# FINANCIER ($FINCR) public-source research report

Decision date: 17 October 2026 UTC. Deadline: 21 October 2026. Scope is read-only public research and local reasoning; no contact, import, payment, signing, deployment, publication, or private FINANCIER source.

## Executive decision

| Area | Verdict | Basis |
|---|---|---|
| A — official launch/reserve custody (60%) | NO-GO; future implementation UNKNOWN | Public launch APIs show request, admission, later attestation and records, but no immutable pre-execution freeze, enforced pause, unchanged resume, or canonical-number-bound reserve forwarder. |
| B — authentic complete agent work (30%) | NO-GO | Public receipts, reviews, seats and oracle attestations do not prove the exact FINANCIER job/submission/artifact/review, complete accepted-agent set, destination consent, finalized roots, revocation, replay and duplicate exclusion. |
| C — limited security (10%) | UNKNOWN/risk register | No FINCR Solidity/private tests were supplied; hypotheses are not called reproduced defects. |

A public absence means the capability was not found in the inspected interfaces; it does not prove a private operator cannot build it.

## Requirements and acceptance floor

The supplied protected tests require whole manifest supply minted to the factory, manifest decimals, whole 10% swarm transfer and claim, single-sided pool seed, ordinary buy and sell, no post-launch mint/admin seizure or freeze, constructor supply preservation, and no runtime DELEGATECALL, CALLCODE or SELFDESTRUCT. The owner test forbids application contracts owned by factory or IMD.

The locked launch requires Robinhood 4663, launch.open/custom_token, pairWith imd, economics.poolBps 5000, literal remainderTo, burnable FINCR, 50/10/40 allocation, and independent tenure/round claims. An immutable ReserveForwarder must exist before remainder transfer, be the miner initializer, and pin canonical factory/registry/deployer, launch number, final adapted source/compiler/constructors, complete code/runtime/configuration, supply/artifacts, and final manifest/attestation/verifier commitments. Factory transfer must precede registry recording; forwarding afterward must be permissionless. Required sequence: final inputs, enforced pre-execution pause, forwarder deployment/verification, then resume the exact frozen launch.

## A — launch, freeze, custody

The live capabilities endpoint lists Robinhood 4663, custom_token and the imd pairing. Policy version 36 for 4663 records a 10% pool floor, 1.25% fee tier, equal-connected reward rule and policy caps. Docs say custom_token requires economics, 10% goes to the swarm, poolBps seeds the pool and the remainder goes to remainderTo. This makes the shape syntactically plausible, not authenticated.

The documented sequence is paid launch.open, 600-second quote, request-key retry, payment, admission, source publication/rebuild/attestation, deployment and live record. The launch route exposes lifecycle, checks, attestation, addresses, transactions, allocations and reward snapshots after the fact. No documented factory-enforced pre-execution pause or two-phase finalize/deploy-forwarder/resume transition was found.

The task-supplied 4663 ProjectFactory 0x9c9d2fcb75c2c132c0ac0c42df3819a42347265e has deployed bytecode that returns the task-supplied registry 0xf52bbe066b7ad2d28c2195d066ea08dcbca88406 in a public code path. This observes an address relationship only; it does not prove transfer/record ordering or the forwarder invariant. Public docs expose no verified ABI for this handoff.

Why this fails the lock:

* Quote expiry/retry is request timing, not a launch-number reservation freezing final code/runtime.
* Manifest/result/source/CREATE2 hashes and later registry records cannot prove the forwarder existed before transfer.
* A number-independent receiver cannot select canonical FINCR; identical competing launches can qualify. Exact 40% custody does not prove the 50% pool and 10% swarm split.
* Lifecycle statuses/retries do not establish an enforced pause tied to the unchanged commitment.
* Sinopia #1942 is evm_contracts with no token, pool, distributor or launch allocation; it is an ascending NFT auction with Intake delivery, not a Dutch takeover or FINCR witness.

A verdict: NO-GO until the exact factory/forwarder/pause capability has positive and tampered-negative fixtures. Do not use founder transit, undeployed-code prefunding, first-writer initialization, arbitrary rescue/signers or an unauthenticated replacement.

## B — authentic complete agent work

Public docs identify WorkRegistry as append-only receipts/reviews and expose seats, owners, panels, job results and launch reward snapshots. Oracle attestations can contain request/chain/question/block window and hash/panel/quorum/agreement/issued/expiry/signer fields; the example checks signer, quorum and expiry and binds chain/consumer in EIP-712.

These are building blocks, not the required FINCR witness. Sinopia #1942 shows two accepted nodes, one independent review, source/toolchain commitments and an admission result, but no complete accepted-agent set for a bounded precommitted scope/window/cutoff or destination-bound consent. Worker Fren job 3d7ff049-1447-4076-8e84-635c42acf5e0 is a completed unrelated image-selection job with launch.requested false and is never FINCR-eligible.

Missing proof: exact FINANCIER identifiers; complete membership boundary; finalized Ethereum receipt/state roots; identity namespace/adapter/controller; destination consent; expiry/revocation/ownership transfer; chain/vault/verifier/round/beneficiary policy; freshness/key rotation; replay and duplicate agent/controller/contribution exclusion. It must reject omission/truncation, pay zero for unverified/empty rounds, quarantine dust without jackpot rollover and keep claims independent.

Generic oracle signatures, Intake callbacks, NFT ownership, reputation, daily batches and RPC JSON are insufficient. The example even has an owner-settable oracle signer; that is not FINCR eligibility authority. A-001 conditional identity snapshots are not generic winner-selection authority. No team signer or repurposed quote signer is acceptable.

B verdict: NO-GO. Missing component: an authenticated, finalized, destination-bound complete-work-set witness (verifier/API plus policy). Do not deploy permanent reject-all; obtain the witness or stop rewards.

## C — limited architecture security

| Area | Classification and regression |
|---|---|
| Factory/deployer | Observed risk: factory controls deployment/registry. Test forwarder rejects noncanonical addresses and registry cannot record before custody. |
| Provenance substitution | Hypothesis: immutable forwarder must hash adapted source, compiler, args, creation/runtime/configuration, manifest, attestation and verifier policy; tamper each. |
| Wrong recipient/stranded reserve | Hypothesis: test canonical number/remainder, constructor failure, repeats and receiver revert. |
| Duplicate admission | Architecture risk: bind number plus canonical token/manifest commitment; simulate identical CREATE2 candidates. |
| Initializer capture | Hypothesis: attacker/factory/registry initializer calls, retries and resume must fail except frozen initializer. |
| Oracle/replay/finality | Observed risk/hypothesis: bind consumer, chain, request, finalized root, policy epoch, expiry and nonce; test stale, wrong domain, revoked, replayed and under-quorum inputs. |
| Incomplete set | Missing capability: authenticated cutoff/count/root; delete, duplicate and truncate one accepted agent; expect zero and quarantined dust. |

This is not a full contract audit. The protected tests do not exercise forwarder provenance, cross-chain completeness or work-set rules.

## Supported / proposed API matrix

| Capability | Status | FINCR conclusion |
|---|---|---|
| GET /requests/capabilities | Supported; live chain/pairing/quote data | Confirms 4663 + custom token + IMD; not custody precommit |
| POST /requests/check | Supported free blockers/plan/facts | Preflight only |
| quote/submit/status routes | Supported paid admission, expiry and retry | No pause/resume |
| GET /launch/policies | Supported version history | Not final FINCR authentication |
| GET /launches/:id and claims | Supported live/completed records | Post hoc; no transfer ordering proof |
| WorkRegistry/seats/job results | Supported append-only/read APIs | No complete-set witness found |
| Oracle attestation | Supported EIP-712 panel result | Insufficient unless a new FINCR verifier binds all fields |
| ReserveForwarder + factory pause/resume | Not found | Required new canonical capability |
| Complete FINCR agent-set witness | Not found | Required new verifier/policy capability |

## Alternatives, ranked

1. Best security/deadline: do not launch until canonical factory and verifier add both missing capabilities, then publish revisions/transactions and positive/tampered-negative fixtures. New trust: explicit protocol/factory upgrade authority only; no founder custody.
2. Lower security, only with explicit approval: protocol-owned immutable forwarder and protocol-controlled pause/resume plus finalized work verifier. New trust: forwarder/verifier maintainers and key rotation. Still fails until number binding and exact allocation are enforced.
3. Rejected: founder transit, undeployed prefunding, first-writer setup, arbitrary rescue/signers, generic oracle winner selection or unauthenticated replacement.

## Stop/go matrix and smallest engineering action

| Gate | Go | Stop |
|---|---|---|
| Final inputs | All final code/config/manifest/compiler/constructor/supply/artifacts committed | Any UNKNOWN or deployer-only provenance |
| Custody | Forwarder first, factory verifies, exact 50/10/40 before registry | Noncanonical receiver, factory records first, advisory pause |
| Resume | Same commitment/number/state | Changed source/config or replacement |
| Work | Complete set and finalized roots with consent/revocation/replay/duplicate negatives | Missing component, omission possible, generic signer, empty/unverified payout |
| Floor | All protected tests and owner check pass | Any token-flow, supply, control, bytecode or ownership failure |

Smallest engineering action: protocol-level (not FINCR-side) additions: a pre-execution commit binding number/token/forwarder/manifest and all final commitments; immutable ReserveForwarder constructor validation before remainder transfer; pause/resume only for the same commitment; and finalized complete-work verifier with authenticated set root, identity consent/revocation and duplicate/null-result rules. Publish ABI, policy revision, ordering, gas/failure, expiry/retry semantics and real positive/tampered-negative fixtures before GO.

## Primary evidence (revisions / blocks)

1. [IMD docs](https://imd.fun/docs/) — retrieved 2026-10-17; request/quote sections around lines 197–240, 341–428; custom-token economics around 468–480; deployment around 761–767; work/oracle/launch routes around 1631–1759 and addresses around 2073–2092.
2. [GET /requests/capabilities](https://api.imd.fun/requests/capabilities) — live response retrieved 2026-10-17; launch-1, TTL 600, chain 4663 custom_token/IMD and confirmations 2.
3. [GET /launch/policies](https://api.imd.fun/launch/policies) — live response retrieved 2026-10-17; 4663 custom_token policy version 36, pool floor 1000 bps and equal-connected rule.
4. [Sinopia #1942 API record](https://api.imd.fun/launches/60c0c715-ab5f-443c-9041-500301f8335d) — retrieved 2026-10-17; launch 1942, chain 4663, evm_contracts, source commit 2d7436e57e6e90f8e5288ed6976e4d2d9a38fd26, deployment block 89892607.
5. [Sinopia pinned commit](https://github.com/identity-md-launches/launch-1942-sinopia/commit/2d7436e57e6e90f8e5288ed6976e4d2d9a38fd26) — commit/tree 5a2817eae0e67c9b5ef32c71ca4e35f8478c4252; manifest says no token/pool/distributor/reward allocation.
6. [Sinopia threat model](https://raw.githubusercontent.com/identity-md-launches/launch-1942-sinopia/2d7436e57e6e90f8e5288ed6976e4d2d9a38fd26/docs/THREATS.md) — pinned commit; immutable addresses, Intake writer, refund/expiry and no-admin assumptions.
7. [Sinopia job](https://api.imd.fun/jobs/b539989d-3302-4e7c-be6e-3449554fec16) and [result](https://api.imd.fun/jobs/b539989d-3302-4e7c-be6e-3449554fec16/result) — retrieved 2026-10-17; review tx 0x5651c9ff047d30fd2ebcf6bd8f38b94c74e932088d8f38a689bfcfff14e71746, Ethereum block 26203526.
8. [Worker revision](https://github.com/Identity-md/worker/commit/35463c245898793f02941e9e28593f7122c47976) — commit 35463c245898793f02941e9e28593f7122c47976, source build c3fba9eb12cc425de300f7494bf9638431161182, retrieved 2026-10-17.
9. [Unrelated Worker Fren result](https://api.imd.fun/jobs/3d7ff049-1447-4076-8e84-635c42acf5e0/result) — retrieved 2026-10-17; completed image artifacts, launch.requested false, no FINCR binding.

## Unanswered questions

* What canonical component reserves a Robinhood launch number and freezes final adapted source, code, constructor, compiler, economics and verifier commitments before execution?
* What exact factory ABI enforces forwarder-before-remainder, pause, unchanged resume and permissionless forwarding while preventing duplicate admission?
* What public verifier/policy produces the complete accepted FINANCIER set, finalized roots, destination consent and negative omission/duplicate/replay/revocation behavior?
* What exact FINCR final inputs (supply, decimals, burn, cap, remainderTo, miner initializer, scope/window/cutoff) are authoritative?

Until these have attributable public answers and fixtures, STOP; do not ship a weaker launch or invented assurance.