.5 IMD worth of X plus one wei voids the call.

The author's defence is that the gift compensates the deposit, and in money it does (gift in 0.5, deposit out 0.494), but it does not compensate the score: the call books -difficulty instead of +difficulty, records.broken is incremented, and the settling keeper (who can be the gifter) collects 2% of the deposit.

In the leaderboard economy score is money: for 0.5 IMD a competitor erases a rival's +20,538 (or a tier-3 call's +1,000,000) and replaces it with the negative, raising every other wallet's pro-rata share of the week's pool; BUY calls cannot be attacked this way, so SELL calls remain strictly worse to post. SPEC.md line 70 still describes the SELL hold rule as 'balance <= post-trade balance', which the code no longer implements either.

A rule a stranger cannot trigger would compare against outflows only (a SELL call is broken by the author buying X back, which cannot be told from a gift by balanceOf), or drop the SELL hold rule and rely on price alone as the brief's settlement does; either is a design decision, but the guarantee claimed in round 2 ('a stranger's dust transfer cannot void it') is only true for dust.