8066bb18-bb71-4ace-a6dc-05dd589fe812IMD JOB

Saved 3 verified findings—1 medium, 2 low—to [.imd-findings.json](/home/imd-worker/.identitymd/work/8066bb18-bb71-4ace-a6dc-05dd589fe812/cafb9317-f749-48c2-967b-16e995c92bf0/.imd-findings.json). All three were reproduced with focused Foundry checks. Contracts, tests, configuration, and manifest remain unchanged.

This content was flagged for possible cybersecurity risk. If this seems wrong, try rephrasing your request. To get authorized for security work, join the Trusted Access for Cyber program: https://chatgpt.com/cyber

FAILURE: runtime_error

The work is complete. `launch.json` is written at the repository root and is the only changed file. **What the manifest declares** - `kind` is `univ4_hook`, first field. - Hook is `PvPadHook` with one constructor argument, the Sepolia PoolManager address named by the workflow. The compiled ABI confirms a single `address manager` input. - Permissions are `beforeSwap`, `afterSwap`, `beforeSwapReturnDelta`, copied from what `getHookPermissions` returns in `src/PvPadHook.sol:246`. No `beforeInitialize`, as the workflow requires. - Token is `PVP`, name "Pepe Values Pepe", symbol "PVP", 18 decimals, read from the constants in the token source. - Pool pairs native ETH (zero address) with fee 3000 and tick spacing 60, the key rehearsed in the test fixture. Initial price is the decimal sqrtPriceX96 for 1,000,000 PVP per ETH, the value used by the factory-shaped launch test. - Notes run 2978 characters and describe the source, constants, toolchain and reproduction steps. No supply, allocation, owner, chain or policy fields were added. **Checks run** - Schema validation with a Draft 2020-12 validator against the canonical schema: valid. The price is below 2^256. - `forge build` and `forge test`: 88 tests pass across 10 suites. - The two protected floor suites, run from `test/scratch` against the built creation code with the manifest's flags (200) and decimals (18), both with and without the Sepolia PoolManager etched: 9 of 9 pass. A negative control with flags 136 fails as expected, so the permission match is a real check. - The PoolManager address answers `eth_getCode` with 48 KB of hex on Sepolia through a public RPC. The operator's keyed RPC does not serve chain 11155111. - `git status` shows only the new `launch.json`. The scratch directory is not part of the deliverable.

The deliverable is complete and verified. Here is the recap. **What was built** Two contracts in `src/`, both with only compile-time economics and no admin surface beyond the epoch updater: - **PVP**: a self-contained ERC-20 (name "Pepe Values Pepe", 18 decimals). Its zero-argument constructor mints exactly 10^27 minor units to the deployer. There is no mint path, owner, pause or proxy. Holders can burn. - **PvPadHook**: one Uniswap v4 hook holding the whole PvPad economy. The constructor takes only the PoolManager. Permissions are `beforeSwap`, `afterSwap` and `beforeSwapReturnDelta` (address bits 0xC8 = 200), with no initialize, liquidity or donate permission, so the factory can call `PoolManager.initialize` itself. The hook skims 1% of the specified currency on every swap and delivers it to the King's beneficiary (ETH pushed with a 2300-gas send, ERC-20 transferred directly, and a pullable credit on any failure). If the PoolManager cannot release the fee mid-swap, the fee is held as an ERC-6909 claim that anyone can redeem. King claims start above 0.01 ETH, bump 10% per claim and go entirely to the worker pot. The updater baked in source publishes Merkle epochs, and can hand the role over in two steps. **Design decisions to be aware of** - The fee currency follows the swap shape: exact-input buys and exact-output sells pay ETH, the other two shapes pay PVP. Charging ETH on every swap would have required `afterSwapReturnDelta`, which is outside the recommended permission set, so I stayed with the BurnHook-shaped three. - Partial fills revert, so traders should use extreme price limits and enforce slippage on amounts. - The brief's shorthand `claim(beneficiary)` and `claim(epochId, ...)` became `claimKing` and `claimWorker` to avoid ABI overloads. This is documented in the README and manifest notes. **Verification results** | Check | Result | | --- | --- | | `forge build`, `forge test`, `forge fmt --check`, ABI check, Python tests via `scripts/check.sh` | pass, exit 0 | | Project tests | 88 in 10 suites, including two invariant suites at 2048 calls each with no reverts | | Protected floor suites against the built creation code (flags 200, with and without the Sepolia manager) | 9 of 9 pass | | Same suite with wrong flags (136) | fails in setUp, as expected | The launch-shaped test opens the pool from a non-pad sender, seeds PVP-only liquidity, and exercises the deferred-claim path on the first buy. **Documentation delivered** README, `docs/manifest-notes.md` (exact values for launch.json, including the single constructor argument and the three permissions), `docs/deployment.md`, `docs/keeper.md`, `docs/review-notes.md`, `docs/dependencies.json`, and the ABIs at `docs/abi/PVP.json` and `docs/abi/PvPadHook.json`. Dependencies are vendored as plain files under `lib/` with no submodules. **Left to later stages** Initial price, liquidity shape, CREATE2 deployer and salt, updater key custody, the Sepolia fork rehearsal, and the independent adversarial review are documented as open choices. Nothing was deployed and no transactions were signed. Files were left uncommitted for the harness to commit.