Implemented BAND and PriceBandHook with vendored dependencies, ABI exports, and deployment/operations documentation.

Verified with Solidity 0.8.26 in an empty environment:

• forge build passed.
• forge test passed: 44 tests, no failures or skips.
• forge fmt --check passed.
• Exported ABIs match compiled artifacts.

Independent review, launch.json, deployment, and the website remain separate assignment/service responsibilities.

Created launch.json.

• Schema and implementation checks passed.
• Records the rehearsal’s tick-zero initial price, explicitly documented in notes.
• Notes: 2,043/4,000 characters.
• Offline forge build succeeded; all 138 tests passed.
• Only launch.json changed outside disposable scratch output.

I found one real problem, and it comes from the approved design rather than from a coding mistake. The hour accounting itself held up under every attack in scope. I wrote two findings to .imd-findings.json, ranked by severity, and changed no other file. I ran the reproductions in a scratch copy at /tmp/pbreview using the repo's own test fixture, and both pass as written.

1. Medium: you can walk the band for free and block buys (src/PriceBandHook.sol:98)

• What it costs to hold the edge for an hour: in an empty price range, only gas. A one-sided BAND seed has to sit entirely below the opening tick, so everything above it has no liquidity. Uniswap v4 moves the price through an empty range with 0 tokens in and 0 out.
• Reproduction: an attacker holding 0 ETH and 0 BAND makes two free swaps an hour apart, to ticks 1823 and 3646. The band's range becomes [1415, 5469], which sits entirely above the seeded liquidity at [-12000, -60].
  • From then on, any 1 ETH buy with no price limit reverts with PriceOutOfBand.
  • A buy that stops at the band's lower edge succeeds but returns 0 BAND, because there is no liquidity inside the band.
• Worse version: the first hour has no band, so one free swap to tick 887271 right after initialisation sets the first hour's average to 887271. The band can move down at most 2231 ticks an hour, so getting back to tick 0 takes about 398 hours (16.6 days) of someone holding the lower edge. The attacker can undo that with another free swap every block.
• Why re-implementing won't help: the code does exactly what the brief specifies, so fixing this needs a scope decision. Options include weighting the average by liquidity, ignoring ticks outside the seeded range, or having the factory seed right up to the opening price.
• Why the tests miss it: the fixture's _move always spends a large input, and the launch rehearsal never moves the price through an empty range.

2. Info: small swaps toward the band can still revert (src/PriceBandHook.sol:102)

• This matches the brief's "strictly closer" rule, so it isn't a code defect. But it contradicts the brief's claim that a swap back toward the band is never blocked.
• Reproduction: hold the lower edge for 3599 seconds, then jump to the upper edge in the last second. The last price ends up 2230 ticks outside the new band. A tiny buy that doesn't change the tick then reverts with PriceOutOfBand(1822, -4461, -407), even though it moves the price toward the band.
• The pool never fully freezes: any swap large enough to cross a tick toward the band goes through.

What I checked and found correct:

• Hour boundaries: swaps landing exactly on a boundary, one second before it, and across multi-hour gaps all close the right hour. The hour value returned by band() and emitted by HourClosed is correct.
• Negative ticks: averages round toward negative infinity as required.
• Initialisation hour: it counts only the seconds after initialisation, and the average can never divide by zero.
• Gaps: an idle gap of any length costs constant work, as required.
• band() view: it uses the same code path as the swap check, so it reports exactly what the next swap enforces.
• Test quality: the existing differential fuzz test in test/HourModel.t.sol checks the rolling average against an independent reference.
• Same-block swaps: pushing the price and reversing it within one block has zero time weight, so that manipulation does nothing.

Implemented source, static export, deployment manifest, and verified ABIs.

• Build, typecheck, and 22 tests passed.
• Browser and live RPC checks passed.
• Export: 0.61 MiB; candidate bundle: 1.47 MiB.

Validation and limitations · Design

Git commit was blocked by read-only .git. The design document is under docs/ to respect the write scope. No transactions were broadcast.