The review is complete. No tracked file changed; the only writes are .imd-findings.json and my scratch tests under test/scratch/, which are ignored.

Outcome: no defect found in the three contracts. The findings file holds one low and two info entries.

What was read and run

• Read in full: src/VerdictMarkets.sol, src/VerdictOracle.sol, src/VerdictBurnVault.sol, src/OracleAttestation.sol, both interfaces, launch.json, the deploy parameters library, the test base and mocks. Nothing in scope was unreachable.
• All 198 existing tests pass, and they pass again with a second fuzz seed. Slither reports no High or Medium detector hits in src/.
• Every state-changing entry point was traced for caller, guard and value moved. The two ledgers (collateral and IMD bounty) stay separate, fee rounding favours bettors with the last winner taking the exact remainder, every external call sits behind a reentrancy guard and after state changes, and the attestation path pins body hash, the market's own latest intake request id, question hash, chain, block window, panel minima and issuance window.
• On a mainnet fork over the local RPC I deployed all three contracts with the brief's exact constructor arguments, created a WETH market, bet, and sent a request through the live Intake. The Intake pulled exactly 0.5 IMD, matching its live priceOf, and the settler reward paid out as designed. The oracle callback stays under the 200k stipend even with a 16 KiB answer.

Findings

• Low, launch.json line 12. The committed manifest, script/SepoliaParameters.sol, docs/agents/addresses.json and the two deployment tests still carry Sepolia values. Deployed unchanged on chain 1, every createMarket and request reverts because the TestIMD and Sepolia WETH addresses have no code there. The manifest also routes treasury fees to the owner and sets no config delay, where the brief wants treasury 0x2a85…0231 and 172800 seconds. The adapter must rewrite these for mainnet.
• Info. A delivered attestation that fails the market's filter blocks the retry and forces a void. This is documented behaviour and refunds everyone except the 0.5 IMD oracle spend.
• Info. Trust assumptions to carry forward: the oracle owner can rotate signer and intake after the 48-hour delay, the guardian can pause entry only, and anyone can escalate once at the creator's expense.

Mainnet dependency facts verified live. IMD at 0xd34a…63b7 is a verified LayerZero OFT ERC-20 named BridgedFP with plain transfers and no fee, pause or blacklist. WETH9 moves exact amounts. Owner, treasury and signer are EOAs.

The mainnet adaptation is complete and verified.

What changed

• script/MainnetParameters.sol replaces the Sepolia parameter library with the brief's mainnet values: IMD Intake v2, IMD, WETH9, signer, action, 0.5 IMD price, the launch owner as oracle owner and guardian, the separate treasury wallet, and a 48-hour config delay.
• The stale Sepolia launch.json from launch 1301 is removed. The manifest step writes the mainnet one.
• test/Deployment.t.sol and test/SettlerDeployment.t.sol rehearse the exact mainnet arguments on chain 1 with no code at the dependency addresses, and the rehearsal factory now refuses other chains.
• New test/MainnetLaunch.t.sol reproduces the audit's low finding (the committed Sepolia arguments deployed on chain 1 cannot create or resolve any market, pay treasury fees to the owner and have a zero delay), then runs a market in each slot against mock code at the real mainnet addresses, and pins the 48-hour delay.
• test/VerdictImportedAudit.t.sol gains a regression documenting the info finding that an unproposable delivery blocks the retry and the market voids with full refunds.
• Test fixtures sign in the chain-1 EIP-712 domain; the protocol's Sepolia conformance vector is kept as a fixture.
• docs/agents/addresses.json carries chain 1 and every mainnet external address, with the contract addresses and deploy block left null for the deployment handoff, since the worker holds no keys.
• docs/DEPLOYMENT.md, docs/AGENTS.md, README.md and ADAPTATION.md describe the mainnet launch, the treasury's role and the 48-hour delay. web/ and dist/ are untouched.

The three contracts are byte-for-byte unchanged. No reproduced audit finding was a defect in them. The info findings are recorded as trust assumptions.

Verification

Nothing was committed or broadcast. The deployment handoff fills the three addresses and the deploy block after the launch service deploys.

Done. launch.json is written at the repository root and is the only file changed outside the scratch area.

What the manifest contains

• Kind evm_contracts, three contracts in dependency order: VerdictBurnVault, VerdictOracle, VerdictMarkets.
• VerdictBurnVault takes no arguments.
• VerdictOracle takes the Intake v2, IMD token, oracle signer, the oracle.request@oracle-1 action id, 0.5 IMD price, $owner and the 48-hour delay. $owner resolves to the launch owner 0x397d…a312, which the brief names.
• VerdictMarkets takes $contract:VerdictOracle, the treasury wallet 0x2a85…0231, $contract:VerdictBurnVault, $owner as guardian, then the IMD slot (150/50/50 bps, 500 IMD cap), the WETH9 slot (150/0/100 bps, 1 WETH cap) and the 0.25 IMD settler reward cap. That is 15 arguments, within the 16 limit.
• Notes explain each argument and role in under 2,400 characters.

Verification

• A scratch test embedded the manifest, resolved $owner and $contract: references, ABI-encoded every argument, and asserted the bytes equal the accepted MainnetParameters encodings. It then deployed all three on an empty chain, checked runtime size, and read back owner, treasury, guardian, both collateral slots, price, delay and reward cap. It passed.
• forge build succeeds. The full existing suite, including every independent review and the mainnet launch test, passed with no failures.

• git status shows only the new launch.json plus ignored scratch output. Config files, lib/, web/ and dist/ are untouched.

Outside this task's scope: the mainnet addresses and deploy block in docs/agents/addresses.json stay null. They are filled by the deployment handoff after the launch service deploys, since this assignment may only write the manifest.

The review is complete. The findings file is written and the working tree holds no other changes.

Result: no economic defect found. .imd-findings.json has an empty findings list and 27 coverage rows, one for each of the 23 listed entry points plus four invariant and dependency rows. All 23 entry points are marked holds.

What I checked, from the Economic Security, Invariant and Flow Gap guides

• Both ledgers conserve on every path. Collateral: payouts plus refunds plus fees equals the pool. Bounty: oracle spend plus rewards plus the returned remainder equals the creator's deposit. I traced every writer and executed the mainnet terms (1.5/0.5/0.5 on IMD, 1.5/0/1 on WETH, 0.5 IMD price, 0.25 IMD reward) in a scratch test. Both slots drain the contract to zero.
• The settler reward reserve never starves a promised ask. A market has at most two asks and at most four rewarded actions on any sequence, and creation requires two prices plus five rewards, so the minimum 2.25 IMD bounty always covers the retry or escalation path and returns 0.25 IMD.
• Outcome binding: a proposal must present the oracle's stored attestation for the market's own latest paid ask. Third-party purchases through the oracle, answers to other markets, and stale first-ask answers after a retry are all refused.
• Terminal paths are exclusive: finalize needs winning stake, void needs none; propose stops at voidAfter exactly where void begins.
• Griefing economics: filling the 500 IMD cap blocks others but costs the griefer 2.5% at most and nothing if wrong. Escalation is free to the caller by documented design and bounded to one ask of the creator's own bounty.
• Live dependencies on chain 1: the Intake exposes the exact request and priceOf selectors the oracle calls, and prices the action at 0.5 IMD. IMD is a LayerZero OFT ERC-20 with no pause or blocklist selectors, and a traced transfer moves the exact nominal amount. WETH9 is canonical.

What I did not reach. The mainnet Intake runtime differs from the Sepolia one by 35 bytes in one region, which looks like embedded immutables, but I did not decompile its internal logic. That row is marked unreached.

Timing limits that are documented, not defects. A primary proposal made at or after answerUntil cannot be escalated, and an ask paid just before the cutoff may return an unusable answer. Both reproduce as the README describes and only cost the creator one 0.5 IMD ask, never bettor principal.

The full suite passed before I started (202 tests, including the lifecycle, collateral and reward invariant campaigns), and my scratch directory was removed after use.

The review is complete. Findings are written to .imd-findings.json with both snippets verified against the tree, 23 coverage rows (one per listed entry point plus one deployment-arguments invariant), and the working tree is unchanged apart from the gitignored test/scratch/ reproduction.

Outcome

The three contracts hold up well under the Access Control, Trust Gap and Asymmetry guides. All 202 existing tests pass, the committed ABIs equal this build, and the mainnet constructor arguments in script/MainnetParameters.sol and the deployment tests match the brief exactly (owner and guardian are the launch owner, treasury is the separate static wallet, Intake v2, IMD, WETH9, signer, action id, 0.5 IMD price, 48-hour delay, both fee slots and caps, 0.25 IMD settler reward). No critical, high or medium defect was found.

Two low findings, both reproduced in test/scratch/RetryFrontRun.t.sol:

1. Retry can be used to remove the dispute right. The 24-hour retry in resolve is permissionless and rewarded, and it shares the two-ask budget with escalate. When the oracle is slow, a bettor who sees the pending answer in the mempool can front-run it with a retry. The authentic first answer is then refused, the retry answer is proposed, and the losing side's escalate reverts with AskLimit. The front-runner is paid 0.25 IMD of the creator's bounty for it. Bounded by one market's stake and by needing a panel slower than 24 hours.

2. One-step oracle renounce. VerdictOracle inherits an unguarded renounceOwnership, while the guardian's renounce is guarded against stranding the system. A single owner call permanently freezes intake, action id, asset, price and signer, so a later IMD action or price change voids every open market. Reported as a recoverability gap, not an exploit.

Coverage. Every listed entry point is traced and marked holds except resolve (finding 1) and renounceOwnership (finding 2). Documented trust assumptions were checked and not re-reported: guardian pause and allowlist powers, the owner's delayed config rotation, free stranger escalation, and the accepted rule that an unusable delivered answer blocks the retry. Not verified offline: that the live mainnet IMD token has no transfer restrictions, and that Intake v2 at the given address behaves as the mock does. The deployment doc records a read-only RPC check of symbol, decimals and price for these.

Review complete. The findings file is written and validated against the tree.

Outcome. The math in the three Verdict contracts holds. I found no precision, overflow, rounding or boundary defect that loses or misroutes funds. Two low-severity boundary issues are reported, both in src/VerdictMarkets.sol.

Findings written to .imd-findings.json

• Low, empty-pool markets drain bounty. Once betting closes with zero stake, no outcome can ever pay out, yet resolve still buys an oracle answer and pays a settler reward, propose pays another, and voidMarket a third. On mainnet terms the creator gets back 1.0 IMD of a 2.25 IMD bounty instead of 2.0 IMD. Reproduced in a scratch test.
• Low, unreachable escalation still spends bounty. A replacement needs twice the primary panel, but the oracle sells at most 100 seats. When the primary panel was 51 or more, escalate still spends 0.5 IMD of bounty and extends the dispute window by up to 24 hours for an answer propose will always reject. Reproduced in a scratch test.

What I verified as holding

• Bounty minimum check is an exact, overflow-free equivalent of 2 × price + 5 × reward (fuzzed).
• Fees round down individually from the whole pool, winners get floor shares, the last winner takes the exact remainder, and both ledgers conserve in every claim order (fuzzed).
• Pool cap is inclusive at the boundary in both slots. Settler reserve logic never pays a reward that makes the next ask unaffordable unless the bounty was already short after a price change.
• Time windows for propose, escalate, finalize and void are mutually exclusive at their boundaries.
• Constructor arguments in the parameters library and launch test match the brief.

Test runs. Every existing suite passes, including all five invariant campaigns. One environment note: the sandbox caps memory at 1.5 GB, so a single forge test over all 85 files is killed by the kernel during via-IR compilation. I ran each suite individually with skip filters instead. That is a machine limit, not a code defect, and the verifier's earlier builds show it compiles elsewhere.

Coverage. All 23 listed entry points have a row, plus three invariant rows. Four rows point at the two findings; the rest hold. Nothing was left unreached.

Review complete. The findings file is written and validated, and all probes behaved as the code intends.

What I did

• Read the Senior Auditor's Mindset and the Execution Trace, Periphery and First Principles guides, then traced every state-changing entry point of VerdictMarkets and VerdictOracle through its guards, state writes, external calls and failure paths.
• Ran the full existing suite: 202 tests pass on this tree. Probed mainnet: the Intake's live price for the action equals the configured 0.5 IMD, IMD and WETH have code, and the signer is a plain EOA.
• Wrote scratch tests under test/scratch/ for the edge cases I found and for the paths I was least sure about (re-presented primary attestation, replacement past voidAfter, claim remainder arithmetic under fuzzing). All behaved as the design states except the items below.

Findings written to .imd-findings.json

1. Medium. Schedule validation in _validateParams accepts a one-second ask window and voidAfter = type(uint64).max. A creator can publish such a market, bettors deposit, and every exit path reverts for ever. Proof test included; it fails on current code.
2. Low. The retry gate in resolve reads the oracle's pending slot. A signed delivery the market cannot use clears that slot, so neither proposal nor retry is possible and the market stalls until voidAfter with the fee spent. Documented and disputed by the author; reported from the control-flow side with exact inputs.
3. Info. The oracle pays its stored price rather than reading the Intake's. An Intake-side price move blocks every ask for at least the 48-hour config delay. Launch configuration itself verified correct.
4. Info. Trust assumptions: per-request captured signer, delayed rotation, and the vendored SignatureChecker switching to ERC-1271 if the signer EOA ever carries EIP-7702 code.

Coverage

All 23 listed entry points have a row, plus two invariant rows. Two entry points carry findings, the rest hold. Nothing was left unreached.

Done. The lint notes are the same block.timestamp pattern the existing accepted suites use, and nothing in the new files reads a saved timestamp across a warp, so I left them.

Summary

Outcome: forge build and forge test pass. The full suite is now 224 tests across 30 suites, all green. The 22 new tests cover the Ethereum mainnet launch specifically; no defect was found, so .imd-findings.json was not written.

What I added (all under test/):

• test/mocks/MainnetBytecode.sol holds WETH9's real runtime bytecode, read from chain 1 at block 26172235 and committed as a Solidity literal. The suite needs no RPC. IMD's 23 KB runtime crashes solc as a literal, so slot 0 keeps the OpenZeppelin-based mock at the IMD address.
• test/MainnetFixture.sol builds chain 1 with the brief's dependency addresses populated, deploys the three contracts from the exact constructor bytes in the launch order, and walks the launch owner through the real 48-hour signer rotation because the launch signer's key is unavailable.
• test/MainnetDependencies.t.sol has 20 tests on the brief's settings and their failure paths: every misconfigured constructor argument rejected, the chain-1 EIP-712 domain, the Sepolia vector signature refused on mainnet, the full WETH flow through WETH9's payable fallback and withdraw, exact fee splits at both caps, caps to the wei and per market, the allowlist starting on and empty, two-step guardian and owner handover, the restarted 48-hour clock, a pre-rotation request keeping the launch signer, the 0.25 IMD reward ceiling with the 2.25 IMD bounty floor, and a 1000-run fuzz closing both ledgers with the owner receiving nothing.
• test/MainnetInvariant.t.sol runs 160 random sequences of 64 calls against that deployment, including price rotations through the delay and outsider attempts at privileged calls. It checks custody per token, that treasury, burn vault and owner hold exactly their share, the reward ceiling, and that roles stay as deployed. Every sequence then drains to zero.
• test/TESTING.md documents the new suites.

Verified against live state through a public RPC today: IMD, WETH9 and Intake v2 have code, the symbols and decimals match, and the Intake prices the action at 0.5 IMD.

Observations, not findings:

• VerdictOracle uses request rather than Intake v2's requestWithFailure. The deployment doc records this as intended, and the void timeout covers a missing answer.
• Under via-IR, solc may re-read block.timestamp after vm.warp instead of keeping a saved local. This only affects test code. The new tests derive deadlines from contract getters to avoid it.

Still owed: a fork run against live mainnet state for the IMD token itself, since only its ERC20 semantics are modelled locally. The files are left uncommitted in the working tree for the harness to pick up.

The review is complete and written to .imd-findings.json. Git shows no tracked file changed, only the findings file and my scratch tests.

Outcome: all eight specialist findings reproduced against the code and were kept, with severities unchanged. One finding of my own was added on the manifest. No critical or high defects exist. The existing suite passes in full.

Findings, most severe first

1. Medium, createMarket. No minimum ask window and no bound on voidAfter, so a creator can publish a market whose collateral can never be asked, voided or claimed. The specialist's attached proof fails on this tree as stated, so it is carried on the finding.
2. Low, resolve/escalate. The permissionless, rewarded 24-hour retry shares the two-ask budget with escalation, so an interested bettor can buy it ahead of a slow answer and remove the dispute right.
3. Low, resolve. A signed delivery the market cannot use clears the pending slot, blocking both proposal and retry until voidAfter.
4. Low, resolve. Markets with an empty pool still sell asks and pay three settler rewards from the creator's bounty.
5. Low, escalate. Escalation is sold and the window extended even when the doubled panel exceeds the oracle's 100-seat cap.
6. Low, VerdictOracle. Inherited one-step renounceOwnership strands every owner-settable parameter, unlike the guarded renounceGuardian.
7. Low, launch.json (mine). Both owner arguments use the $owner placeholder where the brief states the owner address literally and the recipe asks for the static address. Harmless only if the placeholder resolves to that exact wallet, which the manifest cannot enforce.
8. Info. The oracle price is stored config, so an Intake-side price move stalls asks for the 48-hour config delay.
9. Info. Trust assumptions around the captured per-request signer and an EIP-7702 delegated signer.

Verification done: every kept behaviour runs in test/scratch/JudgeRepro.t.sol, six demonstration tests that pass on the current code. Contract sizes are within limits and the constructors make no external calls, so the factory rehearsal is unaffected. The manifest's shape, argument counts, order and values match the brief apart from the owner placeholder.

Fixed the lockup finding: request windows must span at least one hour, and timeout deadlines must fall within 365 days of creation.

Build, reviewer proof, independent-review suites, and all 219 delivered tests pass offline. All 11 findings have responses; ADAPTATION.md records the changes. web/ and dist/ are untouched.

Live deployment and confirmed addresses remain pending the launch service.

Done. The revised source (the new creation-time schedule bounds in _validateParams) did not break anything in my mainnet suite, and I found no defect in the revision, so no findings file was written.

What changed since my accepted round Another contributor fixed audit finding 73ad1052 by rejecting ask windows under one hour and timeouts more than 365 days after creation. My existing mainnet fixture, dependency tests and invariant campaign passed unchanged against it.

What I added, all under test/

• test/MainnetDependencies.t.sol: three tests pinning the new bounds at the exact mainnet deployment. In both slots, a window one second short, a timeout one second long, a distant close and two unordered schedules are refused before any bounty moves and without consuming a market id. Exactly one hour and exactly 365 days are accepted, and a market at each cap with the 0.25 IMD reward ceiling asks in the window's last second, is refused at the window end, voids at the timeout, pays the keeper once and refunds the full stake with nothing to the treasury, vault or owner. A 600-run fuzz over close, answer start, window and lifetime asserts acceptance exactly when both bounds hold and that an accepted market returns its untouched bounty at timeout.
• test/MainnetInvariant.t.sol: a probeSchedule handler action that offers an out-of-bounds schedule at any point of a random sequence and asserts refusal, untouched custody and unchanged market count, or EntryPaused first while paused. The deterministic reachability test drives all three bounds plus the paused case.
• test/TESTING.md: a revision section describing the above.

One harness issue worth knowing A first draft of the boundary test failed because, under via-IR, the optimizer hoisted a block.timestamp expression out of a loop containing vm.warp, so the second slot reused the first slot's deadline. The new tests read the clock through vm.getBlockTimestamp(). This is a test artifact, not contract behaviour, and is noted in TESTING.md.

Verification

Nothing was installed, no configuration file was touched, and the working tree is left uncommitted for the harness to pick up.

The one medium finding from last round is fixed, and none of the earlier findings stays open. .imd-findings.json has an empty findings list and a coverage record for all 22 entry points, each marked holds.

Medium (collateral locked forever): fixed. _validateParams in src/VerdictMarkets.sol (line 601) now rejects markets whose answer window is under 1 hour, or whose voidAfter is more than 365 days after creation. Measuring from creation also stops a distant closeAt from getting around the limit. The checks above it guarantee both subtractions can't underflow. I copied both supplied proofs (Proof_73ad105210ae, Proof_e8e371f10ea6) into test/scratch/ and ran them: both now pass, because the reported input reverts InvalidParams. Last round the same proof failed. With the bound in place, every market reaches a final state: an open one can be voided within 365 days and refunded, and a provisional one can be finalized or voided once its dispute deadline passes.

Low and info advisories: settled, not reopened. The author reproduced each one with their own test, and I agree with the result. They declined code changes and documented each behaviour in the README and operator guides instead. That is the right answer here, because the brief asks to deploy the audited contracts without changing their behaviour. None of them loses principal or bypasses a permission:

• A retry ask uses up the escalation ask.
• A signed answer that fails the market's own checks blocks the retry. The new 365-day limit now caps the wait.
• On a market with no bets, the creator's bounty is still spent on oracle asks and settler rewards.
• Escalation can't succeed when the first panel had more than 50 members.
• renounceOwnership on the oracle is one step.
• The oracle uses its stored price rather than reading the Intake's live price.
• Signer trust assumptions.

$owner in launch.json: dropped. The brief names 0x397dacb1ee8e9a8ce5196988958f56bde0a0a312 as the launch owner, so $owner resolves to that address. I can't reproduce the failure where the role lands on a different wallet. The other constructor arguments match the brief position for position.

New code and other checks:

• Tests: the full suite passes (246 tests).
• Size: VerdictMarkets is 17,837 bytes deployed, under the 24,576 limit.
• Untouched paths: no commit touches web/ or dist/, and docs/agents/addresses.json still holds null addresses for the deployment step to fill.
• Changed lines: I read them as new code and found no new defects.
• Static-analysis leads: the reentrancy, strict-equality and uninitialized-local lines don't reproduce as defects. The external calls go only to the configured oracle and Intake, and both are covered by exact-balance checks.

The fix is a small, deliberate tightening of createMarket compared with what was deployed on Sepolia in launch 1301. The author records it as the only behaviour change. I deleted my scratch copies, and no tracked file was changed.