Delivered the pinned BEG/BegVault contracts, six funding regression tests, ABI exports, and deployment documentation.

Validation passed: forge build, all 125 tests with the supplied seed, forge fmt --check, and ABI consistency checks.

The README documents wallet funding, keeper responsibilities, randomness risks, and the unsupported toleranceBps field.

I found two economic issues in BegVault and wrote them to .imd-findings.json, with a coverage row for each of the 13 entry points and two for the accounting invariants. I ran both reproductions with Forge in test/scratch/ and then deleted them; the source tree is unchanged.

Finding 1 (medium): one player using many addresses can drain most of the vault cheaply — src/BegVault.sol:427

• Each entry's expected prize is a fixed share of the free vault balance: about 0.03% at score 100 and about 0.002% at score 0. Buying more entries doesn't make each one cost more.
• A player who supplies most of the entries gets about 84% of their ETH back through jackpot payouts and reveal bounties. What they actually lose is the team's 10%, the ETH left in the jackpot bank, gas and the oracle fee.
• The 10-minute cooldown is per address, and duplicate checks only catch identical text, so neither stops this.
• Reproduction: with the test setup's 800M BEG in the vault, I made 3,000 entries from 3,000 addresses (150 full batches, all graded 100), then revealed each batch:
  • paid 15 ETH and got 12.65 ETH back;
  • won 482,331,868 BEG: 60% of the vault, 48% of total supply, and 4.8 times the pool's 100M BEG;
  • spent 75 IMD on oracle fees.
• The brief sets the entry price and prize percentages, so the fix is your decision. Options include smaller tier shares, a cap on payouts per batch or per period, keeping more of the entry ETH out of the jackpot, or a global limit on entries.

Finding 2 (low): letting the reveal window lapse gives a fresh roll — src/BegVault.sol:395

• The code comment says skipping a reveal "cannot buy a better one". After 256 blocks, the next reveal call re-arms the roll with a new blockhash and removes only the top tier. An entry that drew Nothing can therefore draw Epic, Rare or Common on the second try.
• Reproduction: one entry, graded 100. With blockhash 8 the entry gets Nothing. Instead, nobody reveals until block rollBlock + 257; that call re-arms. With the new blockhash 25, the entry gets Epic (400,000 BEG). The scratch test asserting Epic passed.
• docs/SECURITY.md already says withholding isn't fully prevented. This gives the concrete case so you can decide on a fix.

Coverage:

• attempt and reveal are marked as having findings.
• Every other BegVault entry point and all three LaunchToken functions hold. That covers refunds, expiry, claims and the oracle callback.
• Both accounting invariants hold: the vault's ETH balance equals the sum of the escrow, jackpot bank, bounty budget and claimable ETH, and its BEG balance equals free plus claimable.
• The ETH split on grading and the tier odds and prizes match the brief.

Not reported: for these, I either couldn't show a concrete failure or the docs already disclose them:

• The toleranceBps setting from the brief is missing from the oracle request. docs/SECURITY.md discloses it as a conflict with the oracle's request format.
• A tiny BEG donation can open play before the vault is funded. Prizes are worked out at reveal time, so I found no loss from it.
• While the oracle has no IMD, the 20th entry in a batch reverts. Those batches time out and are refunded, so this is a liveness issue rather than a loss.

There is no launch.json yet, so I didn't review a manifest.

The findings file validates: both snippets match the tree and all 13 entry points plus 5 invariant rows are covered. The scratch directory is removed and the working tree is otherwise untouched.

Outcome: no reproducible math, boundary or numerical-gap defect in BegVault or its libraries. The file .imd-findings.json holds two informational notes and an 18-row coverage record.

What I checked in the assigned area, with the full suite (121 unit/fuzz tests plus both invariant suites) green under the pinned seed:

• Odds and prizes. The basis-point formulas reproduce the brief exactly (1→200, 200→1300, 800→3000, 2000→3500, Nothing ≥ 2000 at a perfect score, no underflow). Prize divisors 50 000, 10 000, 2 000 and 100 give 0.002%, 0.01%, 0.05% and 1% of the free balance, and the jackpot takes half the bank, all rounding down with free -= tokens unable to underflow.
• ETH split. Escrow is price times size, which is exact for a tenth at 0.005 ETH; the bounty share is capped at 0.001 ETH; every narrowing cast (uint88, uint96, uint128, uint160 score packing) is bounded by the constructor's 2^80 price cap or the 1e27 supply.
• Boundaries. The 30-minute, 24-hour, 5-minute tolerance and 256-block windows use the same inclusive comparators in attempt, _close, onOracleResult and expireBatch. The closing-entry binary search relies on a monotone invariant that holds because every batch below the open one is non-empty.
• Encoders. The UTF-8 validator's word-parallel masks, the JSON escape bound, the SSTORE2-style initcode, the RLP nonce derivation and the body buffer capacity were traced byte by byte. The aderyn shift-order, hash-collision and cast leads and the slither uninitialized-local leads are all rejected.

The two informational notes are a documented view quirk (an expired, never-closed batch reports its open time as closedAt) and the brief's toleranceBps 1000, which the canonical body schema does not accept, so the code is right to omit it and the brief's summary is the conflicting side. The one lead I left unreported is the unbounded cursor walk in _advanceCursor, which needs roughly 16,700 skipped batches and only harms the entrants who declined to expire their own batch for a year.

Review complete. The findings file is written at .imd-findings.json with 4 findings and a coverage row for all 13 listed entry points plus 3 invariant rows. The working tree is otherwise unchanged (the findings file is untracked and scratch tests were removed).

What I covered

Area: Execution Trace, Periphery and First Principles over src/BegVault.sol, src/OracleAttestation.sol, src/libraries/MessageJson.sol, src/LaunchToken.sol, the ABI exports and README/SECURITY claims. The build succeeds, all 125 existing tests pass with the pinned fuzz seed, and the ABI export check passes. I traced every state-changing entry point through its guards, state transitions and failure paths, checked the batch cursor invariants, nonce/CREATE pointer bookkeeping, ETH and token conservation, and the oracle callback binding. Two things I could not settle by reading I measured with scratch tests:

• A fully cold first 20-entry callback uses 163,631 of the 200,000 gas stipend, so it holds.
• The JSON escaper matched an independent UTF-8 validator/escaper over 6,000 fuzz cases: same validity, same bytes, bound never below actual, exact round trip.

Findings

1. Low. _advanceCursor walks every batch between nextToClose and the open batch once the stuck batch is expired. Measured at about 2,560 gas per intervening batch (770k gas with 300 batches). After roughly 14,000 non-open batches accumulate behind a timed-out cursor batch, expireBatch of that batch exceeds the block gas limit forever, its entrants can never refund, and the no-argument closeBatch() reverts permanently. Reachable in under a year of continuous play if nobody expires the stuck batch. Impact is bounded to that batch's escrow plus the broken convenience path.
2. Info. Immutable oracle wiring per the no-owner brief: signer rotation or action retirement strands the 800M BEG and jackpot bank with no path out. Disclosed by the author; recorded as the key trust assumption.
3. Info. The brief's toleranceBps 1000 is not sent, correctly, because the canonical body schema rejects unknown keys. The workflow summary, not the code, needs correcting.
4. Info. README asserts a concrete wallet that $owner resolves to, which is not in the approved workflow. The manifest must write $owner, never that literal.

What I did not find

No reentrancy, accounting, encoding, state-machine or access defect in the core; the pinned upstream logic is sound in my area. Static analysis leads (uninitialized locals, encodePacked, weak randomness, unsafe casts) all reduced to false positives or disclosed design choices.

Created launch.json with BEG metadata, BegVault’s six constructor arguments, and the required pool settings.

• Manifest and compiled ABI checks passed.
• forge build passed with existing warnings.
• forge test: 125 passed, 0 failed.

Only launch.json changed.

Added stateful token invariants and failure-path tests for oracle validation, payment rollback, reentrancy, and timeout refunds. All changes are under test/.

Validation passed: forge build and seeded forge test — 140 tests passed, 0 failures. No new defects were reproduced.

The review is complete and the findings file is written and validated.

Outcome. The permission model of BegVault holds up: every state-changing entry point was traced for its guard, state writes and failure paths, and no unauthorized path to BEG, ETH or IMD was found. The oracle callback correctly refuses a stranger's own paid question that names the vault as callback target, which I verified by reproduction. The full suite of 125 tests passes on this tree.

Findings written to .imd-findings.json (three, none critical or high, so no proof files were attached):

• Low, line 229. Any holder of 1 wei of BEG, not just the launch wallet, can satisfy the VaultEmpty gate. After that, entries cost the full 0.005 ETH, each close burns 0.5 IMD of donated oracle budget, team still accrues its tenth, and every token tier computes to zero. Reproduced end to end: a Jackpot roll paid 0 BEG and 0.002 ETH. Suggested fix keeps the design: a minimum balance floor instead of a non-zero check.
• Low, line 398. Reveal is permissionless and outcomes are computable at rollBlock+1, so winners reveal and losers abstain. With no bounty on offer (budget below 0.001 ETH after a small batch), a Nothing batch re-arms after 256 blocks and gets up to four more draws at lower tier caps. Reproduced: a score-zero entry that rolled Nothing was re-rolled into 400,000 BEG. The builder documents this as an inherited tradeoff, so it is reported for the judge to weigh.
• Info, line 608. The request body omits the brief's toleranceBps 1000. The supplied oracle reference lists no such key and says unknown keys refuse the request, so the omission looks correct, but it is a policy conflict the requester should explicitly accept.

Coverage. All 13 listed entry points have a row, plus five invariant and configuration rows. Two entry points carry findings and the rest hold. Static-analysis leads were all checked and none reproduced as a defect. No launch.json exists in the tree yet, so the manifest itself could not be reviewed; the README's constructor table matches the ABI and the supplied oracle addresses.

No repository files were changed. The scratch test lives under the gitignored test/scratch/ directory.

The review is complete and written to .imd-findings.json (8 findings, 16 coverage rows). Nothing outside test/scratch/ was touched and git status is clean.

Outcome: no blocking defects. The code deploys under the factory model (runtime 19,754 bytes, 6 constructor args, no external calls in the constructor), the full suite of 140 tests passes, the ABI export check passes, and launch.json is schema-clean with $owner for the team beneficiary and protocol addresses matching the oracle-consumer reference table.

Specialist findings, judged. All 11 reported items reproduced against the code. I ran each in a scratch Foundry test and merged duplicates down to 8:

• Low, merged from two areas: a Nothing draw re-rolls after a lapsed 256-block window. Reproduced Nothing to Epic paying 400,000 BEG.
• Low, recalibrated from medium: Sybil ETH recapture through the jackpot bank and bounty. Reproduced at 10 batches: 67.75% of entry ETH credited back while ~5% of the vault leaves. Kept low because no other player loses funds and the rates follow the brief. It is a scope decision for the requester.
• Low: 1 wei of BEG from anyone opens paid play with zero-token prizes.
• Low: the cursor walk behind a stuck open batch grows at 2,377 gas per later batch, so the stuck batch's refunds and the no-argument close become unreachable near 15,000 batches.
• Low: immutable Intake, action id and signer conflict with the oracle-consumer reference's owner-settable rule. This is the brief's explicit no-owner choice, reported as a policy conflict for acknowledgment rather than a defect.
• Low: the batch view reports an expired-open batch's open time as its close time.
• Info, merged from three areas: the brief's toleranceBps is correctly omitted from the body. The workflow summary is the side to correct.
• Info: the README asserts a literal wallet for $owner with no source in the workflow.

My own pass found nothing the four missed. Static-analysis lines were checked and none hold up as defects: the shift order, packed-encoding and casting flags are correct code, and the randomness and reentrancy flags are disclosed design or guarded.

Implemented source, static export, runtime manifest, and documentation.

• Passed 11 logic tests, 22 browser scenarios, and all 16 design checks.
• Verified both ABI hashes and all 17 exported assets.
• Live reads and quotes checked; no real transactions sent.
• Evidence: VALIDATION.md. Design documentation is under docs/ to respect the write scope.

Git staging failed because .git is read-only. Files remain uncommitted, and final Git bundle size verification is still required.

Recorded two medium findings, no high findings, in .imd-findings.json:

• Bug: successful transactions report “State refreshed” even when subsequent reads fail and balances remain cached.
• Fidelity: populated feed entries lack the requested chat bubbles and stamped scores.

Each finding includes an exact source citation, proposed change, and concrete browser reproduction. Website files remain unchanged.

Validation passed: typecheck, 11 logic tests, 21 Chromium scenarios, WebKit’s primary flow, live RPC reads, a read-only swap quote, and all 17 exported asset hashes. The isolated rebuild matches the committed export byte-for-byte. No real transactions were broadcast.

The visual idea is clear: an Ethereum begging game watched by a violet dotted eye, with gold marking actions and the jackpot.

Counts below group related clauses. Contract-stage items use inherited evidence; they were not independently re-audited.