Failed on the agent's machine.

• lowCHEESE (or any non-principal token) sent by mistake to the ETH or sIMD farm is unrecoverable; skimSurplus only measures the principal assetsrc/CheeseFarm.sol:397

  The farm's NatSpec (src/CheeseFarm.sol:158-159, 307) says skimSurplus sends 'tokens that were donated or sent by mistake' to the Treasury, but _surplus() only reads _assetBalance(), i.e. the principal asset (ETH for CheeseFarmETH, the configured asset for CheeseFarmSIMD).

  The reward token CHEESE sits in those farms too (rewardReserve), so it is the most likely token to be mis-sent to them, yet no entry point can move CHEESE beyond rewardReserve: claim() clamps to rewardReserve (src/CheeseFarm.sol:239), skimSurplus() reverts NothingToSkim because the ETH/sIMD surplus is 0, and there is no other transfer path. The same holds for any ERC-20 other than the principal asset sent to any farm.

  First-principles assumption violated: 'only the principal asset can arrive outside the farm's own transfers'. Impact is limited to funds the sender mis-routed (no staker or Treasury funds at risk), hence low. A minimal fix that preserves the design is a skimToken(address token) owner function restricted to tokens other than the principal asset and, for CHEESE, to balance minus rewardReserve, sending only to controller.treasury().

  whole finding

  Deploy controller/token/CheeseFarmETH, bindToken, addPool(ethFarm,200).

  Alice deposits 1 ether.

  Owner (premint holder) calls cheese.transfer(ethFarm, 1000e18).

  Expected: owner can route the mis-sent CHEESE to the Treasury via skimSurplus (as its NatSpec states).

  Actual: ethFarm.surplus()==0, skimSurplus() reverts NothingToSkim, ethFarm.rewardReserve()==0, alice.claim() returns 0; cheese.balanceOf(ethFarm) stays 1000e18 forever.

  Reproduced locally with a Foundry probe performing exactly this sequence (assertions: surplus()==0, skimSurplus reverts NothingToSkim, claim returns 0, farm CHEESE balance unchanged).

  whole reproduction

Failed on the agent's machine.

• highHamster Bite retained 14% is captured by a same-block dust depositor; front-running a dominant staker's exit diverts the Treasury's 15% and dilutes honest remaining stakerssrc/CheeseFarm.sol:217

  withdraw() leaves 14% of the withdrawer's gross in totalAssets for whoever still holds shares and only routes the whole 15% to the Treasury when totalShares reaches 0 after the burn. Nothing requires a remaining share to predate the withdrawal: deposits are instant, have no minimum and no lock, and shares minted in the same block count fully.

  An unprivileged actor who sees a dominant staker's withdraw() in the mempool deposits dust ahead of it, becomes the sole 'remaining' holder, inherits the retained 1.4 ETH at the post-withdrawal share price, and then exits as the last depositor keeping 85% of it.

  The brief's guarantee 'Last depositor sends the entire 15% fee plus residual rounding dust to Treasury' is defeated at a cost of 1000 wei: the Treasury receives 0.311 ETH instead of 1.5 ETH and the attacker nets +1.189 ETH.

  With honest remaining stakers T and attacker deposit D the attacker nets 0.850.14WD/(T+D) - 0.15D, positive whenever the exiting stake W exceeds about 1.26*(T+D), i.e. on every exit by a staker holding more than ~56% of a farm, and the honest stakers lose the share of the retained fee the attacker takes. Same code path in CheeseFarmERC20, CheeseFarmETH and CheeseFarmSIMD.

  Repository tests (test_lastDepositorWithdrawalSendsFull15ToTreasury, test_emptyFarmSweepsResidualRetainedFeeToTreasury) never insert a deposit between the preview and the dominant exit, and docs/SECURITY.md does not list this. Reported by the economics specialist; reproduced here by running its proof (fails on current code with attacker profit 1188811188811188661 wei).

  Minimal fix preserving 'no cooldown' on principal: exclude shares deposited in the current block from the retained-fee redistribution (track last-deposit block per account; route the retained share, or the portion attributable to same-block shares, to the Treasury instead), or send the retained share to the Treasury when the withdrawer held more than a threshold fraction of totalShares.

  whole finding

  CheeseFarmETH, controller never activated (no Core needed), treasury = EOA.

  1. alice: deposit{value: 10 ether}() -> sharesOf(alice) = 1e22; previewWithdraw(1e22) returns toTreasury = 1.5e18 (sole-staker branch).

  2. attacker, same block ahead of alice's tx: deposit{value: 1000}() -> 1,000,000 shares.

  3. alice: withdraw(1e22): gross 1e19, paid 8.5e18, toTreasury 0.1e18, 1.4e18 stays in totalAssets.

  4. attacker: withdraw(1_000_000): totalShares -> 0, gross = 1e6*(1.4e18+1001)/(1e6+1000) = 1.3986e18, paid 1.1888e18, toTreasury 0.2112e18.

  Expected: Treasury receives >= 1.5e18 for alice's exit and a zero-duration depositor cannot profit.

  Actual: Treasury receives 311188811188811339 wei in total; attacker balance rises by 1188811188811188661 wei.

  Run forge test --match-path test/scratch/RetainedFeeFrontRun.t.sol: FAIL 'same-block depositor extracted the retained Hamster Bite: 1188811188811188661 > 0'.

  whole reproduction
  proof · a Foundry test the fix has to pass

  // SPDX-License-Identifier: MIT
  pragma solidity 0.8.26;
  
  import {Test} from "forge-std/Test.sol";
  import {CheeseEmissionController} from "src/CheeseEmissionController.sol";
  import {CheeseToken} from "src/CheeseToken.sol";
  import {CheeseFarmETH} from "src/farms/CheeseFarmETH.sol";
  
  /// @notice Hamster Bite retained share can be captured by a zero-duration depositor.
  ///
  ///         The brief: when the last depositor leaves, the whole 15% fee goes to the Treasury; otherwise 14%
  ///         stays "for everyone remaining". Nothing requires "remaining" shares to have been staked for any
  ///         time, so a dust deposit placed in the block of a dominant staker's withdrawal takes the retained
  ///         14% and exits with 85% of it. The Treasury (sole-staker case) or the honest remaining stakers
  ///         (multi-staker case) lose it.
  contract RetainedFeeFrontRunTest is Test {
      address owner = makeAddr("owner");
      address treasury = makeAddr("treasury");
      address alice = makeAddr("alice");
      address attacker = makeAddr("attacker");
  
      CheeseEmissionController controller;
      CheeseToken cheese;
      CheeseFarmETH farm;
  
      function setUp() public {
          // No SqueekCore is needed: the controller is never activated, so _sync() returns (true, 0).
          controller = new CheeseEmissionController(owner, address(0xC0DE), treasury);
          cheese = new CheeseToken(owner, owner, owner, address(controller));
          farm = new CheeseFarmETH(owner, address(controller));
          vm.deal(alice, 100 ether);
          vm.deal(attacker, 1 ether);
      }
  
      /// Sole staker exits; the brief says the Treasury receives the entire 15% of her gross assets.
      function test_dustFrontRunOfSoleStakerExitDivertsTreasuryFee() public {
          vm.prank(alice);
          farm.deposit{value: 10 ether}();
          uint256 aliceShares = farm.sharesOf(alice);
          (uint256 gross,,, uint256 promisedToTreasury) = farm.previewWithdraw(aliceShares);
          assertEq(promisedToTreasury, (gross * 1500) / 10_000, "preview: sole staker sends the full 15%");
  
          // Same block, just before alice's withdrawal is mined: 1000 wei in.
          uint256 attackerBefore = attacker.balance;
          vm.prank(attacker);
          farm.deposit{value: 1000}();
  
          uint256 treasuryBefore = treasury.balance;
          vm.prank(alice);
          farm.withdraw(aliceShares);
  
          // The attacker is now the last depositor and sweeps the farm.
          uint256 attackerShares = farm.sharesOf(attacker);
          vm.prank(attacker);
          farm.withdraw(attackerShares);
  
          uint256 treasuryGot = treasury.balance - treasuryBefore;
          int256 attackerProfit = int256(attacker.balance) - int256(attackerBefore);
  
          emit log_named_uint("alice gross", gross);
          emit log_named_uint("treasury should get (15%)", (gross * 1500) / 10_000);
          emit log_named_uint("treasury actually got", treasuryGot);
          emit log_named_int("attacker net profit (wei)", attackerProfit);
  
          // A zero-duration depositor must not profit from another staker's exit fee.
          assertLe(attackerProfit, 0, "same-block depositor extracted the retained Hamster Bite");
          // And the Treasury must receive the full 15% the brief promises for the sole staker's exit.
          assertGe(treasuryGot, (gross * 1500) / 10_000, "Treasury short-changed by the front-run");
      }
  }

  whole proof

• mediumEmission arrives in round-sized chunks and is split by shares at pull time with no time weighting: a deposit mined ahead of the Reporter's settle tx earns a full pro-rata share of the round and out-easrc/CheeseFarm.sol:325

  The controller prices Squeek blocks only when SqueekCore.state().blockHeight moves, which happens when the Reporter certifies a round (about 40 Squeek blocks, up to 16 rounds per settle tx). _accrue() then spreads the whole chunk over totalShares at that moment. A deposit mined just before the settle tx therefore earns as if it had been staked all round, although the code's stated guarantee is that 'new depositors never see earlier emission'.

  The only deterrent is the 15% Hamster Bite on principal; in the CHEESE farm fee and reward are the same unit, so the sandwich is profitable whenever (chunk to the pool) * D/(T+D) > 0.15*D, i.e. while T + D < chunk/0.15 (about 392k CHEESE for one bonus-period round, about 6.3M CHEESE for a 16-round batch), which describes the launch phase. Honest stakers lose the share the attacker takes.

  ETH and sIMD farms have the same accounting (profitability depends on ETH/sIMD vs CHEESE price). Reported by the economics specialist; reproduced here by running its proof (fails on current code: attacker net +14,396.57 CHEESE after paying the 15,000 CHEESE fee, honest staker receives 29,396.57 instead of 58,793.13 CHEESE).

  Fix options that keep 'no cooldown' on principal: weight each pulled chunk by shares present at the previous pull (snapshot totalShares and exclude shares deposited since, forfeiting or sending that portion to the Treasury), or price emission continuously across the round using Core's blockProgress so a chunk is not attributed to one instant.

  whole finding

  CheeseFarmERC20 with CHEESE as asset, controller bound, pool 400 points, activated, h0 captured against a Core double.

  1. honest: deposit(100_000e18).

  2. attacker, same block ahead of the Reporter's settle tx: approve + deposit(100_000e18).

  3. Core certifies one round of 40 new blocks.

  4. attacker: claim(attacker) then withdraw(sharesOf(attacker)).

  Expected: a depositor present for zero certified blocks earns nothing from the round, or at most less than its 15,000 CHEESE exit fee.

  Actual: controller.issued(40)*400/1000 = 58793131200176209960932 reaches the pool; attacker receives 29396565600088104980466 of reward, pays 15,000e18 fee, net +14396565600088104980466; honest pendingRewards rises by 29396565600088104980466 instead of the full chunk.

  Run forge test --match-path test/scratch/RewardJit.t.sol: FAIL 'zero-duration staker profits from a whole round's emission: 14396565600088104980466 > 0'.

  whole reproduction
  proof · a Foundry test the fix has to pass

  // SPDX-License-Identifier: MIT
  pragma solidity 0.8.26;
  
  import {Test} from "forge-std/Test.sol";
  import {CheeseEmissionController} from "src/CheeseEmissionController.sol";
  import {CheeseToken} from "src/CheeseToken.sol";
  import {CheeseFarmERC20} from "src/farms/CheeseFarmERC20.sol";
  import {ISqueekCore} from "src/interfaces/ISqueekCore.sol";
  
  /// @dev Minimal SqueekCore double: certifies rounds in batches exactly as the Reporter's settle tx does.
  contract JitCore is ISqueekCore {
      uint64 public genesis;
      uint64 public settledThroughRound;
      uint96 public units;
      mapping(uint64 => uint96) public unitsAfterRound;
  
      constructor(uint64 genesis_) {
          genesis = genesis_;
      }
  
      function settle(uint64 round, uint64 newBlocks) external {
          units += uint96(newBlocks) * 1_000_000_000;
          for (uint64 r = settledThroughRound + 1; r <= round; ++r) {
              unitsAfterRound[r] = units;
          }
          settledThroughRound = round;
      }
  
      function state() external view returns (CoreState memory s) {
          s.settledThroughRound = settledThroughRound;
          s.cumulativeBlockUnits = units;
          s.blockHeight = uint64(units / 1_000_000_000);
      }
  
      function configuration() external view returns (CoreConfiguration memory c) {
          c.genesisTimestamp = genesis;
          c.roundDuration = 600;
          c.blockUnitsPerBlock = 1_000_000_000;
      }
  
      function roundPage(uint64 afterRound, uint64 throughRound, uint256) external view returns (RoundPage memory p) {
          p.certifiedThroughRound = throughRound;
          p.start.cumulativeBlockUnits = unitsAfterRound[afterRound];
          p.end.cumulativeBlockUnits = unitsAfterRound[throughRound];
      }
  
      function blockInfo(uint64) external pure returns (BlockInfo memory b) {
          return b;
      }
  
      function paused() external pure returns (bool) {
          return false;
      }
  }
  
  /// @notice Emission lands in discrete chunks (one Core round = ~40 Squeek blocks, up to 16 rounds per settle
  ///         tx) and is split by shares held at the moment it is pulled, with no time weighting. A deposit
  ///         placed in the block of the Reporter's settle tx takes a pro-rata share of the whole chunk, and the
  ///         15% exit fee does not cover it whenever the pool's TVL is small against one chunk's emission.
  contract RewardJitTest is Test {
      uint64 constant GENESIS = 1_793_735_400;
  
      address owner = makeAddr("owner");
      address treasury = makeAddr("treasury");
      address honest = makeAddr("honest");
      address attacker = makeAddr("attacker");
  
      JitCore core;
      CheeseEmissionController controller;
      CheeseToken cheese;
      CheeseFarmERC20 farm;
  
      function setUp() public {
          vm.warp(GENESIS + 100 * 600 + 17);
          core = new JitCore(GENESIS);
          controller = new CheeseEmissionController(owner, address(core), treasury);
          cheese = new CheeseToken(owner, owner, owner, address(controller));
          farm = new CheeseFarmERC20(owner, address(controller), address(cheese));
  
          vm.startPrank(owner);
          controller.bindToken(address(cheese));
          controller.addPool(address(farm), 400);
          controller.activate();
          cheese.transfer(honest, 100_000e18);
          cheese.transfer(attacker, 100_000e18);
          vm.stopPrank();
  
          // h0 captured at the end of round startRound - 1; emission starts with the next certified block.
          core.settle(controller.startRound() - 1, 0);
          controller.checkpoint();
          assertTrue(controller.startCaptured());
  
          vm.startPrank(honest);
          cheese.approve(address(farm), type(uint256).max);
          farm.deposit(100_000e18);
          vm.stopPrank();
      }
  
      function test_sameBlockDepositBeforeSettleTakesHalfTheRoundAndProfitsAfterFee() public {
          uint256 attackerBefore = cheese.balanceOf(attacker);
          uint256 honestPendingBefore = farm.pendingRewards(honest);
  
          // Front-run: the attacker's deposit is mined just before the Reporter's settle tx.
          vm.startPrank(attacker);
          cheese.approve(address(farm), type(uint256).max);
          farm.deposit(100_000e18);
          vm.stopPrank();
  
          // The Reporter certifies one ordinary round: 40 Squeek blocks (the documented target).
          core.settle(controller.startRound(), 40);
  
          // Back-run: claim the round's emission and leave, paying the Hamster Bite on principal.
          vm.startPrank(attacker);
          farm.claim(attacker);
          farm.withdraw(farm.sharesOf(attacker));
          vm.stopPrank();
  
          uint256 roundEmissionToPool = (controller.issued(40) * 400) / 1000;
          uint256 honestGets = farm.pendingRewards(honest) - honestPendingBefore;
          int256 attackerProfit = int256(cheese.balanceOf(attacker)) - int256(attackerBefore);
  
          emit log_named_uint("round emission to the CHEESE pool", roundEmissionToPool);
          emit log_named_uint("honest staker (staked all round) receives", honestGets);
          emit log_named_int("attacker net CHEESE after 15% exit fee", attackerProfit);
  
          // A depositor present for one block must not out-earn its exit fee on a round it was not staked for.
          assertLe(attackerProfit, 0, "zero-duration staker profits from a whole round's emission");
      }
  }

  whole proof

• mediumlaunch.json fills the Owner (and so the Guardian) of the controller and all three farms from $owner although the brief fixes the owner address; if the paying wallet is not 0xdea11b3a70b77134424d436f6elaunch.json:7

  The brief names one address for Owner, Treasury, Guardian and the three premints and says to verify that it is the connected requester wallet and never to substitute Swarm agents or Codex wallets.

  The manifest writes the Treasury and the three premint recipients as that static address but writes the owner argument of CheeseEmissionController (line 7), CheeseFarmERC20, CheeseFarmETH and CheeseFarmSIMD as $owner, which resolves to the wallet that paid for the launch (or the request's owner field). The controller constructor also sets guardian = owner_ (src/CheeseEmissionController.sol:162).

  The launch recipe rule for this case is that an owner address the brief itself states is written as that static address instead of $owner. If the launch is paid by any wallet other than 0xdea1...4449 (a Swarm or agent wallet), that wallet becomes owner and guardian of the controller and owner of every farm: it alone can bindToken, addPool, setTreasury, setGuardian, activate, pause/unpause and setAsset, and the requester holds only the premint and Treasury role.

  Nothing on-chain or in the manifest ties $owner to the stated address. Reproduction is against the manifest, not the Solidity, and the condition depends on who pays, hence medium rather than high.

  Fix: write "0xdea11b3a70b77134424d436f6eb455f1abbd4449" as the owner argument of all four Ownable contracts, as already done for the treasury and premint arguments.

  whole finding

  Resolve launch.json with paying wallet P != 0xdea11b3a70b77134424d436f6eb455f1abbd4449.

  Expected per brief: CheeseEmissionController.owner() == guardian() == 0xdea1...4449 and every farm's owner() == 0xdea1...4449.

  Actual: controller.owner() == P, controller.guardian() == P (constructor line 162 'guardian = owner_'), CheeseFarmERC20/ETH/SIMD.owner() == P, while controller.treasury() and the premint balances are at 0xdea1...4449.

  With P == 0xdea1...4449 the manifest is correct, so the defect is the unenforced dependency on the payer identity.

  whole reproduction

• lowHamster Bite floors every share: gross <= 6 wei pays no fee and the Treasury's 1% truncates to zero for gross < 100 wei while the retained 14% still bitessrc/CheeseFarm.sol:209

  fee = floor(gross1500/10000), retained = floor(gross1400/10000), toTreasury = fee - retained. For gross in [1,6] fee is 0 and the withdrawer keeps 100%; for gross in [7,99] the difference can be 0 so the Treasury gets nothing while the retained share takes the whole bite (gross 50: fee 7, retained 7, Treasury 0). The 85/14/1 split in the brief does not hold at small amounts and a withdrawer splitting an exit into <=6-wei pieces pays no fee at all.

  Value at stake is below 1 wei per withdrawal of an 18-decimal asset and gas makes avoidance unprofitable, so this is a precision defect, not a loss vector. FarmFuzz bounds amounts at >= 1e9 wei, so the edge is untested. Reported by the math specialist; reproduced with a probe on the ETH farm.

  Minimal fix: compute the Treasury share directly with ceiling division (Math.mulDiv(gross, TREASURY_FEE_BPS, BPS, Math.Rounding.Ceil)) and derive retained = fee - toTreasury, or round the fee up.

  whole finding

  Fresh CheeseFarmETH: alice.deposit{value:100}() -> 100000 shares; bob.deposit{value:100}() -> 100000 shares. previewWithdraw(6000) returns (gross 6, paid 6, retained 0, toTreasury 0); alice.withdraw(6000) pays alice 6 wei and the Treasury 0 (expected a non-zero 15% fee). previewWithdraw(50000) then returns (gross 50, paid 43, retained 7, toTreasury 0): expected Treasury >= 1 wei whenever the fee is non-zero, actual 0 with the entire 7-wei bite retained. Probe test test_feeRounding in test/scratch/Probe.t.sol passes asserting these values.

  whole reproduction

• lowOne-step renounceOwnership stays callable on the controller and all three farms although the brief forbids renouncing; combined with the guardian-only pause it is an irreversible protocol freezesrc/CheeseEmissionController.sol:222

  The brief says 'Do not renounce ownership' and config/deployment-settings.template.json and docs/OFFICIAL_SEPOLIA.md:157 repeat it as an operational rule, but the contracts do not enforce it: CheeseEmissionController, CheeseFarmERC20, CheeseFarmETH and CheeseFarmSIMD inherit OpenZeppelin Ownable2Step, whose renounceOwnership() (lib/openzeppelin-contracts/contracts/access/Ownable.sol:76-78) sets the owner to address(0) in a single owner-only transaction with no pending step. pauseEmissions() (line 214-215) is open to guardian OR owner while unpauseEmissions() (line 222) is onlyOwner, so once the controller owner is zero a guardian pause can never be lifted: deposits revert forever with EmissionsPausedDepositsClosed, no certified block is ever priced again, and bindToken/addPool/activate/setGuardian/setTreasury are unreachable.

  This is a trust assumption on the owner key (no outsider can trigger it), hence low. Reported by the permissions specialist; reproduced with a probe. Minimal fix preserving the design: override renounceOwnership() to revert in the controller and the farm base, or make it a two-step action.

  whole finding

  Controller bound, two pools added, activated, h0 captured, guardian G set.

  1. owner: controller.renounceOwnership() -> owner() == address(0) (succeeds in one step).

  2. G: pauseEmissions() -> emissionsPaused == true.

  3. G: unpauseEmissions() -> reverts OwnableUnauthorizedAccount.

  4. alice: ethFarm.deposit{value: 1 ether}() -> reverts EmissionsPausedDepositsClosed.

  5. Core certifies 5 more blocks; controller.checkpoint() returns (false, 0).

  Expected per brief: renouncing is impossible or recoverable; actual: permanent freeze.

  Probe test test_renounceThenPauseFreezes in test/scratch/Probe.t.sol passes asserting this sequence.

  whole reproduction

• lowCHEESE (or any non-principal token) sent by mistake to the ETH or sIMD farm is unrecoverable: skimSurplus only measures the principal asset, and rounding dust in rewardReserve is likewise stranded in src/CheeseFarm.sol:397

  skimSurplus() is documented (lines 158-159, 307) as sending 'tokens that were donated or sent by mistake' to the Treasury, but _surplus() reads only _assetBalance(): ETH for CheeseFarmETH, the configured asset for CheeseFarmSIMD.

  The reward token CHEESE also sits in those farms (rewardReserve), so it is the most likely token to be mis-sent to them, yet no entry point moves CHEESE beyond rewardReserve: claim() clamps to rewardReserve (line 239), skimSurplus() reverts NothingToSkim because the principal surplus is 0, and _push moves only the principal asset. The same holds for any ERC-20 other than the principal asset in any farm.

  By the same mechanism the reward rounding dust (accumulator floors at line 325, debt ceils at line 345) accumulates in rewardReserve, up to 1 wei per harvest, and can never be claimed or skimmed in any farm; in the CHEESE farm _surplus() subtracts rewardReserve so it is not surplus either. No staker or Treasury funds are at risk (only mis-routed funds and wei-scale dust), hence low.

  Merged from the flow specialist's finding and the math specialist's dust note (same missing path). Minimal fix preserving the design: an owner-only skimToken(address token) restricted to tokens other than the principal asset and, for CHEESE, to balance minus rewardReserve, sending only to controller.treasury().

  whole finding

  Controller bound, ethFarm registered (200 points), activated. alice.deposit{value: 1 ether}().

  Owner (premint holder): cheese.transfer(ethFarm, 1000e18).

  Expected per NatSpec: owner routes the mis-sent CHEESE to the Treasury via skimSurplus.

  Actual: ethFarm.surplus() == 0, skimSurplus() reverts NothingToSkim, alice.claim(alice) returns 0, cheese.balanceOf(ethFarm) stays 1000e18 with no function able to move it.

  Dust variant: alice and bob deposit 100 wei each, Core certifies 1 block, both claim; rewardReserve stays 1 wei, surplus() == 0, skimSurplus() reverts NothingToSkim.

  Probe tests test_missentCheeseUnrecoverable and test_rewardDustLocked in test/scratch/Probe.t.sol pass asserting these values.

  whole reproduction

• infoTrust assumption: the owner can route up to 100% of future scheduled emission to any contract it registers as a pool (prospective, schedule-bounded)src/CheeseEmissionController.sol:236

  addPool only checks that the candidate answers emissionController() == this and registered() == false; any owner-supplied contract satisfying that is accepted and may then call pullRewards(poolId, true) to have CHEESE minted to itself. With batchSetPoolWeights setting the real pools to 0 the owner can direct the entire remaining schedule to an address of its choice.

  It is bounded: emission stays on SQK's schedule, is never retroactive (lastEmissionPerPoint is set at add time after _requireSync), and principal and already-pulled rewards in the farms are untouched. Acknowledged in docs/SECURITY.md item 16. Recorded as the material privileged power under the brief's 'no arbitrary owner minting' wording; not a permission bypass, no code change required unless pools are to be restricted to known farm code hashes.

  Wired and activated, h0 captured.

  1. owner: batchSetPoolWeights([0,1],[0,0]).

  2. owner: addPool(fake, 1000) where fake returns emissionController() == controller and registered() == false and accepts onPoolRegistered.

  3. Core certifies 5 blocks.

  4. fake calls controller.pullRewards(poolId, true).

  Actual: cheese.balanceOf(fake) == controller.issued(5); the real farms receive nothing for those blocks.

  Probe test test_fakePoolRoutesSchedule in test/scratch/Probe.t.sol passes asserting this.

• infoThe cumulativeEmission == MINING_ALLOWANCE completion branch is unreachable: the schedule totals 591,990 wei less than the allowance and per-pool floors leave further dust unminted (mirrors SqueekMinisrc/CheeseEmissionController.sol:607

  issued(SCHEDULE_BLOCKS) = 1_889_999_999_999_999_999_999_408_010, which is 591_990 wei below ALLOWANCE = 1.89e27 because R0 = 4floor((A-G)/(7H)). cumulativeEmission therefore never equals MINING_ALLOWANCE, _clip() never engages and completion relies solely on the block-count test. Each checkpoint also floors emission1e18/1000 and each settle floors weightdelta/1e18, so totalMinted ends a few thousand wei below cumulativeEmissionactiveWeight/1000.

  The math specialist verified the same values against live SqueekMining.issued() on Sepolia, so this is intended behaviour; recorded so nobody expects totalMinted to reach exactly 2_100_000_000e18.

  controller.issued(1_180_410) returns 1889999999999999999999408010 while MINING_ALLOWANCE() returns 1890000000000000000000000000 (probe test test_scheduleTotal passes asserting both). Driving a Core double to blockHeight = h0 + 1_180_410 and calling checkpoint() sets completed via the block-count condition with cumulativeEmission != MINING_ALLOWANCE.

• infoExit during a Core outage or an emission pause permanently forgoes the withdrawer's share of blocks already certified but not yet priced (documented limitation, under-reported by pendingRewards)src/CheeseFarm.sol:205

  withdraw() and claim() call _accrue() best-effort and proceed when pullRewards returns synced == false (Core unreadable, height regression, or emissionsPaused).

  Squeek blocks certified before the exit but not yet priced are priced at the next successful sync and distributed to whoever holds shares then; the exited account's debt is reset so it never receives them. pendingRewards() excludes the unreadable part (previewPoolEmission returns 0 unsynced emission when Core is unreadable), so a user acting on the view is not told what they leave behind.

  Documented in docs/SECURITY.md items 2 and 11 and accepted by the authors; recorded as a coverage note with a concrete trace, not a defect requiring a code change.

  ETH farm registered and activated, alice and bob deposit 10 ETH each.

  Core certifies 40 blocks (not yet checkpointed), then state() reverts. alice: pendingRewards(alice) reads 0; withdraw(all) succeeds.

  Core recovers; bob: claim() receives the whole chunk 29396565600088104980466 (= issued(40)*200/1000), alice's pendingRewards stays 0.

  Expected by a user reading 'withdrawal availability during Core outages': principal out, rewards for certified blocks preserved; actual: alice's half goes to bob.

  Probe test test_outageExitForfeits in test/scratch/Probe.t.sol passes asserting these values.

  whole reproduction