Refused by Codex's safety filter

• lowsafeTransferFrom rejects every recipient with code: compliant IERC721Receiver contracts and EIP-7702 delegated EOAs cannot receive pieces through the standard safe path while supportsInterface claims src/Pepeolithic.sol:272

  Merged from audit_permissions (EIP-7702 wallets), audit_flow and audit_economics (compliant receivers): one root cause. Both safeTransferFrom overloads reach this 4-arg override (OZ v5.0.2's 3-arg version forwards to the virtual 4-arg one), which replaces the ERC-721 onERC721Received check with a blanket revert for any to whose EXTCODESIZE is nonzero.

  Two populations are hit: (a) contracts that correctly implement IERC721Receiver (Safe multisigs, escrows, marketplace delegates such as Blur's ExecutionDelegate, which transfer via safeTransferFrom); (b) ordinary EOAs that have set an EIP-7702 delegation on mainnet since Pectra, whose account code is the 23-byte designator 0xef0100||impl, so to.code.length == 23 (MetaMask Smart Accounts, Ambire, Uniswap wallet users). supportsInterface(0x80ac58cd) still returns true, overstating compliance.

  No funds are lost and transferFrom works, so low. This matches the pinned Ochre.sol byte-for-byte and the README documents it as the chosen reading of 'no receiver callbacks anywhere'; changing it is a scope decision against the 'match Ochre.sol exactly' requirement.

  If the author decides to keep callbacks out, the minimal fix that preserves that is to exempt the 23-byte 0xef0100 designator (bytes memory code = to.code; if (code.length != 0 && !(code.length == 23 && code[0] == 0xef && code[1] == 0x01 && code[2] == 0x00)) revert ContractRecipient();) and document the remaining contract restriction in collection metadata; if receiver compliance is wanted, restore OZ's _checkOnERC721Received for transfers only.

  whole finding

  Deploy with the mainnet arguments and a bool-returning mock etched at the ZTO address.

  (a) Deploy GoodReceiver whose onERC721Received returns IERC721Receiver.onERC721Received.selector.

  As adam: safeTransferFrom(adam, GoodReceiver, 0) and safeTransferFrom(adam, GoodReceiver, 0, "").

  Expected per ERC-721 (and supportsInterface(0x80ac58cd)==true): ownerOf(0)==GoodReceiver and onERC721Received called once.

  Actual: both revert ContractRecipient(); transferFrom(adam, GoodReceiver, 0) then succeeds with zero receiver calls.

  (b) vm.etch(0xB0B, hex"ef0100" ++ 20-byte address) so 0xB0B.code.length == 23 exactly as a delegated EOA on mainnet; warp START+3600, seller buys (1,1) -> id 5; seller calls safeTransferFrom(seller, 0xB0B, 5) and the 4-arg form.

  Expected: ownerOf(5)==0xB0B as for any EOA.

  Actual: both revert ContractRecipient().

  Verified: the attached proof (specialist's Proof_08f3e1e8bd71.t.sol) fails on this tree with ContractRecipient() in both tests; my scratch tests testSafeTransferCompliantReceiverReverts / testSafeTransferDelegatedEoaReverts confirm the same.

  whole reproduction
  proof · a Foundry test the fix has to pass

  // SPDX-License-Identifier: MIT
  pragma solidity 0.8.26;
  
  import {Test} from "forge-std/Test.sol";
  import {Pepeolithic} from "src/Pepeolithic.sol";
  
  /// @dev Minimal bool-returning coin standing in for ZTO at the pinned address.
  contract ScratchCoin {
      mapping(address => uint256) public balanceOf;
      mapping(address => mapping(address => uint256)) public allowance;
  
      function mint(address to, uint256 amount) external {
          balanceOf[to] += amount;
      }
  
      function approve(address spender, uint256 amount) external returns (bool) {
          allowance[msg.sender][spender] = amount;
          return true;
      }
  
      function transferFrom(address from, address to, uint256 amount) external returns (bool) {
          allowance[from][msg.sender] -= amount;
          balanceOf[from] -= amount;
          balanceOf[to] += amount;
          return true;
      }
  }
  
  /// @notice An EOA that has set an EIP-7702 delegation keeps its 23-byte delegation
  /// designator as its account code (EXTCODESIZE == 23 on mainnet since Pectra).
  /// Pepeolithic.safeTransferFrom rejects every recipient with code, so such a wallet
  /// can never receive a piece through the standard safe-transfer path.
  contract Delegated7702TransferTest is Test {
      address internal constant COIN = 0xd782Bdea4EF02a0Bd391eb9089470c8080f0A68e;
      address internal constant ADMIN = 0x433c8A73Bec1273561E4E2201649de12f20B7D58;
      address internal constant ADAM = 0x047F606fD5b2BaA5f5C6c4aB8958E45CB6B054B7;
      uint256 internal constant START = 1791810000;
  
      Pepeolithic internal pepeolithic;
      ScratchCoin internal coin;
      address internal seller = address(0xA11CE);
      address internal delegatedWallet = address(0xB0B);
  
      function setUp() public {
          ScratchCoin implementation = new ScratchCoin();
          vm.etch(COIN, address(implementation).code);
          coin = ScratchCoin(COIN);
          pepeolithic = new Pepeolithic(
              COIN,
              ADMIN,
              ADAM,
              bytes32(uint256(1)),
              START,
              86400,
              3600,
              1e24,
              1e22,
              bytes32("pepeolithic-base-naij"),
              bytes32("pepeolithic-moss-naij"),
              bytes32("pepeolithic-water-naij"),
              bytes32("pepeolithic-ice-naij"),
              bytes32("pepeolithic-lava-naij"),
              bytes32("pepeolithic-crystal-naij"),
              bytes32("pepeolithic-roots-naij")
          );
          // Seller buys cave 1 round 1 slot 5 (id 5) at the floor.
          coin.mint(seller, 1e24);
          vm.prank(seller);
          coin.approve(address(pepeolithic), 1e24);
          vm.warp(START + 3600);
          vm.prank(seller);
          uint256 id = pepeolithic.buy(1, 1);
          assertEq(id, 5);
          // The recipient is an ordinary user whose EOA carries an EIP-7702 delegation
          // designator: 0xef0100 followed by the delegate implementation address.
          vm.etch(delegatedWallet, abi.encodePacked(hex"ef0100", address(0xDE1E6A7E)));
          assertEq(delegatedWallet.code.length, 23);
      }
  
      function testDelegatedEoaCanReceiveViaSafeTransferFrom() public {
          vm.prank(seller);
          pepeolithic.safeTransferFrom(seller, delegatedWallet, 5);
          assertEq(pepeolithic.ownerOf(5), delegatedWallet);
      }
  
      function testDelegatedEoaCanReceiveViaSafeTransferFromWithData() public {
          vm.prank(seller);
          pepeolithic.safeTransferFrom(seller, delegatedWallet, 5, "");
          assertEq(pepeolithic.ownerOf(5), delegatedWallet);
      }
  }

  whole proof

• lowbuy()/buyLeftover() accept no caller price bound; a line sale in the preceding round lifts a pre-open quote by up to 2x and an unlimited ZTO allowance pays the lifted openingsrc/Pepeolithic.sol:175

  From audit_economics; reproduced. The charge is price(c, r, now) with no maxPrice argument. Inside an open round the price is deterministic and non-increasing (I also verified that out-of-order floor buys in earlier quiet rounds leave the open round's derived opening unchanged: round 1 line sale at 93,750 ZTO, rounds 2 and 3 quiet, round 4 open at 125,000 ZTO; floor buys of rounds 2 and 3 after round 4 opened leave openingPrice(1,4) and priceNow(1,4) identical).

  The exposure is only at the round boundary: openingPrice(c, r) for a not-yet-open round is derived, and a line sale in round r-1, whose line runs until the instant r opens, raises it to max(2*lastLineSale, opening(r-1)/2). A buyer who reads openingPrice before the open, signs with an unlimited approval and lands at the open pays the lifted value.

  Nobody profits from the lift (the predecessor buyer pays real ZTO for a real piece), so this is a bounded user-protection gap, not an exploit. The README already states that a quote is not a reservation and recommends an exact allowance. Adding a maxPrice parameter would change the reference ABI, so this is a scope decision; otherwise the mitigation is wallet-side (approve exactly the quoted amount).

  whole finding

  Mainnet parameters (first 1e24, floor 1e22, 3600 s rounds), nothing bought in cave 1 rounds 1..5 so the ladder halves to 20,000 ZTO by round 7.

  (a) At roundOpen(1,7)-600 Alice reads openingPrice(1,7) = 20000000000000000000000 and holds an unlimited allowance.

  Bob calls buy(1,6) at that time and pays priceNow(1,6) = 10416666666666666666667 (a line sale).

  At roundOpen(1,7) Alice's buy(1,7) is charged 20833333333333333333334 (coin balance delta), +4.2% over the quote.

  (b) Same, but Bob buys (1,6) at roundOpen(1,7)-1799 for 15620659722222222222223: Alice's quote 20000000000000000000000, charge at open 31241319444444444444446 (+56%).

  Expected by a quoting user: pay <= quote or revert; actual: pays the lifted opening.

  Verified with scratch tests testQuoteVsCharge / testQuoteVsChargeMax (logged values above).

  whole reproduction

• infoUncapped ladder: 2 * lastLineSale can overflow for extreme (non-mainnet) firstPrice, bricking the remaining rounds; unreachable with the launch argumentssrc/Pepeolithic.sol:285

  From audit_math; reproduced. The constructor bounds floorPrice (<= max/2) and firstPrice from below (>= 2floor) but not from above. If every round is bought at its opening the opening doubles each round, so round k opens at firstPrice2^(k-1) and lastLineSale equals it; once lastLineSale reaches 2^255 the checked multiplication panics (0x11) and openingPrice, priceNow and buy revert for that round and every later one, leaving those pieces only sweepable to admin.

  With the mainnet arguments (firstPrice 1e24) the maximum reachable opening after 146 doublings is 89202980794122492566142873090593446023921664000000000000000000000000 (~8.9e67 < 2^256), so this cannot happen on the launch configuration; verified by buying all 147 rounds at their openings. Configuration-hardening note only (e.g. require firstPrice_ <= type(uint256).max >> 147); the brief requires matching Ochre.sol, so no change is expected for this launch.

  whole finding

  Deploy with firstPrice_ = 1 << 120, floorPrice_ = 1, caveLength 86400, roundLength 3600 (accepted by the constructor).

  For k = 1..136 (cave 1 round 1 through cave 7 round 10): warp to roundOpen(c, r) and buy(c, r) once; lastLineSale(c, r) == (1<<120) << (k-1) each time.

  Then at roundOpen(7,11): openingPrice(7,11) and buy(7,11) both revert with an arithmetic panic because 2 * lastLineSale(7,10) = 2^256.

  Expected per the brief: the round opens at twice the last line sale (no cap) or the sale continues; actual: cave 7 rounds 11..21 (44 pieces) are unbuyable.

  Verified with scratch test testLadderOverflowExtreme; testMainnetMaxDoublingNoOverflow confirms the mainnet arguments complete all 147 rounds.

  whole reproduction

• infoConstructor accepts a startTime already in the past; a launch mined after 2026-10-12 13:00 UTC silently truncates round 1's line and lowers the ladder anchorsrc/Pepeolithic.sol:98

  From audit_economics; reproduced. The curve is anchored to the fixed constructor value startTime = 1791810000, not to deployment time, and there is no startTime_ > block.timestamp check (the brief fixes startTime and requires matching Ochre.sol, so this is an operational item for the deployer, not a code change).

  If the deployment transaction lands after startTime, the 1,000,000 ZTO opening and the upper part of the ladder are never purchasable and claimSeat is live immediately. Lower-than-designed price discovery for cave 1; no loss of funds. Today is 2026-10-08; the launch must be mined before 2026-10-12 13:00 UTC, and the deployer should abort and re-plan if it cannot be.

  Deploy with the mainnet arguments at block.timestamp = startTime + 1800: priceNow(1,1) immediately returns 93750000000000000000000; the 1,000,000 ZTO opening was never buyable.

  Deploy at startTime + 3600: priceNow(1,1) = 10000000000000000000000 (floor) and openingPrice(1,2) = 500000000000000000000000, derived from a round nobody could buy on its line.

  Expected for the designed sale: round 1 opens at 1,000,000 ZTO for buyers.

  Verified with scratch test testLateDeployment (logged values above).