• mediumFeeRouter hard-codes the 2% heartbeat share; Params.HeartbeatBps (the Desk's regulator lever and the heartbeat 200 bps constructor word) is never readsrc/FeeRouter.sol:139

  SwarmDesk takes heartbeatBps from the policy word (200 here), proves at bind that Params was constructed with it, and its regulator stream (_regulate, key 41 -> Params.Key.HeartbeatBps, bounds 200..5000, +/-10% per day) can move it. regulator.md ('Keeper deficit ... propose bounded share change ... Params heartbeat 200-5000 bps'; 'Share governance remains bounded at 200-5000 bps') and docs/oracle-v37/regulator.json present it as the keeper-funding lever.

  No contract reads Params.Key.HeartbeatBps: FeeRouter._route credits a literal 200/10000 of every sell surcharge (line 139) and routeTokens a literal amount*200/10000 (line 157). An accepted change emits ParamChanged, burns the key's 24h cooldown and changes nothing the router does, so a keeper deficit the swarm tries to fix on chain stays unfixed and off-chain readers of Params.get(HeartbeatBps) see a share that is not applied.

  Reported by audit_math; reproduced with a failing test on the repository fixture. Note for the fix: FeeRouter is pinned in ModuleCode (role 6), which GameRegistry embeds, whose creation hash SwarmCode pins, which SwarmDesk embeds. Reading params().get(Params.Key.HeartbeatBps) in _route/routeTokens therefore changes GameRegistry's and SwarmDesk's creation code and every pin (tools/pin_module_code.py), contrary to the specialist's note that the Desk code is unaffected.

  The alternative is to drop key 41 from regulator.json/regulator.md and document the share as fixed, which changes the regulatorBody/question constructor words. This deployment's word (200) equals the literal, so the bootstrap transaction itself is not affected; no funds are lost or misdirected.

  whole finding

  Repository fixture test/Base.t.sol (desk is Params.swarmWallet). vm.warp(+2 days); vm.prank(address(desk)); d.params.set(Params.Key.HeartbeatBps, 220, "raise keeper share") succeeds and d.params.get(HeartbeatBps) == 220. vm.prank(address(market)); d.fees.depositSellTax{value: 1 ether}().

  Expected heartbeatBalance increase 0.022 ether (220 bps).

  Actual 0.02 ether.

  Ran as test/scratch/HeartbeatBps.t.sol: '[FAIL: heartbeat share ignores Params.HeartbeatBps: 20000000000000000 != 22000000000000000]'.

  Static check: grep -rn 'HeartbeatBps' src/ matches only SwarmDesk.sol (binding) and Params.sol (enum, default, bounds).

  whole reproduction

• lowbind accepts a twin GameRegistry that reuses the honest Params: the documented twin front-run needs one launched contract, not threesrc/SwarmDesk.sol:200

  bind proves Params at (paramsLaunch, paramsIndex) and only requires the candidate's params() to equal that address; nothing ties the Params coordinates to the registry's launch. Once job A executes, its Params (pinned code, constructor (thisDesk, 200, 1e18)) is public and satisfies _proveParams for anyone.

  A twin therefore needs only one GameRegistry launched through the ProjectFactory at other coordinates with constructor (token, honestParams, market, starterRoot, freeRoot, snapshotBlock, endowment, factory): gameConfigHash matches (roots public after job A), _proveParams passes on the honest Params, _predictRegistry matches the twin, and registry is set to the twin; the honest bind then reverts AlreadyDone. docs/m2-trust-assumption.md section 2 says the twin 'needs Params and GameRegistry' and prices the capture as a three- or eight-contract launch.

  The impact class is unchanged from the documented M-2 (griefing: honest launches orphaned, no attacker-withdrawable funds, the twin's Params still name this Desk), but the attacker's cost and admission surface are lower than the document states, and a shared Params means every later regulator change applies to the orphaned honest game as well. Reported by audit_permissions; its proof fails on the current code for the stated reason.

  Design-preserving fix: require paramsLaunch == registryLaunch (job A deploys Params at index 0 and GameRegistry at index 1 of one launch, so the honest bind is unaffected), and correct the trust document either way.

  whole finding

  State: Desk unbound; factory F modelled as CREATE2 with salt (launch, index).

  Honest job A: Params P = F.deploy(41,0, ParamsCode ++ abi.encode(desk,200,1e18)); GameRegistry R = F.deploy(41,1, RegistryCode ++ abi.encode(token,P,market,starterRoot,freeRoot,snapshot,endowment,F)).

  Attacker, after job A: T = F.deploy(42,0, RegistryCode ++ abi.encode(token,P,market,starterRoot,freeRoot,snapshot,endowment,F)) (one contract, no Params). desk.bind(T, registryCode, paramsCode, 42, 0, 41, 0).

  Expected per docs/m2-trust-assumption.md: InvalidProof.

  Actual: succeeds, desk.registry() == T; desk.bind(R, ..., 41, 1, 41, 0) then reverts AlreadyDone. forge test --match-path test/scratch/TwinSharedParams.t.sol: '[FAIL: one-contract twin (shared honest Params) must not bind]'.

  whole reproduction
  proof · a Foundry test the fix has to pass

  // SPDX-License-Identifier: MIT
  pragma solidity 0.8.26;
  import {Test} from "forge-std/Test.sol";
  import {GameRegistry} from "src/GameRegistry.sol";
  import {Params} from "src/Params.sol";
  import {SwarmDesk} from "src/SwarmDesk.sol";
  
  /// Minimal model of the ProjectFactory's predictContract/CREATE2 behaviour (salt = (launchNumber, index)).
  contract TwinFactory {
      mapping(uint64 => mapping(uint256 => bool)) public used;
      function predictContract(uint64 launchNumber, uint256 index, bytes calldata initCode) external view returns (address) {
          return address(uint160(uint256(keccak256(abi.encodePacked(
              bytes1(0xff), address(this), keccak256(abi.encode(launchNumber, index)), keccak256(initCode))))));
      }
      function deploy(uint64 launchNumber, uint256 index, bytes memory initCode) external returns (address result) {
          require(!used[launchNumber][index]);
          used[launchNumber][index] = true;
          bytes32 salt = keccak256(abi.encode(launchNumber, index));
          assembly ("memory-safe") { result := create2(0, add(initCode, 32), mload(initCode), salt) }
          require(result != address(0));
      }
  }
  
  /// A twin GameRegistry that reuses the honest job A Params (same Desk as swarmWallet) binds the Desk with a
  /// one-contract launch. docs/m2-trust-assumption.md section 2 says a twin needs its own Params and GameRegistry.
  contract TwinSharedParamsTest is Test {
      uint256 private constant ENDOWMENT = 200_000_000 ether;
      bytes32 private constant STARTER_ROOT = keccak256("starter");
      bytes32 private constant FREE_ROOT = keccak256("free");
      uint256 private constant SNAPSHOT = 12345;
      address private constant TOKEN = address(0x1001);
      address private constant MARKET = address(0x1002);
  
      TwinFactory private f;
      SwarmDesk private desk;
      bytes private registryCode = type(GameRegistry).creationCode;
      bytes private paramsCode = type(Params).creationCode;
  
      function setUp() public {
          f = new TwinFactory();
          bytes32 configHash = keccak256(abi.encode(STARTER_ROOT, FREE_ROOT, SNAPSHOT, ENDOWMENT));
          // policyWord = chainId 1 | fromBlock 100 <<32 | toBlock 200 <<80 | maxPrice 0.5e18 <<128 | heartbeatBps 200 <<224
          uint256 policy = 1 | (uint256(100) << 32) | (uint256(200) << 80) | (uint256(0.5 ether) << 128) | (uint256(200) << 224);
          desk = new SwarmDesk(
              address(0xA1), address(0xA2), address(0xA3), address(0xA4), bytes32("oracle.request@oracle-1"), policy,
              keccak256("event q"), keccak256("regulator q"), keccak256("event body"), keccak256("regulator body"),
              address(f), configHash
          );
      }
  
      function _registry(uint64 launch, uint256 index, address params) private returns (GameRegistry) {
          bytes memory args = abi.encode(TOKEN, params, MARKET, STARTER_ROOT, FREE_ROOT, SNAPSHOT, ENDOWMENT, address(f));
          return GameRegistry(f.deploy(launch, index, bytes.concat(registryCode, args)));
      }
  
      function _bind(GameRegistry r, uint64 rl, uint8 ri, uint64 pl, uint8 pi) private returns (bool ok) {
          (ok,) = address(desk).call(
              abi.encodeWithSignature("bind(address,bytes,bytes,uint64,uint8,uint64,uint8)", address(r), registryCode, paramsCode, rl, ri, pl, pi)
          );
      }
  
      function testTwinRegistryReusingHonestParamsBindsWithOneContract() public {
          // Honest job A: Params at (41,0), GameRegistry at (41,1). The roots become public when job A executes.
          Params honestParams = Params(f.deploy(41, 0, bytes.concat(paramsCode, abi.encode(address(desk), uint256(200), uint256(1 ether)))));
          GameRegistry honest = _registry(41, 1, address(honestParams));
  
          // Attacker: one GameRegistry at (42,0) whose params is the honest Params. No Params of its own.
          vm.startPrank(makeAddr("attacker"));
          GameRegistry twin = _registry(42, 0, address(honestParams));
          bool ok = _bind(twin, 42, 0, 41, 0);
          vm.stopPrank();
          // Expected per docs/m2-trust-assumption.md: InvalidProof, a twin must launch Params + GameRegistry.
          assertFalse(ok, "one-contract twin (shared honest Params) must not bind");
  
          // The honest registry, launched as the runbook describes, binds.
          assertTrue(_bind(honest, 41, 1, 41, 0), "honest bind");
          assertEq(address(desk.registry()), address(honest));
      }
  }

  whole proof

• low_accept requires the exact current epoch for stream 0 while _event tolerates base+1: honest heartbeat answers that cross an advanceEpoch boundary are dropped and the slot can only be rescued by a paidsrc/SwarmDesk.sol:333

  The event attestation carries the base epoch the panel read (values[1]). _accept drops the answer with AnswerIgnored(2) unless FarmRewards.epoch() still equals it on arrival, yet _event (line 396, 'if (current > base + 1 || current < base) return;') already handles current == base+1 and would submit the base+2 plan.

  FarmRewards.advanceEpoch is permissionless the moment the 6-hour epoch ends and epochs start when it is actually called, so boundaries drift through the UTC slots; an attestation issued minutes before a boundary and relayed after it (the oracle answers minutes later, and anyone can front-run submit with advanceEpoch) is not consumed and acceptedSlotPlusOne is untouched.

  The only recourse in that slot is askBackup, which spends 0.5 IMD of donated Desk funds, once; if the backup straddles the boundary too the slot runs on GridOperator's fallback (severity 10000 instead of the attested 5000-7000). event.json does say 'The receiver rejects another slot or epoch', so this is partly by design; the defect is the stricter gate at accept than at execute, which turns a tolerated state into a lost slot plus IMD spend.

  Reported by audit_economics; reproduced. Fix preserving the design: accept values[1] == epoch || values[1] + 1 == epoch, matching _event.

  whole finding

  Repository fixture (test/Base.t.sol, signer key 0x123456). end = d.rewards.epochEnd(); vm.warp(end - 10 minutes); build a stream-0 attestation with values [slot(0), epoch, 1, 7000, 3, salt, letter], issuedAt = now, sign in the Desk domain. vm.warp(end + 2 minutes) (same UTC slot), roll blocks, bob calls d.rewards.advanceEpoch() (epoch == base+1). desk.submit(a, sig).

  Expected: consumed[a.requestId] true and execute later submits the base+2 plan.

  Actual: AnswerIgnored(a.requestId, 2), consumed false, acceptedSlotPlusOne(0) == 0.

  Ran as test/scratch/EpochGate.t.sol::testAnswerIssuedBeforeEpochBoundaryDroppedAfterIt: '[FAIL: answer dropped at epoch boundary]'.

  whole reproduction

• lowexecute reads registry.module(7/12/11/4) outside any try: an answer accepted between bind (after job A) and job B registration closes its slot but can never executesrc/SwarmDesk.sol:393

  _accept needs only module(1) for stream 0 and no module for stream 1, so once the Desk is bound (runbook M5, right after job A registers roles 0-5) a valid answer is stored: consumed[uuid], delivered and acceptedSlotPlusOne[stream] = s+1 are written. execute then calls GameRegistry.module(role), which reverts NotConfigured for an unregistered role (src/GameRegistry.sol:64), at line 393 (module(7)) and 397 (module(12)) for stream 0 and at lines 423, 428 and 443 (module(12), module(11), module(4)) for stream 1, unconditionally and outside the try/catch blocks that the comment at line 432 says exist so 'a busy dormant module cannot block notices'.

  The revert rolls back r.pending = false, so execute can be retried, but only until validUntil (at most 6 hours for stream 0, 1 day for stream 1); job B is budgeted at two hours or more with no upper bound. Because the slot is closed, askBackup for that stream reverts TooEarly for the rest of the slot, and askBackup is itself callable in the window (it only needs registry != 0), so 0.5 IMD per stream per slot can be spent on answers that cannot execute.

  Impact is bounded liveness loss (plans fall back to GridOperator's table; a week's Params adjustments are lost if job B lands more than a day after a regulator answer). audit_flow and audit_math reported the same root cause for streams 0 and 1; merged.

  Fix preserving the design: use registry.registeredModule(role) and skip the block when it is zero, or have _accept return AnswerIgnored before _consume while the modules the stream needs are unregistered so the slot is not consumed.

  whole finding

  Repository fixture, Desk bound. vm.mockCallRevert(address(d.registry), abi.encodeWithSelector(GameRegistry.module.selector, 7), NotConfigured) to model job A only.

  Deliver or submit a valid stream-0 attestation (values [slot, epoch, 1, 7000, 3, salt, letter]): submit succeeds, consumed[uuid] == true, acceptedSlotPlusOne(0) == slot+1. desk.execute(0, a.answer): expected plans submitted or the Grid block skipped; actual revert NotConfigured. askBackup(0, body) for the slot then reverts TooEarly.

  Ran as test/scratch/EpochGate.t.sol::testAcceptedAnswerCannotExecuteBeforeJobBModules (PASS on the asserted revert).

  Same shape for stream 1 at line 423 with module(12).

  whole reproduction

• infoaskBackup lets any address spend 0.5 IMD of the Desk's donated balance per stream and slot from one hour into the slot, whether or not the free heartbeat is missing (documented design, trust assumptiosrc/SwarmDesk.sol:246

  The NatSpec states the rule ('One paid backup per stream/slot, after one hour') and the body is pinned, so this is the chosen design, not a bypass: the IMD goes to the Intake, never to the caller.

  Recorded as a liveness-funding trust assumption: a griefer paying only gas can make the Desk spend about 2.07 IMD per day (4 x 0.5 for stream 0 and 0.5/7 for stream 1) on backups that the Ethereum heartbeat then makes redundant (the paid answer is ignored once acceptedSlotPlusOne is set), so a 10 IMD donation is gone in under five days and later real outages have no backup. Reported by audit_economics; the trace holds.

  If the requester wants it tighter without an owner: gate backups on a missed heartbeat (acceptedSlotPlusOne[stream] != s+1 and the slot older than the heartbeat schedule offset) or let the caller fund the backup from their own IMD.

  Desk bound and holding 10 IMD.

  At s*6h+1h any EOA calls askBackup(0, eventBody): passes, Desk IMD falls by priceOf (0.5e18), askedSlotPlusOne[0] = s+1.

  At s*6h+2h the heartbeat is relayed via submit and accepted.

  The later direct result is AnswerIgnored(2).

  Repeating each slot drains 0.5 IMD per slot; after the balance is below 0.5 IMD askBackup reverts in the Intake's transferFrom.

  Traced in code; no failing invariant, the behaviour matches the NatSpec.

• infoAll oracle coordinates (signer, intake, action, price cap) are immutable: a signer rotation, action retirement or price above 0.5 IMD silences the Desk permanently and strands donated IMD (trust assumsrc/SwarmDesk.sol:249

  The brief chose no owner and hard-coded bounds, so this is a trust assumption on the IMD platform rather than a defect. The oracle-consumer reference says intake, action, asset/price and signer are expected to move and should be settable.

  Here they are constructor-only: if Intake.priceOf(action, asset) exceeds 5e17 or the action is retired (price 0), askBackup reverts InvalidValue forever; if the attester key rotates, every submit/onOracleResult reverts BadSignature (SignatureChecker takes the ERC-1271 path only if the signer has code, which the configured EOA does not); in both cases the game runs on GridOperator's fallback and the IMD in the Desk has no exit (no withdrawal, the only spender is askBackup).

  Reported by audit_economics; recorded for the judge as a documented assumption with its concrete failure state.

  Case A: in the fixture, MockSwarmIntake.setPrice(0.6 ether); askBackup(0, body) at s*6h+1h reverts InvalidValue (price > config.maxPrice), permanently. Case B: sign an otherwise valid attestation with a key other than config.signer; submit reverts BadSignature; no path changes oracleSigner (OracleAttestationConsumer._setOracleSigner is internal and called only from the constructor).

• infoThe pinned event body instructs the panel to answer severity 9000 while the Desk clamps to 7000, so the attested severity band is constantsrc/SwarmDesk.sol:400

  docs/oracle-v37/event.json, whose keccak is the immutable eventBody word, says 'severity = 9000'. The Desk clamps v[3] into [5000, 7000], so every executed plan carries 7000 regardless of the panel's choice, and the v3.8 intent that the swarm picks a severity within the band cannot occur with this body. Not a defect in the clamp (the stated hard bound); changing the body changes a constructor word, so it is a requester decision.

  Reported by audit_economics; confirmed by reading event.json and line 400.

  Deliver an event attestation built per event.json (v[3] = 9000) and call execute(0, answer).

  Expected per the definitions: plan severity 9000.

  Actual: GridOperator.planAt(base+1).severity == 7000 (the fixture test testScheduleDeliveryStoresUnder200kThenExecutesTwoPlans already asserts 7000 for v[3] = 7000; with 9000 the clamp yields the same).

Failed in the task.