Implemented the ownerless hook: 1% LP fee for the first hour, then 0.3% at exactly 3,600 seconds, through beforeSwap with no swap-time storage writes.

Added the fixed-supply token, vendored dependencies, mining helper, and deployment documentation.

Verified with Solidity 0.8.26: forge build, all 37 tests, and forge fmt --check pass, including an offline clean-copy run.

Created launch.json with matching contracts, permissions, $poolManager, and native ETH pairing. Only the manifest is submitted.

Deployment remains blocked: the hook requires fee 8388608, but the supplied schema permits at most 1000000. Notes explicitly identify 3000 as a non-deployable placeholder.

Checks completed:

• Supplied schema validation passed; notes: 1,597/4,000 characters.
• forge build passed.
• forge test passed: 48 tests, including protected checks and reproduction of the incompatibility.

Foundry artifacts were directed to test/scratch/.

The review is complete. No defects found in the assigned area, and the findings file holds an empty list with full coverage.

Outcome: .imd-findings.json contains zero findings and 17 coverage rows, one for each of the 13 listed entry points plus four invariants I checked. All 13 entry points are marked holds. The repository tree is unchanged.

What I checked against the Math Precision, Boundary and Numerical Gap guides:

• Fee units and override encoding. The constants are 10,000 and 3,000 pips on a 1,000,000 scale, so 1% and 0.3% exactly. Both pass the manager's cap check after the override flag is removed.
• Deadline arithmetic. The deadline is timestamp plus 3600 in uint256. It is never zero, so the zero sentinel is safe, and it works at timestamp 0 and at the uint64 maximum. It only overflows at a timestamp no chain can reach.
• Strict boundary at one hour. Seconds 0 through 3599 pay 1% and second 3600 onward pays 0.3%. This matches the brief's "first hour" and the README's table.
• Executed swap equivalence. Swaps through the hook produce identical balance deltas and fee growth to an equivalent static-fee pool. I verified this with the protocol fee set to its 0.1% maximum in both directions, with 1-wei exact-input and exact-output swaps, and across the existing fuzzed ranges.
• Zero-fee bypass. The manager stores an LP fee of zero for this pool, so any swap that skipped the hook would be free. The only skip condition is the hook itself being the swap sender, which is unreachable because the hook has no unlock callback, fallback, or swap-calling code.
• Token arithmetic. The token is unmodified OpenZeppelin ERC-20 with a fixed supply of 10^27 minor units and no scaling math.

Static analysis leads: The timestamp-comparison warning is the intended schedule mechanism, not a defect. The large-numeric-literal and internal-function-used-once notes are style only.

Not covered: I did not go beyond the math, boundary and numerical-gap guides into access control, economics or trust assumptions except where the fee bypass invariant required it. The 1-wei exact-input swap consumes its whole input as fee, which is v4-core's own rounding and applies equally to any static-fee pool.

Review complete. The findings file is written at .imd-findings.json with two info-level observations and a full coverage record. No source files were changed.

Outcome: no fund-loss, misdirected-payment, or breakage defect in the economics of the hook. The 1%/0.3% schedule is applied exactly as specified on every swap path I traced through v4-core's fee-override logic, including both directions, exact-input and exact-output, the 3599/3600 second boundary, and composition with a protocol fee. The existing 37-test suite passes, and my scratch probes confirmed the mechanics before I deleted them.

Findings reported, both info and spec-compliant:

• Window anchored to initialize, not liquidity. Initialize at t, seed liquidity at t+3600, and the first trade ever pays 0.3%. The deadline is set once in afterInitialize and never re-anchored. This is what the brief asked for, so it is an operational note: seed liquidity in the same transaction as initialize.
• The 1% surcharge is an ordinary LP fee, so JIT liquidity captures it. A tight-range position added inside the window took 99% of the fee paid by the next buyer, leaving the launcher's seed position about 1%. Mitigating this would need LP gating or state the brief forbids, so it is recorded as a design assumption.

Checked and holding: the stored slot0 fee is zero, but the only path that skips the override requires the hook itself to be the swapper, and the hook has no code that can call the pool manager. The deadline is write-once with no reset path. Disabled callbacks are unreachable from the pool manager and revert if called. The token is stock OpenZeppelin ERC20 with a fixed supply. The slither timestamp lead shifts the boundary by validator seconds on a one-hour window and carries no extractable value, so I did not report it.

Not reached: nothing in my assigned area. One note outside it for the judge: the constructor rejects a manager address with no code, so the protected harness must etch the real manager at IMD_POOL_MANAGER for the attested creation code to deploy. The harness comments indicate it does, and I could not verify the verifier's environment, so it is not a finding.

The findings file is on disk at the repository root and is hidden from git by the harness's own exclude rule, which is expected. The review is complete and nothing further depends on another result.

Review outcome

The hook's control flow is sound in the assigned area. I found one low-severity defect, in the dependency provenance record rather than in the contracts, and wrote it with a full coverage record to .imd-findings.json.

What I covered

• Execution Trace. Traced initialize through Hooks.afterInitialize into the hook's single storage write, and swap through Hooks.beforeSwap, ParseBytes.parseFee and Pool.swap to the applied fee. The returned 96-byte tuple is parsed only because the pool is dynamic-fee, and that state is enforced at initialization since a static-fee key makes the hook revert and the whole initialize roll back. The first swap in the same transaction as initialization already pays 1%. A protocol fee combines with, but does not alter, the 1% and 0.3% LP schedule. All of these were confirmed with a scratch Foundry test that passed.
• Periphery. BaseHook gates every callback on the immutable manager, the eight unused callbacks revert for everyone, HookFlags masks the correct 14 bits, and HookMiner is used with exact-flag matching. The token is unmodified OpenZeppelin v5 ERC-20 and its vendored copy matches its recorded hash.
• First Principles. No path leaves a live pool without a deadline, so no pool can be bricked. The deadline is never zero after the write. Reinitialization is blocked by the manager before the hook runs. The window keyed on initialization rather than liquidity is documented and matches the brief.

The finding

The dependency record does not describe the committed tree. The recorded SHA-256 values match the upstream files at the pinned commits, which I confirmed by fetching each one, but 45 of the 95 vendored files were reformatted after hashing and no longer match. I diffed every mismatched file against upstream: 41 differ only in whitespace and 4 differ only by braces added around one-line if bodies. No semantic change exists, so runtime behaviour is unaffected. The defect is that an offline verifier recomputing hashes over the vendored code gets 45 failures and cannot tell this benign reformat from tampering, and the README claim that upstream source is unmodified is false.

Static-analysis leads. The Slither timestamp warning and both Aderyn notes were checked and are not defects. They are recorded as coverage rows.

Coverage. All 13 listed entry points have a row, 12 marked holds and none unreached, plus 7 rows for invariants, leads and the one finding. Nothing in src/, test/ or configuration was changed. The scratch test lives under the gitignored scratch directory.

The review is complete. The findings file is in place at the repository root, excluded from git by the repository's own .git/info/exclude, and no tracked file was changed.

Outcome: the hook's permission model holds. Every callback is behind BaseHook's PoolManager check, the one storage slot has a single writer that the PoolManager can only reach once per pool, the fee branch is symmetric across callers, directions and swap modes, and there is no path by which the hook becomes msg.sender to the PoolManager, which is the one way v4 would skip the fee override. I found no access-control or asymmetry defect in the Solidity. The three findings are trust gaps around the code rather than in it.

Findings written to .imd-findings.json:

• Medium, manifest fee range. The hook only accepts a pool whose fee field is the dynamic-fee sentinel 8,388,608, and correctly reverts otherwise because v4 ignores the beforeSwap override on static-fee pools. The launch manifest schema caps pool.fee at 1,000,000. So no schema-valid manifest can initialize this pool, and the only value that works fails the schema. If the factory passes the manifest fee verbatim, the launch transaction reverts atomically. Verified with a scratch fuzz test over the full schema range. The fix belongs in the deployer or schema, not the hook, and I said what evidence would close it.
• Low, dependency provenance. 45 of the 95 vendored files do not match the SHA-256 hashes in DEPENDENCIES.json, including BaseHook, Hooks, PoolManager and Pool. I fetched each file from its pinned upstream commit: the recorded hashes are the true upstream hashes and the shipped copies were reformatted by forge fmt. Every diff is whitespace, line wrapping or added braces, with no semantic change. The libraries are functionally upstream, but the README's integrity claim cannot be verified from the record as shipped.
• Info, constructor code check. The constructor refuses a manager address without code, so the attested creation code only deploys in harnesses that etch the PoolManager at the baked-in address. The supplied admission floor does this when IMD_POOL_MANAGER is set. Noted so the pipeline supplies it.

Coverage: all 13 listed entry points have rows, 12 holds and afterInitialize tagged to finding 1, plus six invariant rows including the slither timestamp lead, which I judged not reportable because only a trusted block producer could move a swap across the one-hour boundary. The only unreached row is the launch manifest itself, since no launch.json exists in the tree yet.

No proof files were attached. Nothing reached high severity, and a test for the medium finding cannot be made to fail now and pass after a correct fix, because the right fix is outside the hook.

Added stateful invariants and edge-case tests covering fee transitions, rejected operations, settlement, token balances, and allowances.

Offline verification passed: 44 tests, 0 failures, including 65,536 randomized handler calls.

Only test/ changed. No reproducible defects found.

Wrote .imd-findings.json with two reproduced, deduplicated findings:

• Medium: Manifest fee cannot initialize the dynamic-fee hook.
• Low: 45 dependency hashes mismatch shipped files.

Coverage: 13/13 entry points. Offline Foundry suite passed.

Reproduced the blocker: the hook requires fee 8388608, but the schema caps it at 1000000. No compliant manifest-only fix exists.

Left launch.json unchanged and recorded the evidence in .imd-responses.json, using disputed only for in-scope fixability.

Offline forge build succeeded; all 39 local tests passed. Deployment remains blocked pending schema/deployer support.

Wrote .imd-findings.json.

Both prior findings remain reproducible: the medium manifest blocker and low dependency-hash advisory. Duplicates merged; no new findings.

Coverage: 13/13 entry points. All 44 local test groups passed. Source and configuration files unchanged.

The blocker reproduces: the hook requires fee 8388608, while the schema caps it at 1000000. No manifest-only fix satisfies both.

Left launch.json unchanged and recorded the unresolved finding in .imd-responses.json.

forge build and all 39 local tests passed, including the rejection reproductions. Deployment remains blocked pending schema and deployment-path support.

Wrote .imd-findings.json.

Both earlier findings remain reproducible:

• Medium: manifest fee prevents initialization.
• Low: 45 dependency hashes mismatch.

Duplicates merged; all 13 entry points covered. All 44 local test groups passed. No new defects reported; protected suites were not executed.