Fixed launch.json: all constructor arguments are strings, with true encoded as ABI word "1". Only the manifest changed.

Validation passed: forge build, seeded offline tests (188 passed, 2 fork tests skipped), and protected suites (13 passed in each token order).

I found two medium and two low findings, and wrote them to .imd-findings.json with a coverage row for each of the 34 entry points. Nothing qualified as critical or high, so no finding carries a proof file. The two I could check in code I confirmed with throwaway tests, which I then deleted, so the tree is unchanged.

Findings

1. Medium: anyone can drain the desk's IMD treasury (src/CurbDesk.sol:260). fileIncident can be called by anyone, and each halt on any bound pool spends one oracle price from the treasury. That includes the drill pool, which halts cheaply: on-chain liquidity of 1e19, test-sized trades, a 10 s limit, 300 s halt and 300 s cooldown. So a stranger can force a payment about every 610 s, around 140 a day. Once the treasury is empty, a real halt on the launch pool fails with TreasuryShort and gets no verdict. In my test a stranger repeated halt → file three times and the desk's balance went from 1.5 IMD to 0.
2. Medium: the verdict rule can be gamed (src/CurbHook.sol:263). The trade record names each trader by tx.origin. One actor who splits a move across four wallets at 25% each gets "Organic", so the halt ends early and the band re-centres on their price. In the other direction, many users relayed through one bundler count as a single trader and get "Concentrated", which pins the band against normal buying for the 30-minute cooldown. I didn't test this one: it follows directly from how volume shares map to verdicts.
3. Low: status() shows the wrong band after a halt (src/CurbHook.sol:160). It uses a different clamp from the code that actually closes the halt. Confirmed in a test: status() showed reference 0 and upper limit 1000, and after the closing swap they were 51 and 1051.
4. Low: the desk's CURB share of LP fees is locked forever (src/CurbDesk.sol:271). The desk receives 80% of pool fees in both tokens, but has no way to move CURB at all; IMD can only go to the Intake. Untested; it's visible from the absence of any transfer path.

What I read

• In full: CurbHook, CurbToken, CurbDesk, HookFlags, the Breaker, BandMath and L2Block libraries, OracleAttestation, ILaunchFactory, CurbRouter, DrillToken, the drill parameters in script/Mainnet.s.sol, and launch.json.
• Skimmed only: OracleQuestion.sol, ICurbHook, IIntake, and the vendored OpenZeppelin BaseHook, which I took to be the library's v1.3.0-rc.0 release.
• Not reachable: the deployed IMD LaunchFactory, Intake and oracle service. I judged their behaviour from the interfaces only.

Checks that came out clean

• Manifest: the 12 constructor arguments are in the right order, permissions match flags 0x20C0, and fee 12500 / tick spacing 60 match what beforeInitialize accepts.
• Token: it matches the brief, with no owner, mint, burn, tax or pause.
• Forbidden patterns: nothing in src uses DELEGATECALL or SELFDESTRUCT, and there are no proxies or initializers.
• Owner powers: the owner can only shorten a halt or pin the reference; it cannot lengthen a halt.

Not checked

• arbBlocks is written as "1" in launch.json, where the brief says true. The manifest schema doesn't say how a bool is written, so I left this as a note, not a finding.
• Full test runs: I didn't run forge test across the whole repository or script/protected.sh. When I ran my scratch tests, the existing 36 desk incident tests passed alongside them.