Method: property-based invariants (test/Invariants.t.sol: curve solvency, reward backing, supply conservation, creator never earns holder rewards, split fixed, 1,920 random calls per property), oracle TWAP and precision tests, two independent proof-of-concept attack passes with runnable Foundry exploits (test/Attack.t.sol, test/Attack2.t.sol, test/AttackV3.t.sol, now kept as regression tests), and a second manual read. Suite after round 2: 190 tests; after round 3: 241. Attempted and defended in this round (each has a passing test or a written argument in the attack files): curve reserve accounting under mixed buys and sells; distributor solvency under exclusion, re-inclusion and minimum-hold churn with a full claim-out; creator wallets holding large bags; protocol reward drains; tax or split mutation; pre-graduation pool seeding through a curve buy; arbitrary AMM-pair flagging; V3 pools pre-initialised far above or below the curve price (empty); a 24-decimal pair asset through the whole curve and graduation; registry spam (the list is never iterated on-chain); reward magnitude overflow; zap fund theft through callbacks or sweeps.

V3 graduation against deep pre-placed quote-only liquidity (test_H6c, test_H6d). With the pool pre-initialised at a token price 16× the curve's and deep quote liquidity in between, the adapter's alignment budget (half of the token side) cannot reach the target, so the pool opens above the curve price. The PoC shows the attacker loses about 13 ETH doing it: the adapter sells the coin's tokens to them at 16× and the leftover quote is paid to holders through the revenue split, curve buyers can sell into that liquidity at the inflated price, and the vault's full-range position is intact. Opening a pool mispriced at the attacker's expense is accepted; a looped alignment is a possible refinement.

Sandwich residue. With the average-price floor, a front-run inside the 0.3% (V2) / 1%-of-sqrt (V3) tolerance still costs the attacker two pool fees on a trade larger than the sale, which the PoC shows as a loss at every size on a 0.3% pool. On a pool with lower fees the residue would be bounded by the tolerance times the sale (0.3% of at most 0.5% of the reserve).

Creator-exempted MEV bot. A creator may exempt any address from tax (a CEX, a vesting contract), including a bot of their own. With the floor above, what such a bot can take from swap-backs is the same bounded residue; it cannot take the pot.

Method: three more independent adversarial passes with runnable proofs (the round-2 code: test/Attack3.t.sol; the rest of the protocol end to end: test/Attack4.t.sol; the web app), Slither over src/ (86 raw results, each read), the invariant suite at 18,000 random calls per property, fuzz tests for the floor maths (test/V2Twap.t.sol), and a manual re-read of everything round 2 changed. Attempted and defended in this round (each with a passing test in the attack files): distributor accounting under raising and lowering the minimum hold mid-life, refused and reverting recipients in batch and ETH claims, reentrancy through the ETH claim, pre-graduation tokens reaching any address other than the curve (EOAs, fake pools that claim token0() == this, a V4 PoolManager), the final curve buy when the remaining cost is below the minimum buy, exact-cost final buys leaving no dust, the zap's inner swap guarded by the outer minimum, a re-pointed zap against existing curves, ticker normalisation and reservation front-running, onGraduated spoofing, protocol-reward batch authorisation, the pause switch's scope, implementation initialisers and clone re-initialisation, TaxVault, FactoryBound and vault registration authorisation, creator transfers to contracts, V4 registration without a StateView, non-8-decimal and negative feeds.

V3 route selection by liquidity for the ETH / pair-asset leg (bestPool) can be won by a concentrated one-tick pool at another fee tier. Preview and execution use the same pool, and the single-range estimate overstates output across tick boundaries, so the app's minimum makes such a trade revert rather than lose money. Same class as the accepted "spot venues" note below; the coin's own leg no longer uses this lookup.

Ticker display spoofing. A symbol with a trailing control character is a distinct ticker key; it cannot take another coin's reservation but can look like it on screen. The app renders symbols as text and the explore page shows the address; a normalisation of control characters is a possible refinement.

An asset whose only market the attacker owns. The two-step activation makes a pushed price expensive to hold on a real market; on a pool with a single owner and no arbitrage a bogus price costs nothing to hold, so such an asset activates at whatever size its owner chooses (test_attackerControlledPoolActivatesAtChosenSize). This is the permissionless model: a creator chooses their pair asset, the launch form flags assets outside the stock lists as unverified, and the owner can disable one for good. A minimum external liquidity or holder count is a possible refinement.

Griefing the swap-back window. Someone can push the price more than the tolerance below the average right before each window closes, deferring the token-side sale again and again. It costs them two pool fees on a trade larger than the deferred sale every ten minutes and gains them nothing; holder rewards from the quote side keep flowing, and the token side sells as soon as they stop.

Scope: the new BuybackVault (one per factory), V3Twap, and the changes that route a launch's buyback share to it (DreamToken: a fourth bucket in _splitRevenue, a pre-graduation rule letting the vault transfer to the dead address only, fixed exemptions; DreamPadFactory: buybackShareBps and burnCapBps in the launch parameters, setBuybackVault). Method: the feature's own suite (test/Buyback.t.sol, 10 tests including a sandwich sweep, plus the 12 proof tests of the pass kept as regressions), an independent adversarial pass with runnable proofs (test/Attack5.t.sol), and a manual read against the threat model of rounds 1 to 3. Design decisions that follow from those rounds:

The trigger is permissionless, so every buy is bounded like the fee sales. Once per ten-minute window; on the curve at most 0.5% of the virtual quote (a round trip pays the 2% curve fee twice, a 1% price move cannot pay for that); on a V2 pool at most 0.5% of the quote reserve, floored at the pair's time-weighted average price since the previous run with a 0.3% tolerance; on a V3 pool a swap limited to 1% above the pool's average sqrt price. A pushed-up price defers the buy. The feature's sandwich sweep shows a loss for the attacker at every size.

The share comes out of the creator's part, never the holders'. The launch form shows all four buckets; the contract checks that holders + creator + buyback = 100% of the non-platform part.

Nothing but bought coins leave the vault, and only to the dead address or the creator. withdraw moves only held (coins bought after the burn cap), only to the creator, and only after graduation because the token's pre-graduation rule allows the vault a single destination.

Per-coin ledgers. The vault holds many pair assets for many coins in one balance; pending is credited only through deposit, which pulls the exact amount from a launched coin, and a run spends only that coin's pending. Curve fees that flow straight back during a run (_depositedDuringRun) are separated from a sell-out refund.

Exemptions are fixed. The creator cannot tax, cap or re-include the vault; a wallet that buys on the curve can name the vault as recipient, which only strands (effectively burns) its own coins. Attempted and defended (tests in test/Attack5.t.sol): curve sandwiches at every size (the 2% curve fee twice beats the move), deferral griefing (two pool fees per window for nothing), per-coin ledgers across coins and through a sell-out refund with fees flowing back mid-run, burn and withdrawal bounds, replacing the vault (existing coins keep theirs, a hostile vault cannot deposit), share rounding, configure and deposit authorisation, callback pinning.

Scope: every contract, the web app, the API routes, the deploy scripts, the runbooks, the git history and the live Vercel project. Method: three independent adversarial passes with runnable proofs (test/Attack6.t.sol: token, curve, factory, zap, 22 tests; test/Attack7.t.sol: vaults, buyback, rewards, oracles, 7 tests; a web and operations pass that ran the app with hostile metadata under Playwright), Slither, npm audit, and a secret sweep of every commit, dangling object and untracked file. Every proof that found something is kept as a regression that now asserts the fix.

Key material. No private key, mnemonic, RPC key, Pinata JWT or Vercel token has ever been committed on any branch or dangling commit. The only 64-hex strings in the history are Anvil's two public developer keys in script/DeployLocal.s.sol. cache/, broadcast/, .env* and now every *.log are ignored; server secrets are read only inside the two API route handlers; nothing in a client module touches them. The treasury is an address the factory reports, held by a Safe on mainnet per the runbook; the deployer keeps no role once the Safe accepts ownership. Attempted and defended (tests in test/Attack6.t.sol and test/Attack7.t.sol): ETH-refund re-entrancy on the final buy and on unwrapped sells, pre-funded pair griefing, the max wallet against graduation, the dead address and the adapter, the final-buy refund maths and a CurveMath fuzz, sellFor and zap allowance abuse, swap-back floor DoS, creator cap tightening and role transfers, treasury and owner key powers (a table of every power is in the pass report), zap cross-venue routing leaving nothing behind, the vault and zap as max-wallet bypasses, buyback ledger inflation and fake coins, a buyback run that graduates the curve, spoofing or reverting onGraduated, the V3 held-window sandwich (a loss at every size), V3 run bounds, burnStray against a creator's held coins, and, on the web, stored XSS through every metadata field, SVG script execution, prototype pollution, SSRF through metadata, fast-key exfiltration (661 requests, none carried it), chain and contract confusion through crafted URLs, clickjacking, and docs search reflection.