Implemented the launch deliverable and completed the local audit panel.

• forge build, forge test, and forge fmt --check pass.
• 56 permanent tests and 11 supplied protected checks pass.
• Final flags are 0x22cc, retaining 0x288 plus required callbacks.
• Withdrawal limits now apply per position to prevent quota interference.

Details: audit report and launch runbook.

Mainnet deployment and pool seeding remain the IdentityMD launch stage; no transactions were broadcast.

I found one low-severity defect and nothing critical, high or medium in the economics of the swap, surcharge, trust and withdrawal-limit flows. The findings and coverage are in .imd-findings.json: 1 finding and 15 coverage rows (all 14 entry points plus one invariant). No repository files were changed; I deleted the scratch test I used for measuring.

Finding (low): verify() pays a price fixed at deployment (src/SwarmShieldHook.sol:209)

• The hook always pays the 0.5 IMD set in its constructor. The IdentityMD reference says the price should be read from the Intake (priceOf) and that a price change must not need a redeploy.
• Trigger: the Intake raises its oracle.request price above 0.5 IMD. Every verify() then reverts inside requestWithFailure.
• Effect: the pool can never become trusted again. Once the current verdict expires, every swap pays the protected fee plus the 1% surcharge forever.
• Fix, keeping the hook ownerless: read intake.priceOf(ORACLE_ACTION, imd) inside verify() instead of using the fixed price. The README already accepts that a price change can stop verification, but this case can be fixed without adding an owner.

What holds

• Swap surcharge: I traced all four swap modes (buy and sell, exact input and exact output).
  • The cut is 1% of the gross ETH amount, with consistent rounding.
  • The swapper pays exactly the amount they specified, and the hook's balance with the PoolManager always nets to zero.
  • Partial fills where ETH is the specified side revert instead of charging for ETH that was never swapped.
  • If the PoolManager holds too little ETH, the cut becomes a claim that redeemSurcharge() later sends to 0xdEaD.
  • I found no way to avoid the surcharge or extract fees for free. Swaps under 100 wei pay no surcharge, which gas makes worthless to exploit.
• Oracle path:
  • Only answers to the hook's own requests are accepted, from the Intake.
  • The 7-agent, 5-vote panel, the chain ID, the order of verdicts, expiry, and one-time use are all checked.
  • A failure report never changes trust.
  • I measured the result callback at about 130k gas with cold storage, under the Intake's 200k limit.
• Withdrawal limit: the factory's zero-amount fee collection always passes. The other ways around the 10%-per-day limit are already documented as accepted trade-offs in README lines 72–80, so I did not raise them:
  • withdrawing after moving the price out of a position's range
  • the reset at UTC midnight
  • leftover dust that cannot be withdrawn
• Policy pool: on the 12500 pool the fee cannot drop to 0.30% after a positive verdict. The brief explicitly allows this fallback.

The existing suite passes: 56 tests, including the fuzz and stateful conservation tests. I did not review areas outside economics in depth, such as the hook flags differing from the brief's 0x288, launch preparation and mining, or the manifest.

The review is complete and .imd-findings.json is written and validated: all four snippets match their cited lines, and the coverage record answers all 14 listed entry points plus three invariant rows.

Outcome: no permission bypass, escalation path, or unguarded state writer was found in the SwarmShield hook. The full suite builds and passes (56 tests, not the 18 the brief mentions, because earlier contributors added suites). Every hook callback is gated to the PoolManager, the oracle callbacks to the Intake, and every value exit leads only to the immutable burn sink. The two verify() leads from Slither (reentrancy, strict equality) were rejected after tracing: the guard blocks reentry, and the Intake pulls exactly the offered amount per the oracle reference.

Findings recorded (none blocking):

• Low, rug shield escapable in one unlock. The per-position 10%/day cap applies only while the price sits inside the position's range, and the LP controls that condition. My scratch test moved the price out of a narrow range, removed 100% of the position, and moved it back in a single transaction. The README discloses this limitation and the factory's full-range seed position cannot be escaped this way, so I left it at low for the judge to weigh.
• Low, immutable signer/price/Intake. With no owner, an oracle key rotation or price change turns every later verify() into a non-refundable 0.5 IMD sink with no reachable trusted tier. Documented in the README; reported as a trust assumption with the concrete failing state.
• Info, open re-verification revokes trust. Anyone can pay to re-ask, and a single negative panel answer resets trustedUntil to zero. Design choice, recorded with actor and preconditions.
• Info, flag mask. The constructor requires exactly 0x22cc, so a manifest or miner reusing the brief's 0x288 reverts on deployment.

Coverage: 11 entry points hold, 3 carry findings. No rows are unreached. No source files were modified. The scratch test under test/scratch/ reproduces finding 1 and is disposable.

The review is complete. The findings file is written and validated, and the working tree holds no tracked changes.

Outcome. The hook's swap arithmetic holds across all four modes. I traced the surcharge formulas against v4-core's Hooks.beforeSwap, Hooks.afterSwap and Pool.swap, checked the PARTIAL_NATIVE_FILL equality against the pool's exact full-fill condition, and found no value leak, overflow, or wrong rounding direction beyond dust. The defects in my area all sit in the withdrawal guard, beforeRemoveLiquidity.

Findings written to .imd-findings.json (four, none above low):

1. Low. Tick-boundary exemption defeats the daily cap. The guard skips any position the current tick is outside of. An LP nudges the tick one step past their range with a partial-fill swap and removes the whole position in the same block. Reproduced: a 1e21 position at [0,60) exits fully after a one-tick buy, and the daily counter stays at zero. Only the factory's full-range seed is actually held to the cap. The README names this limitation.
2. Low. Cap base shrinks while the accumulator is cumulative. The cap is 10% of liquidity remaining at each call, so split removals converge to L/11 and the position locks for the day after any removal near 9%. Reproduced: 5% then 4.5% succeed, one more unit is refused, while a fresh identical position removes 10% in one call.
3. Info. Cap rounds to zero below 10 liquidity units, so a tiny active position can never withdraw. Documented in the README.
4. Info. Surcharge is 0 under 100 wei and 1 wei at 1-wei exact output. Confirmed by test, dust only, no accumulation path.

Coverage. All 14 listed entry points have rows, plus three invariant rows. Thirteen entry points hold; beforeRemoveLiquidity carries the findings. Static-analysis leads on verify() reentrancy and strict equality were traced and rejected: the Intake pulls exactly the amount passed, and both callbacks are guarded.

Not reached. I did not audit the oracle body text, the launch manifest, or the live Intake behaviour; those are outside the math area. Anyone can initialize the second valid pool (the dynamic-fee variant) at any price, which is an access question for another specialist rather than a math defect.

Scratch tests live under test/scratch/, which is gitignored, so nothing in the tree changed.

Review complete. Findings are written to .imd-findings.json with coverage rows for all 14 listed entry points plus two invariants. No source files were changed, and the scratch tests were removed.

Build and tests. The repository compiles with Solidity 0.8.26 and all 56 tests pass, including the stateful invariant suite. The brief's "18 tests" floor is exceeded.

What I traced in my area (Execution Trace, Periphery, First Principles): every swap mode against v4's Hooks.beforeSwap and Hooks.afterSwap delta composition, the claim-mint fallback and redeemSurcharge unlock path, the rug shield's position accounting, the whole oracle lifecycle through the canonical Intake v2 callback shapes and the 200k stipend, verify()'s exact-balance and approval handling, flush, receive, and the launch helper library and script. No critical or high defect survived verification, so no proof file was attached.

Findings reported:

• Low. Rug shield bypass by price push at src/SwarmShieldHook.sol:192. The out-of-range exemption is reachable by the LP's own swap. Reproduced on the fixture: a sell of 5e23 SHIELD moved the tick to 887271, the sole LP received 2925.7 ETH from its own pool for a 29.55 ETH surcharge, then removed 100% of the position in the same block where a 100% removal had just reverted. The README acknowledges the limitation, so this is recorded as low with the concrete sequence and cost.
• Info. Any address can initialize the sibling fee-tier pool at src/SwarmShieldHook.sol:134. The hook validates the key but not the initializer, so after launch a stranger can open the other admitted pool (dynamic or 12500) at any price. No funds at risk; noted as a design choice with the $factory pattern as the fix if a single pool is wanted.
• Info. Flags are 0x22cc, not the brief's 0x288 at src/SwarmShieldHook.sol:34. The superset is forced by the launch floor's initialization requirement and by charging ETH on token-specified swaps. Recorded so the manifest step declares the six-permission set.

Static-analysis leads were checked and not promoted: the verify() reentrancy and strict-equality lines are intentional exact-payment checks behind nonReentrant; the unused unlock return and getSlot0 tuple are harmless; the "locks Ether" lead is false because flush exists.

Not reached. A fork rehearsal against the live Intake, IMD and PoolManager, and the launch factory's seeding and fee-collection calls, which this repository cannot exercise offline.

Added failure-path, differential fuzz, atomic launch, and multi-actor invariant tests under test/.

• forge build passes.
• Required-seed forge test: 94 passed, zero failures or skips.
• New invariant campaign: 16,384 calls, zero unexpected reverts.

No new defects reproduced. Tests follow the accepted 0x22cc launch specification. No live deployment or oracle panel was performed.