Four agents audited the code as it is at f48b2a2, each in one area, and a judge reproduced, merged and ranked what they found, then read the code once more itself. Nothing in the code was changed or deployed.

Download the report (Markdown)

2 medium3 low6 info

• 1.mediumOracle validity is time-based, so a single off-market seed (first receipt, or first receipt after a 2-day gap) survives warm-up and charges MAX_EXTRA plus releases floorReserve at an unchanged market src/DynamicSellFloorProgram.sol:134

          if (uint256(o.lastTime) < uint256(o.seededAt) + MIN_COVERAGE) return (false, 0);

  averagePrice() treats the oracle as valid once one observation lands MIN_COVERAGE (1 day) after seededAt (line 134); it never checks that the rate-bounded short average has converged or that more than one observation exists. The seed path (line 238) writes a single receipt's execution price into both averages with no bound, both at first use and whenever the previous observation is older than STALE_AFTER (line 236).

  Every later update is capped at MAX_STEP_BPS (50% of emaShort, lines 245-247) regardless of elapsed time, and during warm-up the long average simply copies the capped short average (line 252). So one seed far from the market followed by one honest receipt a day later yields a 'valid' long average still far above spot: with a 10x seed the average is 8.9x spot, with a 2x seed after a stale gap it is 1.78x spot.

  The NatSpec at line 53 claims 'a bad seed cannot persist'; it does whenever trading is sparse, which is exactly the regime in which the reseed path fires. Consequences while the average is inflated (TAU_LONG = 84h, so for about 1-2 weeks of sparse trading): sellExtra() returns MAX_EXTRA (2.7%) for every large sell at the true market price, and _inDrawdown() is true, so releaseFloor() moves floorReserve to BURN_HOOK at RELEASE_MAX per hour during a drawdown that never happened.

  Who can cause it: the first >= 0.01 ETH trade after deployment or after any 2-day quiet period is the seed; a receipt's observed price is its own execution price, so a trader who pumps first (or trades after a pump) chooses the seed. Cost is the pool fee on the pump round trip (about 4.4% of pump volume, e.g. roughly 1.8 ETH to seed at 2x on a 100 ETH virtual reserve); it can also happen organically from one large buy's impact price.

  Verified: both specialists' scenarios (audit_flow bfcf3e4b and audit_economics fbd178a1) reproduce; they share this root cause and are merged here. Fix preserving the design: require a minimum number of tracked observations (and/or that the last update did not hit the step cap) before averagePrice() returns ok, and on a stale reseed keep the previous emaLong as the long seed instead of the new receipt's price.

  whole finding

  Fresh case (attached proof): mocks etched at GOVERNANCE, DRAW and POOL_MANAGER; vm.warp(1_800_000_000).

  Real price P = spotPrice(32<<96) = 976562500000000.

  Receipt 1 at t0: buy, amount0 = -0.01 ether, amount1 = 0.01e18*1e18/(10P) (seeds emaShort = emaLong = 10P).

  Receipt 2 at t0 + 1 day: buy, amount0 = -1 ether, amount1 = 1e18*1e18/P.

  Expected: averagePrice() not valid, or sellExtra(32<<96) == 0 because spot equals the market price.

  Actual: averagePrice() = (true, 8.888P), sellExtra(32<<96) == 27000, _inDrawdown() true.

  Stale-gap case (test_staleReseedPersists in test/scratch/JudgeRepro.t.sol): 26 hourly 1 ETH buys at 1000 CLAUS/ETH make the oracle valid at 1e15 with last observation T; at T + 2 days + 1 one buy amount0 = -0.01 ether, amount1 = 5e18 (price 2e15) reseeds both averages to 2e15 with no bound; at T + 3 days + 1 hour one honest buy (-1 ether, 1000e18) makes averagePrice() = (true, 1775139413563591); sellExtra(2505414483750479311864138015696) == 27000 at spot 1e15; releaseFloor() one hour later records drawdownSince != 0.

  Run: FOUNDRY_REMAPPINGS='forge-std/=/src/' forge test --match-path test/scratch/Proof_bfcf3e4b4d9b.t.sol (fails on current code).

  whole reproduction
  proof · a Foundry test that fails on this code and passes once it is fixed

  // SPDX-License-Identifier: MIT
  pragma solidity ^0.8.26;
  
  import "forge-std/Test.sol";
  import {DynamicSellFloorProgram} from "src/DynamicSellFloorProgram.sol";
  import {ProgramTypes} from "src/IClausTradeProgram.sol";
  
  contract MockGov {
      address public adapter;
      function set(address a) external { adapter = a; }
      function adapterFor(address) external view returns (address) { return adapter; }
      function approvedAdapter(address) external pure returns (bool) { return true; }
  }
  contract MockDraw {
      function startedAt() external pure returns (uint256) { return 0; }
      function endsAt() external pure returns (uint256) { return 0; }
  }
  contract MockPM {
      function balanceOf(address, uint256) external pure returns (uint256) { return 0; }
      function transfer(address, uint256, uint256) external pure returns (bool) { return true; }
  }
  
  contract OracleSeedTest is Test {
      DynamicSellFloorProgram p;
      address constant GOV = 0x180eAE784dEe739FBab432B06f78bF9a98Aae334;
      address constant DRAW = 0xF54c2f80c7A745C7b73F6c2035B7cAB87672f0A0;
      address constant PM = 0x000000000004444c5dc75cB358380D2e3dE08A90;
      address adapter = address(0xA11CE);
      uint160 constant SQRT_REAL = uint160(32 << 96); // 1024 CLAUS per ETH
  
      function setUp() public {
          vm.warp(1_800_000_000); // after every hard-coded draw / Buy&Hodl window
          vm.etch(GOV, address(new MockGov()).code);
          vm.etch(DRAW, address(new MockDraw()).code);
          vm.etch(PM, address(new MockPM()).code);
          MockGov(GOV).set(adapter);
          p = new DynamicSellFloorProgram();
      }
  
      function _trade(uint256 id, uint256 ts, uint256 ethWei, uint256 claus) internal {
          ProgramTypes.Trade memory t = ProgramTypes.Trade({
              id: id, module: adapter, sender: address(1), buy: true,
              amount0: -int128(int256(ethWei)), amount1: int128(int256(claus)),
              feeEth: 0, moduleFeeEth: 0, blockNumber: block.number, timestamp: ts,
              dataHash: keccak256("")
          });
          vm.prank(adapter);
          p.onTrade(t, "");
      }
  
      /// A seed at 10x the real price (one 0.01 ETH receipt), followed by ONE honest receipt
      /// at the real price exactly MIN_COVERAGE later, yields a "valid" average at ~8.9x the
      /// real price. Every large sell at the real, unchanged price then pays MAX_EXTRA, and the
      /// floor reserve is treated as being in a 15%+ drawdown.
      function test_badSeedPersistsPastWarmup() public {
          uint256 real = p.spotPrice(SQRT_REAL); // 976562500000000 wei per 1e18 CLAUS
          uint256 t0 = block.timestamp;
          // Seed: 0.01 ETH for (0.01e18*1e18/(10*real)) CLAUS => observed price = 10x real
          _trade(1, t0, 0.01 ether, 0.01 ether * 1e18 / (10 * real));
          vm.warp(t0 + 1 days);
          // One honest receipt at the real price
          _trade(2, t0 + 1 days, 1 ether, 1 ether * 1e18 / real);
  
          (bool ok, uint256 avg) = p.averagePrice();
          emit log_named_uint("avg / real (x1000)", avg * 1000 / real);
          // A sell at the real spot price, with the price never having fallen, must not pay the
          // drawdown extra. Currently it pays the full 2.7%.
          assertTrue(!ok || p.sellExtra(SQRT_REAL) == 0, "spot == real price but full sell extra charged");
      }
  }

  whole proof

• 2.mediumLarge-sell extra is avoided by splitting a sell into swaps of at most 0.5% of the virtual reserve, because isLargeSell is stateless and per swapsrc/DynamicSellFloorProgram.sol:89

          if (!isLargeSell(amountSpecified, sqrtPriceX96, liquidity)) return a; // Day 7

  The only condition that routes a sell into sellExtra() is isLargeSell() (line 89), a pure function of the single swap's amountSpecified against 0.5% of the in-range virtual reserve (lines 97-107). quote() reads no per-sender, per-block or cumulative state, so N consecutive sub-threshold swaps in one transaction (Universal Router or any contract) deliver the same output as one large swap at the same price path, and each is quoted the base A5 only.

  The base 2.2% is paid either way; the only cost of splitting is gas. The sells the program exists to tax (large sells into a drawdown, up to 2.7% of gross) are therefore exactly the ones that can opt out, and floorReserve grows only from sellers who do not bother. Example on a 100 ETH virtual reserve at full deficit: one 10 ETH sell owes 0.27 ETH extra; 20 swaps of 0.5 ETH owe 0 and cost about 20 x 150k gas.

  This is inherent to the Day 7 per-swap size gate rather than a coding slip, so the fix is a design choice for the requester: (a) drop the size gate and let the deficit alone set the extra, (b) have the adapter pass cumulative per-block or per-sender sell volume in the quote data and gate on that, or (c) measure 'large' by the price move the swap would cause (post-swap price) rather than by amountSpecified.

  whole finding

  State: oracle valid at emaLong = 1e15 (26 hourly buys of 1 ETH for 1000e18 CLAUS), liquidity L = 1e24, sqrtPriceX96 = 2717503554927417939056391812168 (spot 8.5e14, 15% below the average). reserve1 = (L * (sqrtP >> 32)) >> 64 = 34299717028501767865670754; piece = reserve1 * 50 / 10000.

  Input A: quote(any, false, -(20 * piece), sqrtP, L, '') -> a[5] == 29000 (base 2000 + MAX_EXTRA 27000).

  Input B: 20 calls quote(any, false, -piece, sqrtP, L, '') -> every a[5] == 2000.

  Expected: a sell of 10% of the reserve into a 15% drawdown pays the extra.

  Actual: 0 extra when split. test_splitSellBypassesExtra in test/scratch/JudgeRepro.t.sol.

  whole reproduction

• 3.lowsellExtra uses only the pre-swap spot price, so a buy that lifts spot to the average removes the extra from a sell of any sizesrc/DynamicSellFloorProgram.sol:90

          a[5] = A5 + sellExtra(sqrtPriceX96);

  sellExtra() compares the sqrtPriceX96 the caller passes to quote() (the pool price before the swap) with the slow average and returns 0 whenever spot >= avg (line 114). The oracle is rate bounded but the spot side is not. A seller who first buys enough to lift the pool to the average and then sells is quoted the base allocation for the sell regardless of its size, while the sell itself drives the price back below the average.

  Cost of the bypass is the base fee on both legs of the pump (about 0.044 x pump, where lifting the price by deficit d on virtual reserve R costs about R*d/2 ETH); the avoided extra is up to 2.7% of the sell, so the pump pays for sells above roughly 12% of the virtual reserve (R = 100 ETH, d = 15%: pump 7.24 ETH, fees 0.32 ETH, extra avoided on a 20 ETH sell 0.54 ETH).

  Splitting (previous finding) is cheaper and dominates today, so this matters once the size gate is fixed; it is kept separate because it needs a different fix: evaluate the deficit against the post-swap price (or min(pre, post)) or a short time-weighted price rather than the instantaneous pre-swap spot.

  whole finding

  State: oracle valid at 1e15, L = 1e24.

  Input A: quote(any, false, -1e25, sqrtP = 2640938750475477889760800828730 (spot 9e14), L, '') -> a[5] == 20000.

  Input B, same oracle state after a buy moved the pool to sqrtP = 2505414483750479311864138015696 (spot = avg): quote(any, false, -1e25, sqrtP, L, '') -> a[5] == 2000, i.e. a sell of about 30% of the reserve pays no extra.

  Expected: a sell that large into a 10% drawdown pays 1.8% extra. test_prePumpZeroesExtra in test/scratch/JudgeRepro.t.sol.

• 4.lowA late-delivered buy with an id below lastAttestedBuy never invalidates its reign, so crownKeeper succeeds on a reign the contract already holds a contradicting receipt forsrc/DynamicSellFloorProgram.sol:415

          if (last != 0 && t.id > last && t.timestamp < uint256(buyTime[last]) + KEEPER_REIGN) {

  _keeperOnBuy auto-contradicts only when the new receipt's id is greater than lastAttestedBuy (line 415).

  A buy receipt delivered late, whose id lies between an attested reign and its next attested buy and whose timestamp is inside that reign's 24h, is recorded in buyTime but contradicts nothing. keeperCrownable (lines 493-500) checks only keeperOf, reignCrowned, reignInvalid, scanThrough and the next attested buy's time, none of which this receipt touches, so anyone can crownKeeper the reign and push it into the hall of fame after the contract already knows the keys moved.

  The property stated at lines 386-387 ('A delivered buy that contradicts the attested coverage invalidates the affected reign') therefore holds only for the latest reign; earlier reigns depend on a separate permissionless invalidateBySkippedBuy call that races with crownKeeper. No ETH or claim value depends on the crown, so impact is a wrong hall-of-fame entry that must afterwards be flagged via reignRevoked.

  Minimal fix preserving the design: in _keeperOnBuy, when t.id < lastAttestedBuy, walk back a bounded number of attested ids (add a prevAttestedBuy link set in _attestKeeper) to the attested id just below t.id and call _contradict if t.timestamp < buyTime[thatId] + KEEPER_REIGN.

  whole finding

  State: buy id 10 delivered at T0 and attested (wallet 0xBEEF); buy id 20 delivered and attested at T0+25h; attester calls attestScan(T0+24h).

  Input: adapter delivers buy receipt id 15 with timestamp T0+5h (accepted: timestamp <= block.timestamp, id unused).

  Expected: reign 10 invalid (keeperCrownable(10) == false, crownKeeper(10) reverts KeeperNotReady).

  Actual: keeperCrownable(10) == true and crownKeeper(10) succeeds, pushing (0xBEEF, T0, T0+24h, 10) into the hall of fame.

  Run: FOUNDRY_REMAPPINGS='forge-std/=/src/' forge test --match-path test/scratch/Proof_5c85bc2d8fa5.t.sol (fails on current code).

  whole reproduction
  proof · a Foundry test that fails on this code and passes once it is fixed

  // SPDX-License-Identifier: MIT
  pragma solidity ^0.8.26;
  import "forge-std/Test.sol";
  import {DynamicSellFloorProgram} from "src/DynamicSellFloorProgram.sol";
  import {ProgramTypes} from "src/IClausTradeProgram.sol";
  
  contract MockPM {
      mapping(address => mapping(uint256 => uint256)) public balanceOf;
      function transfer(address to, uint256 id, uint256 amount) external returns (bool) { balanceOf[msg.sender][id] -= amount; balanceOf[to][id] += amount; return true; }
  }
  contract MockGov {
      address public adapter;
      function set(address a) external { adapter = a; }
      function adapterFor(address) external view returns (address) { return adapter; }
      function approvedAdapter(address a) external view returns (bool) { return a == adapter; }
  }
  contract MockDraw { function startedAt() external pure returns (uint256) { return 1; } function endsAt() external pure returns (uint256) { return 2; } }
  
  contract KeeperCrownAfterContradiction is Test {
      DynamicSellFloorProgram p;
      address adapter = address(0xADA);
      function setUp() public {
          vm.warp(1_800_000_000);
          vm.etch(0x000000000004444c5dc75cB358380D2e3dE08A90, address(new MockPM()).code);
          vm.etch(0x180eAE784dEe739FBab432B06f78bF9a98Aae334, address(new MockGov()).code);
          MockGov(0x180eAE784dEe739FBab432B06f78bF9a98Aae334).set(adapter);
          vm.etch(0xF54c2f80c7A745C7b73F6c2035B7cAB87672f0A0, address(new MockDraw()).code);
          p = new DynamicSellFloorProgram();
      }
      function buy(uint256 id, uint256 ts) internal {
          ProgramTypes.Trade memory t = ProgramTypes.Trade(id, adapter, address(1), true, -1 ether, 1000e18, 0, 0, block.number, ts, keccak256(""));
          vm.prank(adapter); p.onTrade(t, "");
      }
      /// Reign 10 starts at T0. Buy 20 at T0+25h is attested, scan covers T0+24h. Then buy 15 (T0+5h)
      /// is delivered late. The contract now holds a receipt proving the keys moved at T0+5h, but
      /// crownKeeper(10) still succeeds because _keeperOnBuy only contradicts lastAttestedBuy.
      function test_crownSucceedsAfterContradictingBuyDelivered() public {
          uint256 t0 = block.timestamp;
          buy(10, t0);
          vm.prank(p.ATTESTER()); p.attestKeeper(10, address(0xBEEF));
          vm.warp(t0 + 25 hours);
          buy(20, t0 + 25 hours);
          vm.prank(p.ATTESTER()); p.attestKeeper(20, address(0xCAFE));
          vm.prank(p.ATTESTER()); p.attestScan(uint64(t0 + 24 hours));
          buy(15, t0 + 5 hours); // late delivery, inside reign 10
          assertEq(p.buyTime(15), t0 + 5 hours);
          // Expected: reign 10 invalid (comment line 386-387: a delivered contradicting buy invalidates the reign)
          // Actual: still crownable and crownKeeper succeeds.
          assertFalse(p.keeperCrownable(10), "reign 10 should not be crownable after contradicting buy 15 was delivered");
          vm.expectRevert(); p.crownKeeper(10);
      }
  }

  whole proof

• 5.lowReceipt replay guard and keeper state are keyed on trade.id alone, so a replacement adapter whose ids overlap is rejected or ignoredsrc/ClausDrawFundingProgram.sol:44

          if (trade.module != msg.sender || drawReceiptConsumed[trade.id] || trade.dataHash != keccak256(data) || trade.timestamp > block.timestamp)

  GOVERNANCE can change adapterFor(program) after this review. drawReceiptConsumed (line 44), buyTime, the strictly increasing attestation chain (lastAttestedBuy) and nextAttestedBuy are keyed only on trade.id, not on (module, id).

  If a new adapter numbers its receipts in a range that overlaps ids the old adapter already delivered: (a) onTrade reverts DrawFundingInvalidReceipt for every overlapping id, so those receipts' fee accounting (recipientAccrued/floorReserve), oracle updates and volume are never recorded; (b) _keeperOnBuy returns early for ids that already have buyTime, and _attestKeeper reverts for any id <= lastAttestedBuy, so the keeper feature stalls.

  Whether ids can overlap depends on how the external adapter numbers receipts, which this repository does not show; that is an assumption, so severity is low.

  Fix: key consumption and keeper state on keccak256(module, id), or record the adapter in effect and namespace on change.

  whole finding

  Mock GOVERNANCE.adapterFor = A, approvedAdapter(A) true.

  A delivers a receipt with id = 1 (succeeds).

  Governance sets adapterFor = B.

  B delivers its own first receipt with id = 1 and module = B.

  Expected: accepted, a different receipt from a different adapter.

  Actual: reverts DrawFundingInvalidReceipt(). test_adapterSwapIdOverlap in test/scratch/JudgeRepro.t.sol.

• 6.infoquote() and onTrade() hard-depend on DRAW.startedAt()/endsAt(); the try/catch in floorShare can never engagesrc/ClausDrawFundingProgram.sol:36

          if ((block.timestamp < IClausDrawWindow(DRAW).endsAt() || block.timestamp < BUY_HODL_END) && allocation[5] < 2000)

  The inherited quote (line 36) and onTrade (line 49) call IClausDrawWindow(DRAW).endsAt()/startedAt() unguarded, so any revert or missing code at DRAW makes every quote and every receipt delivery revert.

  The override's floorShare (DynamicSellFloorProgram.sol lines 173-179) checks DRAW.code.length and wraps both views in nested try/catch, but it runs only after the parent's unguarded calls have already succeeded, so that defence is dead code and suggests a graceful degradation that does not exist.

  On mainnet DRAW (0xF54c...f0A0) has 8527 bytes of non-proxy code and returns startedAt 1793200595 / endsAt 1793805395 (read on 2026-11-03), and post-Cancun code cannot be removed, so the failing state was not observed; recorded as a dependency and dead-defence note. If graceful degradation is wanted, move the try/catch into the parent's quote/onTrade (a failed window read means 'outside the window'); otherwise drop the dead guard.

  whole finding

  State: no code at DRAW (vm.etch(DRAW, '')), as in any non-fork environment.

  Input: quote(any, true, -1e18, 2**96, 1e18, '') or onTrade(validReceipt, '') from the approved adapter.

  Expected if the floorShare defence were effective: base allocation returned / receipt processed with the draw deduction skipped.

  Actual: both revert before floorShare runs, while floorShare(sellReceipt) called directly succeeds. test_quoteRevertsWithoutDrawCode in test/scratch/JudgeRepro.t.sol.

• 7.infoTrust assumptions: operator-controlled GOVERNANCE selects the adapter that fabricates every receipt; RECIPIENT and ATTESTER are single EOAs; DRAW window read livesrc/ClausDrawFundingProgram.sol:42

          if (msg.sender != authority.adapterFor(address(this)) || !authority.approvedAdapter(msg.sender))

  Inventory of the privileged roles and mutable dependencies that can change behaviour after this review (merged from audit_economics bb296070 and audit_permissions c321b3c5). (1) onTrade accepts receipts only from adapterFor(this) that is also approvedAdapter, both read at call time from GOVERNANCE 0x180e...e334 (6585 bytes of code on mainnet; operator() = 0xAB71...2073, an EOA with no code).

  The operator can at any time point adapterFor elsewhere (every further onTrade here reverts DrawFundingUnauthorized) or approve an adapter that fabricates receipts: the program verifies only module == msg.sender, unused id, dataHash and timestamp <= now, and trusts id, amounts (oracle, hyperdrive volume, keeper), feeEth and moduleFeeEth (recipientAccrued/floorReserve) with no on-chain cross-check.

  Verified mitigating property: even a hostile adapter cannot direct claims to itself. collectFees pays only RECIPIENT and only up to balance - floorReserve (line 212 of the override), _maybeRelease pays only BURN_HOOK and only up to balance - pending, and the base pays only DRAW_FUNDING and BUY_HODL; the worst a hostile adapter can do is re-split held claims between those fixed destinations and skew the oracle.

  (2) RECIPIENT 0x5a42...d995 and ATTESTER 0x8aCA...4cFa have no code on mainnet: the native transfer in unlockCallback cannot re-enter, and keeper wallets/scan coverage are a single-key trust. (3) DRAW_FUNDING and BUY_HODL have code (8350 and 6761 bytes) and no EIP-1967 slots.

  (4) Assumptions this repository cannot verify: that the adapter transfers trade.moduleFeeEth in id-0 claims before or during onTrade (the invariant balance >= floorReserve + pending depends on it), and that a sell receipt's amount0 is gross ETH before fee (floorShare line 170 and _recordVolume line 338 treat it so; if it is net of fee, floorShare diverts part of the base module fee to floorReserve).

  whole finding

  State: GOVERNANCE.adapterFor(program) returns X and approvedAdapter(X) is true.

  Input: X calls onTrade with Trade{id: fresh, module: X, buy: false, amount0: 1e18, amount1: 1, feeEth: 0, moduleFeeEth: 1e18, timestamp: block.timestamp, dataHash: keccak256('')} and data ''.

  Actual: accepted; recipientAccrued and/or floorReserve rise by 1e18 without any claims arriving, and the next collectFees/releaseFloor pay out of whatever claims the program already holds, bounded by the two balance checks.

  Conversely after the operator calls setModule(other) on GOVERNANCE, the previously valid adapter's onTrade reverts DrawFundingUnauthorized at lines 42-43.

  Expected: by design; recorded as the trust boundary, not a bypass.

  whole reproduction

• 8.infoFloor reserve destination BURN_HOOK is an EIP-1967 transparent proxy whose upgrader could not be identified; released claims follow whatever implementation is installed latersrc/DynamicSellFloorProgram.sol:60

      address public constant BURN_HOOK = 0x37Bfb8AC7C960E558657871D41Ca70E07e7DbfFf;

  _maybeRelease (line 310) transfers PoolManager ETH claims (id 0) to BURN_HOOK permissionlessly, up to 0.05 ETH per hour, and in stale mode without any price condition.

  Read on mainnet on 2026-11-03: 0x37Bf...bfFf holds 3070 bytes of proxy code; its EIP-1967 implementation slot is 0xa62f9b597225779b430024398b70374e8468ce14 (24261 bytes) and its admin slot is 0x1f22e4b065b2f15fed5be556dc0fa636048d29bc (1018 bytes, owner() returns the zero address, so it is either a renounced ProxyAdmin or a different pattern; the upgrader could not be determined). The program cannot pause or redirect releases.

  Whether the hook spends ERC-6909 claims pushed to it by a third-party transfer, rather than only claims it minted itself, could not be verified without its source; if it does not, released reserve is stranded in the hook's claim balance. Record the upgrade authority of 0x37Bf... and the hook's handling of externally transferred claims as explicit trust assumptions before launch.

  whole finding

  State: floorReserve > 0 and either the drawdown condition held for 1h or no non-dust receipt for 2 days.

  Input: anyone calls releaseFloor().

  Actual: PoolManager.transfer(BURN_HOOK, 0, amount) succeeds unconditionally (ERC-6909 has no receiver hook) and floorReserve is reduced; what happens to the claims is decided by the proxy's current implementation.

  Observed: cast storage 0x37Bfb8AC7C960E558657871D41Ca70E07e7DbfFf 0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc -> 0x...a62f9b597225779b430024398b70374e8468ce14; admin slot 0xb53127...6103 -> 0x...1f22e4b065b2f15fed5be556dc0fa636048d29bc.

  whole reproduction

• 9.infoNo recovery path: id-0 claims above floorReserve + pending, and claims of any other currency id, are permanently stucksrc/DynamicSellFloorProgram.sol:212

          if (IFloorClaims(POOL_MANAGER).balanceOf(address(this), 0) < amount + floorReserve) revert CollectInvalid();

  The only two outflows are collectFees() (bounded by recipientAccrued - recipientCollected, line 211) and _maybeRelease() (bounded by floorReserve). Any id-0 claim balance not represented in those counters (rounding dust from the base contract's halving, claims transferred directly to the program, adapter over-delivery) can never be moved, and claims of any other currency id are not handled at all.

  There is intentionally no owner, so this is a design consequence rather than a defect; it is reported because the task asks for custody and recovery to be checked. If the requester wants it closed: let anyone sweep max(0, balance - floorReserve - pending) of id 0 to BURN_HOOK or RECIPIENT via the existing unlock/burn/take path, which adds no new trust.

  State: floorReserve = 0, recipientAccrued == recipientCollected.

  Input: any account transfers 1 wei of PoolManager claim id 0 to the program.

  Actual: collectFees(1) reverts CollectInvalid (amount > pending = 0); releasable() returns (0, false); releaseFloor() returns 0; no other function moves claims.

  Expected under the task's recovery check: a bounded, permissionless sweep to one of the fixed recipients. test_strayClaimStuck in test/scratch/JudgeRepro.t.sol.

• 10.infoShort-EMA rate limiter freezes permanently once emaShort is tiny (cap = s/2 rounds to 0 at s == 1)src/DynamicSellFloorProgram.sol:246

          uint256 cap = s * MAX_STEP_BPS / 10000;

  _observe bounds each short-average step by maxDelta = s2500dt/36_000_000 capped at cap = s*5000/10000 (lines 245-247), both relative to the previous short average and both rounding down. With s == 1 the cap is 0, so target is clamped to s on every later observation and the long average, which copies target during warm-up and is an EMA of target afterwards, is pinned too. More generally for s < 14400/dt the per-update step rounds to 0.

  The state is only entered through the unbounded (re)seed path (line 238) with a receipt whose amount1 >= amount0 * 1e18, i.e. >= 1e34 CLAUS base units against 0.01 ETH, which is not achievable at any plausible CLAUS price; reported as a verified numerical boundary, not an exploitable defect. Once stuck, averagePrice stays (true, 1) after warm-up, so sellExtra returns 0 for every large sell and _inDrawdown is always false until a stale reseed.

  Minimal fix: floor maxDelta at 1 (if (maxDelta == 0) maxDelta = 1) or reject seeds below a sanity floor.

  whole finding

  Fresh deployment, DRAW window closed.

  Receipt 1: buy, amount0 = -0.01 ether, amount1 = 1e34 -> oracle = (1, 1, t0, t0).

  Then one buy per hour for 30 hours, amount0 = -1 ether, amount1 = 1e25 (price 1e11).

  Expected: the short average converges toward 1e11 within the 25%/hour bound.

  Actual: oracle.emaShort == 1 and oracle.emaLong == 1 after 30 observations; averagePrice() == (true, 1); sellExtra(any) == 0. test_seedOneFreezes in test/scratch/JudgeRepro.t.sol.

• 11.infosellExtra treats a spot price that rounds to 0 wei as missing data, dropping the extra at the deepest possible deficitsrc/DynamicSellFloorProgram.sol:114

          if (spot == 0 || spot >= avg) return 0;

  spotPrice returns ETH wei per 1e18 CLAUS as an integer and returns 0 for sqrtPriceX96 above about 7.92e37 (below Uniswap's MAX_SQRT_PRICE of about 1.46e48), where the true value is below 1 wei. sellExtra uses spot == 0 as the same sentinel as 'no price' (line 114) and returns 0, although with a valid average a zero spot is the maximal deficit and MAX_EXTRA is the intended result.

  Reaching this region requires the pool price to exceed 1e18 CLAUS base units per ETH, so it is a verified boundary of the formula rather than a reachable loss on the current pool.

  Minimal fix: return 0 only when sqrtPriceX96 == 0 and let spot == 0 fall through to the deficit computation.

  Oracle warmed up with a valid average (26 hourly 1 ETH buys at 1e15). sellExtra(uint160(8e46)) -> expected MAX_EXTRA (spot far more than 15% below avg); actual spotPrice(8e46) == 0 and sellExtra == 0, while sellExtra(uint160(7e37)) == 27000. test_spotZeroDropsExtra in test/scratch/JudgeRepro.t.sol.

1. Postedunder a minuteto the first attempt
2. Audit flowAgent #1989found 1 medium, 1 low

   That notification is from my earlier search for a local copy of forge-std, which I no longer need. I fetched forge-std into a separate project in /tmp instead and ran both tests there, so nothing changes. .imd-findings.json still holds the two findings.

   ran onclaude · claude-opus-5-5 · 1 turn · 9m 24s · 4 in · 106 out · 62K cached

   submissionca89eb96e88f53133fa4db8c0ff99b7746cad1c2a66999d3567cbe428636b64f

   device827152cce766ca0d9dcb2e5f328488bd1288d7474704ab1ce3c5473a88ea008f

   started fromf48b2a22465c226582079df2321055460bb41c7e

   bundlenone

   • mediumOne bad seed price passes oracle warm-up when trading is sparse, causing false MAX_EXTRA sell fees and floor releases that were not caused by a real price dropsrc/DynamicSellFloorProgram.sol:134

     averagePrice() treats the oracle as warmed up once one observation lands MIN_COVERAGE (1 day) after the seed. It does not check that the rate-bounded short average has actually converged. _observe caps each update at MAX_STEP_BPS (50% of emaShort, line 246) no matter how much time has passed.

     So if the price was seeded far from the market (one >=0.01 ETH receipt after 2+ days without activity, for example sandwiched inside an atomic pump/dump of the pool), and the next receipt arrives about 24h later, one update can only halve the seed. Then the long EMA is computed from that half-corrected value (line 252). The NatSpec says 'a bad seed cannot persist', but here it does.

     The result is a 'valid' long average many times the real price. Every large sell at an unchanged market price pays MAX_EXTRA (2.7%) instead of 0. _inDrawdown() is true (emaShort < 85% of emaLong), so floorReserve is released to BURN_HOOK at 0.05 ETH/h during what is not a real drawdown. Because TAU_LONG = 84h, the inflated long average stays more than 15% above spot for roughly 1-2 weeks after the short average has converged.

     Fix idea: require a minimum number of observations, or require |emaShort - price| to be within a bound before the average counts as valid. Alternatively, do not allow coverage to complete until emaShort has stopped hitting the step cap.

     whole finding

     Setup: mocks at GOVERNANCE/DRAW/PoolManager; warp to 1_800_000_000 (outside the draw and Buy&Hodl windows); program has never been seeded (or 2+ days since lastTime).

     Real pool price sqrtPriceX96 = 32<<96, so spotPrice = 976562500000000 wei per 1e18 CLAUS (P).

     Receipt id 1 at t0: buy, amount0 = -0.01 ether, amount1 = 0.01e18*1e18/(10P), which seeds emaShort = emaLong = 10P.

     Receipt id 2 at t0+1 day: buy, amount0 = -1 ether, amount1 = 1e18*1e18/P (price P).

     Expected: the average is not valid yet, or sellExtra(32<<96) == 0, since spot equals the market price.

     Actual: averagePrice() = (true, 8.888P), emaShort = 5P, sellExtra(32<<96) = 27000 (MAX_EXTRA), and _inDrawdown() is true.

     Verified with the attached Foundry test (log: avg/real x1000 = 8888).

     whole reproduction
     proof · a Foundry test the fix has to pass

     // SPDX-License-Identifier: MIT
     pragma solidity ^0.8.26;
     
     import "forge-std/Test.sol";
     import {DynamicSellFloorProgram} from "src/DynamicSellFloorProgram.sol";
     import {ProgramTypes} from "src/IClausTradeProgram.sol";
     
     contract MockGov {
         address public adapter;
         function set(address a) external { adapter = a; }
         function adapterFor(address) external view returns (address) { return adapter; }
         function approvedAdapter(address) external pure returns (bool) { return true; }
     }
     contract MockDraw {
         function startedAt() external pure returns (uint256) { return 0; }
         function endsAt() external pure returns (uint256) { return 0; }
     }
     contract MockPM {
         function balanceOf(address, uint256) external pure returns (uint256) { return 0; }
         function transfer(address, uint256, uint256) external pure returns (bool) { return true; }
     }
     
     contract OracleSeedTest is Test {
         DynamicSellFloorProgram p;
         address constant GOV = 0x180eAE784dEe739FBab432B06f78bF9a98Aae334;
         address constant DRAW = 0xF54c2f80c7A745C7b73F6c2035B7cAB87672f0A0;
         address constant PM = 0x000000000004444c5dc75cB358380D2e3dE08A90;
         address adapter = address(0xA11CE);
         uint160 constant SQRT_REAL = uint160(32 << 96); // 1024 CLAUS per ETH
     
         function setUp() public {
             vm.warp(1_800_000_000); // after every hard-coded draw / Buy&Hodl window
             vm.etch(GOV, address(new MockGov()).code);
             vm.etch(DRAW, address(new MockDraw()).code);
             vm.etch(PM, address(new MockPM()).code);
             MockGov(GOV).set(adapter);
             p = new DynamicSellFloorProgram();
         }
     
         function _trade(uint256 id, uint256 ts, uint256 ethWei, uint256 claus) internal {
             ProgramTypes.Trade memory t = ProgramTypes.Trade({
                 id: id, module: adapter, sender: address(1), buy: true,
                 amount0: -int128(int256(ethWei)), amount1: int128(int256(claus)),
                 feeEth: 0, moduleFeeEth: 0, blockNumber: block.number, timestamp: ts,
                 dataHash: keccak256("")
             });
             vm.prank(adapter);
             p.onTrade(t, "");
         }
     
         /// A seed at 10x the real price (one 0.01 ETH receipt), followed by ONE honest receipt
         /// at the real price exactly MIN_COVERAGE later, yields a "valid" average at ~8.9x the
         /// real price. Every large sell at the real, unchanged price then pays MAX_EXTRA, and the
         /// floor reserve is treated as being in a 15%+ drawdown.
         function test_badSeedPersistsPastWarmup() public {
             uint256 real = p.spotPrice(SQRT_REAL); // 976562500000000 wei per 1e18 CLAUS
             uint256 t0 = block.timestamp;
             // Seed: 0.01 ETH for (0.01e18*1e18/(10*real)) CLAUS => observed price = 10x real
             _trade(1, t0, 0.01 ether, 0.01 ether * 1e18 / (10 * real));
             vm.warp(t0 + 1 days);
             // One honest receipt at the real price
             _trade(2, t0 + 1 days, 1 ether, 1 ether * 1e18 / real);
     
             (bool ok, uint256 avg) = p.averagePrice();
             emit log_named_uint("avg / real (x1000)", avg * 1000 / real);
             // A sell at the real spot price, with the price never having fallen, must not pay the
             // drawdown extra. Currently it pays the full 2.7%.
             assertTrue(!ok || p.sellExtra(SQRT_REAL) == 0, "spot == real price but full sell extra charged");
         }
     }

     whole proof

   • lowReceipt replay guard and keeper state are keyed on trade.id alone, so a replacement adapter whose ids overlap is rejected or ignoredsrc/ClausDrawFundingProgram.sol:44

     GOVERNANCE (0x180e...) can change adapterFor(program) after this review. drawReceiptConsumed, buyTime, the keeper attestation chain (strictly increasing lastAttestedBuy) and nextAttestedBuy are all keyed only on trade.id, not on (module, id).

     If the new adapter numbers its receipts in a range that overlaps ids the old adapter already delivered, then: (a) onTrade reverts with DrawFundingInvalidReceipt for every overlapping id, so those receipts' fee accounting (recipientAccrued/floorReserve), oracle updates and volume are never recorded; and (b) _keeperOnBuy returns early for ids that already have buyTime, and _attestKeeper reverts for any id <= lastAttestedBuy, so the keeper feature stalls.

     Whether ids overlap depends on how the external adapter numbers receipts. That cannot be verified from this repository and is an assumption.

     Fix: key consumption and keeper state on keccak256(module, id), or record the adapter in effect and reset or namespace on change.

     whole finding

     Mock GOVERNANCE.adapterFor = A.

     A delivers a receipt with id = 1 (succeeds).

     Governance sets adapterFor = B.

     B delivers its own first receipt with id = 1 and module = B.

     Expected: accepted, since it is a different receipt from a different adapter.

     Actual: reverts with DrawFundingInvalidReceipt().

     Verified with a scratch Foundry test (vm.expectRevert passes).

3. Audit permissionsAgent #729found 1 low, 3 info

   The review is complete. .imd-findings.json holds four findings, and no tracked file was changed.

   Files read. src/DynamicSellFloorProgram.sol (entry, 519 lines) and both runtime dependencies it imports: src/ClausDrawFundingProgram.sol (abstract parent that implements quote/onTrade and the draw/Buy&Hodl deductions) and src/IClausTradeProgram.sol (the Trade struct and IProgram interface). Coverage of the entry file and its imports is complete. The chain-side dependencies were checked by bytecode and storage reads on mainnet, not by source, so their internals are assumptions.

   What the contract does. It is a fee-allocation program behind a Uniswap v4 hook. The operator-controlled governance contract chooses an adapter, and only that adapter may deliver trade receipts. Each receipt moves a rate-bounded price EMA, a 24h volume window, the keeper-of-the-keys record, and splits the remaining module fee into a floor reserve (only the large-sell extra) and an accrual for a fixed recipient. ETH claims leave the contract only to four hardcoded destinations: the draw funder and Buy&Hodl (parent), the fixed recipient via collectFees, and the burn hook via capped hourly releases.

   Verified properties (scratch tests under test/scratch pass on the current code):

   • Only the governance-approved adapter can call onTrade. Receipts are bound by module, unused id, data hash, and a timestamp at or before now. Duplicates revert.
   • collectFees is permissionless but pays only the constant recipient, never below the floor reserve, and unlockCallback rejects any caller but the PoolManager outside an in-flight collection. Reentrancy via the recipient is blocked by the payment flag.
   • Releases go only to the burn hook, are capped per hour, never touch claims backing pending recipient fees, and restore state if the transfer fails.
   • Attestation and scan are attester-only. The permissionless skipped-buy proof only invalidates reigns that a delivered receipt genuinely contradicts.

   Findings written:

   • Low, line 415. A late-delivered buy whose id is below the last attested id never auto-invalidates its reign, so crownKeeper succeeds on a reign the contract already holds a contradicting receipt for. The test in test/scratch/KeeperCrownAfterContradiction.t.sol fails on this code and is attached as proof. Impact is a wrong hall-of-fame entry only. No ETH depends on the crown.
   • Info, line 60. The burn hook that receives the reserve is an EIP-1967 proxy with a live implementation slot, so its behaviour can change after review and the upgrader could not be identified on chain.
   • Info, parent line 42. Receipt delivery authority is fully delegated to the operator of the governance contract, which exposes setModule, setOperator and createAdapter. A newly approved adapter can fabricate every receipt field the program trusts.
   • Info, parent line 36. quote and onTrade revert outright if the draw contract's views fail, while the try/catch in floorShare is dead defence. Not observed on chain.

   Open assumptions, not findings. Auto-collection inside _afterTrade only works if the PoolManager is locked when receipts arrive. If delivery happens inside the swap, every attempt reverts and manual collectFees is needed. The adapter is assumed to credit exactly moduleFeeEth of claims before calling onTrade. Whether the burn hook spends externally transferred claims is unverified. The condition at line 471 is unreachable but harmless. Economics, math, and control-flow passes were outside the assigned permissions area and were not performed in depth.

   ran onclaude · claude-fable-5-1 · 33 turns · 11m 59s · 418 in · 51K out · 1M cached

   submissiondd50b1b44c21642d768ee0aa9fd89e179a77383c699d74ec61cbfa3c1647fc19

   devicefa2b0b9c7ebc154780b1c3f35982d6c9c2950dc9328019427fef7c6d9213c7f6

   started fromf48b2a22465c226582079df2321055460bb41c7e

   bundlenone

   • lowLate-delivered buy with an id below lastAttestedBuy never invalidates its reign, so crownKeeper succeeds on a reign the contract already holds a contradicting receipt forsrc/DynamicSellFloorProgram.sol:415

     Asymmetry between the two delivery orders of a contradicting buy. _keeperOnBuy auto-contradicts only when the new receipt's id is greater than lastAttestedBuy (line 415).

     A buy receipt delivered late, whose id lies between an attested reign and its next attested buy and whose timestamp is inside that reign's 24h, is recorded in buyTime but contradicts nothing. keeperCrownable (lines 493-500) checks only keeperOf, reignCrowned, reignInvalid, scanThrough and the next attested buy's time, none of which this receipt touches, so anyone can crownKeeper the reign and push it into the hall of fame after the contract already knows the keys moved.

     The stated property at lines 386-387 ('A delivered buy that contradicts the attested coverage invalidates the affected reign') holds only for the latest reign; for earlier reigns it requires a separate permissionless invalidateBySkippedBuy call, which races with crownKeeper. No ETH or claim value depends on the crown, so impact is limited to a wrong hall-of-fame entry that must afterwards be flagged via reignRevoked.

     Minimal fix preserving the design: add a reverse link prevAttestedBuy (set in _attestKeeper) and in _keeperOnBuy, when t.id < lastAttestedBuy, walk back from lastAttestedBuy a bounded number of steps to the attested id just below t.id and call _contradict if t.timestamp < buyTime[thatId] + KEEPER_REIGN; alternatively make keeperCrownable require that no delivered unattested buy exists in (tradeId, nextAttestedBuy) by tracking a per-reign counter incremented in _keeperOnBuy via the same bounded walk.

     whole finding

     State: buy id 10 delivered at T0 and attested (wallet 0xBEEF); buy id 20 delivered and attested at T0+25h; attester calls attestScan(T0+24h).

     Input: adapter delivers buy receipt id 15 with timestamp T0+5h (accepted: timestamp <= block.timestamp, id unused).

     Expected: reign 10 is invalid (keeperCrownable(10) == false, crownKeeper(10) reverts KeeperNotReady).

     Actual: keeperCrownable(10) == true and crownKeeper(10) succeeds, pushing (0xBEEF, T0, T0+24h, 10) into the hall of fame; only a later invalidateBySkippedBuy(10, 15) sets reignRevoked[10].

     Run: FOUNDRY_REMAPPINGS="forge-std/=/src/" forge test --match-path test/scratch/KeeperCrownAfterContradiction.t.sol (fails on current code).

     whole reproduction
     proof · a Foundry test the fix has to pass

     // SPDX-License-Identifier: MIT
     pragma solidity ^0.8.26;
     import "forge-std/Test.sol";
     import {DynamicSellFloorProgram} from "src/DynamicSellFloorProgram.sol";
     import {ProgramTypes} from "src/IClausTradeProgram.sol";
     
     contract MockPM {
         mapping(address => mapping(uint256 => uint256)) public balanceOf;
         function transfer(address to, uint256 id, uint256 amount) external returns (bool) { balanceOf[msg.sender][id] -= amount; balanceOf[to][id] += amount; return true; }
     }
     contract MockGov {
         address public adapter;
         function set(address a) external { adapter = a; }
         function adapterFor(address) external view returns (address) { return adapter; }
         function approvedAdapter(address a) external view returns (bool) { return a == adapter; }
     }
     contract MockDraw { function startedAt() external pure returns (uint256) { return 1; } function endsAt() external pure returns (uint256) { return 2; } }
     
     contract KeeperCrownAfterContradiction is Test {
         DynamicSellFloorProgram p;
         address adapter = address(0xADA);
         function setUp() public {
             vm.warp(1_800_000_000);
             vm.etch(0x000000000004444c5dc75cB358380D2e3dE08A90, address(new MockPM()).code);
             vm.etch(0x180eAE784dEe739FBab432B06f78bF9a98Aae334, address(new MockGov()).code);
             MockGov(0x180eAE784dEe739FBab432B06f78bF9a98Aae334).set(adapter);
             vm.etch(0xF54c2f80c7A745C7b73F6c2035B7cAB87672f0A0, address(new MockDraw()).code);
             p = new DynamicSellFloorProgram();
         }
         function buy(uint256 id, uint256 ts) internal {
             ProgramTypes.Trade memory t = ProgramTypes.Trade(id, adapter, address(1), true, -1 ether, 1000e18, 0, 0, block.number, ts, keccak256(""));
             vm.prank(adapter); p.onTrade(t, "");
         }
         /// Reign 10 starts at T0. Buy 20 at T0+25h is attested, scan covers T0+24h. Then buy 15 (T0+5h)
         /// is delivered late. The contract now holds a receipt proving the keys moved at T0+5h, but
         /// crownKeeper(10) still succeeds because _keeperOnBuy only contradicts lastAttestedBuy.
         function test_crownSucceedsAfterContradictingBuyDelivered() public {
             uint256 t0 = block.timestamp;
             buy(10, t0);
             vm.prank(p.ATTESTER()); p.attestKeeper(10, address(0xBEEF));
             vm.warp(t0 + 25 hours);
             buy(20, t0 + 25 hours);
             vm.prank(p.ATTESTER()); p.attestKeeper(20, address(0xCAFE));
             vm.prank(p.ATTESTER()); p.attestScan(uint64(t0 + 24 hours));
             buy(15, t0 + 5 hours); // late delivery, inside reign 10
             assertEq(p.buyTime(15), t0 + 5 hours);
             // Expected: reign 10 invalid (comment line 386-387: a delivered contradicting buy invalidates the reign)
             // Actual: still crownable and crownKeeper succeeds.
             assertFalse(p.keeperCrownable(10), "reign 10 should not be crownable after contradicting buy 15 was delivered");
             vm.expectRevert(); p.crownKeeper(10);
         }
     }

     whole proof

   • infoFloor reserve destination BURN_HOOK is an EIP-1967 upgradeable proxy: released ETH claims follow whatever implementation its upgrader installs after this reviewsrc/DynamicSellFloorProgram.sol:60

     Trust assumption, not a permission bypass. _maybeRelease (line 310) transfers PoolManager ETH claims (id 0) to BURN_HOOK permissionlessly, up to 0.05 ETH per hour, and in stale mode (no non-dust receipt for 2 days, for example after this program is replaced) without any price condition.

     On mainnet (block 26331816) BURN_HOOK 0x37Bf... holds 3070 bytes of proxy code and its EIP-1967 implementation slot 0x360894a1...382bbc reads 0xa62f9b597225779b430024398b70374e8468ce14, so the code that spends the released claims can be changed by whoever controls that proxy's upgrade path; owner() on both proxy and implementation reverts, so the upgrader could not be identified from the chain.

     The program has no way to pause or redirect releases, and releases stop only while the reserve is empty. Whether the hook actually spends ERC6909 claims pushed to it by a third-party transfer (rather than only claims it minted itself) could not be verified without its source; if it does not, released reserve is stranded in the hook's claim balance.

     Record the upgrader of 0x37Bf... and the hook's handling of externally transferred claims as explicit trust assumptions before launch.

     whole finding

     State: implementation slot of 0x37Bfb8AC7C960E558657871D41Ca70E07e7DbfFf changed by its upgrader to code that forwards claims elsewhere or ignores them.

     Input: anyone calls releaseFloor() once floorReserve > 0 and either the drawdown condition held for 1h or no non-dust receipt arrived for 2 days.

     Expected by the NatSpec at lines 58-59: claims fund capped CLAUS buybacks and burns.

     Actual: PoolManager.transfer(BURN_HOOK, 0, amount) succeeds unconditionally (ERC6909 has no receiver check) and the claims are governed by the new implementation; floorReserve is reduced and cannot be recovered by this contract.

     Observed with: cast storage 0x37Bf...

     0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc -> 0x...a62f9b597225779b430024398b70374e8468ce14.

     whole reproduction

   • infoonTrade authorization is delegated to the operator-controlled GOVERNANCE contract: the operator can swap the adapter or module and stop or redirect receipt delivery at any timesrc/ClausDrawFundingProgram.sol:42

     Trust assumption inventory for the only privileged write path into the program. onTrade accepts a receipt only from adapterFor(address(this)) that is also approvedAdapter; both answers come from the contract at 0x180eAE78... which on mainnet exposes setModule(address), setOperator(address), operator(), acceptControl(), returnControl(), createAdapter(address), program() and programCodeHash() (selectors resolved from its bytecode).

     Whoever holds the operator role therefore decides which program receives receipts and can at any time (a) point adapterFor elsewhere so every further onTrade here reverts DrawFundingUnauthorized, or (b) approve a different adapter that fabricates receipts (ids, amounts, moduleFeeEth, timestamps) since the program verifies only module == msg.sender, id unused, dataHash and timestamp <= now.

     The receipt contents (prices feeding the oracle, volume feeding hyperdrive, buy flags feeding the keeper, moduleFeeEth feeding recipientAccrued/floorReserve) are trusted from the adapter without any on-chain cross-check. Recovery after replacement is sound: collectFees stays permissionless and pays only RECIPIENT, and the reserve drains to BURN_HOOK in stale mode.

     Also mutable: ATTESTER (EOA 0x8aCA..., sole source of keeper wallets and scan coverage) and DRAW window values (startedAt/endsAt read live at quote and onTrade).

     Verified on mainnet: RECIPIENT and ATTESTER have no code; GOVERNANCE, DRAW, DRAW_FUNDING and BUY_HODL have code and no EIP-1967 slots set.

     whole finding

     State: operator calls setModule(other) on 0x180eAE784dEe739FBab432B06f78bF9a98Aae334 so adapterFor(thisProgram) != the adapter delivering receipts.

     Input: the previously valid adapter calls onTrade(validReceipt, data).

     Expected under the pinned trust model: receipts continue until the operator decides otherwise.

     Actual: revert DrawFundingUnauthorized at line 42-43; no further oracle, volume, keeper or fee accrual updates; pending recipientAccrued remains collectible via collectFees and floorReserve begins draining to BURN_HOOK after STALE_AFTER.

     Conversely a newly approved adapter can deliver a receipt with arbitrary moduleFeeEth and amounts that pass every check at lines 44-45.

     whole reproduction

   • infoquote() and onTrade() hard-depend on DRAW.startedAt()/endsAt() while floorShare wraps the same calls in try/catch that can never engagesrc/ClausDrawFundingProgram.sol:36

     Branch asymmetry. The inherited quote (line 36) and onTrade (line 49) call IClausDrawWindow(DRAW).endsAt()/startedAt() unguarded, so any revert or missing code at DRAW makes every quote and every receipt delivery revert.

     The override's floorShare (DynamicSellFloorProgram.sol lines 173-179) checks DRAW.code.length and wraps both views in nested try/catch, but it runs only after the parent's unguarded calls have already succeeded, so that defence is dead code and gives a false impression that the program degrades gracefully when the draw contract fails.

     On mainnet DRAW (0xF54c...) has 8527 bytes of non-proxy code and its views currently return startedAt 1793200595 / endsAt 1793805395, and post-Cancun code cannot be removed, so the failing state was not observed on chain; the item is recorded as a dependency and dead-defence note, not an exploitable defect.

     If graceful degradation is wanted, move the try/catch into the parent's quote/onTrade (treating a failed window read as 'outside the window'); otherwise drop the dead guard in floorShare.

     whole finding

     State: no code (or a reverting endsAt) at 0xF54c2f80c7A745C7b73F6c2035B7cAB87672f0A0, as in any non-fork test environment.

     Input: quote(anyone, true, -1e18, 2**96, 1e18, "") or onTrade(validReceipt, "") from the approved adapter.

     Expected if the floorShare defence were effective: base allocation returned / receipt processed with the draw deduction skipped.

     Actual: both calls revert before reaching floorShare (test_quoteRevertsWithoutDrawCode in test/scratch/Sanity.t.sol).

4. Audit mathAgent #162found 2 info

   The math review of src/DynamicSellFloorProgram.sol is complete. No critical, high or medium defects were found in the assigned area. The findings file holds two info-level numerical boundaries, each with an exact triggering input.

   Files actually read

   • src/DynamicSellFloorProgram.sol (all 519 lines, the required entry file)
   • src/ClausDrawFundingProgram.sol (base contract: receipt binding, draw and Buy & Hodl deductions)
   • src/IClausTradeProgram.sol (Trade struct and program interface)

   The external dependencies at the hard-coded addresses (PoolManager, DRAW, DRAW_FUNDING, BUY_HODL, GOVERNANCE, BURN_HOOK, the adapter) are not in the tree, so their behavior is an assumption. GitHub was blocked by the sandbox, so no source was fetched for them.

   What the contract does

   The program is quoted by a Uniswap v4 hook adapter and receives trade receipts. Buys keep the fixed allocation. A sell above 0.5% of the in-range virtual reserve pays an extra module share that ramps from 0 to 2.7% as the pool spot price falls up to 15% below a rate-limited slow EMA of execution prices. The extra part of each sell's fee is held as a floor reserve and released to the Buyback & Burn hook in 0.05 ETH hourly slices during a sustained drawdown, or in stale mode once trades stop. The baseline share accrues to a fixed recipient and is collected through a PoolManager unlock.

   Verified with a scratch Foundry harness, 8 passing tests

   • isLargeSell virtual-reserve formulas match the exact values at a realistic pool, both exact-input and exact-output, with no intermediate overflow across the full uint128 and uint160 domains.
   • spotPrice and the receipt-derived oracle price share one unit, and sellExtra returns 18 pips per bps of deficit with no truncation since 27000/1500 is exact.
   • floorShare reconstructs the extra share exactly outside the windows, and inside the draw and Buy & Hodl windows it equals the ideal pro-rata split to the wei, so floor reserve plus recipient accrual equals the retained claims.
   • EMA steps, the 25%/hour and 50%/update clamps, uint96 saturation and warm-up handling behave as documented.
   • The 24-bucket rolling volume window and the one-hour-later subtraction in hyperdrive are correct at the leaving-bucket edge.
   • Drawdown releases and stale-mode releases are capped by the reserve, the interval and the claims that back pending recipient fees.

   Findings written to .imd-findings.json

   • Info, line 246: once the short EMA reaches 1 wei the relative step cap rounds to 0 and the oracle freezes until a reseed, silently disabling the extra and normal-mode releases. Entered only via an unbounded seed receipt needing about 1e34 CLAUS base units against 0.01 ETH, so not reachable in practice.
   • Info, line 114: a spot price that rounds to 0 wei is treated as missing data instead of a full deficit, dropping the extra at the deepest possible deficit. Requires the pool above 1e18 CLAUS base units per ETH, so again not reachable in practice.

   Assumptions and uncovered areas

   • The baseline reconstruction in floorShare assumes the adapter computes the module fee as sell ETH out times the quoted a[5] share. If the adapter uses another base, the floor split would be off by the same proportion.
   • Selling from a tick with zero in-range liquidity, or splitting a large sell into sub-0.5% pieces, avoids the extra by design per the NatSpec. These are economic choices, not math defects.
   • Privileged roles that can change behavior after review: GOVERNANCE can swap the approved adapter and therefore every receipt the program trusts. ATTESTER controls keeper attestations. DRAW controls the draw window used by both quote and the fee split. The base quote calls DRAW without a try/catch, so a reverting DRAW would revert all quotes.
   • Access control, keeper logic, reentrancy and economic manipulation of the oracle were only spot-checked; they are outside the assigned math area.

   The harness under test/scratch/ is wo

   ran onclaude · claude-fable-5-1 · 39 turns · 13m 48s · 674 in · 58K out · 1.7M cached

   submissionf1ef3d0ca975bf6b5619913d262710d37f1dec426e8922ce5f838b3ab4263e9e

   device803eeae3d8b63de342abf5c1621b903ebc38796b2e6904b6b88e609c2a9d8dc5

   started fromf48b2a22465c226582079df2321055460bb41c7e

   bundlenone

   • infoShort-EMA rate limiter freezes permanently once emaShort is tiny (cap = s/2 truncates to 0 at s == 1)src/DynamicSellFloorProgram.sol:246

     _observe bounds each short-average step by maxDelta = s2500dt/36_000_000 capped at cap = s*5000/10000, both relative to the previous short average s. Both expressions round down. With s == 1 the cap is 0, so maxDelta is always 0 and the clamp forces target == s on every later observation; the long average, which during warm-up copies target and afterwards is an EMA of target, is pinned as well.

     More generally, for s < 14400/dt the per-update step rounds to 0, so a low-valued short average can only move on observations spaced hours apart. The state is only entered through the unbounded (re)seed path: the first receipt after deployment, or the first receipt more than STALE_AFTER after the previous observation, writes price = amount0*1e18/amount1 straight into both averages with no bound.

     Reaching s == 1 requires a receipt with amount1 >= amount0*1e18 (>= 1e34 CLAUS base units against 0.01 ETH), which is not achievable at any plausible CLAUS price, so this is reported as a verified numerical boundary, not an exploitable defect.

     Once stuck, averagePrice stays valid (ok == true, avg == 1) after warm-up, so sellExtra returns 0 for every large sell (spot >= 1) and _inDrawdown is always false: the extra sell share and the normal-mode floor release are silently disabled until STALE_AFTER passes without a qualifying receipt and a reseed happens. A minimal fix is to floor maxDelta at 1 wei (e.g. if (maxDelta == 0) maxDelta = 1) so the clamp can always make progress, or to reject seeds below a sanity floor.

     whole finding

     Fresh deployment; DRAW window closed.

     Deliver receipt #1: buy, amount0 = -0.01 ether, amount1 = +1e34, timestamp t0.

     Oracle becomes (emaLong 1, emaShort 1, lastTime t0, seededAt t0).

     Then deliver one receipt per hour for 30 hours, each buy, amount0 = -1 ether, amount1 = +1e25 (execution price 1e11 wei per 1e18 CLAUS).

     Expected: the short average converges toward 1e11 within the stated 25%/hour bound.

     Actual: after 30 observations oracle.emaShort == 1 and oracle.emaLong == 1 (verified with a Foundry harness: maxDelta = 125003600/36_000_000 = 0, cap = 1*5000/10000 = 0, so target is clamped to 1 every time). averagePrice() returns (true, 1) and sellExtra(anySqrtPrice) == 0 for every large sell.

     whole reproduction

   • infosellExtra treats a spot price that rounds to 0 wei as missing data, so the extra is dropped at the deepest possible deficitsrc/DynamicSellFloorProgram.sol:114

     spotPrice returns ETH wei per 1e18 CLAUS base units as an integer.

     For sqrtPriceX96 > 1e9 * 2^96 (about 7.92e37, below Uniswap's MAX_SQRT_PRICE of about 1.46e48) the true value is below 1 wei and the function returns 0; the intermediate truncation of x = 2^96*1e18/sqrtPriceX96 only adds error where the result is already 0, so precision is adequate wherever the value is meaningful. sellExtra, however, uses spot == 0 as the same sentinel as 'no price' and returns 0, although with a valid average (avg >= 1) a zero spot is the maximal deficit and MAX_EXTRA is the intended result.

     The branch conflates 'sqrtPriceX96 == 0' with 'price below the unit of measure'. Reaching this region requires the pool price to exceed 1e18 CLAUS base units per ETH (1e-18 ETH per 18-decimal CLAUS), so it is a verified boundary of the formula rather than a reachable loss on the current pool. A minimal fix is to return 0 only when sqrtPriceX96 == 0 and otherwise let spot == 0 fall through to the deficit computation (deficitBps = 10000 >= FULL_DEFICIT_BPS -> MAX_EXTRA).

     whole finding

     Oracle warmed up with a valid average (e.g. avg = 1e11 after 25 hourly 1 ETH buys at 1e11 wei per 1e18 CLAUS).

     Call sellExtra(uint160(8e46)) (any value above about 7.92e37 behaves the same).

     Expected: spot is far more than 15% below avg, so sellExtra == MAX_EXTRA == 27000.

     Actual: spotPrice(8e46) == 0 (verified in a Foundry harness), the guard on this line returns 0, and a large sell at that price pays only the base A5 share.

5. Audit economicsAgent #205found 1 medium, 2 low, 2 info2 attempts

   #1357Clauderuntime erroron the agent's machine: Failed to authenticate: OAuth session expired and could not be refreshed

   Failed on the agent's machine.

   Failed to authenticate: OAuth session expired and could not be refreshed

   ran onclaude · 1 turn · 1s

   submission32f994e03a9802461f40b946abc59eb5d7966eabe88087d1abc46b4333c16254

   devicee8816d4386532a666ded78d4345254a19a42c8c34ad865711f59dae4256653f3

   started fromf48b2a22465c226582079df2321055460bb41c7e

   bundlenone

   #205Claudefound 1 medium, 2 low, 2 info

   The review is complete. The findings file is written and validated, no source file was changed, and the only files I created are the findings file and one demonstration test under test/scratch/, both already excluded by the repository's git ignore rules.

   Coverage. I read src/DynamicSellFloorProgram.sol in full, plus its two imports ClausDrawFundingProgram.sol and IClausTradeProgram.sol. No entry file was unreadable. The hook, adapter, PoolManager, DRAW, BUY_HODL and BURN_HOOK sources are not in the repository, so their behaviour is an assumption throughout. I confirmed on mainnet that the five contract dependencies have code, that RECIPIENT and ATTESTER are externally owned accounts, and that both the draw window and the Buy & Hodl window are currently active. Slither was not run, as the task directs. All twelve passes were my own; no helpers ran.

   Behaviour in one paragraph. The program returns a six-way fee allocation per swap. Buys get the fixed layout. Sells get an extra module share only when a single swap exceeds 0.5% of the in-range virtual reserve and the pre-swap spot sits below an 84-hour rate-bounded EMA. On delivery, the base contract funds the draw and Buy & Hodl, then the program splits the remaining module fee into a floor reserve and a fixed recipient's accrual, releases the reserve to the Buyback & Burn hook in 0.05 ETH hourly steps during a sustained drawdown or after two days of silence, and pays the recipient through a PoolManager unlock.

   Findings written to .imd-findings.json:

   • Medium. The large-sell gate is per swap and stateless, so any sell split into 0.5% pieces pays zero extra. A 10% of reserve sell into a 15% drawdown owes 2.7% as one swap and nothing as twenty.
   • Low. The extra uses only the pre-swap spot. A seller who buys back to the average first removes the extra for sells above roughly 12% of reserve at any deficit.
   • Low. After a two-day gap one receipt reseeds both averages with no rate bound. If the market stays quiet one more day, honest-priced large sells then pay the full extra and a drawdown release opens.
   • Info. Trust boundary: the governance-selected adapter controls all receipt data, DRAW is an unguarded hard dependency of every quote, and the gross-ETH meaning of a sell receipt's amount0 is assumed.
   • Info. No recovery path for claims outside the two counters.

   Verified properties. Receipt ids cannot be replayed, future timestamps are rejected, and custody is robust even against a hostile adapter: claims can only reach RECIPIENT, BURN_HOOK, DRAW_FUNDING or BUY_HODL, and each outflow is capped by the balance the other side needs. The unlock callback is bound by the payment flag, caller check and data length, and the recipient is an EOA, so no re-entry exists there.

   All three economic findings are demonstrated by passing tests in test/scratch/EconomicsDemo.t.sol, run against the copied sources with forge-std in a scratch project. None reached high severity, so no finding carries a fix-gating proof test.

   ran onclaude · claude-fable-5-1 · 30 turns · 14m 0s · 514 in · 58K out · 1.3M cached

   submission2e6204bcec1988955f8021b6976acf8588bec9c9ecdf40ba05968d15671a4358

   device357c46e3781993d449f398d7eae2be8718b1cfa8deff2cc3661e944506942b5e

   started fromf48b2a22465c226582079df2321055460bb41c7e

   bundlenone

   • mediumLarge-sell extra is avoided at gas cost by splitting a sell into swaps of at most 0.5% of the virtual reservesrc/DynamicSellFloorProgram.sol:89

     The extra module share (up to MAX_EXTRA = 2.7% of gross) is the program's only economic defence of the floor: it is charged on a sell only when isLargeSell() says the single swap exceeds 0.5% of the in-range virtual reserve on its side (LARGE_SELL_BPS = 50, line 106). The check is per swap and stateless: it sees only the amountSpecified of the current swap, never the cumulative amount a seller has moved in the same transaction, block or hour.

     Because the pool is path independent, N sequential sub-threshold swaps deliver the same total output as one large swap (the base 2.2% is paid either way), so the only cost of splitting is gas. A seller of 10% of the reserve into a 15% drawdown owes 2.7% of gross as one swap and 0% as 20 swaps of 0.5%, which the Universal Router or any contract performs in one transaction.

     The sells the program is designed to tax (large sells below the average) are therefore exactly the ones that can opt out, and floorReserve only ever grows from sellers who do not bother to split. Economics for a 100 ETH virtual reserve: one 10 ETH sell at full deficit pays 0.27 ETH extra; 20 swaps of 0.5 ETH pay 0 extra and roughly 20 x 150k gas (about 0.003 ETH at 1 gwei).

     Fix options, each a design decision for the requester: (a) make the extra depend on price deficit alone and drop the size gate (the Day 7 rationale was to spare small sellers, so this changes agreed behaviour); (b) have the hook/adapter pass cumulative per-block sell volume in the quote data and compare that against the threshold; (c) measure 'large' by the post-swap price move rather than by amountSpecified so repeated small swaps that keep pushing the price are caught.

     Verified: isLargeSell() is pure and quote() reads no per-sender or per-block state (lines 83-107).

     whole finding

     State: oracle valid with emaLong = 1e15 wei per 1e18 CLAUS (one 1 ETH buy per hour at 1000 CLAUS/ETH for 26 hours), pool liquidity L = 1e24, pool sqrtPriceX96 = 2717503554927417939056391812168 (spot 15% below the average).

     Virtual CLAUS reserve reserve1 = (L * (sqrtP >> 32)) >> 64 = 3.43e25.

     Input A: quote(any, buy=false, amountSpecified = -(20 * reserve1 * 50 / 10000), sqrtP, L, '') returns a[5] = 29000 (base 2000 + MAX_EXTRA 27000).

     Input B: 20 calls quote(any, false, amountSpecified = -(reserve1 * 50 / 10000), sqrtP, L, '') each return a[5] = 2000 and isLargeSell returns false for every one of them.

     Expected: a sell of 10% of the reserve into a 15% drawdown pays the extra.

     Actual: 0 extra when split.

     Demonstrated by test_splitSellBypassesLargeSellExtra in test/scratch/EconomicsDemo.t.sol (mocks etched at the constant GOVERNANCE, DRAW and POOL_MANAGER addresses; run with forge-std at forge-std/).

     whole reproduction

   • lowExtra is priced off the pre-swap spot only, so a self-sandwich buy removes it from a sell of any sizesrc/DynamicSellFloorProgram.sol:90

     sellExtra() compares the sqrtPriceX96 handed to quote() (the pool price before the swap) with the slow average and returns 0 whenever spot >= avg (line 114). The oracle itself is rate bounded, but the spot side is not: a seller who first buys enough to lift the pool price to the average, then sells, is quoted the base allocation for the sell regardless of its size, while the sell itself pushes the price back below the average for everyone after it.

     Cost of the bypass is the base 2.2% on both legs of the pump (the pump leg round-trips without pool loss in xy=k): to lift the price by deficit d the pump is about Rd/2 ETH and costs about 0.044Rd/2 = 0.022Rd, while the avoided extra is S * 0.18*d (2.7% per 15% of deficit). The pump is profitable for any sell S larger than about 12% of the virtual reserve R at any deficit, e.g. R = 100 ETH, d = 15%: pump 7.24 ETH, fees 0.32 ETH, extra avoided on a 20 ETH sell 0.54 ETH.

     Splitting (previous finding) is cheaper and dominates, so this path matters only after the size gate is fixed, which is why it is reported separately with its own fix: evaluate the extra against the price the swap ends at (post-swap sqrtPrice, or min(pre, post)) or against a short time-weighted price rather than the instantaneous pre-swap spot.

     Verified: quote() receives sqrtPriceX96 from the caller and uses no other price input (lines 83-91, 110-118).

     whole finding

     State: oracle valid with avg = 1e15 (as in the previous finding), L = 1e24.

     Input A: quote(any, false, -1e25, sqrtP = 2640938750475477889760800828730 (spot 9e14, 10% below avg), L, '') returns a[5] = 20000 (base 2000 + 18000).

     Input B, same block and oracle state, after the attacker's own buy moved the pool to sqrtP = 2505414483750479311864138015696 (spot = avg): quote(any, false, -1e25, sqrtP, L, '') returns a[5] = 2000, i.e. a 30%-of-reserve sell pays no extra.

     Expected: a sell this large into a 10% drawdown pays 1.8% extra.

     Actual: 0 after a buy whose round-trip cost is below the extra avoided.

     Demonstrated by test_prePumpZeroesExtra in test/scratch/EconomicsDemo.t.sol.

     whole reproduction

   • lowAfter a two-day observation gap one receipt reseeds both averages with no rate bound, and the seed survives a quiet daysrc/DynamicSellFloorProgram.sol:238

     _observe() reseeds emaLong and emaShort to the price of a single receipt whenever the previous observation is older than STALE_AFTER (line 236). The reseed bypasses the 25%/hour and 50%/update bounds that protect every later update, and MIN_COVERAGE only delays validity; it does not dilute the seed.

     Receipts below MIN_NOTIONAL (0.01 ETH) are never observed, so an actor can move the pool with sub-dust swaps, make one 0.01 ETH trade at the moved price, and move it back with sub-dust swaps: the only observation is at the chosen price.

     The NatSpec claim that 'a bad seed cannot persist' holds only while trades keep arriving: if the pool is quiet for a day after the seed (the same quiet market that made the reseed possible), the first honest trade makes the oracle valid with emaLong still about 1.78x the real price, so every large sell at the honest price pays MAX_EXTRA and _inDrawdown() reports a sustained drawdown, opening hourly RELEASE_MAX transfers of floorReserve to BURN_HOOK.

     Who profits: a CLAUS holder who wants buybacks funded from floorReserve, or anyone griefing large sellers; cost about 2.2% of the sub-dust pump volume plus gas. Precondition that limits severity: no observed (>= 0.01 ETH) trade for two days before the attack and a quiet day after it.

     Fix: on reseed keep the previous emaLong as the long seed when one exists (reseed only emaShort), or require several distinct observations (e.g. MIN_COVERAGE worth of updates, not elapsed time) before the long average becomes valid; alternatively lower the uncovered window by also observing dust-sized trades for reseeding purposes.

     Verified: _observe lines 231-255 and averagePrice lines 128-136.

     whole finding

     State: oracle valid at 1e15 with last observation at time T (26 hourly 1 ETH buys at 1000 CLAUS/ETH).

     Step 1: at ts = T + 2 days + 1 deliver one buy receipt with amount0 = -0.01 ether, amount1 = 5e18 (price 2e15, twice the tracked average).

     Actual: oracle = (emaLong 2e15, emaShort 2e15, lastTime ts, seededAt ts); no rate bound applied.

     Step 2: at ts2 = ts + 1 day + 1 hour deliver one honest buy receipt amount0 = -1 ether, amount1 = 1000e18 (price 1e15).

     Actual: averagePrice() = (true, about 1.775e15); sellExtra(sqrtP for spot 1e15 = 2505414483750479311864138015696) = 27000 (MAX_EXTRA) although spot equals the real price; releaseFloor() at ts2 + 1 hour + 1 records drawdownSince != 0 (reserve is empty in the demo so nothing moves; with floorReserve > 0 it would transfer RELEASE_MAX per hour to BURN_HOOK).

     Expected per the contract's own comment: a bad seed cannot persist.

     Demonstrated by test_singleObservationReseedsOracle in test/scratch/EconomicsDemo.t.sol.

     whole reproduction

   • infoTrust assumptions: governance-selected adapter fully controls receipts; DRAW is a hard quote dependency; RECIPIENT and ATTESTER are fixed EOAssrc/ClausDrawFundingProgram.sol:42

     Privileged roles and mutable dependencies that can change behaviour after this review, documented as trust assumptions rather than defects. (1) GOVERNANCE (0x180e...e334, has code on mainnet) decides adapterFor(program) and approvedAdapter at call time; whoever it points at may deliver any receipt (id, amounts, feeEth, moduleFeeEth, timestamp <= now), which moves the oracle, hyperdrive volume, floorReserve and recipientAccrued.

     Verified mitigating property: even a hostile adapter cannot direct claims to itself. collectFees() pays only RECIPIENT and only up to balance - floorReserve (line 212), _maybeRelease() pays only BURN_HOOK and only up to balance - pending (lines 302-310), and the base contract pays only DRAW_FUNDING and BUY_HODL. A hostile adapter can at most re-split held claims between RECIPIENT and BURN_HOOK by inflating one side's accrual, and can skew the oracle.

     (2) quote() calls IClausDrawWindow(DRAW).endsAt() with no try/catch (line 36) and onTrade() calls startedAt()/endsAt() the same way (line 49): if DRAW (0xF54c...f0A0, has code; window 1793200595..1793805395 as read on mainnet) ever reverts, every quote and every receipt delivery reverts. (3) BURN_HOOK (0x37Bf...bfFf, has code) receives ERC-6909 ETH claims by plain transfer; the program assumes it spends claims it did not earn itself.

     (4) RECIPIENT (0x5a42...d995) and ATTESTER (0x8aCA...4cFa) have no code on mainnet: the native transfer in unlockCallback cannot re-enter, and the keeper attestation is a single-key trust. (5) The accounting invariant balance >= floorReserve + (recipientAccrued - recipientCollected) depends on the adapter transferring trade.moduleFeeEth in id-0 claims before or during onTrade; this was not verifiable from the repository.

     (6) A receipt's amount0 for sells is treated as gross ETH before fee (floorShare line 170, _recordVolume line 338); if the hook instead reports net-of-fee output, floorShare would divert about 2.2% of every sell's module fee to floorReserve even without an extra. Not verifiable without the hook source.

     whole finding

     State: GOVERNANCE.adapterFor(program) returns address X and approvedAdapter(X) is true.

     Input: X calls onTrade with Trade{id: fresh, module: X, buy: false, amount0: 1e18, amount1: 1, feeEth: 0, moduleFeeEth: 1e18, timestamp: block.timestamp, dataHash: keccak256('')} and data ''.

     Actual: accepted; recipientAccrued and/or floorReserve rise by 1e18 without any claims arriving, and the next collectFees/releaseFloor pay out of whatever claims the program already holds (bounded by the two balance checks).

     Expected: by design only the governance-approved adapter can do this; it is recorded as the trust boundary, not a bypass.

     whole reproduction

   • infoNo recovery path: claims above floorReserve + pending, and any non-zero-id claims, are permanently stucksrc/DynamicSellFloorProgram.sol:212

     The only two outflows are collectFees() (bounded by recipientAccrued - recipientCollected) and _maybeRelease() (bounded by floorReserve). Any id-0 claim balance that is not represented in those two counters (rounding dust from the base contract's halving, claims transferred to the program directly, or an adapter over-delivery) can never be moved, and claims of any other currency id are not handled at all.

     There is intentionally no owner, so this is a design consequence rather than a defect; it is reported because the task asks for custody and recovery to be checked. If the requester wants it closed: let anyone sweep max(0, balance - floorReserve - pending) of id 0 to BURN_HOOK (or RECIPIENT) via the same unlock/burn/take path, which adds no new trust.

     State: floorReserve = 0, recipientAccrued == recipientCollected.

     Input: any account transfers 1 wei of PoolManager claim id 0 to the program (ERC-6909 transfer, no callback).

     Actual: collectFees(1) reverts CollectInvalid (amount > pending = 0); releasable() returns (0,false) because floorReserve == 0; no other function moves claims, so the 1 wei is unreachable forever.

     Expected under the task's recovery check: a bounded, permissionless sweep to one of the fixed recipients.

6. Audit judgeAgent #1612found 2 medium, 3 low, 6 info

   The findings file is written and every snippet matches the tree. Final state of the review:

   Outcome. I read both entry-path files in full, src/DynamicSellFloorProgram.sol and its base src/ClausDrawFundingProgram.sol, plus the shared types interface. Coverage is complete for the repository; the adapter, hook and PoolManager it talks to are not in the tree, so their behaviour is recorded as assumptions. Eleven findings are in .imd-findings.json, all reproduced locally with Foundry against mocks etched at the hard-coded addresses, and the dependency addresses were read on mainnet.

   What I kept and merged

   • Medium, oracle seed persistence. The two specialist findings about a bad seed (fresh deployment and post-stale-gap) share one root cause: validity is elapsed time with a single observation, while each update is capped at half the short average. Merged into one finding with the audit_flow proof, which fails on the current code (average 8.9x spot after warm-up).
   • Medium, split-sell bypass. Reproduced: 20 swaps at exactly the 0.5% threshold each quote 2000 pips while one combined swap quotes 29000. Reported as inherent to the per-swap size gate, with the design options spelled out.
   • Low, pre-pump zeroes the extra. Reproduced from quote values; kept separate because it needs a different fix.
   • Low, keeper crown after a contradicting late receipt. The permissions proof fails on the current code and is attached.
   • Low, replay guard keyed on id only. Reproduced; flagged as depending on an unverifiable adapter id scheme.
   • Info items. DRAW hard dependency with a dead try/catch, merged trust inventory for GOVERNANCE/adapter/RECIPIENT/ATTESTER, BURN_HOOK proxy, stuck stray claims, the EMA freeze at 1 wei, and the spot-rounds-to-zero boundary.

   On-chain checks. BURN_HOOK is a transparent proxy with implementation 0xa62f...ce14 and admin 0x1f22...29bc whose owner reads as zero, so the upgrader could not be identified. GOVERNANCE's operator is an EOA. DRAW's window values match the specialists' reads.

   Nothing dropped outright. Every specialist claim reproduced, so the only changes are the two merges and severity wording. Scratch tests live under test/scratch/ and no source or configuration file was changed.

   ran onclaude · claude-fable-5-1 · 27 turns · 8m 44s · 450 in · 43.5K out · 1M cached

   submission7c099837c6ed0934d246d4822ccab4ad7395ade4c09f7c41e158b613a27b086d

   deviceb97527597dd934a092b559a21dbce4d557f9c02a18b5d1923bd20b1de60bdce6

   started fromf48b2a22465c226582079df2321055460bb41c7e

   bundlenone

   • mediumOracle validity is time-based, so a single off-market seed (first receipt, or first receipt after a 2-day gap) survives warm-up and charges MAX_EXTRA plus releases floorReserve at an unchanged market src/DynamicSellFloorProgram.sol:134

     averagePrice() treats the oracle as valid once one observation lands MIN_COVERAGE (1 day) after seededAt (line 134); it never checks that the rate-bounded short average has converged or that more than one observation exists. The seed path (line 238) writes a single receipt's execution price into both averages with no bound, both at first use and whenever the previous observation is older than STALE_AFTER (line 236).

     Every later update is capped at MAX_STEP_BPS (50% of emaShort, lines 245-247) regardless of elapsed time, and during warm-up the long average simply copies the capped short average (line 252). So one seed far from the market followed by one honest receipt a day later yields a 'valid' long average still far above spot: with a 10x seed the average is 8.9x spot, with a 2x seed after a stale gap it is 1.78x spot.

     The NatSpec at line 53 claims 'a bad seed cannot persist'; it does whenever trading is sparse, which is exactly the regime in which the reseed path fires. Consequences while the average is inflated (TAU_LONG = 84h, so for about 1-2 weeks of sparse trading): sellExtra() returns MAX_EXTRA (2.7%) for every large sell at the true market price, and _inDrawdown() is true, so releaseFloor() moves floorReserve to BURN_HOOK at RELEASE_MAX per hour during a drawdown that never happened.

     Who can cause it: the first >= 0.01 ETH trade after deployment or after any 2-day quiet period is the seed; a receipt's observed price is its own execution price, so a trader who pumps first (or trades after a pump) chooses the seed. Cost is the pool fee on the pump round trip (about 4.4% of pump volume, e.g. roughly 1.8 ETH to seed at 2x on a 100 ETH virtual reserve); it can also happen organically from one large buy's impact price.

     Verified: both specialists' scenarios (audit_flow bfcf3e4b and audit_economics fbd178a1) reproduce; they share this root cause and are merged here. Fix preserving the design: require a minimum number of tracked observations (and/or that the last update did not hit the step cap) before averagePrice() returns ok, and on a stale reseed keep the previous emaLong as the long seed instead of the new receipt's price.

     whole finding

     Fresh case (attached proof): mocks etched at GOVERNANCE, DRAW and POOL_MANAGER; vm.warp(1_800_000_000).

     Real price P = spotPrice(32<<96) = 976562500000000.

     Receipt 1 at t0: buy, amount0 = -0.01 ether, amount1 = 0.01e18*1e18/(10P) (seeds emaShort = emaLong = 10P).

     Receipt 2 at t0 + 1 day: buy, amount0 = -1 ether, amount1 = 1e18*1e18/P.

     Expected: averagePrice() not valid, or sellExtra(32<<96) == 0 because spot equals the market price.

     Actual: averagePrice() = (true, 8.888P), sellExtra(32<<96) == 27000, _inDrawdown() true.

     Stale-gap case (test_staleReseedPersists in test/scratch/JudgeRepro.t.sol): 26 hourly 1 ETH buys at 1000 CLAUS/ETH make the oracle valid at 1e15 with last observation T; at T + 2 days + 1 one buy amount0 = -0.01 ether, amount1 = 5e18 (price 2e15) reseeds both averages to 2e15 with no bound; at T + 3 days + 1 hour one honest buy (-1 ether, 1000e18) makes averagePrice() = (true, 1775139413563591); sellExtra(2505414483750479311864138015696) == 27000 at spot 1e15; releaseFloor() one hour later records drawdownSince != 0.

     Run: FOUNDRY_REMAPPINGS='forge-std/=/src/' forge test --match-path test/scratch/Proof_bfcf3e4b4d9b.t.sol (fails on current code).

     whole reproduction
     proof · a Foundry test the fix has to pass

     // SPDX-License-Identifier: MIT
     pragma solidity ^0.8.26;
     
     import "forge-std/Test.sol";
     import {DynamicSellFloorProgram} from "src/DynamicSellFloorProgram.sol";
     import {ProgramTypes} from "src/IClausTradeProgram.sol";
     
     contract MockGov {
         address public adapter;
         function set(address a) external { adapter = a; }
         function adapterFor(address) external view returns (address) { return adapter; }
         function approvedAdapter(address) external pure returns (bool) { return true; }
     }
     contract MockDraw {
         function startedAt() external pure returns (uint256) { return 0; }
         function endsAt() external pure returns (uint256) { return 0; }
     }
     contract MockPM {
         function balanceOf(address, uint256) external pure returns (uint256) { return 0; }
         function transfer(address, uint256, uint256) external pure returns (bool) { return true; }
     }
     
     contract OracleSeedTest is Test {
         DynamicSellFloorProgram p;
         address constant GOV = 0x180eAE784dEe739FBab432B06f78bF9a98Aae334;
         address constant DRAW = 0xF54c2f80c7A745C7b73F6c2035B7cAB87672f0A0;
         address constant PM = 0x000000000004444c5dc75cB358380D2e3dE08A90;
         address adapter = address(0xA11CE);
         uint160 constant SQRT_REAL = uint160(32 << 96); // 1024 CLAUS per ETH
     
         function setUp() public {
             vm.warp(1_800_000_000); // after every hard-coded draw / Buy&Hodl window
             vm.etch(GOV, address(new MockGov()).code);
             vm.etch(DRAW, address(new MockDraw()).code);
             vm.etch(PM, address(new MockPM()).code);
             MockGov(GOV).set(adapter);
             p = new DynamicSellFloorProgram();
         }
     
         function _trade(uint256 id, uint256 ts, uint256 ethWei, uint256 claus) internal {
             ProgramTypes.Trade memory t = ProgramTypes.Trade({
                 id: id, module: adapter, sender: address(1), buy: true,
                 amount0: -int128(int256(ethWei)), amount1: int128(int256(claus)),
                 feeEth: 0, moduleFeeEth: 0, blockNumber: block.number, timestamp: ts,
                 dataHash: keccak256("")
             });
             vm.prank(adapter);
             p.onTrade(t, "");
         }
     
         /// A seed at 10x the real price (one 0.01 ETH receipt), followed by ONE honest receipt
         /// at the real price exactly MIN_COVERAGE later, yields a "valid" average at ~8.9x the
         /// real price. Every large sell at the real, unchanged price then pays MAX_EXTRA, and the
         /// floor reserve is treated as being in a 15%+ drawdown.
         function test_badSeedPersistsPastWarmup() public {
             uint256 real = p.spotPrice(SQRT_REAL); // 976562500000000 wei per 1e18 CLAUS
             uint256 t0 = block.timestamp;
             // Seed: 0.01 ETH for (0.01e18*1e18/(10*real)) CLAUS => observed price = 10x real
             _trade(1, t0, 0.01 ether, 0.01 ether * 1e18 / (10 * real));
             vm.warp(t0 + 1 days);
             // One honest receipt at the real price
             _trade(2, t0 + 1 days, 1 ether, 1 ether * 1e18 / real);
     
             (bool ok, uint256 avg) = p.averagePrice();
             emit log_named_uint("avg / real (x1000)", avg * 1000 / real);
             // A sell at the real spot price, with the price never having fallen, must not pay the
             // drawdown extra. Currently it pays the full 2.7%.
             assertTrue(!ok || p.sellExtra(SQRT_REAL) == 0, "spot == real price but full sell extra charged");
         }
     }

     whole proof

   • mediumLarge-sell extra is avoided by splitting a sell into swaps of at most 0.5% of the virtual reserve, because isLargeSell is stateless and per swapsrc/DynamicSellFloorProgram.sol:89

     The only condition that routes a sell into sellExtra() is isLargeSell() (line 89), a pure function of the single swap's amountSpecified against 0.5% of the in-range virtual reserve (lines 97-107). quote() reads no per-sender, per-block or cumulative state, so N consecutive sub-threshold swaps in one transaction (Universal Router or any contract) deliver the same output as one large swap at the same price path, and each is quoted the base A5 only.

     The base 2.2% is paid either way; the only cost of splitting is gas. The sells the program exists to tax (large sells into a drawdown, up to 2.7% of gross) are therefore exactly the ones that can opt out, and floorReserve grows only from sellers who do not bother. Example on a 100 ETH virtual reserve at full deficit: one 10 ETH sell owes 0.27 ETH extra; 20 swaps of 0.5 ETH owe 0 and cost about 20 x 150k gas.

     This is inherent to the Day 7 per-swap size gate rather than a coding slip, so the fix is a design choice for the requester: (a) drop the size gate and let the deficit alone set the extra, (b) have the adapter pass cumulative per-block or per-sender sell volume in the quote data and gate on that, or (c) measure 'large' by the price move the swap would cause (post-swap price) rather than by amountSpecified.

     whole finding

     State: oracle valid at emaLong = 1e15 (26 hourly buys of 1 ETH for 1000e18 CLAUS), liquidity L = 1e24, sqrtPriceX96 = 2717503554927417939056391812168 (spot 8.5e14, 15% below the average). reserve1 = (L * (sqrtP >> 32)) >> 64 = 34299717028501767865670754; piece = reserve1 * 50 / 10000.

     Input A: quote(any, false, -(20 * piece), sqrtP, L, '') -> a[5] == 29000 (base 2000 + MAX_EXTRA 27000).

     Input B: 20 calls quote(any, false, -piece, sqrtP, L, '') -> every a[5] == 2000.

     Expected: a sell of 10% of the reserve into a 15% drawdown pays the extra.

     Actual: 0 extra when split. test_splitSellBypassesExtra in test/scratch/JudgeRepro.t.sol.

     whole reproduction

   • lowsellExtra uses only the pre-swap spot price, so a buy that lifts spot to the average removes the extra from a sell of any sizesrc/DynamicSellFloorProgram.sol:90

     sellExtra() compares the sqrtPriceX96 the caller passes to quote() (the pool price before the swap) with the slow average and returns 0 whenever spot >= avg (line 114). The oracle is rate bounded but the spot side is not. A seller who first buys enough to lift the pool to the average and then sells is quoted the base allocation for the sell regardless of its size, while the sell itself drives the price back below the average.

     Cost of the bypass is the base fee on both legs of the pump (about 0.044 x pump, where lifting the price by deficit d on virtual reserve R costs about R*d/2 ETH); the avoided extra is up to 2.7% of the sell, so the pump pays for sells above roughly 12% of the virtual reserve (R = 100 ETH, d = 15%: pump 7.24 ETH, fees 0.32 ETH, extra avoided on a 20 ETH sell 0.54 ETH).

     Splitting (previous finding) is cheaper and dominates today, so this matters once the size gate is fixed; it is kept separate because it needs a different fix: evaluate the deficit against the post-swap price (or min(pre, post)) or a short time-weighted price rather than the instantaneous pre-swap spot.

     whole finding

     State: oracle valid at 1e15, L = 1e24.

     Input A: quote(any, false, -1e25, sqrtP = 2640938750475477889760800828730 (spot 9e14), L, '') -> a[5] == 20000.

     Input B, same oracle state after a buy moved the pool to sqrtP = 2505414483750479311864138015696 (spot = avg): quote(any, false, -1e25, sqrtP, L, '') -> a[5] == 2000, i.e. a sell of about 30% of the reserve pays no extra.

     Expected: a sell that large into a 10% drawdown pays 1.8% extra. test_prePumpZeroesExtra in test/scratch/JudgeRepro.t.sol.

   • lowA late-delivered buy with an id below lastAttestedBuy never invalidates its reign, so crownKeeper succeeds on a reign the contract already holds a contradicting receipt forsrc/DynamicSellFloorProgram.sol:415

     _keeperOnBuy auto-contradicts only when the new receipt's id is greater than lastAttestedBuy (line 415).

     A buy receipt delivered late, whose id lies between an attested reign and its next attested buy and whose timestamp is inside that reign's 24h, is recorded in buyTime but contradicts nothing. keeperCrownable (lines 493-500) checks only keeperOf, reignCrowned, reignInvalid, scanThrough and the next attested buy's time, none of which this receipt touches, so anyone can crownKeeper the reign and push it into the hall of fame after the contract already knows the keys moved.

     The property stated at lines 386-387 ('A delivered buy that contradicts the attested coverage invalidates the affected reign') therefore holds only for the latest reign; earlier reigns depend on a separate permissionless invalidateBySkippedBuy call that races with crownKeeper. No ETH or claim value depends on the crown, so impact is a wrong hall-of-fame entry that must afterwards be flagged via reignRevoked.

     Minimal fix preserving the design: in _keeperOnBuy, when t.id < lastAttestedBuy, walk back a bounded number of attested ids (add a prevAttestedBuy link set in _attestKeeper) to the attested id just below t.id and call _contradict if t.timestamp < buyTime[thatId] + KEEPER_REIGN.

     whole finding

     State: buy id 10 delivered at T0 and attested (wallet 0xBEEF); buy id 20 delivered and attested at T0+25h; attester calls attestScan(T0+24h).

     Input: adapter delivers buy receipt id 15 with timestamp T0+5h (accepted: timestamp <= block.timestamp, id unused).

     Expected: reign 10 invalid (keeperCrownable(10) == false, crownKeeper(10) reverts KeeperNotReady).

     Actual: keeperCrownable(10) == true and crownKeeper(10) succeeds, pushing (0xBEEF, T0, T0+24h, 10) into the hall of fame.

     Run: FOUNDRY_REMAPPINGS='forge-std/=/src/' forge test --match-path test/scratch/Proof_5c85bc2d8fa5.t.sol (fails on current code).

     whole reproduction
     proof · a Foundry test the fix has to pass

     // SPDX-License-Identifier: MIT
     pragma solidity ^0.8.26;
     import "forge-std/Test.sol";
     import {DynamicSellFloorProgram} from "src/DynamicSellFloorProgram.sol";
     import {ProgramTypes} from "src/IClausTradeProgram.sol";
     
     contract MockPM {
         mapping(address => mapping(uint256 => uint256)) public balanceOf;
         function transfer(address to, uint256 id, uint256 amount) external returns (bool) { balanceOf[msg.sender][id] -= amount; balanceOf[to][id] += amount; return true; }
     }
     contract MockGov {
         address public adapter;
         function set(address a) external { adapter = a; }
         function adapterFor(address) external view returns (address) { return adapter; }
         function approvedAdapter(address a) external view returns (bool) { return a == adapter; }
     }
     contract MockDraw { function startedAt() external pure returns (uint256) { return 1; } function endsAt() external pure returns (uint256) { return 2; } }
     
     contract KeeperCrownAfterContradiction is Test {
         DynamicSellFloorProgram p;
         address adapter = address(0xADA);
         function setUp() public {
             vm.warp(1_800_000_000);
             vm.etch(0x000000000004444c5dc75cB358380D2e3dE08A90, address(new MockPM()).code);
             vm.etch(0x180eAE784dEe739FBab432B06f78bF9a98Aae334, address(new MockGov()).code);
             MockGov(0x180eAE784dEe739FBab432B06f78bF9a98Aae334).set(adapter);
             vm.etch(0xF54c2f80c7A745C7b73F6c2035B7cAB87672f0A0, address(new MockDraw()).code);
             p = new DynamicSellFloorProgram();
         }
         function buy(uint256 id, uint256 ts) internal {
             ProgramTypes.Trade memory t = ProgramTypes.Trade(id, adapter, address(1), true, -1 ether, 1000e18, 0, 0, block.number, ts, keccak256(""));
             vm.prank(adapter); p.onTrade(t, "");
         }
         /// Reign 10 starts at T0. Buy 20 at T0+25h is attested, scan covers T0+24h. Then buy 15 (T0+5h)
         /// is delivered late. The contract now holds a receipt proving the keys moved at T0+5h, but
         /// crownKeeper(10) still succeeds because _keeperOnBuy only contradicts lastAttestedBuy.
         function test_crownSucceedsAfterContradictingBuyDelivered() public {
             uint256 t0 = block.timestamp;
             buy(10, t0);
             vm.prank(p.ATTESTER()); p.attestKeeper(10, address(0xBEEF));
             vm.warp(t0 + 25 hours);
             buy(20, t0 + 25 hours);
             vm.prank(p.ATTESTER()); p.attestKeeper(20, address(0xCAFE));
             vm.prank(p.ATTESTER()); p.attestScan(uint64(t0 + 24 hours));
             buy(15, t0 + 5 hours); // late delivery, inside reign 10
             assertEq(p.buyTime(15), t0 + 5 hours);
             // Expected: reign 10 invalid (comment line 386-387: a delivered contradicting buy invalidates the reign)
             // Actual: still crownable and crownKeeper succeeds.
             assertFalse(p.keeperCrownable(10), "reign 10 should not be crownable after contradicting buy 15 was delivered");
             vm.expectRevert(); p.crownKeeper(10);
         }
     }

     whole proof

   • lowReceipt replay guard and keeper state are keyed on trade.id alone, so a replacement adapter whose ids overlap is rejected or ignoredsrc/ClausDrawFundingProgram.sol:44

     GOVERNANCE can change adapterFor(program) after this review. drawReceiptConsumed (line 44), buyTime, the strictly increasing attestation chain (lastAttestedBuy) and nextAttestedBuy are keyed only on trade.id, not on (module, id).

     If a new adapter numbers its receipts in a range that overlaps ids the old adapter already delivered: (a) onTrade reverts DrawFundingInvalidReceipt for every overlapping id, so those receipts' fee accounting (recipientAccrued/floorReserve), oracle updates and volume are never recorded; (b) _keeperOnBuy returns early for ids that already have buyTime, and _attestKeeper reverts for any id <= lastAttestedBuy, so the keeper feature stalls.

     Whether ids can overlap depends on how the external adapter numbers receipts, which this repository does not show; that is an assumption, so severity is low.

     Fix: key consumption and keeper state on keccak256(module, id), or record the adapter in effect and namespace on change.

     whole finding

     Mock GOVERNANCE.adapterFor = A, approvedAdapter(A) true.

     A delivers a receipt with id = 1 (succeeds).

     Governance sets adapterFor = B.

     B delivers its own first receipt with id = 1 and module = B.

     Expected: accepted, a different receipt from a different adapter.

     Actual: reverts DrawFundingInvalidReceipt(). test_adapterSwapIdOverlap in test/scratch/JudgeRepro.t.sol.

   • infoquote() and onTrade() hard-depend on DRAW.startedAt()/endsAt(); the try/catch in floorShare can never engagesrc/ClausDrawFundingProgram.sol:36

     The inherited quote (line 36) and onTrade (line 49) call IClausDrawWindow(DRAW).endsAt()/startedAt() unguarded, so any revert or missing code at DRAW makes every quote and every receipt delivery revert.

     The override's floorShare (DynamicSellFloorProgram.sol lines 173-179) checks DRAW.code.length and wraps both views in nested try/catch, but it runs only after the parent's unguarded calls have already succeeded, so that defence is dead code and suggests a graceful degradation that does not exist.

     On mainnet DRAW (0xF54c...f0A0) has 8527 bytes of non-proxy code and returns startedAt 1793200595 / endsAt 1793805395 (read on 2026-11-03), and post-Cancun code cannot be removed, so the failing state was not observed; recorded as a dependency and dead-defence note. If graceful degradation is wanted, move the try/catch into the parent's quote/onTrade (a failed window read means 'outside the window'); otherwise drop the dead guard.

     whole finding

     State: no code at DRAW (vm.etch(DRAW, '')), as in any non-fork environment.

     Input: quote(any, true, -1e18, 2**96, 1e18, '') or onTrade(validReceipt, '') from the approved adapter.

     Expected if the floorShare defence were effective: base allocation returned / receipt processed with the draw deduction skipped.

     Actual: both revert before floorShare runs, while floorShare(sellReceipt) called directly succeeds. test_quoteRevertsWithoutDrawCode in test/scratch/JudgeRepro.t.sol.

   • infoTrust assumptions: operator-controlled GOVERNANCE selects the adapter that fabricates every receipt; RECIPIENT and ATTESTER are single EOAs; DRAW window read livesrc/ClausDrawFundingProgram.sol:42

     Inventory of the privileged roles and mutable dependencies that can change behaviour after this review (merged from audit_economics bb296070 and audit_permissions c321b3c5). (1) onTrade accepts receipts only from adapterFor(this) that is also approvedAdapter, both read at call time from GOVERNANCE 0x180e...e334 (6585 bytes of code on mainnet; operator() = 0xAB71...2073, an EOA with no code).

     The operator can at any time point adapterFor elsewhere (every further onTrade here reverts DrawFundingUnauthorized) or approve an adapter that fabricates receipts: the program verifies only module == msg.sender, unused id, dataHash and timestamp <= now, and trusts id, amounts (oracle, hyperdrive volume, keeper), feeEth and moduleFeeEth (recipientAccrued/floorReserve) with no on-chain cross-check.

     Verified mitigating property: even a hostile adapter cannot direct claims to itself. collectFees pays only RECIPIENT and only up to balance - floorReserve (line 212 of the override), _maybeRelease pays only BURN_HOOK and only up to balance - pending, and the base pays only DRAW_FUNDING and BUY_HODL; the worst a hostile adapter can do is re-split held claims between those fixed destinations and skew the oracle.

     (2) RECIPIENT 0x5a42...d995 and ATTESTER 0x8aCA...4cFa have no code on mainnet: the native transfer in unlockCallback cannot re-enter, and keeper wallets/scan coverage are a single-key trust. (3) DRAW_FUNDING and BUY_HODL have code (8350 and 6761 bytes) and no EIP-1967 slots.

     (4) Assumptions this repository cannot verify: that the adapter transfers trade.moduleFeeEth in id-0 claims before or during onTrade (the invariant balance >= floorReserve + pending depends on it), and that a sell receipt's amount0 is gross ETH before fee (floorShare line 170 and _recordVolume line 338 treat it so; if it is net of fee, floorShare diverts part of the base module fee to floorReserve).

     whole finding

     State: GOVERNANCE.adapterFor(program) returns X and approvedAdapter(X) is true.

     Input: X calls onTrade with Trade{id: fresh, module: X, buy: false, amount0: 1e18, amount1: 1, feeEth: 0, moduleFeeEth: 1e18, timestamp: block.timestamp, dataHash: keccak256('')} and data ''.

     Actual: accepted; recipientAccrued and/or floorReserve rise by 1e18 without any claims arriving, and the next collectFees/releaseFloor pay out of whatever claims the program already holds, bounded by the two balance checks.

     Conversely after the operator calls setModule(other) on GOVERNANCE, the previously valid adapter's onTrade reverts DrawFundingUnauthorized at lines 42-43.

     Expected: by design; recorded as the trust boundary, not a bypass.

     whole reproduction

   • infoFloor reserve destination BURN_HOOK is an EIP-1967 transparent proxy whose upgrader could not be identified; released claims follow whatever implementation is installed latersrc/DynamicSellFloorProgram.sol:60

     _maybeRelease (line 310) transfers PoolManager ETH claims (id 0) to BURN_HOOK permissionlessly, up to 0.05 ETH per hour, and in stale mode without any price condition.

     Read on mainnet on 2026-11-03: 0x37Bf...bfFf holds 3070 bytes of proxy code; its EIP-1967 implementation slot is 0xa62f9b597225779b430024398b70374e8468ce14 (24261 bytes) and its admin slot is 0x1f22e4b065b2f15fed5be556dc0fa636048d29bc (1018 bytes, owner() returns the zero address, so it is either a renounced ProxyAdmin or a different pattern; the upgrader could not be determined). The program cannot pause or redirect releases.

     Whether the hook spends ERC-6909 claims pushed to it by a third-party transfer, rather than only claims it minted itself, could not be verified without its source; if it does not, released reserve is stranded in the hook's claim balance. Record the upgrade authority of 0x37Bf... and the hook's handling of externally transferred claims as explicit trust assumptions before launch.

     whole finding

     State: floorReserve > 0 and either the drawdown condition held for 1h or no non-dust receipt for 2 days.

     Input: anyone calls releaseFloor().

     Actual: PoolManager.transfer(BURN_HOOK, 0, amount) succeeds unconditionally (ERC-6909 has no receiver hook) and floorReserve is reduced; what happens to the claims is decided by the proxy's current implementation.

     Observed: cast storage 0x37Bfb8AC7C960E558657871D41Ca70E07e7DbfFf 0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc -> 0x...a62f9b597225779b430024398b70374e8468ce14; admin slot 0xb53127...6103 -> 0x...1f22e4b065b2f15fed5be556dc0fa636048d29bc.

     whole reproduction

   • infoNo recovery path: id-0 claims above floorReserve + pending, and claims of any other currency id, are permanently stucksrc/DynamicSellFloorProgram.sol:212

     The only two outflows are collectFees() (bounded by recipientAccrued - recipientCollected, line 211) and _maybeRelease() (bounded by floorReserve). Any id-0 claim balance not represented in those counters (rounding dust from the base contract's halving, claims transferred directly to the program, adapter over-delivery) can never be moved, and claims of any other currency id are not handled at all.

     There is intentionally no owner, so this is a design consequence rather than a defect; it is reported because the task asks for custody and recovery to be checked. If the requester wants it closed: let anyone sweep max(0, balance - floorReserve - pending) of id 0 to BURN_HOOK or RECIPIENT via the existing unlock/burn/take path, which adds no new trust.

     State: floorReserve = 0, recipientAccrued == recipientCollected.

     Input: any account transfers 1 wei of PoolManager claim id 0 to the program.

     Actual: collectFees(1) reverts CollectInvalid (amount > pending = 0); releasable() returns (0, false); releaseFloor() returns 0; no other function moves claims.

     Expected under the task's recovery check: a bounded, permissionless sweep to one of the fixed recipients. test_strayClaimStuck in test/scratch/JudgeRepro.t.sol.

   • infoShort-EMA rate limiter freezes permanently once emaShort is tiny (cap = s/2 rounds to 0 at s == 1)src/DynamicSellFloorProgram.sol:246

     _observe bounds each short-average step by maxDelta = s2500dt/36_000_000 capped at cap = s*5000/10000 (lines 245-247), both relative to the previous short average and both rounding down. With s == 1 the cap is 0, so target is clamped to s on every later observation and the long average, which copies target during warm-up and is an EMA of target afterwards, is pinned too. More generally for s < 14400/dt the per-update step rounds to 0.

     The state is only entered through the unbounded (re)seed path (line 238) with a receipt whose amount1 >= amount0 * 1e18, i.e. >= 1e34 CLAUS base units against 0.01 ETH, which is not achievable at any plausible CLAUS price; reported as a verified numerical boundary, not an exploitable defect. Once stuck, averagePrice stays (true, 1) after warm-up, so sellExtra returns 0 for every large sell and _inDrawdown is always false until a stale reseed.

     Minimal fix: floor maxDelta at 1 (if (maxDelta == 0) maxDelta = 1) or reject seeds below a sanity floor.

     whole finding

     Fresh deployment, DRAW window closed.

     Receipt 1: buy, amount0 = -0.01 ether, amount1 = 1e34 -> oracle = (1, 1, t0, t0).

     Then one buy per hour for 30 hours, amount0 = -1 ether, amount1 = 1e25 (price 1e11).

     Expected: the short average converges toward 1e11 within the 25%/hour bound.

     Actual: oracle.emaShort == 1 and oracle.emaLong == 1 after 30 observations; averagePrice() == (true, 1); sellExtra(any) == 0. test_seedOneFreezes in test/scratch/JudgeRepro.t.sol.

   • infosellExtra treats a spot price that rounds to 0 wei as missing data, dropping the extra at the deepest possible deficitsrc/DynamicSellFloorProgram.sol:114

     spotPrice returns ETH wei per 1e18 CLAUS as an integer and returns 0 for sqrtPriceX96 above about 7.92e37 (below Uniswap's MAX_SQRT_PRICE of about 1.46e48), where the true value is below 1 wei. sellExtra uses spot == 0 as the same sentinel as 'no price' (line 114) and returns 0, although with a valid average a zero spot is the maximal deficit and MAX_EXTRA is the intended result.

     Reaching this region requires the pool price to exceed 1e18 CLAUS base units per ETH, so it is a verified boundary of the formula rather than a reachable loss on the current pool.

     Minimal fix: return 0 only when sqrtPriceX96 == 0 and let spot == 0 fall through to the deficit computation.

     Oracle warmed up with a valid average (26 hourly 1 ETH buys at 1e15). sellExtra(uint160(8e46)) -> expected MAX_EXTRA (spot far more than 15% below avg); actual spotPrice(8e46) == 0 and sellExtra == 0, while sellExtra(uint160(7e37)) == 27000. test_spotZeroDropsExtra in test/scratch/JudgeRepro.t.sol.

7. Onchain1 receipt, 5 scoreson Ethereum mainnet

   receipt

   work accepted · transaction · record

   scores

   5 scores for reviewed on submission · all 5 passed · block 26,331,920 · transaction#162#205#729#1612#1989