X: https://x.com/imdplace

Goblin Gold v3.4: fix every high, medium and low finding of audit 1f9510eb (commit 170070d). Keep the design. Add each auditor proof as a test that now passes.

1. HIGH odds escalation (BagGacha.sol:640): never move odds of an empty tier upward. An empty tier's odds may only move down to the nearest lower non-empty tier; if none exists (weights[0] == 0 and no lower non-empty tier), those odds are not redistributed upward: treat the regular lane as empty for that request (Genesis-only spin, or NothingToDraw when Genesis is unavailable). A tier's effective odds never exceed its own odds plus the odds of higher empty tiers. OddsEscalation test passes (odds[2] <= 700).
2. MEDIUM dust tick (V3Depth.sol:74): inside the fixed band walk up to 8 initialized ticks per direction using IUniswapV3Pool.ticks(t).liquidityNet, carry L' = L +/- liquidityNet across each crossing and use min(L, L') for the next segment; start each search strictly beyond a tick whose price equals sqrtPrice (treat it as crossed, as the v3 swap loop does). DustTick tests pass (one dust tick keeps >= 50% of depth; parked-at-tick depth > 0).
3. MEDIUM POLManager wiring (GoldHook.sol:370): add mintEscrow() and poolManager() to IHookPOL; bindCheck and bindGacha also require pol.mintEscrow() == NFT and pol.poolManager() == address(poolManager). Mirror both in CheckLaunch.s.sol; extend testBindCheckChecksEveryWireWithoutWaitingForReview. MintEscrowWire test now expects GachaMismatch.
4. LOW band scaling (V3Depth.sol:36): additionally require the unscaled WETH released inside the band to be at least 1 ETH and bound the payout cap by a fixed multiple of that released amount; state in README and the Curator policy string that the gate is liquidity-equivalent plus a 1 ETH in-band capital floor.
5. LOW Genesis liveness: document in README and runbook that startTime must be at least 4 h after the first post-seed swap and that a keeper makes a dust GOLD swap at least every 50 minutes; add the keeper step.
6. LOW CheckLaunch funding: revert only when balanceOf(vault) < genesisSupply, log any surplus.
7. LOW CheckLaunch VRF and constructor words: call gacha.spinPrice() and require fee > 0 and total > fee; compare address(gacha.vrf()) with the chain wrapper passed as a script argument; check gacha.curator() and gacha.startTime() against script arguments.
8. Re-pin GACHA_RUNTIME_CODE_HASH under the launch profile (FOUNDRY_VIA_IR=false FOUNDRY_BYTECODE_HASH=none). All tests and v4 fork tests pass under that profile; every runtime under 24,576 bytes; getHookPermissions still matches REQUIRED_FLAGS. Report every new creation and runtime hash.