The review is complete and .imd-findings.json holds four entries. The git tree is otherwise unchanged (the findings file is ignored by git, and the scratch tests were removed).

Verdict: no critical, high or medium defect in the Stacker. The contract does what the brief says: ownerless, immutable IMD and sIMD, no external call in the constructor, one-time vault check and approval, every failure path rolls back the pull, the approval and the ready flag, shares minted straight to the trader, no forbidden opcodes in the 2,362-byte runtime. The manifest is valid and both constructor arguments checksum to the addresses in the brief. All 172 offline tests pass, and I also ran the three mainnet fork tests against a public RPC, where they pass against the live IMD and sIMD.

Findings written:

• Low, src/Stacker.sol:76. credit accepts the Stacker itself or the vault as the trader. The shares then sit in an address with no way to move them, which breaks the documented "holds no sIMD" invariant. The fuzz test in Stacker.t.sol explicitly excludes these two inputs. Suggested fix is a two-address extension of the existing zero-trader check.
• Low, README.md:166. The gas table lists 136k and 102k but the first credit ever costs about 232k, and nothing primes the vault at launch. On a fork, a call with the table's 1.3x budget fails on a fresh Stacker and succeeds once primed. Recommend a 1-wei priming credit in the launch handoff and a table row for the one-time cost.
• Info, src/Stacker.sol:89. A 1-wei credit stamps the trader's one-block hold, so anyone can delay a trader's redeem by one block per 1 wei plus gas. This is a property of the renounced vault, reachable directly too, so no Stacker fix is proposed. Noted so trader-facing text does not overpromise.
• Info, coverage. Lists what was read in full (Stacker, ProjectRegistry, oracle, both mocks, manifest, config, Stacker tests, protected floor), what was executed, and what was not reached: the live IMD OFT's source was only exercised on the fork, not read, and the registry and oracle were read but not audited to the same depth since they are a later launch.

Next step for the adapter: decide whether to add the trader guard and the priming credit before the mainnet deploy. Neither changes the launch manifest.

Completed the launch adaptation: fixed unsafe recipients, corrected first-credit gas guidance, added regressions, and documented all findings in ADAPTATION.md.

Validation passed: clean forge build, 181 offline tests, all 192 tests with RPCs, and the protected deployment checks.

Manifest and dependencies remain unchanged. No mainnet transaction was broadcast; the deployment address remains pending.

Updated launch.json, preserving the sole Stacker deployment and approved addresses, with clarified integration notes.

Validation passed: manifest structure, constructor ABI, and forge build. forge test: 181 passed, 0 failed, 11 skipped because RPC URLs were unset.

Only launch.json changed.

I found nothing to fix in the math of the Stacker, the one contract this launch deploys. I filed one low finding about the off-chain points rules, and wrote it with coverage rows for all 9 entry points to .imd-findings.json. I changed no repository files. The offline suite passes: 181 passed, 0 failed, 11 skipped (fork tests without RPC). The brief and README say 180 tests (172 offline, 8 fork); the actual total is 192, so those counts are out of date.

Stacker.credit: holds

• Rounding: the vault rounds shares down. With sIMD's 6-decimal offset, a trader loses less than one share, about 1e-6 of a token's smallest unit.
• Zero shares and donation attacks: the ZeroShares check rolls the whole credit back. Forcing a zero-share result with 1.81M IMD staked would take a donation of about 1.8e12 IMD, which isn't possible.
• Totals: the running totals use checked additions and are capped by IMD's total supply. totalStacked always equals the sum of the per-project totals exactly.
• Edge amounts: a zero amount skips the vault check, the approval and every state change. The maximum value reverts cleanly in the vault's math.
• First credit: the vault check and approval roll back if the credit fails. The one-time unlimited approval can never run out.

ProjectRegistry (not deployed in this launch): every entry point holds

• The rate limits (25 to 100 bps) and text-length limits are inclusive and checked before any payment.
• Time arithmetic is widened before adding or safely bounded, so it can't overflow.
• The 1-day expiry boundary leaves no overlap and no gap: an answer is accepted up to exactly one day after the ask, and expire is open from one second later. Cooldown, handoff and the 5-minute clock tolerance also behave at their exact edges.
• Fee and bond amounts add up: the registry pulls the fee plus bond, approves exactly the fee, and pays out one bond per settled question.
• The panel check requires at least 15 seats and at least 11 agreeing, and never fewer than the stated quorum.

Finding 1 (low): the fee guard doesn't stop cheap self-trading for points. The listing rule (src/ProjectRegistry.sol:541, restated in the README) counts fees paid to liquidity providers as money that leaves the project. It ignores the case where the self-trader is also the main liquidity provider.

• Example: a pool with a 1% LP fee and 1% cashback meets the rule. An attacker holding 99% of the active liquidity trades 1,000 IMD back and forth.
• Result: they get 20 points and roughly 39.8 IMD back, for about 0.2 IMD plus gas.
• Why it matters: the README says self-trading for points "always costs more than it brings back", which assumes a net cost of at least 20 IMD here. The actual cost is about 100 times lower.

It is low because points are off-chain, nothing is promised, and the registry isn't part of this launch. No proof test is attached, since only critical and high findings need one.

The static-analysis leads I checked (unused return values, timestamp comparisons, state written after an external call) don't hold up as math defects. I didn't run the fork tests because no RPC was configured, so the live mainnet vault was not checked directly; I relied on the brief's on-chain facts.

The review is complete. The findings file holds an empty findings list and 11 coverage rows, and the working tree is clean apart from that file.

Result: no reproducible defect in the access-control, trust-gap or asymmetry area.

What I verified:

• Stacker.credit pulls only the caller's own IMD, mints only to the trader, rejects zero, self and vault recipients before any transfer, and is fully under the reentrancy guard. The one-time max approval to the immutable vault can only be spent by the Stacker's own deposit call. A failed first credit rolls back both the flag and the approval.
• Launch manifest lists exactly the Stacker with the live IMD and sIMD addresses in declaration order. The protected floor rehearsal with the real init code passes, and no owner, admin, fee, pause or upgrade exists in the ABI.
• Live facts at block 26,176,338 match the brief: vault asset is IMD, owner renounced, not paused, 24 decimals. The offline suite passes and all 5 mainnet fork tests pass against the local endpoint.
• ProjectRegistry entry points all hold under my lenses. The one seam I chased hardest was whether anyone could race expire between the Intake completing a request and delivering its callback to void an unfavourable answer. The verified Intake v2 source sets the completed flag and calls the callback in the same transaction, and the callback is non-reentrant, so no such window exists.

Documented trust assumptions, recorded in coverage rather than as findings: the open-application spam cost is already acknowledged in the design notes, the vault's one-block hold can be stamped by any 1 wei deposit and is covered by an existing regression test, and IMD's OFT owner is not renounced, which is outside the Stacker's code.

The review is complete. The findings file at .imd-findings.json holds 3 findings and 12 coverage rows, all snippets copied from the tree.

What I checked

• The Stacker's economics against the live mainnet vault, read at block 26,176,349: asset is IMD, owner renounced, not paused, 24 decimals, 1.799M IMD staked, and one wei deposits at 125,375 shares. Deposit rounding loses under one share per credit, donations change share count but not value, the zero-share guard is unreachable at live state, and the Stacker ends every call holding nothing. IMD is not a proxy and has no pause function.
• All 181 offline tests pass, and the 5 mainnet fork tests pass against a public RPC, including the gas-budget cases.
• The manifest lists the two correct addresses in constructor order with only the schema's keys.
• The registry's bond and fee flows on every settle, failure, expire and claim branch.

Findings

1. Medium, README rule 3 and the panel's trader rule. Falling back to sender in a v4 hook names the router when hookData is empty, which is the Uniswap frontend default. The sIMD is minted to the Universal Router, whose sweep command is permissionless, so searchers take the cashback and points land on the router's address. The same wording is in the registry's panel rule, so a challenge on that ground would be defended. Rule 6 hints at the fix (the router's msgSender()) but nothing requires it.
2. Medium, ProjectRegistry.applyListing. A stranger can occupy a project's one open-question slot for one oracle fee per cycle with no bond at risk, backrunning each rejection or expiring and re-applying atomically, so the real owner's application reverts with AskOpen forever. Reproduced in a scratch test. The registry is a later launch, but it is in the entry-point list.
3. Info. The job text's test count is stale: the tree has 192 tests (181 offline plus 11 fork), not 180.

Coverage. All nine entry points have rows: applyListing is a finding, the other eight hold, plus three invariant rows for Stacker conservation, the manifest, and the fork suite. Nothing was left unreached. The one-block hold griefing via a dust credit is a vault property already covered by the existing VaultTrustRegression test, so I did not report it.

The review is complete. The findings file is written, the working tree is otherwise unchanged, and the scratch tests are removed.

Outcome. The Stacker's control flow holds for the mainnet launch. No critical, high or medium defects. I recorded two low findings and one informational note in .imd-findings.json, with a coverage row for all nine listed entry points plus five invariant rows.

What I verified

• Execution trace of credit. Guards run before any external call. The zero-amount return precedes vault validation. The ready flag and the max approval are set before the pull and roll back with it on any later revert. The guard is single-entry and the token has no transfer hooks, so the static-analysis reentrancy leads do not reach a failing state.
• Periphery against live mainnet. Sourcify exact matches show the live vault is the test double apart from name, symbol and pragma, with identical Solady sources. IMD is a LayerZero OFT on OpenZeppelin 5.4 with no fee, pause or hooks, and it does not decrement a max allowance. Live reads confirm the vault's asset, renounced owner, unpaused state and 24 decimals.
• Launch artifacts. The manifest matches the brief and schema. I ran the supplied protected test on the exact creation bytecode: it passes with a 2,528-byte runtime and no escape opcodes.
• Tests. The offline suite passes. All five mainnet fork tests and all six Sepolia fork tests pass against public RPCs, including the 177k out-of-gas rollback and the 350k cold first credit.

Findings

1. Low, src/Stacker.sol line 80. The recipient guard rejects the Stacker and the vault but not the IMD token contract, which can equally never move sIMD. A credit naming the token as trader succeeds and strands the shares. I reproduced this with a scratch test.
2. Low, README.md line 166. Rule 3 says to fall back to sender. In a Uniswap v4 hook that is the router, so interface swaps with empty hookData credit the router and strand the cashback. Rule 6 already names the correct resolution through the router's msgSender.
3. Info, jobs/4-mainnet-launch.md line 14. The launch text says 180 tests with 8 forks. The tree runs 192 with 11 forks, as the adaptation notes already state.

Not reached. I did not measure whole-transaction gas against the brief's exact figures, only that the documented budgets succeed on the fork. I did not audit the registry or oracle beyond a control-flow trace, since they are not deployed in this launch.

Added tests for the exact mainnet deployment, dependency-failure rollback, and randomized hold/conservation invariants. Changes are confined to test/.

Verification passed:

• forge build
• forge test: 199 passed, 0 failed, 11 skipped

The skipped fork tests still require mainnet/Sepolia RPC configuration.

The review is complete. The findings file is at .imd-findings.json with 5 findings and 12 coverage rows, and no tracked file was changed.

What I verified

• src/Stacker.sol holds as deployed: guards, one-time asset check and approval with rollback, exact-amount pull and deposit, totals and event, reentrancy guard. The 5 mainnet fork tests pass live against the real IMD and sIMD. The compiled runtime is 2,528 bytes with no forbidden opcodes under the protected test's exact scan, and launch.json matches the brief's two checksummed addresses.
• All 9 listed entry points are answered. 7 hold, 2 carry findings. The slither leads on tryRecover and expire return values are wrong: both values are checked.

Findings kept, after reproduction and merging

1. Medium, README rule 3. "Fall back to sender" credits the Uniswap v4 router on every frontend swap with empty hookData, and Universal Router's permissionless sweep lets anyone take the sIMD. Merged from two specialists. The deployed code is fine; the fix is wording in the integration rule and later the registry's trader rule.
2. Low, registry applyListing. A squatter holds a project's single application slot for one oracle fee per cycle. Reproduced in a scratch test. Downgraded from medium because the registry is not deployed in this launch, with a note to fix it before that launch.
3. Low, Stacker.credit line 80. The IMD token is accepted as a share recipient while the Stacker and vault are rejected. Reproduced in a scratch test.
4. Low, registry fee guard text. LP fees count as leaving even when the wash-trader is the LP. Policy text only.
5. Info, job text. Stated test count is stale. Actual run: 199 offline passed, 11 fork skipped, 210 total.

No critical or high finding, so no proof files were attached. Scratch tests live under test/scratch/ and are not kept.

Implemented router-resolution guidance, the IMD recipient guard, and LP-fee policy corrections. Updated ADAPTATION.md and answered all nine findings in .imd-responses.json.

Validation passed: forge build, 192 offline tests, all 11 fork tests, and the protected deployment check.

Registry application-slot squatting remains documented and deferred to its later launch. No mainnet transaction was broadcast.

Updated only launch.json, normalizing the real IMD and sIMD addresses to the brief’s exact strings. Stacker remains the sole deployment; arguments match its compiled constructor ABI.

forge build passed. forge test: 192 passed, 0 failed, 11 fork tests skipped without RPC URLs. Manifest checks and git diff --check passed.

Added seven tests under test/ covering vault-transfer failures, atomic rollback, single fallback payouts, and recovery, including two 1,000-run fuzz tests.

forge build and forge test pass: 217 passed, 0 failed, 11 skipped. Existing invariants pass. Fork tests remain unrun without RPC settings.

Review settled and written to .imd-findings.json (3 info findings, 14 coverage rows, every snippet checked against its file line). No file other than the findings file was changed.

Settlement of the five earlier findings

• Rule 3 credits a sweepable router (medium): fixed. README rule 3, the registry's trader rule text and the docs now resolve valid hookData, else the router's active msgSender(), else sender only when it has no code, and reject router recipients. The new TraderResolution suite reproduces the old loss on a legacy branch and covers the corrected paths, invalid data, malformed or reverting accessors and the plain-IMD fallback.
• IMD token accepted as share recipient (low): fixed. The guard at src/Stacker.sol:80 now rejects the token, before any amount handling or external call. The regression tests pass offline, and the Sepolia fork test confirms the candidate rejects all three unreachable recipients.
• LP fees counted as leaving (low): fixed. The feeGuard rule and README exclude LP fees and anything returned to trader, owner or team, and the universal net-cost claim is gone.
• Application-slot squatting (low, registry): deferral accepted. The author confirmed the behaviour with a test, documented it in the design doc, and deferred the policy decision to the registry launch. The registry is not deployed here, so I recorded it at info so it stays on the record without blocking.
• Stale test count (info): still stale. The author's 203 was correct in their checkout. The tester's accepted files were merged afterwards, so the combined tree runs 228. Recorded again as info with the cause.

One new item, info only. The manifest's notes, written by the manifest step before this revision and re-applied unchanged, still say "otherwise sender" and count liquidity as leaving. The constructor arguments and the contract are correct, so this is text drift in the signed record, not a deployment defect.

Verification run. Offline: 217 passed, 0 failed, 11 skipped. Mainnet fork against a public RPC: 5 passed, including the cold first credit under the README's gas budget. Sepolia fork: 6 passed. The two slither leads (ignored returns in expire and the attestation verifier) are intentional and the needed values are checked. Nothing blocks the launch.