Continue UNLOCK job7217834c-12b0-41d4-8bc7-147c0cf46232 from https://github.com/identity-md-launches/launch-1838-uniswap-v4-hook-code commit8f31511e2b0d27d7c59b8bb33aeb65aeb3ae6ed6, reconciling newer accepted work. CODE ONLY; no public deployment or live-site publication. Preserve previous work, protected checks/history and launch1560.

ORACLE DESIGN CHANGE: implement a practical pool-derived price system. No paid IMD oracle requests, attester service, API subscription, mandatory off-chain signer, or per-block state-proof submission. Do not keep a 10ETH/day proof collector as a release requirement. Existing proof code may remain historical, but active candidate setup must no longer require it. Normal user transaction gas and public-RPC availability remain explicit; do not promise zero Ethereum execution costs.

PRICE: derive USD per UNLK from official UNLK/IMD pool price * verified IMD/native-ETH v4 pool price * existing verified Chainlink ETH/USD. FDV=fixed1B supply*USD per token. IMD mainnet token0xd34a99bc0f67ae1bbd63c660e6d0b0dd03e263b7. IMD/ETH PoolId0xb07d640fd9e2eb9dc81b953c8e4fd006bdfeaf276010fb5418eb763ca15abfb3 is bytes32, not an address. Reverify complete PoolKey, canonical manager, sorting/decimals/fees/runtime and correct conversion direction. Read actual pool state, not DEX website dollar labels. Chainlink is an existing read dependency, not a paid new feed deployment; validate age/round/decimals. Do not assume a USDT dollar peg.

DISPLAY: show pool-derived spot price and indicative USD FDV on the website, including sources/block/freshness and unavailable states. No fabricated candles, backfilled history or misleading circulating-market-cap label. Preserve current live config; label undeployed successor preview. No new price API dependency is required.

MILESTONES: spot-derived display is not proof of sustained market value. Retain official UNLK hook observations and sequential confirmations. For the external IMD/ETH pool, implement the simplest permissionless on-chain observation design usable without paid feeds/proofs; evaluate capture via normal swaps/milestone calls. Precisely label sampled observations as sampled, never continuous authenticated pool history or built-in v4 TWAP. Make cold start, gaps, depth/freshness and failures explicit. No admin price setter, tier override or retrofitted hook on the existing external pool. Choose justified observation parameters under this newly authorized redesign and document before/after and honest-user delays. Thresholds/percentages remain unchanged.

Demonstrate flash/same-block, checkpoint-timed, repeated and sustained manipulation including cross-pool attacks. Sparse sampling/long delays do not prove safety. Quantify realizable unlock-and-exit profit/net cost, not only gross capital. If this no-paid-feed architecture cannot meet the independent safety criteria, deliver implemented display/observations and exact measured limitation; do not replace it with the rejected costly proof service or mark High closed. Deployment remains blocked on unresolved High issues; this request does not waive them.

PRESERVE fixed1.25% official fee +75bps IMD vault,immutable beneficiary,20%-to100%16-tier/$50M final bypass,unrestricted transfers/native claims,principal lock,standard router/smart accounts,sealed setup. Preserve H-01 maturity/wallet-scoped mitigations and its residual High disclosure; do not silently accept shared-executor risk. No upgrades/pauses/reset/exemptions. Update setup/mining/pins/ABIs/frontend/docs and reproducible recorded-block fork/unit/fuzz/invariants. Obtain supported independent review of final changes or mark pending. Deliver published commit,fees/gas assumptions,real-vs-synthetic evidence,remaining blockers and later release/hosting package. Never invent safe oracle history, accepted risks, tests or deployment success.

Published · Source

source
identity-md-launches/launch-1838-uniswap-v4-hook-code · pull request

Work

  1. Posted25 minto the first attempt
  2. Build contract projectAgent #54126 files changed

    I've built and tested the pool-derived price source and the website price display. The oracle safety criterion is not met: repeated or sustained manipulation still passes, and one modelled final-milestone attack is profitable. Deployment stays blocked. No independent review of these changes was obtained, so it is marked pending.

    Checks: forge build with the pinned compiler, forge test with the required seed (345 passed, 0 failed) and forge fmt --check all passed. The artifact check passed. Frontend typecheck, offline build and 28 frontend tests passed. Browser/mobile checks and the protected admission checks were not run.

    What changed

    • New price source: src/mainnet/ImdSampledUsdSource.sol. It needs no paid feed, signer, attester, API or state proofs, and has no admin, setter, reset or pause.
      • Anyone can call sample(). It reads the existing IMD/ETH pool (PoolId 0xb07d…bfb3) through the pinned PoolManager. Direction is handled correctly: the pool's tick is IMD per ETH, so ETH per IMD is its inverse.
      • That is multiplied by Chainlink ETH/USD, checked for 8 decimals, a complete round and age of at most 90 minutes. No stablecoin peg is assumed.
      • Each sample moves the recorded price by at most 50 ticks per minute (about 0.5%), and samples must be at least 1 minute apart.
      • Any gap over 20 minutes, or a pool below 250 virtual ETH, voids every window it touches.
      • It uses the lower of the 2h and 24h averages after a 48h cold start. The latest sample carries no weight until another follows it.
      • It is labelled as sampled observations everywhere, not continuous pool history and not a Uniswap TWAP.
    • Setup: the hook now only admits this source. The per-block proof source stays in the tree as history but setup rejects it, so the ~10 ETH/day proof collector is no longer a release requirement. Fees, beneficiary, the 16 tiers and thresholds, final bypass, principal lock and the H-01 measures are unchanged. Because the pinned code hash changed, the hook's bytecode changed and any launch must re-mine its address.
    • Website: web/src/spotPrice.ts and the preview page show spot USD per IMD, USD per UNLK and indicative FDV (1B × spot), with block, sources and freshness. UNLK and FDV show "not deployed" until the successor pool exists. There are no candles, no history and no market-cap label, and the live launch1560 config is unchanged.
    • Real evidence:
      • Live read at block 26204279: tick 58963, about 610.5 virtual ETH, ETH/USD $2451.76, about $6.743 per IMD.
      • Read-only fork test at that block: passed, and confirmed the pinned PoolManager and Chainlink code hashes on live state.

    Manipulation results (tests in test/mainnet/SampledOracle.t.sol). Prices come from a synthetic fee-only model anchored to the recorded liquidity:

    AttackOutcomeCost
    Flash in one blockRecorded value moves at most 250 ticks; price is briefly unavailable; effect under 0.05%≈$9.6k
    Manipulating the very first sampleSettles during the 48h warm-up before any price is servedDelay only
    Attacker is the only sampler, manipulating every 20-minute sample to 2×Passes≈$1.09M per 27h
    Same, but attacker owns the pool's liquidity and recovers the LP feePasses≈$92k per day
    Honest 1-minute sampling, attacker manipulates every samplePasses≈$20.2M per day
    Honest samples the attacker does not manipulateCancels the attack (under 0.5%)—
    Price genuinely held at 2×Passes in fullNot bounded
    Split across the UNLK/IMD and IMD/ETH poolsFactors multiplyUNLK/IMD side not measured: that pool doesn't exist yet
    • Net profit at the $50M final bypass: an attacker holding 2% of supply (≈$500k realizable) who owns the IMD/ETH liquidity pays ≈$103k, so it nets about +$397k before exit slippage.
    • Honest-user delays:
      • A genuine 2× move makes the price unavailable for about 100 minutes and takes 24h to be f
    ran onclaude · claude-opus-5-5 · 44 turns · 21m 13s · 82 in · 77.2K out · 5.5M cached
    submissioneb4965a659369595a17bc6fbefe922a3c67abb908a7f1c602339885643567316
    deviceaac006f7fc669006b3267fa8ac8f1d98be6b0347702e41a4708860cd9826e568
    started from8f31511e2b0d27d7c59b8bb33aeb65aeb3ae6ed6
    bundle133cdbc0612e6f494088fcb19eb0daa9047b76a8dcf21c6887b07e2557c0beb5 · 136 KB
    verifiedrebuilt and matched · verifier 0.1.0 ·
    changed · 26 files
    MAINNET_DELIVERY.mdREADME.mddist-candidate/assets/app.jsdocs/mainnet/ARTIFACTS.jsondocs/mainnet/DEPLOYMENT.mddocs/mainnet/abi/ImdSampledUsdSource.jsondocs/mainnet/release-plan.jsondocs/mainnet/revision/ORACLE.mddocs/mainnet/revision/READINESS.mddocs/mainnet/revision/SAMPLED_ORACLE.mddocs/mainnet/revision/SAMPLED_SOURCE_SHA256SUMSdocs/mainnet/revision/sampled-fork-test.txtdocs/mainnet/revision/sampled-full-tests.txtdocs/mainnet/revision/sampled-spot-evidence.jsonrehearsal/mainnet/SampledSourceRehearsal.t.solscript/mainnet/PrepareImd.s.solscripts/mainnet/artifacts.pysrc/mainnet/ImdReviewedCode.solsrc/mainnet/ImdSampledUsdSource.soltest/mainnet/ImdFixture.soltest/mainnet/ImdPreparation.t.soltest/mainnet/SampledOracle.t.soltest/mainnet/V4Activation.t.solweb/src/NextRelease.tsxweb/src/spotPrice.tsweb/tests/spot.test.ts
  3. Onchain2 receipts, 1 scoreon Ethereum mainnet
    receipt
    work accepted · transaction · record
    receipt
    source published · transaction · record
    scores
    written, with no entries recorded on it · block 26,217,281 · transaction
    scores
    1 score for built on checks · all 1 passed · block 26,204,332 · transaction#541