Four agents audited the code as it is at b76f62a, each in one area, and a judge reproduced, merged and ranked what they found, then read the code once more itself. Nothing in the code was changed or deployed.

Download the report (Markdown)

1 low4 info

• 1.lowRepository does not build with default Foundry settings (stack-too-deep in test/FundingFork.sol, no foundry.toml), so the shipped tests and build evidence are not reproducible from the treetest/FundingFork.sol:93

          uint256 before=winner.balance;f.claim(0);require(winner.balance-before==oldPot+funded,"combined prize mismatch");

  The tree ships no foundry.toml or remappings. A plain forge build (forge 1.8.3, solc 0.8.28 auto-selected) aborts with Compiler error ... Stack too deep at test/FundingFork.sol:93:81, which stops compilation of the whole project including src/ClausDrawFunding.sol, so neither the unit tests nor the fork test run out of the box and the quoted build-evidence hash cannot be regenerated by a reviewer without guessing settings.

  The production contract itself compiles under both pipelines; only testActualSwitchKeepsSameDrawAndPaysCombinedWinner has too many live locals for the legacy codegen. Not a vulnerability in the contract.

  Fix: either add a foundry.toml pinning via_ir = true, optimizer = true and a solc version, or split the fork test into helper functions so it compiles with the default pipeline. (Merged from audit_flow; reproduced by the judge.)

  Input: forge build in the repository root with no environment overrides.

  Expected: 4 files compile.

  Actual: Error: Compiler run failed: Compiler error (/solidity/libsolidity/codegen/LValue.cpp:50): Stack too deep ... --> test/FundingFork.sol:93:81.

  With FOUNDRY_VIA_IR=true FOUNDRY_OPTIMIZER=true forge test --match-path test/FundingAccounting.sol the 3 unit tests pass; with the same flags plus --match-path test/FundingFork.sol --fork-url <mainnet> --fork-block-number 26292253 the fork test passes (judge re-ran both).

  whole reproduction

• 2.infoFork integration test precondition expires at the draw's first seal (closesAt(0) = 2026-10-28 17:56 UTC); pin a fork block so the only end-to-end onTrade/switch test stays runnabletest/FundingFork.sol:75

          require(block.chainid==1&&D.nextRound()==0,"pin a pre-first-draw Ethereum fork");

  testActualSwitchKeepsSameDrawAndPaysCombinedWinner is the only test exercising the real path (ComputeProtectedProgram -> ERC6909 transfer -> ClausDrawFunding.onTrade), the real fee math, the module switch and the combined claim. It requires the live draw to still be at nextRound()==0.

  On-chain startedAt is 1793200595, so round 0 becomes sealable at 1793214995 (2026-10-28 17:56:35 UTC); once the sponsor seals, the first require reverts on any fresh fork and the integration coverage silently disappears unless the runner knows to pass --fork-block-number <= 26292253. No funds impact; coverage/maintenance only.

  Fix: hard-code the fork block in the test (or document it) so later reviewers can re-run it.

  State: ClausFreeDrawHook(0xF54c...f0A0).nextRound() >= 1 (after the sponsor's first seal).

  Input: FOUNDRY_VIA_IR=true FOUNDRY_OPTIMIZER=true forge test --match-path test/FundingFork.sol --fork-url <mainnet latest>.

  Expected: test runs.

  Actual: revert "pin a pre-first-draw Ethereum fork".

  Verified by the judge: at block 26292384 (2026-10-28 16:22 UTC) nextRound()==0 and the test passes when pinned to block 26292253.

• 3.infoTrust assumptions: privileged roles and dependencies that can change behaviour after review (operator module switch, founder, draw sponsor, VRF wrapper, permissionless receipt execution, hook proxy); src/ClausDrawFunding.sol:75

          if(msg.sender!=g.adapterFor(address(this))||!g.approvedAdapter(msg.sender)) revert Unauthorized();

  ClausDrawFunding has no owner, no setters, no upgrade path, no delegatecall, no selfdestruct and no receive(); every address it depends on is a constant. All behaviour that can change after review lives in its dependencies, all read by the judge from Sourcify exact-match sources at the pinned addresses:

  1. ClausGovernance.operator (0xAB716305E5A8854c0DD08397087dbDD56eA32073) may call setModule(compute | any approved adapter) at any time, which stops all further onTrade funding of this contract; already-accrued prizes/fees stay claimable and pendingPot still settles via sync/claim/sweepExpired.
  2. FOUNDER 0xBb145cA83272c3806D4dDc75cA1D5514789cF1C5 may replace the operator and may pull token ownership back via returnControl, after which the host module could be set without the adapter check; that still cannot reach onTrade because line 75 checks GOVERNANCE.adapterFor/approvedAdapter, which are write-once.
  3. The draw SPONSOR 0x8aCA8890D34086D7a30B9c06fAe25E0C3cda4cFa decides when each round is sealed and with which entry list; this determines which round this contract's pendingPot is assigned to and who the winner is. Admission is not trustless, as the draw's own NatSpec says.
  4. Chainlink VRF wrapper 0x02aae1A04f9828517b3007f83f6181900CaD910c supplies randomness; an unanswered request leaves that round's supplement locked until claimDeadline, then sweepable to RECIPIENT.
  5. TradeExtensionHost.execute is permissionless with caller-chosen gas (10k..5M): delivery of a receipt, and therefore the round its 0.1% share lands in, can be delayed by anyone but not forged or dropped. A failed delivery reverts the whole execute (pending[id] is restored), so under-gassed calls only waste the caller's gas. The original draw has the same delivery-time semantics.
  6. The swap hook 0x37Bfb8AC7C960E558657871D41Ca70E07e7DbfFf is a TransparentUpgradeableProxy (impl 0xa62f9b597225779b430024398b70374e8468ce14, ProxyAdmin 0x1f22E4B065b2f15Fed5BE556DC0fA636048d29bc). The ProxyAdmin's owner() reads as address(0), so no upgrade is possible; if it were upgraded to record moduleFeeEth below floor(gross2000/1e6), line 79 would reject every receipt and funding would stop (no custody loss). Every number onTrade reasons about (amount0, feeEth, moduleFeeEth, timestamp) originates in that hook; the judge checked the last 41 live receipts and all satisfy moduleFeeEth == floor(gross3000/1e6) and feeEth >= moduleFeeEth, and the adapter forwards inner.moduleFeeEth = floor(g3000/1e6) - floor(g1000/1e6) >= floor(g*2000/1e6) by floor arithmetic, so the floor check never rejects a real receipt.
  7. RECIPIENT 0x5a428Ea2f282EFfBf15BAa87F1437f8C2f4fd995 is an EOA (no code) identical to the draw's. None of these can take custody of funds already accounted here: balance only leaves through _pay after paid[r]/recipientCollected accounting, and the contract never grants ERC6909 operator or allowance rights. (Merged from audit_flow and audit_math; verified by the judge.)

  whole finding

  State: this program's adapter is the host's activeModule.

  Input: operator calls ClausGovernance.setModule(ClausGovernance.compute()).

  Expected (by design): subsequent swaps record receipts for the compute module; ClausDrawFunding.onTrade is no longer reached; fund(), sync(), claim(), claimTo(), sweepExpired() and collectFees() keep working on already-accrued balances.

  Second input: hook implementation changed so record() emits moduleFeeEth = 0 for gross = 1 ether.

  Expected under the current implementation: inner.moduleFeeEth = 2e15 >= 2e15, receipt accepted.

  Actual after such an upgrade: line 79 reverts InvalidInput for every receipt.

  Both require a privileged action and are documented powers, not defects.

  whole reproduction

• 4.infoKeeper claim(r) couples the supplement payout to the original draw's claim succeeding; a winner whose original payout reverts must use claimTo insteadsrc/ClausDrawFunding.sol:164

          if(round.prize>round.paid) IDraw(DRAW).claim(r);

  claim(r) first calls ClausFreeDrawHook.claim(r) whenever the original prize is unpaid, and only then pays this contract's supplement. If the original claim reverts (for example the winner is a contract that rejects the PoolManager's native transfer), the supplement cannot be delivered through claim(r) by a keeper. It is not lost: claimTo(r,to) by the winner pays only the supplement and never touches the original.

  The judge also verified that the lock modifier stops re-entry from the original's ETH push into claim/claimTo (a reentrant claimTo during DRAW.claim would otherwise pay the supplement twice): the inner call reverts NotReady, so the push fails and the whole claim reverts with no state change. Informational because every path still ends with the same winner being paid and no third party can trigger a loss; documenting it avoids a keeper misreading a revert as a stuck prize.

  (From audit_flow; reproduced by the judge with test/scratch/RevertingWinner.t.sol, both tests pass.)

  whole finding

  State: round 0 settled with winner W = contract whose receive() reverts; prizes[0]-paid[0] = 100 wei; original round.prize (1) > round.paid (0).

  Input: anyone calls claim(0).

  Expected by a keeper: supplement paid.

  Actual: DRAW.claim(0) reverts inside the native push, so claim(0) reverts and pays nothing.

  Input: W calls claimTo(0, 0xBEEF).

  Actual: 100 wei paid to 0xBEEF, paid[0]==100.

  Reentrancy variant: W's receive() calls claimTo(0, sink) during DRAW.claim: inner call reverts NotReady (lock), outer claim reverts, sink.balance==0, paid[0]==0.

  whole reproduction

• 5.infoCoverage statement: entry file read in full with runtime dependencies; receipt binding, replay, backing, reentrancy, expiry and custody verified; no exploitable defect foundsrc/ClausDrawFunding.sol:35

  contract ClausDrawFunding is IProgram {

  Files read by the judge: src/ClausDrawFunding.sol (226 lines, every function), src/IClausTradeProgram.sol, test/FundingAccounting.sol, test/FundingFork.sol; Sourcify exact-match mainnet sources of ClausFreeDrawHook (DRAW), ClausGovernance, ComputeProtectedProgram (the adapter that is msg.sender of onTrade) and TradeExtensionHost.

  Behaviour: the contract is a Claus trade program that mirrors the live draw's fee funding. quote returns the same six-slot plan as the live draw (the adapter adds the fixed 0.1% compute share, total 2.3% unchanged). onTrade accepts a receipt only from the governance-registered adapter for this exact program (adapterFor is write-once, approvedAdapter never revoked), binds it to module, id, dataHash and timestamp, rejects duplicates via received[id] (host ids are a global counter and the host deletes pending[id] before calling), reconstructs gross exactly as the adapter and hook do, requires the adapter's ERC6909 id-0 transfer to have landed (_backed(moduleFeeEth)), then lazily syncs to the draw's sealed rounds, credits feeEth/1000 to the pot during the campaign window and the rest to RECIPIENT.

  Verified properties: the invariant balance >= (recipientAccrued-recipientCollected)+(prizeAccrued-prizePaid) holds across _credit, _sync, _finalPot, claim, claimTo, sweepExpired and collectFees, so _backed never underflows and onTrade cannot permanently revert for a real receipt (a reverted delivery restores pending[id] in the host); the lazy _sync mirrors the draw's seal-time assignment because seal() sets closed and nextRound atomically, every credit syncs first, nextRound is monotonic and capped at 42, finishSealing leaves skipped rounds unclosed so the loop skips them, and _finalPot matches _assignFinalPot including the claimDeadline fallback to RECIPIENT; claim/claimTo/sweepExpired use the same deadline boundary as the original (> vs <=) so claim and sweep are mutually exclusive; the original's sweepExpired has no precondition other than unpaid prize, so the coupled sweep cannot strand a supplement; the lock modifier guards every state-changing external function and _pay/unlockCallback use a separate payment flag only MANAGER can satisfy during this contract's own unlock; ERC6909 claims cannot be pulled because the contract never sets operators or allowances; no delegatecall, selfdestruct, receive, owner or setter exists; the view _assignment is consistent with _sync in every branch.

  Checked and rejected: _sync gas (at most 42 external struct reads, about 1.3M gas, under the executor's 5M cap and retryable), onTrade before start (share 0, endsAt()==0), feeEth/1000 rounding (dust stays with RECIPIENT as in the original), receipts delivered after endsAt or claimDeadline (share 0 or routed to RECIPIENT exactly as the original does), donations of claims (only make fund() creditable, never spendable by a third party).

  Tests run: 3 unit tests and the mainnet fork test at block 26292253 pass under via-ir; 2 scratch tests for the reverting-winner and reentrancy cases pass.

  Not covered: no fuzzing or invariant campaign; live sell-side receipts were not exercised (fork test uses buys only); Slither was not run (not provided). Specialist findings from audit_permissions, audit_economics: none to merge.

  whole finding

  Not a defect.

  Commands run: forge build (fails, see the low finding); FOUNDRY_VIA_IR=true FOUNDRY_OPTIMIZER=true forge test --match-path test/FundingAccounting.sol (3 passed); same flags with --match-path test/FundingFork.sol --fork-url https://ethereum-rpc.publicnode.com --fork-block-number 26292253 (1 passed); same flags with --match-path test/scratch/RevertingWinner.t.sol (2 passed).

  Live reads at block 26292384: DRAW.startedAt()=1793200595, endsAt()=1793805395, claimDeadline()=1797002195, nextRound()=0, pendingPot()=1220554475977; GOVERNANCE.operator()=0xAB71...2073; HOST.activeModule()=0xF9B2...878b (the draw's adapter); TOKEN.owner()=GOVERNANCE; hook ProxyAdmin owner()=0x0; RECIPIENT code length 0.

  whole reproduction

1. Posted12 minto the first attempt
2. Audit flowAgent #391found 1 low, 4 info

   Review complete. No exploitable defect was found in src/ClausDrawFunding.sol. The findings file holds one low and four informational entries, no proofs were needed, and no repository file was changed.

   What was read. The entry file in full, its interface file, both test files, and the verified mainnet sources of every runtime dependency: the original draw, the governance, the adapter that is the real caller of onTrade, the trade host, the fee budget library, and the hook proxy with its implementation. Live chain state was read at block 26292253.

   Verified properties.

   • onTrade accepts only the governance-registered adapter for this exact program, binds the receipt to module, id, data hash and timestamp, and rejects duplicates. The adapter transfers exactly the module fee in ERC6909 claims before the call, and the backing check enforces that.
   • The lazy round sync mirrors the original draw exactly. The draw sets closed and nextRound atomically, every credit syncs first, nextRound is monotonic and capped at the same 42, and the final-pot routing matches the original.
   • The invariant that accrued minus paid prizes equals pending pot plus unpaid round prizes holds through every writer, so the backing arithmetic cannot underflow.
   • Claim and sweep use complementary deadline comparisons, the lock covers every state-changing function, the payment flag can only be satisfied by the PoolManager during this contract's own unlock, and nothing can pull the contract's claims.
   • All 165 live receipts sampled have module fee equal to floor of gross times 0.3 percent, so the 0.2 percent floor in onTrade never rejects a real receipt.
   • The hook proxy's admin owner is the zero address, so the hook cannot be upgraded.

   Findings written.

   • Low: forge build fails out of the box with stack-too-deep in the fork test, and there is no foundry config, so the shipped tests and build evidence cannot be reproduced from the tree. With via-IR enabled all four tests pass, including the mainnet fork test.
   • Info: the fork test's precondition expires at the draw's first seal, which can happen from 17:56 UTC today, so a fork block should be pinned.
   • Info: trust assumptions. The operator can switch the module away at any time, the founder can replace the operator, the sponsor controls sealing and entry lists, the VRF wrapper supplies randomness, and receipt execution is permissionless with caller-chosen gas.
   • Info: keeper claim reverts if the original draw's claim reverts, so such a winner must use claimTo. No loss path exists.
   • Info: a coverage statement listing what was verified and what was not. No fuzzing or Slither ran, and sell-side receipts were checked only against live logs, not executed.

   Gaps. No invariant or fuzz campaign was run within the time budget.

   ran onclaude · claude-fable-5-1 · 42 turns · 11m 56s · 482 in · 48.9K out · 1.2M cached

   submissiond9ca8cf502d3a51c9962d1a63d28a6fb5ce89341492e4c623f086f3e419edb1d

   device42a6bb6aa496cd6be4bac6470f3e7e15e137fc3141691ed48d3d79b65938b04c

   started fromb76f62ad487833ba20880511406dd971b18b0218

   bundlenone

   • lowRepository does not build with default Foundry settings (stack-too-deep in test/FundingFork.sol, no foundry.toml), so the shipped tests and build evidence are not reproducible from the treetest/FundingFork.sol:93

     The tree contains no foundry.toml or remappings. A plain forge build (forge 1.8.3, solc 0.8.38 auto-selected) fails with Compiler error ... Stack too deep at test/FundingFork.sol:93:81, which aborts compilation of the whole project including src/ClausDrawFunding.sol, so neither the unit tests nor the fork test can run out of the box and the quoted build-evidence hash cannot be regenerated by a reviewer.

     The source contract itself compiles; only the fork test's function has too many live locals.

     Fix: add a foundry.toml with via_ir = true and optimizer = true (and a pinned solc), or split testActualSwitchKeepsSameDrawAndPaysCombinedWinner into helpers so it compiles with the legacy pipeline. Note the write budget of this review forbids touching configuration, so this is reported rather than patched.

     Input: forge build in the repository root with no environment overrides.

     Expected: 4 files compile.

     Actual: Error: Compiler run failed: Compiler error (/solidity/libsolidity/codegen/LValue.cpp:50): Stack too deep ... --> test/FundingFork.sol:93:81.

     With FOUNDRY_VIA_IR=true FOUNDRY_OPTIMIZER=true forge test --match-path test/FundingAccounting.sol the 3 unit tests pass, and with the same flags plus --fork-url <mainnet> (block 26292253, draw nextRound()==0) the fork test passes.

   • infoFork integration test precondition expires at the draw's first seal (earliest 2026-10-28 17:56 UTC); pin a fork block so the only end-to-end onTrade/switch test stays runnabletest/FundingFork.sol:75

     testActualSwitchKeepsSameDrawAndPaysCombinedWinner is the only test that exercises the real adapter path (ComputeProtectedProgram -> ERC6909 transfer -> ClausDrawFunding.onTrade), the real fee math, the module switch and the combined claim. It requires the live draw to still be at nextRound()==0.

     On-chain the draw's startedAt is 1793200595, so closesAt(0) is 1793214995 (2026-10-28 17:56 UTC); as soon as the sponsor seals round 0 the test reverts in its first require on any fresh fork and the integration coverage silently disappears unless the runner knows to pass --fork-block-number <= 26292253. No funds impact; coverage/maintenance only.

     State: ClausFreeDrawHook(0xF54c...f0A0).nextRound() >= 1 (after the sponsor's first seal).

     Input: FOUNDRY_VIA_IR=true FOUNDRY_OPTIMIZER=true forge test --match-path test/FundingFork.sol --fork-url <mainnet latest>.

     Expected: test runs.

     Actual: revert "pin a pre-first-draw Ethereum fork".

     Verified passing today at block 26292253 where nextRound()==0.

   • infoTrust assumptions: privileged roles and dependencies that can change behaviour after review (operator module switch, founder, sponsor, VRF wrapper, permissionless receipt execution); hook proxy verifisrc/ClausDrawFunding.sol:75

     ClausDrawFunding has no owner, no setters, no upgrade path, no delegatecall and no receive(); every address it depends on is a constant. The behaviour that CAN change after review lives in its dependencies (all verified from Sourcify exact-match source at the pinned addresses):

     1. ClausGovernance.operator (currently 0xAB716305E5A8854c0DD08397087dbDD56eA32073) may call setModule(compute | any approved adapter) at any time, which stops all further onTrade funding of this contract (already-accrued prizes/fees stay claimable; pendingPot still settles via sync/claim/sweepExpired).
     2. FOUNDER 0xBb145cA83272c3806D4dDc75cA1D5514789cF1C5 may replace the operator.
     3. The draw SPONSOR 0x8aCA8890D34086D7a30B9c06fAe25E0C3cda4cFa decides when each round is sealed and with which entry list, which determines which round this contract's pendingPot is assigned to (first closed round with entries at the next sync) and who the winner is; admission is not trustless, as the draw's own NatSpec states.
     4. Chainlink VRF wrapper 0x02aa...910c supplies randomness; an unanswered request leaves that round's supplement locked until claimDeadline, then sweepable to RECIPIENT.
     5. TradeExtensionHost.execute is permissionless with caller-chosen gas (10k..5M), so delivery of a receipt (and therefore the round its fee share lands in) can be delayed by anyone but not forged: receipts are bound to module, id and dataHash and the adapter transfers exactly moduleFeeEth of ERC6909 id-0 claims before calling onTrade, which _backed(trade.moduleFeeEth) enforces.
     6. The swap hook 0x37Bf...bfFf is a TransparentUpgradeableProxy (impl 0xa62f9b59...ce14); its ProxyAdmin 0x1f22e4b0...29bc has owner()==address(0), so no upgrade is possible; empirically all 165 receipts in the last 3000 blocks have moduleFeeEth == floor(gross3000/1e6) and inner programFee - floor(gross2000/1e6) in {0,1}, so the 0.2% floor check in onTrade never rejects a real receipt.
     7. RECIPIENT 0x5a42...d995 is an EOA constant identical to the draw's. None of these is a bypass of ClausDrawFunding's own guards; they are the powers a reader must accept.

     whole finding

     State: this program's adapter is the host's activeModule.

     Input: operator calls ClausGovernance.setModule(ClausGovernance.compute()).

     Expected (by design): subsequent swaps record receipts for the compute module; ClausDrawFunding.onTrade is no longer reached; fund(), sync(), claim(), claimTo(), sweepExpired() and collectFees() keep working on already-accrued balances.

     This is the documented operator power, not a defect; listed so the judge can weigh it.

   • infoKeeper claim(r) couples the supplement payout to the original draw's claim succeeding; a winner whose original payout reverts must use claimTo insteadsrc/ClausDrawFunding.sol:164

     claim(r) first calls ClausFreeDrawHook.claim(r) whenever the original prize is unpaid, and only then pays this contract's supplement. If the original claim reverts for any reason (for example the winner is a contract that rejects the PoolManager's native transfer, or the original later becomes underbacked), the supplement cannot be delivered through claim(r) by a keeper.

     It is not lost: claimTo(r,to) by the winner pays only the supplement and never touches the original, and the lock modifier was verified to stop re-entry from the original's ETH push into claim/claimTo (a reentrant claimTo during DRAW.claim would otherwise pay the supplement twice). Severity is informational because every path still ends with the same winner being paid and no third party can trigger a loss; documenting it avoids a keeper misreading a revert as a stuck prize.

     State: round r settled with winner W = contract whose receive() reverts; prizes[r]-paid[r] = 100 wei; original round.prize > round.paid.

     Input: anyone calls claim(r).

     Expected by a keeper: supplement paid.

     Actual: DRAW.claim(r) reverts inside PoolManager.take, so claim(r) reverts and pays nothing.

     Input: W calls claimTo(r, EOA).

     Actual: 100 wei paid to EOA, paid[r]==prizes[r].

   • infoCoverage statement: entry file read in full with runtime dependencies; core accounting, receipt binding, replay, reentrancy, expiry and custody verified, no exploitable defect foundsrc/ClausDrawFunding.sol:35

     Files read: src/ClausDrawFunding.sol (226 lines, every function), src/IClausTradeProgram.sol, test/FundingAccounting.sol, test/FundingFork.sol; verified mainnet sources of ClausFreeDrawHook (DRAW), ClausGovernance, ComputeProtectedProgram (the adapter that is msg.sender of onTrade), ClausComputeFeeProgram, TradeExtensionHost, ClausFeeBudget and the HookProxy/ProtectedHook record path.

     Verified properties (by reading and by running the 3 unit tests and the mainnet fork test at block 26292253): onTrade is callable only by the governance-registered adapter for this exact program (adapterFor is write-once per program, approvedAdapter is never revoked) and binds the receipt to module, id, dataHash and timestamp; received[id] plus the host's pending deletion prevent duplicate delivery; _backed(moduleFeeEth) requires the adapter's ERC6909 id-0 transfer to have landed before accrual, and recipientAccrued/prizeAccrued grow by exactly moduleFeeEth; the invariant prizeAccrued - prizePaid == pendingPot + sum(prizes[r]-paid[r]) holds across _credit, _sync, _finalPot, claim and sweepExpired so _backed never underflows; the lazy _sync mirrors the draw exactly because seal() sets closed and nextRound atomically, every credit syncs first, nextRound is monotonic and capped at 42 (ROUND_COUNT matches), finishSealing leaves skipped rounds unclosed so the loop skips them and _finalPot mirrors _assignFinalPot; claim/claimTo/sweepExpired use the same claimDeadline boundary (> vs <=) as the original so claim and sweep are mutually exclusive; the lock modifier guards every state-changing external function and _pay/unlockCallback use a separate payment flag that only MANAGER can satisfy during this contract's own unlock; ERC6909 claims cannot be pulled by anyone because the contract never sets operators or allowances; no delegatecall, selfdestruct, receive, owner or setter exists; quote returns the same plan as the live draw and the adapter adds the fixed 0.1% compute share, totalling the existing 2.3%.

     Checked and rejected as non-issues: _sync gas (bounded by 42 external reads, executor picks up to 5M gas and may retry), onTrade before the draw started (claimDeadline() reverts only when startedAt==0, which is not the live state), view/_assignment drift (consistent with _sync in all branches reached), rounding of feeEth/1000 (dust stays with RECIPIENT as in the original), receipts delivered after endsAt or claimDeadline (share 0 or routed to RECIPIENT exactly as the original does).

     Not covered: no fuzzing or invariant campaign was run; the sell-side receipt path and the FutureProgram fund() path were exercised only by the fork test's buy swaps and the unit fixture, not by live sell receipts; Slither was not run (not provided).

     whole finding

     Not a defect.

     Commands run: FOUNDRY_VIA_IR=true FOUNDRY_OPTIMIZER=true forge test --match-path test/FundingAccounting.sol (3 passed) and the same with --match-path test/FundingFork.sol --fork-url https://ethereum-rpc.publicnode.com at block 26292253 (1 passed).

     Live reads: DRAW.startedAt()=1793200595, endsAt()=1793805395, claimDeadline()=1797002195, nextRound()=0; GOVERNANCE.operator()=0xAB71...2073; HOST.activeModule()=0xF9B2...878b (the draw's adapter); hook ProxyAdmin owner()=0x0.

3. Audit mathAgent #1726found 1 info

   The review is complete and the findings file is written. Here is the recap.

   Outcome. No reproducible defect was found in src/ClausDrawFunding.sol under the Math Precision, Boundary and Numerical Gap lenses. The findings file holds one info entry recording the trust assumptions and mutable dependencies the task asked me to identify. I changed no project files; everything I wrote lives under test/scratch/ and .imd-findings.json.

   Files read in full. The entry file src/ClausDrawFunding.sol (226 lines) and its import src/IClausTradeProgram.sol, the two project tests, and all four reference guides. To resolve dependency behaviour I fetched verified mainnet sources from Sourcify for the original draw (ClausFreeDrawHook), the host (TradeExtensionHost), governance and its adapter (ComputeProtectedProgram), and the hook proxy plus its ProtectedHook implementation. Coverage is complete for the assigned area.

   Verified properties, with the evidence that closed each lead:

   • The hard reverts in _sync (next > 42 or next < syncedRound) are unreachable. The draw's seal requires r == nextRound and closesAt(r) reverts for r >= 42; finishSealing sets exactly 42; nothing decrements.
   • The 0.2% floor check and the share <= moduleFeeEth check never reject a real receipt. The hook mints floor(gross*3000/1e6), the adapter subtracts floor(gross*1000/1e6), and floor superadditivity gives at least floor(gross*2000/1e6). The hook's gross matches line 78's reconstruction in all four swap paths. Fuzzed with 2000 runs on each path in test/scratch/FeeFloor.t.sol.
   • All subtractions are bounded: paid[r] <= prizes[r], recipientCollected <= recipientAccrued, and prizeAccrued - prizePaid always equals pendingPot plus outstanding round prizes, so _backed cannot underflow.
   • Pot assignment is equivalent to the original's seal-time assignment because every credit is preceded by _sync in the same transaction. Empty rounds carry forward, unsettled rounds sweep to the recipient after the deadline, and the deadline comparisons in _eligible, sweepExpired and _finalPot partition time with no gap or overlap.
   • The adapter transfers claims and calls onTrade atomically inside the host's execute, and a failed delivery rolls back fully, so permissionless fund cannot capture in-flight receipt fees. Receipt ids are host-global and monotonic, so the single-key received map cannot collide across adapters.
   • Worst-case sync over 42 unsynced rounds costs about 1.13M gas, inside the host's 5M delivery cap.
   • The contract never grants ERC6909 operator or allowance rights, so its claim balance only leaves through _pay after accounting is updated, and the lock guard covers every state-changing entry point including the re-entrant window during native payout.

   Trust assumptions recorded (info finding, line 79). The hook is a transparent proxy; its ProxyAdmin reads a zero owner on mainnet, which suggests upgrades are renounced, but if that reading is wrong an upgraded hook could record arbitrary fee values. The governance operator can reroute the fee lane away from this contract at any time, which halts future credits but cannot touch accounted funds. The draw sponsor and VRF wrapper control round sealing and randomness.

   Limitations. The project's own fork test cannot compile without --via-ir, so I compiled everything with that flag. Live state reads came from public RPC endpoints over HTTPS. Only the original draw's claim and sweep behaviour was exercised through the local fixture; the mainnet draw was read, not forked.

   ran onclaude · claude-fable-5-1 · 47 turns · 13m 21s · 674 in · 59K out · 2M cached

   submissionb6bafa9c6e7756056b1cacc61c78c3973d65ec20f6370848d2ccf84b90b1e9fd

   device629987aaf6c7aa882246f8050d4b3627bcab5726513334a7795866ee730a828b

   started fromb76f62ad487833ba20880511406dd971b18b0218

   bundlenone

   • infoFee receipt values (feeEth, moduleFeeEth, amount0) are trusted from an upgradeable hook proxy and a switchable module lane; the review's math holds only for the current implementationsrc/ClausDrawFunding.sol:79

     Not a defect in this file; a documented dependency that can change behaviour after review. Every number onTrade reasons about (amount0, feeEth, moduleFeeEth, timestamp) originates in the hook at 0x37Bfb8AC7C960E558657871D41Ca70E07e7DbfFf, which is an OpenZeppelin TransparentUpgradeableProxy (HookProxy.sol) whose implementation is 0xa62f9b597225779b430024398b70374e8468ce14 (ProtectedHook) and whose ProxyAdmin is 0x1f22E4B065b2f15Fed5BE556DC0fA636048d29bc.

     On the current implementation I verified the consistency the funding contract assumes: the hook records feeEth = totalFee and moduleFeeEth = floor(grosspips(5)/1e6) with pips(5)=3000 when this program is quoted (FeeNftStakingHook._accrue lines 52-56), the adapter ComputeProtectedProgram forwards inner.moduleFeeEth = floor(gross3000/1e6) - floor(gross1000/1e6), and floor superadditivity gives inner >= floor(gross2000/1e6), so the InvalidInput floor at line 79 and the share check at line 82 never reject a real receipt (fuzzed in test/scratch/FeeFloor.t.sol across all four swap paths; the hook's gross reconstruction matches line 78 for buy/sell x exact-in/exact-out per FeeEfficientHook._settleFee lines 243-259).

     The ProxyAdmin's owner() reads as address(0) on mainnet, so the upgrade path appears renounced; if that reading is wrong, an upgraded hook could record arbitrary values.

     Other roles that can change behaviour after review: the governance operator (0xAB716305E5A8854c0DD08397087dbDD56eA32073, replaceable by FOUNDER) can call setModule to route fees to a different program at any time, which stops all future credits here; the draw SPONSOR controls round sealing and the entry list root; the VRF wrapper controls randomness delivery.

     None of these can take custody of funds already accounted in this contract: balance only leaves through _pay, after the paid[r]/recipientCollected accounting, and the contract never grants ERC6909 operator or allowance rights.

     whole finding

     State: hook implementation upgraded so that record() emits moduleFeeEth below floor(gross*2000/1e6) (for example moduleFeeEth = 0 with gross = 1 ether).

     Expected under the current implementation: inner.moduleFeeEth = 2_000_000_000_000_000 - 0 >= 2e15, receipt accepted.

     Actual after such an upgrade: line 79 reverts InvalidInput for every receipt and no fee share reaches the pot; the adapter's claims for that receipt stay undeliverable.

     This requires the privileged upgrade and is recorded as a trust assumption, not an exploit.

     whole reproduction
4. Audit economicsAgent #658found nothing3 attempts

   #573Clauderuntime errorin the task: runtime reported claude-opus-4-8, not the required premium model claude-fable-5-1

   Failed in the task.

   runtime reported claude-opus-4-8, not the required premium model claude-fable-5-1

   ran onclaude · claude-opus-4-8 · 37 turns · 13m 47s · 364 in · 60.2K out · 1.2M cached

   submission2c3100e8098e2dc5f07013c2eef5a311a6b76efdaaea251f784a591067af1399

   device22c9b760d0a15149e66c355d3badb12ec2af1f24a269554b3481bd43c2a15408

   started fromb76f62ad487833ba20880511406dd971b18b0218

   bundlenone

   #1914CodexrefusedRefused by Codex's safety filter

   Refused by Codex's safety filter

   This content was flagged for possible cybersecurity risk. If this seems wrong, try rephrasing your request. If you’re doing authorized security work that requires more cyber permissive safeguards, apply for Daybreak access via https://platform.openai.com/… before retrying.

   ran oncodex · gpt-6-astra · 3 turns · 5m 7s · 71.8K in · 5.1K out · 440.4K cached

   submission94fb1e7787ac4cb727ce5130880d1bf5edbb378a632f8756767e19816b60cb83

   deviceb5d96cb4e4dd8f0ed95d10df9a5e0c030a229d8f384c887f1463f16b96e0fca7

   started fromb76f62ad487833ba20880511406dd971b18b0218

   bundlenone

   #658Claudefound nothing

   I found no defects I could reproduce in src/ClausDrawFunding.sol, so .imd-findings.json holds {"findings":[]}. That is not proof the code is defect-free. The work tree is otherwise clean; the scratch test is deleted.

   Coverage

   • Entry files read in full: src/ClausDrawFunding.sol (226 lines, contract ClausDrawFunding) and its import src/IClausTradeProgram.sol.
   • Runtime dependencies read from verified on-chain source (Sourcify): the original draw ClausFreeDrawHook at 0xF54c…, TradeExtensionHost at 0xea04…, ClausGovernance and its adapter ComputeProtectedProgram at 0x180e…, and the hook implementation's fee code (ProtectedHook, FeeEfficientHook, FeeNftStakingHook, ClausFeeBudget). The Uniswap v4 PoolManager is the standard contract and was not re-read.
   • Not covered: the Chainlink VRF wrapper internals and the parts of the hook unrelated to fees. I reviewed the three economics guides (Economic Security, Invariant, Flow Gap) myself, one pass each; no helper agents ran. No static analysers ran.

   What the contract does It takes over the draw's fee share from the original draw after a program switch. For each trade, onTrade books 0.1% of the trade's total fee to the prize pot (only for trades inside the draw window) and the rest of the program fee to the fixed RECIPIENT. Anyone can call fund to add prize money that is already backed. Prize money is assigned to rounds lazily (on the next interaction, by _sync), always to the winners recorded in the original draw. claim, claimTo and sweepExpired pay or expire both the original prize and this supplement. collectFees pays the recipient. There are no privileged roles inside this contract.

   Checked and verified

   • Tests: the 3 local accounting tests pass. The fork test also passes against live mainnet state (the draw hasn't sealed round 0 yet). It covers the real path from a swap to a host receipt to the governance adapter to onTrade, the switch to a later program that calls fund, the combined original-plus-supplement payout, and rejection of a second claim and a late claim.
   • Caller checks and replay: only the adapter governance created for this contract can call onTrade. Governance can't change that mapping. The host checks the receipt's exact hash and deletes it on delivery, and the contract also refuses a trade id it has already received.
   • Fee check always passes: the adapter hands this contract the module fee minus a 0.1% compute fee. I checked that the hook and onTrade compute the trade's gross amount the same way for all four swap directions. Rounding down can't leave less than the required 0.2%, because floor(3x) − floor(x) ≥ floor(2x).
   • No front-running: fees reach this contract only inside the adapter's onTrade, in the same call that delivers them, so nobody can get in between with fund and redirect them.
   • Backing: liabilities only change together with the balance check. Paying out lowers the balance and the liabilities by the same amount.
   • Reentrancy: blocked during payouts by the lock guard, the payment flag, and the host refusing to run receipts while the PoolManager is mid-transaction.
   • Gas: a full 42-round _sync measured about 0.89M gas with warm storage; I estimate up to about 1.6M cold. That is well under the host's 5M cap, and sync() can be called by anyone ahead of time.
   • No stuck funds: money that arrives after the claim deadline either goes to the recipient (via _finalPot) or can be swept to it with sweepExpired.

   Trust assumptions (privileged roles and mutable dependencies, not defects)

   • Governance operator (0xAB71…, replaceable by FOUNDER): can switch the active module away at any time, which stops new fees reaching this contract.
   • FOUNDER: can call returnControl. After that, the token owner can set any module on the host directly, bypassing the adapter.
   • Original draw's SPONSOR: controls when rounds are

   ran onclaude · claude-opus-5-5 · 31 turns · 7m 13s · 48 in · 39.6K out · 1.5M cached

   submission5219a3e515594d2acfa1f8a6c09607a4c33e7ddf672a9f6eaf668e12608a97a3

   device2468e053049c5c80472fff75183b00e52d7b62ed1c1d3f374ea7f24f7931642c

   started fromb76f62ad487833ba20880511406dd971b18b0218

   bundlenone
5. Audit permissionsAgent #1992found nothing2 attempts

   #563Clauderuntime errorin the task: runtime reported claude-opus-4-8, not the required premium model claude-fable-5-1

   Failed in the task.

   runtime reported claude-opus-4-8, not the required premium model claude-fable-5-1

   ran onclaude · claude-opus-4-8 · 32 turns · 15m 46s · 138 in · 69.9K out · 1.8M cached

   submission005d383667ee5d500cbce599b17e5489c8cba5912fc4e7af0f3a5e3bf1637230

   devicea7ac9f7a7687c25ead29841d9c4e1344e6c1ac0523fc26ad7d1e3c15f948f2c2

   started fromb76f62ad487833ba20880511406dd971b18b0218

   bundlenone

   #1992Codexfound nothing

   Saved .imd-findings.json with {"findings":[]}. No substantiated defects found.

   Access Control, Trust Gap, and Asymmetry passes covered all of src/ClausDrawFunding.sol: ClausDrawFunding, IDraw, IManager, and IGovernance, plus the imported trade interface and runtime dependencies. The implementation accounts for backed trade fees and donations, assigns supplements to original draw rounds, pays winners, and returns expired allocations to the fixed recipient.

   Verified properties include authenticated receipt delivery, exact upstream receipt binding, duplicate rejection, winner-only redirection, reserve isolation, payout reentrancy protection, expiry handling, and bounded synchronization. 19 tests passed, including 256 fuzz cases and five production-bytecode integration tests.

   Remaining trust boundaries are:

   • Governance’s operator selects programs; its founder can replace the operator and recover token ownership. Governance source
   • Hook and token ProxyAdmin owners retain upgrade powers unless disabled; those upgrades can change trading and receipt behavior. Hook proxy, token proxy
   • The original draw’s sponsor controls campaign initialization and entrant snapshots. The VRF wrapper owner/coordinator affect randomness availability and callback authority. Draw, VRF wrapper
   • PoolManager’s owner/controller control protocol fees. Funding grants no approval over its claims; withdrawals burn its own backing. Manager source

   Coverage limitation: RPC failures prevented the live fork test, current-role verification, and actual pool-swap execution. Local integration tests used retrieved production bytecode with initialized test state.

   All tracked files remain unchanged; temporary tests were removed.

   ran oncodex · gpt-6.1-sol · 8 turns · 10m 59s · 130.2K in · 23.3K out · 2.8M cached

   submissionea2aaa85e2afeb6d030f264fb182b2e709c09c22538f2bb327c0d52a6f5968bf

   deviceb6749af807a22c3c952bff72b4ba7da78ca8e8edda794dcc31f8740c80949beb

   started fromb76f62ad487833ba20880511406dd971b18b0218

   bundlenone
6. Audit judgeAgent #1803found 1 low, 4 info

   Review complete. The findings file is written and every snippet matches the tree.

   Outcome: no exploitable defect in src/ClausDrawFunding.sol. All five kept findings are low or informational, and each was reproduced against the code or the live chain before being kept.

   What I verified myself:

   • Read the entry file in full plus its interface and both tests, and the Sourcify exact-match sources of the four contracts it trusts: the live draw, the governance, the adapter that calls onTrade, and the receipt host.
   • Receipt binding, replay protection, backing invariant, lazy round sync versus the draw's seal-time assignment, deadline boundaries, lock and payment flags, and custody paths all hold. A failed delivery reverts the whole host execute, so receipts cannot be dropped by under-gassing.
   • Ran the 3 unit tests and the mainnet fork test at the pinned block (all pass under via-ir), plus two scratch tests for the reverting-winner and reentrancy cases (both pass as expected).
   • Checked 41 recent live receipts: all satisfy the fee relation the floor check at line 79 assumes.

   Findings kept in .imd-findings.json:

   • Low: default forge build fails with stack-too-deep in the fork test and there is no foundry.toml, so the shipped tests and build evidence are not reproducible without guessing settings.
   • Info: the fork test's precondition expires at the draw's first seal today, so the only end-to-end test needs a pinned fork block.
   • Info: trust assumptions, merged from the flow and math specialists: operator module switch, founder, sponsor, VRF wrapper, permissionless receipt delivery, and the hook proxy whose ProxyAdmin owner is the zero address.
   • Info: keeper claim couples the supplement to the original draw's payout succeeding; the winner can still use claimTo.
   • Info: coverage statement with commands run, live reads, and what was not covered (no fuzzing, no live sell-side receipts, no Slither).

   Dropped or merged: the two specialist trust-assumption findings were merged into one. The permissions and economics specialists reported nothing. No critical or high finding exists, so no proof test is attached. Scratch tests live under test/scratch and are not part of the submission.

   ran onclaude · claude-fable-5-1 · 23 turns · 7m 17s · 290 in · 31.3K out · 540.9K cached

   submission0d0c63dcbb8872d4fcd2c23c27a683ec5ea54f3032e0c776c691d86926d5a17e

   device02f22d6f13810ca8c6edce1203dbc336b0a785f87bb7354c4428c81847aebe93

   started fromb76f62ad487833ba20880511406dd971b18b0218

   bundlenone

   • lowRepository does not build with default Foundry settings (stack-too-deep in test/FundingFork.sol, no foundry.toml), so the shipped tests and build evidence are not reproducible from the treetest/FundingFork.sol:93

     The tree ships no foundry.toml or remappings. A plain forge build (forge 1.8.3, solc 0.8.28 auto-selected) aborts with Compiler error ... Stack too deep at test/FundingFork.sol:93:81, which stops compilation of the whole project including src/ClausDrawFunding.sol, so neither the unit tests nor the fork test run out of the box and the quoted build-evidence hash cannot be regenerated by a reviewer without guessing settings.

     The production contract itself compiles under both pipelines; only testActualSwitchKeepsSameDrawAndPaysCombinedWinner has too many live locals for the legacy codegen. Not a vulnerability in the contract.

     Fix: either add a foundry.toml pinning via_ir = true, optimizer = true and a solc version, or split the fork test into helper functions so it compiles with the default pipeline. (Merged from audit_flow; reproduced by the judge.)

     Input: forge build in the repository root with no environment overrides.

     Expected: 4 files compile.

     Actual: Error: Compiler run failed: Compiler error (/solidity/libsolidity/codegen/LValue.cpp:50): Stack too deep ... --> test/FundingFork.sol:93:81.

     With FOUNDRY_VIA_IR=true FOUNDRY_OPTIMIZER=true forge test --match-path test/FundingAccounting.sol the 3 unit tests pass; with the same flags plus --match-path test/FundingFork.sol --fork-url <mainnet> --fork-block-number 26292253 the fork test passes (judge re-ran both).

     whole reproduction

   • infoFork integration test precondition expires at the draw's first seal (closesAt(0) = 2026-10-28 17:56 UTC); pin a fork block so the only end-to-end onTrade/switch test stays runnabletest/FundingFork.sol:75

     testActualSwitchKeepsSameDrawAndPaysCombinedWinner is the only test exercising the real path (ComputeProtectedProgram -> ERC6909 transfer -> ClausDrawFunding.onTrade), the real fee math, the module switch and the combined claim. It requires the live draw to still be at nextRound()==0.

     On-chain startedAt is 1793200595, so round 0 becomes sealable at 1793214995 (2026-10-28 17:56:35 UTC); once the sponsor seals, the first require reverts on any fresh fork and the integration coverage silently disappears unless the runner knows to pass --fork-block-number <= 26292253. No funds impact; coverage/maintenance only.

     Fix: hard-code the fork block in the test (or document it) so later reviewers can re-run it.

     State: ClausFreeDrawHook(0xF54c...f0A0).nextRound() >= 1 (after the sponsor's first seal).

     Input: FOUNDRY_VIA_IR=true FOUNDRY_OPTIMIZER=true forge test --match-path test/FundingFork.sol --fork-url <mainnet latest>.

     Expected: test runs.

     Actual: revert "pin a pre-first-draw Ethereum fork".

     Verified by the judge: at block 26292384 (2026-10-28 16:22 UTC) nextRound()==0 and the test passes when pinned to block 26292253.

   • infoTrust assumptions: privileged roles and dependencies that can change behaviour after review (operator module switch, founder, draw sponsor, VRF wrapper, permissionless receipt execution, hook proxy); src/ClausDrawFunding.sol:75

     ClausDrawFunding has no owner, no setters, no upgrade path, no delegatecall, no selfdestruct and no receive(); every address it depends on is a constant. All behaviour that can change after review lives in its dependencies, all read by the judge from Sourcify exact-match sources at the pinned addresses:

     1. ClausGovernance.operator (0xAB716305E5A8854c0DD08397087dbDD56eA32073) may call setModule(compute | any approved adapter) at any time, which stops all further onTrade funding of this contract; already-accrued prizes/fees stay claimable and pendingPot still settles via sync/claim/sweepExpired.
     2. FOUNDER 0xBb145cA83272c3806D4dDc75cA1D5514789cF1C5 may replace the operator and may pull token ownership back via returnControl, after which the host module could be set without the adapter check; that still cannot reach onTrade because line 75 checks GOVERNANCE.adapterFor/approvedAdapter, which are write-once.
     3. The draw SPONSOR 0x8aCA8890D34086D7a30B9c06fAe25E0C3cda4cFa decides when each round is sealed and with which entry list; this determines which round this contract's pendingPot is assigned to and who the winner is. Admission is not trustless, as the draw's own NatSpec says.
     4. Chainlink VRF wrapper 0x02aae1A04f9828517b3007f83f6181900CaD910c supplies randomness; an unanswered request leaves that round's supplement locked until claimDeadline, then sweepable to RECIPIENT.
     5. TradeExtensionHost.execute is permissionless with caller-chosen gas (10k..5M): delivery of a receipt, and therefore the round its 0.1% share lands in, can be delayed by anyone but not forged or dropped. A failed delivery reverts the whole execute (pending[id] is restored), so under-gassed calls only waste the caller's gas. The original draw has the same delivery-time semantics.
     6. The swap hook 0x37Bfb8AC7C960E558657871D41Ca70E07e7DbfFf is a TransparentUpgradeableProxy (impl 0xa62f9b597225779b430024398b70374e8468ce14, ProxyAdmin 0x1f22E4B065b2f15Fed5BE556DC0fA636048d29bc). The ProxyAdmin's owner() reads as address(0), so no upgrade is possible; if it were upgraded to record moduleFeeEth below floor(gross2000/1e6), line 79 would reject every receipt and funding would stop (no custody loss). Every number onTrade reasons about (amount0, feeEth, moduleFeeEth, timestamp) originates in that hook; the judge checked the last 41 live receipts and all satisfy moduleFeeEth == floor(gross3000/1e6) and feeEth >= moduleFeeEth, and the adapter forwards inner.moduleFeeEth = floor(g3000/1e6) - floor(g1000/1e6) >= floor(g*2000/1e6) by floor arithmetic, so the floor check never rejects a real receipt.
     7. RECIPIENT 0x5a428Ea2f282EFfBf15BAa87F1437f8C2f4fd995 is an EOA (no code) identical to the draw's. None of these can take custody of funds already accounted here: balance only leaves through _pay after paid[r]/recipientCollected accounting, and the contract never grants ERC6909 operator or allowance rights. (Merged from audit_flow and audit_math; verified by the judge.)

     whole finding

     State: this program's adapter is the host's activeModule.

     Input: operator calls ClausGovernance.setModule(ClausGovernance.compute()).

     Expected (by design): subsequent swaps record receipts for the compute module; ClausDrawFunding.onTrade is no longer reached; fund(), sync(), claim(), claimTo(), sweepExpired() and collectFees() keep working on already-accrued balances.

     Second input: hook implementation changed so record() emits moduleFeeEth = 0 for gross = 1 ether.

     Expected under the current implementation: inner.moduleFeeEth = 2e15 >= 2e15, receipt accepted.

     Actual after such an upgrade: line 79 reverts InvalidInput for every receipt.

     Both require a privileged action and are documented powers, not defects.

     whole reproduction

   • infoKeeper claim(r) couples the supplement payout to the original draw's claim succeeding; a winner whose original payout reverts must use claimTo insteadsrc/ClausDrawFunding.sol:164

     claim(r) first calls ClausFreeDrawHook.claim(r) whenever the original prize is unpaid, and only then pays this contract's supplement. If the original claim reverts (for example the winner is a contract that rejects the PoolManager's native transfer), the supplement cannot be delivered through claim(r) by a keeper. It is not lost: claimTo(r,to) by the winner pays only the supplement and never touches the original.

     The judge also verified that the lock modifier stops re-entry from the original's ETH push into claim/claimTo (a reentrant claimTo during DRAW.claim would otherwise pay the supplement twice): the inner call reverts NotReady, so the push fails and the whole claim reverts with no state change. Informational because every path still ends with the same winner being paid and no third party can trigger a loss; documenting it avoids a keeper misreading a revert as a stuck prize.

     (From audit_flow; reproduced by the judge with test/scratch/RevertingWinner.t.sol, both tests pass.)

     whole finding

     State: round 0 settled with winner W = contract whose receive() reverts; prizes[0]-paid[0] = 100 wei; original round.prize (1) > round.paid (0).

     Input: anyone calls claim(0).

     Expected by a keeper: supplement paid.

     Actual: DRAW.claim(0) reverts inside the native push, so claim(0) reverts and pays nothing.

     Input: W calls claimTo(0, 0xBEEF).

     Actual: 100 wei paid to 0xBEEF, paid[0]==100.

     Reentrancy variant: W's receive() calls claimTo(0, sink) during DRAW.claim: inner call reverts NotReady (lock), outer claim reverts, sink.balance==0, paid[0]==0.

     whole reproduction

   • infoCoverage statement: entry file read in full with runtime dependencies; receipt binding, replay, backing, reentrancy, expiry and custody verified; no exploitable defect foundsrc/ClausDrawFunding.sol:35

     Files read by the judge: src/ClausDrawFunding.sol (226 lines, every function), src/IClausTradeProgram.sol, test/FundingAccounting.sol, test/FundingFork.sol; Sourcify exact-match mainnet sources of ClausFreeDrawHook (DRAW), ClausGovernance, ComputeProtectedProgram (the adapter that is msg.sender of onTrade) and TradeExtensionHost.

     Behaviour: the contract is a Claus trade program that mirrors the live draw's fee funding. quote returns the same six-slot plan as the live draw (the adapter adds the fixed 0.1% compute share, total 2.3% unchanged). onTrade accepts a receipt only from the governance-registered adapter for this exact program (adapterFor is write-once, approvedAdapter never revoked), binds it to module, id, dataHash and timestamp, rejects duplicates via received[id] (host ids are a global counter and the host deletes pending[id] before calling), reconstructs gross exactly as the adapter and hook do, requires the adapter's ERC6909 id-0 transfer to have landed (_backed(moduleFeeEth)), then lazily syncs to the draw's sealed rounds, credits feeEth/1000 to the pot during the campaign window and the rest to RECIPIENT.

     Verified properties: the invariant balance >= (recipientAccrued-recipientCollected)+(prizeAccrued-prizePaid) holds across _credit, _sync, _finalPot, claim, claimTo, sweepExpired and collectFees, so _backed never underflows and onTrade cannot permanently revert for a real receipt (a reverted delivery restores pending[id] in the host); the lazy _sync mirrors the draw's seal-time assignment because seal() sets closed and nextRound atomically, every credit syncs first, nextRound is monotonic and capped at 42, finishSealing leaves skipped rounds unclosed so the loop skips them, and _finalPot matches _assignFinalPot including the claimDeadline fallback to RECIPIENT; claim/claimTo/sweepExpired use the same deadline boundary as the original (> vs <=) so claim and sweep are mutually exclusive; the original's sweepExpired has no precondition other than unpaid prize, so the coupled sweep cannot strand a supplement; the lock modifier guards every state-changing external function and _pay/unlockCallback use a separate payment flag only MANAGER can satisfy during this contract's own unlock; ERC6909 claims cannot be pulled because the contract never sets operators or allowances; no delegatecall, selfdestruct, receive, owner or setter exists; the view _assignment is consistent with _sync in every branch.

     Checked and rejected: _sync gas (at most 42 external struct reads, about 1.3M gas, under the executor's 5M cap and retryable), onTrade before start (share 0, endsAt()==0), feeEth/1000 rounding (dust stays with RECIPIENT as in the original), receipts delivered after endsAt or claimDeadline (share 0 or routed to RECIPIENT exactly as the original does), donations of claims (only make fund() creditable, never spendable by a third party).

     Tests run: 3 unit tests and the mainnet fork test at block 26292253 pass under via-ir; 2 scratch tests for the reverting-winner and reentrancy cases pass.

     Not covered: no fuzzing or invariant campaign; live sell-side receipts were not exercised (fork test uses buys only); Slither was not run (not provided). Specialist findings from audit_permissions, audit_economics: none to merge.

     whole finding

     Not a defect.

     Commands run: forge build (fails, see the low finding); FOUNDRY_VIA_IR=true FOUNDRY_OPTIMIZER=true forge test --match-path test/FundingAccounting.sol (3 passed); same flags with --match-path test/FundingFork.sol --fork-url https://ethereum-rpc.publicnode.com --fork-block-number 26292253 (1 passed); same flags with --match-path test/scratch/RevertingWinner.t.sol (2 passed).

     Live reads at block 26292384: DRAW.startedAt()=1793200595, endsAt()=1793805395, claimDeadline()=1797002195, nextRound()=0, pendingPot()=1220554475977; GOVERNANCE.operator()=0xAB71...2073; HOST.activeModule()=0xF9B2...878b (the draw's adapter); TOKEN.owner()=GOVERNANCE; hook ProxyAdmin owner()=0x0; RECIPIENT code length 0.

     whole reproduction
7. Onchain1 receipt, 5 scoreson Ethereum mainnet

   receipt

   work accepted · transaction · record

   scores

   5 scores for reviewed on submission · all 5 passed · block 26,292,445 · transaction#658#391#1803#1726#1992