{"assessments":[],"deployments":[],"fuzz":[],"identity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"interpretation":"Records acceptance and evidence. Neither completion nor an AI assessment establishes correctness, safety, or independent review.","jobId":"b16833e2-091b-48ac-a988-776cbe75b0a1","kind":"shape:chain","nodes":[{"acceptedSubmissionHash":"274a10ad09c8be6dd6a0f6e772305180aacfbb120bbf8b792b590fbffada3590","dependsOn":["audit_imported_code"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"2d7d84a1a9972f1497e5bc68a704cbf42294d08c62d2868f102ffe3b909b9b51","skillId":"adapt-contract-project","tools":[]},"key":"adapt_contract_project","kind":"code","role":"implement","skillHash":"2d7d84a1a9972f1497e5bc68a704cbf42294d08c62d2868f102ffe3b909b9b51","skillId":"adapt-contract-project","state":"failed"},{"acceptedSubmissionHash":"13d5534611477670c592d04747b429c91a3a055197c55eb3f4a65d0d13f88c8d","dependsOn":["adapt_contract_project","write_foundry_tests","gas_and_size_report","manifest"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_economics","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"8468bbda40ce929c49a79771acb8d6232af34b92bed556b5e2549fe0d4fca514","dependsOn":["adapt_contract_project","write_foundry_tests","gas_and_size_report","manifest"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_flow","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"8f3ec3c57e5a8e5d219fbd0d568f1487079573ea7936bc1577ed5a89da95ced8","dependsOn":[],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"9897597976b0e72440db7ca402d225aea20f3d37205ba53e7df2400ff80f29cc","skillId":"audit-imported-code","tools":[]},"key":"audit_imported_code","kind":"code","role":"review","skillHash":"9897597976b0e72440db7ca402d225aea20f3d37205ba53e7df2400ff80f29cc","skillId":"audit-imported-code","state":"accepted"},{"acceptedSubmissionHash":"9edabe41f16302eebba4c12fde1a5716063176c89bcf8354d8c9959a21a0265d","dependsOn":["adapt_contract_project","write_foundry_tests","gas_and_size_report","manifest","audit_math","audit_permissions","audit_economics","audit_flow"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"af3aa01159bbf354f621cafa5c0006f6169e0938a8b015be508b7377dbf165bc","skillId":"audit-judge","tools":[]},"key":"audit_judge","kind":"code","role":"review","skillHash":"af3aa01159bbf354f621cafa5c0006f6169e0938a8b015be508b7377dbf165bc","skillId":"audit-judge","state":"waiting"},{"acceptedSubmissionHash":"a4190797fdd1b32d70d7efcb9279066a5fdc19cb28aafc9577a878026e8e99bc","dependsOn":["adapt_contract_project","write_foundry_tests","gas_and_size_report","manifest"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_math","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"0036f20543cf3053edda66e238e72699b52d18ebcf90d0a4909e8ebcca17d88b","dependsOn":["adapt_contract_project","write_foundry_tests","gas_and_size_report","manifest"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_permissions","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"95bd8ba51c0d5eca1ee33a13a227dc1d7b110a0c705d49935fdbb984b9eb04e1","dependsOn":["write_foundry_tests"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"30969efdf166eb4a7d01a215c4655adeac1cd303dea3ef1c3ba1fc75789474d4","skillId":"gas-and-size-report","tools":[]},"key":"gas_and_size_report","kind":"code","role":"tests","skillHash":"30969efdf166eb4a7d01a215c4655adeac1cd303dea3ef1c3ba1fc75789474d4","skillId":"gas-and-size-report","state":"waiting"},{"acceptedSubmissionHash":"9107b6169f4814d6e8e36499e5b4929fbb90f8472b977314a78da082f7999103","dependsOn":["audit_imported_code","adapt_contract_project","write_foundry_tests","gas_and_size_report"],"execution":{"network":false,"profile":"foundry","requires":[],"tools":[]},"key":"manifest","kind":"code","role":"integrate","skillHash":null,"skillId":null,"state":"waiting"},{"acceptedSubmissionHash":"bb0b0de80dc17102d04ac8174afb58a3fc2458a066ee4d7998bd67688bd11cb3","dependsOn":["adapt_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"4c76766b00591dfe982fe85d3de589fdb2f810e5137c301155d1c5e36a1d3b23","skillId":"write-foundry-tests","tools":[]},"key":"write_foundry_tests","kind":"code","role":"tests","skillHash":"4c76766b00591dfe982fe85d3de589fdb2f810e5137c301155d1c5e36a1d3b23","skillId":"write-foundry-tests","state":"waiting"}],"objective":"Launch the SECOND Quorum Compatibility Probe test on Ethereum mainnet, paired with IMD. This is not the production DAO launch. Use the exact pinned source and newly verified immutable core-creation package in PREREQUISITES.json; reuse the unchanged English constitution. Stop if prerequisites are not VERIFIED_DEPLOYED. Preserve immutable governance, fixed stake 62,500, one staking address per seat, unlimited seats, original/reward/purchased quotas, 3% IMD buy/sell tax, 50/50 accounting, work/allowance/suspension rules and factory-only new LP. The zero-argument token fixes both dependencies. Hook creates the actual core during official factory launch; no admin, proxy or mutable binding. Before handing work to manifest integration, verify getHookPermissions() returns exactly beforeInitialize, beforeAddLiquidity, beforeSwap, afterSwap (0x28c0), matching the manifest and address bits; do not defer missing Solidity interfaces to a launch.json-only worker. Run every test under the default test root including all 26 mandatory cases in ACCEPTANCE.json; no skips or weakened assertions. Validate approved governance buy/sell through the real pool, tax income during operating execution, unused-budget refunds, both-asset fees and ordinary service-failure rollback/retry. Verify package creation bytes against compiled core and constitution hash. Use current official opening policy and 90% pool/10% swarm, no founder allocation. Demonstrate real transaction gas under 16,777,216, initcode under 49,152 and runtimes under 24,576; a multi-week test harness gas allowance is not a transaction-cap waiver. Core changes require a newly reviewed package, never silently change immutable dependencies. Perform final actual chain bindings/registry checks; disclose payer-to-Hook future-fee handover if needed. No frontend, ENS, bots, recurring services or production release. A code publication alone is not acceptance.","parentJobId":null,"planHash":"0b5b6cbfe3938b0ba0bc75f3141fc2f080b1acb3f0f03bb7017277452555a6c9","previousHash":"0000000000000000000000000000000000000000000000000000000000000000","projectId":"b16833e2-091b-48ac-a988-776cbe75b0a1","publication":{"commit":null,"deliveredAt":null,"repoUrl":"https://github.com/identity-md-launches/launch-2270-launch-second-quorum-compatibility"},"receiptIdentity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"registry":"0xb6d0a187b050fa5bb0b87033a203f37becf4a775","research":[],"schema":"identitymd-work-v1","signals":[{"agentId":"52188","feedbackHash":"0e8738a09aa6f0c3e6e922154a6400508e3e15396bcbd95e7dbdc95ed2afd3f2","nodeKey":"adapt_contract_project","submissionHash":"09196c158f3cabca94115b4b7ef7d4059b67be7c396313b77c275f66f3d20a19","tag1":"verification:checks","tag2":"acceptance-v2","value":0},{"agentId":"50988","feedbackHash":"ba54f9abcbedcd427f27a6fa358598135d7f95976a564b98baa46d1aabb7cb6a","nodeKey":"adapt_contract_project","submissionHash":"274a10ad09c8be6dd6a0f6e772305180aacfbb120bbf8b792b590fbffada3590","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"51538","feedbackHash":"1ea5ef27354d6e7b8dd29b3f65ab11c7c6b3dcdc45b353da96fa1222102313bf","nodeKey":"audit_economics","submissionHash":"13d5534611477670c592d04747b429c91a3a055197c55eb3f4a65d0d13f88c8d","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"54233","feedbackHash":"86fe2b1cc39b3931670b24359f2fbc2f0597401d62ab98161925a1dfa2d395e8","nodeKey":"audit_flow","submissionHash":"8468bbda40ce929c49a79771acb8d6232af34b92bed556b5e2549fe0d4fca514","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52673","feedbackHash":"3821d5debf8fd1cc449cfcfd44519be6239ce3ce83c6805d1909f67f00b9171f","nodeKey":"audit_imported_code","submissionHash":"8f3ec3c57e5a8e5d219fbd0d568f1487079573ea7936bc1577ed5a89da95ced8","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52671","feedbackHash":"17e8eec14334798b654a19019c8f7b90da4fbada798f73795b4f8058a8e30264","nodeKey":"audit_judge","submissionHash":"9edabe41f16302eebba4c12fde1a5716063176c89bcf8354d8c9959a21a0265d","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51442","feedbackHash":"f4318a4a443916c9754904b11c721a981c889637169da51138d3768001f7602f","nodeKey":"audit_math","submissionHash":"a4190797fdd1b32d70d7efcb9279066a5fdc19cb28aafc9577a878026e8e99bc","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52676","feedbackHash":"64342b30059abb180efe3f8551d9986ab2d4fa63bd043eb1d6e975139c8a6df3","nodeKey":"audit_permissions","submissionHash":"0036f20543cf3053edda66e238e72699b52d18ebcf90d0a4909e8ebcca17d88b","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51728","feedbackHash":"506cda7249b85c17569bd357535294f9fd788060c88145095e91c17ae96379a9","nodeKey":"gas_and_size_report","submissionHash":"95bd8ba51c0d5eca1ee33a13a227dc1d7b110a0c705d49935fdbb984b9eb04e1","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"51174","feedbackHash":"dd43eb40ffbdbec78bb9912f2cbc92f3933288be81fe7a101932c02ba1b9ba21","nodeKey":"manifest","submissionHash":"9107b6169f4814d6e8e36499e5b4929fbb90f8472b977314a78da082f7999103","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"50986","feedbackHash":"a0483d566184e9bc13e77f8f4c90104cbdfba64295a5440b50544527654fa5da","nodeKey":"write_foundry_tests","submissionHash":"bb0b0de80dc17102d04ac8174afb58a3fc2458a066ee4d7998bd67688bd11cb3","tag1":"verification:checks","tag2":"acceptance-v2","value":1}],"site":null,"snapshotHash":"d3a00e89ea2ce45b2594e9f9a89245636efe4f6ee720d166693771d64ecb3b7e","state":"blocked","submissions":[{"artifacts":[],"attempt":1,"bundleHash":null,"device":"970da38f1d564250","findings":[],"hash":"0036f20543cf3053edda66e238e72699b52d18ebcf90d0a4909e8ebcca17d88b","nodeId":"52cf2294-5bf2-43ca-a336-fa7e40bd4a32","outcome":"completed","summary":"I found no permission defect I could reproduce, so `.imd-findings.json` has an empty findings list. It also has a coverage row for all 76 entry points: 61 `holds` and 15 `unreached`. I changed no files and wrote no Foundry proofs, since there was nothing to prove.\n\n**What I traced** (Access Control, Trust Gap and Asymmetry):\n- **`QuorumIssuanceHook`:**\n - `getHookPermissions()` sets exactly beforeInitialize, beforeAddLiquidity, beforeSwap and afterSwap. The constructor checks the hook's address bits against that same list, and `launch.json` lists the same four.\n - Every callback accepts calls only from the PoolManager and enforces this pair with fee 12500 and tick spacing 60.\n - Only the factory that deployed the hook can initialize the pool (once) or add liquidity.\n - Swaps must come through the hook's own router with a trader set.\n - `rewardPaid` accepts calls only from the treasury.\n - `collectPlatformFees` checks the factory's registry record and that the fee requester is the hook itself.\n- **`QuorumCoreCode.create`:** anyone can call it, but each new core's reward reporter is whoever called it, and the hook refuses any core whose reporter isn't the hook. The creation bytes are re-hashed on every call.\n- **`QuorumSwapRouter`:** the callback accepts only the PoolManager during an active trade. The trader is always `msg.sender`, there is a reentrancy flag, and both the 3% tax and the price bounds are checked.\n- **`QuorumTreasury`:**\n - Every function that moves funds can only be called by `QuorumWork`.\n - Operating plans can only spend operating funds.\n - Income received while a plan runs is still split 50/50, and only the operating account can send it ETH.\n- **`QuorumOperatingAccount`:** only the treasury can call it. Calls to the two tokens are limited to `transfer`, approvals are cleared afterwards, and leftover balances go back to the treasury.\n- **`QuotaPrototype`:** every write function can only be called by the hook.\n- **`QuorumMembership` and `QuorumWork`:** the seat, agent and owner checks, plan-hash commitment, exclusion of targets and beneficiaries from voting, and ballot approval all hold.\n\n**Leads I checked and dropped:**\n- Treasury-held QPROBE can't be sold through the pool, because only purchased amounts carry a sell allowance. The design intends this and a test documents it.\n- An operating plan can deposit its own budget back as revenue. That only happens through a plan governance approved.\n\n**Not reached (15 rows):** `AuthenticatedRouterPrototype`, `RestrictedPoolPrototype`, `WorkCyclePrototype` and the `LocalToken`/`LocalSeats` fixtures. None of them is part of the launch the hook builds.\n\n**Not checked:** I didn't run the test suite, and I didn't check the factory's liquidity path, i.e. that the `sender` the hook sees when liquidity is added really is the factory. That needs the official factory's code or the mainnet chain, so a later check against the deployed contracts should confirm it.","treeHash":null,"usage":{"cachedInputTokens":470398,"inputTokens":18,"model":"claude-opus-5-5","outputTokens":8797,"runtime":"claude","turns":9,"wallClockMs":102295}},{"artifacts":[],"attempt":1,"bundleHash":"6fb4d3cfb12a5457eb3df3757697e2b847ebe1e834cce8bc864a06689c1e2397","device":"d4b53d656a3fbe07","findings":[],"hash":"09196c158f3cabca94115b4b7ef7d4059b67be7c396313b77c275f66f3d20a19","nodeId":"70507d0d-5227-4081-982f-c1d2b451083e","outcome":"completed","summary":"The revision is complete. The high finding reproduced and is fixed in the Core, which forces a new code package before this launch can proceed. The three advisory findings and the earlier audit items are answered in `.imd-responses.json`.\n\n**What reproduced and what I changed**\n\n- **Finding d4c39603 (high), fixed.** The reviewer's proof failed on the starting tree exactly as reported. `proposeOperation` let the proposer strike any seat by naming it as a beneficiary, call target or approval spender, and the two-thirds threshold then shrank with the electorate. In `src/QuorumWork.sol` such proposer-declared seats now stay in the electorate the threshold is computed from, while they still cannot vote. In the proof's scenario the threshold is six of nine instead of four of five, execution reverts, and the treasury keeps its funds. The proof passes, all 26 mandatory cases pass unchanged, and a new regression suite with three cases covers struck seats, a legitimately disclosed member beneficiary, and seat call targets and spenders.\n- **The three advisory findings** are confirmed by reading but disputed as design: the operating account's full return to operations is constitution line 54, direct transfers to the treasury are not income by design, and batched week settlement is the constitution's bounded settlement. None of them was changed.\n\n**The consequence I had to report rather than hide**\n\n`QuorumWork` is created inside the Core, so the Core's creation bytes changed. The immutable package already deployed on mainnet now carries the vulnerable bytes and must not launch. Following the brief's rule that core changes need a newly reviewed package, the prerequisites file is set to a non-deployed status with submission disallowed, the superseded package is recorded, and the submission gate now fails closed on four named checks, including a check that the token is not bound to the superseded package. The token still names that package only because the revised one has no address yet and a stand-in is forbidden.\n\n| Core creation | Superseded package | Revised tree |\n| --- | --- | --- |\n| bytes | 39,860 | 40,001 |\n| keccak256 | 0x3bd4bffb… | 0x3b42bdba… |\n\n**Verification run on this machine**\n\n- `forge build` and `forge test` with the verifier's fuzz seed: 45 tests in the tree pass plus the proof copy, no skips.\n- The project's local gate passes. The submission gate fails by design with the four documented blockers.\n- The acceptance runner confirms all 35 mandatory and supplementary cases ran and passed.\n\n**What the requester must do next**\n\nApprove the revised Core, deploy a new `QuorumCoreCode` package from the compiled creation bytes on Ethereum, verify it, bind its address in `src/QProbeToken.sol`, and set the prerequisites file back to verified. The hook, token constants, constitution, 0x28c0 permissions and pool terms are unchanged. The payer-to-Hook fee handover after launch still applies as documented.","treeHash":"54c3717ad80c204471943e63f90055817e106ea6","usage":{"cachedInputTokens":4512583,"inputTokens":1314,"model":"claude-fable-5-1","outputTokens":47135,"runtime":"claude","turns":42,"wallClockMs":866825}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"b57ae3a96321a0e1","findings":[{"citation":"resolved","description":"proposeOperation lets the applicant pass up to 32 arbitrary 'beneficiaries' (plus 16 call targets and 16 approval spenders); every address in those lists is written to recused[id] with no check that it benefits from the plan, that it consents, or that the plan touches it. entryEligible (src/QuorumWork.sol:212) then removes every enrollment whose owner or agent appears there from the ballot before it is assembled, and threshold (line 225) is ceil(2/3) of the *assembled* electorate while _approved only requires voters>=5. The constitution's recusal rule exists so that interested seats cannot vote; here it becomes a lever by which the proposer picks who may vote. With N qualified seats, a proposer plus four allied seats (5 x 62,500 fixed stake, all refundable) declares every other seat except one as a beneficiary (up to 64 exclusions, so any DAO of up to ~70 members), leaves exactly 5 voters, casts 4 yes votes (threshold (5*2+2)/3 = 4) and executes a plan whose only call is a token transfer of the whole IMD and project operatingFunds (and ETH budget) to an outside wallet. Without the false declaration the same 4 yes votes among 9 voters fail (threshold 6). This violates 'Governance spends operations funds only' under ceil(2*electorate/3) approval and 'Quorum never silently decreases': the quorum is decreased by the proposer, silently, before assembly. Loss: all operatingFunds in both assets and operatingNative; protected pools are not reachable. Call targets are an equally free lever: a call to an EOA with empty calldata succeeds, so 16 more honest seats can be struck out that way. Minimal fix that preserves the design: compute threshold and the five-seat minimum from the full qualified count of the ballot's week (recused seats still count in the denominator and cannot vote), or alternatively require declared beneficiaries to appear in the plan (approval spender / call target / transfer recipient) and cap the number of seats a proposal may recuse relative to sourceCount.","line":178,"path":"src/QuorumWork.sol","proof":"// SPDX-License-Identifier: MIT\npragma solidity 0.8.28;\n// Proof for: an operation proposer shrinks the electorate by declaring honest voters as\n// \"beneficiaries\" (QuorumWork.proposeOperation -> recused[id][addr]) and passes a treasury\n// draining plan with 4 colluding yes votes out of 10 qualified members.\n// This tree ships no forge-std, so the cheat-code interface is declared inline, as the\n// repository's own tests do.\nimport {QuorumLocalSystem} from \"src/QuorumLocalSystem.sol\";\nimport {QuorumMembership, IERC20Local} from \"src/QuorumMembership.sol\";\nimport {QuorumTreasury} from \"src/QuorumTreasury.sol\";\nimport {QuorumWork} from \"src/QuorumWork.sol\";\nimport {LocalToken} from \"src/LocalFixtures.sol\";\nimport {QuorumCodeCatalog} from \"src/QuorumCodeCatalog.sol\";\nimport {OperatingPlan, OperatingApproval, OperatingCall} from \"src/QuorumOperatingAccount.sol\";\n\ninterface ScratchVm {\n function prank(address) external;\n function warp(uint256) external;\n function roll(uint256) external;\n function setBlockhash(uint256, bytes32) external;\n function readFile(string calldata) external view returns (string memory);\n}\n\ncontract RecusalCaptureTest {\n ScratchVm constant vm = ScratchVm(address(uint160(uint256(keccak256(\"hevm cheat code\")))));\n uint256 constant MEMBERS = 10;\n address constant ATTACKER_WALLET = address(0xBAD);\n QuorumLocalSystem system;\n QuorumMembership members;\n QuorumTreasury funds;\n QuorumWork work;\n LocalToken stake;\n LocalToken income;\n uint256 initialWeek;\n address[MEMBERS] owners;\n address[MEMBERS] agents;\n\n function setUp() public {\n vm.warp(4 days + 100 weeks + 1 days);\n vm.roll(10);\n stake = new LocalToken();\n income = new LocalToken();\n system = new QuorumLocalSystem(\n IERC20Local(address(stake)), IERC20Local(address(income)), 62_500 ether,\n bytes(vm.readFile(\"constitution.en.md\")), new QuorumCodeCatalog()\n );\n members = system.membership();\n funds = system.treasury();\n work = system.work();\n initialWeek = members.currentWeek();\n for (uint256 i; i < MEMBERS; ++i) {\n owners[i] = address(uint160(0x1000 + i));\n agents[i] = address(uint160(0x2000 + i));\n stake.mint(owners[i], 62_500 ether);\n vm.prank(owners[i]);\n stake.approve(address(members), 62_500 ether);\n vm.prank(owners[i]);\n members.authorize(agents[i], block.timestamp + 365 days);\n bytes32 digest = members.constitutionHash();\n vm.prank(agents[i]);\n require(members.accept(owners[i], 1, digest) == i, \"enrollment id\");\n }\n income.mint(address(this), 1000 ether);\n income.approve(address(funds), 1000 ether);\n funds.depositRevenue(1000 ether); // 500 allowances, 500 operations\n }\n\n function tick() internal {\n vm.roll(block.number + 1);\n bytes32 anchor = keccak256(abi.encode(block.number - 1));\n vm.setBlockhash(block.number - 1, anchor);\n uint256 week = members.currentWeek();\n uint256 hour = (block.timestamp - members.weekStart(week)) / 1 hours;\n for (uint256 i; i < MEMBERS; ++i) {\n if (members.live(i) && members.hourBitmap(i, week) & (uint256(1) << hour) == 0) {\n uint256 revision = system.agendaRevision();\n vm.prank(agents[i]);\n members.respond(i, block.number - 1, anchor, revision, \"checked agenda\");\n if (hour == 125) {\n vm.prank(agents[i]);\n members.report(i, \"weekly report\");\n }\n }\n }\n }\n\n function maintainUntil(uint256 target) internal {\n uint256 next = (block.timestamp / 1 hours + 1) * 1 hours;\n while (next <= target) {\n vm.warp(next);\n uint256 week = members.currentWeek();\n if (week > initialWeek && !funds.settled(week - 1)) {\n while (!funds.settled(week - 1)) funds.settleWeek(week - 1, 32);\n }\n tick();\n next += 1 hours;\n }\n vm.warp(target);\n }\n\n /// Five colluding seats (proposer 0 and voters 1..4) out of ten qualified members must not be\n /// able to move the whole IMD operating balance to an outside wallet. Expected: the operation\n /// is refused at proposal, assembly or execution, and the treasury keeps its operating funds.\n function testFalseBeneficiaryDeclarationCannotCaptureOperatingFunds() public {\n maintainUntil(members.weekStart(initialWeek + 2));\n require(funds.qualifiedCount(initialWeek + 1) == MEMBERS, \"all ten qualified\");\n uint256 operating = funds.operatingFunds();\n require(operating == 500 ether, \"operating budget\");\n\n OperatingPlan memory p;\n p.primaryBudget = operating;\n p.approvals = new OperatingApproval[](0);\n p.calls = new OperatingCall[](1);\n p.calls[0] = OperatingCall(\n address(income), 0, abi.encodeCall(IERC20Local.transfer, (ATTACKER_WALLET, operating)), bytes32(0)\n );\n // Honest seats 6..9 are falsely declared as beneficiaries; seat 5 is left in so that the\n // electorate still has five voters. Seats 1..4 collude with the proposer (seat 0).\n address[] memory declared = new address[](4);\n for (uint256 i; i < 4; ++i) declared[i] = owners[6 + i];\n\n vm.prank(agents[0]);\n (bool proposed, bytes memory ret) = address(work).call(\n abi.encodeCall(QuorumWork.proposeOperation, (0, p, declared, \"Pay an outside contractor\"))\n );\n if (proposed) {\n uint256 id = abi.decode(ret, (uint256));\n (bool assembled,) = address(work).call(abi.encodeCall(QuorumWork.prepareBallot, (id, 32)));\n if (assembled) {\n QuorumWork.Ballot memory b = work.ballot(work.work(id).ballot);\n // Nine seats other than the proposer are qualified; four honest ones were struck out.\n // Allies 1..4 vote yes; every honest seat still eligible votes no. Votes a fixed\n // implementation may refuse are ignored: only the end state is asserted.\n for (uint256 i = 1; i < MEMBERS; ++i) {\n if (!work.eligible(work.work(id).ballot, i)) continue;\n vm.prank(agents[i]);\n address(work).call(abi.encodeCall(QuorumWork.vote, (id, i, i <= 4)));\n }\n maintainUntil(b.started + 120 hours);\n (bool executed,) = address(work).call(abi.encodeCall(QuorumWork.executeOperation, (id, p)));\n require(!executed, \"four colluding votes out of ten qualified seats executed the plan\");\n }\n }\n require(income.balanceOf(ATTACKER_WALLET) == 0, \"operating funds captured by minority\");\n require(funds.operatingFunds() == operating, \"operating funds moved\");\n }\n}","reproduction":"State: 10 enrolled seats (owners 0x1000..0x1009, agents 0x2000..0x2009) all qualified for week W-1 and settled; treasury operatingFunds (IMD) = 500e18. Calls: (1) agent0: proposeOperation(0, plan{primaryBudget:500e18, calls:[income.transfer(0xBAD,500e18)]}, beneficiaries=[owners 6,7,8,9], 'Pay an outside contractor'). (2) prepareBallot(id,32) -> ballot.voters == 5 (seats 1..5; 6..9 excluded although the plan never touches them). (3) agents 1..4 vote yes, agent5 votes no. (4) warp started+120h; executeOperation(id, plan) succeeds. Actual: income.balanceOf(0xBAD)==500e18 and operatingFunds()==0 with 4 yes votes out of 10 qualified seats. Expected: the plan needs ceil(2*9/3)=6 yes votes among the nine non-applicant qualified seats, so execution reverts with 'approval' and operatingFunds stays 500e18. Proof test: test/scratch/RecusalCapture.t.sol (fails now with 'four colluding votes out of ten qualified seats executed the plan').","severity":"high","snippet":" for(uint256 i;i execute() runs a harmless call -> _returnAsset reads balanceOf = 100e18 (the stray tokens) -> transfers 100e18 to treasury -> executeOperating adds 100e18 to p.operatingFunds; allowancePool and scheduledAsset are unchanged.","line":42,"path":"src/QuorumOperatingAccount.sol","reproduction":"State: launched system (ImdFactoryPositive setUp), 7 qualified members, treasury.operatingFunds()=X, allowancePool()=A. 1) imd.mint(attacker,100e18); vm.prank(attacker); imd.transfer(address(treasury.operatingAccount()),100e18). 2) Propose and approve any operating plan with primaryBudget=0, projectBudget=0, nativeBudget=0, approvals=[], calls=[{target: NormalOperationService, data: confirm()}]; vote 4 yes of 6; warp 120h. 3) work.executeOperation(id,plan). Expected (per the 50/50 rule applied to every other receipt): operatingFunds = X+50e18, allowancePool = A+50e18, scheduled(currentWeek+1) += 50e18. Actual: operatingFunds = X+100e18, allowancePool = A, scheduled unchanged; OperatingExecuted(0,0,0) is emitted and no Income event is emitted for the 100e18. The same 100e18 sent to the hook and flushed would have produced Income(...,100e18,...,50e18).","severity":"low","snippet":" amount=IERC20Local(asset).balanceOf(address(this));\n if(amount>0)require(IERC20Local(asset).transfer(treasury,amount),\"return funds\");","title":"Operating-account refund sweep returns stray balances as operating funds, bypassing the 50/50 income split"},{"citation":"resolved","description":"The treasury's five ledger buckets are the only spendable balances; every outward path (claimAllowance, pay, executeOperating) decrements a bucket before transferring. _deposit is the only function that increments buckets and it books exactly `amount` pulled by transferFrom from msg.sender (line 74-77). There is no function that reconciles token balance against accountedAssetBalance, so any supported-asset tokens that arrive by plain transfer are frozen forever: they are not allowance, not operating funds, and no entry point can move them. This is reachable from inside the protocol, not only by mistaken senders: QuorumWork.propose accepts recipient=address(treasury) (only recipient!=0 is checked, src/QuorumWork.sol:121), and _pay then does a self-transfer `IERC20Local(a).transfer(recipient,amount)` (line 132) which succeeds, decrements earnedWork and leaves the balance unchanged, so the whole work budget becomes dead balance; an approved operating call `imd.transfer(treasury,X)` (allowed by the 'token transfer only' guard) does the same.","line":65,"path":"src/QuorumTreasury.sol","reproduction":"State: launched system with treasury IMD balance == accountedBalance() == B. Input A: any EOA calls imd.transfer(address(treasury), 1e18). Afterwards imd.balanceOf(treasury) == B+1e18 while accountedBalance() == B; no call sequence (depositRevenue reverts 'exact receipt' for a different amount and cannot pull from the treasury's own balance; claimAllowance/pay/executeOperating only spend buckets) ever makes the 1e18 spendable. Input B (protocol path): with the budget vote machinery of GovernancePositive, call work.propose(applicant, worker, recipient=address(core.treasury()), budget=10e18, deadline, terms); assemble, approve, fund, submit, approve acceptance, accept, claim. Expected: a payment to a fixed recipient or a revert for a self-recipient. Actual: claim succeeds, Paid(id, treasury, 10e18) is emitted, earnedWork drops by 10e18, treasury balance is unchanged and accountedBalance() is now 10e18 below balanceOf; the 10e18 is unrecoverable by any entry point.","severity":"low","snippet":" function accountedAssetBalance(address a) public view returns(uint256) {\n Ledger storage l=ledgers[a];return l.allowancePool+l.earnedAllowances+l.operatingFunds+l.reservedWork+l.earnedWork;\n }","title":"Tokens that reach QuorumTreasury outside _deposit are permanently unaccounted and unrecoverable"},{"citation":"resolved","description":"Each week's settlement snapshots rosterLimit = membership.enrollmentCount() and iterates ids 0..rosterLimit-1 (lines 93-96), calling membership.registeredAtStart and membership.qualified (which itself calls agenda.isSuspended -> work.isSuspended) for every id. enrollmentCount only grows: every key rotation (authorize+accept) and every exit creates or orphans an id that is still scanned forever, 32 ids per transaction (limit<=32). QuorumWork._newBallot (src/QuorumWork.sol:96-97) requires the preceding week to be settled, so no work, operation or suspension can be proposed and no delivery can be submitted until the full scan completes, every week, for the life of the DAO. A single 62,500-token stake can be recycled (accept -> requestExit -> wait 7 days -> withdraw -> authorize/accept from a fresh address) to add one permanent id per cycle at gas cost only, and ordinary churn does the same honestly. This is the Periphery guide's 'loop whose worst-case gas bricks critical protocol functions': there is no pruning of ended/exited ids and no per-week registration list.","line":89,"path":"src/QuorumTreasury.sol","reproduction":"State: enrollmentCount = E after churn (e.g. E = 100,000 reached by cycling the same stake through fresh addresses, or by years of ordinary rotation/exit). Input: at the start of any week W+1, anyone must call treasury.settleWeek(W, 32) until weekInfo(W).done; that is ceil(E/32) = 3,125 separate transactions for E=100,000, each doing 32 x (2 external view calls into membership, one of which calls back into work) before any proposal, operation, suspension or delivery for week W+1 can be created (QuorumWork._newBallot reverts 'settle preceding week' until then). Expected: settlement cost bounded by the active roster for the week. Actual: cost proportional to all ids ever issued, including ids whose endWeek < W or stake == 0, and it must be paid again every week. Measured on the launched fixture (GovernancePoolPositive setup, 7 live seats plus 57 enrollments that accepted and immediately requested exit, enrollmentCount=64): settleWeek(week,32) costs 578,079 gas for the first batch and 476,435 gas for the second, i.e. about 14,900 gas per id, exited ids included. So E=1,000 already needs 32 transactions and about 15M gas every week; E=100,000 needs 3,125 transactions and about 1.5 billion gas every week before any ballot can be created.","severity":"low","snippet":" w.started=true;w.rosterLimit=membership.enrollmentCount();w.budget=scheduledAsset[address(asset)][week];","title":"settleWeek scans every enrollment id ever created; exited and rotated ids are never pruned, so weekly settlement cost grows without bound and gates all governance"}],"hash":"8468bbda40ce929c49a79771acb8d6232af34b92bed556b5e2549fe0d4fca514","nodeId":"8a5a8d77-59a0-467f-b0dc-31892178a9ab","outcome":"completed","summary":"Review complete. The findings file is written and validated, the scratch tests are removed, and the tree is otherwise unchanged.\n\n**Outcome.** The production control flow for the second Quorum Compatibility Probe launch holds up well under the Execution Trace, Periphery and First Principles checklists. I traced every state-changing entry point listed by the verifier, plus three invariants, and found no critical, high or medium defect. Three low-severity findings are recorded in `.imd-findings.json`, each with a concrete input or state, and the first two were confirmed by running scratch tests against the compiled system.\n\n**Findings.**\n- **Operating-account sweep bypasses the 50/50 split (low).** Any supported-asset balance already sitting on the persistent operating account is returned as an \"unused budget refund\" and booked 100% to operating funds. Confirmed: 100 IMD sent to the account before a no-op approved operation raised operatingFunds by exactly 100 IMD with zero allowance share.\n- **Direct transfers to the treasury are frozen forever (low).** No entry point reconciles balance against the ledger buckets. This is reachable from protocol paths too, since a work proposal may name the treasury itself as recipient and the resulting self-transfer silently drops the budget from earnedWork. Confirmed for the direct transfer case.\n- **Weekly settlement scans every enrollment id ever created (low).** Exited and rotated ids are never pruned and every ballot depends on the preceding week being settled. Measured about 14,900 gas per id and about 476k gas per batch of 32, so a roster history of 1,000 ids already costs 32 transactions each week.\n\n**Coverage.** All 78 listed entry points have rows, 74 marked holds and 4 pointing at the findings above, plus rows for the allowance-pool/scheduled-sum invariant, the once-only income split during operations, and the launch manifest's constructor-argument and 0x28c0 permission match. Nothing was left unreached. The hook callbacks, router settlement for both currency orders, treasury ledger math, work-cycle stage machine, suspension scheduling and membership key rotation were traced in depth. Prototype and local-fixture contracts were read and marked as non-launch surfaces.\n\n**What I could not do.** The full default test suite was not rerun end to end because the via-IR build alone took about 20 minutes of the budget; the 11 inherited pool and governance tests that my scratch suite pulled in all passed, and the factory launch measured 13,308,250 gas with an 18,154-byte hook initcode, consistent with the manifest's claims.","treeHash":null,"usage":{"cachedInputTokens":2867010,"inputTokens":706,"model":"claude-fable-5-1","outputTokens":62350,"runtime":"claude","turns":56,"wallClockMs":2827920}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"476778ae63dff113","findings":[{"citation":"resolved","description":"collectPlatformFees requires the factory's positionOf(launchNumber).requester to be the hook. In a real IMD launch the deployer sets requester to the payer/owner (e.g. mainnet launch 2176 had requester 0x92ce...90c4), not to the hook. The positive tests hide this because they set p.requester=factory.predictHook(...) at launch (test/compatibility/FixedTokenBindingPositive.t.sol:89), which the production deployer does not do. Until the payer calls LaunchFactory.setRequester(launchNumber, hook), the requester share of LP fees goes to the payer and does not reach the treasury. The 50/50 accounting of fee income is then not enforced by code.","line":82,"path":"src/QuorumIssuanceHook.sol","reproduction":"Run the FixedTokenBindingPositive setUp with p.requester=address(0xA11CE) (the payer) instead of the predicted hook, then call hook.collectPlatformFees(NUMBER). Expected: fees reach core.treasury(). Actual: it reverts with 'fee destination not bound'. factory.claimFees(NUMBER) still pays 0xA11CE. Fix or disclose: the payer must call setRequester(launchNumber, hook) after launch, and that handover must be shown in final chain checks.","severity":"medium","snippet":" require(recipient==address(this),\"fee destination not bound\");","title":"Platform-fee collection reverts unless the factory requester is handed over from the payer to the Hook"},{"citation":"resolved","description":"The manifest notes say 'New code-package deployment and token address binding are pending user approval. Do not submit or deploy this draft.' PREREQUISITES.json says VERIFIED_DEPLOYED, QProbeToken already binds 0xa4709b43..., and onchain creationHash() equals the compiled QuorumBoundCore hash. The notes are stale and contradict the launch they describe.","line":28,"path":"launch.json","reproduction":"Read launch.json notes and compare them with PREREQUISITES.json status VERIFIED_DEPLOYED and src/QProbeToken.sol:9. Expected: the notes describe the deployable candidate. Actual: the notes say not to deploy.","severity":"low","snippet":" \"notes\": \"LOCAL SECOND-TEST CANDIDATE ONLY. New code-package deployment and token address binding are pending user approval. Do not submit or deploy this draft. Preserve immutable constitution and all governance semantics. Hook permissions must match getHookPermissions() and 0x28c0. Production pool price must be derived from current official IMD policy and actual address order, not the placeholder initialPrice. Final external-code hashes and receipts must be verified before submission.\"","title":"launch.json notes forbid deployment and claim the package is still pending"},{"citation":"resolved","description":"requiredBeforeSubmission still lists deploying the new package and binding its address, plus a candidatePlaceholder 0x...c0de02. Meanwhile newDeploymentRequired=false. I verified independently that cast call 0xa4709b43...creationHash() on mainnet returns 0x3bd4bffb...6c0d. That equals keccak256 of the compiled QuorumBoundCore creation code (39,860 bytes). The constitution.en.md sha256 also equals bdcd5942...28d7, and both addresses have code. The deployment is done, so these list entries are stale. The remaining open items are explicit user approval and the official-policy/fee-handover check.","line":23,"path":"PREREQUISITES.json","reproduction":"Run jq .coreCode.newDeploymentRequired,.requiredBeforeSubmission PREREQUISITES.json. It returns false next to 'Deploy new package...'. Expected: consistent status.","severity":"info","snippet":" \"Deploy new package and verify chain=1 receipts, runtime and creation bytes\",","title":"PREREQUISITES.json keeps stale pre-deployment requirements alongside VERIFIED_DEPLOYED"}],"hash":"8f3ec3c57e5a8e5d219fbd0d568f1487079573ea7936bc1577ed5a89da95ced8","nodeId":"8e14ace3-8d2d-4dbb-b46a-8ceba42047e5","outcome":"completed","summary":"I found no high or critical defects. The one real launch problem is that platform fees can't reach the treasury until the payer hands their fee position over to the Hook. I wrote three findings to `.imd-findings.json` and changed no repository files. I did not deploy anything and am not claiming a deployment succeeded.\n\n**What checks out:**\n- **Tests:** all 36 tests under the default test root pass with no skips, including the 26 mandatory cases in `ACCEPTANCE.json`.\n- **Core package:** the compiled `QuorumBoundCore` creation code is 39,860 bytes and its keccak256 is `0x3bd4bffb…6c0d`. That matches `PREREQUISITES.json`. On mainnet, `creationHash()` at `0xa4709b43…` returns the same value.\n- **Constitution:** the sha256 of `constitution.en.md` matches the pinned `bdcd5942…28d7`. Code exists at the constitution and core-package addresses, and `QProbeToken` binds both with no constructor arguments.\n- **Hook permissions:** `getHookPermissions()` returns exactly beforeInitialize, beforeAddLiquidity, beforeSwap and afterSwap. That matches `launch.json`, and the hook's own constructor checks the address bits. `beforeInitialize` only accepts the factory, and the pool settings fit the policy: fee 12500, tick spacing 60, 90% to the pool.\n- **Size and gas:** the factory launch uses about 13.31M execution gas; adding calldata cost I estimate it stays under 16,777,216. Hook initcode is 18,090 bytes and token initcode 3,087, both under 49,152. Every runtime is under 24,576; the largest is the hook at 8,314.\n\n**Findings:**\n1. **Medium – fee collection reverts in a real launch.** `QuorumIssuanceHook.sol:82` requires the factory's fee recipient for the launch to be the Hook. A real launch sets it to the payer, so `collectPlatformFees` reverts and the payer keeps the fees. The tests hide this by setting the recipient to the predicted Hook at launch. The payer has to call `LaunchFactory.setRequester(launchNumber, hook)`, and the final chain checks need to confirm it.\n2. **Low – stale `launch.json` notes.** They still say \"Do not submit or deploy this draft\" and describe the package as pending, which contradicts `PREREQUISITES.json`.\n3. **Info – stale entries in `PREREQUISITES.json`.** It still lists \"Deploy new package…\" and a placeholder address while also saying no new deployment is required.\n\n**Read:** every file in `src/` (all 19 contracts; the hook, router, quota, core package, token and launch-proof contracts in depth). I also read all the tests, `launch.json`, `PREREQUISITES.json`, `ACCEPTANCE.json`, the evidence and policy fixtures, and the external factory ABIs.\n\n**Not reached:**\n- I skimmed `QuorumTreasury`, `QuorumWork` and `QuorumMembership` rather than auditing them line by line; the passing tests are what cover them.\n- I only had the external factory and pool manager as compiled ABIs and bytecode, not their source.\n- I did not confirm on chain that the current official launch policy is still version 34.","treeHash":null,"usage":{"cachedInputTokens":533300,"inputTokens":26,"model":"claude-opus-5-5","outputTokens":6677,"runtime":"claude","turns":13,"wallClockMs":173509}},{"artifacts":[],"attempt":1,"bundleHash":"2f217f6ed2ffa5c728a9185382c7093a8e095a42c385f8b3ea216388410e0647","device":"e89087c02a1681bf","findings":[],"hash":"9107b6169f4814d6e8e36499e5b4929fbb90f8472b977314a78da082f7999103","nodeId":"fc8a0e0d-79c5-4666-a08a-081479f3d895","outcome":"completed","summary":"Updated only `launch.json`; notes remain under 4,000 characters and document verification, audit findings and the required fee handover.\n\n- Manifest checks and `forge build` passed.\n- All 108 tests passed, including all 26 mandatory cases, with the supplied seed.\n- Mainnet dependency bytes matched; local launch replay used 13,365,876 gas.\n\nOfficial deployment, final live bindings/registry checks and payer-to-Hook fee handover remain pending.","treeHash":"c85fa88620c0197b7fcc799db942829d0e8ee88d","usage":{"cachedInputTokens":1211520,"inputTokens":90194,"model":"gpt-6-astra","outputTokens":9618,"runtime":"codex","turns":6,"wallClockMs":281823}},{"artifacts":[],"attempt":1,"bundleHash":"dbdaea96576b1e4c96a71807c713b6e4656b4ba8d61a1d92f15bcbdb8a074c82","device":"d6415252dcd668d9","findings":[],"hash":"95bd8ba51c0d5eca1ee33a13a227dc1d7b110a0c705d49935fdbb984b9eb04e1","nodeId":"b6a26f86-4125-4045-ab74-31617c8d2859","outcome":"completed","summary":"Created [reports/gas.md](reports/gas.md) and [.gas-snapshot](.gas-snapshot).\n\n- Build and all 108 test results pass, including all mandatory cases.\n- Full launch: **13,365,876 gas**; initcode and runtimes fit.\n- The 128-contributor variant exceeds the cap; final metadata and live-launch checks remain pending.\n\nCommit blocked: Git could not create `.git/index.lock` because `.git` is read-only.","treeHash":"2603cd9cef297dfea218966dd796777e9d747642","usage":{"cachedInputTokens":8425856,"inputTokens":204360,"model":"gpt-6-astra","outputTokens":53280,"runtime":"codex","turns":9,"wallClockMs":1427294}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"e293ff3324f7ddb5","findings":[{"citation":"resolved","description":"proposeOperation writes every caller-supplied beneficiary, call target and approval spender into recused[id] without checking the plan touches them; entryEligible drops those seats and threshold() is ceil(2/3) of the reduced voters count, with only voters>=5 required. Proposer chooses the electorate.","line":178,"path":"src/QuorumWork.sol","proof":"// SPDX-License-Identifier: MIT\npragma solidity 0.8.28;\n// Proof for: an operation proposer shrinks the electorate by declaring honest voters as\n// \"beneficiaries\" (QuorumWork.proposeOperation -> recused[id][addr]) and passes a treasury\n// draining plan with 4 colluding yes votes out of 10 qualified members.\n// This tree ships no forge-std, so the cheat-code interface is declared inline, as the\n// repository's own tests do.\nimport {QuorumLocalSystem} from \"src/QuorumLocalSystem.sol\";\nimport {QuorumMembership, IERC20Local} from \"src/QuorumMembership.sol\";\nimport {QuorumTreasury} from \"src/QuorumTreasury.sol\";\nimport {QuorumWork} from \"src/QuorumWork.sol\";\nimport {LocalToken} from \"src/LocalFixtures.sol\";\nimport {QuorumCodeCatalog} from \"src/QuorumCodeCatalog.sol\";\nimport {OperatingPlan, OperatingApproval, OperatingCall} from \"src/QuorumOperatingAccount.sol\";\n\ninterface ScratchVm {\n function prank(address) external;\n function warp(uint256) external;\n function roll(uint256) external;\n function setBlockhash(uint256, bytes32) external;\n function readFile(string calldata) external view returns (string memory);\n}\n\ncontract RecusalCaptureTest {\n ScratchVm constant vm = ScratchVm(address(uint160(uint256(keccak256(\"hevm cheat code\")))));\n uint256 constant MEMBERS = 10;\n address constant ATTACKER_WALLET = address(0xBAD);\n QuorumLocalSystem system;\n QuorumMembership members;\n QuorumTreasury funds;\n QuorumWork work;\n LocalToken stake;\n LocalToken income;\n uint256 initialWeek;\n address[MEMBERS] owners;\n address[MEMBERS] agents;\n\n function setUp() public {\n vm.warp(4 days + 100 weeks + 1 days);\n vm.roll(10);\n stake = new LocalToken();\n income = new LocalToken();\n system = new QuorumLocalSystem(\n IERC20Local(address(stake)), IERC20Local(address(income)), 62_500 ether,\n bytes(vm.readFile(\"constitution.en.md\")), new QuorumCodeCatalog()\n );\n members = system.membership();\n funds = system.treasury();\n work = system.work();\n initialWeek = members.currentWeek();\n for (uint256 i; i < MEMBERS; ++i) {\n owners[i] = address(uint160(0x1000 + i));\n agents[i] = address(uint160(0x2000 + i));\n stake.mint(owners[i], 62_500 ether);\n vm.prank(owners[i]);\n stake.approve(address(members), 62_500 ether);\n vm.prank(owners[i]);\n members.authorize(agents[i], block.timestamp + 365 days);\n bytes32 digest = members.constitutionHash();\n vm.prank(agents[i]);\n require(members.accept(owners[i], 1, digest) == i, \"enrollment id\");\n }\n income.mint(address(this), 1000 ether);\n income.approve(address(funds), 1000 ether);\n funds.depositRevenue(1000 ether); // 500 allowances, 500 operations\n }\n\n function tick() internal {\n vm.roll(block.number + 1);\n bytes32 anchor = keccak256(abi.encode(block.number - 1));\n vm.setBlockhash(block.number - 1, anchor);\n uint256 week = members.currentWeek();\n uint256 hour = (block.timestamp - members.weekStart(week)) / 1 hours;\n for (uint256 i; i < MEMBERS; ++i) {\n if (members.live(i) && members.hourBitmap(i, week) & (uint256(1) << hour) == 0) {\n uint256 revision = system.agendaRevision();\n vm.prank(agents[i]);\n members.respond(i, block.number - 1, anchor, revision, \"checked agenda\");\n if (hour == 125) {\n vm.prank(agents[i]);\n members.report(i, \"weekly report\");\n }\n }\n }\n }\n\n function maintainUntil(uint256 target) internal {\n uint256 next = (block.timestamp / 1 hours + 1) * 1 hours;\n while (next <= target) {\n vm.warp(next);\n uint256 week = members.currentWeek();\n if (week > initialWeek && !funds.settled(week - 1)) {\n while (!funds.settled(week - 1)) funds.settleWeek(week - 1, 32);\n }\n tick();\n next += 1 hours;\n }\n vm.warp(target);\n }\n\n /// Five colluding seats (proposer 0 and voters 1..4) out of ten qualified members must not be\n /// able to move the whole IMD operating balance to an outside wallet. Expected: the operation\n /// is refused at proposal, assembly or execution, and the treasury keeps its operating funds.\n function testFalseBeneficiaryDeclarationCannotCaptureOperatingFunds() public {\n maintainUntil(members.weekStart(initialWeek + 2));\n require(funds.qualifiedCount(initialWeek + 1) == MEMBERS, \"all ten qualified\");\n uint256 operating = funds.operatingFunds();\n require(operating == 500 ether, \"operating budget\");\n\n OperatingPlan memory p;\n p.primaryBudget = operating;\n p.approvals = new OperatingApproval[](0);\n p.calls = new OperatingCall[](1);\n p.calls[0] = OperatingCall(\n address(income), 0, abi.encodeCall(IERC20Local.transfer, (ATTACKER_WALLET, operating)), bytes32(0)\n );\n // Honest seats 6..9 are falsely declared as beneficiaries; seat 5 is left in so that the\n // electorate still has five voters. Seats 1..4 collude with the proposer (seat 0).\n address[] memory declared = new address[](4);\n for (uint256 i; i < 4; ++i) declared[i] = owners[6 + i];\n\n vm.prank(agents[0]);\n (bool proposed, bytes memory ret) = address(work).call(\n abi.encodeCall(QuorumWork.proposeOperation, (0, p, declared, \"Pay an outside contractor\"))\n );\n if (proposed) {\n uint256 id = abi.decode(ret, (uint256));\n (bool assembled,) = address(work).call(abi.encodeCall(QuorumWork.prepareBallot, (id, 32)));\n if (assembled) {\n QuorumWork.Ballot memory b = work.ballot(work.work(id).ballot);\n // Nine seats other than the proposer are qualified; four honest ones were struck out.\n // Allies 1..4 vote yes; every honest seat still eligible votes no. Votes a fixed\n // implementation may refuse are ignored: only the end state is asserted.\n for (uint256 i = 1; i < MEMBERS; ++i) {\n if (!work.eligible(work.work(id).ballot, i)) continue;\n vm.prank(agents[i]);\n address(work).call(abi.encodeCall(QuorumWork.vote, (id, i, i <= 4)));\n }\n maintainUntil(b.started + 120 hours);\n (bool executed,) = address(work).call(abi.encodeCall(QuorumWork.executeOperation, (id, p)));\n require(!executed, \"four colluding votes out of ten qualified seats executed the plan\");\n }\n }\n require(income.balanceOf(ATTACKER_WALLET) == 0, \"operating funds captured by minority\");\n require(funds.operatingFunds() == operating, \"operating funds moved\");\n }\n}","reproduction":"10 qualified seats, operatingFunds=500e18. agent0 proposeOperation(plan transferring 500e18 to 0xBAD, beneficiaries=[owners 6..9]); prepareBallot -> voters=5; agents1..4 vote yes (threshold 4); warp 120h; executeOperation succeeds, 0xBAD gets 500e18. Expected: 6 yes of 9 required, revert 'approval'. Ran specialist proof test/scratch/Proof_e45b17889d26.t.sol: fails with 'four colluding votes out of ten qualified seats executed the plan'.","severity":"high","snippet":" for(uint256 i;i