Repository: https://github.com/Bradymck/imd-beacon. Continue Job 2, the BeaconVerifier. Read docs/SPEC.md (§4.3, §8.2, §10.3 Job 2) and docs/reviews/job2-review.md, section "Audit round 2", first. Fix only the findings below. Do not deploy anything. foundry.toml is fixed and must not change.

Rule for every fix: first add or tighten a test that FAILS on the current code, then change the code so it passes. In the pull request description, list each new test and the failure it showed before the fix.

1. Verifier bug, src/BeaconVerifier.sol submit() duplicate path (lines 130–136). Once a round is available, submit() only parses, compresses and hashes the signature. An off-curve or non-subgroup point with the same x and compression sign bit returns false instead of reverting. That violates SPEC "invalid submissions revert". Fix: on the duplicate path, run the full _verify (encoding checks, hash-to-curve, pairing), then compare with the stored value. A matching valid duplicate still returns false, writes nothing and emits nothing. Any invalid input reverts with the same error a first submission would get. A valid signature for a different value reverts RoundValueMismatch. Add test_DuplicateRejectsInvalidPoint: publish round 1, then submit offCurveG1Affine and nonSubgroupG1Affine from test/vectors/bls12.json for round 1, and expect PrecompileFailure(0x0f) exactly. Restore and commit the proof of this finding that test/verification-notes.md says was recorded (.imd-findings.json, test/scratch/DuplicateOffCurveProof.t.sol) as an ordinary test, or remove the stale references.

2. testFuzz_EncodingCannotChangeOutput (test/contracts/BeaconVerifier.t.sol about 482–507): every run must be adversarial. Target the equivalence classes x+p, y+p, p−y (the negated point), flag bits 0x80/0x40/0x20 set in the affine x, and infinity, each with its exact error selector. Run each against verify, against a first submit, and against a duplicate submit after the round is published. Keep at least 10,000 runs.

3. testFuzz_ModifiedSignatureFails: pin the exact selectors (no bare expectRevert; PrecompileFailure(0x0f) where the pairing precompile rejects). Remove the no-op mask near line 529. Add mutations sig + G1 and 2·sig (valid subgroup points that must fail the pairing with InvalidSignature). Run every mode both against verify and against submit after the same round has been published.

4. test/contracts/BeaconVerifierInvariant.t.sol malformed-input handler (about lines 136–144): assert the expected revert data for each state instead of accepting any revert, so RoundNotReleased or EpochNotAuthorized cannot mask a missed signature check. Add a mutation that flips y while keeping x and the sign bit (the class in finding 1).

5. Replace the bare vm.expectRevert() at BeaconVerifier.t.sol lines 355 and 403 and BeaconVerifierAdversarial.t.sol lines 119, 168, 174, 190 and 400 with exact selectors and arguments.

6. testGas_SubmitFirstWriteWarmWord warms the availability word in the same transaction and undercounts by about 2,100 gas. Measure it so the warm state comes from a prior transaction (for example, by isolating the calls), and update docs/verification-gas.md with the corrected numbers. Budgets stay: verify at most 170,000 execution gas; first submit at most 250,000 receipt gas. If the duplicate-path fix raises duplicate cost, record it; duplicates have no budget, but report the number.

Out of scope: deployment scripts and manifests, registry, rewards. If any fix conflicts with SPEC, stop and report instead of guessing. The whole suite must pass offline with make test.