• lowClaim evidence accepts a second leaf for the same wallet in one round, crediting more than the distributor deliveredsrc/MerkleClaimEvidence.sol:50

  MerkleClaimEvidence.attest proves a claim by (1) the distributor's boolean claimed[round][account] flag and (2) a Merkle proof of (account, amount) against the round's root.

  The verified MerkleDistributor stores no amount, so when a round's tree contains two leaves for one account (OpenZeppelin's StandardMerkleTree does not forbid duplicates, and IMD's builder is not verifiable from here), the wallet can natively claim the smaller leaf (which sets the flag) and then attest the larger one. hook.syncRewards then adds the larger amount to E, so the wallet gains sale quota on tokens it never received.

  The over-credit is bounded by the tree's largest duplicate leaf and requires IMD's tree to be malformed; the adapter cannot distinguish the two leaves on chain. README already records this as an unenforceable assumption (known issue 4); this finding gives it a concrete failing input.

  Possible fixes: the adapter records only the first attested amount per account and refuses any amount larger than the round's per-account maximum visible to it (not available on chain), or the credit is reconciled against the distributor's roundOf(round).claimed delta observed between two attestations (only exact when one claim happens between them), or IMD's tree builder guarantees one leaf per account per round and states so in the launch record.

  whole finding

  Open a round whose tree is [(alice, 100e18), (alice, 500e18)].

  Call distributor.claim(0, alice, 100e18, [leaf(alice,500e18)]): alice receives 100e18 and claimed[0][alice] = true.

  Call evidence.attest(0, alice, 500e18, [leaf(alice,100e18)]).

  Expected: refused or not counted, evidence.claimed(alice) == 100e18 == alice's balance.

  Actual: accepted, evidence.claimed(alice) == 500e18 while alice holds 100e18; hook.syncRewards(alice) then credits 500e18 of E.

  proof · a Foundry test the fix has to pass

  // SPDX-License-Identifier: MIT
  pragma solidity 0.8.26;
  
  import {Test} from "forge-std/Test.sol";
  import {MerkleProof} from "@openzeppelin/contracts/utils/cryptography/MerkleProof.sol";
  import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
  import {UnlkToken} from "src/UnlkToken.sol";
  import {MerkleClaimEvidence} from "src/MerkleClaimEvidence.sol";
  import {IMerkleDistributor} from "src/interfaces/IIntegration.sol";
  
  /// @dev The claim path of IMD's verified `MerkleDistributor`, reduced to what the adapter reads: a per-round,
  /// per-account `claimed` flag (no amount), the round's root, and a transfer of exactly the proven leaf amount.
  contract DistributorStandIn {
      struct Round {
          bytes32 root;
          uint256 funded;
          uint256 claimed;
          uint64 unlocksAt;
      }
  
      IERC20 public immutable token;
      address public immutable opener;
      Round[] private rounds;
      mapping(uint256 => mapping(address => bool)) public claimed;
  
      constructor(IERC20 token_) {
          token = token_;
          opener = msg.sender;
      }
  
      function openRound(bytes32 root, uint256 funded) external {
          rounds.push(Round(root, funded, 0, uint64(block.timestamp)));
      }
  
      function claim(uint256 round, address account, uint256 amount, bytes32[] calldata proof) external {
          Round storage current = rounds[round];
          require(!claimed[round][account], "AlreadyClaimed");
          bytes32 leaf = keccak256(bytes.concat(keccak256(abi.encode(account, amount))));
          require(MerkleProof.verifyCalldata(proof, current.root, leaf), "InvalidProof");
          claimed[round][account] = true;
          current.claimed += amount;
          require(token.transfer(account, amount));
      }
  
      function roundOf(uint256 round) external view returns (Round memory) {
          return rounds[round];
      }
  
      function roundCount() external view returns (uint256) {
          return rounds.length;
      }
  
      function swept(uint256) external pure returns (bool) {
          return false;
      }
  }
  
  /// @notice A round whose tree holds two leaves for one wallet (OpenZeppelin's StandardMerkleTree does not
  /// forbid it). The distributor lets the wallet claim exactly one of them; the adapter then accepts the OTHER
  /// leaf as evidence, because it only sees the boolean flag and a valid proof. Credit exceeds delivery.
  contract Proof_DuplicateLeafOverCredit is Test {
      address alice = address(0xA11CE);
  
      function _leaf(address account, uint256 amount) internal pure returns (bytes32) {
          return keccak256(bytes.concat(keccak256(abi.encode(account, amount))));
      }
  
      function _pair(bytes32 a, bytes32 b) internal pure returns (bytes32) {
          return a < b ? keccak256(abi.encodePacked(a, b)) : keccak256(abi.encodePacked(b, a));
      }
  
      function testEvidenceNeverExceedsWhatTheDistributorDelivered() public {
          UnlkToken token = new UnlkToken();
          DistributorStandIn distributor = new DistributorStandIn(IERC20(address(token)));
          token.transfer(address(distributor), 600 ether);
          bytes32 small = _leaf(alice, 100 ether);
          bytes32 large = _leaf(alice, 500 ether);
          distributor.openRound(_pair(small, large), 600 ether);
          MerkleClaimEvidence evidence =
              new MerkleClaimEvidence(IMerkleDistributor(address(distributor)), address(token));
  
          bytes32[] memory proofSmall = new bytes32[](1);
          proofSmall[0] = large;
          distributor.claim(0, alice, 100 ether, proofSmall);
          assertEq(token.balanceOf(alice), 100 ether, "the distributor delivered the small leaf");
  
          bytes32[] memory proofLarge = new bytes32[](1);
          proofLarge[0] = small;
          // Expected: evidence for a leaf the distributor never paid is refused, or at least never counted.
          try evidence.attest(0, alice, 500 ether, proofLarge) {} catch {}
          assertEq(
              evidence.claimed(alice),
              token.balanceOf(alice),
              "the adapter credits more than the distributor delivered"
          );
      }
  }

  whole proof

• mediumFixed 10 ETH quote-depth floor can make the first $100K tier unreachable (unresolved audit finding, requester decision required)src/UnlkOracle.sol:21

  UnlkOracle marks an observation liquid only when the seed position holds at least MIN_QUOTE_DEPTH = 10 ETH of actual quote principal. With the 870M token-only seed opening at about 25 ETH FDV and ETH at $2,000, about 9.5 ETH of buys lifts spot FDV past $100K while the seed holds under 10 ETH, so fdvUsd() reverts and tier 1 cannot confirm until roughly $137K FDV. At higher ETH prices the gap widens.

  The conflict is structural between a fixed ETH floor and a fixed USD threshold; the brief forbids changing either silently. Options are the requester's: lower MIN_QUOTE_DEPTH, raise the first threshold, or express the floor in USD through the same feed. Each is a one-constant change in UnlkOracle with a matching pin in UnlkHook._verifyOracle.

  test/TwoStage.t.sol testDepthFloorBlocksFirstTierAtSpotAbove100k: after activation, bob buys 9.5 ETH; spot FDV at $2,000/ETH >= 100,000e18 and the seed's quote depth < 10 ether; two full confirmation cycles later hook.tier() is still 0 and oracle.fdvUsd() reverts InvalidOracle. Expected by the brief: the $100K tier confirms once the TWAP holds above it for an hour.

• mediumSustained price manipulation for 90 minutes buys a permanent quota bypass for every wallet (unresolved audit finding, scope decision required)src/UnlkHook.sol:499

  _updateMilestone starts qualifyingSince for every tier above the current one in the same call, so one actor who lifts the 30-minute TWAP past $5M FDV and holds it for a further hour with calls at most 5 minutes apart has tiers 1-6 confirm together and fullyUnlocked becomes true permanently, including for transfer-only holders. Counter-selling cannot discipline this because sales are themselves capped by the quota rule until the bypass.

  The reviewer measured about 206 ETH of buys at $2,000/ETH absorbing about 37 ETH of quota-limited counter-sales and about 203 ETH recovered on exit: roughly 40 ETH net for a permanent bypass. Mitigations (one tier per confirmation period, a longer confirmation for the bypass tier, or depth-weighted confirmation) change honest paths too and were not made unilaterally.

  test/Oracle.t.sol testSustainedManipulationRequiresWindowAndConfirmation: after the warm-up, alice buys 500 ETH, 30 minutes pass, hook.tierForFdv(oracle.fdvUsd()) == 6; after twelve updateMilestone calls 5 minutes apart hook.fullyUnlocked() is true. Expected by the brief's intent: a single actor's temporary capital should not permanently remove every wallet's quota.

• infoA wallet whose cumulative native claims exceed the 10% swarm allocation can never synchronize any reward creditsrc/UnlkHook.sol:448

  pendingRewardCredit reverts InvalidEvidence when rewards.claimed(recipient) > token.SWARM_ALLOCATION(). The cap is a sanity bound, but it is all-or-nothing: once exceeded (only possible if the treasury funds later rounds beyond the 100M the factory placed in the distributor), syncRewards reverts permanently for that wallet, including the part under the cap that was never credited.

  Fail-closed and bounded, recorded so operators know the treasury must not pay any single wallet more than 100M UNLK across rounds if that wallet is to keep sale rights.

  test/EvidenceAndOracleProperties.t.sol testEvidenceBeyondTheSwarmAllocationIsRefusedNotTruncated: with rewards.claimed(alice) written to 100,000,000e18 + 1, hook.pendingRewardCredit(alice) and hook.syncRewards(alice) revert InvalidEvidence and eligible(alice) stays 0; at exactly 100,000,000e18 the full amount is credited.

• infoA PoolManager protocol fee on this pool halts all router trading permanently (accepted fail-closed dependency)src/UnlkHook.sol:310

  beforeSwap refuses every swap while getSlot0 reports protocolFee != 0 or lpFee != 12500, and the oracle marks such observations illiquid. If Uniswap governance ever sets a protocol fee on this pool, the only authorized sell route is gone for the life of the token with no admin to restore it; transfers and native claims keep working. This is the price of the sealed 1.25% (1%/0.25%) fee promise.

  Sepolia's PoolManager has protocolFeeController() == address(0) today.

  test/Adversarial.t.sol testProtocolFeeChangeCannotSilentlyAlterTradingEconomics: after manager.setProtocolFee(key, 500) a router buy reverts and eligible stays 0, while an ERC-20 transfer succeeds.

• mediumThe 10 ETH quote-depth floor conflicts with the $100K first tier: with the token-only seed, FDV passes $100K while the seed holds under 10 ETH, so every observation is illiquid, fdvUsd reverts and tiesrc/UnlkOracle.sol:21

  Settled from round 1 (id a52eab30): the author reproduced it, changed no code, and documented it as README known issue 1 with the gap quantified at $2,000 and $2,555 per ETH, the ETH price above which the conflict exists (about $1,460) and three one-constant resolutions.

  I agree with the author's dispute that the choice is the requester's and that the brief forbids changing thresholds or oracle settings silently; the finding is kept because the promised guarantee (35% at a verified $100K FDV) still cannot hold at today's ETH price, and the launch should not proceed until the requester picks an option.

  UnlkOracle.checkpoint marks an observation liquid only if the ETH principal in the seed range is >= MIN_QUOTE_DEPTH (src/UnlkOracle.sol:102 bool liquid = sqrtPrice != 0 && liquidity >= MIN_LIQUIDITY && depth >= MIN_QUOTE_DEPTH), twapTick reverts on an illiquid last observation or any illiquid second in the window (src/UnlkOracle.sol:129, 143), and UnlkHook._updateMilestone then takes its catch branch and returns false.

  With the factory's 870M token-only seed at normalized tick -174960 and ETH/USD $2,000, about 9.5 ETH of buys lifts spot FDV above $100K while the seed holds under 10 ETH, so the first tier is unobservable for all FDV between $100K and roughly $137K. Not a loss of funds; a promised guarantee that cannot hold.

  Resolution options (requester): lower MIN_QUOTE_DEPTH, raise the first threshold, or a USD-denominated floor, each with the matching pin in UnlkHook._verifyOracle (src/UnlkHook.sol:286).

  whole finding

  Existing test test/TwoStage.t.sol::testDepthFloorBlocksFirstTierAtSpotAbove100k (passes in the suite, demonstrating the defect): activate, _buy(bob, 9.5 ether); assert spot FDV >= 100_000e18 and seed depth < 10 ether; run two full 90-minute confirmation cycles (_confirm() twice: updateMilestone every 5 minutes).

  Expected per brief: tier() == 1, p == 3500.

  Actual: tier() == 0 and oracle.fdvUsd() reverts InvalidOracle.

  Re-run here on this code: PASS (defect present).

  My scratch test (test/scratch/DipNearFloor.t.sol) also logs depth 10.27 ETH and FDV $108,738 after a 10.4 ETH buy at $2,000/ETH, i.e. the floor is only crossed well above the first threshold.

  whole reproduction

• mediumSustained-price manipulation buys a permanent quota bypass for every holder; the arbitrage that is supposed to make it costly is itself capped by the quota rule (unresolved from round 1; scope decisiosrc/UnlkHook.sol:512

  Settled from round 1 (id 18a69b14): the author reproduced it, changed no code, and documented it as README known issue 2 with the measured cost (about 206 ETH deployed, about 37 ETH of quota-limited counter-sales absorbed, about 203 ETH recovered, roughly 40 ETH net), why arbitrage cannot cap it, and three mitigations with their effect on honest paths.

  I agree that each mitigation changes the unlock schedule for honest price discovery and so needs the requester's decision; the finding is kept because the quota scheme the brief centres on remains removable by one funded actor at a cost that does not scale with the manipulated price.

  Mechanism, unchanged: every tier above the current one gets its qualifyingSince in the same _updateMilestone call (src/UnlkHook.sol:499-508), so a 30-minute TWAP window plus one 60-minute confirmation with calls <= 5 minutes apart confirms tiers 1..6 together and sets fullyUnlocked permanently (line 512; 'price falls never relock').

  Only wallets with eligible credit can sell into the spike, each at most p = 25% of E (src/UnlkHook.sol:338), and transfer-only holders cannot sell at all, so counter-selling is bounded by the sum of existing quotas, smallest right after activation. The fix to the catch branch (round-1 finding 9b6dd839) does not change this cost: the attacker never needed an invalid-data path.

  whole finding

  Existing test test/Oracle.t.sol::testSustainedManipulationRequiresWindowAndConfirmation (passes, demonstrating): activated system with >= 10 ETH depth, _buy(alice, 500 ether); _advance(30 minutes); updateMilestone() -> tierForFdv(oracle.fdvUsd()) == 6, fullyUnlocked() false; then 11 x (_advance(5 minutes); updateMilestone()) -> still false; one more -> fullyUnlocked() == true, remainingQuota(any) == type(uint256).max, alice may sell all 500 ETH worth of tokens back.

  Expected per brief: a permanent unlock should not be purchasable by one funded actor at the cost of LP fees plus other holders' capped quotas.

  Re-run here on this code: PASS (defect present).

  whole reproduction

• lowA one-block depth dip near the 10 ETH floor still restarts a pending confirmation: one illiquid second invalidates the TWAP for the next 30 minutes, longer than MAX_CONFIRMATION_GAP, so the first valisrc/UnlkOracle.sol:143

  The round-1 fix holds for what it claims: the catch branch in UnlkHook._updateMilestone now only returns false (src/UnlkHook.sol:491-495) and the failing calls neither erase qualifyingSince nor touch lastConfirmation (verified: five keeper calls during the blackout left both unchanged).

  But the price-based trigger I merged into that finding is only partly closed. twapTick requires zero illiquid seconds inside the 30-minute window (line 143) and an observation is illiquid when seed depth < MIN_QUOTE_DEPTH (src/UnlkOracle.sol:102).

  While depth sits just above 10 ETH, which is the normal state while the first tier is being confirmed (finding 1), any holder with quota can sell a small amount that pulls depth under 10 ETH, which afterSwap's checkpoint records as liquid == false, then buy back 12 seconds later. That single illiquid block makes fdvUsd() revert for exactly 30 minutes.

  Because a failed read is not an observation, lastConfirmation stays at the last good call, the 30-minute gap exceeds MAX_CONFIRMATION_GAP = 5 minutes (src/UnlkHook.sol:497 if (block.timestamp - lastConfirmation > MAX_CONFIRMATION_GAP) delete qualifyingSince;), and the first valid call restarts every tier's hour.

  Cost to the griefer: two 1.25% LP fees on about 0.3 ETH of round trip (under 0.01 ETH) per 90 minutes of delay; it needs pre-existing eligibility of roughly four times the depth margin above the floor, so it is limited to the near-floor regime of finding 1 and to actors who already bought.

  Not a loss of funds, and the brief's 'invalid data blocks new tiers only' is arguably met for the failing call itself, but the hour restarting because of one block of bad data is the same outcome the round-1 finding described, reached through the gap rule instead of the catch branch.

  Mitigation inside the design: tolerate a bounded number of illiquid seconds per window (for example reject only if endBad - startBad exceeds a small fraction of WINDOW), or do not count an invalid stretch shorter than MAX_CONFIRMATION_GAP plus WINDOW as unobserved time. Either is a change to a reviewed oracle rule and needs the requester's sign-off; it is reported here so it is decided together with finding 1 rather than discovered after launch.

  whole finding

  SystemFixture (test/fixtures/SystemFixture.sol), activated, feed $2,000. alice buys 10.4 ETH (depth 10.27 ETH >= 10, spot FDV $108,738). _advance(30 minutes); oracle.checkpoint(); hook.updateMilestone() at t0 -> qualifyingSince(0) == t0. _advance(5 minutes); updateMilestone() -> unchanged. alice sells 3% of her tokens (within her 25% quota): depth 9.83 ETH (< 10). _advance(12); alice withdrawNative() and buys the proceeds back: depth 10.26 ETH.

  Then updateMilestone() every 5 minutes for 25 minutes: each call leaves qualifyingSince(0) == t0 and lastConfirmation unchanged (fix 1 holds).

  At t0 + 5 min + 12 s + 30 min (first valid TWAP) updateMilestone(): lastConfirmation advances, qualifyingSince(0) == 1800003912 > t0 == 1800001800 (restarted), tier() == 0.

  Expected per brief: a one-block dip delays at most one observation; actual: 30 minutes without milestone data and the hour restarts.

  Run: test/scratch/DipNearFloor.t.sol::testOneBlockDipStillRestartsConfirmationViaGapRule (a demonstration test: it passes on this code, showing the restart; source summarized above, built on SystemFixture with _buy/_sell/_advance helpers).

  whole reproduction

• infoClaim evidence accepts a second leaf for the same wallet in one round, crediting more than the distributor delivered (unenforceable on chain; operational check on IMD's tree required, as the brief saysrc/MerkleClaimEvidence.sol:56

  Reproduced the tester's finding (write_foundry_tests ac2017e7) with its attached proof on this code: FAIL 'the adapter credits more than the distributor delivered: 500000000000000000000 != 100000000000000000000'. attest proves a claim by the distributor's boolean claimed[round][account] flag (line 51) plus a Merkle proof of (account, amount) against the round's root (lines 52-54).

  The verified MerkleDistributor stores no amount, so when a round's tree holds two leaves for one account the wallet can natively claim the smaller leaf (setting the flag) and attest the larger one; hook.syncRewards then adds the larger amount to E. The adapter cannot distinguish the two leaves on chain; the distributor's Round.claimed total is not per account.

  So there is no code fix within the design, which is why this is recorded as information: the brief's 'confirm one leaf per recipient per round against the actual tree if required by the adapter' is exactly the off-chain check the operator must run on IMD's tree before stage 2, and README known issue 4 states the assumption. Over-credit is bounded by the tree's largest duplicate leaf and the SWARM_ALLOCATION cap in pendingRewardCredit (src/UnlkHook.sol:448).

  whole finding

  Open a round whose tree is [(alice, 100e18), (alice, 500e18)]. distributor.claim(0, alice, 100e18, [leaf(alice,500e18)]): alice receives 100e18, claimed[0][alice] = true. evidence.attest(0, alice, 500e18, [leaf(alice,100e18)]).

  Expected: refused or not counted, evidence.claimed(alice) == 100e18.

  Actual: accepted, evidence.claimed(alice) == 500e18 while alice holds 100e18; hook.syncRewards(alice) would credit 500e18 of E.

  Run: copy .imd/reads/proofs/Proof_ac2017e77bf9.t.sol to test/scratch/ and forge test --match-path test/scratch/Proof_ac2017e77bf9.t.sol -> FAIL as quoted (run here).

  whole reproduction

• infoA PoolManager protocol fee on the official pool halts every swap permanently, with no recovery path (accepted fail-closed dependency, now documented; unchanged from round 1)src/UnlkHook.sol:310

  Settled from round 1 (id 2142eaf0): the author reproduced it, kept the fail-closed design, and recorded it as README known issue 8 with the exact failing state, what keeps working (transfers, native claims), the alternative (tolerate protocolFee != 0 while pinning lpFee) and its cost, plus the Sepolia check that protocolFeeController() == address(0) at block 11898691. beforeSwap refuses every swap once getSlot0(poolId).protocolFee != 0, and UnlkOracle.checkpoint (src/UnlkOracle.sol:102-103) marks every observation illiquid under the same condition; the hook is sealed with no admin.

  The trust assumption is on Uniswap's protocol-fee controller, an external actor. Recorded as information so the dependency stays visible; no code change requested.

  Existing test test/Adversarial.t.sol::testProtocolFeeChangeCannotSilentlyAlterTradingEconomics (passes): SystemFixture after activation; manager.setProtocolFeeController(address(this)); manager.setProtocolFee(key, 500).

  A router buy reverts UnlkHook.InvalidPool from beforeSwap; eligible stays 0; an ERC-20 transfer still succeeds.

  Expected per brief: sale within quota succeeds at the 1.25% LP fee; actual: no official-pool trade is possible from then on and no function can restore it.

Failed in the task.