Implemented the pinned audited source with only the two permitted hook additions. Required creation hash and 21,982-byte runtime match.

Checks passed: forge build, forge fmt --check, and 337 tests with the supplied fuzz seed; six live-fork checks skipped.

• Token: platform BLACKOUT/BLACKOUT; address pending launch.
• Hook: V4Market; address pending launch.
• Pool key: (native ETH, $token, 12500, 60, deployed hook).
• Launch number: assigned by the platform after deployment.

Parameters and operational responsibilities are documented in README.md.

The review is complete. The findings file is written and the scratch tests are removed.

Outcome: no substantiated defect in the assigned area. .imd-findings.json holds an empty findings list plus a 157-row coverage record: 25 rows holds (all V4Market, StandardMarket, StandardAdapter and MarketFactory entry points, and the four FeeRouter execute paths that consume the hook's quotes), 132 rows unreached for the game-economy contracts outside the math area.

What I checked in V4Market, with concrete values:

• spot() scaling. Two mulDiv steps give tokens-per-ETH in wad with 512-bit intermediates. The zero and 1e40 guards need a price below 1e-18 or above 1e22 tokens per ETH, unreachable for a 1e9-supply token.
• TWAP ring. The 31-minute readiness gate lands exactly one minute after the uninitialized init-minute slot, so minute - 30 is always written or extrapolated. I verified against the real PoolManager that a 100-minute idle gap resolves and that a half-window price change yields the exact harmonic mean 1e60 / ((900/p1 + 900/p2)/1800).
• Buy tax arithmetic. fee = ethIn*tax/1e4 never reaches ethIn, so the remaining swap amount is at least 1 wei (1 wei input gives fee 0, 10 wei gives fee 9). The int128 guard precedes the shift, so the BeforeSwapDelta cannot wrap. afterSwap's expected is the identical integer expression, so full fills always match.
• Sell surcharge. Target is at least 100 bps before the cap, so the decay floor cannot drop below 1 percent even when storedFeeWad - fall would. Params keys 24 to 26 map to SellHourBps, SellDayBps, SellDeviationBps with bounds that cap the sum at 1500 bps, so no overflow or over-cap.
• Held-balance invariant. Every manager.take matches a held counter increment on launch tax, sell fee, system buy and system sell paths, so flushFees cannot over- or under-send.
• Units. maxSellBatch, quoteSell, quote and the FeeRouter's 98.5 percent floors all use token wei or ETH wei consistently. Storage slot offsets 6 and +3 match Pool.State.

Not covered: the Billboards, Civic, Economy, Farm*, GridOperator, PackSale, RewardPool, Season, StarterClaim, SwarmDesk and GameRegistry entry points were not examined. The accepted items (float take in beforeSwap, unbound-hook holdings) were not re-reported.

The review is complete and .imd-findings.json holds the result. The working tree is otherwise unchanged. Nothing is committed, since this is a read-only review.

Outcome: no exploitable defect in the hook's permission model. I audited src/V4Market.sol against the Access Control, Trust Gap and Asymmetry guides and found no caller a guard lets through, no asymmetric branch that leaks value, and no in-flight accrual an actor can redirect.

What I verified, by reading and against the real vendored PoolManager:

• Callbacks. Every callback pins the caller to the PoolManager and the exact pool key. The hook is single-pool by construction: a second initialize from the factory reverts.
• Delta accounting. Buy charges on the specified input and sell charges on the unspecified output both net to zero against the hook's take. Partial sells are charged on actual output with funds conserved, while partial buys are refused as documented.
• Binding. The one-time binder is permissionless but pinned to the Desk-bound registry whose market is this hook, with CREATE2 proofs. Look-alike routers cannot bind.
• System buy and sell. Only the bound FeeRouter can call them, the sell recipient is pinned, slippage floors are enforced in-hook, and keeper sandwiching is unprofitable against the fee stack.
• TWAP ring. 256 fuzzed sequences of idle gaps up to three days never blocked a sell or the TWAP views.
• Slither and aderyn leads. All hook lines were false positives. The ETH sends go to proven addresses and the modulo uses are ring indexing, not randomness.

One info-level finding recorded. It is a trust assumption, not a bypass. If the Desk binder binds a registry whose market is a different proven hook, every bind attempt on this hook reverts and its held tax becomes stranded. This extends the accepted item 420b1475 with a second precondition. The binder is a trusted project wallet, so there is no unprivileged amplifier.

Coverage. All 157 entry points have a row. 43 are holds (the hook, StandardMarket, StandardAdapter, MarketFactory, FeeRouter, GameRegistry.register, SwarmDesk.bind, Params.set, RewardPool, EndowmentEscrow). 2 point at the info finding. 112 game-module entry points are marked unreached because they lie outside the hook launch target and I did not trace them in the budget.

Both output paths exist and are deliberately excluded by the repository's git exclude list, so the tree is clean apart from the findings file and the scratch test the task permits. No stray files remain.

Review complete. The findings file .imd-findings.json holds one low finding and a 158-row coverage record covering every listed entry point.

What I checked, against the Economic Security, Invariant and Flow Gap guides:

• Delta accounting on both swap directions. The buy tax is taken from the manager in beforeSwap and returned as the specified delta, so the hook nets zero. The sell charge is taken in afterSwap and returned as the unspecified delta. Both traced through the vendored v4-core Hooks library and confirmed by the existing fuzz test.
• Conservation invariant. The hook's ETH balance equals the sum of the three held streams across every tax step, dust buys, system buys, system sells and flush. Verified with a scratch test against the real PoolManager.
• TWAP liveness. The 32-slot observation ring always has the two minutes the TWAP needs, including after a 7-day idle gap and for back-to-back swaps in one minute. So the deviation surcharge cannot brick user sells.
• View versus write consistency. The buy and sell quotes match the executed system trades modulo price impact, and the FeeRouter's slippage floors bound sandwiching to less than the round-trip fee cost.
• FeeRouter seams. The flush deposits, the system buy and sell flows, and the receive guard all accept the hook as sender once bound. No deposit path reverts on bounded Params or an unregistered Civic.
• Accepted items a3749636, 420b1475 and the exact-input, PriceLimitedBuy and PartialFill behaviour were not re-reported.

The one finding, low severity. The sell-side 1% share and progressive surcharge apply only to swaps. Any holder, including the swarm distribution or the payer's remainder, can mint a token-only position just below the current tick and let buyers fill it, then withdraw ETH with no hook fee and no effect on the imbalance ratchet, while earning the LP fee instead of paying it. Reproduced in the scratch test: a 5 ETH buy filled a range order for 1.59 ETH with zero sell-side charge. This is a design property of a swap-only fee hook, so I flagged it as low for the author to decide on.

Coverage. All 9 V4Market entry points plus the TWAP invariant are marked holds or finding. The 9 StandardMarket rows are holds as the non-launch variant of the same code. The FeeRouter rows that touch the hook are holds. The remaining game-module entry points are marked unreached, since they are outside hook economics and I did not trace them.

Done. The review is complete and .imd-findings.json holds the result; the working tree shows no tracked changes (only the findings file and my scratch tests, both in allowed paths).

Outcome: one medium finding, with a failing Foundry proof, plus a full coverage record.

Finding 1 (medium), src/V4Market.sol:467. The hook records the pool's spot price in afterSwap without checking that the price was traded against liquidity. The launch pool is seeded with BLACKOUT only, so there is no liquidity above the opening tick. A user sell with a high price limit drains the ETH that earlier buys put in range, then walks the price through empty liquidity to the limit while consuming nothing more. The hook accepts that spot (up to its 1e40 cap) as lastPrice and time-weights it until the next swap. In the reproduction, after 20 quiet minutes the TWAP read 2.8× the real price, quote over-promised tokens by 2.75× and quoteSell under-stated ETH by 65%. Consequences on the hook's own paths: FeeRouter reward buys revert on their minOut floor for up to 30 minutes after restoration, system sell batches can be sandwiched well beyond the intended 1.5% band, and while the price is parked maxSellBatch is zero and every user sell reverts. Attacker cost is fees only, about 0.1 ETH per ETH of in-range depth. Proof: test/scratch/TwapExcursionProof.t.sol fails on current code at the final TWAP assertion.

Verified as intended (holds), in my area:

• Buy path delta arithmetic: the fee << 128 specified delta, the manager's amountToSwap, the hook's take and the PartialFill comparison all agree, including with protocol fees.
• Sell path: charge on gross ETH output returned as unspecified delta nets the take exactly.
• unlockCallback self-swaps: hook callbacks are suppressed by v4, deltas settle to zero on both paths, ETH balance always equals the three held streams.
• Observation ring: I proved by induction that twap() cannot revert after 31 minutes.
• Periphery: Params keys 24 to 26 exist, pool state slot offsets match v4 StateLibrary, the embedded GameRegistry creation code and the IV4 ABI subset match the vendored core.
• The accepted a3749636 float dependency was reproduced on a fresh manager, where every buy reverts; it is noted in coverage, not reported.

Coverage: 161 rows, with 140 holds, 8 finding, 13 unreached. The unreached rows are FeeRouter functions the hook never calls, SwarmDesk, GameRegistry.register and EndowmentEscrow.forward, which are off the hook's control flow and were not traced in the budget.

Added 31 checks, covering failure paths and 16,384 invariant calls.

• Build passed.
• Full seeded suite: 368 passed, 0 failed, 6 fork skips.
• Contracts and configuration unchanged; hook hash and runtime size match.

Reported an inherited whitespace-only source-pin mismatch in .imd-findings.json.

Token: BLACKOUT. Hook: V4Market. Pool: ETH/BLACKOUT, fee 12500, spacing 60. Deployment addresses and launch number remain unassigned.