Implemented Launcher, Kiln, vendored dependencies, an offline salt miner, tests, and deployment documentation.

• forge build, forge test, and forge fmt --check pass.
• All 35 tests pass.
• Kiln runtime: 5,906 bytes, below 12,000.
• No transactions broadcast.

Documented one necessary correction: with ETH as currency0, a ZTO-only range belongs below the opening tick; an above-price range holds ETH.

Created launch.json with Launcher and the three supplied Sepolia addresses. Kiln is created later through Launcher.open().

Manifest structure and constructor ABI checks passed. forge build succeeded with existing lint warnings; all 35 tests passed.

Only launch.json changed.

The findings file is valid, every snippet matches its cited line, and the only files touched are the findings file and my scratch test (both are permitted paths).

Review complete. Findings are in .imd-findings.json at the repository root.

What I reviewed. Access Control, Trust Gap and Asymmetry passes over both contracts, following the Pashov mindset and guides. I traced all eight ABI entry points plus four invariants. The build is clean, all 35 existing tests pass, and the Kiln runtime is about 5.9 kB. I also read the vendored PoolManager and Hooks library to confirm the four cut cases settle as claimed.

No critical, high or medium defects. The permission model is sound. Every hook callback is guarded by onlyPoolManager plus an exact pool-key check. The unlock callback can only be reached through the Kiln's own collect() call. No approvals held by the Kiln can be spent by a third party. There is no admin, withdraw, pause or upgrade path.

Six findings, three low and three info, each with a concrete reproduction:

1. Low. buy() has no zero-price guard mirroring sell()'s ZeroBid. When reserve is below 50 wei, every inventory piece is free. Dust impact, but the branch pair is not mirrored.
2. Low. sell() and buy() have no price bounds. A caller accepts whatever bid or ask is live when the transaction is mined. Ordering risk, not extraction. The brief fixes the signatures, so a fix is a scope decision.
3. Low. The Kiln's own inventory lets a 0-piece whale rent a 21-piece pass in one transaction. Measured rent was about 54.7 ZTO against a 130 ZTO cut avoided on a 10,000 ZTO swap. Economic consequence of the documented tx.origin rule.
4. Info. open() is front-runnable, as the README says. I verified an empty pool's price can be moved freely afterwards, so no harm results.
5. Info. Price-limited swaps revert for cut-paying tiers on the two ZTO-specified cases but fill for tier 21. Documented in the README.
6. Info. sell() and buy() cannot be composed inside another PoolManager unlock while claims are outstanding. Documented.

Verification. Findings 1, 3, 4 and 5 are each demonstrated by a passing scratch test in test/scratch/Review.t.sol. Finding 2 uses the numbers from the existing Pieces test. Finding 6 follows from the PoolManager's AlreadyUnlocked check, which I read but did not run.

Not reached. Nothing in my assigned area was left unreached. I did not look at the real Sepolia Pepeolithic contract's bytecode, so whether its transferFrom semantics match the mock remains a trust assumption. The static-analysis leads were all either false positives for this code or covered by existing tests.

Added failure-path tests, arithmetic edge cases, and multi-wallet reserve/claims/inventory invariants under test/.

Verified:

• forge build passes.
• forge test: 53 passed.
• Invariants: 256 sequences, 24,576 calls, zero unexpected reverts.

Documented the ZTO-only range-direction mismatch. No new implementation defects found.

The review is complete. .imd-findings.json is written in the repository root with one finding, one proof test, and twelve coverage rows. No source files were changed; only test/scratch/ holds my working tests, which the ignore rules exclude.

Finding (medium): Launcher.open() can be denied by anyone. The pool key only depends on public data, since the salt is visible in the pending transaction and initCodeHash() is a view. The Kiln has no initialize permission bits, so PoolManager accepts the key while nothing is deployed at the predicted address. A front-runner calls initialize with that key first, and the operator's open then reverts with PoolAlreadyInitialized at src/Launcher.sol:47. That salt is burned, and each newly revealed salt can be blocked the same way for about 60k gas per attempt. No funds are at risk, but the one-shot launch has no recovery path. The proof test fails on the current code as claimed. I also verified against the real PoolManager that a minimal fix works: skip initialize when slot0 already holds a price, which is safe because an empty pool's price can be moved by anyone with a zero-delta swap, so the pre-set price is not sticky.

What held up in my area. I traced all four swap orientations through the vendored Hooks library: the cut always lands on currency1, the mint offsets the hook delta exactly, the partial-fill check reads the pre-hook swap delta, and the gross-up formulas match the rate within one wei. The sell, buy, seed and collect paths update state before external calls, and the reserve-backing and claims-backing invariants hold on every path. Nested-unlock reverts and partial-fill reverts are documented design choices, not defects, so I did not report them.

Periphery checks. The vendored libraries differ from the local mirror only in formatter whitespace. On Sepolia, all three dependency addresses have code, and the Pepeolithic rehearsal contract answers balanceOf and reports ERC-721 support.

Static-analysis leads. The ERC-20 interface warning is a false positive on an ERC-721 interface, the uninitialized locals are intentional zero defaults, and the reentrancy and unused-return lines all sit behind effects-before-interactions ordering or atomic reverts. None reproduced as a defect.

The review is complete. The findings file is at the repository root, no tracked file was changed, and the only scratch material lives in the ignored test/scratch directory.

Outcome. The Kiln's hook arithmetic, claim settlement, reserve accounting and piece market hold up under the Economic Security, Invariant and Flow Gap checklists. The existing 35 tests pass. I verified the hook delta sign and currency mapping against the vendored v4 code, and exercised both Kiln transfer paths against the real Sepolia Pepeolithic and WETH contracts on a fork. One medium finding concerns the launch itself, not the running protocol.

Findings written to .imd-findings.json

1. Medium, with proof test. Anyone can initialize the ETH/ZTO pool key with the predicted Kiln address before open() runs, because the address carries no initialize bits and v4 never checks for hook code. open() then reverts with PoolAlreadyInitialized for that salt for ever. The salt is predictable since the miner takes the first match from index 0 against public inputs. No funds are at risk, but the launch can be blocked repeatedly at the cost of one initialize per attempt. The proof test fails on the current code.
2. Low. Because bid and ask are pure functions of the current reserve and buy and sell carry no price bound, a large seed or swap cut can be sandwiched through inventory. With a 98 ZTO reserve and a 100 ZTO seed, the attacker nets about 1.75 ZTO. Profit exists whenever the inflow exceeds roughly 12.7% of the reserve. This follows from the mandated formulas, so it is reported as a design property to document or mitigate operationally.
3. Info. A front-runner can open the pool at an extreme price. Recovery via a zero-liquidity swap works only through the afterSwap paths or a 21-piece wallet, and the README does not describe it.
4. Info. The Sepolia rehearsal collection is named Ochre, has only ids 0 and 1 minted, and carries an admin role for its sale. Tiers 4 and 21 cannot be rehearsed until more pieces exist. Transfers through the Kiln work against it today.

Coverage. All eight entry points have a row. Five hold, three carry findings. Three invariant rows also hold: reserve never exceeds the Kiln's ZTO balance, claims are fully backed and equal the kilnCut share within one wei, and no withdrawal path exists.

Static-analysis leads were all checked and none became findings: the ERC-20 interface warning is an ERC-721 interface, the uninitialized locals are deliberate zeros, ignored returns are harmless, reentrancy warnings are covered by effects-before-interactions with callback-free tokens, and the unprotected-initializer warning points at a view function and a permissionless open() that the brief requires.

Review complete. The findings file is at .imd-findings.json with 8 findings and 11 coverage rows. No source files were changed; only the ignored scratch directory and the findings file were written.

What I kept, after reproducing each against the code

• Medium, merged from two specialists: anyone can pre-initialize the ETH/ZTO pool key with the codeless predicted Kiln address, because the hook bits carry no initialize permission. The operator's open() then reverts with PoolAlreadyInitialized and that salt is burned. Both specialist proofs fail on this tree exactly as claimed, and one is attached as the proof.
• Low: buy() lacks the zero-price guard that sell() has, so every inventory piece is free once the reserve drops below 50 wei. Reproduced with seed 50, one sale, then a free buy.
• Low: large reserve inflows can be sandwiched through inventory. A 100 ZTO seed on a 98 ZTO reserve lost 1.75 ZTO to a buy-before, sell-after round trip.
• Low, merged from two specialists: sell and buy execute at the mined-time quote with no bounds, and the collect inside buy() raises the price above the quoted ask.
• Info: pass rental from the Kiln's own inventory, nested-unlock reverts, the permissionless first opener fixing the price with a narrow recovery path, and the live Sepolia Pepeolithic contract having only a handful of minted pieces. The last one I verified with live calls to Sepolia.

What I dropped or downgraded. The pass-rental finding went from low to info because the brief explicitly forbids holding guards and the README documents same-transaction borrowing. The partial-fill asymmetry was not kept as a finding, since the suite tests it and the README documents it. All slither and aderyn lines were either false positives (ERC-721 interface flagged as ERC-20, intentionally permissionless open(), zero-initialized locals) or benign ordering notes.

My own pass found nothing new. I traced all four swap cases against the vendored v4 hook accounting, the claim mint and burn flow, inventory swap-and-pop, and the reserve backing invariant. The full suite passes at 53 of 53 tests and the Kiln runtime is 5,906 bytes. All eight entry points have a coverage verdict, four of them pointing at a finding.

The responses file is excluded by the harness's own .git/info/exclude rule, so it is collected from disk as intended. All work is complete.

Outcome. The medium finding reproduced and is fixed. The proof test now passes, the full suite is 38 for 38, and forge build and forge fmt --check are clean.

Code changes (two small diffs, verified and accepted code otherwise untouched):

• src/Launcher.sol: open() now reads the pool's slot0 and calls initialize only when the price is still zero. A stranger who pre-initializes the key with the codeless predicted Kiln address no longer burns the salt. Opened is emitted either way and the one-shot guard is unchanged.
• src/Kiln.sol: buy() reverts with ZeroBid when the ask is zero, mirroring sell(). The reviewer's free-buy below 50 wei reserve reproduced and is closed.

Tests added:

• testPreInitializedPoolIsAdoptedAndRepriceable in the Launcher suite: stranger initializes first at an extreme price, open adopts the pool at the predicted address, second open reverts, and a zero-piece wallet re-prices the empty pool in both directions with zero deltas and zero claims.
• testBuyAtZeroAskRevertsUntilReserveIsSeeded in the Pieces suite.

README updates: handoff step 4 documents the pre-initialization race, that the supplied price is ignored when the pool already exists, the obligation to read the pool price before funding, and the exact recovery swaps. New caveats cover inventory pass rental, missing price bounds with the exact-allowance protection, seed sandwiching with tranching advice, and the live Sepolia Pepeolithic contract having only 7 of 737 pieces minted, which I verified with cast call today.

Responses filed for all eight findings in .imd-responses.json: the medium and the zero-ask low are fixed in code; the sandwich, price-bounds, pass-rental, extreme-price and Sepolia-supply findings are addressed by documentation since the brief mandates the formula, signatures, no-hold rule and permissionless open; the nested-unlock info is disputed as already-documented intended design.

The manifest is verified and needed only one small revision.

What I checked. The accepted source has a single deployable, Launcher, whose constructor takes zto, pepeo and poolManager in that order, makes no external calls and reads nothing on-chain. Kiln is created later by the permissionless open() call, so it is correctly absent from the manifest. The existing launch.json already named Launcher with those three Sepolia addresses, used only the keys kind, contracts and notes, and kept notes at about 1,100 characters.

What I changed. The Pepeolithic address was written all-lowercase, which solc rejected as a bad checksum when I embedded it in a scratch test. I replaced it with its EIP-55 checksum form, which is the same address, so a strict address validator cannot reject the manifest. No other line changed.

Verification.

• A scratch test deployed Launcher via CREATE2 with the exact manifest arguments on chain id 11155111 in an empty EVM, confirmed the stored addresses, and scanned the runtime for the forbidden opcodes the protected probe checks. It passed.
• Launcher runtime is 7,988 bytes and Kiln is 5,927 bytes, both under the EIP-170 limit and Kiln under the 12,000 byte brief limit.
• The full suite passed: 38 tests, 0 failures.
• Git shows launch.json as the only modified tracked file. The scratch test lives in test/scratch and is discarded before submission.

The revision is complete. The full suite passes with 61 tests, up from 55, and forge build is clean.

What I found. The brief listed no findings for this round, so I re-read the merged implementation adversarially, with attention to the implementer's newest changes: adopting a pool a stranger pre-initialized at the predicted Kiln address, and the zero-ask guard on buy(). I traced all four swap cases through v4's hook-delta accounting, the partial-fill guard, the claim mint and burn path, and the market functions. Nothing produced a concrete failing input, so I wrote no findings file. Two economic consequences the root README discloses (renting the Kiln's own inventory to dodge the cut, and sandwiching a visible seed) are real but documented design outcomes of the no-hold rule and reserve-only pricing, so I pinned them as tests rather than reporting them.

What I changed. Only three files under test/ were touched; everything accepted earlier is left as it was.

• test/Launcher.t.sol: two tests for the adoption path. With stranger liquidity, open() succeeds, the supplied price is ignored, the pool trades at the stranger's price, and the Kiln still charges and collects its cut there. On an empty adopted pool, the two modes that mint a specified cut in beforeSwap revert with PartialSpecifiedSwap on the zero fill for 0, 1 and 4 piece wallets, leaving price and claims untouched, while a 21-piece wallet repriced the pool with zero deltas.
• test/AdversarialEdges.t.sol: a sell of an unminted or out-of-collection id reverts without effects. The inventory-rent test shows a zero-piece wallet buys 21 pieces, swaps cut-free, sells them back, the rent lands in the reserve at about 5.5 percent of it regardless of swap size, and it only undercuts the cut for swaps of several reserves. The seed-sandwich property runs 1000 examples, asserting capture never exceeds 2 percent of the inflow, loses below about 12.7 percent of the reserve, and wins above 20 percent, with pinned cases on both sides of breakeven so the conditional branches are not vacuous.
• test/README.md: describes the new coverage and corrects the earlier range-direction note. The brief's "ZTO-only range above the opening price" is the same position seen from ZTO's side, which in v4 tick terms sits below the opening tick.

Still owed outside this run. Fork runs against the live Sepolia WETH, Pepeolithic and PoolManager remain untested here, as before, since the verifier has no network.

The findings file parses as valid JSON with zero findings and 18 coverage rows, and the tree holds no stray files.

Outcome: every finding from the previous round is settled and no new defect reproduced. The findings file at the repository root reports an empty list with a full coverage record.

Settled as fixed, verified by running the proofs and tests:

• The medium finding about open() being blockable by pre-initializing the pool key is fixed. Launcher.open now reads slot0 and only calls initialize when the price is zero. All three earlier proof files pass on this tree under test/scratch, and the author's new test re-prices an adopted empty pool from a zero-piece wallet in both directions.
• The low finding about buy() handing out pieces for free below 50 wei reserve is fixed. buy() now reverts with ZeroBid at a zero ask, which coincides exactly with a zero bid.

Settled as documented within the brief's constraints: the seed sandwich, the missing price bounds, the inventory pass rental, the permissionless opening price recovery, and the Sepolia collection having only 7 minted pieces. Each now has a README caveat or handoff step, and the brief fixes the signatures and formulas involved, so no code change was owed.

Dropped: the nested-unlock composability note. The author disputed it as documented design, and I agree there is no fund risk and the README states the limitation.

New-code review of the changed lines found nothing. open() has no remaining third-party revert path, since nobody else can place code at the CREATE2 address and getSlot0 is a view. The full suite passes with 61 tests, and the Kiln runtime is 5,927 bytes against the 12,000-byte limit. The static-analysis leads were all benign on inspection.