Review complete. The findings file is written and valid, no source file was changed, and the working tree has no stray files.

Outcome. The code as it stands shows no loss-of-funds or access-control defect that I could reproduce. I recorded one low finding and one info finding in .imd-findings.json. Neither is critical or high, so no proof file is attached. This is a review of what I could reach in the time budget, not a statement that the code is audited or secure.

Manifest. launch.json is valid for the factory: only schema keys, strings for addresses and notes, numbers for fee, tick spacing and decimals, lowercase paired currency, constructor arguments in the declared order with no literal addresses, and six permissions that encode to 10444 and match the hook's own permission function. The token name is nine characters, the symbol SVO, decimals 18. Notes are 3,864 characters. The indicative price is below 2^160.

Mining. PrepareLaunch found a salt for the local fixture and the hook deployed at an address carrying flags 10444, built its vault, accepted initialization from the factory at the manifest's fee and tick spacing, and refused a 3000 fee tier. The real salt must be mined again with the chain's manager, token and factory addresses.

Tests.

Findings.

• Low, src/SovrnHook.sol:126. The opening-hour liquidity lock exempts every sender while the timestamp equals the opening timestamp. On a sub-second chain several blocks share one timestamp, so a non-factory LP in a following block placed an IMD-only range and was filled by sell flow fee-free. Measured: 3.75 IMD bought about 4.1M SVO, the vault earned 0.16 IMD from the seller's fee, and a direct buy of the same IMD paid 1.87 IMD. This is the parked route from launch #1173 narrowed to one second rather than closed.
• Info, test/LiquidityLock.t.sol:23. The regression test's "IMD-only range" lies on the wrong side of the fixture price and holds SVO only in both currency orders, so the suite never exercises the route it names.

Trust assumptions, not defects. The IMD owner's transfer gate or blocklist can halt every fee-bearing swap and strand claims until lifted. The PoolManager owner can set a protocol fee. A router that syncs IMD before the swap must add the hook fee to its payment or its settlement reverts. All three are already in the manifest notes.

Coverage. I read all five contracts in src/, the preparation script, the shared test fixture, the router mock and the lock tests, and traced the four swap modes, the quote path, claim fallback and vault accounting against the Pashov and v4 checklists. Not reached: the real IMD token's behaviour on chain 4663 (fork test unrun), the launch factory's seeding path, and whether the Safe or vault can be blocklisted by IMD's owner.

Done. The one failure in that last run is my scratch copy of the protected floor, whose setUp reads the creation code from environment variables that are unset in a plain run. With the variables set it passed 11 of 11, and test/scratch is deleted before anything is built. The delivered suite is unchanged at 184 passed, 2 skipped.

What I changed: only launch.json. The source, tests, attestation and config are untouched.

• pool.initialPrice is now the launch's stated one-to-one value from the reference, replacing the previous contributor's indicative 3,000 IMD figure. The deployer derives the real opening price from the policy, so this is descriptive only.
• The notes now record the verification results, both audit findings and their disposition, and stay under the cap at 3937 characters. Everything else in the manifest was already correct and is unchanged.

Manifest verification: first key is "kind": "univ4_hook", hook is SovrnHook with the flat $poolManager, $token, $factory arguments in declaration order, the six permissions match getHookPermissions exactly and encode 10444, token is SovrnToken named SOVRN.ONE / SVO with 18 decimals, pool is IMD in lowercase, fee 12500, tick spacing 60.

Hook mining: PrepareLaunch found salt 321 for a sample deployer, the predicted address carries flags 10444, a real CREATE2 deployment landed there, and the deployed hook's permissions agree. A local copy of the protected admission floor, driven by the real creation code with manager, token and factory probes, passed all 11 tests including initialization from the factory on the IMD pool at the one-to-one price.

Tests: forge test gives 184 passed, 0 failed, 2 skipped. The skipped ones are the two Fork4663 suites, which need FORK_4663_RPC.

Audit findings: both reproduce against the unchanged code, in both currency orders, with the auditor's exact figures.

• Low: the opening-hour exemption is keyed on the timestamp, not the block. In a later block of the same second a non-factory sender added an IMD-only range, a seller filled it, and the vault received only the 3.5% sell fee where a direct buy of the same IMD paid 50%. One second later the same add reverts as intended.
• Info: the LiquidityLock test's "IMD-only range" holds only SVO at the fixture price in both orientations, so the suite never exercises the parked route. A real IMD-only range is ticks 138240 to 156240 with IMD as currency0.

Neither was fixed because the task forbids source changes. The reproducing tests are in test/scratch/AuditFindings.t.sol and the notes describe both.

Two things to know: the repository's own script/attest.py --check already fails on the unchanged tree because the last commit added a compiled Python cache file under test/ that the generator now hashes. It is the contributor's record, not the verifier's attestation, and it also pins the old initialPrice. Separately, if the real factory seeds liquidity in a later block through a periphery contract other than its own address, the opening-hour lock refuses that seeding. The README discloses this; confirm how the factory seeds before deployment.

The review is complete. The findings are in .imd-findings.json at the repository root, and no tracked file was changed.

Launch checks

• launch.json is a valid manifest. Five schema keys, hook SovrnHook with the flat $poolManager, $token, $factory arguments in constructor order, six permissions that encode 10444 and match getHookPermissions, token SOVRN.ONE / SVO / 18, fee 12500, tick spacing 60, lowercase IMD address, initialPrice 2^96, notes 3,937 characters.
• Hook address mining works. PrepareLaunch found salt 0x926c giving 0x7A9c…68cc with the low 14 bits equal to 10444; a CREATE2 deployment at that address succeeded and the deployed hook reports the same six permissions.
• Test suite: 184 passed, 0 failed, 2 skipped. The skips are Fork4663.t.sol, which needs FORK_4663_RPC.

Findings

1. Medium, with proof. The opening-hour liquidity lock in SovrnHook.beforeAddLiquidity is keyed on the timestamp, so any sender whose transaction lands in a later block of the opening second passes it. Robinhood Chain is an Arbitrum Orbit chain that stamps several blocks per second. In the proof a non-factory address adds an IMD-only range beside the opening price, a seller fills it one second later, and the range owner withdraws SVO without paying the 50% buy fee.

The manifest already discloses this as low. The numbers and the fact that the previous launch was parked on the same mechanism put it at medium for the judge to weigh. The proof fails on the current code and passes under a factory-only lock or a block-number-keyed exemption; I verified both by patching and restoring the source.

2. Info. The math-precision pass: all fee divisions floor in the swapper's favour by under 1 wei, exact-output sells deliver exactly the requested IMD, the vault's 70/30 split drifts at most 1 wei of buyback per sync call, and the decay rate is exact at every edge. No defect.

Coverage. All fourteen entry points have rows. Thirteen hold; beforeAddLiquidity carries finding 1. I fuzzed the fee math in all four modes with price limits in both currency orders and checked the exact-output sell identity for 2,000 runs per order. One probe that reverted turned out to be the PoolManager's own overflow on a request larger than the pool's IMD, not a hook defect.

The review is complete. The findings file is in place, the working tree is clean apart from the harness-excluded paths, and no source, test, config or manifest file was changed.

Outcome

• Manifest. launch.json is valid: exactly the five schema keys, constructor arguments $poolManager, $token, $factory match the hook's flat three-argument constructor in order, the six permissions equal getHookPermissions and encode 10444, token name "SOVRN.ONE" (nine characters, one full stop) and symbol "SVO" with 18 decimals, paired currency is the lowercase IMD address, fee 12500 and tick spacing 60 are numbers, initial price is a decimal string below 2^256, notes are 3937 characters.
• Address mining. Running the shipped miner against the real initcode found a salt whose predicted CREATE2 address carries flags 10444. The hook deployed at that address, and its implementation reports the same 10444. Figures are in the coverage record.
• Test suite. The existing suite passed with no failures. The two skipped tests are the fork tests that need an RPC variable that is not set.

One finding, low severity. The opening-hour liquidity lock exempts any sender while the block timestamp equals the opening timestamp, not only the opening block. On a sub-second chain, a non-factory LP can add an IMD-only range in a later block of the same second. A seller then fills it at the 3.5% sell fee, and the LP ends up holding SVO with no 50% buy fee paid. The reproduction placed 5.91 IMD, one 8M SVO sell filled it, the vault got 0.198 IMD, and the LP withdrew 3.98M SVO for 2.80 IMD net. The author's own manifest notes already disclose this residual; I reported it with a reproducing test because it is the remnant of the parked finding and the fix was keyed on the wrong clock. The proof test under test/scratch fails on the current tree and would pass if the exemption were keyed on block number or restricted to the factory.

Everything else in my area holds. I traced all fourteen entry points through their guards, state changes and failure paths: the self-call quote path and its rounding chains, the claim-versus-take settlement in afterSwap, the redeem unlock cycle, the vault's reserve derivation under surplus and shortfall, and the plain token. Nothing blocks admission. The coverage record has a row for every listed entry point plus rows for the manifest, mining, the test run, the periphery libraries and the documented router sync-ordering hazard.

Review complete. The findings file is at .imd-findings.json (one finding, 17 coverage rows, proof embedded); git intentionally excludes it and test/scratch/, and no tracked file was changed.

Outcome of the four requested steps

• Manifest. launch.json is valid for the factory: schema keys only, fee, tick spacing and decimals as numbers, price and notes as strings, lowercase IMD paired currency, constructor arguments $poolManager, $token, $factory in declaration order, six permissions that encode 10444 and match getHookPermissions, name SOVRN.ONE (nine bytes) and symbol SVO matching the token, notes 3937 ASCII characters.
• Hook address. The Launch tests mine a salt with PrepareLaunch, deploy by CREATE2 at the predicted address and confirm flags 10444. I also ran the protected admission floor locally against this hook's creation code with probe addresses for manager, token and factory, and the token floor with the policy supply and decimals. Result: 11 of 11 passed, including initialization from the factory probe.
• Test suite. forge test gives 184 passed, 0 failed, 2 skipped. The skipped pair is the fork test, which needs FORK_4663_RPC.
• Review (Access Control, Trust Gap, Asymmetry). Every callback is PoolManager-only, initialization is single-shot and factory-only, the vault pays only the fixed Safe, the quote self-call cannot re-enter callbacks, and the before/after swap fee formulas mirror each other in all four modes including partial fills. Nothing found blocks admission.

One finding, low severity, with a failing proof test. The opening-hour liquidity lock at src/SovrnHook.sol:126 exempts block.timestamp == openedAt, while the comment and manifest describe an opening-block exemption. Robinhood Chain mines several blocks per second, so a non-factory sender in a later block of the opening second can still add a pure-IMD range beside the price. Sell flow during the hour then converts that IMD into SVO at the pool price with only the 3.5% sell fee reaching the vault, instead of the 50% a direct buy would owe. The reproduction converts 0.306 IMD into about 450,949 SVO while the vault receives 0.119 IMD against 0.153 IMD owed on a direct buy. One second later the same add reverts. The author's own notes already disclose this as low. The proof under test/scratch/OpeningSecondLock.t.sol fails on the current code and passes once the exemption is tied to the factory's own initializing transaction or block.

Not reached. The real launch factory's seeding path is outside the tree, so whether it calls modifyLiquidity itself in the opening transaction is a stated trust assumption rather than something I verified. The fork rehearsal did not run here.

Review complete. The findings file is at .imd-findings.json with one finding, a proof test, and 20 coverage rows. No source, test, config or manifest file was changed; only the findings file and test/scratch/OpeningSecondLock.t.sol were written.

Launch checks

• launch.json is valid for the factory: the five schema keys only, hook SovrnHook with ["$poolManager","$token","$factory"] in declaration order, six permissions that equal getHookPermissions and encode flags 10444, token SOVRN.ONE / SVO / 18, fee 12500, tick spacing 60, lowercase IMD paired currency, a decimal initialPrice string, notes 3937 characters.
• Mining and address verification pass: the Launch tests mine a salt with PrepareLaunch.mine, deploy through real CREATE2 to the predicted address, and the address and implementation both carry 10444 in both currency orders. Hook plus vault deployment costs about 2.16M gas, runtime 7130 bytes.
• forge test: 184 passed, 0 failed, 2 skipped. The two skips are the fork suite, which needs FORK_4663_RPC and was not run here.

Finding (medium): the opening-hour liquidity lock is keyed on the timestamp, not the launch transaction. src/SovrnHook.sol:126 exempts every sender while block.timestamp == openedAt. Robinhood Chain has sub-second blocks, so an ordinary sender can add an IMD-only range in the next block of the opening second and the hook accepts it. In the scratch test, Alice adds a range at ticks 138180..138240 one block after the launch block, Bob sells 20M SVO, and Alice withdraws 3.05M SVO for 2.99 IMD. The vault received 0.32 IMD from the seller's 3.5% fee instead of the 1.50 IMD a direct buy at 50% would have paid. One second later the same add is refused, so the window is exactly the opening timestamp. This is the same route that parked launch #1173, narrowed but not closed. The manifest notes already list it as low; I rate it medium because the stated guarantee is broken for any watcher of the launch block. A minimal fix that keeps the design is to mark the initializing transaction with transient storage in beforeInitialize and accept that flag, the factory, or the end of the decay in beforeAddLiquidity. Do not key it on block.number, which on Orbit chains is the parent chain's block.

Coverage. All 14 entry points have rows. Thirteen hold: the four swap modes in both currency orders conserve the fee, the quote path leaves no state, the exact-output sell rounding gives amountToSwap == gross, the claim fallback nets the hook delta to zero, the vault's two reserves always sum to its balance in both branches, and the token is plain. One row carries the finding. Not reached: the real factory's seeding path. If the factory seeds in a later block through a contract other than its own address, the hook refuses it, and the fork rehearsal in the repo does not model a factory. That is a deployment question the deployer's simulation will answer, not a code defect I could reproduce.

Review complete. The findings file is written at .imd-findings.json and the working tree is otherwise untouched (only the findings file is new; the scratch directory was removed).

Outcome

• Manifest holds. launch.json uses only schema keys. Constructor arguments are $poolManager, $token, $factory in declaration order. The six permissions encode 10444 and match getHookPermissions exactly. Token name, symbol and decimals, pool fee 12500, tick spacing 60, lowercase IMD pairedCurrency and a decimal initialPrice all check out. Notes are 3,937 characters.
• Hook address mined and verified. PrepareLaunch found a salt whose CREATE2 address carries flags 10444. A CREATE2 deploy at that address succeeded, the constructor validated the permissions and deployed the vault. Initcode with arguments is 10,793 bytes and runtime is 7,130 bytes, inside both protocol limits.
• Test suite: 184 passed, 0 failed, 2 skipped. The skipped pair is the fork suite, which needs FORK_4663_RPC.

Findings kept

1. Medium, merged from all four specialists. The opening-hour liquidity lock exempts any sender while block.timestamp equals openedAt, which is a whole second rather than the factory's transaction. Robinhood Chain mines several blocks per second, so a non-factory sender in a later block of the opening second adds an IMD-only range and sell flow fills it at the 3.5% sell fee instead of the 50% opening buy fee. I ran both specialist proofs and both fail on this tree for that reason. The permissions specialist's proof is attached: ALICE deposits 0.591 IMD in block N+1 of the opening second, one 5M SVO sell converts 0.306 IMD of it into 450,948 SVO, and the vault receives 0.119 IMD where a direct buy would have paid 0.153 IMD. One second later the same add reverts. I recalibrated to medium, since loss is bounded by first-hour sell flow and a one-second window, and noted that a block.number-based fix would be worse on an Orbit chain.
2. Info. The suite's lock test uses a range that holds only SVO at the fixture price, so the parked IMD-only route is never exercised by the repository's own tests. Verified by adding it after the decay: IMD leg 0, SVO leg nonzero.
3. Info. If the launch factory seeds in a later block through a helper contract whose address is not $factory, the hook refuses the seed for 60 minutes. The factory's seeding model is not in front of me, so this is recorded for admission to check, not as a code defect.

Coverage: all 14 entry points answered, 13 hold, beforeAddLiquidity carries finding 1. Three extra rows record the manifest check, the mining run and the test run. The math specialist's info note on 1-wei rounding was verified but not kept as a finding, since it describes bounded precision loss rather than a defect.