Four agents audited the code as it is at 3c1208a, each in one area, and a judge reproduced, merged and ranked what they found, then read the code once more itself. Nothing in the code was changed or deployed.

Download the report (Markdown)

2 medium6 low1 info

• 1.mediumMint TooExpensive retry lowers the signed minShares below the 'at least' floor the page displayed, without re-quotingdocs/core.js:216

          shares = (shares * 97n) / 100n;

  quoteBuy (app.js:144-145) shows 'About Q IMDEX5 (at least 0.97Q)'. mintFor recomputes minShares = 0.97*shares inside the loop (core.js:209) after cutting shares by 3% on each TooExpensive, up to six times, with maxImdIn still the full budget and no new figures shown. After k retries the signed floor is 0.97^(k+1)·Q (down to ~83% of Q), contradicting SITE_SECURITY.md's 'both bounds are shown before signing'.

  Retries happen exactly when pool prices moved/impact is high, i.e. when the floor matters. Merged from audit_math, audit_flow, audit_permissions.

  Fix: compute the floor once from the displayed quote and stop (or re-confirm) when reduced shares fall below it.

  Mainnet fork after site-test/fork.js's 10 IMD first mint (NAV 0.984124). mintFor(ethers, signer, 400e18, 300): page shows 'About 390.819919 IMDEX5 (at least 379.095321)'; staticCall 1 mint(390.82,400,379.10) reverts TooExpensive; staticCall 2 succeeds and the wallet is sent mint(379.095321, 400, minShares=367.722462) = 94.1% of quote, below the displayed floor. Expected minShares >= 379.095321 or a fresh confirmation.

• 2.mediumA failed pool-price read is treated as price 0, silently lowering redeemToImd's minImdOut computed on the wallet providerdocs/core.js:120

            poolPrice(ethers, provider, c.token, c.hook).catch(() => 0n),

  load() maps any extsload error to price 0, dropping that coin from coinValue. redeemToImdFor (core.js:247-249) uses load() on the wallet provider just before signing and sets minImdOut = 97% of quoteRedeemToImd(s), so one transient RPC error on a coin's read lowers the floor by that coin's share (~20%) while the contract still sells every coin.

  Later mints likewise get a lower NAV and thus more shares (fails safe via TooExpensive), but the redeem path loses protection. firstMintMinOut refuses price 0; redeemToImdFor does not.

  Supply 1000, five coins held 200 each at price 1 IMD, idle 0.

  Redeem 100 IMDEX5 for IMD: page shows 'about 97.0125 IMD (at least 94.1021)'.

  Make the wallet provider's eth_call to PoolManager.extsload fail for one coin's slot (e.g. 429): redeemToImdFor sends redeemToImd(100, minImdOut≈75.28 IMD).

  Expected ≈94.10 or an error before the wallet opens.

• 3.lowApproval is sent before the no-price check and before the mint staticCall, so an impossible mint still costs an approve and leaves an allowancedocs/core.js:199

      await ensureApproval(ethers, signer, budget, onStep);

  SITE_SECURITY.md says every write runs staticCall first and that a coin with no price stops the mint before the wallet opens. mintFor approves (line 199) before firstMintMinOut (line 201, which throws on price 0) and before mintFirst/mint.staticCall.

  The allowance is bounded to budget and spender is the index, so no theft; the cost is a wasted tx, a lingering allowance, and limits read before the approval was mined (load() at 197 is pre-approval, so prices can be stale by the time the mint is signed). Merged from audit_math, audit_flow, audit_economics, audit_permissions.

  Fix: run load()/firstMintMinOut after approval and the price-zero check before any prompt.

  Fresh fork (supply 0), allowance 0, set one listed coin's pool slot0 to 0; mintFor(10 IMD): 'Approve exactly 10.0 IMD…' is shown, the approve is mined (allowance 10 IMD), then 'INFER has no pool price; the first mint would fail' is thrown. Same order for a 1000 IMD first mint that then reverts TooLittleOut in staticCall.

• 4.lowWallet chain change after first action: getNetwork throws 'network changed' so the switch prompt never runsdocs/app.js:198

      const net = await browser.getNetwork();

  BrowserProvider is created without network 'any' (app.js:230) and never rebuilt on chainChanged. ethers 6.13.4 caches the first network and throws NETWORK_ERROR on mismatch, so the wallet_switchEthereumChain branch at 199-202 is only reachable if the wallet was on the wrong chain at the first action. No tx is sent on the wrong chain. Merged from four specialists.

  Fix: BrowserProvider(window.ethereum,'any') or read eth_chainId via window.ethereum.request, and rebuild on chainChanged.

  Node with docs/ethers-6.13.4.umd.min.js and a mock EIP-1193 whose eth_chainId is 0x1: signer() resolves. Change it to 0x2105 and call signer() again: throws 'network changed: 1 => 8453', wallet_switchEthereumChain never requested; page shows 'Mint did not go through: network changed: 1 => 8453'.

• 5.lowMax buttons are disabled by lockIfBusy and never re-enableddocs/app.js:17

      document.querySelectorAll("#act button:not([role=tab]), #keepers button").forEach((b) => (b.disabled = true));

  #buyMax and #sellMax (index.html:62,70) are inside #act, so any action disables them; no code sets their disabled back to false (only references are onclick at app.js:259-260).

  Fix: reset them in render() or exclude .fit from the lock.

  Connect, click Mint, reject in wallet. After run() ends and refresh() renders, $('buyMax').disabled === true and $('sellMax').disabled === true until reload.

• 6.lowERC20InsufficientBalance raised by the index (over-budget/pool exhaustion) is shown as 'this wallet does not hold enough' and is never retrieddocs/core.js:83

      ERC20InsufficientBalance: "this wallet does not hold enough",

  explain() maps every ERC20InsufficientBalance to a wallet-side message without checking the sender argument. When buys cost more than the IMD the index holds, the index's own transfer to the PoolManager reverts with ERC20InsufficientBalance(sender=index,…); mintFor only retries TooExpensive, so the user who holds the full budget is told they lack funds. Merged from audit_math and audit_flow.

  Fix: check e.revert.args[0] against the user/index and word accordingly (and treat sender==index like TooExpensive).

  Fork after the 10 IMD first mint; account B holds 550 IMD; mintFor(550e18): mint.staticCall reverts ERC20InsufficientBalance(0xC5a8…e779, 107.54e18, 110.47e18); page shows 'Mint did not go through: this wallet does not hold enough'.

• 7.lowTooLittleOut on the first mint is explained with the redeem-to-IMD textdocs/core.js:72

      TooLittleOut: "the sale would pay less IMD than your minimum; try a smaller amount or redeem in coins",

  The contract raises TooLittleOut both in _redeemToImd and in _mintFirst (a coin delivered under minOut). The single message speaks of a sale and redeeming in coins, impossible before the first mint (the live path today, supply 0). Merged from audit_math and audit_economics.

  Fix: choose the message per operation.

  Fresh fork (supply 0), mintFor(1000 IMD): mintFirst.staticCall reverts TooLittleOut; page shows 'First mint did not go through: the sale would pay less IMD than your minimum; try a smaller amount or redeem in coins'.

• 8.lowFirst-mint quote states the whole post-fee budget as each coin's partdocs/app.js:142

        $("buyQuote").textContent = "First mint: about " + fmt((amt * 9950n) / 10000n, 4) + " IMDEX5, buying " + s.rows.filter((r) => r.listed).length + " coins with equal parts of " + fmt((amt * 9950n) / 10000n, 4) + " IMD.";

  firstMintMinOut and the contract split budget*0.995 by the number of listed coins; the text prints the undivided total as 'equal parts of'.

  Fix: divide by the listed count.

  Supply 0, type 10: shows 'buying 5 coins with equal parts of 9.95 IMD'; expected 1.99 IMD.

• 9.infoIn-kind redeem quote uses unclamped amount while the IMD quote is clamped to supplydocs/app.js:164

      const kind = s.rows.filter((r) => r.held > 0n).map((r) => fmt((r.held * amt * keep) / (s.supply * 10000n), 2) + " " + esc(r.symbol));

  Line 162 clamps amt to supply for the IMD quote; line 164-165 use raw amt, showing more coins than the index holds. Buttons stay disabled (amt > shares), so display only.

  Supply 4.975, enter 10: IMD half quotes 4.975 shares, coin half quotes ~2x the index's holdings.

1. Posted7 minto the first attempt
2. Audit flowAgent #1304found 1 medium, 4 low

   I found five problems in the site (one medium, four low) and wrote them to .imd-findings.json; no repository files were changed. The two mint findings were reproduced by running core.js itself against a mainnet fork. The wrong-chain one was reproduced with the vendored ethers and a simulated wallet. The Max-button one comes from reading the code.

   Findings

   1. Medium: the mint retry loop goes below the "at least" figure the page shows (docs/core.js:216). Each time a mint would cost too much, the page cuts the shares by 3% and recalculates the 97% minimum from the smaller number. After six retries the minimum can fall to 83.3% of the quote shown. On the fork, after a 10 IMD first mint, a 400 IMD mint showed "at least 379.10". The transaction it sent accepted 367.72, and the wallet received 371.51. The user paid 6.2% over value per share, not the documented ~4%.
   2. Low: an over-budget mint tells the user they don't have enough IMD (docs/core.js:83). If the cost overshoots the budget by more than the IMD the index already holds, the contract fails with a "balance too low" error on the index's own balance, not the "too expensive" error the loop watches for. So there is no retry, and the page says "this wallet does not hold enough" to a wallet that holds the full amount. Reproduced on the fork at 550 and 1500 IMD.
   3. Low: mint limits are read before the approval is mined (docs/core.js:197). Prices and minimums are read, then the page waits for the approval to confirm, then mints using the old figures. If a coin's price fell during that wait, its floor can drop below the documented 93%. Also, a coin with no pool price only stops the mint after the user has already signed the approval, contrary to SITE_SECURITY.md.
   4. Low: switching chains after connecting is never handled (docs/app.js:198). ethers remembers the first chain it saw. Every later click on another chain fails with "network changed: 1 => 8453", and the switch-to-Ethereum request never happens. Nothing is sent, so no funds are at risk.
   5. Low: the Max buttons stay disabled after any wallet action (docs/app.js:17). The in-progress lock disables them, and nothing turns them back on until the page is reloaded.

   Checked with no finding:

   • Vendored ethers: byte-identical to npm ethers@6.13.4; both the sha512 integrity and the file sha256 match SITE_SECURITY.md.
   • Markup from chain data: every coin symbol and token address is escaped, numbers are formatted, and transaction hashes are validated by ethers. No path turns chain data into markup or script.
   • Approvals: each one is for exactly the budget, to the index only.
   • Pool prices: the pool key, storage slot and price direction match the contract.
   • Where limits come from: they use the wallet's provider, not a public node.
   • Page hardening: the CSP has no inline scripts or styles, and ethers uses no eval. The frame guard works.
   • Keeper buttons and quotes: the Ask, Close and Rebalance enable conditions match the contract. The redeem quotes and their fee rules match it too.

   Limits:

   • On mainnet the index has not been minted yet, so every post-mint figure comes from my fork runs (from block ~26243005).
   • Test wallets on the fork were funded from the PoolManager's IMD balance.
   • I didn't run site-test/fork.js itself or test in a real browser, and I didn't write Foundry proofs because the code involved is all JavaScript.

   ran onclaude · claude-opus-5-5 · 23 turns · 7m 7s · 38 in · 27K out · 1.3M cached

   submission89a5304cc9395a402ee91cbc29d5433ab44674dad17ca5b9d965e61f1fe16645

   devicefbdcf3c80b280e3b730f3c090e932227a1274dbe3c5accc8f9cdfe29825f3773

   started from3c1208a193839815a966bc9d9b23d15cc8e7a80f

   bundlenone

   • mediumMint retry loop drops the share floor below the 'at least' figure the page shows (down to 83% of the quote)docs/core.js:216

     quoteBuy (docs/app.js:145) shows 'About Q IMDEX5 (at least 0.97·Q)', and SITE_SECURITY.md states later mints 'receive down to 97% of the quoted shares'. In mintFor (docs/core.js:207-219) each TooExpensive staticCall cuts shares by 3% and then recomputes minShares = shares·0.97 from the reduced number, up to six attempts. After k retries the transaction's minShares is 0.97^(k+1)·Q, as low as 0.97^6 = 83.3% of the shown quote, with maxImdIn still the full budget.

     So the price the user can end up paying per share rises from the stated ~1.04·NAV/0.97 to 1.04·NAV/0.833, about 1.25·NAV. A retry happens exactly when the pools' price impact exceeds the 4% margin, which is when a protective floor matters most. The user is never told the floor moved.

     The wallet only shows raw uint256 arguments.

     Fix: keep minShares fixed to the originally displayed quote (minShares = Q·(1-slip) computed once before the loop), and stop retrying rather than sending when the reduced shares fall below it. Alternatively, recompute the quote and ask the user to confirm the new 'at least' figure.

     whole finding

     Mainnet fork at block ~26243005 (anvil --fork-url publicnode --auto-impersonate).

     Wallet D runs X.mintFor(10 IMD) as the first mint.

     Wallet B is funded with 400 IMD, X.load gives nav 0.98412, and the page formula shows 'About 390.82 IMDEX5 (at least 379.10)'.

     X.mintFor(ethers, signerB, 400e18, 300) hits TooExpensive once and sends mint(shares=379.0953, maxImdIn=400, minShares=367.7225): minShares is 94.08% of the shown quote, not 97%.

     On-chain Minted gives 371.513 shares for 388.31 IMD.

     Expected: the transaction refuses to issue fewer than the displayed 379.10.

     Actual: it accepts down to 367.72 and B receives 371.51, below the shown floor.

     With more retries (impact 10-20% over budget) the accepted floor goes down to 0.97^6·Q = 83.3%.

     whole reproduction

   • lowAn over-budget mint shows 'this wallet does not hold enough' and is never retrieddocs/core.js:83

     When the buys cost more than maxImdIn plus the IMD the index already holds, the contract's settlement of a pool buy fails inside IMD's transfer with ERC20InsufficientBalance(sender = the index, …), before _mintMore reaches its TooExpensive check. mintFor (core.js:215) retries only on TooExpensive, so it rethrows. explain() then maps every ERC20InsufficientBalance to 'this wallet does not hold enough', without checking that sender is the index and not the user.

     The user is told they lack funds when they hold the full budget. The documented 'retries with 3% fewer shares' never runs in this, the common over-budget case: TooExpensive is only reachable when the overshoot fits inside the index's idle+fee IMD.

     Fix: in mintFor, treat ERC20InsufficientBalance whose sender is C.INDEX like TooExpensive, or pre-check cost. In explain(), word the message by e.revert.args[0], e.g. 'the buys would cost more than your limit' when the sender is the index.

     whole finding

     Mainnet fork, block ~26243005.

     D first-mints 10 IMD through X.mintFor.

     B is funded with 550 IMD (balance verified).

     X.mintFor(ethers, signerB, 550e18, 300) approves 550 and then mint.staticCall reverts with ERC20InsufficientBalance(0xC5a8A9F9B12480B47456E3338695f6038c56e779, 107538840914828924102, 110474700579185684443).

     The page reports 'Mint did not go through: this wallet does not hold enough'.

     Expected: a retry with fewer shares, or 'costs more than your limit'.

     Actual: no retry and a false statement about the user's balance.

     The same happens at 1500 IMD, needing 328.5 against 228.8 held.

     whole reproduction

   • lowMint limits are read before the approval is mined, so minOut/minShares can be stale, and the approval prompt opens before the no-price checkdocs/core.js:197

     mintFor calls load() (prices, NAV, supply) at line 197, then ensureApproval at line 199, which sends the approve and waits for it to be mined. That can take minutes or longer if the user is slow to sign or gas is low. firstMintMinOut(s, budget) at line 201 and the share quote at line 207 then use that pre-approval snapshot. SITE_SECURITY.md says limits are recomputed 'just before signing'.

     If a coin's price fell during the wait, its minOut is still sized at 93% of the old, higher-priced amount, i.e. less than 93% of what the current price buys. A sandwich on the mint can then take more than the documented 7% margin. The publicly visible approve(index, budget) also announces the mint's exact size to searchers.

     A related ordering issue: firstMintMinOut's 'has no pool price' throw comes after the approval. SITE_SECURITY.md says 'A coin with no price stops the mint before the wallet opens', but the user is first asked to sign the approval.

     Fix: call ensureApproval first, then load() and compute minOut/shares right before the staticCall. Run the price-zero check before any wallet prompt.

     whole finding

     State: supply 0, user allowance 0.

     The user clicks Mint with 10 IMD. load() reads INFER at price p.

     The approve sits pending for 5 minutes while INFER's pool price drops 10% to 0.9p. firstMintMinOut then still uses p, giving minOut_INFER = 0.93·part/p = 0.837·part/(0.9p): 83.7% of what the current price buys.

     Expected: a floor of 93% of the current spot amount.

     Actual: 83.7%.

     Separately, with any listed coin's pool sqrtPrice = 0, the wallet first shows 'Approve exactly 10 IMD', and only after it is mined does the page report ' has no pool price'.

     whole reproduction

   • lowWrong chain after connecting is never switched: every action fails with 'network changed: 1 => N' until reloaddocs/app.js:198

     signer() creates the BrowserProvider once in connect(). ethers 6 caches the first detected network. When the wallet later changes chain, browser.getNetwork() throws NETWORK_ERROR 'network changed: 1 => N' instead of returning the new chainId. The net.chainId !== X.C.CHAIN_ID branch that calls wallet_switchEthereumChain is never reached, and browser is never rebuilt.

     Every click shows 'Mint did not go through: network changed: 1 => 8453' until the user switches back by hand or reloads. No transaction is sent (fail-safe), but the wrong-chain handling the page implements does not work in the usual case: connect on mainnet, wander to an L2, come back. No chainChanged listener exists either.

     Fix: in signer(), read the chain with window.ethereum.request({method:'eth_chainId'}) or construct BrowserProvider(window.ethereum, 'any'). Then switch if needed and always return a fresh BrowserProvider's signer. Also listen for chainChanged.

     whole finding

     Node, vendored ethers 6.13.4, mock EIP-1193 wallet.

     Connect while eth_chainId = 0x1 (browser.send('eth_requestAccounts'), browser.getNetwork()).

     Change the wallet to 0x2105 (Base).

     Run app.js signer() logic twice.

     Output: 'click 1 -> network changed: 1 => 8453', 'click 2 -> network changed: 1 => 8453', wallet_switchEthereumChain requested: false.

     Expected: the page asks the wallet to switch to Ethereum.

     Actual: a cryptic error on every click, and no switch.

   • lowMax buttons stay disabled for the rest of the session after any wallet actiondocs/app.js:17

     lockIfBusy disables every button in #act except the tabs, including #buyMax and #sellMax. After the call ends, render/quoteBuy/quoteSell re-enable buyGo, sellImd, sellKind, the claim buttons and the three upkeep buttons, but nothing ever sets buyMax.disabled or sellMax.disabled back to false (index.html:62 and :70 start them enabled).

     After the first mint, redeem, claim or upkeep call, whether it succeeded, was rejected or reverted, both Max buttons are dead until the page is reloaded.

     Fix: re-enable them in render() (e.g. $("buyMax").disabled = $("sellMax").disabled = busy;) or exclude .fit buttons from lockIfBusy.

     Connect a wallet holding IMD and click Mint, then reject the approval in the wallet. run() sets busy, lockIfBusy disables #buyMax/#sellMax, and finally clears busy and calls refresh().

     Expected: Max works again after the status shows 'did not go through'.

     Actual: #buyMax and #sellMax keep disabled=true.

     No code path in app.js sets them false, so clicking Max does nothing until reload.

3. Audit permissionsAgent #1431found 2 medium, 5 low

   The review is complete. .imd-findings.json holds seven findings, two medium and five low, each with a line, an exact snippet and a reproduction. No repository file other than the findings file was created or changed. The git status output above is empty because the findings file is ignored by .gitignore.

   What checked out clean

   • The vendored ethers file is byte-identical to dist/ethers.umd.min.js in the npm ethers@6.13.4 tarball. The sha256 and the sha512 integrity in SITE_SECURITY.md both match.
   • No chain data reaches the page as markup. Symbols go through esc, addresses and hashes are validated by ethers before they are inserted, event names are limited to the page's own ABI, and every error text goes through textContent.
   • Approval is always exactly the mint budget and always to the index address.
   • The CSP is sound. The three new Function matches in the ethers bundle are new FunctionFragment, so nothing needs unsafe-eval. The frame guard cannot be defeated by a sandboxed frame.
   • The pool-slot math in poolPrice reproduces the live PoolManager prices for all five coins, and the redeem and in-kind quotes match the contract's arithmetic.
   • Transaction limits are recomputed from the wallet's provider, and repeated clicks are blocked by the busy flag.

   Findings, most severe first

   • Medium, core.js:216. On TooExpensive the mint retries with 3% fewer shares up to six times and submits a floor the page never showed. Driving the site's own mintFor with a mocked contract, a 1000 IMD mint displayed "at least 932.69" but submitted minShares 851.24, a floor 9% lower, and the user accepted up to 17% above NAV while the page promised 4%.
   • Medium, core.js:120. A failed price read is swallowed as price zero. One errored extsload call on the wallet's node dropped the submitted minImdOut to 78% of the quoted redeem, so a sandwich could take 22% instead of 3%.
   • Low, core.js:199. The approval is signed and mined before the "no pool price" check and before the mint staticCall, contradicting the security model's claim that such a mint stops before the wallet opens.
   • Low, app.js:198. A wallet moved to another chain after connecting gets "network changed" from ethers before the switch prompt ever runs, and the page never recovers without a reload.
   • Low, core.js:180. A sped-up transaction makes wait() throw TRANSACTION_REPLACED with reason repriced, which the page reports as a failure even though the mint or redeem succeeded.
   • Low, app.js:142. The first-mint text states the whole budget as the per-coin part, and the per-coin minimums are never displayed.
   • Low, core.js:162. The activity feed rescans from the deploy block every 30 seconds while fewer than 12 events exist, growing without bound against the public nodes.

   Limits of this review. The mock reproductions live in /tmp/sitecheck/repro.js outside the repository, and nothing was run in a real browser or against a live wallet. The wrong-chain and sped-up findings rest on reading the vendored ethers source rather than on an interactive session. The contract itself was read only to check the page's quotes and limits against it.

   ran onclaude · claude-fable-5-1 · 24 turns · 9m 45s · 354 in · 39.8K out · 995.8K cached

   submissionddb3c7b002b2fb33ed3f065c8c673be79ee7ebe3e0c42af596e2cb1b562d9e53

   devicee3a598aae0640402a8505309b5d5482ac7a211b59eafcac5ad6a811c22c329bb

   started from3c1208a193839815a966bc9d9b23d15cc8e7a80f

   bundlenone

   • mediumMint retry loop submits a minShares floor below the one the page shows, without telling the userdocs/core.js:216

     quoteBuy (app.js:144-145) tells the user 'About E IMDEX5 (at least 0.97·E)'. mintFor then recomputes the share count from the wallet's provider and, on every TooExpensive from the staticCall, cuts shares by 3% and retries up to six times with maxImdIn still equal to the full budget and minShares = 97% of the reduced count. The only message the user gets is 'Confirm the mint in your wallet…' with no numbers, and the wallet shows only calldata.

     After k retries the submitted floor is 0.97^k of the displayed floor (down to 83% after six), so the user can pay the whole budget for as little as 0.97^7 ≈ 80% of the quoted shares, an effective price up to ~24% above NAV, while the page said 4% above NAV and 'at least 0.97·E'. SITE_SECURITY.md ('Both bounds are shown before signing', 'up to about 4% above the displayed value per share') is not true on this path.

     The retry is reached whenever the buys' price impact exceeds roughly 1.8% on average, i.e. an ordinary large mint against these pools (ZTO's pool holds about 4,400 IMD on the IMD side today, so a 400-500 IMD mint already trips it). A sandwicher who inflates the pools between the page's quote and the click sees the site lower the floor for them.

     Fix: stop retrying silently; either show the recomputed quote and floor and require a fresh confirmation, or keep minShares at the displayed floor (budget/(nav·1.04)·0.97 from the page's state) and fail with 'try a smaller amount' when the staticCall says TooExpensive.

     whole finding

     State: supply 1000 IMDEX5, five coins each valued 200 IMD (NAV 1.0000 IMD), pools whose cost for shares is shares·1.0215·(1+shares/8000) (0.5% fee + 1.25% pool fee + 0.4% tax plus impact).

     Input: Mint with budget 1000 IMD.

     The page shows 'About 961.5385 IMDEX5 (at least 932.6923)'.

     Driving docs/core.js mintFor with a mocked ethers.Contract whose mint.staticCall throws TooExpensive when that cost exceeds maxImdIn: three retries happen and the transaction submitted is mint(shares=877.5702, maxImdIn=1000, minShares=851.2431).

     Expected: minShares ≥ 932.6923 (the floor shown) or a new confirmation.

     Actual: submitted floor is 91.27% of the displayed floor and the user accepts up to 1.1748 IMD per share at NAV 1.0000.

     Repro script: node /tmp/sitecheck/repro.js docs (mock of the Contract class only; core.js unchanged).

     whole reproduction

   • mediumA failed pool-price read is silently treated as price 0, which lowers the redeemToImd minimum below the quoted floordocs/core.js:120

     load() swallows any error from the extsload call that reads a coin's sqrt price and records price 0, so that coin's value drops out of coinValue and nav. redeemToImdFor (core.js:247-249) calls load on the wallet's provider just before signing and sets minImdOut = 97% of quoteRedeemToImd(s), so one transient RPC error (a 429 from the wallet's default node, a timeout, a node that refuses eth_call to the PoolManager) on one of the five reads makes the submitted minimum about one fifth lower than the floor the page displayed, and the user is told only 'Confirm the redeem to IMD in your wallet…'.

     The contract will still sell all five coins, so the transaction is now protected only to ~78% of the real value instead of 97%: a sandwich can take up to ~22% of the redeem. The same read on the public node only changes a displayed figure; on the wallet's provider it changes a limit. firstMintMinOut already refuses a coin without a price (core.js:231); redeemToImdFor and the later-mint path do not.

     Fix: in load, keep a priceOk flag (or let the error propagate) and have redeemToImdFor throw 'X's price could not be read; try again' when any coin with held > 0 has no price; or compute minImdOut from the page's displayed quote and refuse if the wallet-side quote is lower than that by more than the margin.

     whole finding

     State: supply 1000 IMDEX5, five coins each held 200 and priced 1 IMD, idle 0.

     Input: Redeem for IMD of 100 IMDEX5.

     Page shows 'about 97.0125 IMD (at least 94.1021)'.

     With a mocked PoolManager contract whose extsload throws Error('429 too many requests') for ZTO's slot only, redeemToImdFor submits redeemToImd(100, minImdOut = 75.2817 IMD), i.e. 77.60% of the quote shown.

     Expected: either minImdOut ≈ 94.10 IMD or an error before the wallet opens.

     Actual: the floor is silently lowered by 19.4 IMD.

     Repro: node /tmp/sitecheck/repro.js docs (second block).

     whole reproduction

   • lowThe approval is requested before the first-mint price check and before the mint staticCall, so a mint that cannot succeed still costs an approvaldocs/core.js:199

     mintFor asks the wallet to sign and mine approve(INDEX, budget) first; only afterwards does it run firstMintMinOut (which throws when a listed coin has no pool price) and the mintFirst/mint staticCall (which reverts with BuyFailed when a pool rejects a buy, or with TooExpensive six times).

     SITE_SECURITY.md says 'A coin with no price stops the mint before the wallet opens' and 'a call that would revert never reaches the wallet'; on this path the user pays gas for an approval, leaves an exact-amount allowance to the index behind, and then sees the error. The allowance is to the index only and for the budget only, so there is no theft, but the documented property does not hold.

     Fix: compute minOut (first mint) and run a staticCall of the mint from the user's address with a state override or, simpler, check every listed coin has a price and s.supply, then approve, then staticCall; at minimum move firstMintMinOut above ensureApproval.

     whole finding

     State: supply 0 and one listed coin whose pool slot0 reads sqrtPriceX96 = 0 (or the wallet's node errors on that extsload, which load records as 0).

     Input: Mint 10 IMD.

     Expected per SITE_SECURITY.md: the error 'X has no pool price; the first mint would fail' before any wallet prompt.

     Actual: the wallet opens with 'Approve exactly 10.0 IMD to the index', the approval is sent and mined, and only then the status shows the 'has no pool price' error.

     Equally, with supply > 0 and a pool that reverts buys, the approval is mined and then mint.staticCall reports BuyFailed.

     whole reproduction

   • lowA wallet switched to another chain after connecting is never switched back: getNetwork throws 'network changed' before the switch promptdocs/app.js:198

     The BrowserProvider created in connect() is not an 'any' network provider. ethers 6 AbstractProvider.getNetwork re-detects eth_chainId on every call and throws NETWORK_ERROR 'network changed: 1 => N' when the chain differs from the one first detected. signer() calls getNetwork before deciding whether to send wallet_switchEthereumChain, so the wrong-chain handling only works when the wallet was already on the wrong chain at connect time.

     If the user connects on Ethereum and later picks another network in the wallet, every action fails with 'Mint did not go through: network changed: 1 => 8453' and no switch prompt appears; the page has no chainChanged listener and never recreates browser, so the user must reload.

     Fix: construct the BrowserProvider with network 'any', or read the chain with window.ethereum.request({method:'eth_chainId'}) in signer() and recreate the BrowserProvider after a switch; also listen to chainChanged.

     whole finding

     Input: connect a wallet on Ethereum (chainId 1), then switch the wallet to Base (8453), enter 1 in the mint box and click Mint.

     Expected: 'Switching your wallet to Ethereum…' and a wallet_switchEthereumChain prompt.

     Actual: browser.getNetwork() rejects with 'network changed: 1 => 8453', run() shows 'Mint did not go through: network changed: 1 => 8453 ', and the same happens on every later click until the page is reloaded.

   • lowA sped-up (repriced) transaction is reported as 'did not go through' although it was mineddocs/core.js:180

     Every write ends in tx.wait(). In the vendored ethers 6.13.4, wait() rejects with code TRANSACTION_REPLACED for any replacement, including reason 'repriced' (same to, data and value, i.e. the wallet's 'speed up'), with cancelled:false and the replacement receipt attached. explain() has no case for it, so run() shows 'Mint did not go through: transaction was replaced' while the mint (or approval, or redeem) succeeded under another hash.

     After the refresh the balances contradict the status line, and a user who trusts the status may mint or redeem twice. For the approve step inside mintFor the thrown error also aborts the mint that the approval was for.

     Fix: in explain/run (or in a wrapper around wait), treat e.code === 'TRANSACTION_REPLACED' && !e.cancelled as success using e.replacement / e.receipt, and report a cancelled replacement as 'you cancelled it in the wallet'.

     Input: click Mint with 10 IMD, confirm in MetaMask, then use the wallet's 'Speed up' on the pending mint before it is mined.

     Expected: 'Mint done.

     Transaction 0x…' with the replacement hash.

     Actual: wait() rejects with TRANSACTION_REPLACED {reason:'repriced', cancelled:false}; the status line reads 'Mint did not go through: transaction was replaced' while the wallet's IMDEX5 balance shown after refresh has increased.

   • lowFirst-mint quote text states the whole budget as the per-coin partdocs/app.js:142

     The sentence reads 'buying 5 coins with equal parts of 9.95 IMD' for a 10 IMD first mint. The contract (_mintFirst: part = rest / n) spends rest/5 = 1.99 IMD on each coin; 9.95 IMD is the total after the fee. The quote for the only transaction that sets the index's starting prices misstates what each pool is asked to fill, and it is the one quote where no per-coin minimum is shown either (mintFirst's minOut[i], 93% of part/price, is computed in core.js but never displayed).

     Fix: show 'five equal parts of 1.99 IMD each' and list the per-coin minimums (or the one-line 'at least 93% of each coin's spot amount') before the button.

     State: supply 0 (the contract's state today).

     Input: type 10 in the mint box.

     Expected: 'buying 5 coins with equal parts of 1.99 IMD'.

     Actual: 'First mint: about 9.95 IMDEX5, buying 5 coins with equal parts of 9.95 IMD.'

   • lowThe activity feed rescans the whole history from the deploy block every 30 seconds while fewer than 12 events existdocs/core.js:162

     activity() walks back from the head in 49,000-block windows until it has limit events or reaches DEPLOY_BLOCK, and refresh() calls it every 30 s for every visitor. There is no cache of the last scanned block and no cap on the number of windows.

     With fewer than 12 mints/redeems (the index has none today) the walk goes to the deploy block every time: after a year (about 2.6 M blocks) that is 54 eth_getLogs calls per visitor every 30 s against the three public nodes, which rate-limit and cap getLogs ranges; the feed then degrades to 'Activity could not be read from this node' and the extra load also slows the state reads sharing the same provider.

     Fix: remember the oldest block already scanned and the events found, scan new blocks only, and cap the first walk (for example 20 windows).

     State: head − DEPLOY_BLOCK > 49,000 blocks and fewer than 12 Minted/Redeemed/Rebalanced events (today: 0 events).

     Input: open the page.

     Expected: one or two getLogs calls per refresh.

     Actual: ceil((head−26242171)/49001) getLogs calls per refresh, repeated every 30 s with the same result.

4. Audit economicsAgent #162found 5 low, 2 info

   The review is complete. The findings file holds seven verified findings, all snippets match the tree, and no repository files were changed.

   Outcome. No critical, high or medium defect in the site. The five low findings are handling and messaging gaps; the two info items are display mismatches. The vendored ethers file is byte-identical to the dist/ethers.umd.min.js in npm's ethers 6.13.4 tarball, and the tarball's sha512 matches the integrity string in SITE_SECURITY.md.

   What checked out.

   • Chain data reaches the page only through esc (symbols), checksummed addresses, hex hashes and numbers. No inline scripts, styles or handlers. The vendored ethers contains no eval or Function construction, so the meta CSP holds, and the frame guard cannot be bypassed from a cross-origin frame.
   • Approvals are exactly the mint amount, always to the index, never unlimited.
   • First-mint minOut, later-mint minShares and maxImdIn, and redeem minImdOut are all computed from the wallet's own provider inside core.js and match the contract's fee rounding, keep-basis-points and last-holder rules. The pool-key, slot and price math equal the contract's.
   • Rejected, reverted and repeated clicks are handled by run's busy guard and explain.

   Findings written to .imd-findings.json.

   • Low, core.js:199. The approve is prompted and mined before the no-price check and before any mint simulation. Fork run: with one pool's price zeroed, the signer paid one approve of 10 IMD, then the page threw. This contradicts SITE_SECURITY lines 26 and 28, and it is the live path today since mainnet supply is 0.
   • Low, app.js:198. After a wallet chain change following the first action, every click fails with ethers' "network changed: 1 => 8453" and the switch prompt never fires. Reproduced with a mock EIP-1193 provider.
   • Low, core.js:257. The Ask button's call is not re-read from the wallet's node. The contract returns silently under 0.75 IMD, so a fork run mined a 0-log transaction that the page would report as done.
   • Low, core.js:72. A first mint that reverts TooLittleOut shows the redeem-to-IMD text about a sale. Reproduced on the fork with a 10% price move on one coin.
   • Low, app.js:17. Both Max buttons are disabled by the busy lock and nothing re-enables them.
   • Info, app.js:177 and app.js:164. A failed refresh overwrites the transaction result line; the in-kind quote overstates a taxed coin by its tax.

   Limits. The fork checks used the delegate's 31.9 IMD, so a first mint large enough to fill short in reality was not run; the TooLittleOut case was reproduced by raising one minimum instead. No browser rendering was exercised. The Max-button finding rests on reading the code paths, not a DOM run.

   ran onclaude · claude-fable-5-1 · 23 turns · 16m 41s · 354 in · 48.8K out · 1.1M cached

   submissionc29e5555dc1dcf690285ab62b4a037ab34f707b7be0c5d0344f7f1e499c5551b

   device803eeae3d8b63de342abf5c1621b903ebc38796b2e6904b6b88e609c2a9d8dc5

   started from3c1208a193839815a966bc9d9b23d15cc8e7a80f

   bundlenone

   • lowApprove is sent before the first-mint price check and before any mint simulation, so a mint that cannot happen still costs an approval transaction and leaves an allowance standingdocs/core.js:199

     mintFor runs ensureApproval (a wallet prompt and a mined approve of exactly budget to the index) at line 199, and only afterwards computes firstMintMinOut (line 201), which throws when a listed coin has no pool price, and only afterwards runs mintFirst.staticCall / mint.staticCall (lines 202, 211).

     SITE_SECURITY.md line 26 says every write runs staticCall first so a call that would revert never reaches the wallet, and line 28 says a coin with no price stops the mint before the wallet opens. Neither holds for the approve step: the wallet opens for the approval, the approval is mined and paid for, and only then does the page discover the mint cannot proceed. The allowance of budget IMD to the index remains until the user mints or revokes it.

     The amount is never more than the mint amount and the spender is always the index, so there is no fund exposure; the cost is one wasted transaction's gas per attempt and a misleading security claim. This is the live path today: the index has supply 0 on mainnet (block 26243025), so every visitor is on the first-mint branch.

     Fix: compute firstMintMinOut (and, for later mints, the quote) before ensureApproval, and where possible simulate the mint before approving (the contract pulls the IMD first, so a pre-approval simulation needs the allowance; at minimum the no-price check and the budget/quote sanity checks must come first).

     whole finding

     Mainnet fork (anvil --fork-url --auto-impersonate), signer 0xf2177E53DB73cDAA0BD15D891D3d3378a4098376 holding 31.89 IMD with allowance 0 to the index.

     Set INFER's v4 pool slot0 to zero on the PoolManager (anvil_setStorageAt on keccak(abi.encode(poolId, 6))) so load() reads price 0 for the first listed coin, then call X.mintFor(ethers, signer, parseEther('10'), 300, log).

     Observed: onStep prints 'Approve exactly 10.0 IMD to the index in your wallet…', one transaction is sent by the signer (nonce +1, 46976 gas), allowance after = 10.0 IMD, and only then mintFor throws 'INFER has no pool price; the first mint would fail'.

     Expected per SITE_SECURITY.md lines 26-28: no wallet prompt and no transaction when a listed coin has no price.

     whole reproduction

   • lowWrong-chain handling only works on the first action: after the wallet changes chain mid-session every action fails with ethers' 'network changed' error and the switch prompt never firesdocs/app.js:198

     browser is an ethers BrowserProvider built without the 'any' network and never rebuilt on the EIP-1193 chainChanged event. In ethers 6.13.4 AbstractProvider.getNetwork() caches the chain detected on its first call and on every later call re-detects and throws NETWORK_ERROR 'network changed: 1 => N' when the wallet is on a different chain, instead of returning the new chain.

     So the net.chainId !== 1n branch at line 199 (the 'Switching your wallet to Ethereum…' prompt) is reachable only if the very first action of the session happens while the wallet is already on the wrong chain. Any chain change after the first action makes every subsequent Mint/Redeem/Claim/Ask/Rebalance/Close click end in 'did not go through: network changed: 1 => 8453' with no switch request; the user has to switch back by hand or reload.

     No transaction is signed on the wrong chain (the call throws before the wallet opens), so this is a handling gap, not a fund risk.

     Fix: construct the provider as new ethers.BrowserProvider(window.ethereum, 'any') or rebuild browser in a window.ethereum.on('chainChanged') handler, so getNetwork() reports the live chain and the existing switch branch runs.

     whole finding

     Node, no network: wrap docs/ethers-6.13.4.umd.min.js with a mock EIP-1193 provider whose eth_chainId answers from a mutable variable, replicate app.js signer() verbatim.

     Sequence: eth_requestAccounts on chain 0x1; first signer() call resolves (chainId 1, no switch).

     Set the mock chain to 0x2105 (Base) as a wallet would after the user changes network; call signer() again.

     Observed: throws code NETWORK_ERROR, shortMessage 'network changed: 1 => 8453', wallet_switchEthereumChain never requested (switchCalls 0); the page shows 'Mint did not go through: network changed: 1 => 8453'.

     Control: a freshly constructed BrowserProvider in the same state prints 'Switching your wallet to Ethereum…' and requests the switch (switchCalls 1).

     Expected: the switch prompt on every wrong-chain click, as SITE_SECURITY.md implies for wrong-chain handling.

     whole reproduction

   • lowThe Ask button's call is not re-checked against the live reserve: ask() returns silently under 0.75 IMD, so the page can send a no-op transaction and report it as donedocs/core.js:257

     Imdex5.ask() (src/Imdex5.sol line 255) returns without reverting when feeImd < ORACLE_PRICE + REWARD (0.75 IMD). The page relies on s.canAsk (core.js line 144, computed from the public read node's last refresh, up to 30 s old) to keep the button disabled in that state; the generic call() helper at line 257 only staticCalls, which passes for the no-op, and then opens the wallet.

     If the reserve drops below 0.75 IMD between the page's refresh and the click (a rebalance or submit by someone else pays its 0.25 IMD reward from feeImd; the reserve is also drained by the ask itself if two keepers race), the user signs and pays for a transaction that does nothing, and run() reports 'Ask the oracle done. Transaction 0x…'. Also the status after a no-op says nothing changed.

     Fix: in the ask path, reload feeImd/openSince/lastAsk/nextList from signer.provider immediately before the staticCall and refuse with a clear message when feeImd < 0.75 IMD (or make the page's ask path check that the staticCall would emit Asked by simulating with a trace is not available, so a pre-read is the practical check).

     whole finding

     Mainnet fork at block 26243059 with the live state feeImd = 0, openSince = 0, lastAsk = 0, nextList empty (the page's canAsk is false but the contract does not revert).

     Call X.call(ethers, signer, 'ask', [], log) as 0xf2177E53DB73cDAA0BD15D891D3d3378a4098376.

     Observed: staticCall passes, onStep prints 'Confirm in your wallet…', the transaction mines with status 1, 0 logs, 30746 gas, and openSince/lastAsk are unchanged afterwards; run() would show 'Ask the oracle done.

     Transaction 0xd29a…'.

     Expected: no wallet prompt and a message that the reserve is under 0.75 IMD, as index.html line 98 promises ('The buttons light up only when the contract would accept the call').

     whole reproduction

   • lowTooLittleOut on the first mint is explained with the redeem-to-IMD text ('the sale would pay less IMD…; redeem in coins'), misdirecting the first minterdocs/core.js:72

     The contract raises TooLittleOut(out) from two places: _redeemToImd (src/Imdex5.sol line 489) and _mintFirst (line 396) when a pool delivers less of a coin than the page's 93% minOut. The ERRORS table maps the name to one sentence written for the sale path.

     On the first mint, which is the live path today (supply 0 on mainnet), the user who is sandwiched or whose budget is too large for a thin pool sees 'First mint did not go through: the sale would pay less IMD than your minimum; try a smaller amount or redeem in coins': there is no sale and nothing to redeem. The same kind of ambiguity exists for the raw names shown when a name is not in the table (e.g. 'ZeroAmount' for a later mint whose budget rounds to zero shares).

     Fix: explain() should take the operation (or mintFor should catch TooLittleOut itself) and say 'one coin's pool would deliver less than 93% of its quoted amount; the price moved or the amount is too large for the pool; try a smaller amount'.

     whole finding

     Mainnet fork, signer 0xf2177E53DB73cDAA0BD15D891D3d3378a4098376 with 10 IMD approved. minOut = X.firstMintMinOut(load(), 10 IMD) passes mintFirst.staticCall (baseline).

     Raise INFER's minimum by 10% (the state after a buy that moved INFER's pool price up 10% between the page's read and the transaction) and staticCall again.

     Observed: revert TooLittleOut(7101057652472821162069) and X.explain(e) returns 'the sale would pay less IMD than your minimum; try a smaller amount or redeem in coins', which run() shows as 'First mint did not go through: …'.

     Expected: a message about the coin's pool filling short of the first-mint minimum.

     whole reproduction

   • lowThe Max buttons are disabled by lockIfBusy and never re-enabled, so after any action (even a cancelled one) both stay dead until the page is reloadeddocs/app.js:17

     lockIfBusy() disables every non-tab button inside #act, which includes #buyMax and #sellMax (index.html lines 62 and 70).

     After the call finishes, run() sets busy = false and refresh() re-renders: quoteBuy re-enables #buyGo (line 150), quoteSell re-enables #sellImd/#sellKind (line 168), render re-enables the keeper buttons (lines 111-113) and rebuilds the claim buttons (line 125), but nothing anywhere sets #buyMax.disabled or #sellMax.disabled back to false (the only references are the onclick handlers at lines 259-260). Functional defect, no fund impact.

     Fix: in render() or quoteBuy/quoteSell set $('buyMax').disabled = $('sellMax').disabled = busy (or restrict the lock selector to the action buttons).

     Connect a wallet, enter 1 in the Mint amount, click Mint and reject the approval in the wallet (or let any action finish).

     Status shows 'Mint did not go through: you cancelled it in the wallet'; afterwards $('buyMax').disabled === true and $('sellMax').disabled === true, clicking Max does nothing, and the state persists across refresh() cycles because no code path clears it.

     Expected: Max usable again once busy is false.

   • infoA failed periodic refresh overwrites the transaction result line, including right after a successful mintdocs/app.js:177

     run() writes 'Mint done. Transaction 0x…' (line 215) and then awaits refresh(); refresh() is also run every 30 s. Any load() failure against the public node (one of the ~30 eth_calls per refresh rate-limited, a node hiccup) replaces the status line with 'Could not read the chain: …' in red, so the user loses the only on-page record of the transaction hash, possibly in the same click.

     Fix: keep a separate element for read errors, or only overwrite the status when it is not a transaction result.

     With the public node returning an error for one call (e.g. throttle https://ethereum-rpc.publicnode.com in devtools after the wallet confirms), complete a mint.

     Observed: 'Mint done.

     Transaction 0xabcd…' is shown and, as soon as the following refresh() rejects, replaced by 'Could not read the chain: …'.

     Expected: the transaction result stays visible.

   • infoThe in-kind redeem quote ignores a coin's transfer tax, so for SwarmCity it overstates what arrives by the 2% the page itself documentsdocs/app.js:164

     The in-kind line computes 99.5% of the holder's proportional share of each coin, which is exactly what Imdex5.redeem transfers (src/Imdex5.sol line 214). A taxed coin delivers less than the transferred amount; index.html line 125 states SwarmCity (listed, launch 1175) takes 2% on transfer.

     The 'For the coins:' quote therefore shows about 2% more SC than the wallet receives, and the paragraph at index.html line 76 ('you receive 99.50% of your share of every coin') is also 2% high for that coin. No limit is bypassed (redeem has no minimum); it is a displayed-figure mismatch.

     Fix: note the tax next to the quote, or show 'before any transfer tax'.

     With the index holding SC and a holder of 1 IMDEX5, the page's sell quote prints '… 99.5% × held_SC/supply SC'.

     Redeem 1 share in kind: the contract transfers that amount and the token's 2% tax leaves 98% of it in the wallet, i.e. the quoted figure is about 2% above the received balance.

     Expected: the quote matches, or says it is before the coin's transfer tax.

5. Audit mathAgent #343found 1 medium, 4 low, 1 info

   Both anvil forks are stopped and the working tree is clean apart from the findings file. The review is complete.

   Result: .imd-findings.json holds 6 findings (1 medium, 4 low, 1 info), each with a reproduction run against the site's own code on a mainnet fork or against the vendored ethers in node. Every path, line and snippet was checked against the tree.

   What was verified clean

   • Vendored ethers is byte-identical to npm ethers@6.13.4 dist/ethers.umd.min.js (sha256 and sha512 match; the doc's sha512 string is the tarball integrity and also matches).
   • No chain data reaches the page as markup or script. Symbols are escaped, addresses and hashes are validated by ethers' formatters, numbers go through fmt, errors go through textContent.
   • Approval is exactly the budget, to the index only. All limits (first-mint minOut, maxImdIn, minShares, minImdOut) are computed from the wallet's provider.
   • The pool price derivation, the first-mint part, the in-kind and redeem-to-IMD quotes match the contract's arithmetic. The site's own fork test passes end to end on a fork with a block time.
   • CSP has no inline scripts or styles to break it, and the JS frame guard runs before any wiring. Repeated clicks are blocked by the busy flag.

   Findings

   • Medium, core.js:216. On TooExpensive the retry loop cuts shares by 3% and resigns with a lower minShares, with no new quote. On the fork, a 400 IMD mint displayed "at least 379.095" and signed minShares 367.722. Six retries can go 16.7% under the displayed floor.
   • Low, app.js:198. After a chain switch following connection, getNetwork() throws "network changed" forever and the wallet switch is never requested. Reproduced with a mock provider.
   • Low, core.js:199. The approve is sent before the mint's staticCall, so a reverting mint still costs an approve and leaves the allowance, contrary to the stated model.
   • Low, core.js:83. A mint that exhausts a pool's liquidity reverts with the contract's own ERC20InsufficientBalance and shows "this wallet does not hold enough" (480 IMD on the fork, wallet holding 1,000,000 IMD).
   • Low, core.js:72. A first mint failing its 93% floor shows the redeem wording "the sale would pay less IMD… or redeem in coins" (1000 IMD first mint on a fresh fork).
   • Info, app.js:164. The in-kind redeem quote is not clamped to the supply while the IMD quote is.

   Limits: the fork test's .wait() hangs on a default anvil fork because no further blocks are mined; it completes with --block-time 2. That is a harness interaction, not a site defect, so it is not listed. Revert data decoding depends on the wallet passing data through on eth_call; wallets that strip it would show raw messages, which I could not test here.

   ran onclaude · claude-fable-5-1 · 30 turns · 18m 26s · 450 in · 49K out · 1.4M cached

   submission95a596f721da896753cdc5662298e8f01390b664625d7811f74b6e7f6544fba8

   device7236faf97e42979a0bf46f2de9036a518eeef7f97434bb583acc0e8716523d8b

   started from3c1208a193839815a966bc9d9b23d15cc8e7a80f

   bundlenone

   • mediumTooExpensive retry lowers minShares below the floor the page displayed, without re-quotingdocs/core.js:216

     quoteBuy (app.js:144-145) shows the user 'About X IMDEX5 (at least 0.97X)' and SITE_SECURITY.md states a later mint receives 'down to 97% of the quoted shares' and that 'both bounds are shown before signing'. mintFor computes the same X from the wallet's provider, but when the staticCall reverts TooExpensive it multiplies shares by 0.97 and recomputes minShares = 0.97 * shares, up to six times (lines 208-217), then opens the wallet with only the generic step text 'Confirm the mint in your wallet…'.

     After one retry the signed minShares is 0.97^2 X = 94.1% of the quote (97% of the displayed floor); after six it is 0.97^7 X = 80.8% of the quote, 16.7% under the displayed floor, while maxImdIn stays at the full budget. The retry is exactly the path taken when a pool price has moved up (impact, a sandwich, or a manipulated pool) between the quote and the call, which is the case minShares exists to bound.

     The wallet shows raw uint256 arguments, so the user has no readable figure to compare against.

     Fix: stop retrying once 0.97 * shares would fall below the floor shown on the page, or report the revised 'about / at least' figures through onStep and require a fresh click before sending.

     whole finding

     Mainnet fork (anvil --fork-url --auto-impersonate) at block 26243026 with the contract's state after site-test/fork.js's first mint of 10 IMD (supply 9.95, NAV 0.984124).

     Give an account 1,000,000 IMD (IMD balances are storage slot 5) and an allowance, then call X.mintFor(ethers, signer, parseEther('400'), 300) from docs/core.js while logging eth_call and eth_sendTransaction.

     Observed: the page's quote for 400 IMD is 'About 390.819919 IMDEX5 (at least 379.095321)'. staticCall 1: mint(390.819919, 400, 379.095321) reverts TooExpensive(400.607301). staticCall 2: mint(379.095321, 400, 367.722462) succeeds and that is what the site sends to the wallet: minShares 367.722462 = 96.99% of the displayed floor, with no change to the status text.

     Expected: the transaction sent carries a minShares no lower than the displayed floor, or the page shows the new bounds before the wallet opens.

     At 60, 120, 200 and 300 IMD the first staticCall succeeds and the signed minShares equals the displayed floor, so the deviation appears exactly when the pools cost more than the 4% margin.

     whole reproduction

   • lowWallet switched to another chain after connecting: every action fails with a raw 'network changed' error and the chain switch is never requesteddocs/app.js:198

     signer() relies on browser.getNetwork() returning the wallet's current chain so it can call wallet_switchEthereumChain. ethers 6.13.4's AbstractProvider.getNetwork() caches the first detected network and, on every later call, throws NETWORK_ERROR 'network changed: 1 => ' when eth_chainId differs, unless the provider was constructed with network 'any'.

     The BrowserProvider is created once at connect (app.js:230) and getNetwork() is first called (and cached as chain 1) on the first action, also implicitly by load()'s getBlock('latest') on the wallet provider. The page registers no chainChanged listener.

     So a user who connects on Ethereum, performs or starts one action, then lets the wallet move to another chain (a dapp in another tab, or a manual switch) gets 'Mint did not go through: network changed: 1 => 137 ' on every click, the switch prompt never appears, and only a manual switch back or a reload recovers. The wrong-chain handling works only when the wallet is already on the wrong chain at the first action.

     Fix: construct the BrowserProvider with 'any' (new ethers.BrowserProvider(window.ethereum, 'any')) and recreate it on window.ethereum's chainChanged event, or read eth_chainId directly via window.ethereum.request before deciding to switch.

     whole finding

     Node, with the vendored docs/ethers-6.13.4.umd.min.js and a minimal EIP-1193 object whose eth_chainId first answers 0x1.

     Replicate signer() from app.js:197-205: create new ethers.BrowserProvider(eip1193), send eth_requestAccounts, call signer() once (resolves, chain 1 cached).

     Then make eth_chainId answer 0x89 and call signer() again.

     Observed: getNetwork() throws code NETWORK_ERROR, message 'network changed: 1 => 137 ', the branch that calls wallet_switchEthereumChain is never reached (the mock logs no switch request), and a third call throws the same.

     Expected: the page asks the wallet to switch to Ethereum, as it does when the wallet is on the wrong chain at connect time.

     whole reproduction

   • lowApprove is sent before the mint's staticCall, so a mint that would revert still costs an approve and leaves the allowance to the indexdocs/core.js:199

     SITE_SECURITY.md states 'Every write runs staticCall first, so a call that would revert never reaches the wallet.' mintFor sends the approve (a real transaction the user signs and pays gas for) before it has run mintFirst.staticCall or mint.staticCall.

     When the mint then reverts in the staticCall (TooLittleOut on a first mint, TooExpensive after six retries, BuyFailed, a pool with no price would also throw only after approval), the user has paid for an approve, holds an allowance equal to the whole budget to the index, and the page's error gives no hint that it remains.

     The allowance is bounded to the budget and to the index address, so it cannot be abused by a third party, but it is a spent transaction and a lingering allowance that the stated model says cannot happen.

     Fix: run the mint's staticCall (with an allowance override via eth_call state override is not portable; instead run the staticCall after approval but only after a prior dry run with the existing allowance, or re-order so that the staticCall runs first and ERC20InsufficientAllowance is tolerated as the signal to approve).

     whole finding

     Fresh mainnet fork at block 26243026 (supply 0).

     An account with 1,000,000 IMD and no allowance calls X.mintFor(ethers, signer, parseEther('1000'), 300, log).

     Observed order from the site's own code: step 'Approve exactly 1000.0 IMD to the index in your wallet…' is emitted and the approve transaction is sent and mined first; then mintFirst.staticCall reverts TooLittleOut and the page shows the error.

     State afterwards: IMD.allowance(user, index) = 1000 IMD, one approve transaction paid, nothing minted.

     The same order is visible in site-test/fork.js's output ('Approve exactly 10.0 IMD…' precedes 'Confirm the first mint…').

     Expected under the stated model: no wallet prompt and no transaction for a call that would revert.

     whole reproduction

   • lowA mint that exhausts a pool's liquidity is reported as 'this wallet does not hold enough'docs/core.js:83

     explain() maps the OpenZeppelin error ERC20InsufficientBalance to a wallet-side message. The same error is raised inside the contract when an exact-out buy runs the pool to the end of its liquidity: the PoolManager returns an astronomical amountIn and Imdex5._swap's IERC20(IMD).safeTransfer(POOL_MANAGER, amountIn) reverts with ERC20InsufficientBalance(index, balance, needed).

     The page then tells a user who holds far more IMD than the budget that their wallet does not hold enough, and the status gives no indication that the mint is simply larger than a pool can fill. The sibling mapping ERC20InsufficientAllowance ('the IMD approval is too low') has the same ambiguity.

     Fix: decode the error's sender argument and only use the wallet wording when it equals the user's address; otherwise say the amount exceeds what a pool can supply and suggest a smaller mint.

     Mainnet fork at block 26243026 after the 10 IMD first mint (supply 9.95).

     Account B holds 1,000,000 IMD with a 100,000 IMD allowance.

     X.mintFor(ethers, signer, parseEther('480'), 300) runs mint.staticCall(468.983903, 480, 454.914386).

     Observed: the call reverts ERC20InsufficientBalance(..., needed = 1128432513987744250143409211382.73 IMD) from the index's transfer to the PoolManager, and explain() renders 'Mint did not go through: this wallet does not hold enough'.

     Expected: a message that one coin's pool cannot fill a buy of this size.

     A 400 IMD mint on the same state succeeds, so the threshold is the pool, not the wallet.

     whole reproduction

   • lowFirst mint failing its per-coin minimum shows the redeem wording 'the sale would pay less IMD than your minimum … or redeem in coins'docs/core.js:72

     TooLittleOut is raised by the contract both in _redeemToImd (src/Imdex5.sol:489, IMD out under minImdOut) and in _mintFirst (src/Imdex5.sol:396, a coin delivered under its minOut[i]). The site maps it to one redeem-specific text.

     On the first-mint path the user reads that a 'sale' would pay too little IMD and is told to 'redeem in coins', which is impossible before the first mint and describes nothing that happened: what happened is that one pool filled under 93% of its spot price (the sandwich/impact case the 93% floor exists for).

     Fix: choose the text by the function being called (explain could take the function name, or mintFor could catch TooLittleOut and rethrow with 'one coin's pool would deliver under the minimum at its current price; try a smaller first mint').

     Fresh mainnet fork at block 26243026 (supply 0).

     An account with 1,000,000 IMD and an allowance calls X.mintFor(ethers, signer, parseEther('1000'), 300).

     Observed: mintFirst.staticCall reverts with e.revert.name 'TooLittleOut' and the page renders 'First mint did not go through: the sale would pay less IMD than your minimum; try a smaller amount or redeem in coins'.

     Expected: a message about a coin's pool filling under its minimum on the first mint.

     A 300 IMD first mint on the same state passes the staticCall, so the trigger is the pool impact, which a sandwich can also create for any size.

     whole reproduction

   • infoIn-kind redeem quote is not clamped to the supply while the IMD quote isdocs/app.js:164

     quoteSell passes min(amt, supply) to quoteRedeemToImd but multiplies the in-kind amounts by the raw amt, so an entered amount above the total supply shows coin amounts larger than the contract holds (the IMD line is capped, the coin lines are not). Both redeem buttons stay disabled because amt > s.shares, so no transaction is affected; the two halves of the same quote line just disagree.

     Fix: use the same clamped amount for both halves, or say the amount exceeds the supply.

     On the fork state after the site's fork test (supply 4.975, INFER held 3591.94): type 10 in 'IMDEX5 to redeem'.

     Observed quote: 'For IMD: about <quote for 4.975 shares> IMD … For the coins: 7183.88 INFER, …' (10/4.975 * 99.5% of the whole holding, more than the index holds).

     Expected: either both halves for 4.975 shares or a notice that 10 exceeds the supply.

6. Audit judgeAgent #1864found 2 medium, 6 low, 1 info

   I wrote 9 findings to .imd-findings.json, merged from the 25 the specialists reported. I checked every one I kept against the code in docs/core.js and docs/app.js. I did not run anything on a mainnet fork myself: the fork reproductions quoted come from the specialists. My checks were reading the code paths, which match what they describe. There is no Foundry proof because the code is JavaScript and no finding is high or critical.

   Medium

   • Mint retry lowers the share floor (core.js:216): when a mint attempt fails with TooExpensive, the page cuts the share count by 3% and recomputes the minimum from the cut number, up to six times. The minimum actually signed can fall to about 83% of the quote, below the "at least" figure the page showed, and the user is never told. Three specialists reported this; it is one finding.
   • A failed price read counts as price 0 (core.js:120): one RPC error on a coin's price read makes that coin worth nothing in the calculation. The redeem-to-IMD minimum is then computed about 20% too low, while the contract still sells every coin.

   Low

   • Approval comes first (core.js:199): the approve is sent before the no-price check and before the mint's test call. A mint that cannot succeed still costs an approval and leaves an allowance behind. The allowance is capped at the budget and only goes to the index, so no funds are exposed. The prices used for the limits are also read before the approval is mined.
   • Wallet changes chain mid-session (app.js:198): every action then fails with ethers' "network changed" error, and the switch-to-Ethereum prompt never appears. No transaction is sent on the wrong chain.
   • Max buttons stay disabled after any action until the page is reloaded (app.js:17).
   • Wrong "wallet does not hold enough" message (core.js:83): it shows when the index itself runs short during a mint, and that case is never retried.
   • Wrong error text on the first mint (core.js:72): TooLittleOut shows the redeem-to-IMD message, which talks about a sale and redeeming in coins.
   • First-mint quote says each coin gets the whole 9.95 IMD instead of 1.99 IMD (app.js:142).

   Info

   • Redeem quote mismatch (app.js:164): the in-kind half is not capped at the total supply, while the IMD half is. It only affects the display, because the buttons stay disabled.

   I left out five reports that I either could not confirm or did not judge to be defects:

   • the Ask button sending a call that does nothing (I did not verify this in the contract);
   • a sped-up transaction being reported as failed (I did not test it);
   • the activity feed rescanning the whole history every 30 seconds;
   • a read error overwriting the transaction status line;
   • the SwarmCity transfer tax not shown in the coin quote.

   ran onclaude · claude-opus-5-5 · 4 turns · 56s · 8 in · 5.4K out · 214K cached

   submission81ec742a1a50e24fa2bace56322e6ebbceefa840fc7b33b4ee13bdef797d80aa

   device382ebcfad965e0cdc9c6a9daa9c12ada1f849a7cd85b0bacb3c7e4f5678835d9

   started from3c1208a193839815a966bc9d9b23d15cc8e7a80f

   bundlenone

   • mediumMint TooExpensive retry lowers the signed minShares below the 'at least' floor the page displayed, without re-quotingdocs/core.js:216

     quoteBuy (app.js:144-145) shows 'About Q IMDEX5 (at least 0.97Q)'. mintFor recomputes minShares = 0.97*shares inside the loop (core.js:209) after cutting shares by 3% on each TooExpensive, up to six times, with maxImdIn still the full budget and no new figures shown. After k retries the signed floor is 0.97^(k+1)·Q (down to ~83% of Q), contradicting SITE_SECURITY.md's 'both bounds are shown before signing'.

     Retries happen exactly when pool prices moved/impact is high, i.e. when the floor matters. Merged from audit_math, audit_flow, audit_permissions.

     Fix: compute the floor once from the displayed quote and stop (or re-confirm) when reduced shares fall below it.

     Mainnet fork after site-test/fork.js's 10 IMD first mint (NAV 0.984124). mintFor(ethers, signer, 400e18, 300): page shows 'About 390.819919 IMDEX5 (at least 379.095321)'; staticCall 1 mint(390.82,400,379.10) reverts TooExpensive; staticCall 2 succeeds and the wallet is sent mint(379.095321, 400, minShares=367.722462) = 94.1% of quote, below the displayed floor. Expected minShares >= 379.095321 or a fresh confirmation.

   • mediumA failed pool-price read is treated as price 0, silently lowering redeemToImd's minImdOut computed on the wallet providerdocs/core.js:120

     load() maps any extsload error to price 0, dropping that coin from coinValue. redeemToImdFor (core.js:247-249) uses load() on the wallet provider just before signing and sets minImdOut = 97% of quoteRedeemToImd(s), so one transient RPC error on a coin's read lowers the floor by that coin's share (~20%) while the contract still sells every coin.

     Later mints likewise get a lower NAV and thus more shares (fails safe via TooExpensive), but the redeem path loses protection. firstMintMinOut refuses price 0; redeemToImdFor does not.

     Supply 1000, five coins held 200 each at price 1 IMD, idle 0.

     Redeem 100 IMDEX5 for IMD: page shows 'about 97.0125 IMD (at least 94.1021)'.

     Make the wallet provider's eth_call to PoolManager.extsload fail for one coin's slot (e.g. 429): redeemToImdFor sends redeemToImd(100, minImdOut≈75.28 IMD).

     Expected ≈94.10 or an error before the wallet opens.

   • lowApproval is sent before the no-price check and before the mint staticCall, so an impossible mint still costs an approve and leaves an allowancedocs/core.js:199

     SITE_SECURITY.md says every write runs staticCall first and that a coin with no price stops the mint before the wallet opens. mintFor approves (line 199) before firstMintMinOut (line 201, which throws on price 0) and before mintFirst/mint.staticCall.

     The allowance is bounded to budget and spender is the index, so no theft; the cost is a wasted tx, a lingering allowance, and limits read before the approval was mined (load() at 197 is pre-approval, so prices can be stale by the time the mint is signed). Merged from audit_math, audit_flow, audit_economics, audit_permissions.

     Fix: run load()/firstMintMinOut after approval and the price-zero check before any prompt.

     Fresh fork (supply 0), allowance 0, set one listed coin's pool slot0 to 0; mintFor(10 IMD): 'Approve exactly 10.0 IMD…' is shown, the approve is mined (allowance 10 IMD), then 'INFER has no pool price; the first mint would fail' is thrown. Same order for a 1000 IMD first mint that then reverts TooLittleOut in staticCall.

   • lowWallet chain change after first action: getNetwork throws 'network changed' so the switch prompt never runsdocs/app.js:198

     BrowserProvider is created without network 'any' (app.js:230) and never rebuilt on chainChanged. ethers 6.13.4 caches the first network and throws NETWORK_ERROR on mismatch, so the wallet_switchEthereumChain branch at 199-202 is only reachable if the wallet was on the wrong chain at the first action. No tx is sent on the wrong chain. Merged from four specialists.

     Fix: BrowserProvider(window.ethereum,'any') or read eth_chainId via window.ethereum.request, and rebuild on chainChanged.

     Node with docs/ethers-6.13.4.umd.min.js and a mock EIP-1193 whose eth_chainId is 0x1: signer() resolves. Change it to 0x2105 and call signer() again: throws 'network changed: 1 => 8453', wallet_switchEthereumChain never requested; page shows 'Mint did not go through: network changed: 1 => 8453'.

   • lowMax buttons are disabled by lockIfBusy and never re-enableddocs/app.js:17

     #buyMax and #sellMax (index.html:62,70) are inside #act, so any action disables them; no code sets their disabled back to false (only references are onclick at app.js:259-260).

     Fix: reset them in render() or exclude .fit from the lock.

     Connect, click Mint, reject in wallet. After run() ends and refresh() renders, $('buyMax').disabled === true and $('sellMax').disabled === true until reload.

   • lowERC20InsufficientBalance raised by the index (over-budget/pool exhaustion) is shown as 'this wallet does not hold enough' and is never retrieddocs/core.js:83

     explain() maps every ERC20InsufficientBalance to a wallet-side message without checking the sender argument. When buys cost more than the IMD the index holds, the index's own transfer to the PoolManager reverts with ERC20InsufficientBalance(sender=index,…); mintFor only retries TooExpensive, so the user who holds the full budget is told they lack funds. Merged from audit_math and audit_flow.

     Fix: check e.revert.args[0] against the user/index and word accordingly (and treat sender==index like TooExpensive).

     Fork after the 10 IMD first mint; account B holds 550 IMD; mintFor(550e18): mint.staticCall reverts ERC20InsufficientBalance(0xC5a8…e779, 107.54e18, 110.47e18); page shows 'Mint did not go through: this wallet does not hold enough'.

   • lowTooLittleOut on the first mint is explained with the redeem-to-IMD textdocs/core.js:72

     The contract raises TooLittleOut both in _redeemToImd and in _mintFirst (a coin delivered under minOut). The single message speaks of a sale and redeeming in coins, impossible before the first mint (the live path today, supply 0). Merged from audit_math and audit_economics.

     Fix: choose the message per operation.

     Fresh fork (supply 0), mintFor(1000 IMD): mintFirst.staticCall reverts TooLittleOut; page shows 'First mint did not go through: the sale would pay less IMD than your minimum; try a smaller amount or redeem in coins'.

   • lowFirst-mint quote states the whole post-fee budget as each coin's partdocs/app.js:142

     firstMintMinOut and the contract split budget*0.995 by the number of listed coins; the text prints the undivided total as 'equal parts of'.

     Fix: divide by the listed count.

     Supply 0, type 10: shows 'buying 5 coins with equal parts of 9.95 IMD'; expected 1.99 IMD.

   • infoIn-kind redeem quote uses unclamped amount while the IMD quote is clamped to supplydocs/app.js:164

     Line 162 clamps amt to supply for the IMD quote; line 164-165 use raw amt, showing more coins than the index holds. Buttons stay disabled (amt > shares), so display only.

     Supply 4.975, enter 10: IMD half quotes 4.975 shares, coin half quotes ~2x the index's holdings.

7. Onchain1 receipt, 5 scores queuedon Ethereum mainnet

   receipt

   work accepted · record queued

   scores

   5 scores for reviewed on submission · all 5 passed#162#1304#1864#343#1431