The committed tree builds and passes offline from a fresh clone, so the deliverable is complete.

Summary

Delivered a root-level Foundry project for the Locker farming platform, committed on main.

Contracts in src/:

• LaunchToken: standard fixed-supply LOCKER, 10^27 units minted to the deployer, no admin surface.
• LockerFarm: one isolated pool per staked token. Synthetix-style LOCKER emissions over 30-day epochs plus a fee-per-share accumulator for the 10% withdrawal fee (9% to other depositors, withdrawer excluded even on partial withdrawals, 1% to Treasury, all 10% to Treasury when alone). Separate renounceable emissions-manager and guardian roles. Funding never changes emissions, and every schedule change is reserve-checked so principal and accrued rewards can never back emissions.
• LockerFarmFactory: owner creates or registers farms later without touching existing ones. Renouncing ends farm creation permanently.
• LockerTreasury: owner vault for fee shares and the post-launch 50% supply, refills farms, two-step ownership that cannot be renounced, no power over farms.

Launch wiring: LaunchToken, then LockerTreasury ($owner, $token), LockerFarmFactory ($owner, $token, $contract:LockerTreasury), LockerFarm for LOCKER staking ($token, $token, $contract:LockerTreasury, $owner). Constructors make no external calls. A scratch simulation of the protected launch floor passed, including the forbidden-opcode scan and supply check.

Verification results (forge 1.8.3, solc 0.8.26): 87 tests pass with and without the verifier's fuzz seed, plus a 1000-run fuzz pass. forge build and forge fmt --check are clean. A fresh clone of the commit tests offline. The invariant suite caught a real 1-wei insolvency from fee rounding dust during development, which I fixed by keeping dust in the farm instead of sending it to the Treasury.

Documented in README.md: launch parameters, roles and renouncement, chosen constants, after-launch owner steps (create IMD and sIMD farms, register the LOCKER farm, fund Treasury, start epochs), trust assumptions, and limitations such as rebasing tokens being unsupported.

Decisions to flag for review:

• IMD and sIMD token addresses were not in my inputs, so those two farms are created by the owner after launch through the factory rather than deployed at launch.
• The brief says "paired with IMD" but the launch section fixes the pool pair as native ETH and the fee at 1.25%. I left both to the launch and noted the conflict in the README.
• ABIs are exported to docs/abi/. The website, launch.json and deployed addresses belong to later stages and are not in this tree.

Done. launch.json is written and verified; the only change in the tree is that new file.

What the manifest describes (kind evm_project, token LaunchToken "Locker" / "LOCKER", 18 decimals, no constructor args):

The pool block is exactly as the "This launch" section gives it: native ETH as the zero address, fee 12500, tickSpacing 60, initialPrice "79228162514264337593543950336". Notes are 1451 characters and explain each contract's role and that every owner or admin argument resolves to $owner.

Verification

• Each contracts entry was cross-checked against the exported ABI in docs/abi: argument counts match the constructors, every reference lands in an address-typed parameter, and every $contract: reference points backward. Names are unique, under 32 characters, and avoid the reserved identifiers.
• The IMD and sIMD farms are not listed because the accepted tree does not deploy them at launch. The owner creates them through the factory after launch, as the README states.
• forge build compiled cleanly and forge test with the verifier's fuzz seed passed all 87 tests with 0 failures.
• git status shows only the untracked launch.json. No configuration, source, or dependency file was touched.

I found two medium defects and one low in the farm's fee economics, all in src/LockerFarm.sol. They're in .imd-findings.json with a coverage row for all 31 entry points, plus two invariant rows. Both medium findings come with a Foundry proof that fails on the current code. I ran each proof on its own and both failed for the stated reason; the scratch tests have since been deleted. The project's own tests pass (87).

Findings

1. Medium — the withdrawer can take back the fee meant for the Treasury (LockerFarm.sol:448, in _withdraw). Any nonzero balance counts as an "other depositor" when someone withdraws. So a sole staker can deposit 1 wei from a second wallet before withdrawing, and that wallet collects the whole 9%. In the test, a 1,000,000 LOCKER exit left the Treasury with 10,000 instead of 100,000, and the second wallet got 90,000 for its 1 wei. This breaks two rules in the brief: "prevent self-fee rewards" and "all 10% to Treasury if no other eligible depositors".
2. Medium — a last-second deposit takes most of the fee from existing depositors (LockerFarm.sol:209). There's no deposit fee and a new deposit shares in fees immediately. It pays whenever the withdrawal is larger than about 1.11× everyone else's stake.
   • In the test: whale 1,000,000, Alice 100,000; a sniper deposits 200,000 just before the whale withdraws, then exits.
   • The sniper nets +40,000 LOCKER, and Alice ends with 48,000 instead of 90,000.
3. Low — tokens sent straight to a farm are stuck forever (LockerFarm.sol:325). If the owner sends LOCKER to a farm with a plain transfer instead of fundFarm, it can't be used or recovered. Rounding leftovers from the fee and reward maths end up stuck the same way.

The fixes for 1 and 2 are a minimum stake or a minimum time in the pool before a deposit shares in fees. Either one changes the brief's economic rules, so the requester has to approve it.

What holds: emission scheduling (startEpoch, boostEmissions, setRewardRate) can only commit funded reward balance. Rewards earned while nobody is staked go back into it. User deposits and earned rewards can't be reached by any role, and renounced roles can't be restored. The divide-before-multiply lines static analysis flagged are deliberate rounding down, and the leftover goes back to the reward balance. The strict-equality and reentrancy lines it flagged didn't reproduce as problems.

Not covered: I couldn't check whether sIMD is a rebasing or fee-taking token; if it is, its farm's accounting would need another look. There's no launch.json in the tree yet, so I didn't review a manifest.

I changed no project files. forge build left its usual cache/ and out/ folders, which git ignores.

The review is complete. Findings are in .imd-findings.json with 3 findings and 33 coverage rows, snippets verified against the tree, scratch removed, and no source file changed.

What I covered. The Execution Trace, Periphery and First Principles passes over all four contracts, the deploy script and the interface. I traced every LockerFarm path through the two accumulators, including the same-token LOCKER farm, no-staker recycling, epoch rollover, boosts, rate changes and the partial-withdrawal self-exclusion. The full suite passes (87 tests), the four docs/abi exports match forge inspect exactly, and constructor wiring uses $owner everywhere with no external calls, so it runs on an empty chain.

Findings.

• Low, LockerFarm.withdraw: the self-fee exclusion and the sole-depositor rule are per address. A depositor who parks 1 wei in a second wallet captures the full 9% of their own fee and the Treasury gets 1% instead of 10%. Reproduced with concrete amounts. It is inherent to proportional redistribution, so the fix is a scope decision for the author.
• Low, LockerFarm.returnUncommittedRewards: after the emissions manager renounces, uncommitted reserve has no exit at all. Funding stays permissionless and no-staker emissions keep recycling into the reserve, while return, epoch start and recovery all revert. A minimal fix is to let anyone return reserve to the immutable Treasury once the role is zero.
• Info, README pool pairing: the README asserts the launch pairs with native ETH while the brief specifies a LOCKER/IMD pool. No manifest exists yet. The manifest step should take the paired currency from its own launch section, not from that sentence.

Static analysis leads. Divide-before-multiply, strict equalities, timestamp use and the reentrancy flags all traced to guarded or intentional code, so none became findings.

Not reached. No defect was found in the core fee or emission arithmetic. I did not run extended fuzzing beyond the project's own invariant suite.

I couldn't commit because this machine has no git author identity, and I didn't change the git config to get around that. The three new test files are staged in the working tree for the upload step to collect.

What I added (tests only)

All 121 tests pass on forge test with the verifier's fuzz seed, not counting the scratch proof. That is the 87 that were already there plus 34 new ones.

• test/LockerFarmEdgeCases.t.sol (33 tests), covering:
  • Epoch timing: the end of a 30-day epoch, starting a new epoch exactly at periodFinish, startEpoch(0), and a boost in the last second.
  • Reward splits and pauses: rewards split exactly by stake and time; setRewardRate(0) stops payouts and returns what's left to the reserve; the emissions manager can't pull back rewards users have already earned; rewards from periods with no stakers aren't lost.
  • Withdrawal fees: whoever withdraws never earns a share of their own fee, even when the only other stake is 1 wei, across repeated partial withdrawals, and after a full withdrawal and redeposit. Fuzzed fee splits across four depositors check the 9% stays proportional and nothing is over-promised.
  • Tokens that charge a fee on transfer: the farm credits only what it actually receives, for both staking and reward tokens.
  • Separate farms: activity in one farm doesn't change another.
  • Roles after transfer or renounce: an old holder can't act, nobody can act as address(0), and renouncing farm creation also clears any pending new factory owner.
  • Failure paths: duplicate or invalid farm registration in the factory, plus Treasury funding failures and leftover allowance.
• test/LockerMultiFarmInvariant.t.sol: random-sequence invariant tests over the IMD farm and the LOCKER farm together. Five users, Treasury refills, epochs, boosts, rate changes, pausing and renouncing the guardian. 128 runs × 64 calls. They check:
  • each farm can always pay everything it owes;
  • fees paid out never exceed fees collected;
  • rewards never exceed what was funded;
  • token balances add up exactly, including the Treasury's;
  • the LOCKER supply never changes;
  • after every call: the 90% payout is exact, nobody earns from their own fee, one farm never changes another's state, the per-share counters never go down, and a renounced guardian is never used or restored.
• test/mocks/FeeOnTransferToken.sol: a test token that burns 1% on each transfer.

Problems found, in .imd-findings.json

• Medium: a depositor can grab withdrawal fees by depositing just before a big withdrawal. In the reproduction, a whale has 1000 IMD and a long-term depositor has 10. An attacker deposits 290 just before the whale withdraws, then exits straight away and ends with 348 IMD (+20%). Most of that is the 9% fee that should have gone to the long-term depositor. The brief's "split among other depositors" rule allows this, but it is a leak. The finding includes a test that fails on the current code.
• Low: the 10% fee rounds down, so withdrawals under 10 wei pay no fee at all.
• Info: farm roles (emissions manager, guardian) are handed over in one call, so a mistyped address loses the role for good. The factory and Treasury use a two-step handover.
• Info: a staking token whose balances rebase on their own, which sIMD might be, would break the farm's books. A negative rebase would leave the last people to withdraw unable to get their funds out. Someone needs to confirm which sIMD contract is meant.

One problem I found was in my own test, not the contract: in an early version the pause test almost never actually paused. I fixed it, and the pause path now runs with 0 reverts.

The review is complete and .imd-findings.json holds 3 findings plus a 34-row coverage record covering all 31 entry points and 3 checked invariants. No source files were changed; only the findings file and scratch tests under test/scratch/ were written.

What I covered. Every division, multiplication and accumulator in LockerFarm against the Math Precision, Boundary and Numerical Gap guides: the 10%/9%/1% fee split, the fee-per-share and reward-per-token accumulators, epoch rate derivation, boost and re-rate conservation, overflow headroom under the 1e27 supply, zero and 1 wei inputs, and the LOCKER farm where staking and reward tokens coincide. A 256-run solvency fuzz plus the repository's 87 existing tests all pass. The Slither divide-before-multiply and strict-equality leads are false positives: the remainder of each division is returned to the reserve exactly, and the equalities are zero-amount guards.

Findings.

• Medium, LockerFarm.sol:448. Fee eligibility is decided per address only. A sole staker exits through a second address holding 1 wei and keeps 99% instead of 90%, since the sybil's 1 wei exit pays zero fee and collects the whole 9% share. The Treasury receives 10 LOCKER on a 1,000 LOCKER withdrawal where the brief promises 100. A sandwicher depositing 400 before an honest 1,000 withdrawal against 100 of other stake nets +32 and cuts the honest staker's fee from 90 to 54. The brief says "prevent self-fee rewards", but the fix is a design choice such as minimum stake age or time-weighted shares, so it is flagged as a scope decision.
• Low, LockerFarm.sol:445. The withdrawal fee floors. Withdrawals under 10 wei pay nothing and the 9/1 split rounds against the Treasury. Dust for 18-decimal tokens, but a cheap bypass if a low-decimal staking token is added later, and it is what makes the sybil exit above free.
• Low, LockerFarm.sol:325. Staking or reward tokens sent to the farm by plain transfer, and the per-share rounding residue, are locked forever because recoverERC20 refuses both tokens and no liability covers them.

Not reached. Nothing in my area. Rebasing behaviour of the live sIMD token could not be checked since its address is not in the tree; the README already requires a non-rebasing form.

Review complete. The findings file is written at .imd-findings.json with four findings and 36 coverage rows, one for each of the 31 listed entry points plus five invariant rows. The only untracked paths git reports, .github and scripts, are device nodes the sandbox mounted, not files I created; my scratch tests under test/scratch/ and the findings file are gitignored.

Findings, by severity:

1. Medium, fee capture by a same-block 1-wei stake at src/LockerFarm.sol:448. The 9% redistribution is split by principal at the instant of withdrawal with no stake age, no minimum, and a fee that floors to zero under 10 wei. When the withdrawer is the only real depositor, a 1-wei deposit by a front-runner or by the withdrawer's own second address takes the whole 9% that the brief routes to the Treasury, then exits for free. This breaks both "prevent self-fee rewards" and "if no other eligible depositors exist, all 10% goes to Treasury". The attached proof test fails on the current code with the Treasury receiving 10,000 instead of 100,000 LOCKER.
2. Low, reserve stranded after renounce at src/LockerFarm.sol:343. Renouncing the emissions manager with a non-zero reserve locks it forever, and fundRewards keeps accepting LOCKER into a renounced farm.
3. Low, README pool pairing conflicts with the brief at README.md:150. The brief requires the LOCKER/IMD pair; the README tells the manifest step to use native ETH. No launch.json exists yet, so this is guidance for that step.
4. Info, single-step farm role transfer at src/LockerFarm.sol:336. A mistyped address has the same irreversible effect as a renounce. Recorded as a trust assumption.

What held in my area. Every privileged function has the guard its role implies. No constructor uses msg.sender or tx.origin. Renounced roles cannot be restored through the factory, the Treasury, or any setter, and the factory's pending owner is cleared on renounce. The Treasury has no privilege over any farm. recoverERC20 is permissionless but can only move foreign tokens to the immutable Treasury and the farm holds no approvals, so there is no confused-deputy path. Every emission commit path draws only from the funded reserve. The four ABI exports match the compiled artifacts exactly.

Not reached. The manifest itself, since none exists in the tree, and the live sIMD token's rebasing behaviour on the target chain.

The findings file is written, every snippet matches the tree, and the attached proof was run and fails on the current code. Nothing outside .imd-findings.json and the gitignored test/scratch/ was touched.

Recap

Verification run. forge build --sizes is clean (largest runtime 11.4 KB), the full suite passes with 121 tests and 0 failures, and all four specialist proofs fail exactly as their findings state when run under test/scratch/.

Findings kept, after merging duplicates (6 in .imd-findings.json, 34 coverage rows answering all 31 entry points plus three invariants):

1. Medium. Fee redistribution eligibility is instantaneous and per-address. A 1-wei stake from a second wallet or a same-block front-runner takes the whole 9% share, so the Treasury gets 1% instead of the brief's 10% on a sole-depositor exit, and a just-in-time depositor dilutes long-term stakers. Six specialist reports collapsed into this one root cause. The economics specialist's proof is attached and fails on the current code.
2. Medium. The manifest pairs the pool with native ETH while the approved brief says "paired with IMD" and "LOCKER/IMD liquidity pool". The README cites a launch section pinning ETH that is not in the tree. The finding closes if the manifest step's launch section shows that pinning. Everything else in the manifest checks out: schema keys, constructor argument order and counts, $owner on every privileged role, names, notes length.
3. Low. Renouncing the emissions manager permanently strands any uncommitted reserve, and fundRewards keeps accepting LOCKER into such a farm. Reproduced in my scratch test.
4. Low. LOCKER or staking tokens sent by plain transfer can never leave the farm. Reproduced.
5. Low. The withdrawal fee floors, so withdrawals under 10 wei pay nothing and the split rounds against the Treasury. Reproduced.
6. Info. Farm role transfers are single-step, so a typo equals an irreversible renounce.

Dropped. The rebasing-token note, because the README already documents it as unsupported and instructs a wrapped sIMD. The Slither divide-before-multiply and strict-equality lines are intended behaviour, and Aderyn's reentrancy line is covered by the guard.

My own pass found nothing the specialists missed. The emissions accounting, self-exclusion on partial withdrawals, role renouncement guards, Ownable2Step overrides and Treasury isolation all traced as intended.

The responses file is excluded by the harness's own .git/info/exclude entry, which is expected: it sits in the repository root as the brief requires and is read from there. All work is complete.

Summary

Outcome: all five findings reproduced on the starting tree and are fixed. The reviewer's proof now passes. The suite has 106 tests, 0 failures, with and without the verifier's fuzz seed. forge build and forge fmt --check are clean.

Medium finding (fee eligibility, the proof): fee-share eligibility in src/LockerFarm.sol now has a time dimension. Stake deposited during one FEE_ELIGIBILITY_PERIOD bucket (1 day, a named constant) becomes eligible at the start of the bucket after next. Pending stake still earns LOCKER emissions and can be withdrawn (paying the fee) but neither receives fee rewards nor counts as an "other depositor". The implementation keeps at most two pending tranches per account and two global pending counters, rolled lazily, so maturation needs no iteration. Matured tranches are credited from a lazily recorded accumulator snapshot, so a passive depositor is credited exactly once from maturity onward. While testing I caught and fixed a double-credit of matured tranches that the invariant suite exposed.

Advisory findings:

• Renounce now reverts while reserve remains, funding is refused after renounce, and anyone can return reappearing reserve to the immutable Treasury.
• syncRewardReserve and recoverExcessStakingToken recover balances above tracked liabilities (new counters for emitted and claimed amounts).
• The withdrawal fee rounds up, so a 1-wei withdrawal pays and the Treasury always receives at least 1 wei.
• Farm role transfers are two-step with offer, accept and cancel; renouncing clears pending offers.

Files changed: the farm contract, its ABI export, the README (rules, roles, after-launch steps, constants, assumptions, verification), updated fee, roles, reentrancy and invariant tests, a new test/LockerFarmFeeEligibility.t.sol, and .imd-responses.json with all five verdicts marked fixed.

Residual, documented in the README: a sybil that pre-positions a second wallet more than two days ahead is indistinguishable from a genuine depositor on chain. The delay removes the free atomic variants and makes the pre-positioned one pay the fee on its own exit. Slither and Mythril were not available and did not run.

The finding is disputed and answered. The manifest keeps native ETH as the paired currency, and the only change is a clarifying sentence in its notes.

What the finding claimed: the pool should pair with the chain's IMD token because the brief says "paired with IMD", unless the manifest step's "This launch" section pins native ETH.

What I found: that section does pin it. It states that the pair is native ETH, that the paired currency is the zero address, and that admission refuses any other. The task statement for this assignment repeats the same rule. The launch facts are decided by the chain, policy and factory, and the rules require writing the pool values exactly as given. Writing the IMD pair token would be refused at admission. The conflict between the brief's wording and the pinned pairing is a policy matter for services, not something the manifest can settle.

What I changed:

• launch.json notes now quote the launch section's pinned pairing, fee, tick spacing and initial price directly instead of repeating the README, so the evidence the reviewer asked for is visible in the tree. Notes are 1,870 characters, under the limit.
• .imd-responses.json records the finding as disputed with the quoted evidence.

What I verified:

• The three constructor argument lists still match the accepted constructors in declaration order.
• The manifest has only the schema keys, the zero-address pair, fee 12500, tick spacing 60 and the given initial price.
• The build succeeds, and the test run with the verifier's fuzz seed passes all 106 tests.

No file other than the manifest and the response file was touched.

The suite passes again: forge build is clean, and forge test with the verifier's seed runs 144 tests with 0 failures (the scratch proof excluded). I also reported one medium and one info finding in .imd-findings.json.

Why 9 of my tests had broken. Since my last round, the implementation changed in three ways:

• Eligibility delay: a new deposit only starts sharing withdrawal fees after 24–48 hours.
• Fee rounding: the 10% fee now rounds up to the wei.
• Two-step role transfer: a new emissions manager has to accept the role before it moves.

My tests still assumed the old behaviour, so I updated them rather than the contract.

test/LockerFarmEdgeCases.t.sol

• In the fee tests I now wait out the delay before checking who gets the 9%.
• The fee fuzz test now expects the rounded-up fee, so even a 1-wei withdrawal pays.
• The role test now checks that the old manager keeps the role until the new one accepts, and that strangers can't accept.
• New tests for the delay:
  • Exact boundary: stake is still left out one second before it becomes eligible and counts from that second.
  • Top-ups: adding to a stake doesn't reset the part already eligible, and doesn't earn fees from before it matured.
  • Partial withdrawals: a deposit partly withdrawn during its delay matures only for what's left.
  • Model fuzz test: random deposits and withdrawals over several days, compared step by step against a simple model. Each time the other depositor withdraws, the 9% has to go to this user only if they have eligible stake, and otherwise all 10% goes to the Treasury.

test/LockerMultiFarmInvariant.t.sol

• The payout checks use the rounded-up fee.
• On every random withdrawal, it now checks two things: stake still inside its delay never receives a fee, and nobody gets more than their pro-rata share. It also checks that the Treasury gets exactly 1%, or 10% when no other stake is eligible.
• A new invariant checks that each user's eligible stake adds up to the farm's total. Time jumps are now mostly short, so the random runs often land inside the delay.

Findings

• Medium: anyone can stop the owner from renouncing a farm's emissions-manager role. Renouncing is refused while the farm's unspent reward balance is above zero. Anyone can add 1 wei to that balance, either through fundRewards(1) or by sending 1 wei and calling syncRewardReserve(). The owner needs two transactions (empty the balance, then renounce), so someone watching pending transactions can block the second one every time. The owner's workaround is to hand the role to a helper contract that does both steps at once. The proof test fails on the current code with ReserveNotEmpty(1). Separately, if an epoch is running and nobody is staked, unspent emissions flow back into that balance every block, so the renounce fails unless the owner first sets the rate to zero. The suggested fix is for the renounce to send any leftover balance to the Treasury instead of reverting.
• Info: the eligibility delay is a rule the brief didn't ask for. It is documented in the README and behaves as described. I reported it so the requester can confirm it, because someone who deposits on day N gets no fee share from withdrawals on days N and N+1.

I left the changes to the two test files uncommitted.

The findings file is written and validated: 2 findings, 43 coverage rows, snippets copied from the tree. No repository file was changed; only .imd-findings.json and my test/scratch/ files exist outside the accepted tree.

Settlement of my earlier findings

• Fee eligibility capture (medium): fixed. All four earlier proofs now pass. The time-bucketed eligibility credits a tranche only from the start of the bucket after next, and I traced the lazy bucket-start recording, the two-tranche layout, pending-first withdrawals and the global counters for every post-settle case. Two probes of my own, a skipped-bucket sequence and a two-tranche partial withdrawal, confirm per-account credits, view and settle agreement, eligible sums and solvency. The just-in-time proof now reverts inside the test's own arithmetic because the sniper ends poorer than it started.
• Pool pairing (medium): dropped. The closing condition I set was evidence that the manifest step's launch section pins native ETH. The author quotes that section verbatim and launch.json's notes now cite it. The manifest re-checks clean: schema keys only, lowercase address, numeric fee and tick spacing, string price, three unique names, constructor arguments in declaration order, notes of 1,870 characters.
• Stranded reserve (low): fixed, but the guard it added is the subject of the new finding below.
• Untracked balance (low): fixed with permissionless sync and recovery functions whose liabilities are upper bounds, so principal and accrued amounts stay unreachable.
• Fee floors (low): fixed with ceiling rounding on the fee.
• Single-step roles (info): fixed with an offer and accept pattern.

Findings this round

1. [medium] Anyone can block the emissions-manager renounce with 1 wei. The new ReserveNotEmpty guard reverts while the reserve is nonzero, and anyone can refill it between the owner's return and renounce transactions via fundRewards(1) or a 1-wei donation plus syncRewardReserve. The tester's proof fails on this code with ReserveNotEmpty(1) in both variants, and I attached it. A running epoch with no stakers also refills the reserve every second, so even without an attacker the renounce fails unless the owner zeroes the rate first. Suggested fix: sweep remaining reserve to the immutable Treasury inside renounce instead of reverting.
2. [info] The one-to-two-day eligibility delay is an added economic rule that the requester should confirm, since a depositor earns nothing from withdrawals made on the deposit day and the next.

All 35 entry points are answered, 32 as holds and 3 pointing at finding 1. The full suite passes with the pinned fuzz seed at 144 tests. The static-analysis leads were checked and none reproduces as a defect beyond what finding 1 covers.

The revision is complete. The shell sandbox on this machine refused to start every process, so I could not run forge myself; the job's own check harness is what built and ran the previous attempt, and its output is what I worked from.

What the harness run showed

• The contract fix for the reopened finding was already in the tree and compiled. renounceEmissionsManager in src/LockerFarm.sol now sweeps any uncommitted reserve to the immutable Treasury instead of reverting, so a 1-wei fundRewards, a donation plus syncRewardReserve, or emissions recycled over a no-staker second can no longer block the renounce.
• 107 of 110 tests passed. The three failures were all in the new role tests and all reverted NotEmissionsManager.

Cause of the three failures and the repair

The tests called imdFarm.returnUncommittedRewards(imdFarm.rewardReserve()) right after vm.prank(OWNER). The inline view call consumed the prank, so the real call came from the test contract and was refused. This was a fixture bug, not a contract bug. In test/LockerFarmRoles.t.sol the reserve is now read into a local before the prank in all three tests, matching the pattern the passing role tests already use. I traced each test against the contract by hand. All three reach the renounce as the owner and their assertions hold, and the reviewer's proof scenarios are identical to two of them.

Other changes this round

• README.md verification section now records that the harness built this revision, what the three failures were, and that the author could not run forge in either round.
• .imd-responses.json answers both findings. The medium renounce-blocking finding is marked fixed with the mechanism and tests. The advisory fee-eligibility finding is marked disputed in the sense of "no change": the code and README already document the one-day period as the requester's decision to confirm, and changing an economic parameter without their answer would not be justified.

Still open

The verifier's run is the authoritative result for forge build, forge test, forge fmt --check and the reviewer's proof. Nothing else is outstanding for this task.

The revision is complete. The manifest at launch.json is the only changed file.

What I checked

• The brief listed no review findings, so I compared the accepted manifest against the current tree. The only source change since my last round is in LockerFarm.sol, where renouncing the emissions manager now sweeps uncommitted reserve to the Treasury instead of refusing while reserve remains. No constructor changed.
• All three constructor argument lists match the source and the ABI exports in docs/abi: LockerTreasury(owner, token), LockerFarmFactory(owner, token, treasury), LockerFarm(token, token, treasury, admin). Every reference points backward and fills an address parameter.
• Schema shape validated with a scratch script: only allowed keys, unique names under 32 characters, no reserved names, pool fields exactly as the launch section gives them, notes under 4000 characters.
• forge build succeeds and forge test with the verifier's fuzz seed passes 110 of 110 tests.

What I changed

• One sentence in notes now describes the accepted LockerFarm role behavior: renouncing the emissions manager returns uncommitted reserve to LockerTreasury in the same transaction, and the guardian can pause only deposits. Everything else in the manifest is untouched.

Token, contracts, and pool fields are unchanged from the accepted version. The pairing stays native ETH per the launch section, with the notes already explaining why that overrides the brief's IMD wording.

The new version of renounceEmissionsManager holds up under my tests, and I found no defects, so there is no .imd-findings.json. The full suite passes: 151 tests, 0 failures, both with the verifier's fuzz seed and without it.

Since my last round, the builder changed renounceEmissionsManager. It no longer refuses when reward tokens are still sitting unassigned in the farm. Instead it settles rewards up to the current moment and sends that leftover to the Treasury in the same transaction. All the existing tests already passed on the new code, so I only added coverage for the changed behaviour. Only my two test files changed, and the existing code in them is untouched.

test/LockerMultiFarmInvariant.t.sol (random call sequences over both farms):

• Renounce at random points: the handler now sometimes renounces a farm's emissions manager wherever the sequence happens to be. After each renounce it checks:
  • the Treasury received exactly the leftover reserve, including rewards that built up while nobody was staked;
  • the reserve is now zero;
  • the running reward period, its rate and end time are unchanged;
  • each user's stake, earned rewards and fees are unchanged;
  • the role and any pending offer of it are cleared.
• Renounced roles stay renounced: once a farm is renounced, the handler tries to take the role back or use it. The old manager can't start, boost or re-rate rewards. Nobody can offer or accept the role. New funding is refused. Returning reserve to the Treasury becomes open to anyone.
• Existing invariants updated: the token-conservation and solvency checks now count what the renounce swept, and the roles invariant expects an empty manager after a renounce.

test/LockerFarmEdgeCases.t.sol:

• testFuzz_renounceSweepsExactlyAndStrandsNothing (1000 runs) renounces before, during or after the reward period, with a staker present, gone or never there. It checks the sweep amount exactly. It then runs the period out: the staker leaves with exactly what they earned, a stranger sends anything left over to the Treasury, and only rounding dust may remain.
• test_pendingOffereeCannotAcceptAfterRenounce: a pending offer of the role dies with the renounce, and renouncing twice reverts, including from address(0).
• test_onlyEmissionsManagerCanRenounce: the guardian, the Treasury, the factory, a stranger and address(0) can't trigger the renounce.

To check the new tests can actually fail, I briefly edited a local copy of src/LockerFarm.sol to break the renounce, then restored it from git.

• When the renounce settled nothing first, the new fuzz test failed at once. The random sequences alone didn't catch that one, because renouncing on an empty farm mid-period is rare there; that's why I added the fuzz test.
• When the renounce sent nothing to the Treasury, the invariant suite caught it.

src/ is unchanged.

The review is complete. Both earlier findings are settled and the record is written to .imd-findings.json with no open findings and a full coverage record.

Settled findings

• Medium, renounce blocked by 1 wei in the reserve: fixed. The revised renounceEmissionsManager in src/LockerFarm.sol:444 accrues, sweeps any uncommitted reserve to the immutable Treasury, then clears the role and pending offer. I copied my proof from .imd/reads/proofs into test/scratch and ran it against this code. Both tests now pass, in the fundRewards(1) variant and in the 1-wei donation plus syncRewardReserve variant. The no-attacker variant, where a running epoch recycles emissions with nobody staked, is covered by the author's test that renounces one second after a return and sees the recycled 1e18 wei swept with the rest of the epoch still backed. The regenerated ABI matches the compiled contract exactly, with the old ReserveNotEmpty error gone. The README role table and operating sequence describe the single-transaction renounce.
• Info, one-day fee-eligibility delay: dropped. The author did not change it, and I agreed in the original note that it is not a defect. It stays in the README as the one economic parameter for the requester to confirm.

Verification run

New this round

The manifest launch.json is new and I checked it against the schema rules. Keys, name lengths, uniqueness, types, lowercase address and notes length are all within limits. Each constructorArgs list matches its constructor in declaration order, dependency order is right, and every privileged role resolves to the launch owner. The paired currency is the zero address, which the notes attribute to the manifest step's own launch section. I could not see that section, so I recorded it as holding on that statement, with admission as the check that refuses a wrong pair.

The protected harness tests import a floor file that only the verifier supplies, so I did not run them locally. No new defect was found. The scratch directory was removed, so the tree is unchanged apart from the findings file.

Implemented the frontend, static export and verified deployment manifest.

Validation passed: build, typecheck, 10 unit tests, 25 browser checks and 16 design checks. Export is under 0.9 MB; submission size is below 8 MiB. No transactions were broadcast.

Setup and documentation · Validation evidence · Design specification

WebKit testing was unavailable due missing system libraries. DESIGN.md is under docs/ to respect the write scope. Files are ready for publisher submission; Git metadata is read-only here.

Recorded both findings in .imd-findings.json. Website source and export remain unchanged.

• Medium — bug: failed farm reads appear as missing setup. A previously working IMD farm becomes “Awaiting setup” after its reads fail. Retain the known farm with an unavailable/retry state.
• Medium — bug: navigation clears a pending transaction’s lock. Leaving Farms and returning enables the action before its receipt arrives. The delayed-receipt fixture accepted two claimFees submissions.

Locker is a farming dashboard carried by one visual idea: golden pixel treasure chests inside a dark stone vault.

The checklist below groups repeated requirements from the brief.