{"assessments":[],"deployments":[],"fuzz":[],"identity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"interpretation":"Records acceptance and evidence. Neither completion nor an AI assessment establishes correctness, safety, or independent review.","jobId":"43bfe288-317b-41b5-ae0e-44237ff350b1","kind":"multi_contract","nodes":[{"acceptedSubmissionHash":"7b506184bef9bee0d152e23596e76276062cdfea056d183f6f2abcb1f607147b","dependsOn":[],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"5289ce0b24a4ca1035ac0eb09883cc3f5490829bd653f88316262bd1414d0803","skillId":"implement-one-contract","tools":[]},"key":"impl_burrowhook","kind":"code","role":"implement","skillHash":"5289ce0b24a4ca1035ac0eb09883cc3f5490829bd653f88316262bd1414d0803","skillId":"implement-one-contract","state":"accepted"},{"acceptedSubmissionHash":"caafeb66c2b41597c38fd44407205ef8dfc0f3f54d062862b13d66e3e9998538","dependsOn":[],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"5289ce0b24a4ca1035ac0eb09883cc3f5490829bd653f88316262bd1414d0803","skillId":"implement-one-contract","tools":[]},"key":"impl_burrowmarket","kind":"code","role":"implement","skillHash":"5289ce0b24a4ca1035ac0eb09883cc3f5490829bd653f88316262bd1414d0803","skillId":"implement-one-contract","state":"accepted"},{"acceptedSubmissionHash":"0ee2dc36ec12b8bb9568b254f99a7bd274158e5f3340e73c725365a5140a85e0","dependsOn":[],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"5289ce0b24a4ca1035ac0eb09883cc3f5490829bd653f88316262bd1414d0803","skillId":"implement-one-contract","tools":[]},"key":"impl_burrowvaluer","kind":"code","role":"implement","skillHash":"5289ce0b24a4ca1035ac0eb09883cc3f5490829bd653f88316262bd1414d0803","skillId":"implement-one-contract","state":"accepted"},{"acceptedSubmissionHash":"9c284c189ca9c34f7cad14761afe2f10430a89899bfa652632ef4edcbc768eef","dependsOn":[],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"5289ce0b24a4ca1035ac0eb09883cc3f5490829bd653f88316262bd1414d0803","skillId":"implement-one-contract","tools":[]},"key":"impl_burrowvault","kind":"code","role":"implement","skillHash":"5289ce0b24a4ca1035ac0eb09883cc3f5490829bd653f88316262bd1414d0803","skillId":"implement-one-contract","state":"accepted"},{"acceptedSubmissionHash":"9f68ad555dd456d969aca2df76adfe2f8d3bad20f92d6c052d9c6099abe9665f","dependsOn":["impl_burrowvault","impl_burrowvaluer","impl_burrowmarket","impl_burrowhook","tests"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"6b037a7b6601e883cf8a906c1520c0624817d42d8310b65c2f43679204608af3","skillId":"adversarial-review","tools":[]},"key":"review","kind":"code","role":"review","skillHash":"6b037a7b6601e883cf8a906c1520c0624817d42d8310b65c2f43679204608af3","skillId":"adversarial-review","state":"accepted"},{"acceptedSubmissionHash":"e7d342105d6083d868a76373c1a4e502c23805dd3a49173ab5526b49e1f26269","dependsOn":["impl_burrowvault","impl_burrowvaluer","impl_burrowmarket","impl_burrowhook"],"execution":{"forkChains":[1,11155111],"network":false,"profile":"foundry","requires":[],"skillHash":"606842ccca0e7c5d3017a54684625438eab9b351eb51dcf0cf88c43d1ea41464","skillId":"write-foundry-tests","subagents":4,"tools":[]},"key":"tests","kind":"code","role":"tests","skillHash":"606842ccca0e7c5d3017a54684625438eab9b351eb51dcf0cf88c43d1ea41464","skillId":"write-foundry-tests","state":"accepted"}],"objective":"Write Burrow, one protocol for Squeekchain on Ethereum Sepolia where a Squeek NFT can be collateral, a marketplace and a Uniswap v4 hook both pay their fees to the same vault, and bonding sells discounted shares for assets the treasury keeps. Foundry, unit tests plus Sepolia fork tests, and a deployment script the operator runs. Do not deploy from the job.\n\nThe vault share token is named Burrow SQK, symbol bSQK, 18 decimals. Holding bSQK is the single way to earn from everything: loan interest, marketplace fees and swap fees all arrive as SQK into the vault and raise the share price. There is no rebase and no second staking contract.\n\nLIVE ADDRESSES, every one verified by calling it; pass them to constructors, never hardcode. SQK 0x5501e1fa81be1c3f49225fa7668da0245d07db60, ERC20 with EIP-2612 permit, 18 decimals. Squeek NFT 0xcb98349c134ab983da5bfd80527dfe2552bdb70f, ERC721, 9987 minted. Squeekchain staking 0x4b67b739dfd832f4eac67a7aa3bc244fb74cea4f exposing deposit(address collection, uint256[] tokenIds), withdraw(address collection, uint256[] tokenIds), claim(address recipient), setClaimRecipient(address), claimable(address) view, basePower(address account, uint8 collection) view, accountPower(address) view, stakeOf(address) view, stake(uint256), unstake(uint256 amount, uint256 maxFee, uint64 deadline) returns (uint256 net), quoteUnstake(address,uint256) view, exitPolicy() view returning (uint16 minBps, uint16 maxBps, uint16 saturationBps, uint8 windowDays, uint256 pressureFloor), live value (200, 6000, 2000, 7, 21000000e18). Uniswap v4 PoolManager 0xE03A1074c86CFeDd5C142C4F04F1a1536e203543, PositionManager 0x429ba70129df741B2Ca2a85BC3A2a3328e5c09b4, Permit2 0x000000000022D473030F116dDEE9F6B43aC78BA3. The public Squeekchain docs are stale for this deployment: their claimable(uint8,uint256[]) and position(uint8,uint256) selectors revert here, so call no signature this objective has not listed.\n\n1. BurrowValuer. creditLine(uint256[] tokenIds) view returns the SQK a borrower may owe, equal to summed NFT power times pricePerPower times ltvBps over 10000. Power per level comes from a table set at construction matching the published policy 1000, 3000, 7000, 15000, 31000, 63000 and upward. There is no NFT market on this chain so pricePerPower is governed and is the main attack surface: the owner may move it only through a two day timelock, by at most 20 percent per change, inside a hard band fixed at construction. ltvBps capped at 6000. Events on proposal and execution with old and new values.\n\n2. BurrowVault, ERC20 bSQK, the lending core and the single fee sink.\nLenders: deposit(uint256 assets) mints shares against totalAssets, which is idle SQK plus principal outstanding plus accrued interest. withdraw(uint256 shares) burns and pays from idle SQK, with a clear custom error when utilisation leaves none.\nBorrowers: openPosition(uint256[] tokenIds) pulls NFTs with safeTransferFrom, records each level, then calls staking.deposit and staking.setClaimRecipient so the collateral keeps earning for the vault. borrow(uint256 amount) requires debt plus amount at or below the valuer line. repay, repayAll and closePosition, which calls staking.withdraw and returns the NFTs once debt is zero. Interest is a fixed per second rate set at construction, capped at 50 percent a year, accrued on every touch.\nSelf repaying loans, the heart of this: sweepRewards() calls staking.claim for the vault and applies what arrives first to accrued interest, pro rata by each position's escrowed power, then to principal. While the hamster runs, the loans shrink by themselves. Anyone may call it.\nLiquidation: when debt exceeds the line, liquidate(address borrower) lets anyone repay the debt and take the NFTs, with liquidationBonusBps capped at 1500, surplus recorded for the borrower. Liquidation reverts within one hour of a price change so governance cannot harvest borrowers.\nFee sink: donate(uint256 amount) pulls SQK and raises the share price without minting. The marketplace and the hook call it. Nothing else is needed to pay stakers.\nBonding: bond(address asset, uint256 amountOrId, uint256 minShares) accepts a Squeek NFT or a v4 SQK pool position, values an NFT through the valuer and a position through its SQK principal, mints bSQK worth that value plus bondDiscountBps capped at 2000, vesting linearly over bondVestingDays, claimable with claimBond(). Bonded assets stay in the treasury; bonded NFTs are staked so they earn.\n\n3. BurrowMarket. list(uint256 tokenId, uint256 price), cancel, buy with SQK pulled from the buyer, and a Dutch auction used for liquidated NFTs that decays linearly from a premium to a floor over a fixed window. Every sale takes feeBps, capped at 500, and forwards it with vault.donate. Sellers are paid the rest in the same transaction.\n\n4. BurrowHook, a Uniswap v4 hook for the SQK pool, built on BaseHook from v4-periphery against the PoolManager above. Permissions: afterSwap and afterSwapReturnDelta only, declared in getHookPermissions. In afterSwap, when the output currency is SQK, skim hookFeeBps capped at 100 of the output, take it from the PoolManager with poolManager.take, and forward it with vault.donate; when SQK is not the output currency, take nothing. A v4 hook only works if its address carries its permission bits, so the deployment script must mine a CREATE2 salt with HookMiner and deploy through the deterministic deployer, and a test must assert the deployed address has exactly the declared flags.\n\nRULES. Solidity 0.8.26, OpenZeppelin for ERC20, ERC721Holder, SafeERC20, ReentrancyGuard and Ownable2Step, v4-core and v4-periphery for the hook. Every value moving external function nonReentrant, checks effects interactions. Custom errors only. Token id arrays capped at 32, strictly ascending, no duplicates. The owner has no path to user assets: the only powers are pausing new borrows, the timelocked price, and parameters inside their hard caps.\n\nTESTS. Unit tests on a mock staking contract mirroring the real one: share price never falls on deposit or withdraw, borrow refused above the line, interest accrual, sweepRewards cutting debt, liquidation one wei either side of the boundary, the timelock rejecting early or oversized moves, the post move liquidation freeze, bond vesting and discount caps, marketplace fee routing into the share price, hook flags matching its address, and every custom error. Fork tests with vm.createSelectFork pinned to a Sepolia block, deal for SQK, vm.prank on a real Squeek holder, proving against the real deployed staking and NFT contracts a full round trip: escrow, still earning, borrow, sweep, repay, close. Invariants: total assets never fall except on withdrawal, and summed debt never exceeds summed credit lines. Ship script/Deploy.s.sol reading the live addresses and parameters from environment variables, mining the hook salt, deploying all four and wiring them, plus a README with every address, every assumption, the unaudited testnet only warning, and the exact forge commands.","parentJobId":null,"planHash":"9bf5ce7e877f8859526e2cf65a899799e5e4fc4ff91fe86c59b3c228d6adbce7","previousHash":"0000000000000000000000000000000000000000000000000000000000000000","projectId":"43bfe288-317b-41b5-ae0e-44237ff350b1","publication":{"commit":null,"deliveredAt":null,"repoUrl":"https://github.com/identity-md-launches/launch-2763-src-burrowvault-sol-src-burrowvaluer-sol"},"receiptIdentity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"registry":"0xb6d0a187b050fa5bb0b87033a203f37becf4a775","research":[],"schema":"identitymd-work-v1","signals":[{"agentId":"51493","feedbackHash":"610deb0ce7007a3481aeaa02b57eaa66d521d2d9c1050e89cd0876247e2ca444","nodeKey":"impl_burrowhook","submissionHash":"7b506184bef9bee0d152e23596e76276062cdfea056d183f6f2abcb1f607147b","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"51087","feedbackHash":"e7e9268c85d361bb4db5582a55600c160082cf4cd013d0ebaf3a3b43765589ed","nodeKey":"impl_burrowmarket","submissionHash":"caafeb66c2b41597c38fd44407205ef8dfc0f3f54d062862b13d66e3e9998538","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"52199","feedbackHash":"23135fcb7da87f9fd1a4d4eebd2479a9d20427bd4c3fb3ab540f33f945639f55","nodeKey":"impl_burrowvaluer","submissionHash":"0ee2dc36ec12b8bb9568b254f99a7bd274158e5f3340e73c725365a5140a85e0","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"51067","feedbackHash":"023a53bbaa6d81b0a45f227f6821ecc398a94b946c634f14eb34dbf31b6f3b47","nodeKey":"impl_burrowvault","submissionHash":"9c284c189ca9c34f7cad14761afe2f10430a89899bfa652632ef4edcbc768eef","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"52127","feedbackHash":"8d8289cbb621d02e9fdeaab860411375eb653098d4b03ae02888350f3d0a940e","nodeKey":"review","submissionHash":"9f68ad555dd456d969aca2df76adfe2f8d3bad20f92d6c052d9c6099abe9665f","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51017","feedbackHash":"3806874da8bb3be787c509238d1da1f78fb7b1343079b24bbbaf1d31d2f690f6","nodeKey":"tests","submissionHash":"e7d342105d6083d868a76373c1a4e502c23805dd3a49173ab5526b49e1f26269","tag1":"verification:checks","tag2":"acceptance-v2","value":1}],"site":null,"snapshotHash":"d25f08ec07bdaf1caef29ab473f078299db8f6b1d0fb4b939c5f054090037627","state":"completed","submissions":[{"artifacts":[],"attempt":1,"bundleHash":"a4e7b3919455e7bee050bef75e4ac067bbba065b9b38c5c7bf9716768f27badf","device":"410d15d57eeec440","findings":[],"hash":"0ee2dc36ec12b8bb9568b254f99a7bd274158e5f3340e73c725365a5140a85e0","nodeId":"d3cc0a21-cb12-4559-b505-f349742f066f","outcome":"completed","summary":"Implemented [BurrowValuer.sol](/home/imd/.identitymd/work/43bfe288-317b-41b5-ae0e-44237ff350b1/d3cc0a21-cb12-4559-b505-f349742f066f/src/BurrowValuer.sol).\n\nOffline `forge build` succeeds. All 64 scratch tests pass, including two pinned Sepolia fork tests, using the supplied fuzz seed.\n\nIntegration details:\n\n- Constructor: `(owner, collection, powerTable, initialPrice, minimumPrice, maximumPrice, ltvBps)`.\n- Table index zero represents level one. LTV and price bounds are immutable.\n- Prices use SQK base units per whole power unit.\n- Uses the live-verified `level(uint256)` NFT getter.\n- Governance uses `proposePricePerPower` and `executePricePerPower`; the vault must enforce its liquidation freeze using `lastPriceChange()`.\n\nOpenZeppelin ownership code is bundled in the permitted file for offline compilation.","treeHash":"50aeda77f1d2e99458faeb813bad56bac9113665","usage":{"cachedInputTokens":964352,"inputTokens":71217,"model":"gpt-6-astra","outputTokens":21975,"runtime":"codex","turns":7,"wallClockMs":367163}},{"artifacts":[],"attempt":1,"bundleHash":"919325e4d425df8d8462229cd989a277227cdc9f7fcbb14a1207d276b83d677d","device":"74979c69cdd583ad","findings":[],"hash":"7b506184bef9bee0d152e23596e76276062cdfea056d183f6f2abcb1f607147b","nodeId":"1280f848-2d8d-4664-a30f-f9fcce8c18c9","outcome":"completed","summary":"I fixed the build. `forge build` now compiles `src/BurrowHook.sol` with no errors, and all 9 of my scratch tests pass under the given fuzz seed.\n\n**Why it failed:** the repository has no `lib/`, no `foundry.toml` and no remappings. Every `@uniswap/...` and `@openzeppelin/...` import pointed at code that isn't there. The only file I'm allowed to write is `src/BurrowHook.sol`, so I couldn't add those libraries.\n\n**The fix:** the file now contains everything it needs. I copied in small versions of the parts of Uniswap v4 and OpenZeppelin that the hook uses: `BaseHook`, the v4 types (`PoolKey`, `SwapParams`, `BalanceDelta`, `Currency`), the hook permission flags, `ReentrancyGuard`, `Ownable2Step` and SafeERC20's `forceApprove`. They encode the same way as the real ones. The `afterSwap` selector, struct layouts, flag bits and pool-id hashing all match, and a test checks the selector against the v4 signature. Each copy has a `Burrow…` prefix so it won't clash if someone adds the real libraries later.\n\n**How the hook behaves:**\n- **Permissions:** only `afterSwap` and `afterSwapReturnDelta`, which means address flags `0x44`. The constructor reverts if the deployed address doesn't carry exactly those flags.\n- **Fee:** when a swap is exact-input and SQK is the output, it takes `hookFeeBps` (capped at 100) of the output. It pulls that with `poolManager.take`, approves the vault, calls `vault.donate`, and returns the fee so the swapper receives that much less.\n- **No fee** when SQK isn't the output.\n- **If the vault's `donate` fails,** the swap still goes through. The fee stays in the hook and anyone can send it on later with `flush()`.\n\n**What the scratch tests covered:** the address flags, the constructor rejecting an unflagged address, the fee going into the vault, no fee when the output isn't SQK or the swap is exact-output, the hold-then-`flush` path, only the PoolManager being able to call `afterSwap`, the owner-only fee setting with its cap, and the selector match.\n\n**Not committed:** the change is staged but there's no commit, because this machine has no git name or email set and I didn't change its git config.\n\n**Assumptions the other contributors need to match:**\n1. **Constructor:** `constructor(address poolManager, address sqk, address vault, uint16 hookFeeBps, address owner)`. It takes plain addresses, not `IPoolManager`/`IERC20` types, so the deploy script and tests can pass addresses whether or not they use the real Uniswap or OpenZeppelin types. HookMiner should use `type(BurrowHook).creationCode` with `abi.encode` of those five values.\n2. **Vault:** I assumed the vault has `donate(uint256)` and collects the SQK with `transferFrom` from the hook. The hook approves the exact fee amount just before each call.\n3. **Exact-output swaps that pay out SQK are not charged.** In v4, `afterSwap` can only adjust the currency the swapper didn't fix, and in an exact-output swap that's the input currency, not SQK.\n4. **Type names differ from v4's:** `afterSwap` takes `BurrowPoolKey` and `BurrowSwapParams` rather than v4's `PoolKey` and `SwapParams`. Tests that call it directly should use these, or call through a real PoolManager. `hookFlags()` returns `0x44` for the flag-matching test.\n5. **Owner:** the owner's only power is setting `hookFeeBps` within the 100 cap, and ownership transfers take two steps. The vault and SQK addresses are fixed at construction.","treeHash":"35856d666928447435be741018329a7defabfc21","usage":{"cachedInputTokens":493753,"inputTokens":35,"model":"claude-opus-5-5","outputTokens":31886,"runtime":"claude","turns":19,"wallClockMs":326900}},{"artifacts":[],"attempt":1,"bundleHash":"b1429bcfbd7e874f295e07c3f8ff28975c1e6a880f228f032da1386b3ac59dca","device":"b0ab61c6f4146d8d","findings":[],"hash":"9c284c189ca9c34f7cad14761afe2f10430a89899bfa652632ef4edcbc768eef","nodeId":"09dcdb3a-c338-41de-a56c-9af892161344","outcome":"completed","summary":"Implemented [src/BurrowVault.sol](/root/.identitymd/work/43bfe288-317b-41b5-ae0e-44237ff350b1/09dcdb3a-c338-41de-a56c-9af892161344/src/BurrowVault.sol:3524) with self-contained dependencies, lending, reward repayment, liquidation surplus, donations, and vested NFT/v4 bonds.\n\nValidation: `forge build` succeeded; 50 tests passed with the requested seed, including 128,000 invariant calls. Sepolia escrow, borrowing, repayment, and collateral return passed at block **12,031,523**. Live staking returned zero rewards; positive reward repayment was verified with mocks.\n\nIntegration assumptions:\n\n- Constructor accepts `Config`; interest uses WAD per second.\n- Valuer exposes `creditLine(uint256[])`, `ltvBps()`, and `lastPriceChange()`.\n- LP bonds accept one constructor-pinned pool.\n- Liquidators pay debt plus borrower equity after the capped bonus.\n- Limits: 256 positions, 32 active bonds per user; first deposit permanently locks 1,000 share wei.\n\nDeployment requires **`--optimize`**: optimized runtime is 20,582 bytes. Nothing was deployed.","treeHash":"a3a8f974c1086547bff5ed8ee4dc0eeec355f928","usage":{"cachedInputTokens":3919872,"inputTokens":95179,"model":"gpt-6-astra","outputTokens":62323,"runtime":"codex","turns":9,"wallClockMs":1779967}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"fd5402086dce252e","findings":[{"citation":"resolved","description":"The objective says: in afterSwap, when the output currency is SQK, skim hookFeeBps of the output. The implementation only skims on exact-input swaps (amountSpecified < 0). Any swapper who buys SQK with an exact-output swap (amountSpecified > 0, output currency SQK) pays no fee at all, so the vault's swap-fee income can be avoided by every trader simply by choosing the swap mode. The contract documents this as a v4 limitation (an afterSwap return delta can only adjust the unspecified currency), and that is true, but the brief does not exempt exact-output swaps. Resolving it needs a scope decision: either accept the gap explicitly, or charge the fee on the unspecified input currency (not SQK) for exact-output swaps, or add beforeSwap/beforeSwapReturnDelta permissions to adjust the specified amount. The second and third options change the agreed design (permissions are specified as afterSwap and afterSwapReturnDelta only). No unit test exercises amountSpecified > 0 (grep of test/ finds no such case).","line":431,"path":"src/BurrowHook.sol","reproduction":"Pool key currency0 = SQK, currency1 = X, hookFeeBps = 100. Swap A: zeroForOne=false, amountSpecified=-1000e18 (exact input X), SQK output 1000e18: hook takes 10e18 SQK and donates it. Swap B: zeroForOne=false, amountSpecified=+1000e18 (exact output SQK), same economic trade: _afterSwap returns (selector, 0), poolManager.take is never called, vault balance unchanged. Expected per brief: 10e18 SQK donated in both cases. Actual: 0 in case B.","severity":"medium","snippet":"        if (params.amountSpecified >= 0) return (BurrowBaseHook.afterSwap.selector, 0);","title":"Hook fee is bypassed entirely by exact-output swaps that buy SQK"},{"citation":"resolved","description":"The objective requires script/Deploy.s.sol (reading addresses and parameters from environment variables, mining the hook salt with HookMiner, deploying all four contracts through the deterministic deployer and wiring them), a README with every address, assumption, testnet warning and forge commands, and that the hook be built on BaseHook from v4-periphery with OpenZeppelin, v4-core and v4-periphery as dependencies. The working tree has no script/ directory, no README, no foundry.toml, no lib/ and no remappings. Every library is instead vendored inline: BurrowBaseHook is a hand port of BaseHook, the OpenZeppelin contracts are copied and renamed per file (BurrowMarketOwnable2Step, BurrowValuerOwnable2Step, BurrowHookOwnable2Step), and the test harness re-declares the cheatcode interface rather than using forge-std. The code that exists is consistent with v4 (flag bits, PositionInfo layout, StateLibrary slot 6) and the fork tests pass against the live PoolManager, so this is a scope gap rather than a runtime defect, but the operator has nothing to run to deploy and the hook does not carry the audited upstream BaseHook.","line":138,"path":"src/BurrowHook.sol","reproduction":"ls script/ README.md foundry.toml lib/ remappings.txt in the repository root: none exist. `forge script script/Deploy.s.sol` has no target. grep -rn 'v4-periphery\\|openzeppelin/' src/ returns no import; src/BurrowHook.sol:136-138 declares a local port instead of importing BaseHook.","severity":"medium","snippet":"abstract contract BurrowBaseHook {","title":"Deliverables required by the brief are missing: Deploy script, README, HookMiner, v4-periphery BaseHook and library dependencies"},{"citation":"resolved","description":"openPosition reverts once 256 positions exist. A position with zero debt can never be liquidated or removed by anyone but its owner, so 256 addresses each escrowing one Squeek (9987 exist) fill the table forever and no other user can open a position. The brief did not ask for a position cap; it was added to bound the interest accrual loop. The attacker forfeits the staking yield of those NFTs (it accrues to the vault as income) but otherwise pays nothing. Keeping the loop bounded while removing the griefing vector (for example, a per-position lastAccrual timestamp so no global loop is needed) changes the agreed accounting shape and is a scope decision.","line":3770,"path":"src/BurrowVault.sol","reproduction":"Mock staking, 256 distinct addresses each calling openPosition([id_i]) with a level-1 Squeek and never borrowing. Address 257 (an honest borrower) calls openPosition([id_257]): reverts TooManyPositions. No action by anyone except the 256 holders can free a slot. The existing test at test/BurrowVault.t.sol:1450 shows the revert but treats it as intended.","severity":"low","snippet":"        if (_borrowers.length == MAX_POSITIONS) revert TooManyPositions();","title":"Hard cap of 256 positions lets a holder of 256 Squeeks permanently block every new borrower"},{"citation":"resolved","description":"The liquidator must always pay at least the full debt. When collateralValue (line scaled back by ltv) falls below debt, nobody will pay debt for NFTs worth less, so the position is never liquidated. Its principal and interest remain in totalPrincipal/totalAccruedInterest, which are counted in totalAssets and in the share price, and interest keeps accruing on the dead principal every touch. Share price is therefore overstated by uncollectable debt and the last withdrawers absorb the loss. The brief's wording (\"repay the debt and take the NFTs\") matches the implementation, so this is a design observation, not a bypass; fixing it (partial-payment liquidation or a write-off path) would be a scope change.","line":3888,"path":"src/BurrowVault.sol","reproduction":"ltv 6000, pricePerPower P, borrower at the line: debt = 0.6V. Governance executes three consecutive maximal 20% decreases over six days (allowed by the timelock): V' = 0.512V, line' = 0.3072V, collateralValue' = 0.512V < debt 0.6V. liquidate() demands payment = debt = 0.6V for collateral worth 0.512V. Alternatively, with no price move, hold the loan ~22 months at the 50%/yr cap: debt > V. In both states totalAssets() still reports the full debt plus continuing interest while no SQK can ever be collected.","severity":"low","snippet":"        payment = Math.max(debt, collateralValue > bonus ? collateralValue - bonus : 0);","title":"Underwater positions have no rational liquidator, so bad debt stays in totalAssets and keeps accruing interest"},{"citation":"resolved","description":"Only the upper bound is checked. A valuer built with initialLtvBps = 0 returns creditLine 0 for everything. BurrowVault's constructor independently rejects a valuer whose ltvBps is 0, so a mis-wired deployment fails at the vault rather than at the valuer, which makes the error harder to attribute. No user harm.","line":290,"path":"src/BurrowValuer.sol","reproduction":"new BurrowValuer(owner, squeek, [1000,3000,7000], 1e18, 1e17, 1e19, 0) succeeds; creditLine([anyId]) returns 0; new BurrowVault with this valuer reverts InvalidParameter().","severity":"info","snippet":"        if (initialLtvBps > MAX_LTV_BPS) revert InvalidLtvBps(initialLtvBps);","title":"BurrowValuer accepts ltvBps = 0 at construction"},{"citation":"resolved","description":"Bond shares are priced against totalAssets, which excludes treasury NFTs and LP positions by design. A bonder with a Squeek valued V at the governed price receives shares redeemable for up to 1.2V of lender SQK after vesting, while the vault gains only the NFT's staking yield. The owner can set bondDiscountBps to 0 but has no switch to stop bonding, and pricePerPower governs the amount extracted. This matches the brief (discounted shares for assets the treasury keeps; share price must not fall on deposit or withdraw, bond is not listed) and is documented at src/BurrowVault.sol:3485-3487, so it is recorded as a trust assumption, not a defect.","line":3939,"path":"src/BurrowVault.sol","reproduction":"Vault with 1000e18 SQK and 1000e18 shares outstanding; bondDiscountBps 2000; NFT valued 100e18. bond(squeek, id, 0) mints 120e18 shares to the vault. Share price moves from 1.0 to 1000/1120 = 0.893 SQK per bSQK immediately; after vesting the bonder can withdraw ~107e18 SQK from lender deposits.","severity":"info","snippet":"        shares = convertToShares(discounted);","title":"Bonding mints discounted shares against liquid SQK only, so every bond lowers the share price and cannot be paused"}],"hash":"9f68ad555dd456d969aca2df76adfe2f8d3bad20f92d6c052d9c6099abe9665f","nodeId":"67c0ef0f-465e-47c0-aba0-deaadc7485c4","outcome":"completed","summary":"The findings file is written and every cited snippet matches the tree. No source files were changed.\n\n**Outcome:** The Burrow implementation is largely sound. No critical or high defects were found. The suite of 79 unit tests passes, and the six Sepolia fork tests also pass when run against a live RPC at the pinned block, proving the round trip against the real staking and NFT contracts. I confirmed by direct calls to Sepolia that the live Squeek NFT exposes a level getter and that staking.accountPower returns two words, so the code's ABI assumptions hold.\n\n**Findings, ranked by severity, in .imd-findings.json:**\n\n- **Medium: hook fee bypass.** Exact-output swaps that buy SQK pay no fee because the hook returns early when amountSpecified is non-negative. Any trader avoids the whole swap fee by choosing swap mode. The brief asks for a skim whenever SQK is the output. Fixing it requires a scope decision, since a v4 afterSwap delta can only touch the unspecified currency.\n- **Medium: missing deliverables.** No script/Deploy.s.sol, no README, no foundry.toml, no lib or remappings. OpenZeppelin, BaseHook and the cheatcode interface are all hand-vendored instead of imported from v4-periphery, OpenZeppelin and forge-std. The operator has nothing to run to deploy.\n- **Low: position-cap griefing.** 256 addresses each escrowing one Squeek with zero debt fill the position table forever. Honest borrowers then get TooManyPositions and nobody can free a slot.\n- **Low: bad debt is never written off.** Liquidators must always pay the full debt, so once collateral value drops below debt (three maximal 20% price cuts, or roughly 22 months at the 50% rate cap) the position is never liquidated and its debt plus continuing interest inflate totalAssets.\n- **Info:** the Valuer accepts an LTV of zero at construction (the Vault rejects it later), and bonding dilutes the share price with no owner switch to pause it. Both match the brief and are recorded as observations.\n\n**Coverage:** all 55 listed entry points have a verdict, plus three invariant rows. Four entry points carry a finding reference and the rest hold. No proof test files were written, since none of the findings reach high severity and the tree has no forge-std for a self-contained proof to import.","treeHash":null,"usage":{"cachedInputTokens":523819,"inputTokens":290,"model":"claude-fable-5-1","outputTokens":27970,"runtime":"claude","turns":19,"wallClockMs":471694}},{"artifacts":[],"attempt":1,"bundleHash":"e31cffa96e64d8996c79dc79ad8b00a1c74858334d30b238ae072e0bc682e755","device":"87645bda72145989","findings":[],"hash":"caafeb66c2b41597c38fd44407205ef8dfc0f3f54d062862b13d66e3e9998538","nodeId":"5dd1edd6-9648-4afa-8bf3-85995c5423aa","outcome":"completed","summary":"Implemented [src/BurrowMarket.sol](/home/imd/.identitymd/work/43bfe288-317b-41b5-ae0e-44237ff350b1/5dd1edd6-9648-4afa-8bf3-85995c5423aa/src/BurrowMarket.sol:1317) with escrowed listings, cancellations, SQK purchases, linear Dutch auctions, capped fees, vault donations, and reentrancy protection. OpenZeppelin dependencies are bundled.\n\nIntegration assumptions:\n- `vault.donate(uint256)` pulls SQK.\n- Liquidators own NFTs before calling `startAuction`.\n- Constructor takes `(sqk, squeek, vault, owner, feeBps, auctionDurationSeconds)`.\n\nFormatting passed; 37 scratch tests prepared. **Build and tests remain unverified:** both Forge commands failed because Solidity 0.8.26 was unavailable and its download failed with a DNS error. Sepolia verification also failed. Nothing deployed.","treeHash":"0bbc9fd6a57bad7edfd5868ac88e39f8f38dbe30","usage":{"cachedInputTokens":850816,"inputTokens":66856,"model":"gpt-6-astra","outputTokens":23481,"runtime":"codex","turns":6,"wallClockMs":506595}},{"artifacts":[],"attempt":1,"bundleHash":"baa7fce4c5fdcb28be9511182e04a1e46b24dab1cc350fd9b70ddf210f18a306","device":"69bbcd9de2fdd6d0","findings":[{"description":"The task requires skimming hookFeeBps whenever SQK is the output currency. _afterSwap instead returns before checking the currency whenever amountSpecified is nonnegative. Traders can therefore select exact-output routing and avoid the entire vault fee. This is not a test expectation: a 100 SQK output at 100 bps is expected to pay 1 SQK, but pays zero. v4 afterSwap deltas apply to the unspecified currency, so simply removing the early return would charge the wrong currency on exact-output swaps; the supported swap policy or fee design needs to be reconciled with the brief.","line":431,"path":"src/BurrowHook.sol","proof":"// SPDX-License-Identifier: MIT\npragma solidity 0.8.26;\nimport {BurrowHook,BurrowPoolKey,BurrowCurrency,BurrowSwapParams,BurrowBalanceDelta} from \"src/BurrowHook.sol\";\nimport {ERC20} from \"src/BurrowVault.sol\";\ncontract FeeProofToken is ERC20 {\n    constructor() ERC20(\"SQK test\",\"SQK\") {_mint(msg.sender,1000e18);}\n}\ncontract FeeProofSink {\n    FeeProofToken public immutable token;\n    constructor(FeeProofToken t){token=t;}\n    function donate(uint256 amount) external {token.transferFrom(msg.sender,address(this),amount);}\n}\ncontract FeeProofManager {\n    function take(BurrowCurrency currency,address to,uint256 amount) external {FeeProofToken(BurrowCurrency.unwrap(currency)).transfer(to,amount);}\n    function swapCallback(BurrowHook h,BurrowPoolKey memory k) external {\n        // Exact output of 100 SQK: SQK is currency1, the positive specified amount.\n        BurrowBalanceDelta delta=BurrowBalanceDelta.wrap((int256(-101e18)<<128)|int256(100e18));\n        h.afterSwap(msg.sender,k,BurrowSwapParams(true,100e18,0),delta,\"\");\n    }\n}\ncontract ExactOutputFeeProofTest {\n    error MissingSQKOutputFee(uint256 expected,uint256 actual);\n    function test_ExactOutputSQKMustPayTheConfiguredFee() public {\n        FeeProofToken token=new FeeProofToken();FeeProofSink sink=new FeeProofSink(token);FeeProofManager manager=new FeeProofManager();\n        bytes32 hash=keccak256(abi.encodePacked(type(BurrowHook).creationCode,abi.encode(address(manager),address(token),address(sink),uint16(100),address(this))));\n        bytes32 salt;\n        for(uint256 i;;i++){\n            salt=bytes32(i);address predicted=address(uint160(uint256(keccak256(abi.encodePacked(bytes1(0xff),address(this),salt,hash)))));\n            if(uint160(predicted)&0x3fff==0x44)break;\n        }\n        BurrowHook hook=new BurrowHook{salt:salt}(address(manager),address(token),address(sink),100,address(this));\n        token.transfer(address(manager),1000e18);\n        BurrowPoolKey memory key=BurrowPoolKey(BurrowCurrency.wrap(address(sink)),BurrowCurrency.wrap(address(token)),3000,60,address(hook));\n        manager.swapCallback(hook,key);\n        uint256 actual=token.balanceOf(address(sink));\n        if(actual!=1e18)revert MissingSQKOutputFee(1e18,actual);\n    }\n}","reproduction":"Run the attached self-contained ExactOutputFeeProofTest. It CREATE2-deploys the production hook at an address with low bits 0x44, funds a mock PoolManager, and invokes afterSwap with zeroForOne=true, SQK as currency1, amountSpecified=100e18, amount0=-101e18, and amount1=100e18. Expected sink balance: 1e18. Actual sink balance: 0. Locally reproduced with forge test --match-path test/scratch/ExactOutputFeeProof.t.sol -vv, failing MissingSQKOutputFee(1000000000000000000, 0).","severity":"medium","title":"Exact-output SQK swaps bypass the configured hook fee"},{"description":"The brief simultaneously asks for interest-bearing loans, liquidation when debt exceeds the line, and an unconditional invariant that summed debt never exceeds summed credit lines. The latter cannot hold during ordinary interest accrual or a governed price reduction. The delivered fixed-price, zero-rate invariant checks borrow admission and repayment limits; a separate positive-rate invariant checks assets, pending debt, liquidation reserves, custody, and share/bond obligations without asserting the contradictory inequality. This is a specification inconsistency, not a claim that interest accrual itself is a security bug.","line":3690,"path":"src/BurrowVault.sol","proof":"// SPDX-License-Identifier: MIT\npragma solidity 0.8.26;\nimport {BurrowVault,ERC20,ERC721Holder,IERC721Receiver} from \"src/BurrowVault.sol\";\nimport {BurrowValuer} from \"src/BurrowValuer.sol\";\ninterface DebtProofVm {function warp(uint256) external;}\ncontract DebtProofToken is ERC20 {\n    constructor() ERC20(\"Mock SQK\",\"SQK\"){_mint(msg.sender,10000e18);}\n}\ncontract DebtProofNFT {\n    address private holder;\n    address private approved;\n    constructor(){holder=msg.sender;}\n    function ownerOf(uint256) external view returns(address){return holder;}\n    function level(uint256) external pure returns(uint8){return 1;}\n    function approve(address to,uint256) external {assert(msg.sender==holder);approved=to;}\n    function safeTransferFrom(address from,address to,uint256 id) external {\n        assert(holder==from&&(msg.sender==holder||msg.sender==approved));holder=to;approved=address(0);\n        if(to.code.length>0)assert(IERC721Receiver(to).onERC721Received(msg.sender,from,id,\"\")==IERC721Receiver.onERC721Received.selector);\n    }\n}\ncontract DebtProofStaking is ERC721Holder {\n    mapping(address=>uint256) private power;\n    function deposit(address collection,uint256[] calldata ids) external {\n        for(uint256 i;i<ids.length;i++){DebtProofNFT(collection).safeTransferFrom(msg.sender,address(this),ids[i]);power[msg.sender]+=1000e18;}\n    }\n    function accountPower(address who) external view returns(uint256,uint256){return(power[who],0);}\n    function claim(address) external {}\n    function setClaimRecipient(address) external {}\n}\ncontract DebtProofPool {}\ncontract DebtProofPositionManager {\n    address public immutable poolManager;\n    constructor(address manager){poolManager=manager;}\n}\ncontract DebtCreditInvariantProofTest is ERC721Holder {\n    DebtProofVm constant vm=DebtProofVm(address(uint160(uint256(keccak256(\"hevm cheat code\")))));\n    error DebtAboveCredit(uint256 debt,uint256 line);\n    function test_UnconditionalRequestedDebtInvariant() public {\n        vm.warp(10 days);\n        DebtProofToken token=new DebtProofToken();DebtProofNFT nft=new DebtProofNFT();DebtProofStaking staking=new DebtProofStaking();\n        uint256[] memory table=new uint256[](1);table[0]=1000;\n        BurrowValuer valuer=new BurrowValuer(address(this),address(nft),table,1e18,1e18,1e18,6000);\n        DebtProofPool pool=new DebtProofPool();DebtProofPositionManager manager=new DebtProofPositionManager(address(pool));\n        BurrowVault vault=new BurrowVault(BurrowVault.Config(address(this),address(token),address(nft),address(staking),address(valuer),address(manager),address(pool),keccak256(\"test pool\"),1e10,1000,1000,10));\n        token.approve(address(vault),type(uint256).max);vault.deposit(1000e18);\n        nft.approve(address(vault),1);uint256[] memory ids=new uint256[](1);ids[0]=1;vault.openPosition(ids);\n        vault.borrow(600e18);vm.warp(block.timestamp+1);\n        uint256 debt=vault.debtOf(address(this));uint256 line=vault.creditLine(address(this));\n        if(debt>line)revert DebtAboveCredit(debt,line);\n    }\n}","reproduction":"Deposit 1000e18 SQK, escrow one level-one NFT with pricePerPower=1e18 and LTV=6000, and borrow its full 600e18 line at rate 1e10 per second. Warp one second. Expected under the requested unconditional invariant: debt <= 600000000000000000000. Actual debt: 600000006000000000000. Locally reproduced by forge test --match-path test/scratch/DebtCreditInvariantProof.t.sol -vv; it fails DebtAboveCredit with those exact values.","severity":"info","title":"The unconditional debt-versus-credit invariant conflicts with required interest accrual"}],"hash":"e7d342105d6083d868a76373c1a4e502c23805dd3a49173ab5526b49e1f26269","nodeId":"3507c7f0-2d3b-436a-ba17-a121f203b2ca","outcome":"completed","summary":"Added three mainnet fork tests in `test/BurrowVault.t.sol`, pinned to block `26310460`, covering real Permit2 transfers, redemption, and approval failures.\n\nVerified:\n- `forge build` succeeds.\n- Full suite: **88 passed, 0 failed, 0 skipped**, using the required fuzz seed.\n- All nine mainnet/Sepolia fork tests passed.\n- New tests skip correctly when `MAINNET_RPC_URL` is empty.","treeHash":"0bf17c9d96579fc442e1037790740541d38d660b","usage":{"cachedInputTokens":3232768,"inputTokens":146677,"model":"gpt-6-astra","outputTokens":60912,"runtime":"codex","turns":16,"wallClockMs":1341611}}],"verification":[{"checks":[{"durationMs":92,"exitCode":0,"name":"build","output":"Compiling 1 files with Solc 0.8.26\nSolc 0.8.26 finished in 35.38ms\nCompiler run successful!\n","passed":true},{"durationMs":76,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\nWarning: No tests found in project! Forge looks for functions that start with `test`\n","passed":true},{"durationMs":25,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"BurrowValuer.acceptOwnership()\",\"BurrowValuer.cancelPriceProposal()\",\"BurrowValuer.executePricePerPower()\",\"BurrowValuer.proposePricePerPower(uint256)\",\"BurrowValuer.renounceOwnership()\",\"BurrowValuer.transferOwnership(address)\"],\"files\":{\"src/BurrowValuer.sol\":414},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true},{"durationMs":309,"exitCode":0,"name":"slither","output":"slither: no results at low impact or above","passed":true},{"durationMs":286,"exitCode":0,"name":"aderyn","output":"[low] centralization-risk at src/BurrowValuer.sol:131: Centralization Risk (6 places)\n[low] large-numeric-literal at src/BurrowValuer.sol:227: Large Numeric Literal\n[low] literal-instead-of-constant at src/BurrowValuer.sol:300: Literal Instead of Constant (2 places)\n[low] require-revert-in-loop at src/BurrowValuer.sol:341: Loop Contains `require`/`revert`\n[low] state-no-address-check at src/BurrowValuer.sol:152: Address State Variable Set Without Checks (2 places)\n[low] state-variable-could-be-immutable at src/BurrowValuer.sol:249: State Variable Could Be Immutable\n[low] uninitialized-local-variable at src/BurrowValuer.sol:301: Uninitialized Local Variable (2 places)","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"0ee2dc36ec12b8bb9568b254f99a7bd274158e5f3340e73c725365a5140a85e0","verifiedTreeHash":"50aeda77f1d2e99458faeb813bad56bac9113665","verifierVersion":"0.1.0+a6eb4461"},{"checks":[{"durationMs":140,"exitCode":0,"name":"build","output":"Compiling 1 files with Solc 0.8.26\nSolc 0.8.26 finished in 60.90ms\nCompiler run successful!\n","passed":true},{"durationMs":93,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\nWarning: No tests found in project! Forge looks for functions that start with `test`\n","passed":true},{"durationMs":42,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"BurrowHook.acceptOwnership()\",\"BurrowHook.afterAddLiquidity(address,(address,address,uint24,int24,address),(int24,int24,int256,bytes32),int256,int256,bytes)\",\"BurrowHook.afterDonate(address,(address,address,uint24,int24,address),uint256,uint256,bytes)\",\"BurrowHook.afterInitialize(address,(address,address,uint24,int24,address),uint160,int24)\",\"BurrowHook.afterRemoveLiquidity(address,(address,address,uint24,int24,address),(int24,int24,int256,bytes32),int256,int256,bytes)\",\"BurrowHook.afterSwap(address,(address,address,uint24,int24,address),(bool,int256,uint160),int256,bytes)\",\"BurrowHook.beforeAddLiquidity(address,(address,address,uint24,int24,address),(int24,int24,int256,bytes32),bytes)\",\"BurrowHook.beforeDonate(address,(address,address,uint24,int24,address),uint256,uint256,bytes)\",\"BurrowHook.beforeInitialize(address,(address,address,uint24,int24,address),uint160)\",\"BurrowHook.beforeRemoveLiquidity(address,(address,address,uint24,int24,address),(int24,int24,int256,bytes32),bytes)\",\"BurrowHook.beforeSwap(address,(address,address,uint24,int24,address),(bool,int256,uint160),bytes)\",\"BurrowHook.flush()\",\"BurrowHook.setHookFeeBps(uint16)\",\"BurrowHook.transferOwnership(address)\"],\"files\":{\"src/BurrowHook.sol\":471},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true},{"durationMs":874,"exitCode":0,"name":"slither","output":"slither: no results at low impact or above","passed":true},{"durationMs":734,"exitCode":0,"name":"aderyn","output":"[low] centralization-risk at src/BurrowHook.sol:307: Centralization Risk (2 places)\n[low] internal-function-used-once at src/BurrowHook.sol:112: Internal Function Used Only Once (2 places)\n[low] large-numeric-literal at src/BurrowHook.sol:339: Large Numeric Literal\n[low] modifier-used-only-once at src/BurrowHook.sol:149: Modifier Invoked Only Once\n[low] state-no-address-check at src/BurrowHook.sol:308: Address State Variable Set Without Checks (2 places)\n[low] unsafe-erc20-operation at src/BurrowHook.sol:468: Unsafe ERC20 Operation","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"7b506184bef9bee0d152e23596e76276062cdfea056d183f6f2abcb1f607147b","verifiedTreeHash":"35856d666928447435be741018329a7defabfc21","verifierVersion":"0.1.0+a6eb4461"},{"checks":[{"durationMs":203,"exitCode":0,"name":"build","output":"Compiling 1 files with Solc 0.8.26\nSolc 0.8.26 finished in 145.88ms\nCompiler run successful!\n","passed":true},{"durationMs":79,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\nWarning: No tests found in project! Forge looks for functions that start with `test`\n","passed":true},{"durationMs":39,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"BurrowVault.acceptOwnership()\",\"BurrowVault.approve(address,uint256)\",\"BurrowVault.bond(address,uint256,uint256)\",\"BurrowVault.borrow(uint256)\",\"BurrowVault.claimBond()\",\"BurrowVault.claimSurplus()\",\"BurrowVault.closePosition()\",\"BurrowVault.deposit(uint256)\",\"BurrowVault.deposit(uint256,uint256)\",\"BurrowVault.donate(uint256)\",\"BurrowVault.liquidate(address)\",\"BurrowVault.openPosition(uint256[])\",\"BurrowVault.renounceOwnership()\",\"BurrowVault.repay(uint256)\",\"BurrowVault.repayAll()\",\"BurrowVault.setBondDiscountBps(uint256)\",\"BurrowVault.setBorrowsPaused(bool)\",\"BurrowVault.setLiquidationBonusBps(uint256)\",\"BurrowVault.sweepRewards()\",\"BurrowVault.transfer(address,uint256)\",\"BurrowVault.transferFrom(address,address,uint256)\",\"BurrowVault.transferOwnership(address)\",\"BurrowVault.withdraw(uint256)\",\"BurrowVault.withdraw(uint256,uint256)\"],\"files\":{\"src/BurrowVault.sol\":4238},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true},{"durationMs":280,"exitCode":0,"name":"slither","output":"slither: no results at low impact or above","passed":true},{"durationMs":611,"exitCode":0,"name":"aderyn","output":"[high] abi-encode-packed-hash-collision at src/BurrowVault.sol:3133: `abi.encodePacked()` Hash Collision\n[high] incorrect-caret-operator at src/BurrowVault.sol:2949: Incorrect use of caret operator\n[high] incorrect-erc721-interface at src/BurrowVault.sol:440: Incorrect ERC721 interface (3 places)\n[high] incorrect-shift-order at src/BurrowVault.sol:4203: Incorrect Assembly Shift Parameter Order (3 places)\n[high] reentrancy-state-change at src/BurrowVault.sol:3636: Reentrancy: State change after external call (8 places)\n[low] centralization-risk at src/BurrowVault.sol:1443: Centralization Risk (8 places)\n[low] costly-loop at src/BurrowVault.sol:3776: Costly operations inside loop (4 places)\n[low] internal-function-used-once at src/BurrowVault.sol:1019: Internal Function Used Only Once (10 places)\n[low] large-numeric-literal at src/BurrowVault.sol:3500: Large Numeric Literal\n[low] literal-instead-of-constant at src/BurrowVault.sol:1638: Literal Instead of Constant (162 places)\n[low] local-variable-shadowing at src/BurrowVault.sol:3513: Local Variable Shadows State Variable (11 places)\n[low] require-revert-in-loop at src/BurrowVault.sol:3776: Loop Contains `require`/`revert` (2 places)\n[low] state-no-address-check at src/BurrowVault.sol:1464: Address State Variable Set Without Checks (3 places)\n[low] storage-array-length-not-cached at src/BurrowVault.sol:3669: Storage Array Length not Cached\n[low] unchecked-return at src/BurrowVault.sol:3731: Unchecked Return (10 places)\n[low] uninitialized-local-variable at src/BurrowVault.sol:3669: Uninitialized Local Variable (6 places)\n[low] unsafe-erc20-operation at src/BurrowVault.sol:1124: Unsafe ERC20 Operation (6 places)\n[low] unused-error at src/BurrowVault.sol:219: Unused Error (17 places)\n[low] unused-public-function at src/BurrowVault.sol:3696: Public Function Not Used Internally (2 places)","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"9c284c189ca9c34f7cad14761afe2f10430a89899bfa652632ef4edcbc768eef","verifiedTreeHash":"a3a8f974c1086547bff5ed8ee4dc0eeec355f928","verifierVersion":"0.1.0+a6eb4461"},{"checks":[{"durationMs":112,"exitCode":0,"name":"build","output":"Compiling 1 files with Solc 0.8.26\nSolc 0.8.26 finished in 54.39ms\nCompiler run successful!\n","passed":true},{"durationMs":87,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\nWarning: No tests found in project! Forge looks for functions that start with `test`\n","passed":true},{"durationMs":33,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"BurrowMarket.acceptOwnership()\",\"BurrowMarket.buy(uint256)\",\"BurrowMarket.buy(uint256,uint256)\",\"BurrowMarket.cancel(uint256)\",\"BurrowMarket.list(uint256,uint256)\",\"BurrowMarket.renounceOwnership()\",\"BurrowMarket.setFeeBps(uint256)\",\"BurrowMarket.startAuction(uint256,uint256,uint256)\",\"BurrowMarket.transferOwnership(address)\"],\"files\":{\"src/BurrowMarket.sol\":1513},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true},{"durationMs":289,"exitCode":0,"name":"slither","output":"slither: no results at low impact or above","passed":true},{"durationMs":371,"exitCode":0,"name":"aderyn","output":"[high] incorrect-caret-operator at src/BurrowMarket.sol:1076: Incorrect use of caret operator\n[low] centralization-risk at src/BurrowMarket.sol:130: Centralization Risk (4 places)\n[low] internal-function-used-once at src/BurrowMarket.sol:715: Internal Function Used Only Once (6 places)\n[low] large-numeric-literal at src/BurrowMarket.sol:1320: Large Numeric Literal\n[low] literal-instead-of-constant at src/BurrowMarket.sol:1076: Literal Instead of Constant (61 places)\n[low] non-reentrant-not-first at src/BurrowMarket.sol:1446: `nonReentrant` is Not the First Modifier\n[low] state-no-address-check at src/BurrowMarket.sol:151: Address State Variable Set Without Checks (2 places)\n[low] unsafe-erc20-operation at src/BurrowMarket.sol:822: Unsafe ERC20 Operation (4 places)","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"caafeb66c2b41597c38fd44407205ef8dfc0f3f54d062862b13d66e3e9998538","verifiedTreeHash":"0bbc9fd6a57bad7edfd5868ac88e39f8f38dbe30","verifierVersion":"0.1.0+a6eb4461"},{"checks":[{"durationMs":1682,"exitCode":0,"name":"build","output":"Compiling 8 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.58s\nCompiler run successful!\n","passed":true},{"durationMs":11342,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 11 tests for test/BurrowHook.t.sol:BurrowHookTest\n[PASS] testFuzz_FeeBoundAndBalanceConservation(uint128,uint16,bool) (runs: 1000, μ: 286188, ~: 308173)\n[PASS] test_AllUnimplementedCallbacksRevert() (gas: 318123)\n[PASS] test_ApprovalFailureIsAtomicAndFlushCannotReenter() (gas: 491309)\n[PASS] test_CREATE2AddressHasExactlyDeclaredPermissions() (gas: 19360)\n[PASS] test_ConstructorAndSetterCapsAndUnauthorizedOwnerActions() (gas: 144306169)\n[PASS] test_ConstructorRejectsAnAddressWithWrongFlags() (gas: 448056)\n[PASS] test_NonSQKOutputNonPositiveOutputAndDustTakeNothing() (gas: 275107)\n[PASS] test_OnlyPoolManagerMayInvokeAfterSwap() (gas: 84541)\n[PASS] test_RefusedDonationIsHeldThenAnyoneCanFlushIt() (gas: 20073588)\n[PASS] test_SQKAsCurrencyZeroUsesAmountZero() (gas: 210608)\n[PASS] test_SQKOutputSkimTakesAndDonatesToRealVault() (gas: 313394)\nSuite result: ok. 11 passed; 0 failed; 0 skipped; finished in 365.69ms (617.81ms CPU time)\n\nRan 15 tests for test/BurrowMarket.t.sol:BurrowMarketTest\n[PASS] testFuzz_DutchPriceMonotoneAndSettlementConservesSQK(uint128,uint128,uint32,uint16) (runs: 1000, μ: 495941, ~: 503190)\n[PASS] test_ApprovalAndPaymentFailuresPreserveListing() (gas: 569869)\n[PASS] test_CancelOnlyBySellerRestoresNFTAndCanRelist() (gas: 521187)\n[PASS] test_ConstructorValidationAndOwnerFeeCap() (gas: 2724742)\n[PASS] test_DutchAuctionStartMidpointLastSecondAndFloor() (gas: 474218)\n[PASS] test_DutchPricingHandlesMaximumUintWithoutOverflow() (gas: 212725)\n[PASS] test_FeeChangesCannotRewriteExistingSellerTerms() (gas: 755717)\n[PASS] test_FixedSalePaysSellerAndRaisesVaultSharePriceAtomically() (gas: 581681)\n[PASS] test_LiquidatorCanAuctionCollateralAndRouteSaleFee() (gas: 1470629)\n[PASS] test_ListingAuctionAndMissingListingErrors() (gas: 497499)\n[PASS] test_NFTReceiverCannotReenterSaleAndRejectedReceiverRollsBack() (gas: 2044394)\n[PASS] test_SlippageRejectsRelistedPriceWithoutMovingValue() (gas: 476455)\n[PASS] test_TaxedSQKAndNonCollectingSinkRollbackEntireSale() (gas: 4061130)\n[PASS] test_UnsolicitedNFTAndForgedCallbackRejected() (gas: 75031)\n[PASS] test_ZeroFeeAndSubWeiFeeDoNotCallDonateZero() (gas: 687044)\nSuite result: ok. 15 passed; 0 failed; 0 skipped; finished in 371.45ms (375.60ms CPU time)\n\nRan 29 tests for test/BurrowVault.t.sol:BurrowVaultTest\n[PASS] testFuzz_DepositAndWithdrawalNeverLowerSharePrice(uint128,uint128,uint128,uint128) (runs: 1000, μ: 544801, ~: 557329)\n[PASS] test_ArrayValidationAndMaximumBatch() (gas: 7687852)\n[PASS] test_BondDiscountVestsLinearlyAndRetainsEarningNFT() (gas: 1266020)\n[PASS] test_BondFailurePathsAndSlippageReturnCollateral() (gas: 1360524)\n[PASS] test_BondLimitAndMatureScheduleRemoval() (gas: 13808523)\n[PASS] test_BorrowBoundaryOneWeiAndFullRoundTrip() (gas: 1467279)\n[PASS] test_ConstructorChecksEveryDependencyAndEconomicCap() (gas: 30710822)\n[PASS] test_DepositErrorsAndSlippageAreAtomic() (gas: 507823)\n[PASS] test_DepositWithdrawAndMinimumLiquidity() (gas: 340116)\n[PASS] test_DonationRaisesSharePriceAndMintsNothing() (gas: 288854)\n[PASS] test_ExecutedPriceMoveFreezesLiquidationForExactlyOneHour() (gas: 1322893)\n[PASS] test_FeeOnTransferSQKIsRejectedAndReentrancyIsBlocked() (gas: 603434)\n[PASS] test_FractionalInterestSurvivesRepeatedTouches() (gas: 1575760)\n[PASS] test_InsufficientIdleLiquidityDoesNotBurnSharesOrIncreaseDebt() (gas: 1010057)\n[PASS] test_InterestAccruesInViewsAndOnTouchWithoutCompounding() (gas: 1203894)\n[PASS] test_InvalidStakingPowerRevertsAtomically() (gas: 1652433)\n[PASS] test_LPPrincipalBoundaryAndBondCustody() (gas: 804579)\n[PASS] test_LiquidationOneWeiBelowAtAndAboveLine() (gas: 9247574)\n[PASS] test_NFTMustBeOwnedAndApprovedAndUnsolicitedReceiptsRevert() (gas: 598159)\n[PASS] test_PauseOnlyStopsBorrowAndAdminCaps() (gas: 1476036)\n[PASS] test_PositionAndAmountFailurePaths() (gas: 885303)\n[PASS] test_PreSeedDonationCannotBeCapturedByFirstDepositor() (gas: 341566)\n[PASS] test_RemovingMiddleBorrowerPreservesOtherPositions() (gas: 1852641)\n[PASS] test_RepayIsClampedAndCanBeClearedByItsAutomaticSweep() (gas: 1315778)\n[PASS] test_ReserveDeficitIsExplicit() (gas: 1175353)\n[PASS] test_RewardsBelongToOldPowerBeforeNewPositionEnters() (gas: 1409450)\n[PASS] test_RewardsRepayProRataInterestFirstAndLeaveExcessAsIncome() (gas: 2016992)\n[PASS] test_SweepCanRescuePositionBeforeLiquidation() (gas: 1235064)\n[PASS] test_WithdrawErrorsAndSlippageAreAtomic() (gas: 350303)\nSuite result: ok. 29 passed; 0 failed; 0 skipped; finished in 371.62ms (418.32ms CPU time)\n\nRan 11 tests for test/BurrowValuer.t.sol:BurrowValuerTest\n[PASS] testFuzz_CreditLineRoundsOnlyAfterAggregating(uint128,uint16,uint8) (runs: 1000, μ: 155689, ~: 126969)\n[PASS] test_ConstructorRejectsInvalidConfiguration() (gas: 22017)\n[PASS] test_ExactTwentyPercentDecreaseIsAllowed() (gas: 139311)\n[PASS] test_FullPrecisionCreditLineDoesNotOverflow() (gas: 1198647)\n[PASS] test_OneWeiOversizedMovesUnchangedAndHardBand() (gas: 175114)\n[PASS] test_ReplacingProposalRestartsEntireDelayAndCancelDoesNotFreeze() (gas: 272639)\n[PASS] test_SmallIntegerPricesRoundStepCapDown() (gas: 181683)\n[PASS] test_TokenArrayAndLevelFailurePaths() (gas: 209978)\n[PASS] test_TwoDayDelayExecutionEventsAndReplayProtection() (gas: 250548)\n[PASS] test_UnauthorizedPriceChangesAndOwnershipHandoff() (gas: 324459)\n[PASS] test_ValuesSummedPowerAtPublishedLevels() (gas: 256242)\nSuite result: ok. 11 passed; 0 failed; 0 skipped; finished in 371.75ms (365.93ms CPU time)\n\nRan 9 tests for test/BurrowVault.t.sol:BurrowVaultBoundaryTest\n[PASS] testFuzz_AccrualIsIndependentOfTouchFrequency(uint128,uint32,uint8) (runs: 1000, μ: 1628755, ~: 1509138)\n[PASS] testFuzz_ClaimingBondInPartsCannotOverclaim(uint32,uint16) (runs: 1000, μ: 974400, ~: 977861)\n[PASS] testFuzz_RewardAllocationsConserveDebtAndAssets(uint128,uint128,uint128) (runs: 1000, μ: 1680624, ~: 1681687)\n[PASS] test_AscendingIdsAtUint256Boundary() (gas: 956326)\n[PASS] test_InvalidValuerLtvAndLPInvalidTicksFailClosed() (gas: 2995233)\n[PASS] test_LPValuationHandlesSQKAsCurrencyOneAndRangeEdges() (gas: 15246409)\n[PASS] test_LiquidationBonusAndSurplusCannotBeCapturedByOwner() (gas: 16780274)\n[PASS] test_PositionLimitRevertsAndClosingRestoresCapacity() (gas: 111683076)\n[PASS] test_ZeroValueShareWithdrawalAndZeroShareBondRevert() (gas: 9062738)\nSuite result: ok. 9 passed; 0 failed; 0 skipped; finished in 371.72ms (1.29s CPU time)\n\nRan 1 test for test/BurrowMarket.t.sol:BurrowMarketSepoliaForkTest\n[PASS] testFork_SepoliaRealNFTSalePaysRealSQKToVault() (gas: 12612514)\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 622.89ms (622.15ms CPU time)\n\nRan 3 tests for test/BurrowVault.t.sol:BurrowVaultMainnetForkTest\n[PASS] testFork_MainnetPermit2RejectsWrongSpenderAndExpiredApproval() (gas: 16215285)\n[PASS] testFork_MainnetPermit2RevocationAtEitherApprovalLayerPreservesShares() (gas: 16249341)\n[PASS] testFork_MainnetPermit2TransfersYieldBearingSharesAndRedeems() (gas: 16438242)\nSuite result: ok. 3 passed; 0 failed; 0 skipped; finished in 699.59ms (2.05s CPU time)\n\nRan 1 test for test/BurrowHook.t.sol:BurrowHookSepoliaForkTest\n[PASS] testFork_SepoliaRealPoolSwapSettlesFeeIntoVault() (gas: 29138166)\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 766.68ms (765.59ms CPU time)\n\nRan 1 test for test/BurrowHook.t.sol:BurrowLPBondSepoliaForkTest\n[PASS] testFork_SepoliaRealPositionPrincipalMatchesRedeemableSQKAndBonds() (gas: 12563703)\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 863.92ms (863.04ms CPU time)\n\nRan 1 test for test/BurrowVault.t.sol:BurrowNFTBondSepoliaForkTest\n[PASS] testFork_SepoliaBondedNFTKeepsEarningForShareholders() (gas: 10369461)\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 909.88ms (909.34ms CPU time)\n\nRan 2 tests for test/BurrowVault.t.sol:BurrowSepoliaForkTest\n[PASS] testFork_SepoliaRealCollateralEarningBorrowSweepRepayClose() (gas: 11146127)\n[PASS] testFork_SepoliaVerifiedDependenciesAndExitPolicy() (gas: 56153)\nSuite result: ok. 2 passed; 0 failed; 0 skipped; finished in 941.12ms (1.42s CPU time)\n\nRan 1 test for test/BurrowHook.t.sol:BurrowHookInvariantTest\n[PASS] invariant_FeesAreDeliveredOrRecoverableAndNeverLost() (runs: 256, calls: 16384, reverts: 0)\n\n╭-------------------+------------+-------+---------+----------╮\n| Contract          | Selector   | Calls | Reverts | Discards |\n+=============================================================+\n| BurrowHookHandler | flush      | 3292  | 0       | 0        |\n|-------------------+------------+-------+---------+----------|\n| BurrowHookHandler | refuse     | 3375  | 0       | 0        |\n|-------------------+------------+-------+---------+----------|\n| BurrowHookHandler | sendTokens | 3230  | 0       | 0        |\n|-------------------+------------+-------+---------+----------|\n| BurrowHookHandler | setFee     | 3232  | 0       | 0        |\n|-------------------+------------+-------+---------+----------|\n| BurrowHookHandler | swap       | 3255  | 0       | 0        |\n╰-------------------+------------+-------+---------+----------╯\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 1.71s (1.69s CPU time)\n\nRan 1 test for test/BurrowMarket.t.sol:BurrowMarketInvariantTest\n[PASS] invariant_EscrowOwnershipAndSaleAccounting() (runs: 256, calls: 16384, reverts: 0)\n\n╭---------------------+----------+-------+---------+----------╮\n| Contract            | Selector | Calls | Reverts | Discards |\n+=============================================================+\n| BurrowMarketHandler | advance  | 3187  | 0       | 0        |\n|---------------------+----------+-------+---------+----------|\n| BurrowMarketHandler | buy      | 3292  | 0       | 0        |\n|---------------------+----------+-------+---------+----------|\n| BurrowMarketHandler | cancel   | 3282  | 0       | 0        |\n|---------------------+----------+-------+---------+----------|\n| BurrowMarketHandler | list     | 3345  | 0       | 0        |\n|---------------------+----------+-------+---------+----------|\n| BurrowMarketHandler | setFee   | 3278  | 0       | 0        |\n╰---------------------+----------+-------+---------+----------╯\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 5.43s (5.43s CPU time)\n\nRan 1 test for test/BurrowVault.t.sol:BurrowAccruingVaultInvariantTest\n[PASS] invariant_AccruingDebtLiquidationsAndReservesRemainFullyAccounted() (runs: 256, calls: 16384, reverts: 0)\n\n╭--------------------+-----------------+-------+---------+----------╮\n| Contract           | Selector        | Calls | Reverts | Discards |\n+===================================================================+\n| BurrowVaultHandler | advanceAndClaim | 1304  | 0       | 0        |\n|--------------------+-----------------+-------+---------+----------|\n| BurrowVaultHandler | bond            | 1260  | 0       | 0        |\n|--------------------+-----------------+-------+---------+----------|\n| BurrowVaultHandler | borrow          | 1227  | 0       | 0        |\n|--------------------+-----------------+-------+---------+----------|\n| BurrowVaultHandler | claimSurplus    | 1259  | 0       | 0        |\n|--------------------+-----------------+-------+---------+----------|\n| BurrowVaultHandler | close           | 1237  | 0       | 0        |\n|--------------------+-----------------+-------+---------+----------|\n| BurrowVaultHandler | deposit         | 1282  | 0       | 0        |\n|--------------------+-----------------+-------+---------+----------|\n| BurrowVaultHandler | donate          | 1296  | 0       | 0        |\n|--------------------+-----------------+-------+---------+----------|\n| BurrowVaultHandler | liquidate       | 1289  | 0       | 0        |\n|--------------------+-----------------+-------+---------+----------|\n| BurrowVaultHandler | open            | 1226  | 0       | 0        |\n|--------------------+-----------------+-------+---------+----------|\n| BurrowVaultHandler | repay           | 1266  | 0       | 0        |\n|--------------------+-----------------+-------+---------+----------|\n| BurrowVaultHandler | reward          | 1290  | 0       | 0        |\n|--------------------+-----------------+-------+---------+----------|\n| BurrowVaultHandler | transferShares  | 1222  | 0       | 0        |\n|--------------------+-----------------+-------+---------+----------|\n| BurrowVaultHandler | withdraw        | 1226  | 0       | 0        |\n╰--------------------+-----------------+-------+---------+----------╯\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 8.07s (8.06s CPU time)\n\nRan 1 test for test/BurrowVault.t.sol:BurrowVaultInvariantTest\n[PASS]\nBurrowVaultInvariantTest invariants:\n[PASS] invariant_AssetsConservedAndSharePriceMonotoneOnDepositWithdraw\n[PASS] invariant_DebtCreditAndStakedCollateralReconcile\n[PASS] invariant_SharesAndBondEscrowReconcile\n BurrowVaultInvariantTest invariants (runs: 256, calls: 16384, reverts: 0)\n\n╭--------------------+-----------------+-------+---------+----------╮\n| Contract           | Selector        | Calls | Reverts | Discards |\n+===================================================================+\n| BurrowVaultHandler | advanceAndClaim | 1304  | 0       | 0        |\n|--------------------+-----------------+-------+---------+----------|\n| BurrowVaultHandler | bond            | 1260  | 0       | 0        |\n|--------------------+-----------------+-------+---------+----------|\n| BurrowVaultHandler | borrow          | 1227  | 0       | 0        |\n|--------------------+-----------------+-------+---------+----------|\n| BurrowVaultHandler | claimSurplus    | 1259  | 0       | 0        |\n|--------------------+-----------------+-------+---------+----------|\n| BurrowVaultHandler | close           | 1237  | 0       | 0        |\n|--------------------+-----------------+-------+---------+----------|\n| BurrowVaultHandler | deposit         | 1282  | 0       | 0        |\n|--------------------+-----------------+-------+---------+----------|\n| BurrowVaultHandler | donate          | 1296  | 0       | 0        |\n|--------------------+-----------------+-------+---------+----------|\n| BurrowVaultHandler | liquidate       | 1289  | 0       | 0        |\n|--------------------+-----------------+-------+---------+----------|\n| BurrowVaultHandler | open            | 1226  | 0       | 0        |\n|--------------------+-----------------+-------+---------+----------|\n| BurrowVaultHandler | repay           | 1266  | 0       | 0        |\n|--------------------+-----------------+-------+---------+----------|\n| BurrowVaultHandler | reward          | 1290  | 0       | 0        |\n|--------------------+-----------------+-------+---------+----------|\n| BurrowVaultHandler | transferShares  | 1222  | 0       | 0        |\n|--------------------+-----------------+-------+---------+----------|\n| BurrowVaultHandler | withdraw        | 1226  | 0       | 0        |\n╰--------------------+-----------------+-------+---------+----------╯\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 11.20s (11.19s CPU time)\n\nRan 15 test suites in 11.22s (33.06s CPU time): 88 tests passed, 0 failed, 0 skipped (88 total tests)\n","passed":true},{"durationMs":100,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"BurrowHook.acceptOwnership()\",\"BurrowHook.afterAddLiquidity(address,(address,address,uint24,int24,address),(int24,int24,int256,bytes32),int256,int256,bytes)\",\"BurrowHook.afterDonate(address,(address,address,uint24,int24,address),uint256,uint256,bytes)\",\"BurrowHook.afterInitialize(address,(address,address,uint24,int24,address),uint160,int24)\",\"BurrowHook.afterRemoveLiquidity(address,(address,address,uint24,int24,address),(int24,int24,int256,bytes32),int256,int256,bytes)\",\"BurrowHook.afterSwap(address,(address,address,uint24,int24,address),(bool,int256,uint160),int256,bytes)\",\"BurrowHook.beforeAddLiquidity(address,(address,address,uint24,int24,address),(int24,int24,int256,bytes32),bytes)\",\"BurrowHook.beforeDonate(address,(address,address,uint24,int24,address),uint256,uint256,bytes)\",\"BurrowHook.beforeInitialize(address,(address,address,uint24,int24,address),uint160)\",\"BurrowHook.beforeRemoveLiquidity(address,(address,address,uint24,int24,address),(int24,int24,int256,bytes32),bytes)\",\"BurrowHook.beforeSwap(address,(address,address,uint24,int24,address),(bool,int256,uint160),bytes)\",\"BurrowHook.flush()\",\"BurrowHook.setHookFeeBps(uint16)\",\"BurrowHook.transferOwnership(address)\",\"BurrowMarket.acceptOwnership()\",\"BurrowMarket.buy(uint256)\",\"BurrowMarket.buy(uint256,uint256)\",\"BurrowMarket.cancel(uint256)\",\"BurrowMarket.list(uint256,uint256)\",\"BurrowMarket.renounceOwnership()\",\"BurrowMarket.setFeeBps(uint256)\",\"BurrowMarket.startAuction(uint256,uint256,uint256)\",\"BurrowMarket.transferOwnership(address)\",\"BurrowValuer.acceptOwnership()\",\"BurrowValuer.cancelPriceProposal()\",\"BurrowValuer.executePricePerPower()\",\"BurrowValuer.proposePricePerPower(uint256)\",\"BurrowValuer.renounceOwnership()\",\"BurrowValuer.transferOwnership(address)\",\"BurrowVault.acceptOwnership()\",\"BurrowVault.approve(address,uint256)\",\"BurrowVault.bond(address,uint256,uint256)\",\"BurrowVault.borrow(uint256)\",\"BurrowVault.claimBond()\",\"BurrowVault.claimSurplus()\",\"BurrowVault.closePosition()\",\"BurrowVault.deposit(uint256)\",\"BurrowVault.deposit(uint256,uint256)\",\"BurrowVault.donate(uint256)\",\"BurrowVault.liquidate(address)\",\"BurrowVault.openPosition(uint256[])\",\"BurrowVault.renounceOwnership()\",\"BurrowVault.repay(uint256)\",\"BurrowVault.repayAll()\",\"BurrowVault.setBondDiscountBps(uint256)\",\"BurrowVault.setBorrowsPaused(bool)\",\"BurrowVault.setLiquidationBonusBps(uint256)\",\"BurrowVault.sweepRewards()\",\"BurrowVault.transfer(address,uint256)\",\"BurrowVault.transferFrom(address,address,uint256)\",\"BurrowVault.transferOwnership(address)\",\"BurrowVault.withdraw(uint256)\",\"BurrowVault.withdraw(uint256,uint256)\"],\"files\":{\"src/BurrowHook.sol\":471,\"src/BurrowMarket.sol\":1513,\"src/BurrowValuer.sol\":414,\"src/BurrowVault.sol\":4238,\"test/BurrowHook.t.sol\":643,\"test/BurrowMarket.t.sol\":578,\"test/BurrowValuer.t.sol\":227,\"test/BurrowVault.t.sol\":1898},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"e7d342105d6083d868a76373c1a4e502c23805dd3a49173ab5526b49e1f26269","verifiedTreeHash":"0bf17c9d96579fc442e1037790740541d38d660b","verifierVersion":"0.1.0+a6eb4461"}]}