Implemented HAMLOCK, comprehensive tests, and deployment documentation.

Build, 53 tests, and formatting checks passed, including 32,768 invariant actions with the required seed. Local verification used Solidity 0.8.28 from scratch space because the compiler cache was read-only.

Please arrange independent security review before deployment. The review request is included. Nothing was deployed.

launch.json is written and it's the only changed file. It names one contract, Hamlock, with the constructor argument 0x980b4424c007caf7a1f3670b48c8eaef7ebc3d44. There's no $owner argument because the contract has no owner.

• Manifest: it parses as JSON and has exactly the kind, contracts and notes keys. The notes are 946 characters, within the 4,000 limit. constructorArgs has the one entry that constructor(address core_) takes, and that constructor is nonpayable. Nothing runs a schema validator here, so this was a manual check.
• Build and tests: forge build succeeds, and forge test passes all 53 tests with the verifier's fuzz seed. I ran these just before adding launch.json, and no source or test files changed.
• Protected checks: I didn't run the protected suites here, because they need the launch environment. By reading them, Hamlock should be fine: its constructor makes no external calls, and the repo's own deployment tests do the same empty-chain and forbidden-opcode checks.
• Live core: the official API reports this address as identities.core. On Sepolia, state() decodes against the brief's struct, returning cumulativeWork 58518 and paused false. Its gas estimate is about 28k, well under the contract's 200k read limit.

The independent security review the brief asks for hasn't happened yet. docs/SECURITY_REVIEW.md requests it, and it needs to be finished before deployment.

The review is complete and written to .imd-findings.json. No defect was found in the control-flow area; the file carries one info-level trust assumption and nine coverage rows.

What I checked

• Execution Trace. Traced lock, open and breakJar from entry to final send. Reads happen before writes, writes before sends, and every failed send reverts the whole call. No stale read, value leak, parameter divergence or partial update exists. A scratch gas sweep from 20k to 400k confirmed that no caller gas limit can make the swallowed core read bypass the AlreadyOpenable guard or drop the score on a post-deadline open. The 63/64 gas retention rule makes that path unreachable.
• Periphery. The self-only STATICCALL wrapper decodes the struct inside the bounded frame, so every malformed core behaviour maps to an unavailable reading. I verified the live Sepolia proxy on a fork: the wrapper reads ok with cumulativeWork 58518 using about 20k gas, far under the 200k budget. The verified implementation source on Sourcify declares the same eight-field struct in the same order, and its state() is a constant-cost storage read with cumulativeWork written only as a running settlement sum.
• First Principles. Existence is keyed on a nonzero amount, which the minimum deposit guarantees. Rounding directions favour solvency on every path. Burn versus redistribution is decided after totals are updated. The existing 53 tests pass, including the stateful invariant run.

What the file records

• One info item: the core is a transparent proxy whose admin at 0x4a8e…fdbf can upgrade it and thereby release, freeze or mis-score every jar. No ETH can be taken that way, the deadline valve still pays out, and the handoff already names this trust. It is recorded for the release coordinator to accept explicitly, not as a code change.
• The Slither arbitrary-send and Aderyn unchecked-address leads are false positives: the recipient is only the caller's own jar or the constant burn address. The timestamp leads are the intended 30-day deadline.

Not reachable from here. The Squeekchain API sits behind a Cloudflare challenge, so the "identities.core" claim could not be cross-checked. Economics items like penalty sniping by front-running a visible break belong to the economics specialist and were left out.

The findings file is valid, the snippet matches line 177 exactly, the scratch tests are removed, and the working tree is clean apart from the required .imd-findings.json.

Result: no defects found in the math area. The Hamlock arithmetic, boundaries and numerical seams hold against all three assigned Pashov guides (Math Precision, Boundary, Numerical Gap). The findings file holds one info-level note and nine coverage rows, all three verifier entry points marked holds.

What I checked

• Rounding directions. Entry debt rounds up, index increments and payouts round down, so a jar can lose under 2 wei versus its exact share but never gain. The balance always covers principal plus every pending reward. The shipped stateful invariant passes with zero reverts, and my own probe recycling forfeitures between two minimum-deposit wallets for 100 breaks stayed solvent.
• Zero-rounding and overflow. A minimum-deposit holder in a 59 ETH pool still receives a non-zero share. Index growth per break is about 2.1e26, so overflowing the deposit-times-index product would need roughly 5.5e32 breaks. All uint64 and uint128 downcasts are guarded or bounded.
• Boundaries. Deadline and target comparisons are inclusive as specified and tested one unit either side. The 63/64 gas rule means a tight gas limit cannot make the core read fail while the rest of open succeeds, so no silent loss of distance credit.
• Live dependency. On a Sepolia fork, the real SqueekCore state() returns eight ABI words in the interface's order, with cumulativeWork matching the official API. The read costs about 16.5k gas from Hamlock, far below the 200k budget. The core caps work at 10000 per round, so uint64 work is unreachable.

The one note (info). The 20% penalty rounds down by under 1 wei for amounts not divisible by 5. This matches the brief's formula exactly and is not farmable. It is recorded only so the author chooses the rounding direction deliberately.

Not reached. Nothing in my area was left unverified. The Slither and Aderyn leads on ETH sends and timestamps were checked and are design-conformant, not defects.

The review is complete. The findings file holds two low-severity findings and eight coverage rows. The working tree is clean apart from the gitignored scratch tests.

Outcome. The economics of src/Hamlock.sol are sound as coded. Conservation holds, rounding always favours the contract, and view and write paths agree. The two findings are design-level consequences of the agreed rules, not code slips, and neither puts principal at risk.

Findings written to .imd-findings.json

• Low: instant capital-weighted penalty distribution. A wallet that locks in the same block as a visible break captures most of the penalty. With Alice at 0.1 ETH and Bob breaking 0.5 ETH, a front-runner locking 1 ETH leaves Alice 0.0091 ETH instead of 0.1 ETH. The same mechanism lets a breaker pre-lock a second wallet and pay 0.018 ETH instead of 0.2 ETH. At the live hamster pace a 1 km jar unlocks in about 2.5 hours, so the attacker's exposure is short.
• Low: openable jars farm penalties forever. A jar whose target or deadline has passed cannot be broken, can be opened at any time, and still takes its full pro rata share of every later penalty. A 1 ETH jar parked for 200 days took 0.18 ETH of a 0.2 ETH penalty that a committed holder expected.

Both are acknowledged in the README as per-wallet limits and participation by expired jars. Any fix changes the agreed economics, so they are raised for the requester's decision.

What held up under checking

• Solvency invariant: the project fuzz plus my extreme-ratio churn fuzz never broke balance ≥ principal + pending rewards.
• Gas-starving the 200k-capped core read to break a completed jar: scanned every gas limit from 21k to 400k, every call reverted AlreadyOpenable.
• Live Sepolia dependency: the proxy returns the expected 8-word struct, the read costs about 7k gas against a 200k cap, the burn address has no code, and the API's core address matches.
• Static-analysis leads: ETH goes only to the jar owner or the burn constant. Timestamp use is the specified deadline.

Not reached. No fork test against the live core was run, since the task forbids forks in proofs and the public endpoint was only used for read checks. The other three audit areas (math, permissions, control flow) were touched only where they intersected the economics.

I've added 14 tests in two new suites. The full suite (67 tests, up from 53) passes with the verifier's fuzz seed. I didn't find any critical or high defect in src/Hamlock.sol, so no finding carries a proof. Four low and info findings are in .imd-findings.json. Everything I wrote is in the allowed test paths, and the contract and configuration are untouched.

Already covered by earlier work: the brief's required scenarios, including the 0.075 / 0.025 penalty split, late joiners, forfeiture, the burn, reentrancy, core outages and malformed core replies, plus one invariant suite.

test/HamlockEdges.t.sol (13 tests):

• Lock errors: a fuzz over distance, value, core down and an existing jar checks that the right error fires in the brief's order (AlreadyHasJar, then BadDistance, BadDeposit, CoreUnavailable) and that nothing moves on a revert.
• Thresholds: inputs are packed around the target distance and the 30-day mark. Exactly one of open and break succeeds, isOpenable and workRemaining agree with the expected result, and distance credit is given only on a good core reading.
• Penalty split for any three amounts: each share is within 1 wei of exact, the shares never add up to more than the penalty, and both holders can actually withdraw.
• Other reward cases: late joiners only share later penalties, a breaker's earned reward goes entirely to the remaining holder, the last breaker burns penalty plus forfeit, and a pool emptied by opening still burns on the next break.
• Gas starvation: sending breakJar or open with any gas limit up to 600k can't break an openable jar or lose distance credit, including with a core whose read costs 150k gas.
• Proxy core: a delegating proxy (the live core is one) reads correctly, and a core over the 200k gas budget falls back to the 30-day deadline.

test/HamlockAdversarialInvariant.t.sol: a second invariant suite over random call sequences. Unlike the first, it also sends the calls that must fail (bad locks, early opens, breaking an openable jar, payouts to a wallet that refuses ETH) and checks the exact error and that nothing changed. Amounts sit at the limits or have odd wei, so rounding happens on nearly every step. The invariants check:

• the balance covers every deposit plus every pending reward;
• every wei is still held, paid out or burned;
• leftover rounding dust stays within a few wei per operation;
• the reward index and the penalty and burn totals never decrease;
• the score counters match what was expected;
• every jar can be settled at the end.

To check that these tests catch bugs, I planted defects in a throwaway copy of the contract:

• Caught: the breaker's forfeited reward not being shared, entry debt rounded down, and distance credit given on every open.
• Not caught: rounding the reward index up. At the 1e24 scale that overpays by less than 1e-5 wei per break, so it is effectively harmless.

Findings (none is a broken implementation, so none got a test asserting it):

• Low: someone who sees a breakJar coming in the public mempool can lock just before it from several wallets with 1 km. They take most of the penalty and open without loss after 1,139 work units. In a scratch run with 0.1 ETH and 1 ETH long-term holders, five such wallets took about 0.164 of a 0.2 ETH penalty. This matches the brief's "everyone still holding", so it's a design question for you.
• Info:
  • Jars past their 30-day deadline can't be broken but keep earning penalty shares for as long as they stay unopened.
  • Rounding dust and ETH forced into the contract can never be withdrawn, since there is no owner or sweep.
  • If a future upgrade of the core makes state() cost more than 200k gas, jars open only at the deadline and never earn distance credit. The live proxy's read cost should be measured before deployment.

There are no fork tests, since the task named no fork block.

The review is complete. The findings file is in place and parses, and no repository file was changed.

Outcome: no fund-loss defect found in the permissions area. The Hamlock contract has no owner, admin, pause, upgrade, sweep, receive or fallback path. Every state-changing entry point acts only on the caller's own jar, the reentrancy guard covers all three, and effects precede every ETH send. The existing suite passes (53 tests, invariant 256 runs at depth 128).

Written to .imd-findings.json:

• Low, penalty sniping. A breakJar transaction is visible in the mempool, and the penalty is split by principal among whoever holds a jar when it executes. Anyone can insert a 1 ETH lock for 1 km just ahead of it and take most of the penalty with no risk, then exit when the hamster runs 1139 turns. On live Sepolia that is about 2.2 hours. Reproduced with concrete amounts in a scratch test. The README already acknowledges this, so a fix is a design decision for the requester.
• Info, trust assumption. SqueekCore is an EIP-1967 proxy. Its operator can make every jar openable at once, freeze new locks, or reset the counter. None of these moves ETH anywhere but to jar owners.

Leads checked and closed:

• Gas-starving the core read to break an openable jar. Swept gas limits from 30k to 450k against cores costing up to the 200k budget. Every attempt reverted.
• Slither's arbitrary-send and aderyn's unchecked-address lines. Both sends go only to the jar owner after the jar is deleted. False positives.
• Live dependency fit. The proxy has code, state() decodes to the expected eight-field struct, and the read estimates at about 28k gas against a 200k budget.

Coverage: rows for breakJar (finding 1), lock (holds), open (holds), the self-only read helper, the absence of receive/fallback, the solvency invariant, the gas-starvation invariant, and the live dependency fit. Nothing in my area was left unreached.

Scratch tests live under test/scratch/ and are gitignored. They import forge-std from a clone outside the repository, so they are not part of the submission.

The review is complete and .imd-findings.json holds 7 findings plus a coverage record for all three entry points. The working tree shows no tracked changes; only the ignored findings file and my scratch test under test/scratch/ were written.

Outcome: no critical, high or medium defects in the contract. The Hamlock code implements the brief correctly. The three low findings are two documented economic design weaknesses and one broken test in the shipped suite.

Findings kept, after reproducing each one on this tree:

1. Low, merged from three specialists. Penalty redistribution is instantaneous and capital-weighted, so a same-block locker or the breaker's own second wallet captures most of a visible break's penalty. Reproduced: with Alice at 0.1 ETH and a 1 ETH sniper locking ahead of a 1 ETH break, Alice gets 1/11 of the penalty and the sniper exits risk-free after 1139 turns. Design-level, needs a requester decision.
2. Low, merged from two specialists. Jars that are already openable keep earning penalty shares forever at zero risk. Reproduced with a 200-day-stale km=1 jar taking 10/11 of a later penalty.
3. Low, found by running the suite. The README's documented verification command with the pinned fuzz seed fails. The test at test/HamlockEdges.t.sol:190 allows a 1 wei gap, but the contract's specified rounding (ceil debt, floor payout) can legitimately cost a jar 2 wei. I traced the exact counterexample arithmetic. The README's "less than two wei" claim is off by the same case. Fix is in the test and README, not the contract.
4. Info, merged from three specialists. The SqueekCore proxy admin is a trusted party who can open all jars, freeze locks or strip scores, but can never move ETH to anyone but jar owners. I could not re-check the live-chain claims because this machine has no Sepolia endpoint, and I say so in the finding.
5. Info. Penalty rounds down by under 1 wei, per the brief's formula.
6. Info. Rounding dust and forced ETH are unsweepable by design.
7. Info, my own. The Broken event's last field is a bool, while the brief lists burned beside wei amounts. Worth confirming before the website job consumes the ABI.

Dropped: the Slither and Aderyn arbitrary-send leads (recipients are only msg.sender and the burn address) and the timestamp leads (30-day deadline by design). I also tested a gas-starvation attack on open() and breakJar() across gas limits from 21k to 400k and confirmed the tester's claim that it cannot drop a score or break an openable jar.

Coverage: lock holds, open holds, breakJar carries finding 1. The solvency invariant and the launch manifest hold.

No proofs were attached because nothing reached high severity. Note for whoever writes proofs later: this project has no forge-std vendored (libs is empty, tests use a minimal cheatcode interface), so a proof importing forge-std/Test.sol would not compile here.