Failed on the agent's machine.

Failed on the agent's machine.

• lowCredit owed to a contract recipient can only be pulled by that contract itself; a vault without call capability and a receive needing >100k gas keeps its fees locked foreversrc/LaunchHook.sol:240

  Failed pushes are credited to owed[recipient]. The only ways out are withdraw(), which pays owed[msg.sender] and so has to be called by the recipient contract itself, and redeemClaims()/_flush(), which retry with the same PAYOUT_GAS = 100_000 cap. The research vault is described only as 'a contract with a payable receive'.

  If its receive costs more than 100k gas (for example it does accounting or forwards the ETH) and it cannot make arbitrary outbound calls, every vault share is credited and never delivered: no third party can push it with full gas, and the vault cannot call withdraw. The brief says a failed recipient must be able to withdraw its credit later, and that cannot happen for such a vault.

  Deploy the hook with researchVault = a contract whose receive() burns 150k gas (for example a loop of SSTOREs) and which has no other functions.

  Do an exact-input buy of 1 ETH at t=0: the vault's share of 0.295 ETH fails the 100k-gas push, so owed[vault] = 0.295 ETH.

  Call redeemClaims(): _flush retries with 100k gas, fails, and owed stays.

  No function lets anyone deliver it with enough gas.

  Expected: the credit can be delivered, for example by a permissionless withdrawFor(recipient) that forwards all gas to the fixed recipient.

  Actual: 0.295 ETH stays locked in the hook for good.

  whole reproduction

Failed on the agent's machine.

Failed on the agent's machine.

Failed on the agent's machine.

Failed on the agent's machine.

• highFee fixed in beforeSwap from the requested amount is never reconciled with the realized fill: partial fills overcharge, and an exact-output sell larger than the pool's ETH makes the seller pay ETHsrc/LaunchHook.sol:335

  For the two swap types where ETH is the specified currency, beforeSwap computes the fee from params.amountSpecified (line 305: exact-input buy, fee = specified * rate / BPS; line 309: exact-output sell, fee = specified * rate / (BPS - rate)) and returns it as the specified-side BeforeSwapDelta, so the PoolManager credits the hook that full amount no matter how much the pool actually swaps. afterSwap then takes feeFromBefore at face value (lines 335-338) and sets gross from params.amountSpecified, not from the realized swapDelta.

  Uniswap v4 fills partially whenever sqrtPriceLimitX96 is reached or liquidity runs out: it does not revert. This launch pool is seeded with tokens only, so its ETH is exactly what buyers have brought; any exact-output sell asking for more ETH than that is a partial fill.

  Consequences: (a) the effective fee is far above the advertised 2%/30% of the swap's ETH amount; (b) when the precomputed fee exceeds the pool's payout, the seller's ETH delta turns negative and they pay ETH out of pocket while also handing over tokens, and the vault and dev wallet receive ETH that was never part of any swap. The two afterSwap-side types (exact-output buy, exact-input sell) are correct because they read delta.amount0(); the asymmetry is the bug.

  Fix: afterSwap already receives the realized swapDelta, so for the two beforeSwap-priced types compute realizedFee = rate * realizedGross / BPS (exact-output sell: realizedGross = delta.amount0(); exact-input buy: realizedGross = consumed / (1 - rate) with consumed = -delta.amount0()) and, when realizedFee < feeFromBefore, return the excess to sender out of the ETH credit the hook holds (poolManager.take(ETH, sender, excess) or mint(sender, 0, excess)) before taking only realizedFee for the recipients; the hook's delta still nets to zero because the manager credits it feeFromBefore after afterSwap.

  Reverting on a partial fill of these two types is an acceptable stricter alternative. Either way the invariant to keep is fee <= rate * realizedGross / BPS, which is what the attached test asserts.

  whole finding

  Setup: real PoolManager code, pool ETH/TEST at 1:1, token-only seed in [minUsableTick, 0], manager funded with 1000 ETH (mainnet-like), block.timestamp = launchedAt + 3600 so every swap owes 2%.

  Case A (exact-output sell beyond pool ETH): buyer swaps exact-input 10 ETH (9.8 ETH reaches the pool).

  Seller calls swap(zeroForOne=false, amountSpecified=+20e18, sqrtPriceLimit=MAX-1).

  Pool pays out 9.6775 ETH in total; hook keeps 20e18*200/9800 = 0.40816 ETH; seller receives 9.2693 ETH.

  Expected fee: 2% of 9.6775 = 0.19355 ETH.

  Actual: 0.40816 ETH (4.22%).

  Case B (seller loses ETH): buyer swaps exact-input 1 ETH (~0.98 ETH in pool).

  Seller holding 10 ETH calls swap(false, +100e18, MAX-1).

  Fee precomputed = 100e18*200/9800 = 2.0408 ETH > pool payout 0.98 ETH.

  Seller's ETH delta = -1.0731 ETH: balance goes 10 -> 8.9269 ETH and 0.98e18 TEST are taken from them; vault+dev receive 2.0608 ETH.

  Expected: a sell never costs the seller ETH and the fee is 2% of 0.98 ETH = 0.0196 ETH.

  Case C (exact-input buy, price limit): buyer calls swap(true, -10e18, limit = SQRT_PRICE_1_1 - SQRT_PRICE_1_1/1e9).

  Pool consumes 0.5063 ETH; buyer pays 0.7063 ETH in total; fee kept = 0.2 ETH (2% of the requested 10 ETH) = 28.3% of what the buyer actually paid.

  Expected fee: 0.01413 ETH.

  All three are test/scratch/PartialFillFee.t.sol (attached as proof); run forge test --match-path test/scratch/PartialFillFee.t.sol -vv: 3 failures on the current code.

  whole reproduction

• lowERC-6909 ETH claims transferred to the hook by a third party are redeemed into ETH that no one can withdrawsrc/LaunchHook.sol:481

  _redeemClaims burns the hook's entire ERC-6909 balance for id 0 and takes that much ETH into the hook, but owed[] is only increased on the _collect claim path.

  Anyone can mint id-0 claims in the PoolManager (mint + settle{value}) and transfer them to the hook with PoolManager.transfer. redeemClaims() (callable by anyone) then converts them into hook ETH that is backed by no credit: withdraw() reverts NothingOwed for both recipients, redeemClaims' _flush pushes 0, receive() refuses outside ETH and there is no sweep.

  The README invariant 'the hook never keeps ETH for itself; its balance always equals the sum of credits not yet pulled' is broken. Impact is limited to whoever donates (no recipient loses what they are owed), so low.

  Fix: in _redeemClaims redeem only min(pendingClaims, owed[devWallet] + owed[researchVault] - address(this).balance), or credit any surplus redeemed ETH to the research vault.

  whole finding

  1. Donor contract: poolManager.unlock -> in callback poolManager.mint(donor, 0, 1e18); poolManager.settle{value: 1e18}().

  2. donor calls poolManager.transfer(hook, 0, 1e18); hook.pendingClaims() == 1e18.

  3. anyone calls hook.redeemClaims().

  Result: address(hook).balance == 1e18, owed[vault] == 0, owed[dev] == 0; vm.prank(vault); hook.withdraw(vault) reverts NothingOwed.

  Expected: no ETH held by the hook without a matching credit.

  Verified in test/scratch/Extra.t.sol test_donatedClaims_strandEthInHook.

  whole reproduction

• infoTrust assumption: the owner (who is also the dev wallet) can set the base fee to the 0.5% dev share, which routes 100% of every base-rate fee to the dev wallet and 0 to the research vaultsrc/LaunchHook.sol:230

  Permitted by the brief ('the base fee can never go below the 0.5% dev share'), so not a defect, but the economic effect should be stated: with baseFeeBps = 50, _collect computes devAmount = gross*50/BPS == fee and vaultAmount = 0 for every sell and every post-window buy, and the launch decay ends at 0.5% all to the dev wallet. Since owner == devWallet (0x5Cf44fb6...7944), the party that benefits is the party holding the lever.

  Mitigation if the requester wants it: a floor for the base fee above the dev share (e.g. 100 bps) or a timelock on setBaseFee; both change the agreed design.

  vm.prank(owner); hook.setBaseFee(50) succeeds.

  Then an exact-input sell paying out gross 10 ETH: fee = 0.05 ETH, devAmount = 0.05 ETH, vaultAmount = 0; FeeCharged(..., fee=5e16, devAmount=5e16, vaultAmount=0).

  Expected under the design: that is the allowed floor, documented here as the owner's power.

Failed on the agent's machine.

Failed on the agent's machine.

• highExact-output sell fee is fixed on the ETH requested, not the ETH the pool pays out: partial fills pay far above 2%, and a sell on an ETH-less pool costs the seller the fee for nothingsrc/LaunchHook.sol:309

  For an exact-output sell beforeSwap computes fee = net * rate / (BPS - rate) from params.amountSpecified (the ETH the seller asks for) and commits it as the before-swap specified delta, so the hook is owed fee ETH before the pool runs. The pool then pays out only what its liquidity and the price limit allow.

  The launch pool is single-sided (tokens only), so its ETH reserve is exactly what buyers have paid in minus fees; any exact-output sell larger than that reserve is partially filled: the swap reaches the top of the seeded range at tick 0, walks zero liquidity to the price limit and stops.

  The swapper's ETH delta becomes paidOut - fee, where fee was sized on the full request. afterSwap does not compare the executed amount with the request (line 338 uses uint256(params.amountSpecified) + fee as gross), so the fee is paid out to the vault and dev wallet in full.

  Measured against the real PoolManager: (a) pool with 0.7 ETH, request 10 ETH out: pool pays 0.6912 ETH, fee = 10e18*200/9800 = 0.2041 ETH, seller nets 0.4872 ETH, an effective 29.5% against the hardcoded 2% maximum; (b) pool with 0 ETH (the state of every launch pool before its first buy), request 1 ETH out: 0 tokens sold, 0 ETH received, seller pays 20408163265306122 wei which the hook forwards to the recipients.

  The same amountSpecified-based sizing is also what overcharges exact-input buys with a price limit (finding 2).

  Fix: in afterSwap, for the two swap types whose fee was fixed in beforeSwap, compare the executed ETH amount (delta.amount0() for a sell, -delta.amount0() + fee for a buy) with the amount the fee was sized on and revert (e.g. PartialFill()) when they differ; alternatively recompute the fee from the executed amount and return the surplus to the swapper (the only in-swap channel is poolManager.mint(sender, 0, surplus), an ERC-6909 claim, which routers do not expect, so reverting is the simpler safe choice).

  The proof passes with either fix.

  whole finding

  Setup: real PoolManager, LaunchHook with vault/dev EOAs, pool ETH/TEST fee 12500 spacing 60 at sqrtPrice 2^96, seeded with tokens only (liquidity 5e26 in [minUsableTick(60), 0]), manager pre-funded with 1000 ETH of other pools.

  Case A: no buy yet; a router holding TEST calls poolManager.swap(key, zeroForOne=false, amountSpecified=+1e18, sqrtPriceLimit=MAX_SQRT_PRICE-1).

  Expected: either revert or a 0-ETH, 0-fee no-op.

  Actual: swap succeeds with amount0 = -20408163265306122, amount1 = 0; the router must settle 0.0204 ETH; vault receives 15306122448979592 wei and dev 5102040816326530 wei.

  Case B: after one exact-input buy of 1 ETH (pool keeps 0.7 ETH), the same router swaps oneForZero exact output 10e18.

  Expected: 2% of the ETH paid out (about 0.0138 ETH on 0.69 ETH).

  Actual: fee 204081632653061224 wei, seller nets 487168367346938775 wei.

  Run: forge test --match-path test/scratch/SellPartialFillProof.t.sol -vv (both tests fail on the current code, pass once the fee follows the executed amount or partial fills are refused).

  whole reproduction
  proof · a Foundry test the fix has to pass

  // SPDX-License-Identifier: MIT
  pragma solidity 0.8.26;
  
  import {Test} from "forge-std/Test.sol";
  import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
  import {PoolManager} from "v4-core/src/PoolManager.sol";
  import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
  import {IUnlockCallback} from "v4-core/src/interfaces/callback/IUnlockCallback.sol";
  import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
  import {Hooks} from "v4-core/src/libraries/Hooks.sol";
  import {PoolKey} from "v4-core/src/types/PoolKey.sol";
  import {Currency, CurrencyLibrary} from "v4-core/src/types/Currency.sol";
  import {BalanceDelta} from "v4-core/src/types/BalanceDelta.sol";
  import {ModifyLiquidityParams, SwapParams} from "v4-core/src/types/PoolOperation.sol";
  import {TickMath} from "v4-core/src/libraries/TickMath.sol";
  import {LaunchHook} from "src/LaunchHook.sol";
  import {LaunchToken} from "src/LaunchToken.sol";
  
  /// @dev Minimal router: pays the manager from its own balances and keeps what it receives.
  contract LimitRouter is IUnlockCallback {
      IPoolManager public immutable manager;
  
      constructor(IPoolManager m) {
          manager = m;
      }
  
      receive() external payable {}
  
      function swap(PoolKey memory key, bool zeroForOne, int256 amountSpecified, uint160 limit)
          external
          returns (BalanceDelta)
      {
          bytes memory r = manager.unlock(abi.encode(uint8(1), abi.encode(key, zeroForOne, amountSpecified, limit)));
          return abi.decode(r, (BalanceDelta));
      }
  
      function addLiquidity(PoolKey memory key, int24 lower, int24 upper, int256 liq) external returns (BalanceDelta) {
          bytes memory r = manager.unlock(abi.encode(uint8(2), abi.encode(key, lower, upper, liq)));
          return abi.decode(r, (BalanceDelta));
      }
  
      function unlockCallback(bytes calldata data) external returns (bytes memory) {
          require(msg.sender == address(manager));
          BalanceDelta delta;
          PoolKey memory key;
          (uint8 action, bytes memory payload) = abi.decode(data, (uint8, bytes));
          if (action == 1) {
              (PoolKey memory k, bool zeroForOne, int256 amountSpecified, uint160 limit) =
                  abi.decode(payload, (PoolKey, bool, int256, uint160));
              key = k;
              delta = manager.swap(key, SwapParams(zeroForOne, amountSpecified, limit), "");
          } else {
              (PoolKey memory k, int24 lower, int24 upper, int256 liq) =
                  abi.decode(payload, (PoolKey, int24, int24, int256));
              key = k;
              (delta,) = manager.modifyLiquidity(key, ModifyLiquidityParams(lower, upper, liq, bytes32(0)), "");
          }
          _settle(key.currency0, delta.amount0());
          _settle(key.currency1, delta.amount1());
          return abi.encode(delta);
      }
  
      function _settle(Currency c, int128 a) private {
          if (a < 0) {
              uint256 owed = uint256(uint128(-a));
              if (c.isAddressZero()) {
                  manager.settle{value: owed}();
              } else {
                  manager.sync(c);
                  IERC20(Currency.unwrap(c)).transfer(address(manager), owed);
                  manager.settle();
              }
          } else if (a > 0) {
              manager.take(c, address(this), uint256(uint128(a)));
          }
      }
  }
  
  /// @notice Exact-output sells are charged 2% of the ETH the seller *asked for*, fixed in `beforeSwap`, even
  /// when the pool can only pay out part of it (or none of it). Passes once the fee follows the executed
  /// amount, or once the hook refuses a partially filled ETH-specified swap.
  contract SellPartialFillProof is Test {
      uint160 constant SQRT_PRICE_1_1 = 79228162514264337593543950336;
      uint256 constant BPS = 10_000;
      uint160 constant FLAGS = uint160(
          Hooks.AFTER_INITIALIZE_FLAG | Hooks.BEFORE_SWAP_FLAG | Hooks.AFTER_SWAP_FLAG
              | Hooks.BEFORE_SWAP_RETURNS_DELTA_FLAG | Hooks.AFTER_SWAP_RETURNS_DELTA_FLAG
      );
  
      PoolManager manager;
      LaunchToken token;
      LaunchHook hook;
      LimitRouter router;
      LimitRouter seeder;
      PoolKey key;
      address vault = makeAddr("vault");
      address dev = makeAddr("dev");
      address owner = makeAddr("owner");
  
      function setUp() public {
          manager = new PoolManager(address(this));
          token = new LaunchToken();
          address at = address((uint160(0x4242) << 144) | FLAGS);
          deployCodeTo("LaunchHook.sol:LaunchHook", abi.encode(manager, address(token), owner, vault, dev), at);
          hook = LaunchHook(payable(at));
          key = PoolKey(CurrencyLibrary.ADDRESS_ZERO, Currency.wrap(address(token)), 12_500, 60, IHooks(at));
          vm.warp(1_700_000_000);
          manager.initialize(key, SQRT_PRICE_1_1);
  
          // Single-sided seed, as the launch does: tokens only in [minTick, 0].
          seeder = new LimitRouter(IPoolManager(address(manager)));
          token.transfer(address(seeder), 800_000_000 ether);
          seeder.addLiquidity(key, TickMath.minUsableTick(60), 0, 5e26);
  
          // The mainnet manager holds ETH of other pools.
          vm.deal(address(manager), 1_000 ether);
  
          router = new LimitRouter(IPoolManager(address(manager)));
          vm.deal(address(router), 1_000 ether);
          token.transfer(address(router), 10_000_000 ether);
      }
  
      /// Exact-output sell of 1 ETH on a pool that holds no ETH yet: the seller sells nothing, receives nothing,
      /// and still pays 1e18 * 200 / 9800 = 20408163265306122 wei to the vault and dev wallet.
      function test_exactOutputSell_onEmptyPool_chargesFeeForNothing() public {
          uint256 routerEthBefore = address(router).balance;
          uint256 routerTokBefore = token.balanceOf(address(router));
  
          try router.swap(key, false, int256(1 ether), TickMath.MAX_SQRT_PRICE - 1) {} catch {}
  
          uint256 ethReceived = address(router).balance > routerEthBefore ? address(router).balance - routerEthBefore : 0;
          uint256 tokensSold = routerTokBefore - token.balanceOf(address(router));
          uint256 feePaid = vault.balance + dev.balance;
          emit log_named_uint("tokens sold", tokensSold);
          emit log_named_uint("ETH received", ethReceived);
          emit log_named_uint("fee taken", feePaid);
          // A sell must never cost the seller ETH, and the fee must stay at 2% of the ETH the pool paid out.
          assertGe(address(router).balance, routerEthBefore, "seller lost ETH on a sell");
          assertLe(feePaid * BPS, (ethReceived + feePaid) * 200, "fee above 2% of gross ETH paid out");
      }
  
      /// Pool holds 0.7 ETH after one 1 ETH buy. An exact-output sell for 10 ETH is filled with ~0.69 ETH, but the
      /// fee is 10e18 * 200 / 9800 = 0.204 ETH: the seller nets 0.487 ETH, an effective rate of 29.5%, not 2%.
      function test_exactOutputSell_partialFill_overcharges() public {
          router.swap(key, true, -int256(1 ether), TickMath.MIN_SQRT_PRICE + 1);
          uint256 vaultBefore = vault.balance;
          uint256 devBefore = dev.balance;
          uint256 routerEthBefore = address(router).balance;
  
          try router.swap(key, false, int256(10 ether), TickMath.MAX_SQRT_PRICE - 1) {} catch {}
  
          uint256 fee = (vault.balance - vaultBefore) + (dev.balance - devBefore);
          uint256 net = address(router).balance > routerEthBefore ? address(router).balance - routerEthBefore : 0;
          emit log_named_uint("net ETH to seller", net);
          emit log_named_uint("fee taken", fee);
          assertGe(address(router).balance, routerEthBefore, "seller lost ETH on a sell");
          assertLe(fee * BPS, (net + fee) * 200, "fee above 2% of gross ETH paid out");
      }
  }

  whole proof

• mediumExact-input buy fee is 30% of the full amountSpecified even when a price limit stops the pool after a fraction of it, so the effective rate breaks the 30% capsrc/LaunchHook.sol:305

  For an exact-input buy beforeSwap takes fee = ethIn * rate / BPS of the whole params.amountSpecified through the before-swap specified delta, and afterSwap (line 338) keeps gross = uint256(-params.amountSpecified) without looking at how much ETH the pool actually consumed (-delta.amount0()).

  A swapper who passes a sqrtPriceLimitX96 as slippage protection, which is how a limit-priced v4 swap is expressed, is charged the launch rate on ETH that never entered the pool. With a limit the pool reaches after about 1 ETH, a 100 ETH exact-input buy at t=0 costs the buyer 31.02 ETH in total: 1.02 ETH swapped, 30 ETH fee, an effective 96.7% against the hardcoded 30% cap, all of it forwarded to the vault and dev wallet inside the swap.

  Same root cause and same fix as finding 1: compare the executed ETH amount with the amount the fee was sized on in afterSwap and refuse partial fills, or size the fee on the executed amount.

  whole finding

  Setup as in finding 1 (real PoolManager, tokens-only seed of liquidity 5e26 in [minUsableTick(60), 0], sqrtPrice 2^96, t = launchedAt).

  Router with 1000 ETH calls poolManager.swap(key, zeroForOne=true, amountSpecified=-100e18, sqrtPriceLimitX96 = 79228162514264337593543950336 - 1.6e20).

  Expected: fee <= 30% of the ETH the buyer actually pays.

  Actual: buyer pays 31022523504528661025 wei in total, the pool consumes 1022523504528661025 wei, the hook takes 30000000000000000000 wei (29.5 ETH to the vault, 0.5 ETH to the dev wallet).

  Run: forge test --match-path test/scratch/BuyPriceLimitProof.t.sol -vv (fails on the current code, passes once the fee follows the executed amount or partial fills are refused).

  whole reproduction
  proof · a Foundry test the fix has to pass

  // SPDX-License-Identifier: MIT
  pragma solidity 0.8.26;
  
  import {Test} from "forge-std/Test.sol";
  import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
  import {PoolManager} from "v4-core/src/PoolManager.sol";
  import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
  import {IUnlockCallback} from "v4-core/src/interfaces/callback/IUnlockCallback.sol";
  import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
  import {Hooks} from "v4-core/src/libraries/Hooks.sol";
  import {PoolKey} from "v4-core/src/types/PoolKey.sol";
  import {Currency, CurrencyLibrary} from "v4-core/src/types/Currency.sol";
  import {BalanceDelta} from "v4-core/src/types/BalanceDelta.sol";
  import {ModifyLiquidityParams, SwapParams} from "v4-core/src/types/PoolOperation.sol";
  import {TickMath} from "v4-core/src/libraries/TickMath.sol";
  import {LaunchHook} from "src/LaunchHook.sol";
  import {LaunchToken} from "src/LaunchToken.sol";
  
  /// @dev Minimal router: pays the manager from its own balances and keeps what it receives.
  contract LimitRouter is IUnlockCallback {
      IPoolManager public immutable manager;
  
      constructor(IPoolManager m) {
          manager = m;
      }
  
      receive() external payable {}
  
      function swap(PoolKey memory key, bool zeroForOne, int256 amountSpecified, uint160 limit)
          external
          returns (BalanceDelta)
      {
          bytes memory r = manager.unlock(abi.encode(uint8(1), abi.encode(key, zeroForOne, amountSpecified, limit)));
          return abi.decode(r, (BalanceDelta));
      }
  
      function addLiquidity(PoolKey memory key, int24 lower, int24 upper, int256 liq) external returns (BalanceDelta) {
          bytes memory r = manager.unlock(abi.encode(uint8(2), abi.encode(key, lower, upper, liq)));
          return abi.decode(r, (BalanceDelta));
      }
  
      function unlockCallback(bytes calldata data) external returns (bytes memory) {
          require(msg.sender == address(manager));
          BalanceDelta delta;
          PoolKey memory key;
          (uint8 action, bytes memory payload) = abi.decode(data, (uint8, bytes));
          if (action == 1) {
              (PoolKey memory k, bool zeroForOne, int256 amountSpecified, uint160 limit) =
                  abi.decode(payload, (PoolKey, bool, int256, uint160));
              key = k;
              delta = manager.swap(key, SwapParams(zeroForOne, amountSpecified, limit), "");
          } else {
              (PoolKey memory k, int24 lower, int24 upper, int256 liq) =
                  abi.decode(payload, (PoolKey, int24, int24, int256));
              key = k;
              (delta,) = manager.modifyLiquidity(key, ModifyLiquidityParams(lower, upper, liq, bytes32(0)), "");
          }
          _settle(key.currency0, delta.amount0());
          _settle(key.currency1, delta.amount1());
          return abi.encode(delta);
      }
  
      function _settle(Currency c, int128 a) private {
          if (a < 0) {
              uint256 owed = uint256(uint128(-a));
              if (c.isAddressZero()) {
                  manager.settle{value: owed}();
              } else {
                  manager.sync(c);
                  IERC20(Currency.unwrap(c)).transfer(address(manager), owed);
                  manager.settle();
              }
          } else if (a > 0) {
              manager.take(c, address(this), uint256(uint128(a)));
          }
      }
  }
  
  /// @notice An exact-input buy with a price limit is charged 30% of the full `amountSpecified`, fixed in
  /// `beforeSwap`, although the pool stops at the limit and consumes only part of it. Passes once the fee follows
  /// the executed amount, or once the hook refuses a partially filled ETH-specified swap.
  contract BuyPriceLimitProof is Test {
      uint160 constant SQRT_PRICE_1_1 = 79228162514264337593543950336;
      uint256 constant BPS = 10_000;
      uint160 constant FLAGS = uint160(
          Hooks.AFTER_INITIALIZE_FLAG | Hooks.BEFORE_SWAP_FLAG | Hooks.AFTER_SWAP_FLAG
              | Hooks.BEFORE_SWAP_RETURNS_DELTA_FLAG | Hooks.AFTER_SWAP_RETURNS_DELTA_FLAG
      );
  
      PoolManager manager;
      LaunchToken token;
      LaunchHook hook;
      LimitRouter router;
      LimitRouter seeder;
      PoolKey key;
      address vault = makeAddr("vault");
      address dev = makeAddr("dev");
      address owner = makeAddr("owner");
  
      function setUp() public {
          manager = new PoolManager(address(this));
          token = new LaunchToken();
          address at = address((uint160(0x4242) << 144) | FLAGS);
          deployCodeTo("LaunchHook.sol:LaunchHook", abi.encode(manager, address(token), owner, vault, dev), at);
          hook = LaunchHook(payable(at));
          key = PoolKey(CurrencyLibrary.ADDRESS_ZERO, Currency.wrap(address(token)), 12_500, 60, IHooks(at));
          vm.warp(1_700_000_000);
          manager.initialize(key, SQRT_PRICE_1_1);
  
          // Single-sided seed, as the launch does: tokens only in [minTick, 0].
          seeder = new LimitRouter(IPoolManager(address(manager)));
          token.transfer(address(seeder), 800_000_000 ether);
          seeder.addLiquidity(key, TickMath.minUsableTick(60), 0, 5e26);
  
          // The mainnet manager holds ETH of other pools.
          vm.deal(address(manager), 1_000 ether);
  
          router = new LimitRouter(IPoolManager(address(manager)));
          vm.deal(address(router), 1_000 ether);
      }
  
      /// Buyer specifies 100 ETH exact input with a price limit the pool reaches after ~1.02 ETH. The hook takes
      /// 100e18 * 3000 / 10000 = 30 ETH in `beforeSwap`; the buyer pays 31.02 ETH in total for a 1.02 ETH swap,
      /// an effective rate of 96.7% against the hardcoded 30% cap.
      function test_exactInputBuy_priceLimit_chargesFeeOnUnswappedEth() public {
          uint256 routerEthBefore = address(router).balance;
          uint160 limit = SQRT_PRICE_1_1 - 1.6e20; // a limit the pool reaches after consuming about 1 ETH
  
          try router.swap(key, true, -int256(100 ether), limit) {} catch {}
  
          uint256 paid = routerEthBefore - address(router).balance;
          uint256 fee = vault.balance + dev.balance;
          emit log_named_uint("ETH paid by buyer in total", paid);
          emit log_named_uint("ETH consumed by the pool", paid - fee);
          emit log_named_uint("fee taken", fee);
          assertLe(fee * BPS, paid * 3000, "fee above the 30% cap of what the buyer actually paid");
      }
  }

  whole proof

• infoAll four fee formulas round down, so swaps whose ETH leg is below BPS/rate wei pay no fee (dust only)src/LaunchHook.sol:348

  fee = gross * rate / BPS (lines 305 and 348) and fee = x * rate / (BPS - rate) (lines 309 and 342) all truncate toward zero, in the swapper's favour by less than 1 wei per swap; the dev share gross * DEV_SHARE_BPS / BPS truncates the same way and is clamped to fee, so the split never underflows. The loss is at most 1 wei per swap and does not compound; it is recorded here only because the math guide asks for every zero-rounding boundary to be named.

  No change is required; if the author wants fees to round up, use a mulDivUp for the four formulas.

  After the launch window (rate = 200): an exact-input buy of 49 wei pays fee = 49200/10000 = 0; an exact-input sell whose pool payout is 49 wei pays 0; an exact-output sell of 48 wei pays 48200/9800 = 0.

  With rate = 3000 a 3 wei exact-input buy pays 0.

  Any amount above these thresholds pays within 1 wei of the exact rate.

Failed on the agent's machine.

Failed on the agent's machine.

• highFee of specified-ETH swaps is charged on the requested amount, not the executed one: partial fills overpay, and an exact-output sell can make the seller pay ETHsrc/LaunchHook.sol:303

  For an exact-input buy and an exact-output sell the hook decides the whole fee in beforeSwap from params.amountSpecified and returns it as the before-swap delta on ETH. afterSwap then takes exactly that amount (src/LaunchHook.sol:337-338 reuses feeFromBefore and sets gross from params.amountSpecified) and never compares it with the ETH the pool actually moved (delta.amount0()).

  Uniswap v4 does not guarantee a full fill: a swap stops at sqrtPriceLimitX96 or when the liquidity range runs out, and the remainder is simply not swapped. The fee, however, stays what beforeSwap fixed, so the effective rate on the executed ETH is unbounded. The two afterSwap-charged types (exact-output buy, exact-input sell) use the executed delta and are correct, so the four swap types are not charged on the same base, which the brief requires ('the right fee' for each).

  The launch pool is seeded single-sided with tokens only, so it holds little ETH in its first hours: an exact-output sell asking for more ETH than the pool holds is an ordinary request at launch, and v4-periphery's V4Router does not revert on a partially filled exact output (it only bounds the token input).

  When the pool holds less ETH than the fee fixed in beforeSwap, the seller's ETH delta becomes negative: the seller settles tokens and ETH and receives nothing, while the hook pays the recipients 'fee' ETH that was never part of an executed swap.

  Fix: in afterSwap, for the two specified-ETH types, derive the executed ETH from delta.amount0() (exact-input buy: executed = -delta.amount0() + fee; exact-output sell: executed = delta.amount0()) and revert when it differs from what beforeSwap assumed (amountSpecified minus/plus fee), or recompute the fee from the executed amount and refuse the swap when the fee cannot be reconciled.

  A partial fill of a specified-ETH swap must never be charged more than the scheduled rate of the ETH it moved.

  whole finding

  Fixture: real PoolManager, ETH/TEST pool initialized at sqrtPrice 2^96, token-only liquidity 5e26 in [minUsableTick, 0], manager funded with 1000 ETH (mainnet-like).

  (A) Exact-input buy, t=0: swap(zeroForOne=true, amountSpecified=-1e18, sqrtPriceLimitX96 = 2^96 - 2^96/5e10).

  Expected: fee = 30% of the ETH the swap used.

  Actual: beforeSwap takes 0.300000000000000000 ETH; the pool consumes only ~0.0101 ETH before the limit; the swapper pays ~0.3101 ETH for ~0.0101 ETH of tokens, a 96.7% effective fee (scheduled: 0.004339963833721519 ETH).

  (B) Exact-output sell, t=3600 (2%): first buy 1 ETH so the pool holds ~0.97 ETH, then swap(zeroForOne=false, amountSpecified=+5e18, limit=MAX_SQRT_PRICE-1).

  Expected fee: 2% of the 0.96775 ETH actually paid out = 0.019354999999999999 ETH.

  Actual: 0.102040816326530612 ETH (10.5% of the executed gross); the seller receives 0.8657 ETH.

  (C) Same as (B) but the pool holds only ~0.048 ETH (prime with a 0.05 ETH buy).

  Actual: the hook takes 0.102040816326530612 ETH, the pool pays ~0.048 ETH, the seller's ETH balance drops by 0.053653316326530613 ETH while it also hands over its tokens and receives no ETH.

  Expected: a seller never pays ETH.

  All three are test/scratch/PartialFillFee.t.sol (3 failing tests on the current code).

  whole reproduction

• lowThe credited-ETH fallback cannot be pulled by the real research vault: it has no function that can call withdraw(address)src/LaunchHook.sol:240

  withdraw pays owed[msg.sender] only when the recipient itself is the caller.

  The research vault 0x087C0CF0A103acA2c487c5017DbC121ad6C5afEE is a deployed mainnet contract (11,101 bytes of runtime code, owner() = 0x5Cf44fb6a49156125b5f9Dfea73E4011534C7944) whose selectors are approveJob, cancelJob, postJob, releaseJob, initiateWithdraw/executeWithdraw/cancelWithdraw, setOperator, setMonthlyBudget, transferOwnership/acceptOwnership and views; none of them makes an arbitrary external call, so the vault can never execute hook.withdraw(to).

  Today its receive costs ~22.8k gas (a plain payable receive, under the 100k push allowance), so pushes succeed and this path is dormant. It becomes live the moment the vault's receive starts reverting (a pause, an upgrade, a budget guard) or needs more than PAYOUT_GAS: every swap then credits owed[vault], redeemClaims() re-pushes through the same failing receive, and no other address, the owner included (by design), can move the credit.

  The ETH is stranded in the hook for as long as the vault rejects it. Consider letting the vault's owner() (the dev wallet, already a party to this launch) or a vault-chosen address pull on the vault's behalf, or confirm with the vault's source that its receive is unconditional.

  whole finding

  State: researchVault's receive reverts (test stand-in: ToggleVault.setAccepting(false)) and the vault, like the mainnet contract, has no function that calls out.

  Swap: exact-input buy of 1 ETH at t=0 -> owed[vault] = 0.295 ETH, hook balance 0.295 ETH.

  Then: hook.withdraw(x) from any address but the vault reverts NothingOwed; hook.redeemClaims() leaves owed[vault] = 0.295 ETH because _flush fails on the same receive; the owner has no function to move it.

  Expected per the brief: the recipient can withdraw its credit later.

  Actual for this vault: nothing can ever call withdraw as the vault, so the credit is stranded until the vault accepts pushes again.

  whole reproduction

Failed on the agent's machine.

Failed on the agent's machine.

Failed on the agent's machine.

• highPartial fills charge the fee on unexecuted ETH, bypassing the fee cap and debiting ETH on sellssrc/LaunchHook.sol:335

  When ETH is the specified currency, beforeSwap fixes the fee from the entire amountSpecified (lines 303-309). afterSwap then unconditionally collects that fee and derives gross from the requested amount rather than the actual AMM delta (lines 335-338). Uniswap v4 can stop early at a price limit or exhausted liquidity. A partially filled exact-input buy therefore pays a fee on unused input and can lose nearly all the ETH actually debited, exceeding the 30%/2% schedule.

  A partially filled exact-output sell can pay a fee greater than its actual ETH output, turning its ETH delta negative. The 0.5% dev split also uses the unfilled nominal amount. Settle fees on actual executed ETH, or reject unsupported partial fills atomically while continuing to support ordinary filled swaps.

  Run the embedded self-contained test as test/scratch/PartialFillProof.t.sol with forge test --match-path test/scratch/PartialFillProof.t.sol -vv.

  A locally deployed real PoolManager, native ETH/TEST pool at 2^96, 12500 LP fee and token-only liquidity 5e26 in [-887220,0] are used.

  At t=0 swap zeroForOne=true, amountSpecified=-1e18, sqrtPriceLimitX96=2^96-1e12.

  Actual: a positive token fill, actual ETH debit 300000006390771891 wei, and fee 300000000000000000 wei (~100% of actual debit); expected at most 30% of actual ETH or an atomic rejection.

  A second test first buys with 10 ETH, then requests an exact-output sell of 1e17 wei ETH with sqrtPriceLimitX96=currentPrice+1e12.

  Actual seller ETH delta is -2040810015643196 wei while TEST is also debited; expected nonnegative net ETH and a fee proportional to filled output, or atomic rejection.

  Both assertions failed locally.

  Ordinary full-fill buy/sell controls succeed.

  The proofs allow atomic partial-fill rejection as a safe repair.

  whole reproduction
  proof · a Foundry test the fix has to pass

  // SPDX-License-Identifier: MIT
  pragma solidity 0.8.26;
  
  import {Test} from "forge-std/Test.sol";
  import {LaunchHook} from "src/LaunchHook.sol";
  import {LaunchToken} from "src/LaunchToken.sol";
  import {PoolManager} from "v4-core/src/PoolManager.sol";
  import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
  import {IUnlockCallback} from "v4-core/src/interfaces/callback/IUnlockCallback.sol";
  import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
  import {PoolKey} from "v4-core/src/types/PoolKey.sol";
  import {Currency} from "v4-core/src/types/Currency.sol";
  import {BalanceDelta} from "v4-core/src/types/BalanceDelta.sol";
  import {SwapParams, ModifyLiquidityParams} from "v4-core/src/types/PoolOperation.sol";
  import {StateLibrary} from "v4-core/src/libraries/StateLibrary.sol";
  
  contract PartialFillRecipient { receive() external payable {} }
  
  contract PartialFillActor is IUnlockCallback {
      IPoolManager public immutable manager;
      LaunchToken public immutable token;
      constructor(IPoolManager manager_, LaunchToken token_) { manager = manager_; token = token_; }
      receive() external payable {}
      function seed(PoolKey memory key) external { manager.unlock(abi.encode(true, key, SwapParams(false, 0, 0))); }
      function trade(PoolKey memory key, SwapParams memory params) external returns (BalanceDelta) {
          return abi.decode(manager.unlock(abi.encode(false, key, params)), (BalanceDelta));
      }
      function unlockCallback(bytes calldata data) external returns (bytes memory) {
          require(msg.sender == address(manager));
          (bool adding, PoolKey memory key, SwapParams memory params) = abi.decode(data, (bool, PoolKey, SwapParams));
          BalanceDelta delta;
          if (adding) (delta,) = manager.modifyLiquidity(key, ModifyLiquidityParams(-887220, 0, 5e26, 0), "");
          else delta = manager.swap(key, params, "");
          if (delta.amount0() < 0) {
              manager.sync(key.currency0);
              manager.settle{value: uint256(-int256(delta.amount0()))}();
          } else if (delta.amount0() > 0) manager.take(key.currency0, address(this), uint128(delta.amount0()));
          if (delta.amount1() < 0) {
              manager.sync(key.currency1);
              token.transfer(address(manager), uint256(-int256(delta.amount1())));
              manager.settle();
          } else if (delta.amount1() > 0) manager.take(key.currency1, address(this), uint128(delta.amount1()));
          return abi.encode(delta);
      }
  }
  
  contract PartialFillProof is Test {
      using StateLibrary for IPoolManager;
      uint160 constant PRICE = 79228162514264337593543950336;
      IPoolManager manager;
      LaunchHook hook;
      LaunchToken token;
      PartialFillActor actor;
      PartialFillRecipient vault;
      PartialFillRecipient dev;
      PoolKey key;
  
      function setUp() public {
          vm.warp(1700000000);
          manager = IPoolManager(address(new PoolManager(address(this))));
          token = new LaunchToken();
          vault = new PartialFillRecipient();
          dev = new PartialFillRecipient();
          address at = address((uint160(0x1234) << 144) | uint160(0x10cc));
          deployCodeTo("src/LaunchHook.sol:LaunchHook", abi.encode(manager, token, address(this), vault, dev), at);
          hook = LaunchHook(payable(at));
          key = PoolKey(Currency.wrap(address(0)), Currency.wrap(address(token)), 12500, 60, IHooks(at));
          manager.initialize(key, PRICE);
          actor = new PartialFillActor(manager, token);
          token.transfer(address(actor), 800_000_000 ether);
          actor.seed(key);
          vm.deal(address(actor), 100 ether);
          vm.deal(address(manager), 100 ether);
      }
  
      function test_partialExactInputBuyRespectsThirtyPercentCap() public {
          uint256 snapshot = vm.snapshotState();
          assertGt(actor.trade(key, SwapParams(true, -1 ether, PRICE / 2)).amount1(), 0, "ordinary buys must work");
          assertTrue(vm.revertToState(snapshot));
          uint256 beforeEth = address(actor).balance;
          BalanceDelta delta;
          try actor.trade(key, SwapParams(true, -1 ether, PRICE - 1e12)) returns (BalanceDelta filled) {
              delta = filled;
          } catch {
              // Rejecting an unsupported partial fill atomically is also a safe fix.
              assertEq(address(actor).balance, beforeEth);
              assertEq(address(vault).balance + address(dev).balance, 0);
              return;
          }
          uint256 actualSpent = beforeEth - address(actor).balance;
          uint256 fee = address(vault).balance + address(dev).balance;
          assertGt(delta.amount1(), 0, "the price-limited swap fills a positive amount");
          assertLt(actualSpent, 1 ether, "the swap is genuinely partial");
          emit log_named_uint("actual ETH spent", actualSpent);
          emit log_named_uint("ETH fee charged", fee);
          // The specified fee cap applies to actual ETH spent, not an unused input budget.
          assertLe(fee * 10000, actualSpent * 3000, "partial fill charged above 30% of actual ETH");
      }
  
      function test_partialExactOutputSellMustNotChargeTheSellerEth() public {
          actor.trade(key, SwapParams(true, -10 ether, PRICE / 2));
          (uint160 price,,,) = manager.getSlot0(key.toId());
          uint256 snapshot = vm.snapshotState();
          assertEq(actor.trade(key, SwapParams(false, 0.1 ether, PRICE)).amount0(), 0.1 ether, "ordinary sells must work");
          assertTrue(vm.revertToState(snapshot));
          uint256 beforeEth = address(actor).balance;
          uint256 beforeToken = token.balanceOf(address(actor));
          uint256 beforeFee = address(vault).balance + address(dev).balance;
          BalanceDelta delta;
          try actor.trade(key, SwapParams(false, 0.1 ether, price + 1e12)) returns (BalanceDelta filled) {
              delta = filled;
          } catch {
              assertEq(address(actor).balance, beforeEth);
              assertEq(token.balanceOf(address(actor)), beforeToken);
              assertEq(address(vault).balance + address(dev).balance, beforeFee);
              return;
          }
          assertLt(delta.amount1(), 0, "a positive amount of TEST was sold");
          emit log_named_int("seller ETH delta", delta.amount0());
          assertGe(address(actor).balance, beforeEth, "a sell may not debit ETH to pay a fee on unfilled output");
      }
  }

  whole proof

• mediumAn empty PoolManager defers accepting recipients payments beyond the swap transactionsrc/LaunchHook.sol:435

  When the PoolManager has less ETH than the fee during afterSwap, _collect mints an ERC-6909 claim and only increments owed. A normal router settles the buyer ETH after manager.swap returns; neither the hook nor the supplied test router flushes those credits before the transaction ends. Thus the first swap on a token-only, empty manager succeeds but neither accepting recipient is paid in the same transaction.

  Accounting and later redemption remain sound, and the pinned mainnet tests with existing manager ETH pass. This is a liveness/requirement gap against the brief’s unconditional same-transaction payouts, not evidence of lost backing. The implementation README documents the fallback, and the background reference permits claims on an empty manager, but that design does not itself fulfill the stricter brief.

  An integrated post-settlement payout or a changed requirement is needed.

  Run the embedded test as test/scratch/FirstBuyPayoutProof.t.sol with forge test --match-path test/scratch/FirstBuyPayoutProof.t.sol -vv.

  Deploy the real PoolManager locally without ETH funding, initialize the hook pool at 2^96, seed only TEST, and make a 1 ETH exact-input buy at t=0 through one external router call that fully settles the swap.

  Both recipients have accepting payable receive functions.

  Expected end-of-transaction balances: dev +5000000000000000 wei, vault +295000000000000000 wei.

  Actual: both receive zero and pendingClaims() is 300000000000000000 wei.

  The first recipient-balance assertion failed locally.

  A separate future redeemClaims/withdraw call is currently required.

  whole reproduction
  proof · a Foundry test the fix has to pass

  // SPDX-License-Identifier: MIT
  pragma solidity 0.8.26;
  
  import {Test} from "forge-std/Test.sol";
  import {LaunchHook} from "src/LaunchHook.sol";
  import {LaunchToken} from "src/LaunchToken.sol";
  import {PoolManager} from "v4-core/src/PoolManager.sol";
  import {IPoolManager} from "v4-core/src/interfaces/IPoolManager.sol";
  import {IUnlockCallback} from "v4-core/src/interfaces/callback/IUnlockCallback.sol";
  import {IHooks} from "v4-core/src/interfaces/IHooks.sol";
  import {PoolKey} from "v4-core/src/types/PoolKey.sol";
  import {Currency} from "v4-core/src/types/Currency.sol";
  import {BalanceDelta} from "v4-core/src/types/BalanceDelta.sol";
  import {SwapParams, ModifyLiquidityParams} from "v4-core/src/types/PoolOperation.sol";
  import {StateLibrary} from "v4-core/src/libraries/StateLibrary.sol";
  
  contract FirstBuyRecipient { receive() external payable {} }
  
  contract FirstBuyActor is IUnlockCallback {
      IPoolManager public immutable manager;
      LaunchToken public immutable token;
      constructor(IPoolManager manager_, LaunchToken token_) { manager = manager_; token = token_; }
      receive() external payable {}
      function seed(PoolKey memory key) external { manager.unlock(abi.encode(true, key, SwapParams(false, 0, 0))); }
      function trade(PoolKey memory key, SwapParams memory params) external returns (BalanceDelta) {
          return abi.decode(manager.unlock(abi.encode(false, key, params)), (BalanceDelta));
      }
      function unlockCallback(bytes calldata data) external returns (bytes memory) {
          require(msg.sender == address(manager));
          (bool adding, PoolKey memory key, SwapParams memory params) = abi.decode(data, (bool, PoolKey, SwapParams));
          BalanceDelta delta;
          if (adding) (delta,) = manager.modifyLiquidity(key, ModifyLiquidityParams(-887220, 0, 5e26, 0), "");
          else delta = manager.swap(key, params, "");
          if (delta.amount0() < 0) {
              manager.sync(key.currency0);
              manager.settle{value: uint256(-int256(delta.amount0()))}();
          } else if (delta.amount0() > 0) manager.take(key.currency0, address(this), uint128(delta.amount0()));
          if (delta.amount1() < 0) {
              manager.sync(key.currency1);
              token.transfer(address(manager), uint256(-int256(delta.amount1())));
              manager.settle();
          } else if (delta.amount1() > 0) manager.take(key.currency1, address(this), uint128(delta.amount1()));
          return abi.encode(delta);
      }
  }
  
  contract FirstBuyPayoutProof is Test {
      using StateLibrary for IPoolManager;
      uint160 constant PRICE = 79228162514264337593543950336;
      IPoolManager manager;
      LaunchHook hook;
      LaunchToken token;
      FirstBuyActor actor;
      FirstBuyRecipient vault;
      FirstBuyRecipient dev;
      PoolKey key;
  
      function setUp() public {
          vm.warp(1700000000);
          manager = IPoolManager(address(new PoolManager(address(this))));
          token = new LaunchToken();
          vault = new FirstBuyRecipient();
          dev = new FirstBuyRecipient();
          address at = address((uint160(0x1234) << 144) | uint160(0x10cc));
          deployCodeTo("src/LaunchHook.sol:LaunchHook", abi.encode(manager, token, address(this), vault, dev), at);
          hook = LaunchHook(payable(at));
          key = PoolKey(Currency.wrap(address(0)), Currency.wrap(address(token)), 12500, 60, IHooks(at));
          manager.initialize(key, PRICE);
          actor = new FirstBuyActor(manager, token);
          token.transfer(address(actor), 800_000_000 ether);
          actor.seed(key);
          vm.deal(address(actor), 100 ether);
      }
  
      function test_firstBuyPaysBothAcceptingRecipientsInTheSameTransaction() public {
          assertEq(address(manager).balance, 0, "token-only seed contributes no ETH");
          BalanceDelta delta = actor.trade(key, SwapParams(true, -1 ether, PRICE / 2));
          assertEq(delta.amount0(), -1 ether);
          assertGt(delta.amount1(), 0, "the buy executed successfully");
          emit log_named_uint("dev ETH received", address(dev).balance);
          emit log_named_uint("vault ETH received", address(vault).balance);
          emit log_named_uint("claims deferred", hook.pendingClaims());
          assertEq(address(dev).balance, 0.005 ether, "accepting dev must receive ETH in the swap transaction");
          assertEq(address(vault).balance, 0.295 ether, "accepting research vault must receive ETH in the swap transaction");
      }
  }

  whole proof