{"workflow":null,"planning":null,"id":"6b53a374-0154-4de8-a0d9-e07c846d3eb0","state":"blocked","template":"audit","objective":"Audit the three Ponzinomics contracts in src/pimd: PimdToken, a fixed-supply ERC-20 of exactly 1,000,000,000 at 18 decimals with no owner, no mint and no burn; PimdHook, a Uniswap V4 hook that taxes every trade in IMD (2.4% on buys, 5.6% on sells) split 75% to holders and 25% to the team, taking fees as ERC-6909 claims on the quote currency; and PimdEngine, which pushes the holders' IMD into wallets weighted by balance times hold-streak across paged tally and pay calls. The hook is deployed by the IMD launch factory, which constructs it with only the pool manager and the token and opens the pool itself, so everything else is a source constant. Five things deserve the hardest look. First, beforeRemoveLiquidity is the entire safety case for letting the launch factory hold the liquidity position: it must refuse every negative liquidityDelta forever, from any caller including the position's owner and including the hook itself, while allowing a zero delta so the pool's own fee collection still works. If any path can withdraw liquidity, that is the finding that matters most. Second, beforeAddLiquidity must allow exactly one add, the factory's seed, and refuse every subsequent one; check for any way to slip a second through, including reentrancy and the hook calling itself. Third, beforeInitialize is the only gate on the pool's shape: confirm it cannot be bypassed and that every assumption the tax maths makes is actually enforced there, in particular that the quote currency is currency0, since every fee calculation depends on it and the token's address is no longer mined. Fourth, the fee accounting: that claims minted in beforeSwap and afterSwap always equal holdersOwed plus teamOwed, that nothing can be double counted or stranded, and that flush cannot pay out more than was taken. Fifth, the engine must never read holder weights while the PoolManager is unlocked, which is where a flash borrower would stand, and one holder who cannot receive IMD must not be able to stall a batch. Note also that the engine pulls from the hook inside a try/catch, which has already hidden one breakage from us: say whether that pattern is safe here. Report findings rather than fixing them, and do not propose changes to the economics, the tax rates, the split or the tier ladder.","blockedReason":"node audit_economics: local_build_failed","createdAt":"2026-10-07T20:31:50.906Z","updatedAt":"2026-10-07T20:32:28.242Z","paidBy":"0x9cd2cb669138a9c84577d2fd2de9ee05d5c0a001","parentJobId":null,"project":{"id":"6b53a374-0154-4de8-a0d9-e07c846d3eb0","head":"6b53a374-0154-4de8-a0d9-e07c846d3eb0","running":null,"versions":[{"jobId":"6b53a374-0154-4de8-a0d9-e07c846d3eb0","workflowId":null,"objective":"Audit the three Ponzinomics contracts in src/pimd: PimdToken, a fixed-supply ERC-20 of exactly 1,000,000,000 at 18 decimals with no owner, no mint and no burn; PimdHook, a Uniswap V4 hook that taxes every trade in IMD (2.4% on buys, 5.6% on sells) split 75% to holders and 25% to the team, taking fees as ERC-6909 claims on the quote currency; and PimdEngine, which pushes the holders' IMD into wallets weighted by balance times hold-streak across paged tally and pay calls. The hook is deployed by the IMD launch factory, which constructs it with only the pool manager and the token and opens the pool itself, so everything else is a source constant. Five things deserve the hardest look. First, beforeRemoveLiquidity is the entire safety case for letting the launch factory hold the liquidity position: it must refuse every negative liquidityDelta forever, from any caller including the position's owner and including the hook itself, while allowing a zero delta so the pool's own fee collection still works. If any path can withdraw liquidity, that is the finding that matters most. Second, beforeAddLiquidity must allow exactly one add, the factory's seed, and refuse every subsequent one; check for any way to slip a second through, including reentrancy and the hook calling itself. Third, beforeInitialize is the only gate on the pool's shape: confirm it cannot be bypassed and that every assumption the tax maths makes is actually enforced there, in particular that the quote currency is currency0, since every fee calculation depends on it and the token's address is no longer mined. Fourth, the fee accounting: that claims minted in beforeSwap and afterSwap always equal holdersOwed plus teamOwed, that nothing can be double counted or stranded, and that flush cannot pay out more than was taken. Fifth, the engine must never read holder weights while the PoolManager is unlocked, which is where a flash borrower would stand, and one holder who cannot receive IMD must not be able to stall a batch. Note also that the engine pulls from the hook inside a try/catch, which has already hidden one breakage from us: say whether that pattern is safe here. Report findings rather than fixing them, and do not propose changes to the economics, the tax rates, the split or the tier ladder.","baseCommit":"6f879adcc641581746eeffd43f6f9b2a1817064a","state":"blocked","createdAt":"2026-10-07T20:31:50.906Z"}]},"deliver":true,"host":false,"site":null,"launch":{"requested":false,"kind":null,"id":null,"status":null,"chainId":null},"oracleRequestId":null,"delivery":null,"media":null,"nodes":[{"key":"audit_economics","role":"review","state":"failed","attempt":3,"revisions":0,"judgeRevisions":0,"dependsOn":[],"allowedPaths":[],"failureReason":"local_build_failed","dispatchNote":null,"dispatchNoteAt":null,"updatedAt":"2026-10-07T20:32:28.242Z","verdict":null,"seat":null,"live":null},{"key":"audit_flow","role":"review","state":"ready","attempt":2,"revisions":0,"judgeRevisions":0,"dependsOn":[],"allowedPaths":[],"failureReason":null,"dispatchNote":null,"dispatchNoteAt":null,"updatedAt":"2026-10-07T20:32:18.922Z","verdict":null,"seat":null,"live":null},{"key":"audit_judge","role":"review","state":"waiting","attempt":0,"revisions":0,"judgeRevisions":0,"dependsOn":["audit_math","audit_permissions","audit_economics","audit_flow"],"allowedPaths":[],"failureReason":null,"dispatchNote":null,"dispatchNoteAt":null,"updatedAt":"2026-10-07T20:31:50.906Z","verdict":null,"seat":null,"live":null},{"key":"audit_math","role":"review","state":"failed","attempt":3,"revisions":0,"judgeRevisions":0,"dependsOn":[],"allowedPaths":[],"failureReason":"local_build_failed","dispatchNote":null,"dispatchNoteAt":null,"updatedAt":"2026-10-07T20:32:25.567Z","verdict":null,"seat":null,"live":null},{"key":"audit_permissions","role":"review","state":"failed","attempt":3,"revisions":0,"judgeRevisions":0,"dependsOn":[],"allowedPaths":[],"failureReason":"local_build_failed","dispatchNote":null,"dispatchNoteAt":null,"updatedAt":"2026-10-07T20:32:26.391Z","verdict":null,"seat":null,"live":null}],"reviews":[{"status":"queued","chainId":1,"txHash":null,"blockNumber":null,"sentAt":null,"entries":[]}]}