Review complete. Findings are in .imd-findings.json at the repository root, and no repository file was changed (only out/ build artifacts, which .gitignore excludes).

What I verified against mainnet and the local build

• The two core-code parts on chain reconstruct byte-for-byte into the compiled QuorumBoundCore creation code, and their keccak equals both the committed and the on-chain creationHash.
• The deployed constitution contract hashes to the sha256 of constitution.en.md, and the on-chain text contract holds the exact file bytes.
• Both prerequisite runtimes equal the local compile after masking immutables. Both receipts succeed from the listed wallet with the listed addresses, blocks and gas.
• The token pins exactly those addresses plus the 62,500 token stake and the IMD pairing. Manifest constructor args, permissions and token metadata match the source. All runtimes stay under 24,576 bytes and both initcodes under 49,152 bytes.

Findings

• High. One of the nineteen required cases, the four-week suspension test, fails under the committed foundry.toml. It runs out of Foundry's default per-test gas budget and reverts with OutOfGas. It passes when the gas limit is raised, so the contracts are not at fault, but the test file is hash-pinned and the config file is off limits to the adapter. The requester has to re-pin a cheaper test or ship a config with a higher gas limit. The plain required command will otherwise report the suite as failed.
• Low. A voted operating plan can never trade through the project's own pool, because the router's tax deposit hits the treasury's reentrancy lock while the operation is executing. Funds stay intact, but the conversion path is dead and fixing it means new core code.
• Info. Platform fee share defaults to the payer, so the hook's fee collection reverts until the payer hands the requester role to the hook. Fees claimed before that go to the payer permanently. This is the disclosure the brief asks for.
• Info. Verification record, coverage and open items. The IMD token source could not be reached. It has an owner and 23 KB of code, and the treasury's exact-receipt check assumes plain transfers. The hook hard-codes fee tier 12500, which the chain's policy must allow. The unreferenced constitution.packed.hex was not decoded and is not evidence.

Coverage. I read all nineteen source files, the three test files, the external interface facade, and the relevant parts of the launch factory, pool fees, registry and distributor libraries. The project's launch gas in the positive test is about 13.3 million, under the cap. I found no fund-loss, mint, pause, seize, delegatecall, selfdestruct, proxy or post-deployment configuration path in the project code, and the governance semantics I traced match the constitution text.

Done. The project launches through the official univ4_hook factory without any contract change, and the one reproduced audit defect is repaired on the test side.

What I verified

• The compiled QuorumBoundCore creation code hashes to the pinned package hash, and the two mainnet code parts are byte-equal to it after stripping their prefixes. The constitution file hashes to the on-chain constitution hash. Re-checked live on Ethereum at block 26,227,100, including IMD's symbol and decimals.
• The audit's high finding reproduces: under the committed config, the suspension governance case runs out of Foundry's default per-test gas budget. The low finding (operating plans cannot trade through the router) reproduces by code reading. The requester-bound-to-payer finding reproduces.

What I changed (committed as 1915cbf, no src/, config or dependency changes)

• test/positive/NormalIntegrated.t.sol: the shared simulated-clock helper now pauses gas metering for the hourly replay. Every contract call and assertion still runs. All 14 pinned governance cases pass under plain forge test --json, and both pinned test files keep their ACCEPTANCE.json hashes.
• test/positive/LaunchIntegration.t.sol: six new tests launch the real zero-argument QProbeToken and hook through the unchanged factory bytecode, with the prerequisites and IMD staged at their mainnet addresses. They check the package hash, atomic core bindings, size and gas limits, initialization and unauthorized callback rejection, IMD-only tax with no ETH, and the payer-to-hook fee handover.
• ADAPTATION.md and a README section list each change, the launch rules checked, the audit findings and the platform conditions.

Results

Check	Outcome
forge build	clean
forge test --json with the verifier's fuzz seed	30 passed, 0 failed
Required positive cases	19 of 19 pass
Factory launch execution gas	13,425,721

Disclosures for acceptance

• The launch needs Ethereum mainnet state at or after block 26,226,975. On an empty chain the token constructor reverts with "predeployed immutable code", which is the precise rejected stage if the platform can only simulate constructors without state. The brief forbids replacing this composition, so it is kept.
• The audit's low finding is not fixed. The treasury lock is inside the fixed package, and deferring the tax deposit would weaken the atomic 3% rule. It is documented as a limitation with no loss of funds.
• If the platform assigns the payer as requester, the payer must hand over future fees to the hook before acceptance. Fees claimed before that go to the payer and cannot be moved.

I found no defects in the contracts. All 19 required cases pass without skips, and the new compatibility suite passes, but a plain forge test will not run the new suite. foundry.toml sets test = "test/positive", so it only finds the 30 tests in test/positive. To include mine, run FOUNDRY_TEST=test forge test. I couldn't change foundry.toml because it's protected, so I recorded this in .imd-findings.json.

Results, run with the verifier's fuzz seed:

• forge test: 30 passed, 0 failed, 0 skipped. The 19 required cases are among them, and the two pinned suites still match their recorded hashes.
• FOUNDRY_TEST=test forge test: 51 passed, 1 skipped. The skipped one is the mainnet fork test, which skips when no RPC is set.
• I also ran the fork test once against a public mainnet RPC and it passed. The two deployed package parts rebuild byte-for-byte into the compiled QuorumBoundCore creation code with the pinned hash. The deployed constitution matches constitution.en.md and its SHA-256, and IMD reports symbol IMD with 18 decimals.

What I added in test/compatibility/ (nothing in test/positive changed):

• CompatibilityBase.sol: a shared setup that launches the real QProbeToken and hook in one factory.launch call, using the unchanged factory and PoolManager bytecode. IMD and the two prerequisites sit at their mainnet addresses. The pool opens at a 2,500 IMD market cap and is seeded with tokens only.

• DeploymentCompatibility.t.sol (19 tests):

  • Package and constitution: the package parts rebuild the compiled core exactly; the constitution bytes and hash match; the package refuses a wrong hash, an empty part and a constitution with no code; each caller gets a fresh core that reports to that caller.
  • Launch failures: the token reverts on a chain without the prerequisites, and the factory launch fails at the token step there. Over-share, a wrong salt, too much liquidity, a non-deployer caller and a repeat launch number are all refused. The hook constructor refuses a zero pool manager and an address whose flags don't match.
  • After launch: opening price, 90% pool / 10% swarm and no founder allocation; every contract binding and the registry entries; initcode, runtime and gas limits; no ETH accepted anywhere.
  • Tax and router: a fuzz test checks the 3% buy and sell tax rounds up, stays in IMD, and is split 50/50 between allowance and operations. The router refuses a past deadline, a zero amount, price bounds, the wrong hook and a direct callback.
  • Quotas: tokens received by plain transfer can't be sold; nobody can sell more than they bought; original allocations need a valid proof, register only once, and stay locked until qualification; quota and reward entry points reject outsiders.
  • Fees: donations are accounted into the treasury. Fee collection is refused while the payer is the requester. A second setup makes the hook the requester directly and checks the fees reach the treasury.

• TaxQuotaInvariant.t.sol: 48 runs of 30 random calls covering buys, sells (including attempts above quota), plain transfers, donations, fee collection and time passing. It checks after every sequence that:

  • supply never changes;
  • the treasury holds exactly what its ledger records, in both assets;
  • nothing is left in the router or hook;
  • no contract holds ETH;
  • each trader's quota matches their actual trades.

  I confirmed that successful sells and refused oversells both actually occur during these runs.

• RequiredPositiveCases.t.sol: fails to compile if any of the 19 required cases is removed or renamed. Importing the pinned suites also makes them run with the new tests.

• MainnetPrerequisitesFork.t.sol: the live check above. It needs QPROBE_MAINNET_RPC_URL, and no RPC address is committed.

.imd-findings.json has two info-level items: the test-discovery issue above, and the opening price. The 2,500 IMD market cap comes only from

The gas and size report is complete and committed. The composition fits every current mainnet limit, and no contract is over the runtime cap.

What was delivered (commit eb181ac, only test/, .gas-snapshot and reports/ touched; no contract or config changed, pinned test hashes unchanged):

• test/positive/CompositionGas.t.sol: 51 tests, one per public function of the launched composition, plus the whole factory launch, the hook constructor, the package create, the token constructor, and deployed-size checks. All 81 tests in the suite pass with the verifier's fuzz seed, and forge snapshot --check passes.
• test/positive/LaunchTransactionScript.sol: a forge script (not a test) that stages the pinned prerequisites on a local Osaka anvil and sends the real launch transaction.
• .gas-snapshot and reports/gas.md.

Key measurements

Item	Value
Real launch transaction on Osaka anvil with the EIP-7825 check on	13,248,248 gas used, accepted under the 16,777,216 cap
Headroom under the cap	3,528,968 (21%)
Largest runtime (QuorumWork)	17,027 bytes of 24,576
Largest nested initcode (core package + args)	40,378 bytes of 49,152

Post-launch bindings were read back on chain through the actual hook.core() getter: token, stake, constitution hash, IMD asset, reward reporter, seeder, initialization flag and registry record all match the brief.

No size defect. Every contract is under 24,576 bytes, so the report states that plainly rather than reporting a defect. No findings file was needed.

What stands out in the report: launch gas is dominated by code deposit (10.36M of the 13.2M), the constitution's hourly respond rule costs about 14M gas per seat per week, and settleWeek and prepareBallot grow linearly with the roster but are bounded per call by their batch limit.

One caveat is written into the report: the Foundry measurements run under the protected evm_version = cancun setting, so the Osaka anvil transaction is the measurement under current rules. The composition uses no opcode whose price changed after Cancun, and the EIP-7623 calldata floor does not bind.