All five findings now anchor to lines that match the tree, the proof fails on the current code, and nothing under src/, script/, test/ (outside the disposable test/scratch/), launch.json or README.md was modified.

Review result

Scope read in full: src/OGClubBox.sol, src/OGClubFurniture.sol, src/libraries/BlockHeader.sol, src/mocks/MockOG.sol, script/Deploy.s.sol, script/encode_header.py, launch.json, README, ADAPTATION.md, the test base helper and the furniture and header test lists. forge build, forge fmt --check and forge test with the verifier seed pass. The tree runs 136 tests, not the 148 the brief states.

Not reached: the two protected probes need verifier-generated environment inputs and were not executed. The Sepolia header field order the brief mentions was not verified on chain, since no Sepolia endpoint is among the ones this task allows. The three new contracts do not exist yet, so nothing about them could be audited beyond how the kept code constrains them.

Findings written to .imd-findings.json:

• Medium, furniture proposals never lapse. activateMinter has no upper bound, so a proposal made and forgotten is a live, permissionless minting grant years later. The brief's item 4 requires lapse 7 days after maturity. Proof test under test/scratch/MinterProposalLapse.t.sol fails now with "lapsed proposal was still activatable".
• Medium, box pause switch and mutable vault. setPaused and setVault are owner controls the launch rules forbid. The box is being retired, so this is a flag for the adapter not to carry the pattern into staking, raffle or vault.
• Low, header encoder refuses current Sepolia blocks. Any block JSON carrying blockAccessListHash or slotNumber raises an error, so no header can be produced for open or the future draw on Sepolia until the encoder is updated.
• Info, stale manifest and an impossible manifest step. launch.json still deploys the box. The brief's "raffle granted as minter and spender" cannot be done by a constructor-only manifest; the owner must grant it afterwards, and the furniture's single immediate grant means the raffle must be the very first grant.
• Info, MockOG mint is open. On Sepolia anyone can mint unlimited stake and buy every raffle ticket. Fine for a testnet, but it must not appear in the mainnet manifest.

The core box logic looked sound against the checklist: payments settle before state is read, balance deltas reject fee-on-transfer, header decoding is canonical and fuzzed, the reveal window and expiry boundaries are off-by-one correct, reentrancy guards cover all four purchase paths, and the ten-pack and cap accounting match the documentation. No critical or high defect was found in the delivered code.

Implemented the staking, raffle and farming-vault flow, retired OGClubBox, and updated deployment files, fixtures, README and ADAPTATION.md.

All checks pass: forge build, forge fmt --check, 104 permanent Foundry tests with your seed, and six offline checks.

No deployment performed. The owner must grant the raffle its first minter and spender roles after deployment.

Updated only launch.json, preserving the five verified constructor entries and clarifying required owner role grants.

Passed forge build, forge test with the supplied fuzz seed, forge fmt --check, and manifest ABI validation. Nothing deployed.

Findings file validated: both snippets match the tree exactly, JSON parses, and all 41 listed entry points plus three invariant rows are covered.

Result: no critical or high defects in the permissions area. The access-control, trust-gap and asymmetry passes over all four contracts found the permission model consistent, and the full suite of 104 tests passes on this tree.

What I checked and how it came out:

• Role lifecycle in staking and furniture mirrors exactly: one immediate bootstrap grant, 7-day proposals, inclusive 7-day activation window, cancel and activate share one liveness predicate, revoke clears both state slots. Confirmed the lapse instant with a scratch test.
• Window boundaries are complementary at every pair: enter vs cancelRaffle, enter vs commitDraw, vault claim vs cancelSeason and vs releaseSeason. No instant where two sides disagree.
• Owner custody: no selector moves stakes, points or vault tokens. The only vault outflow is a Merkle claim paid to the leaf account.
• claimTo correctly rejects interleaved wallets per group, zero recipients and reentry.
• launch.json has only the three schema keys, in-order constructor arguments, backward references, and notes under the limit.

Findings written to .imd-findings.json:

1. Low. Permissionless claim cannot be declined by the entry wallet. A contract wallet that accepts ERC-1155 but has no outbound transfer receives its prize from a stranger's claim, and its own claimTo then reverts as already claimed. Reproduced in a scratch test. This follows the brief's wording, so it is flagged as a design gap for the author to decide.
2. Info. Documented owner trust assumptions recorded with concrete sequences: Merkle self-allocation bounded to half the unreserved pool per 7 days, any spender can burn any account's points, any minter can mint freely, revoking the raffle blocks delivery, and renouncing ownership is immediate.

Not reached: the randomness bias of re-targeting after 256 blocks is outside my area and already documented in the README, so I did not quantify it. The scratch tests live under test/scratch/ and are not part of the submission.

The review is complete and the findings file is written. The working tree is otherwise untouched (scratch tests and python caches removed).

Outcome: no critical, high or medium defects in the control-flow area. I report one low finding and one documented trust assumption, with 47 coverage rows answering all 41 entry points plus six invariants.

What I traced, against the Execution Trace, Periphery and First Principles guides:

• OGClubRaffle: create/enter/commit/draw/claim state machine, exact window boundaries, the retarget rule (draw window is (target, target+256], recommit only at target+257, which matches blockhash availability exactly), claim grouping and bitmap ordering, reentrancy across the ERC-1155 receiver hook.
• Periphery libraries: BlockHeader RLP parser (canonical-length rules, bounds, field 8 and 13 checks) and Permutation (balanced Feistel with cycle walking is a bijection; I measured near-uniform output at sizes 2, 3 and 4 over 4000 seeds). The Sepolia fixture 11921684 was re-fetched from two live RPCs and matches the embedded hash and mixHash. The python encoder tests pass when run directly.
• OGClubStaking accrual math (144-bit intermediate, remainder carry), fee rounding, balance-delta credit, callback guards, spender lifecycle. OGClubFarmVault budget, interval, claim window and release. Deploy.s.sol and launch.json argument order and dependency order.

Findings written to .imd-findings.json:

1. Low: the deploy helper validates only that TOKEN is non-zero. Because staking defers its decimals() read to the first stake, a token lacking that getter deploys fine and then stake() reverts forever with no recovery, since token is immutable. Reproduced with a Foundry scratch test. Fix: call decimals() in the script's run() and revert if it fails or exceeds 18.
2. Info: the one immediate first grantSpender/grantMinter is the requested design, recorded as a trust assumption with the concrete sequence by which a fresh owner could burn points or mint furniture without delay before the raffle is granted.

Not reached in depth: the README gas table and EIP-8037 slot projections, and the economics of the mainnet OG token itself. Those belong to other specialists' areas.

The review is complete and the findings file is written. Here is the recap.

Outcome: no defects found in the economics area. The .imd-findings.json file holds three info-level trust notes and a 47-row coverage record, with every one of the 41 listed entry points marked holds plus six invariant rows.

What I checked, against the Pashov Economic Security, Invariant and Flow Gap guides

• Staking: accrual is exact (full-precision mulDiv plus a carried remainder, so checkpoint frequency never changes points). The fee is ceil(amount/100), so 1-wei chunks cannot dodge it. Stake credits the balance delta, so a fee-on-transfer token cannot inflate stake. Flash staking earns nothing and loses 1%. The balance-equals-totalStaked invariant survives both the plain and the 2% recipient-fee token.
• Raffle: entries are recorded before the point spend so a failed spend rolls back the range and cap. Both selection permutations are keyed Feistel bijections with cycle walking over the exact domains, so exactly min(prizes, tickets) distinct tickets win and each item is minted at most its quantity. Claims are O(wins), bitmap-guarded, and mint only to the entry wallet. The claimTo redirect checks the wallet at every group boundary.
• Vault: the 50% budget is computed against the unreserved balance, reserved at once, and the 7-day interval is measured from the proposal even after cancel. Claims decrement remaining and reserved before transfer and check the exact debit. Balance ≥ reserved cannot break with an honest token.
• Documentation and manifest: I re-ran the gas test in isolation and all six README rows match exactly. The manifest has only the three schema keys, five unique contract names in dependency order, string arguments one per constructor parameter, and 2,051 characters of notes. Full suite, fmt check and Python header tests all pass.

The three info notes record trust assumptions the judge should weigh, each with a verified reproduction in test/scratch/EconProbe.t.sol:

1. The owner can route half the unreserved vault to any recipient, including itself, every 7 days through seasons. Over three seasons that is 875 of 1000 fee tokens. This is the brief's design and the README says so.
2. A token that debits the sender more than the requested amount makes every unstake and vault claim revert while stake keeps accepting deposits. The README documents it, but the mainnet OG token should be fork-tested before launch.
3. The cheapest seed bias is a validator calling commitDraw three blocks before its own slot and skipping the slot if the computed seed is unfavourable, roughly doubling its odds for one missed block reward. The README documents the general withholding bias; this quantifies it.

Nothing in the tree was modified beyond the findings file and the scratch test directory.

The review is complete and written to .imd-findings.json (valid JSON, two findings, 46 coverage rows covering all 41 listed entry points plus five invariants). The scratch probe tests were removed, so the tree holds only the findings file.

Outcome: no medium-or-higher defect in the math, boundary or numerical-gap area. The arithmetic held up under every check I ran against the Pashov Math Precision, Boundary and Numerical Gap guides:

• Staking accrual is an exact floor of balance × rate × seconds / (86400 × 10^decimals) with the sub-unit remainder carried in a uint80. Intermediates fit (≤ 2^272 through 512-bit mulDiv, result < 2^256 even at the uint128/uint96/uint48/0-decimals corner). Probed at 0 decimals and via the existing 0–18 decimal fuzz.
• Unstake fee is ceilDiv(amount, 100): 1 wei pays 1 wei, 100 pays 1, 101 pays 2. No way to dodge it by splitting.
• Permutation is a balanced 8-round Feistel with cycle walking on the next power-of-four domain. I verified it exhaustively as a bijection at sizes 2, 3, 4, 5, 16, 17 (20 keys each) and 1025, beyond the repo's fuzz to 200. Domain limit 2^48 matches MAX_TICKETS.
• Draw window target < block.number ≤ target + 256 matches BLOCKHASH availability exactly, and re-targeting opens at the first block where the old hash is gone. The RLP decoder is bounds-checked at every read.
• Vault cap floors (balance − reserved) / 2; probed with 3, 2 and 1 wei unreserved. Claim window and release boundary meet at exactly opensAt + 90 days.
• README gas table reproduces exactly from the isolated gas test, and launch.json is schema-valid with correct argument counts.

Two informational notes were recorded, each with a concrete reproduction:

1. enter() writes a ticketsOf slot even for uncapped pools, costing one unenforced fresh slot per wallet per pool under EIP-8037 (the gas test shows 4 fresh slots where 3 would suffice).
2. unstake() requires the token to debit exactly amount. That is the right protective choice, but a sender-taxed OG token would lock every stake, so it is flagged as a mainnet deployment precondition rather than a code defect.

Static-analysis leads in my area (weak-prng on the remainder modulus, strict equalities, uninitialized locals, unsafe casts in enter) were all traced and are false positives: the casts are guarded by prior range checks and the equalities are intentional sentinels.

Added 12 regression/fuzz tests and three stateful invariant campaigns, covering fee conservation, raffle lifecycles, partial payouts, and failure rollback. All changes are under test/.

Verified:

• 119 Foundry tests passed with the required seed.
• forge build and forge fmt --check passed.
• Six offline Python checks passed.

No implementation defects were reproduced. Nothing was deployed.

The review is complete. The findings file is written at the repository root and the working tree is otherwise clean.

Outcome. The code holds. I found no critical, high or medium defect, and none of the four specialists' nine reports survived as more than a low. The full suite of 119 Foundry tests, both Python test files and forge fmt --check pass on this tree, and all five contracts are well under the size limits.

What I kept, after reproducing each against the code:

• Low: the deploy script accepts a TOKEN address whose decimals() reverts, since it checks only for a non-zero address. The deployment then succeeds but every stake() reverts forever because the token is immutable. Reproduced with a scratch test using an ERC-20 that omits decimals().
• Info: permissionless claim() can pre-empt a contract wallet's claimTo() destination. This follows the brief's literal wording, so it is recorded as a design note, with a reproduction showing the prize landing in an accepting-but-immobile contract.
• Info, merged from three specialists: the owner trust assumptions, including the immediate first grant, spender power over any account's points, the vault owner's 50% per 7 days self-allocation path, and immediate renounce.
• Info, merged from two specialists: a token that debits the sender beyond the transferred amount locks every unstake and vault claim. The README documents this as unsupported, so it is a mainnet precondition to verify.
• Info: the proposer-aligned commit bias and retarget re-roll, which the brief accepts and the README documents.
• Info: enter() writes a per-wallet ticket counter even in uncapped pools, one unnecessary fresh slot per wallet per pool.

My own pass traced all 41 entry points plus the three requested invariants, the permutation bijection and the manifest. Every row is answered; none is unreached. The Slither and Aderyn leads were all false positives on inspection: the "weak PRNG" is a modulo for the accrual remainder, the reentrancy lines are guarded and follow checks-effects-interactions, and the unsafe casts are bounded by the prior MAX_TICKETS check.

Housekeeping. The scratch test directory and the Python cache directories created by running the tests were removed, so no tracked or untracked file in the tree changed.