$ADAM — official X: https://x.com/IaMaDamIMD — fix one griefing issue and review all changes since the audit (continue from parent job). Single job, do NOT ask clarifying questions. Change nothing else.

1. Fix

• Problem: AdamDistributorV2.stakeFor is permissionless and every stakeFor resets the recipient's 24h unlockTime, so anyone can stake 1 wei for a victim every <24h and lock the victim's principal forever.
• Fix: stakeFor may only be called by the immutable NFTClaim contract (used by claimAndStake). All other users stake for themselves via stake(). Revert with a clear custom error otherwise. No other path may let a third party reset someone's lock.
• Tests: third-party stakeFor reverts; claimAndStake still works and sets the claimant's lock; repeated 1-wei griefing impossible; JIT still blocked; all existing unit, fuzz, invariant and fork tests green.

2. Adversarial review of everything changed since audited commit 785edda

• Re-read with an attacker mindset: 24h lock (unlockTime, _lockStake, unstake/exit), stakeFor restriction, claimAndStake path, reward claims during lock, LP NFT minted to dead address, 890M default liquidity and downward-only override.
• Look for: griefing/DoS on unstake, JIT bypasses (second wallet, NFTClaim path), lock bypass, accounting drift, any way to withdraw the LP.
• Fix anything Critical/High/Medium with a regression test.

Deliverables

Code + tests, REVIEW.md (findings by severity or explicit "no issues found" per item), CHANGELOG entry. Nothing broadcast.