The review is complete and .imd-findings.json holds two findings. No source file was changed, and the scratch tests are removed.

What I read. All four contracts in full, with their interfaces, SwarmPrices, Labels and SafeReads, plus the test base, mocks, AUDIT.md and the protected harness. Every one of the 138 entry points is answered in the coverage finding. The 11 mainnet fork tests could not run here, so the live ABIs of the launcher, distributors, hooks, IMD6900 and the Intake rest on the repository's fork tests and the oracle reference.

What held. The offline suite passes with 142 tests. All four runtimes sit under the EIP-170 limit. The oracle verification reproduces the protocol's signed vector when a SwarmPrices harness is deployed at the vector address, so the struct, type string and domain match what the oracle signs. The callback fits the 200,000 gas stipend. Access control, link and placement bookkeeping, guardrails, selectors and the PoolManager storage reads all checked out.

The one defect, rated low. The TooLittleGas guard added for AUDIT.md's L-01 only detects an out-of-gas in the direct callee. The real work runs two to four frames deeper, and each intermediate frame hands back its retained 1/64 of gas when it reverts, so a deep out-of-gas leaves the burner with 3/64 to 5/64 and the guard passes. With an IMD6900 leg costing about 800k gas, every gas limit between 758,000 and 1,968,000 succeeds while skipping the IMD6900 buy. The share still burns as $IMD at the dead address, so no funds are lost, but the stated guarantee that out-of-gas swaps revert does not hold. The attached proof fails on this code and passes with a stricter threshold, with the existing burner tests still green. The finding suggests either a fixed gas budget per try or a threshold a deep out-of-gas cannot reach.

Two notes in the coverage finding. AUDIT.md says 144 offline tests and the suite here has 142. The renderer and artist are the only post-deployment settings, metadata only and kept by the brief.

Done. The project was already launch-shaped, so the work came down to one reproduced audit finding, its fix, its tests, and the notes.

What I found

• The four contracts already meet the launch rules: constructors store addresses and call nothing, no owner or upgrade path, no forbidden opcodes, one transaction, runtimes under the size limit. All of this was tested in test/Launch.t.sol and passes unchanged. Interfaces and constructor arguments are untouched.
• The audit's low finding reproduced. The gas guard in LARPBurner._tryUnlock only caught an out-of-gas in the PoolManager itself. The swap, hook and IMD6900 burn run several frames deeper, and each frame hands back 1/64 of its gas on revert, so a starved call passed the 1/63 check, counted the leg as failed, and skipped the IMD6900 buy. The attached proof failed on the code as it arrived.
• The informational coverage finding reports no defect and needed no action.

What I changed

• src/LARPBurner.sol: the guard now reverts with TooLittleGas when a failed try left no more than a quarter of its gas, instead of 1/63. That catches an out-of-gas down to 18 frames while a genuine revert, which returns nearly all its gas, is still skipped rather than fatal. This keeps the brief's rule that out-of-gas swaps revert. I did not take the fixed-budget alternative, since a leg that outgrew the budget would become silently skippable with no owner to raise it.
• test/LARPBurner.t.sol: three tests, all of which fail against the old guard. A heavy IMD6900 at 1M gas reverts; a sweep from 500k to 2.5M never skips the leg; a genuine failure is still skipped at 1M gas and refused rather than skipped at 300k. test/Base.sol makes the mock's burn virtual for the heavy variant.
• AUDIT.md and README.md: L-01 updated with the reason, the cost and the new tests; test count corrected to 145.
• ADAPTATION.md: each change, the finding that required it, what was left alone and why, and the checks run.

The one cost worth knowing: a leg that reverts for a real reason after heavy work, such as an empty pool whose swap walks the whole tick range, now needs a gas limit about a third above that work. Gas used is unchanged and a refused call moves nothing.

Verification: forge build is clean. The full offline suite with an empty environment passed 145 tests and skipped the 11 fork tests. Build configuration, dependencies and launch.json were not touched.

launch.json is written and verified. It is the only file changed.

What the manifest declares, in constructor dependency order:

• LARPBurner with the 11 brief values: PoolManager, $IMD, POOL4 fee and spacing and hook, backup fee and spacing, IMD6900, pair fee and spacing and hook. The three spacings are the plain decimal words 60, 200 and 60, matching the uint24 parameters from commit 0b0e260.
• LARP with identity.md.
• IMDNames with identity.md, the LARP and LARPBurner references, the artist address stated in the brief, IMD's oracle Intake and oracle signer.
• LARPLinks with identity.md, IMD's launcher, and the LARP, IMDNames and LARPBurner references.

No owner argument exists in any constructor, so $owner is not used. The notes stay under 1600 characters and describe only what the source does. I corrected one claim while checking: royalties go to LARPBurner, and the artist only names the renderer and a successor artist until the renderer is locked.

Verification

• The JSON has exactly the keys kind, contracts and notes, with the right argument count per constructor.
• A scratch test deployed all four contracts on an empty chain with the manifest's exact arguments and confirmed every stored constant, including the int24 spacings and the swarm start prices.
• The build passed. The offline test run passed with 146 tests and 0 failures. The 11 skipped tests are fork-only tests that cannot run offline.

The review is complete. .imd-findings.json holds two findings and a coverage row for all 42 listed entry points plus five invariant and periphery rows. No source file was changed. The scratch tests are in test/scratch/, which is not kept.

Result: one medium finding, one informational note. The full suite passes offline (145 tests), and the guides' failure modes for execution trace, periphery and first principles were checked against every contract.

Finding 1 (medium), src/LARPBurner.sol:247. The gas guard in the burner's try/catch treats any failed leg that left at most a quarter of its gas as an out-of-gas and reverts the whole call. The IMD6900 leg ends in an upgradeable token's burn through a hook the same timelock owns. If that code ever consumes all the gas it is given, the guard fires at every gas limit, so burn and burnImd can never complete. Every paid entry point ends there with no other payment path, so registrations, tolls and crew founding all revert, and there is no owner or budget to recover. AUDIT.md's trust table claims a refusing IMD6900 only costs the 6.9% share, which holds for a cheap revert but not for a gas-eating one. The attached proof test fails on the current code at a 30M gas limit for both burn and burnImd. The suggested fix gives the IMD6900 leg a fixed generous gas budget and applies the quarter rule to that budget, which keeps the brief's out-of-gas rule and L-01's no-skip rule.

Finding 2 (info), src/SwarmPrices.sol:22. The comment and AUDIT.md cite callback selector 0x510379c7, which belongs to the reference's example name onOracleResult. The contract's onVerdict has selector 0x8bf09c1b and registers itself correctly, so delivery works. Only the documentation is wrong.

Checked and holding, beyond the entry points:

• The EIP-712 verdict digest reproduces the protocol's published conformance vector: a harness at the vector address accepts the vector signature from the vector signer.
• The jeet board's four external selectors were recomputed and match.
• The burner's pool storage slots and BalanceDelta decoding match Uniswap v4 for both currency orders, and partial fills revert.
• The name link and identity link mappings stay two-way through every writer, and the toll is due on every change of hands.
• Constructors store arguments only, in the brief's order.

Slither's and aderyn's leads were all checked. The strict-equality, unused-return, uninitialized-local and locked-ether lines are false positives in this code, and the reentrancy lines are guarded by the burner's transient lock and the Intake-only callbacks.

The review is complete. The findings file is written and validated, and the project's own suite still passes (145 passed, 11 fork tests skipped offline).

What I found (written to .imd-findings.json, three findings, 142 coverage rows):

1. Medium, LARPBurner.burn: MAX_BURN caps one call, not one transaction. The transient lock clears between calls and nothing records the block, so a searcher can front-run, call burn(0) five or ten times in one transaction, and back-run. At the repo's own pool depth, one 0.1 ETH burn has no profitable sandwich, but five batched calls net the bot 0.072 ETH and the burn receives a third fewer $IMD. The balance it feeds on arrives normally: royalties sit unburned until someone calls burn, and any fee above 0.1 ETH parks its remainder.
2. Low, SwarmPrices.execute: a proposal equal to the current prices passes _checkStep, gets approved whenever prices are in band, and executing it still bumps the epoch and restarts the 7-day cooldown. Whoever executes first each week strands every other approved proposal as Stale, so governance can be pinned indefinitely for 0.5 IMD a week.
3. Low, LARPBurner.receive: ERC-2981 names the burner as royalty receiver, but WETH-settled sales pay WETH, which the burner can neither burn nor move. Confirmed with a test.

Coverage: every one of the 42 state-changing entry points the verifier listed has a row, plus rows for the constructors, views and constants from the 138-item list and four invariants I checked. Nothing is marked unreached. The LARP registry's entry points are outside my economic area and are marked holds with that reason.

Not re-raised: AUDIT.md's acknowledged items (spot-price $IMD payments, oracle trust, sandwiching a single burn, name sniping) were checked against their tests and found consistent with the code.

Scratch tests are under test/scratch/ (Econ.t.sol, Weth.t.sol) and nothing else in the tree was changed.

The review is complete and .imd-findings.json is written. The tree is otherwise unchanged (scratch tests removed).

Outcome: the math holds. No critical, high or medium defects in the Math Precision, Boundary or Numerical Gap areas. Two findings, both with exact reproductions, and a coverage row for every one of the 138 entry points (none unreached).

Findings

• Low, src/LARPBurner.sol:153. MAX_PRICE (1 ETH) exceeds MAX_BURN (0.1 ETH). A registration priced above 0.1 ETH buys IMD with only 0.1 ETH, checks the registrant's minImd against that slice, and parks the rest for anyone's burn(0) with no floor. With an honest 3% floor, register reverts outright above about 0.103 ETH. Reproduction walks the price from 0.0069 to 0.1104 ETH in four permitted 2x steps. Exposure is bounded by the L-04 analysis and such prices sit outside the swarm's guidelines, hence low.
• Info, src/SwarmPrices.sol:22. The comment and AUDIT.md cite callback selector 0x510379c7, which belongs to the reference's onOracleResult; onVerdict is 0x8bf09c1b. Harmless, since the contract registers its own selector with the Intake.

What I verified beyond reading

• The protocol's published EIP-712 conformance vector verifies through onVerdict on a copy of the contract placed at the vector address, and a one-field tamper is refused. The repository's own signature tests are self-signed and could not have caught an encoding mismatch.
• The hardcoded v4 storage layout and BalanceDelta unpacking match the vendored v4-core, and all three pool keys resolve to live mainnet pools with in-range liquidity through the local RPC.
• The 2x step guardrail is exact to the wei, the spot quote sits about 1% above the fee-laden ETH buy, sub-15-wei IMD shares go wholly to DEAD, and the jeet division cannot hit zero.
• The full offline suite passes (145 tests, 11 fork tests skipped).

Leads examined and dropped: a frozen POOL4 price feeding quoteImd (closing the market withdraws its liquidity, so the quote reverts as designed), and every Slither and Aderyn line, all of which were false positives or already-tested behaviour.

The review is complete. The harness itself excludes the findings file and scratch directory from git, so both are where the verifier expects them on disk.

Deliverable: .imd-findings.json in the repository root holds 2 findings and a 142-row coverage record (all 138 entry points plus 4 invariants). Every one of the verifier's 42 state-changing entry points is answered by exact name. No row is unreached.

Finding 1 (medium, Trust Gap: access × economics) LARPBurner.burn is permissionless with a caller-chosen minImd, and its 0.1 ETH MAX_BURN cap is per call. The transient lock releases on return, so one transaction can call it repeatedly and turn all waiting ETH into one atomic trade, paying the pool fees once. The code comment and AUDIT.md L-04 rely on that cap to make sandwiching unprofitable. On the repository's own local POOL4 with 1 ETH waiting, a 10 ETH front-run around one call loses 0.118 ETH, but around ten batched calls it gains 0.347 ETH, and the IMD burned falls from 1,897 to 923. The proof at test/scratch/BurnBatchSandwich.t.sol fails on this code for exactly that reason. The suggested fix rate-limits previously-waiting ETH per block while always trading a caller's own value, so fee payments are never delayed.

Finding 2 (medium, outside my area, reported for permanence) royaltyInfo names the burner for every sale currency, but the burner can only move ETH and $IMD. Royalties paid in WETH, which is how accepted marketplace offers settle, sit in the burner forever with no owner, sweep or unwrap path. Reproduction is a plain ERC-20 transfer to the burner followed by burn and burnImd.

What held: the permission model is small and consistent. Every identity action in all three contracts goes through one canAct, the agent path cannot move tokens or ETH, the EIP-712 agent signature binds the live holder, nonce, deadline, chain and contract, the artist controls art only, and prices are written only by execute of an approved proposal in the same epoch, so the bounds and 2x step always bind. I fetched the live Intake's verified source and confirmed complete is writer-only and request ids are unique, so the oracle trust is exactly what AUDIT.md L-08 states. All 145 existing offline tests pass. The slither and aderyn reentrancy and unused-return leads were traced and rejected; each is a STATICCALL view or an intentionally ignored return.

Not reached: no mainnet fork run, so the pool depth figures come from AUDIT.md rather than a live read.

All 138 entry points are reached by an offline test, the four constructors and receive included. Only files under test/ were added, plus the findings file at the root the brief asks for.

Result

forge test --offline with an empty environment passes: 240 offline tests (145 existing, 95 new), 0 failed, 11 fork tests skipped as designed. No contract, config or dependency was changed.

No defect found. I read the four contracts adversarially (zero, one wei, the maximum, the same call twice, callers who aren't who the code assumed) and found nothing to report above informational. The one finding is a documentation error, recorded in .imd-findings.json: the selector 0x510379c7 cited in the SwarmPrices comment and in AUDIT.md belongs to the reference consumer's onOracleResult, not to this contract's onVerdict. The contract registers its real selector with the Intake, so nothing breaks.

What was added

• Burner invariants (test/LARPBurner.invariant.t.sol). A handler drives donations of ETH and $IMD, burns with random floors, a third-party trader pushing POOL4 in and out of a concentrated range, and a PoolManager that refuses unlocks. Invariants: ETH leaves only into the PoolManager, $IMD is conserved between DEAD, the IMD6900 buy and the burner, no $IMD outlives a burn, IMD6900 only ever burns, DEAD holds only $IMD.
• Swarm-price invariants (test/SwarmPrices.invariant.t.sol). Three proposers, verdicts of every strength, forgeries, strangers' callbacks, failures, executions and time. Invariants: prices equal exactly the last executed proposal, stay within the guardrails, counters match, no proposal reopens, the names contract holds nothing.
• Oracle conformance (test/SwarmPricesEdges.t.sol). The protocol's published vector signature verifies against this contract deployed at the vector's address and chain. The existing tests only signed with their own key.
• Edge and failure paths for all four contracts: constructor zero-address refusals, every constant, the full ERC-721 surface a market uses, a partial fill on POOL4 falling to the hookless pool, pools that don't exist, one wei parking, the 2x and ordering rails at their exact boundaries (fuzzed against the documented rule), verdict windows at their last second, jeet arithmetic fuzzed, crew refusals after disbanding, and more.

One thing worth knowing for anyone reading the fork suite later: the links contract's hard-coded distributor selectors match the local mock by construction, so only the fork tests can confirm them against IMD's real distributor.

Review complete. The findings file holds six substantiated findings and a coverage row for all 42 entry points plus three invariants, and no tracked file changed.

What I kept, after reproducing each against the code

1. Medium, with proof. A gas-exhausting IMD6900 (or a hook on a burn route) makes every burn revert TooLittleGas at any gas limit. The specialist's proof fails on this code with that selector for both burn and burnImd, so every registration, toll and crew founding halts after one third-party upgrade. AUDIT.md's trust table claims the opposite. Anchored at src/LARPBurner.sol:247.
2. Medium, with proof. The 0.1 ETH burn cap is per call, not per transaction. Merged from the economics and permissions specialists. On the repository's own pool depth, ten batched burn(0) calls inside one sandwich took the searcher from 10 to 10.347 ETH and halved the IMD burned, while the single-call control loses. My self-contained proof at test/scratch/Proof_BatchedBurnSandwich.t.sol fails here and its control passes.
3. Low. A proposal equal to the current prices passes the guardrails, and executing it bumps the epoch and restarts the cooldown. Reproduced: the real cut reverts Stale, then its re-proposal reverts Cooling.
4. Low. WETH or any other ERC-20 royalty is stuck in the burner forever. Merged from two specialists. I lowered the permissions specialist's medium because the value belongs to no user and benefits no attacker. The missed burn is the loss.
5. Low. A price above the burn cap is only partly bought under the payer's floor. Reproduced end to end through four swarm-approved doublings and register: an honest floor reverts, a zero floor parks 0.0104 ETH with no event.
6. Info. The commented callback selector is onOracleResult's, not onVerdict's. Three specialists reported it. Merged into one note.

What I checked myself and found holding

• The protocol's published conformance vector verifies through onVerdict at the vector address, and a one-field tamper is refused.
• Every hard-coded selector in LARPLinks and SafeReads matches its function.
• The manifest has the right shape, argument counts and order. All four contracts sit well inside both size limits.
• Every slither and aderyn line was traced. None reproduced as a defect.

The two proofs are in the findings file and under test/scratch/, which is not kept.

The revision is complete and verified. Summary of what was reproduced, changed and answered:

Both required proofs reproduced and now pass.

• The gas-eating IMD6900 (id 0a267c38) made every burn revert with TooLittleGas at any gas limit. Fix in src/LARPBurner.sol: the legs that run third-party code (route 0 through POOL4's hook, the IMD6900 leg through its hook and proxy) run on a fixed 3M gas budget. A call that cannot fund the budget is refused before the leg runs, so a caller still cannot starve it. A leg that eats its whole budget is skipped like any other refusal, so no third party can halt the burner. The hookless route keeps the all-gas forwarding and the 1/4 rule. A burn now needs a gas limit of about 3.35M, which is documented.
• The batched sandwich (id bb9c523e) sold all waiting ETH at one manipulated price. Fix: of the ETH already waiting, at most MAX_BURN leaves per block over all calls. A caller's own fee always goes through, and each call still spends at most MAX_BURN.

Advisory findings.

• WETH royalties stuck: fixed. The burn unwraps any WETH9 the burner holds first, via a constant address, so constructor arguments are unchanged and the constructor still calls nothing.
• Selector comment: fixed in the source comment and AUDIT.md.
• No-op proposal and the fee above MAX_BURN: reproduced but disputed, with reasons in the responses file and documented as AUDIT.md L-12 and L-13. The suggested fixes either leave the same hole open or change the requester's economics.

Tests. Five new burner tests cover each change, and the four gas-sweep tests moved above the new budget. The full offline suite passes with an empty environment:

ADAPTATION.md lists every change with its finding, README and AUDIT.md are updated, and .imd-responses.json answers all eight finding ids. No build configuration, dependency or launch.json was touched.

Updated only launch.json, correcting notes to match the accepted implementation. Verified all four contracts and 23 constructor arguments against the brief and compiled ABIs.

Offline verification passed: forge build; forge test — 150 passed, 0 failed, 11 fork tests skipped.

The findings file and scratch directory are excluded by the harness's own git exclude list, which is expected: the harness reads them from disk and strips scratch before anything is compared. Everything is in place.

Recap

What this revision was about. The other node's accepted commit changed the burner after my tests were written: pre-existing ETH is now capped at MAX_BURN per block (not just per call), third-party legs run on a fixed 3M gas budget, and WETH royalties are unwrapped on each burn. Two of my tests encoded the old "one cap per call" rule and failed against the new code. No other suite was affected.

Changes, all within test/:

• test/LARPBurnerEdges.t.sol: the stale exact-MAX_BURN test now checks the same-block refusal and the next-block sale. Added tests for the block allowance counting only waiting ETH (not the caller's own fee), a fuzz over two burns in one block against the NatSpec's four stated guarantees, the gas budget at its edges (refused at 1M gas with nothing moved, while an empty burn and a 14-wei burnImd need no budget and a 15-wei one does), and three WETH cases: a WETH that refuses to unwrap, one answering short data, and unwrapped WETH being treated as waiting ETH.
• test/LARPBurner.invariant.t.sol: the handler now models the per-block rule as an oracle, donates WETH through a mock etched at WETH9's address, rolls blocks, and makes under-budget gas calls that must be refused by name and move nothing. ETH conservation now includes WETH, and a new measured invariant states L-10 directly. The runner reaches all eight handler functions evenly with zero unexpected reverts under fail-on-revert.

Results. forge test passes: 251 tests pass, the 11 mainnet-fork tests skip offline as designed. All 138 named entry points are referenced in the suite.

One finding reported, not asserted (.imd-findings.json, severity info): a burn whose routes both fail still books the waiting ETH against the block's allowance, so a later same-block call cannot sell it even if a route has since recovered. Nothing is lost and it sells next block. I verified the reproduction with a scratch test rather than pinning the behaviour as correct in the suite.

All five of my earlier findings are settled, and nothing blocking remains. I wrote .imd-findings.json with one info-level note and a coverage row for each of the 42 entry points (all holds). I copied every attached proof under test/scratch/ and ran it against the revised code. The full suite passes: 257 passed, 11 skipped, 0 failed.

The two medium findings are fixed:

• Gas-eating IMD6900 halted every burn (0a267c38): fixed. The legs that run code a third party controls (POOL4's hook, and the pair hook with IMD6900) now get a fixed 3M gas budget. A call that can't fund that whole budget is refused before the leg runs, so a caller still can't starve it on purpose. A leg that uses up its whole budget is skipped instead of reverting the call. My proof and the specialist's proof now pass, and the AUDIT.md trust table is corrected. The cost is that burn now needs about 3.4M gas.
• Batched burn(0) sandwich (bb9c523e): fixed. The caller's own fee goes first, up to MAX_BURN. Of the ETH that was already waiting in the burner, at most MAX_BURN leaves per block, tracked in _burnBlock/_burnedInBlock. The proof now passes (the searcher no longer profits), and its control still passes.

The advisory findings:

• WETH royalties stuck in the burner: fixed. _unwrapWeth unwraps them at the start of burn. It reads WETH9's balance and calls withdraw, and does nothing if WETH has no code there or refuses. The constructor still calls nothing.
• Callback selector in the docs: fixed. The comment in src/SwarmPrices.sol and AUDIT.md now name onVerdict's own selector, 0x8bf09c1b.
• No-op price proposals and prices above MAX_BURN bought in parts: the author disputed both and documented them as AUDIT.md L-12 and L-13. I accept that. Their reasoning holds: the simple fixes don't close the issue without changing the requester's governance or pricing, prices never leave the guardrails, and the remainder above the cap now leaves at most one cap per block. I'm not raising them again.

What the specialists reported:

• The economics and permissions reports on the sandwich and on WETH are duplicates of my findings above, and are now fixed.
• The flow and math reports are duplicates of the gas finding and of my two advisory ones.
• The test writer's note reproduced, and it is the one item in the file, as info. burn counts waiting ETH against the block's allowance (src/LARPBurner.sol:182-185) before it tries any route. If every route fails, that ETH can't be sold again until the next block, even if a pool gains liquidity in between. My scratch test shows the same-block retry buying 0 and the next block buying 197.27 IMD. Nothing is lost and the per-block guarantee still holds, so it doesn't block the launch.

Manifest: launch.json matches the brief: four contracts in order, the stated constructor arguments, and only schema keys.

My scratch tests are removed and I changed no tracked files. Several untracked dotfiles (.bashrc, .claude/, .gitmodules and others) show up in the working tree; I didn't create them. .gitmodules matters because the rules say never to leave a git submodule, so check it before upload.