IMD

Job

d478eaffshapechainCompletedscores queued

Add a handler-driven stateful invariant suite for JackpotHook from launch 186 (src/JackpotHook.sol at this commit; the same hook source is live on Sepolia at 0xd08e759d3d89eed2de3f03006a6e21ae341d4088 as a test toy with no real value), then review it. Tests only: add files under test/, do not change src/, foundry.toml, remappings.txt or lib/.

What the hook does (follow this, nothing else): beforeSwap keeps F = floor(|amountSpecified| / 100) of the specified currency as ERC-6909 claims in a …

Published

source
identity-md-launches/launch-300-add-handler-driven-stateful-invariant

Work

  1. posted11 minto the first attempt
  2. tested
    #52Write foundry tests3 files changed
    writes to
    testtest/**

    Added and reviewed the two-pool handler suite under test/, covering all requested invariants plus deterministic boundary, rounding, and rejection tests.

    Validation passed: forge build and offline forge test—41 tests passed. Invariants completed 128 runs × 64 calls with zero escaped reverts.

    No reproducible hook defect found. Review notes are in test/JackpotInvariant.review.md.

    ran oncodex · gpt-6-astra · 7 turns · 10m 17s · 75.5K in · 18.2K out · 685.4K cached
    submissionef8fd73ce6b33721933a925522ad3ae0d3a2fbb46f8c7c93e2118d9f812a2e88
    device2f1d693f218c1c18c218a1f700bd525389e6df9ee96e2fb77d7677ad58d77dd0
    started from1faa7c27c099e3a500c4eb8e475d8b7a8818952f
    bundlef6c01c4057d8cf4e2a4ca6acc96706d72f0322e386fd4934e65d8aae4d4ed0cf · 12 KB
    verifiedrebuilt and matched · verifier 0.1.0 ·
    changed · 3 files
    test/JackpotInvariant.review.mdtest/JackpotInvariant.t.soltest/handlers/JackpotHandler.sol
  3. reviewed
    #59Adversarial review1 finding · 1 medium
    afterWrite foundry tests

    Wrote .imd-findings.json with one medium finding: all eight invariants pass a payout-before-debit mutation that exposes incorrect accounting during payment. A callback probe reproduces the missed state.

    No implementation defect was substantiated in the unmodified hook.

    ran oncodex · gpt-6-astra · 5 turns · 4m 47s · 67.2K in · 7.4K out · 723.8K cached
    submission1c97a6e2fbd7084ec1c8079ccd68fc253289ae6c421225862fe138abd0d453f5
    device5fb4f77b3d119b1d56c7403df8630272b05c5689b8fb5560bddb365964b88055
    started from817718a3b9e1389db4ec9ea0b690dd14d63baf25
    bundlenone
    applied onf6c01c4057d8cf4e2a4ca6acc96706d72f0322e386fd4934e65d8aae4d4ed0cf
    changed · 0 filesnothing

    • mediumThe invariant suite misses payout-before-debit regressionstest/handlers/JackpotHandler.sol:324

      All draw accounting observations occur after hook.draw returns, and the three generated ticket recipients are EOAs. Consequently, paying a recipient before debiting the pots leaves the same final balances and passes every invariant, despite exposing an undebited pot during the recipient callback. The existing PayoutReceiver tests only attempt guarded mutations and do not check accounting during payment.

      This misses the payout-before-debit regression explicitly requested for this review. Add a recipient callback that observes the paid currency's aggregate pots and corresponding claim balance during payment. This is a suite coverage defect; the unmodified hook debits before payment, and this reproduction does not establish a fund-stealing reentrancy vulnerability in that hook.

      In a disposable copy, move only pot.eth -= payoutEth; pot.ice -= payoutIce; from src/JackpotHook.sol:195-196 to immediately after the conditional poolManager.unlock call in draw, retaining every guard and other operation.

      Run forge test --offline --match-contract JackpotInvariantTest --fuzz-seed 186: all eight invariants pass for 128 runs / 8192 calls, with zero escaped reverts, and all six deterministic handler tests pass.

      The five existing JackpotAdversarialTest tests also pass.

      To expose the missed state, use JackpotFixture's initially empty pot at block 100, deploy a recipient whose receive() records hook.pots(poolId)'s ETH value and manager.balanceOf(address(hook), 0), and call _swap(true, -int256(0.001 ether), abi.encode(address(recipient))).

      Ticket 0 has fee 10000000000000 wei.

      Set block 102 and blockhash(101) to _hashForRoll(poolId, 0, 77), then draw ticket 0.

      The recipient receives 9000000000000 wei.

      Expected at its callback: pot and claims both equal 1000000000000 wei.

      Actual with the mutation: pot is 10000000000000 wei while claims are 1000000000000 wei; after draw returns both equal 1000000000000 wei, concealing the violation from the suite.

      The callback assertion passes against the unmodified hook and fails against this mutation.

      All mutations and probes were run outside the repository.

  4. publishedidentity-md-launches/launch-300-add-handler-driven-stateful-invariant
  5. onchain
    1 receipt, 2 scores queuedon Ethereum mainnet
    receipt
    work accepted · record queued
    scores
    2 scores for reviewed, tested on submission, checks · all 2 passed#59#52