Refused by Codex's safety filter

• mediumAnti-snipe donation is credited by liquidity at the final tick, so a buyer holding SIMDTEST recovers ~90% of their own anti-snipe fee with a single-sided JIT positionsrc/SIMDTESTHook.sol:148

  PoolManager.donate credits feeGrowthGlobal pro rata to state.liquidity at the moment of the call, i.e. the liquidity in range at the tick where the swap ENDS. The hook donates the whole anti-snipe component there, after the swap. A position sitting in the 60-tick bucket where a buy ends therefore receives L_pos/(L_pos+L_seed) of the donation even if it only served the last sliver of the price path.

  Because the price is outside that bucket before the buy, the position is funded with SIMDTEST only (zero IMD), and the buyer can compute the end tick in advance (the launch is deterministic within a block / bundle). Anyone holding a few percent of supply -- the launch initiator, who receives 100M SIMDTEST at src/SIMDTESTLaunch.sol:62, or any earlier buyer -- can thus buy at the 30% launch-block rate and immediately take most of that fee back.

  The brief's stated purpose of the anti-snipe fee ('penalizing snipers', 'protecting liquidity') is defeated for exactly the actors it targets. The README's generic JIT remark describes LPs capturing OTHER traders' donations; this is the trader recovering their OWN fee, which the brief's rule 1 says must not happen. Sells are symmetric (a single-sided IMD position in the bucket where a sell ends).

  Possible fixes (design decision for the requester): PoolManager.donate cannot target pre-swap liquidity, so the practical options are to send the anti-snipe component to the treasury or burn it, or to enable beforeAddLiquidity and reject non-full-range (or any) liquidity additions while antiSnipeBps() > 0.

  whole finding

  State: pool launched via SIMDTESTLaunch.launch(2^96, maxImd, salt) at block 200 with 800M SIMDTEST / 800M IMD full-range seed (seed liquidity 8.0e26). Attacker holds 20M SIMDTEST (the initiator's 100M remainder, or a prior buy). Same block (anti-snipe 30%):

  1. Simulate exact-input buy of 100,000,000 IMD -> ends at tick -1647 (IMD=currency0) / +1646 (IMD=currency1). Baseline: pays 100M IMD, receives 63,208,640 SIMDTEST.
  2. modifyLiquidity(lower=floor60(endTick), upper=lower+60, liquidityDelta=9*seedLiquidity). Price is outside the bucket, so the position takes 19,888,622 SIMDTEST and 0 IMD.
  3. Exact-input buy of 100,000,000 IMD. Hook charges 30,000,000 IMD donation + 500,000 IMD treasury; donate() lands on seed+JIT liquidity at end tick -1623/+1622, which is inside the bucket, so 90% of it accrues to the JIT position. The swap entered the bucket [-1680,-1620] at -1620 and stopped at -1623: the JIT position served only the final 3 ticks of a 1623-tick path and sold ~0.87M SIMDTEST.
  4. Remove the position: 28,037,206 IMD comes back (27M donation share + ~1M sliver sale + LP-fee share). Result: net 71,962,794 IMD spent for 62,338,831 SIMDTEST (1.154 IMD/SIMDTEST) vs 100,000,000 IMD for 63,208,640 (1.582 IMD/SIMDTEST) without the trick. Expected per brief: the sniper bears a 30% fee in the opening block. Actual: effective anti-snipe cost ~3%. Proof test test/scratch/ProofSliverJit.t.sol fails with 'JIT liquidity at the final tick recovers most of the anti-snipe donation'.

  whole reproduction

• mediumFee base differs between exact-input and exact-output buys: the same SIMDTEST output costs 1000 IMD on one route and 907 IMD on the other in the same blocksrc/SIMDTESTHook.sol:137

  For an IMD-specified exact-input buy the hook sets volume = gross (the caller's whole budget, fee included) and deducts the fee before the swap, so only gross - fee reaches the pool: the hook rate is applied to a fee-inclusive base. For an exact-output buy (IMD unspecified) volume = executed, the pool-side IMD input, and the fee is added on top: a fee-exclusive base. Both sell routes use the pool-side gross output (fee-exclusive).

  So three of four swap modes charge 30.5% of the IMD that actually moved through the pool while exact-input buys charge 30.5% of gross, which is 43.9% of pool input at launch (30.5/69.5) -- above the brief's 'never exceeding 30%' if volume means pool volume, while exact-output buys charge only 23.4% of the total paid (30.5/130.5) if volume means total paid.

  Either way the two buy routes are inconsistent, the quoted 30% launch rate depends on which swap mode a router picks, and a sniper simply uses exact-output buys to pay ~23% instead of ~30% of their outlay. The treasury take also differs (5 IMD vs 3.475 IMD for the identical trade).

  Fix: define one IMD fee base (either pool-side IMD or total IMD paid) and apply it in all four modes; for exact-input buys that means gross = budget, fee = feesOn(budget - fee) solved for pool input, or for exact-output buys fee = feesOn(executed + fee).

  whole finding

  State: pool launched at 2^96 with 800M/800M seed in block 200; same block (anti-snipe 30%).

  Route A: swap(zeroForOne = imdIsCurrency0, amountSpecified = -1000e18) -> trader pays exactly 1,000.000 IMD, receives 686.311911219445539005 SIMDTEST; treasury receives 5.000 IMD; donation 300 IMD.

  Revert to the same state.

  Route B: swap(zeroForOne = imdIsCurrency0, amountSpecified = +686311911219445539005) -> trader receives the identical 686.3119 SIMDTEST but pays 906.975 IMD; treasury receives 3.475 IMD; donation 208.5 IMD.

  Expected: one trade, one block, one pool state -> same total IMD (up to rounding) and same fee split. Actual: 93.025 IMD (9.3%) difference. Proof test test/scratch/ProofRouteDivergence.t.sol fails with 'fee base diverges between exact-input and exact-output buys'.

  whole reproduction
  proof · a Foundry test the fix has to pass

  // SPDX-License-Identifier: MIT
  pragma solidity 0.8.26;
  
  // Self-contained proof: no forge-std (not vendored in lib/), no helpers from other test files.
  // Fails on the current code: at the same block and pool state, an exact-input buy and an
  // exact-output buy that deliver the identical SIMDTEST amount charge materially different
  // total IMD, because the hook's fee base is the caller's gross budget for exact-input buys but
  // the pool-side IMD input for exact-output buys. Passes once both routes use one fee base.
  
  import {SIMDTEST} from "src/SIMDTEST.sol";
  import {SIMDTESTHook} from "src/SIMDTESTHook.sol";
  import {SIMDTESTLaunch} from "src/SIMDTESTLaunch.sol";
  import {PoolManager} from "@uniswap/v4-core/src/PoolManager.sol";
  import {IPoolManager} from "@uniswap/v4-core/src/interfaces/IPoolManager.sol";
  import {IUnlockCallback} from "@uniswap/v4-core/src/interfaces/callback/IUnlockCallback.sol";
  import {IERC20Minimal} from "@uniswap/v4-core/src/interfaces/external/IERC20Minimal.sol";
  import {TickMath} from "@uniswap/v4-core/src/libraries/TickMath.sol";
  import {PoolKey} from "@uniswap/v4-core/src/types/PoolKey.sol";
  import {Currency} from "@uniswap/v4-core/src/types/Currency.sol";
  import {BalanceDelta} from "@uniswap/v4-core/src/types/BalanceDelta.sol";
  
  interface Vm {
      function etch(address target, bytes calldata code) external;
      function roll(uint256 blockNumber) external;
      function snapshotState() external returns (uint256);
      function revertToState(uint256 snapshot) external returns (bool);
  }
  
  contract ImdDouble {
      uint8 public constant decimals = 18;
      mapping(address => uint256) public balanceOf;
      mapping(address => mapping(address => uint256)) public allowance;
  
      function mint(address to, uint256 amount) external {
          balanceOf[to] += amount;
      }
  
      function approve(address spender, uint256 amount) external returns (bool) {
          allowance[msg.sender][spender] = amount;
          return true;
      }
  
      function transfer(address to, uint256 amount) external returns (bool) {
          balanceOf[msg.sender] -= amount;
          balanceOf[to] += amount;
          return true;
      }
  
      function transferFrom(address from, address to, uint256 amount) external returns (bool) {
          allowance[from][msg.sender] -= amount;
          balanceOf[from] -= amount;
          balanceOf[to] += amount;
          return true;
      }
  }
  
  contract Router is IUnlockCallback {
      IPoolManager public immutable manager;
  
      constructor(IPoolManager manager_) {
          manager = manager_;
      }
  
      function swap(PoolKey memory key, IPoolManager.SwapParams memory params) external returns (BalanceDelta) {
          return abi.decode(manager.unlock(abi.encode(msg.sender, key, params)), (BalanceDelta));
      }
  
      function unlockCallback(bytes calldata data) external returns (bytes memory) {
          require(msg.sender == address(manager));
          (address payer, PoolKey memory key, IPoolManager.SwapParams memory params) =
              abi.decode(data, (address, PoolKey, IPoolManager.SwapParams));
          BalanceDelta delta = manager.swap(key, params, "");
          _settle(key.currency0, delta.amount0(), payer);
          _settle(key.currency1, delta.amount1(), payer);
          return abi.encode(delta);
      }
  
      function _settle(Currency currency, int128 amount, address payer) private {
          if (amount < 0) {
              uint256 debt = uint256(-int256(amount));
              manager.sync(currency);
              require(IERC20Minimal(Currency.unwrap(currency)).transferFrom(payer, address(manager), debt));
              require(manager.settle() == debt);
          } else if (amount > 0) {
              manager.take(currency, payer, uint256(int256(amount)));
          }
      }
  }
  
  contract ProofRouteDivergenceTest {
      Vm constant vm = Vm(address(uint160(uint256(keccak256("hevm cheat code")))));
      address constant IMD = 0xD34a99Bc0f67aE1bbd63C660e6d0b0dd03E263B7;
      uint160 constant Q96 = 1 << 96;
  
      IPoolManager manager;
      SIMDTESTLaunch launch;
      SIMDTEST token;
      SIMDTESTHook hook;
      ImdDouble imd;
      Router router;
  
      function setUp() public {
          vm.roll(200);
          vm.etch(IMD, address(new ImdDouble()).code);
          imd = ImdDouble(IMD);
          imd.mint(address(this), 1e33);
          manager = IPoolManager(address(new PoolManager(address(this))));
          launch = new SIMDTESTLaunch(manager);
          token = launch.token();
          bytes32 salt;
          for (uint256 i; i < 1_000_000; ++i) {
              salt = bytes32(i);
              if (uint160(launch.predictHook(salt)) & 0x3fff == 0x20cc) break;
          }
          imd.approve(address(launch), 1e33);
          hook = launch.launch(Q96, 1e33, salt); // opening block = 200; anti-snipe 30% now
          router = new Router(manager);
          token.approve(address(router), type(uint256).max);
          imd.approve(address(router), type(uint256).max);
      }
  
      function _buy(bool exactInput, uint256 amount) private view returns (IPoolManager.SwapParams memory) {
          bool zeroForOne = hook.imdIsCurrency0(); // buying SIMDTEST with IMD
          return IPoolManager.SwapParams(
              zeroForOne,
              exactInput ? -int256(amount) : int256(amount),
              zeroForOne ? TickMath.MIN_SQRT_PRICE + 1 : TickMath.MAX_SQRT_PRICE - 1
          );
      }
  
      function test_SameOutputSameBlockSameTotalCostAcrossBuyRoutes() public {
          PoolKey memory key = hook.poolKey();
          uint256 snapshot = vm.snapshotState();
  
          // Route 1: exact-input buy with 1000 IMD in the opening block.
          uint256 before = imd.balanceOf(address(this));
          BalanceDelta d1 = router.swap(key, _buy(true, 1000 ether));
          uint256 out1 = uint256(int256(hook.imdIsCurrency0() ? d1.amount1() : d1.amount0()));
          uint256 paidExactIn = before - imd.balanceOf(address(this));
          require(paidExactIn == 1000 ether, "exact-input route must consume the budget");
  
          require(vm.revertToState(snapshot), "revert");
  
          // Route 2: exact-output buy of exactly the same SIMDTEST amount, same block, same pool state.
          before = imd.balanceOf(address(this));
          BalanceDelta d2 = router.swap(key, _buy(false, out1));
          uint256 out2 = uint256(int256(hook.imdIsCurrency0() ? d2.amount1() : d2.amount0()));
          uint256 paidExactOut = before - imd.balanceOf(address(this));
          require(out2 == out1, "same output");
  
          // Same economic trade must cost the same total IMD up to rounding (allow 0.01%).
          uint256 diff = paidExactIn > paidExactOut ? paidExactIn - paidExactOut : paidExactOut - paidExactIn;
          require(
              diff * 10_000 <= paidExactIn,
              "fee base diverges between exact-input and exact-output buys (expected ~1000 IMD both; got 1000 vs ~907)"
          );
      }
  }

  whole proof

• mediumThe seed position's share of every anti-snipe donation (100% at launch) is permanently unclaimable: the IMD is stranded in the PoolManager rather than 'protecting liquidity'src/SIMDTESTLaunch.sol:100

  PoolManager.donate does not add to pool reserves; it only increases feeGrowthGlobal, i.e. it creates a fee claim for positions in range, realisable only through modifyLiquidity by the position owner. The seed position is owned by SIMDTESTLaunch, whose only PoolManager entry is unlockCallback, which is sealed by !seeding after the launch transaction and has no collect/withdraw path (the contract comment at line 16 states fees are locked forever).

  In the launch block the seed is the only liquidity, so 100% of the first swaps' anti-snipe fee -- the very fee meant to deter snipers and 'protect liquidity' -- becomes IMD held by the PoolManager that no account can ever withdraw. Later it is the seed share L_seed/(L_seed+L_other) of every donation, plus all 1.25% LP fees earned by the seed.

  The brief says this fee 'is not burned'; economically it is burned into the PoolManager balance, with none of the intended liquidity protection (reserves, depth and price are unchanged by a donation). Combined with finding 1, the anti-snipe fee ends up either stranded (seed share) or returned to in-range JIT positions, which can include the sniper.

  This is a design-level consequence the requester should decide on: either make the seed position's fee claim collectible by an agreed party, or route the anti-snipe component to the treasury/burn instead of donate().

  whole finding

  State: pool launched at 2^96 with 800M/800M seed in block 200 (launch helper is the only LP).

  1. Same block, exact-input buy with 1,000 IMD: hook donates 300 IMD, takes 5 IMD to treasury, pool receives 695 IMD.
  2. StateLibrary.getFeeGrowthInside(poolId,-887220,887220) minus the launcher's position feeGrowthInsideLast, times liquidity / 2^128 = 308.6875 IMD owed to the position at (owner=SIMDTESTLaunch, -887220, 887220, salt 0) (300 donation + 8.6875 LP fee).
  3. vm.prank(poolManager); launch.unlockCallback("") -> reverts OnlySeedingCallback; SIMDTESTLaunch exposes no other function that reaches modifyLiquidity, and PoolManager positions are keyed by msg.sender so no one else can touch it. Expected per brief: the 300 IMD 'protects liquidity'. Actual: 300 IMD sits in the PoolManager's IMD balance with no claimant forever; pool reserves/price unchanged.

  whole reproduction

• infoThe unassigned 10% of supply is sent to the launch initiator EOA, which becomes the largest non-pool holder and the natural actor for finding 1src/SIMDTESTLaunch.sol:62

  The brief allocates 80% to the pool and 10% to the dead address and says nothing about the remaining 10%. The helper transfers those 100,000,000 SIMDTEST to launchInitiator (the helper deployer) with no lock or vesting.

  This is a trust assumption, not a bug, but it matters economically: that holder can sell 100M tokens into the pool from block 0 (paying hook fees in IMD on the way out), and holds the SIMDTEST inventory needed to run the single-sided JIT recovery in finding 1 against every sniper in the first 10 blocks. The requester should confirm the destination of the remainder (treasury, burn, vesting) explicitly.

  After SIMDTESTLaunch.launch(...) succeeds: token.balanceOf(launchInitiator) == 100_000_000e18, token.balanceOf(DEAD) == 100_000_000e18, token.balanceOf(poolManager) == 800_000_000e18. No contract constraint prevents launchInitiator from transferring or selling the 100M in the launch block.

• infoEvery swap depends on an IMD transfer to the fixed treasury succeeding; if IMD ever rejects transfers to that address the pool is permanently unswappablesrc/SIMDTESTHook.sol:151

  take() performs a live ERC-20 transfer of the 0.5% fee to TREASURY inside every swap. The hook has no owner, no fallback recipient and no way to skip the fee (by design). Therefore any state in which IMD's transfer to 0x3dD5...9985 reverts or returns false (token pause, blacklist/sanction list, or the treasury becoming a contract that IMD refuses) halts all trading on this pool forever, including sells, so holders cannot exit.

  IMD's behaviour at 0xd34a...63b7 could not be verified offline; this is recorded as a dependency trust assumption, not a code defect. If the requester wants robustness, accrue the treasury fee as an ERC-6909 claim or mint it to the hook for later sweep instead of transferring inline.

  State: pool launched and open.

  Make IMD.transfer(TREASURY, x) return false (the repository's MockIMD.setFail(true) models this).

  Any swap in any mode: router.swap(key, params) -> afterSwap -> poolManager.take(IMD, TREASURY, fee) -> Currency.transfer reverts -> whole swap reverts.

  Expected (if resilient): swap succeeds with fee accrued.

  Actual: every swap reverts until IMD behaviour changes; there is no admin path.

Failed on the agent's machine.

• lowSIMDTESTLaunch.launch accepts a salt that deploys the hook at an ungated (0x20cc) address, shipping the launch without the anti-snipe liquidity gatesrc/SIMDTESTLaunch.sol:55

  SIMDTESTHook's constructor validates its own address against getHookPermissions(), and getHookPermissions() derives the beforeAddLiquidity bit from the address itself (liquidityGateEnabled()). Both 0x28cc and 0x20cc therefore pass validation, which the hook documents. SIMDTESTLaunch.launch(sqrtPriceX96, maxImd, hookSalt) takes the salt from the caller and never checks the resulting hook's flag mask or liquidityGateEnabled().

  If the initiator supplies a salt whose CREATE2 address carries 0x20cc (about 1 in 16384 salts; the README's own test_RejectsInvalidPricesAndBadSalt explicitly skips such salts because they do not revert), the launch succeeds, the pool opens, and the PoolManager never calls beforeAddLiquidity: the JIT end-tick attack that the gate exists to stop (README 'Anti-snipe liquidity gate', measured locally at ~90% recovery of the sniper's own donation) is possible for the whole 10-block window.

  There is no admin path to correct it afterwards, and the launch is one-shot, so the only remedy is a new token and helper. Only the initiator can trigger it, so it is a misconfiguration risk rather than an external attack, but it contradicts the stated fair-launch guarantees ('no hidden features') and the brief's requirement that nothing after deployment depends on an operator getting a step right.

  Suggested fix: in launch(), after hook = new SIMDTESTHook{salt: hookSalt}(...), revert unless uint160(address(hook)) & Hooks.ALL_HOOK_MASK == SIMDTESTHook.HOOK_FLAGS (equivalently hook.liquidityGateEnabled()).

  whole finding

  Deploy PoolManager and SIMDTESTLaunch locally with any ERC-20 at the IMD address.

  Iterate salts from 1 until uint160(launcher.predictHook(salt)) & 0x3fff == 0x20cc.

  Call launcher.launch(1 << 96, maxImd, salt) from the initiator with IMD approved.

  Expected: revert (the hook does not carry HOOK_FLAGS).

  Actual: launch succeeds, hook.liquidityGateEnabled() returns false, hook.antiSnipeBps() returns 3000, and a modifyLiquidity for ticks [-60, 60] in the opening block succeeds (verified locally with test/scratch/Probe.t.sol::test_UngatedSaltLaunches: gas 479,383,252, PASS, meaning the narrow add went through).

  whole reproduction
  proof · a Foundry test the fix has to pass

  // SPDX-License-Identifier: MIT
  pragma solidity 0.8.26;
  
  import {Test} from "forge-std/Test.sol";
  import {SIMDTEST} from "src/SIMDTEST.sol";
  import {SIMDTESTHook} from "src/SIMDTESTHook.sol";
  import {SIMDTESTLaunch} from "src/SIMDTESTLaunch.sol";
  import {PoolManager} from "@uniswap/v4-core/src/PoolManager.sol";
  import {IPoolManager} from "@uniswap/v4-core/src/interfaces/IPoolManager.sol";
  import {IUnlockCallback} from "@uniswap/v4-core/src/interfaces/callback/IUnlockCallback.sol";
  import {PoolKey} from "@uniswap/v4-core/src/types/PoolKey.sol";
  import {Currency} from "@uniswap/v4-core/src/types/Currency.sol";
  import {BalanceDelta} from "@uniswap/v4-core/src/types/BalanceDelta.sol";
  
  /// @dev Minimal ERC-20 installed at the IMD address.
  contract StubIMD {
      uint8 public constant decimals = 18;
      mapping(address => uint256) public balanceOf;
      mapping(address => mapping(address => uint256)) public allowance;
  
      function mint(address to, uint256 amount) external {
          balanceOf[to] += amount;
      }
  
      function approve(address spender, uint256 amount) external returns (bool) {
          allowance[msg.sender][spender] = amount;
          return true;
      }
  
      function transfer(address to, uint256 amount) external returns (bool) {
          balanceOf[msg.sender] -= amount;
          balanceOf[to] += amount;
          return true;
      }
  
      function transferFrom(address from, address to, uint256 amount) external returns (bool) {
          allowance[from][msg.sender] -= amount;
          balanceOf[from] -= amount;
          balanceOf[to] += amount;
          return true;
      }
  }
  
  /// @notice SIMDTESTLaunch.launch accepts a CREATE2 salt whose hook address carries the documented
  /// "ungated" flag set 0x20cc. The hook constructor accepts it, the launch succeeds, and the resulting
  /// pool has no anti-snipe liquidity gate: a narrow position can be added in the opening block.
  /// Expected: launch rejects any hook whose address mask is not HOOK_FLAGS (0x28cc).
  /// Actual: launch succeeds and liquidityGateEnabled() is false.
  contract ProofUngatedSalt is Test, IUnlockCallback {
      address constant IMD = 0xD34a99Bc0f67aE1bbd63C660e6d0b0dd03E263B7;
      IPoolManager manager;
      SIMDTESTLaunch launcher;
      SIMDTEST token;
      StubIMD imd;
      PoolKey key;
  
      function setUp() public {
          vm.etch(IMD, address(new StubIMD()).code);
          imd = StubIMD(IMD);
          imd.mint(address(this), 1e30);
          manager = IPoolManager(address(new PoolManager(address(this))));
          launcher = new SIMDTESTLaunch(manager);
          token = launcher.token();
          imd.approve(address(launcher), 1e30);
      }
  
      function test_LaunchRejectsUngatedHookSalt() public {
          bytes32 salt = bytes32(uint256(1));
          while (uint160(launcher.predictHook(salt)) & 0x3fff != 0x20cc) {
              salt = bytes32(uint256(salt) + 1);
          }
          // Must revert: a launch whose hook has no beforeAddLiquidity bit ships without the gate.
          vm.expectRevert();
          launcher.launch(1 << 96, 1e30, salt);
      }
  
      /// @dev Demonstration of the consequence on the current code (not part of the pass/fail proof):
      /// after an ungated launch, hook.liquidityGateEnabled() is false and a narrow [-60, 60] position
      /// can be added through modifyLiquidity in the opening block, while antiSnipeBps() is 3000.
      function unlockCallback(bytes calldata data) external returns (bytes memory) {
          (int24 lower, int24 upper, int256 delta) = abi.decode(data, (int24, int24, int256));
          (BalanceDelta d,) = manager.modifyLiquidity(key, IPoolManager.ModifyLiquidityParams(lower, upper, delta, 0), "");
          _pay(key.currency0, d.amount0());
          _pay(key.currency1, d.amount1());
          return "";
      }
  
      function _pay(Currency currency, int128 amount) private {
          if (amount < 0) {
              manager.sync(currency);
              StubIMD(Currency.unwrap(currency)).transfer(address(manager), uint256(-int256(amount)));
              manager.settle();
          }
      }
  }

  whole proof

• lowliquidityForSeed accepts seed liquidity above the pool's per-tick maximum, so launch at extreme prices reverts with the PoolManager's TickLiquidityOverflow instead of the helper's own validation errorsrc/SIMDTESTLaunch.sol:78

  liquidityForSeed(sqrtPriceX96) rejects a price only when the computed liquidity is zero or exceeds int128.max. Uniswap v4 additionally caps liquidity per initialized tick at type(uint128).max / numTicks, which for tick spacing 60 is 11505743598341114571880798222544994 (about 1.15e34).

  For prices where 800,000,000e18 SIMDTEST implies more full-range liquidity than that (roughly |tick| > 329,000, i.e. a SIMDTEST price above ~2e14 IMD or below ~5e-15 IMD), liquidityForSeed returns a figure the pool cannot accept and launch() reverts inside modifyLiquidity with TickLiquidityOverflow(int24). A band of slightly less extreme prices passes the per-tick cap but overflows the int128 IMD leg instead.

  In every case the whole launch reverts atomically and the helper remains retryable (verified with testFuzz_AnyPriceSeedsExactlyOrRollsBack over the full usable tick range), so no funds are at risk; the defect is that the helper's documented pre-flight quote (README step 5: 'liquidityForSeed(price) exposes the seed liquidity') is not a reliable admissibility check and the revert reason comes from a foreign contract.

  Suggested fix: in liquidityForSeed, also revert InvalidPriceOrLiquidity when liquidity > type(uint128).max / 29575 (Pool.tickSpacingToMaxLiquidityPerTick(60)).

  whole finding

  Deploy PoolManager and SIMDTESTLaunch locally with any ERC-20 at the IMD address, mine a 0x28cc salt.

  Let tick = 400000 if address(token) < IMD else -400000, price = TickMath.getSqrtPriceAtTick(tick). launcher.liquidityForSeed(price) returns 387744244030801590113917774364944727 (3.9e35), above the per-tick cap 1.15e34, without reverting. launcher.launch(price, type(uint256).max, salt) reverts with selector 0xb8e3c385 = TickLiquidityOverflow(int24).

  Expected: both calls revert with InvalidPriceOrLiquidity (0x4f2461b8).

  Fuzzing int24 ticks across (-887219, 887219) first surfaced this at tick 478702 (test/scratch/Probe.t.sol::testFuzz_WidePrice).

  whole reproduction
  proof · a Foundry test the fix has to pass

  // SPDX-License-Identifier: MIT
  pragma solidity 0.8.26;
  
  import {Test} from "forge-std/Test.sol";
  import {SIMDTEST} from "src/SIMDTEST.sol";
  import {SIMDTESTLaunch} from "src/SIMDTESTLaunch.sol";
  import {PoolManager} from "@uniswap/v4-core/src/PoolManager.sol";
  import {IPoolManager} from "@uniswap/v4-core/src/interfaces/IPoolManager.sol";
  import {TickMath} from "@uniswap/v4-core/src/libraries/TickMath.sol";
  
  /// @dev Minimal ERC-20 installed at the IMD address.
  contract StubIMD {
      uint8 public constant decimals = 18;
      mapping(address => uint256) public balanceOf;
      mapping(address => mapping(address => uint256)) public allowance;
  
      function mint(address to, uint256 amount) external {
          balanceOf[to] += amount;
      }
  
      function approve(address spender, uint256 amount) external returns (bool) {
          allowance[msg.sender][spender] = amount;
          return true;
      }
  
      function transfer(address to, uint256 amount) external returns (bool) {
          balanceOf[msg.sender] -= amount;
          balanceOf[to] += amount;
          return true;
      }
  
      function transferFrom(address from, address to, uint256 amount) external returns (bool) {
          allowance[from][msg.sender] -= amount;
          balanceOf[from] -= amount;
          balanceOf[to] += amount;
          return true;
      }
  }
  
  /// @notice liquidityForSeed only rejects liquidity above int128.max, but the pool's per-tick cap for
  /// tick spacing 60 is type(uint128).max / 29575 (about 1.15e34). For prices where the 800M seed implies
  /// more liquidity than that, the helper quotes a liquidity it cannot seed and launch reverts from inside
  /// the PoolManager with TickLiquidityOverflow instead of the helper's own InvalidPriceOrLiquidity.
  /// Expected: liquidityForSeed and launch revert with InvalidPriceOrLiquidity.
  /// Actual: liquidityForSeed returns a value above the cap and launch reverts with TickLiquidityOverflow.
  contract ProofSeedLiquidityCap is Test {
      address constant IMD = 0xD34a99Bc0f67aE1bbd63C660e6d0b0dd03E263B7;
      IPoolManager manager;
      SIMDTESTLaunch launcher;
      SIMDTEST token;
      bytes32 salt;
  
      function setUp() public {
          vm.etch(IMD, address(new StubIMD()).code);
          StubIMD(IMD).mint(address(this), type(uint256).max / 2);
          manager = IPoolManager(address(new PoolManager(address(this))));
          launcher = new SIMDTESTLaunch(manager);
          token = launcher.token();
          StubIMD(IMD).approve(address(launcher), type(uint256).max);
          bytes32 initHash = launcher.hookInitCodeHash();
          for (uint256 i;; ++i) {
              salt = bytes32(i);
              address predicted = address(
                  uint160(uint256(keccak256(abi.encodePacked(bytes1(0xff), address(launcher), salt, initHash))))
              );
              if (uint160(predicted) & 0x3fff == 0x28cc) break;
          }
      }
  
      function test_LaunchRejectsLiquidityAbovePerTickCap() public {
          // Price far on the side that makes 800M SIMDTEST a huge liquidity figure.
          int24 tick = address(token) < IMD ? int24(400_000) : int24(-400_000);
          uint160 price = TickMath.getSqrtPriceAtTick(tick);
          uint128 perTickCap = type(uint128).max / 29_575;
          (bool ok, bytes memory ret) = address(launcher).call(abi.encodeCall(launcher.liquidityForSeed, (price)));
          if (ok) {
              assertLe(abi.decode(ret, (uint128)), perTickCap, "quoted liquidity exceeds pool per-tick cap");
          }
          vm.expectRevert(SIMDTESTLaunch.InvalidPriceOrLiquidity.selector);
          launcher.launch(price, type(uint256).max, salt);
      }
  }

  whole proof

Failed on the agent's machine.