Review complete. The findings file at .imd-findings.json holds four entries, each with a concrete reproduction, and two of them carry Foundry proofs under test/scratch/ that fail on the current code.

What I found

• Medium, InkVault.revealTraits (line 410): an expired trait reroll is renewed for free. The holder pays the fee once, reads the drawn seed off-chain, and if they dislike it simply never settles. After 256 blocks the same call renews the request to a fresh block, giving a new draw with no new fee. Nobody else is paid to settle a trait reroll, so one fee buys unlimited draws until a rare seed appears. The pull queue has the same renewal path, mitigated only by later pullers' incentive to reveal. Proof: test/scratch/TraitRerollFreeRedraw.t.sol.
• Medium, InkPortraits.setVault (line 83) and the other one-shot setters: the system is wired after deployment by irreversible setters that validate nothing. A single mistyped setVault makes the collection unable to mint forever. A wrong setInk makes setup unreachable and strands the 800M INK the vault already holds, with no exit path. The brief itself requires this post-deploy wiring because INK does not exist yet, so the adapter should add cheap checks rather than remove the setters. Proof: test/scratch/OneShotSetters.t.sol.
• Low, InkVault.onERC721Received (line 462): a portrait sent with plain transferFrom instead of deposit is accepted, never joins the draw, pays nothing, and can never be moved out. Verified with a scratch test.
• Info: a coverage note listing what was read, reached and run.

What checked out clean

• All four contracts deploy with the brief's constructor arguments on an empty chain, stay under the EIP-170 size limit, contain no DELEGATECALL, CALLCODE or SELFDESTRUCT, report the owner as $owner, and return a zero royalty to $owner. Argument order matches every constructor declaration, and no constructor calls another contract.
• On mainnet the seat contract at 0x0000ec93… is an ERC-721 with exactly ids 0 to 1999 and no pause, both Uniswap v4 addresses have code and are linked, and the owner and treasury are EOAs.
• The existing suite passes: 75 tests, 0 failures, 14 fork tests skipped for lack of an RPC. The invariant suite covering backing, custody, cap and queue coverage is clean, and I could not break the pull, admission, renewal or ladder accounting by hand.
• Renderer trait rules match the original art script's seed prefixes and are pinned by fixture tests. A full tokenURI costs about 4.9M gas.

Not reached: the INK token and pool, which only exist after the later hook launch, and the real snapshot root. src/testnet/TestSeats.sol was not reviewed since it is not deployed.

Implemented the four-contract launch adaptation and fixed all three reproduced audit defects. Ownership and royalties remain assigned to $owner; the fee router stays excluded.

• forge build: passed.
• Seeded tests: 96 passed, 28 optional skips.
• Mainnet fork tests: 14 passed.

Changes and deployment handoff are documented in ADAPTATION.md. Protected files are unchanged. No transactions were broadcast.

Created launch.json with the required contract order, constructor arguments, $owner assignments and official Uniswap mainnet addresses.

Validation passed. forge build succeeded; forge test with the supplied seed reported 96 passed, 0 failed, 28 skipped. Skips require RPC or snapshot inputs.

Only launch.json is changed for submission. No deployment was broadcast.

Added tests under test/ covering liquidity custody invariants, fee conservation, failure rollback, threshold boundaries, and 1,000 renderer fuzz cases.

forge build and forge test with the supplied seed pass: 107 passed, 0 failed, 28 skipped. Skipped checks require RPC access or the full snapshot fixture.

Source and configuration remain unchanged.

I finished the economics review and wrote it to .imd-findings.json: 5 findings and 53 coverage rows, one for each of the 52 listed entry points plus one for the backing invariant. I checked every snippet against the tree and it matches. No source files were changed. The scratch tests and the out/ and cache/ folders my test runs created have been deleted.

Tests: I ran the existing suite with forge test --offline. 96 tests passed, 0 failed, and 28 were skipped, mostly the fork tests, which need an RPC URL.

Findings, most severe first:

1. Medium – src/InkVault.sol:385. The agent-holder fee discount goes to msg.sender, so it can be passed on to anyone. A contract that holds one agent portrait can hand in other people's swarm portraits for them in one call, with no trust needed. Non-holders then pay 50 bps instead of 100, so the liquidity contract gets 2,000 INK instead of 4,000 per hand-in. The attached proof test fails on the current code (2000e18 != 4000e18).
2. Low – src/InkVault.sol:439. A trait reroll lets the holder keep the better of the old and new traits for one fee. The holder can work out the new seed from block b+2. If they don't like it, they wait out the 256 blocks and revealTraits keeps the old seed. The attached proof test fails on the current code.
3. Low – src/InkLiquidity.sol:263. setWidth has no upper limit. A width near the int24 maximum overflows in _rangeFrom, so every addLiquidity() reverts once the price is above the release start, and accumulated fee INK stays in the liquidity contract. If the owner has already renounced ownership, nothing can fix it. I worked this out from the arithmetic and did not run it.
4. Low – src/InkHook.sol:159. The hook's fee waiver checks tx.origin. Any agent-holder account that sends transactions for other people, such as a bundler, relayer or trading bot, makes all the swaps inside them fee-free. The hook isn't part of this four-contract launch, but it decides what fees the liquidity contract and the treasury receive later.
5. Info – src/InkVault.sol:161. INK sent to the vault beyond the 800M it needs, whether at setInk or sent directly later, can never be moved out.

Checked and found sound:

• Vault backing: INK in the vault always equals 400,000 per portrait outside it plus per pending pull. This holds through claim, release, pull, reveal, expiry refund and deposit.
• Pull reservations: The reservation check guarantees every queued pull has a portrait to land on.
• Claim window: The claim and release time boundaries line up.
• Price floor: The floor and premium apply for both token orderings, and the release ladder goes in before any swap is possible.
• Hook fees: The fee is taken from the right side and with the right sign for exact-input and exact-output swaps.
• Seat contract: The seat contract on chain 1 has token IDs 0–1999 (2000 is missing), which matches the vault's seat limit.

Not covered:

• Fee router: InkFeeRouter.claimAndRoute is marked unreached. I only read it and didn't test it; it's also not part of this deployment.
• Sandwiching new liquidity: Someone could push the price down just before addLiquidity() lists INK at the current price. The repo already documents this as an accepted risk. I didn't measure how big it is, so I left it out of the findings.

The review is complete and the findings file is written and validated.

Outcome. The permission model of the four launched contracts holds up: every privileged setter is owner-only and one-shot with binding checks, minting is vault-only, and no outsider can act between deployment and owner wiring. Constructor roles match the brief (explicit owner for all four, treasury only as the immutable IMD-fee recipient in InkLiquidity, royalties to the owner at 0 bps, official Uniswap v4 manager addresses). The existing suite passes (90 passed, 5 skipped fork tests).

Findings written to .imd-findings.json (3 findings, 55 coverage rows, all snippets verified against the tree):

1. Low, all four contracts. The accepted fix guarded renounceOwnership before configuration, but one-step transferOwnership reaches the same unrecoverable state unguarded. Confirmed with a scratch test: transferring to a dead address before setVault leaves the collection permanently unmintable, and the same on the vault strands the 800M INK. Suggested fix is Ownable2Step or mirroring the readiness guard.
2. Low, InkLiquidity.addLiquidity. Permissionless listing of fee INK at the spot tick read in the same transaction, bounded only by the release floor, so any caller can sandwich the listing. This is recorded in ADAPTATION.md as a deliberately kept assumption, so it is reported as a trust assumption for the owner to accept, not a blocker.
3. Info, InkVault.pull. Unlike deposit(minOut) and rerollTraits(maxFee), pull has no fee bound, so an owner setFees landing first fixes a higher expiry fee (max 5%) on a pull the user already signed.

Coverage. All 50 listed entry points have a row, plus three invariant rows. Hook, fee router and TestSeats entries are outside this launch and were traced for my area only. No critical or high finding was found, so no proof file is attached. The scratch test was removed.

The review is complete and the findings file is in place.

Outcome. The math in the assigned area holds. I traced every value-moving formula in the vault, liquidity contract, hook and renderer against the Math Precision, Boundary and Numerical Gap checklists and found no defect that moves funds, breaks an invariant or bricks a path from any reachable state. One informational entry is recorded in .imd-findings.json, with a coverage row for all 51 entry points plus five invariants.

What I verified

• Vault fees are exact. Every allowed basis-point value divides 400,000 INK evenly, so hand-backs, expiries and trait rerolls never truncate and vault solvency has no drift term.
• Pull capacity bound guarantees a draw. The check in pull() against available plus already-waiting portraits, with same-block deposits excluded and admission cut at each pull's own block, keeps at least one candidate at every reveal. The NoneAvailable revert in the reveal path is unreachable.
• Single-sided mints never need more INK than sent. Liquidity rounds down and the pool's required amount is a nested ceiling that stays at or below the sent amount, so the sweep only returns dust. The ladder split floors each band and gives the remainder to the last, so nothing leaks.
• Tick arithmetic stays inside int24. I tested the one concrete overflow lead, a maximum setWidth, on the real v4 stack: it clamps to the usable tick bounds and adds liquidity fine. Overflow would need a tick of the opposite sign to the launch price, so I dropped it.
• Renderer thresholds match the script's real-valued thresholds exactly, including the six agent integer cutoffs.

The one recorded item is informational: the hook fee floors to zero for swaps whose unspecified side is under 400 wei at 25 bps. A scratch test confirmed a 399-wei buy mints no fee claim. Impact is dust and uneconomic to exploit, so no proof file is attached.

Not reached. Whether the mainnet IMD token reverts on a zero-amount transfer, which would make InkLiquidity.collectFees revert when one side has no fees. That needs a fork, which this review could not run.

The existing suite passed as a baseline (91 tests, 14 skipped fork or invariant suites). My scratch tests were removed and no repository file was changed.

Review complete. The findings file is written and valid, and nothing in the repository was changed (scratch tests live only under test/scratch/, which is discarded).

Outcome

The control flow of the four launch contracts holds in my area. The existing suite passes (96 tests, 0 failures, 28 skipped fork and snapshot tests), and two scratch suites I wrote against the real Uniswap v4 PoolManager and PositionManager also pass. I report one low finding and no critical, high or medium ones.

Finding 1 (low), src/InkLiquidity.sol:149. setPremium() is refused forever once any position exists, and addLiquidity() is permissionless with no released() gate. If the owner's setPool() lands before setPremium(), anyone holding 400,000 INK before release can send it to InkLiquidity, call addLiquidity(), and lock the premium at zero. The released allocation would then be listed from the opening price rather than 5x above it. I reproduced the exact sequence on the local v4 stack: after the attacker's call, the owner's setPremium(16000) reverts BadPremium. It is low because script/InkSteps.sol and SETUP.md already order the premium before setPool(), so the documented procedure closes the window. The contract itself does not.

Leads checked and dropped

• The posm rounding lead on the release ladder (mint needing one wei more than sent). A fuzz over both token orderings, 1 to 2000 released seats, premiums 0 to 100,000 and opening ticks 1,000 to 256,000 never reverted, so release() cannot be stuck that way.
• Agent-portrait deposit during the claim window, then release, 2000 pulls and reveals. Backing stayed exactly 400,000 INK per portrait outside the vault, the cap held at 2000, and the deposited agent portrait was drawn by a pull.
• The avail == 0 revert in _revealNext. By induction on the pull-time check it is unreachable, since candidates only shrink through reveals.
• Every static-analysis line listed in the task. None reproduced as a defect; the reasons are recorded in the file's scope note.

Coverage. All 53 listed entry points have a row, 52 holds and 1 finding, plus three invariant rows for backing conservation, single-sided mint rounding, and the launch constructor arguments and roles. No row is unreached.

Review complete. The findings file is at .imd-findings.json and the working tree has no other new files.

Outcome: 10 findings kept, 0 dropped outright, 1 downgraded, nothing critical or high.

What I did with the specialist reports:

• Kept at medium, with proof. The agent-holder reroll discount keys off the caller, so one agent portrait parked in a contract resells the half-price deposit to every non-holder. The specialist's proof fails on this code exactly as stated. I merged the equivalent paths in rerollTraits and pull into it.
• Kept at low, with proof. Trait rerolls are a free option: the holder sees the seed at b+2 and can let the request expire to keep the old traits. The proof fails as stated.
• Kept at low, reproduced on the real pool fixture. Between setPool and setPremium, anyone with 400,000 INK can list a zero-premium ladder and lock the premium forever. My test on the InkSystem fixture confirmed 8 positions listed by a non-owner before release, then BadPremium on the owner's call.
• Kept at low by trace. Permissionless addLiquidity lists fee INK at the caller-chosen spot tick, the hook's tx.origin exemption covers bundlers and relayers, and one-step transferOwnership is unguarded where renounceOwnership is guarded. I confirmed no override exists anywhere in src/.
• Downgraded to info. The setWidth overflow does not fire at the pool's real ticks. With the maximum width and INK as currency1 at tick 128,999, addLiquidity succeeds and clamps. For INK as currency0 the opening tick is near -129,000, so the sum still fits. It needs INK at or above 1 IMD per INK.
• Kept at info. Pull has no fee bound, surplus vault INK is stranded, and the hook fee rounds to zero on dust.

My own pass added no new findings. I chased one lead the specialists did not cover: whether the exact amount0Max = amount bound in _mintSingleSided could trip on v4's round-up math and make release() revert. A scan of 108,036 amount and tick combinations produced zero excesses, so I dropped it. I also verified the manifest's Uniswap addresses live on mainnet: the PositionManager reports the manifest's PoolManager.

Coverage answers all 52 entry points plus three invariants, with no unreached rows. The static-analysis leads were checked and none rose to a finding beyond those already listed.

The responses file is in place at the repository root, excluded from git by the harness's own exclude rule, which is where the reviewer reads it. Everything is verified, so the work is complete.

Recap

The reviewer's medium finding reproduced and is fixed, three advisory findings reproduced and were fixed cheaply, and the remaining six are answered as disputed with reasons. No build configuration or dependency changed.

Fixed, with tests

• Discount resold through an agent-holding contract (16c7464acc9e). The proof failed on the starting tree. The cause was pricing the discount from the caller's holder status. The discount is now keyed to the portrait's own history: InkPortraits records whether the current holder received a swarm portrait straight from the vault and has not moved it, and the vault's deposit and trait-reroll paths grant the half fee only on such portraits. The proxy path now pays the full fee, and the proof passes. I chose this over the reviewer's "held since an earlier block" example because a standing custodial proxy still passes that rule after one block. The trade-off, recorded in ADAPTATION.md, is that an agent holder pays the full fee on swarm portraits bought or received from another wallet.
• One-step ownership transfer (68252bb4caa5). All four launched contracts now inherit Ownable2Step, so a transfer to a wrong address never takes effect. Constructors still take $owner.
• Premium lockable before release (b22beff1453b). InkLiquidity records the hook's vault at setPool and refuses addLiquidity until the vault has released. The release path itself is unchanged.
• Range overflow at extreme width (96b69dd541d1). _rangeFrom now widens in 256-bit arithmetic and clamps. A new harness test fuzzes both token orderings.

Left unchanged, answered as disputed: the trait-reroll free option (a deliberate residual of the earlier accepted fix, where both remedies change the fee design), spot-tick listing (already a recorded trust assumption), the hook's tx.origin exemption and fee rounding (hook not deployed by this launch, comment extended), the missing pull fee bound, and stranded surplus INK.

Verification with the verifier's fuzz seed:

One note: the older audit proof for the trait-reroll renewal fails in its own setUp on both the starting and the finished tree, because its liquidity stand-in predates the accepted setter-validation fix. That was already the case when the previous round was accepted, so I left it alone.

The accepted launch.json already satisfies every acceptance criterion, so this revision changes nothing. No findings were attached to the assignment, and the full verification found no defect to repair.

What I verified

• Constructors match the manifest. InkPortraits takes one owner, InkVault takes portraits, seats and owner, InkLiquidity takes PoolManager, PositionManager, owner and treasury, and InkRenderer takes portraits and owner. The argument counts and order in launch.json match the source in all four cases.
• Addresses are correct. The PoolManager and PositionManager values match the official Uniswap v4 Ethereum deployments page, and the seats and treasury addresses match the brief. The same addresses appear in the repository's own mainnet launch tests.
• Ownership goes to the owner. Every owner argument is "$owner". InkPortraits sets its royalty recipient to the same owner argument, and the treasury is only a fee recipient with no privileged role.
• Exclusions are respected. InkFeeRouter, InkHook and the testnet seats contract are not listed.
• Schema check passes. The file has only kind, contracts and notes, four unique identifiers in dependency order, backward-only contract references, no zero address, and notes well under the limit.
• Build and tests pass. With the verifier's fuzz seed the suite reports 106 tests passed, 0 failed, 28 skipped. The skipped tests are fork tests that need a mainnet RPC. The constructors make no external calls, so the protected empty-chain deployment rehearsal will not revert.

The working tree is clean. launch.json is the only deliverable and it is unchanged from the accepted version.

I fixed the one test of mine that broke after the contracts changed, and forge test now passes with the verifier's seed: 117 passed, 0 failed, 28 skipped. forge build is also clean.

What broke: since my last round, InkPortraits, InkVault, InkLiquidity and InkRenderer all switched to two-step ownership transfer. Now, when the owner names a new owner, nothing changes until that person accepts the role. My test in test/RendererBoundaryProperties.t.sol still expected the old owner to be cut off as soon as they named someone else, so it failed. The two-step behaviour is intended, so I updated the test to match it instead of reporting it as a defect.

What the updated test now checks:

• Before acceptance: the old owner is still the owner. The nominee is recorded as pending but can't add art, set the preview link or lock the renderer.
• Who can accept: only the nominee. A stranger and the current owner both fail.
• After acceptance: the old owner can't add art, set the preview link, lock, hand ownership back or renounce it. The new owner can upload and lock.
• The NFT is unaffected: changing the renderer's owner doesn't change the NFT contract's owner or where royalties go.

I also updated the line about this test in test/TestingCoverage.md.

Other changes in this round were already covered by other contributors' tests, so I left them alone: two-step ownership on all four contracts, the reroll discount now applying only to portraits the vault handed out, and addLiquidity being refused before the vault releases. My liquidity invariant suite passes unchanged.

I found no new defects, so there is no .imd-findings.json. The 28 skipped tests are the mainnet fork suites, which need an RPC this offline run doesn't have, plus the snapshot tests whose external data file isn't in the repo. A run against live mainnet state is still owed. Nothing is committed; the two changed files are left in the working tree.

The review is settled and written to .imd-findings.json with 7 findings and a 58-row coverage record covering all 56 entry points. No tracked file was changed.

The medium is fixed. The attached proof for the reroll-discount proxy now passes on the revised tree. The fix keys the discount to the portrait's own history: InkPortraits._update sets heldFromVault only when the vault itself hands the portrait out, and deposit() reads that flag before its own transfer. The full suite passes with 118 tests green and the fork suite excluded.

Three fixed lows and infos confirmed. All four launched contracts now inherit Ownable2Step, so a mistaken transfer stays pending until accepted. addLiquidity() reverts NotReleased until the bound vault has released, so the premium can no longer be locked before the owner sets it. _rangeFrom widens in int256 and clamps, and the RangeMath fuzz test passes.

One residual kept at low, with a failing test. The author's own ADAPTATION.md names it: a custodial wrapper that parks one agent portrait, calls pull() with a user's INK, and keeps the minted portrait in its own custody still hands it in at the half fee, since the vault mints straight to the puller with the flag set. My scratch test fails with 2,000 instead of 4,000 INK. It needs users to hold a wrapped claim instead of the real portrait, so it is advisory rather than blocking, and the proof source is attached.

Disputed items re-run and kept as advisory. The trait-reroll free option still reproduces, and the author's reasoning that neither remedy is a smaller change holds. The spot-tick listing, tx.origin exemption, pull fee bound, stranded surplus, and hook rounding remain documented design decisions, recorded at low or info with their reproductions so the admission record is complete.