Implemented both contracts, vendored dependencies, Sepolia mocks, deployment script, launch.json, and operating documentation.

Validation passed:

• forge build, including a clean offline build
• forge test: 102 passed with the supplied fuzz seed, including accounting invariants
• forge fmt --check
• Manifest, constructor arguments, and runtime-size checks

No contracts were deployed or transactions broadcast.

The economics review found no high or medium defects and one low-severity finding. I wrote it to .imd-findings.json with a coverage row for all 21 entry points plus one for the conservation invariant. I changed no files; forge test passed all 102 tests.

Finding (low): the vault wallet can never pay for a purchase. The check is at src/OGClubPayments.sol:116-117. When the buyer is the vault itself, its share is a transfer to itself. The vault's balance then drops by the burned half instead of rising by its share, so the purchase reverts with ShortTransfer even with a normal token.

• Reproduction: deploy with Deploy.deploy(D, O) on Sepolia, so vault = D. D mints 100,000 OG, approves the houses contract and calls buyHouse(100000e18). It reverts with ShortTransfer(D, 50000e18, 0). deeds.mint by D for a Pepe D owns fails the same way.
• Impact: the brief sets vault = the deployer for Sepolia, and launch.json passes $owner as both vault and owner. So the wallet that deploys, owns and holds the initial mock tokens can't test any purchase from its own wallet. On mainnet, the farming vault can't buy for itself; someone else has to pay for it.
• Status: the README documents this limitation and test_VaultCannotPayItselfAndPassExactReceiptChecks asserts it. It still comes from how the fee-on-transfer check is written, not from the brief.
• Suggested fix: when the payer is the vault, expect its balance to fall by the burned half instead of rising. That keeps the fee-on-transfer protection.

What holds:

• Split: every purchase sends floor(price/2) to 0x…dEaD and the rest to the vault, and the payer's exact debit is checked. The contracts never hold tokens.
• maxPrice: it is checked before any transfer, and the price can't change within the transaction.
• Price notice: a new price takes effect exactly at the boundary. Replacing a pending change keeps a price that has already taken effect, and a zero notice applies at once.
• Pause: it stops purchases only; deed transfers and approvals keep working.
• One deed per Pepe: the flag is set before payment and stays set after the Pepe or the deed changes hands.
• Delegate mints: the registry is checked with full rights (bytes32(0)), and the deed goes to the Pepe's owner.
• Royalty: capped at 10%.

Static-analysis leads:

• Aderyn's "high" reentrancy: a false positive. The mint callback runs after the state change and behind the reentrancy guard.
• Slither's timestamp warnings: these are the intended notice logic.

Owner powers to note (not defects):

• Renouncing while paused: this disables purchases permanently. It's an owner power the README documents.
• Zero-amount transfers: prices of 0 or 1 wei mean a transfer of 0. That would only break if the real OG token rejects zero transfers, which I couldn't check.

Updated launch.json with clarified Sepolia configuration notes. Verified all five contracts, constructor arguments and dependency references against compiled ABIs.

Checks passed: forge build, forge test with the supplied fuzz seed (102 tests), and forge fmt --check.

Only launch.json changed. Nothing was deployed.

The review is complete. No reproducible defects were found in the Math Precision, Boundary or Numerical Gap areas, and the findings file records an empty list with a full coverage record.

What was checked

• The payment split in _collectPayment at src/OGClubPayments.sol:108. Burn gets the floor of half, the vault gets the remainder, and the two always sum to the price with no multiplication that could overflow. Verified at 0, 1, 101, the launch prices and the largest mintable price.
• The receipt and payer-debit checks against taxed, false-returning, self-paying and second-leg-undo tokens. All revert with the right amounts and roll back fully. The existing adversarial suite already covers these, and I re-ran it.
• The price notice. Activation is inclusive at exactly call time plus notice, a replaced announcement never takes effect, an already activated price is preserved when a new one is scheduled in the same second, and a notice scheduled at timestamp zero keeps a nonzero sentinel. The 30-day cap rules out timestamp overflow.
• Royalty bounds and rounding. The cap is 1000 of 10000, and tiny sale prices floor to zero as ERC-2981 expects.
• The external boundaries in mint: nonexistent Pepe reverts in ownerOf, zero owner is rejected, and a contract owner that cannot receive ERC-721 rolls back both payment legs, which the README documents as intended.

Static analysis leads

Both Slither timestamp lines are the intended inclusive notice comparison. The Aderyn reentrancy lead at src/OGClubDeeds.sol:83 is two view calls before a state write inside a nonReentrant function, and the unchecked-return lead is the intentional _requireOwned guard. None became findings.

One assumption left open

The real mainnet OG token address was not available, so I could not confirm it credits the 0xdEaD address normally and accepts zero-value transfers. If it does not, every purchase would revert with ShortTransfer. That is fail-closed rather than a loss, and the coverage record notes it.

Build, full test suite and forge fmt --check all pass. The scratch tests I used for the edge probes have been removed, and the tree is otherwise unchanged.

I found no defect in either contract serious enough to need a failing proof. The previous suite already had 102 passing tests, and I added two test files on top of it. forge build, forge fmt --check and forge test with the verifier's fuzz seed all pass: 119 tests, none failing.

test/PriceScheduleInvariant.t.sol is a new invariant suite (128 runs × 64 calls). It checks the price schedule against a log of every setPrice call rather than the contracts' own storage.

• What it drives: three sales with a 7-day, 1-second and zero notice. Random calls set prices (some odd), have strangers try setPrice, move time forward (including to exactly one second before, on, and after a change takes effect), pause, and buy at the exact price, one wei under it, or with no limit.
• What must hold after every sequence:
  • price() and pendingPrice() match the log at every step.
  • Each purchase charges exactly the price in force, split exactly between burn and vault.
  • Burned plus vault totals equal what payers spent, and neither contract ever holds tokens.
• Four fixed timelines check the log-based expectation against the contracts' actual price()/pendingPrice(), so the invariant can't pass by checking nothing.

test/EdgeCases.t.sol adds 12 unit tests for cases not covered before:

• the largest price a payer can actually hold, which is odd and splits exactly without overflow;
• a 30-day notice accepted, 30 days + 1 second rejected on both contracts, and the 30-day boundary on deeds;
• which error wins when several checks fail at once (pause first, then duplicate or ClubExists, then price limit, then authorisation);
• setPaused repeated is a no-op, and pausing one contract doesn't pause the other;
• a delegation for one Pepe doesn't authorise another;
• an unminted deed has no owner or URI;
• the royalty cap at exactly 10%, 0% allowed, and 10.01% rejected.

.imd-findings.json reports three things for the requester to decide, none critical:

• Low: deeds are minted with _safeMint. If a Pepe's owner is a contract that can't receive NFTs, no club can be minted for it while it sits there, not even by a valid delegate. Payment rolls back, so nothing is lost.
• Info: the vault can't buy from its own wallet; the exact-receipt check rejects it, and the README already says so. Because the Sepolia deployment makes the deployer the vault, testers need a second wallet to buy.
• Info: the inherited renounceOwnership lets the owner give up control while sales are paused, which stops all purchases forever. The README should mention it, or it could be disabled.

The review is complete. The findings file is valid JSON, both cited snippets match the tree, the scratch directory is removed, and the working tree has no other changes.

Outcome: the permission model of both contracts holds. I found no guard gap, escalation path, confused deputy, or asymmetry that an unprivileged caller can exploit. Two low-impact items are recorded with reproductions.

What I checked, against the Access Control, Trust Gap and Asymmetry guides:

• Every storage variable has exactly one writer path and its guard is the strongest available. No internal helper is reachable from a weaker entry point.
• Both payment legs always name the caller as payer, so no function can spend another wallet's allowance.
• The mint authorisation matches the brief: Pepe owner, or the registry check with the caller as delegate and the current owner as vault. Reentrancy through the ERC-721 receiver hook is blocked by the guard, and the one-deed-per-Pepe flag is set before any external call.
• Price scheduling is symmetric between the write and both views at the exact boundary, and a replaced pending change restarts the full notice.
• Ownership uses OpenZeppelin two-step handover with correct guards on every path.
• The two mainnet dependencies named in the brief answer the exact interfaces the contract calls, verified over a public RPC.
• The launch manifest uses only the schema's keys, with arguments in declaration order and no zero address.

Findings recorded:

• Low: the farming vault can never pay for its own house or deed. The vault receipt check sees a net decrease when the payer is the vault, so the purchase reverts with ShortTransfer. A third party can still buy for it. The README documents this.
• Info: owner trust assumptions. Renouncing ownership while paused disables purchases permanently, and the owner may schedule a zero price. Both are owner-only with no unprivileged amplifier.

Coverage: all 21 listed entry points have a row, plus four invariant and dependency rows. Nothing was left unreached.

The review is complete and .imd-findings.json is written with 2 findings and 25 coverage rows. The scratch test was removed and the tree is otherwise unchanged.

Outcome: no exploitable defect in the Execution Trace, Periphery or First Principles areas. Build, all 102 tests and the formatter check pass. The payment base, the notice clock, the delegate check and the one-deed-per-Pepe rule all trace correctly, including the boundary cases the guides call for (exact notice timestamp, replaced announcement, zero and one-wei prices, reentrancy through the token and the ERC-721 receiver, fee-on-transfer on either leg).

Findings reported

• Low, src/OGClubPayments.sol:117. The net-balance receipt check rejects a payer who is the vault. From the vault wallet, buyHouse and mint revert with ShortTransfer at every positive price on an honest token. This matters for the Sepolia manifest, where $owner is the vault, the owner and the only funded wallet. The README and an existing test document it as intended, so I flagged it for the author to confirm rather than as a security defect.
• Info, src/OGClubDeeds.sol:94. Safe-mint to the Pepe owner means a Pepe held by a contract without an ERC-721 receiver can never get its deed, even via a delegate, until it is moved. Documented and tested as intended. Reported as a trade-off.

External checks done against mainnet via a public RPC. The Swarm Pepe address reports name "Swarm Pepe", symbol SPEPE, supports the ERC-721 interface and reverts on ownerOf for unminted ids. The delegate registry address has code and answers the exact checkDelegateForERC721 signature the contract calls. The mainnet OG token address is not given anywhere, so its transfer semantics remain an open operator item, not a finding.

Static-analysis leads (two timestamp warnings, one reentrancy and one unchecked-return lead) were traced and dismissed with reasons in the coverage record. The manifest and deploy script were checked against the schema rules and the brief and hold.

The review is complete. .imd-findings.json holds three findings and a 23-row coverage record, with every snippet verified against the tree. The scratch tests are removed and no repository file was changed.

Outcome. The code is sound. Build, the full suite of 119 tests, and forge fmt --check all pass. No critical, high or medium defect exists, so no proof files were needed. The eight specialist reports collapse into three distinct root causes, all of which I reproduced in a scratch Foundry test before keeping them.

Findings kept, with severity recalibrated by impact:

• Low, vault cannot pay for itself. Four specialists reported the same root cause in src/OGClubPayments.sol:117. The vault's net-balance receipt check sees a self-transfer plus a burn debit and reverts with ShortTransfer at every positive price. Reproduced for buyHouse, mint, and a 1 wei price. No funds are lost and third parties can still buy for the vault, so this stays low rather than a permission defect.
• Low, safe-mint blocks non-receiver Pepe owners. Two specialists reported src/OGClubDeeds.sol:94. A Pepe custodied by a contract without onERC721Received can never get its deed, even through a valid delegate, which the brief explicitly wants to support. The purchase rolls back cleanly.
• Info, renounce while paused is permanent. Two specialists reported this as an owner trust assumption. Reproduced: after setPaused(true) then renounceOwnership, no one can unpause. Documented in the README, so recorded as a trust assumption only.

Static-analysis leads dropped. The Slither timestamp lines are the intended price schedule. The Aderyn reentrancy line is two view calls to immutable dependencies behind nonReentrant. The unchecked-return line is an intentional discard of the result of the ownership check in tokenURI.

My own pass. I traced all 21 entry points and the launch manifest. The price schedule holds at the exact notice boundary, on replacement and after activation. Delegate and stranger paths, ClubExists persistence after both NFTs move, tokenURI, freeze and royalty bounds behave as specified. The manifest uses only the three allowed keys, argument counts match each constructor in order, and no constructor makes an external call.