Everything is in place and verified.

Delivered a fresh Foundry project for CallBook, the on-chain commit-reveal track record settled against Chainlink rounds.

• src/CallBook.sol implements commit (snapshots every enabled feed's fresh price, since the hash hides the market), reveal (caller only, from expiry to expiry plus 24 hours, hash and target-side checks), settle (HIT proven by any in-window round, stale and incomplete rounds rejected, MISS without proof), and forced MISS for unrevealed calls. Per-caller stats with current and best streak come from one view call, and every step emits an event.
• Griefing guard worth noting: a third party can only settle a no-proof MISS after the reveal window closes, so nobody can front-run a caller's proof. The caller can settle a MISS at any time or use revealAndSettle to prove atomically.
• src/LaunchToken.sol is the required fixed-supply ERC-20 with no admin paths.
• script/Deploy.s.sol exposes a single deploy(Config) function that a test calls directly, and its dry run passes with an empty environment.
• README.md covers rules, a worked example, assumptions, factory constructor arguments, and owner, caller, and keeper responsibilities. REVIEW.md records the self-review and untested edges. ABIs are in docs/abi/.

Verification results

The scratch harness in test/scratch/ mirrors the protected deployment floor and is discarded before submission. The constructor makes no external calls, so it deploys even where the feed addresses hold no code.

Not done: I did not commit. Git in this sandbox cannot read the global config, and the network's own process handles the commit. lib/forge-std is vendored as plain files with no git metadata.

Created launch.json with matching token metadata, $owner, Sepolia feeds, and native-ETH pool settings.

Validation passed:

• Schema and constructor ABI checks.
• forge build --offline (existing lint warnings).
• forge test --offline: 57 passed, including pinned checks.

Only launch.json is changed for submission.

I found four problems in CallBook, none high: three medium and one low. I reproduced each with a scratch Foundry test in a copy at /tmp/cbpoc, and all four passed. I didn't change any repository file; the findings are in .imd-findings.json, which is valid JSON and doesn't show up in git status.

Medium: the caller controls their own streak (src/CallBook.sol:336). Streaks count in the order calls are settled, and the caller can choose that order: a revealed HIT has no deadline for settling, and the caller can settle their own MISS straight away. Five calls that expire in the order hit, miss, hit, miss, hit should give a best streak of 1. By settling the misses as they happen and settling the three hits together at the end, the caller gets bestStreak = 3 and currentStreak = 3.

Medium: the owner can turn a call into a MISS (src/CallBook.sol:216). If disableFeed(btc) lands before a pending commit for a BTC call, the commit still succeeds but records no BTC price. Reveal then always fails with FeedNotRecorded, and the call can only end as a forced MISS, even when BTC reached the target. That breaks "no admin power over results", and it also happens when the owner disables a feed honestly while commits are waiting to be mined.

Medium: hits can be farmed with tiny targets (src/CallBook.sol:274). A target only has to be one unit (1e-8 USD) past the commit price. I used real Sepolia ETH/USD rounds, which post roughly once an hour. An UP call at commit price + 1 and a DOWN call at commit price − 1, made together, both settled as hits within two rounds. This follows the spec's literal "correct side" rule, so fixing it (for example with a minimum distance) is a scope decision, not a code bug.

Low: a proven hit can be recorded as a MISS (src/CallBook.sol:303). Once the 24-hour reveal window closes, anyone can call settle(id, 0) and record a MISS without any check for a round that proves a hit. If the caller revealed late or settles after the window, a third party can get in first and the MISS is permanent. Using revealAndSettle avoids it, and the README recommends that, but the contract doesn't require it.

I also checked these and found them sound:

• Hash: it binds every field, and expiry is read from storage.
• Time bounds: the expiry, reveal-window and proof-round boundaries hold at their exact edges.
• Round checks: stale, incomplete and non-positive rounds are rejected.
• Owner: it is immutable and set from $owner in launch.json.
• Funds: the contract holds no ETH or tokens and has no reentrancy surface.
• LaunchToken: fixed supply, with no owner or mint function.
• Staleness limit: both live Sepolia feeds update every ~3,600 s, so the 3-hour limit won't block commits in normal operation.