# Sanctum ($SNCTM) — Audit 1: mechanics and tokenomics vs the Nov 2026 meta

Date: 2 Nov 2026 · Scope: `SPEC.md` (Draft 1) + `BRIEF.md` · Author: mechanism/launch audit pass, no code reviewed (none written yet). ETH used for USD maths: ~$2,790 (Etherscan header, 2 Nov 2026). Nothing in `SPEC.md` was edited.

Reading order: §0 verdict → §A ranked changes → §B attack vectors → §C benchmark → §D keep list → §E sources.

---

## 0. Verdict in six lines

1. The security design (time + user keys, token pays for work) is right for a $100k–$1M cap and is the strongest part of the spec. Keep it.
2. The watcher market as written is **farmable by the owner against himself** with ~zero cost: one Sanctum + one $50 watcher bond yields $10 + 200 SNCTM per 24h per Sanctum, and the owner is the judge. At the 50k/day mint cap a single farmer can take 100% of work emissions and 100% of the ETH Reward Pool. This is the #1 fix.
3. The launch parameters that larpcheck-style scanners read first are still below the meta: 30-day LP lock (scanners: "<30 days suspicious, 6–12 months legitimate"), dev EOA admin for 30 days, a 60% opening tax, 3% steady fee (3x Clanker/Zora/Virtuals' 1%), and a 2 ETH pool ($11k FDV, "liquidity under $10k is thin").
4. A v4 hook that takes fees in ETH needs `beforeSwapReturnsDelta`/`afterSwapReturnsDelta`; Uniswap Labs **does not auto-route such pools** in its interface — they need a manual allowlist, and "extractive toward swappers" hooks are declined. Plan for the Uniswap app and most aggregators not routing SNCTM at launch; volume will come from the site widget and Dexscreener/Basescan-driven direct calls.
5. The buyback-and-burn share only shrinks supply if burns beat emissions; at a $1M cap and 1 ETH/day volume the burn is ~2,900 SNCTM/day against a 50,000/day mint cap (17:1 inflation). Tie emissions to fee inflow.
6. The spec has internal inconsistencies to clean before code: §4 LP row says "Uniswap v2", §6 lists `setPair`/`setTaxExempt` on a plain ERC-20, §8 uses $2/mo vs §9's $5/mo.

---

## A. Ranked spec changes

Each: problem → evidence → change → impact.

### A1. Watcher rewards are self-farmable (owner = judge = beneficiary) — CRITICAL

**Problem.** `confirmFreeze` is decided by the Sanctum's own cold key and pays the watcher $10 ETH from the shared Reward Pool + 200 SNCTM minted. The same person can own the Sanctum, the watcher key and the cold key. Cost per confirmed freeze: one `panic()` + one `confirmFreeze()` on Base (≈$0.02 gas) + a $50 bond that is never slashed because the owner never rejects. Cap: one freeze per Sanctum per 24h (sticky freeze). `factory.create` is free and unlimited, so a farmer with 250 Sanctums hits the full **50,000 SNCTM/day** mint cap and pulls **$2,500/day** from the pool until the pool is empty — the pool is funded at ~$25–35/day in the spec's own §8 scenario, so honest watchers get nothing from day one. Reputation (+1 per confirm) is farmed the same way → the farmer reaches rep ≥ 10 in 10 days and becomes a **Blacklist oracle** (§3.3) and a **BountySanctum guardian** (§3.2, "top 2 watchers by reputation").

**Evidence.** Every per-outcome reward scheme that lets the payer and payee be the same entity has been farmed: Forta moved to staking (100 FORT/bot, 2,500 FORT/pool) and SLA-score slashing precisely because unverifiable alerts were spammed ([Gate/Forta](https://www.gate.com/blog/102049/forta-onchain-real-time-security-ai-firewall-fort-tokenomics-decentralized-security-monitoring-blockchain-risk-detection-web3-security-layer)); bounty platforms gate payouts with expert triage, $250 stakes per report (Sherlock) or KYC (Immunefi) rather than letting the reporter self-validate ([Sherlock 2026](https://sherlock.xyz/post/best-web3-bug-bounties-in-2026-the-highest-paying-programs-on-every-platform)); DePIN networks only got sybil resistance when the farmer had to put capital or hardware at risk per identity ([SquirrelVPN DePIN sybil](https://squirrelvpn.com/blog/sybil-attack-resistance-in-depin-architectures)).

**Change (all five together).**
1. **ETH alert reward comes from the Sanctum's own prepaid coverage, not the shared pool.** Each Sanctum has a `coverageBalance` = 60% of its own subscription payments. `confirmFreeze` pays `min($10, coverageBalance)` from that balance. The shared Reward Pool pays ETH only for (a) bounty-Sanctum freezes and (b) canary-sourced flags, both of which the team adjudicates. Self-farming becomes net negative: pay $5 to recover ≤ $3.
2. **SNCTM mint requires objective on-chain evidence, not just a confirm:** the panic must land while a `queued` transfer ≥ 10% of balance exists OR within 1h of a withdraw that hit the hourly/daily cap; the Sanctum must be ≥ 30 days old, have ≥ $500 TVL (Chainlink-priced ETH + an allowlisted token set) for ≥ 7 consecutive days, and have paid ≥ 1 full month of subscription; max **1 SNCTM-rewarded freeze per Sanctum per 30 days**.
3. **Scale the SNCTM reward with value protected:** `reward = min(200, TVL_usd / 50)` SNCTM (so 200 SNCTM needs $10k TVL frozen). Sybil cost becomes capital, like Forta/DePIN stake.
4. **Reputation only counts freezes that passed rule 2 on a Sanctum whose cold key ≠ the watcher's registering address and that is not among the watcher's own created Sanctums** (the factory records creator). Still gameable with two wallets, so additionally: oracle rights (Blacklist flag) need rep ≥ 25 **and** registration ≥ 90 days **and** admin ratification for the first 180 days of the protocol.
5. **Uptime pool:** drop the fixed "$30/day" headline (unfunded — see A9) and pay uptime only to watchers with ≥ 1 rule-2 confirmed freeze in the trailing 30 days or that are in the top-10 reputation set.

**Impact.** Sustainability: the Reward Pool can no longer be drained by one actor; emissions stay tied to real protection. larpcheck: no change at launch (watchers ship later) but prevents the "emissions went to one wallet" chart that killed Uriel's node story.

### A2. LP lock at seed: 30 days is below every scanner's floor — HIGH

**Problem.** §4: LP unlock 30 days from deploy, "team commits to extend to +180 inside launch week". Scanners read `unlockAt` now, not a promise. Uriel's 7-day lock was the first thing read against it (BRIEF §2.4).

**Evidence.** DEXTools 2026 checklist: "Locks under 30 days are suspicious", 6–12 months legitimate minimum, 100% of liquidity ([DEXTools](https://www.dextools.io/news/early-crypto-scam-signals)). Clanker, Doppler and Flaunch all run protocol-controlled permanent liquidity (Clanker fee locker on Basescan; Flaunch "effectively burned") ([TrustSwap](https://trustswap.com/base/best-launchpads), [Blocmates/Flaunch](https://www.blocmates.com/articles/flaunch-redefining-launchpads-with-fixed-price-fair-launch)). Team Finance does not lock v4 positions on Base; GoPlus ships a v4 locker on Base at `0x4F26fa33bCE395d50671CbC8C7a5D3c55a95519e` ([GoPlus](https://docs.gopluslabs.io/page/goplus-safetoken-locker-for-uni-v4)).

**Change.** Mint the full-range position to `LPLocker` with `unlockAt = deploy + 365d` in the seed tx (extend-only stays). If a 30-day escape hatch is wanted for migration (hook bug), make it a **migration-only** path: the locker can move the position only to a new pool whose liquidity is re-locked for ≥ the remaining term, never to an EOA. Expose `unlockAt()`, `beneficiary()`, `positionId()` as views and get the locker tagged on Basescan; optionally mirror the lock in the GoPlus v4 locker so GoPlus-fed scanners read it.

**Impact.** Direct larpcheck/GoPlus/DEXTools improvement from day 0; removes the "we will extend" trust assumption.

### A3. Admin: dev EOA for 30 days contradicts the brief and the meta — HIGH

**Problem.** §6 keeps a single EOA as token owner, FeeRouter admin, Blacklist admin, BountySanctum cold key and WatcherRegistry admin for 30 days. BRIEF §5 asked for Safe + 48h timelock **from day one**. Uriel's "everything on one EOA" was BRIEF §2.5.

**Evidence.** Hooklist/allowlist reviewers check for proxies and admin control ([Uniswap routing](https://support.uniswap.org/hc/en-us/articles/48291859140621-Routing-for-hooked-pools)); scanners flag modifiable parameters as disqualifying at any current value ([DEXTools tax](https://www.dextools.io/news/how-to-check-buy-and-sell-tax-before-buying-a-token-2026)).

**Change.** Deploy a Safe 2/3 (dev key + the two hardware keys Rams already owns) and a `TimelockController` (24h for days 0–30, raised to 48h by a scheduled op) **before** step 1 of the launch; every contract's owner is the timelock at deploy. Keep only two instant paths, both on the Safe directly: `Blacklist.flag` (add-only) and `BountySanctum.panic`. Remove `setPair`/`setTaxExempt` from §6 — `SNCTM.sol` is a plain ERC-20 and should have **no owner at all**.

**Impact.** larpcheck "admin keys" line goes from red to green at launch; no "handoff countdown" needed (which itself reads as "not yet safe").

### A4. Sniper curve 60%→3% over 60 s: bad optics, little revenue — HIGH

**Problem.** A 60% opening fee is the same headline as Uriel's 97% (BRIEF §2.6). Base blocks are 2 s; 60 s = 30 blocks; bots simply wait for block 31, humans who click early get taxed. Expected buyback from the curve ≈ 0.

**Evidence.** Meta sniper defences are **time/size based, not tax based**: Clanker v4 uses a 2-block trading delay ([Clanker v4](https://paragraph.com/@dish/introducing-clanker-v4)); Flaunch uses a 30-minute fixed-price window with 0.25%-of-supply max buy and no selling inside the window ([Blocmates](https://www.blocmates.com/articles/flaunch-redefining-launchpads-with-fixed-price-fair-launch)); Doppler uses a Dutch-auction bonding curve ([Yellow/Doppler](https://yellow.com/news/doppler-which-hosts-90-of-base-token-launches-moves-into-solana-with-a-native-rebuild)); V4LaunchHook on Base uses a per-tx ETH cap in the launch block ([hooklist #8418](https://github.com/Uniswap/hooklist/pull/8418)).

**Change.** Replace the fee curve with a **fixed-price window**: for the first 10 minutes after `light()` the hook enforces a max buy of **0.25% of supply (250k SNCTM) per wallet**, no sells, and a flat 3%... (see A5) fee; after the window, normal trading. If a fee curve is kept for the headline, cap it at **15%→3% over 30 s**. Keep "no exemption list in the hook" — that is a strong larpcheck point.

**Impact.** Removes the "97% tax, insider play" narrative; same anti-sniper effect; the burn optics move to the steady buyback.

### A5. 3% steady fee is 3x the Base meta and may block routing — MEDIUM-HIGH

**Problem.** Every live Base launch rail charges ~1%: Clanker static fee example 1% token side / 2% paired side, Zora 1%, Virtuals 1%, Pump.fun 1.70% all-in ([TrustSwap](https://trustswap.com/base/best-launchpads), [Clanker v4](https://paragraph.com/@dish/introducing-clanker-v4), [Ricosworks market update](https://github.com/Ricosworks1/blockchain-payment-flow-analysis/releases/tag/market-update-memecoin-factory-79pct-day-one-death-rate-nov-2026)). A fee-in-ETH hook needs returns-delta flags, which removes auto-eligibility from Uniswap's routing and triggers manual review where "extractive toward swappers" is a refusal criterion ([Uniswap routing](https://support.uniswap.org/hc/en-us/articles/48291859140621-Routing-for-hooked-pools)). DEXTools reads tax "red above 10% or modifiable", "1–8% fixed and disclosed supports smaller sizing" — 3% is inside the acceptable band but is read as "small size only" ([DEXTools tax](https://www.dextools.io/news/how-to-check-buy-and-sell-tax-before-buying-a-token-2026)).

**Change.** 2% flat (1% buy / 2% sell is the Clanker-shaped alternative, but asymmetric fees are a separate larp flag — stay symmetric). Submit the hook to Uniswap's allowlist form the day the pool is initialised (requirement: verified source + a deployed pool with minimal liquidity — the seeded, not-yet-lit pool satisfies this) and to the hooklist repo. Budget for the Uniswap app and 1inch not routing for weeks; the site widget must call `UniversalRouter` directly with the hooked `PoolKey`.

**Impact.** Expected: lower take rate × higher volume. At the spec's 1 ETH/day, 3% = 0.03 ETH/day; 2% at 1.5 ETH/day = the same ETH with twice the holders touched.

### A6. Emissions can outrun burns 17:1 at the target cap — MEDIUM-HIGH

**Problem.** Daily mint cap 50,000 SNCTM = 0.05%/day = 18%/yr of supply. Buyback = 35% of fees. At $1M cap (price $0.01) and 1 ETH/day volume at 3%: $29/day buyback ≈ 2,900 SNCTM/day vs up to 50,000 minted. Only at the launch FDV ($11k) does the burn (≈260k/day at $0.000112) exceed the cap — i.e. the burn only "works" while the token is worthless.

**Evidence.** Tokenomist/Unlocks 2026: of 11 buyback programmes only BNB and RAY net-shrink supply; HYPE (+47%), PUMP (+14%), ASTER (+24%) inflate because unlocks/emissions dwarf burns; "the funding source matters most" and burns funded by real fees are the only ones that persist ([Tokenomist](https://tokenomist.ai/research/buyback-and-burn-explained-what-they-are-who-is-doing-them-and-whether-they-actually-work)). "Burns without sustained organic volume are cosmetic" ([CryptoDaily](https://cryptodaily.co.uk/2026/05/uniswap-fee-switch-aftermath-token-burns-volume)).

**Change.** Make the daily mint cap **fee-linked**: `dailyMintCap = min(50_000, SNCTM_bought_back_trailing_7d_avg × 2)`, floor 5,000/day so early watchers still earn. Publish "net supply change, 30d" on the site as the single tokenomics number. Keep 30M as the hard ceiling.

**Impact.** Net supply can never inflate more than 2x the burn rate; the "work-only emissions" story becomes provable, which is what the 2026 buyback meta rewards.

### A7. Seed 2 ETH → $11k FDV and a $114 max buy — MEDIUM

**Problem.** 50M SNCTM / 2 ETH → price 4e-8 ETH ($0.000112), FDV 4 ETH ≈ $11.2k (spec's "$8–9k" is stale). Max wallet 1% of supply (1M SNCTM) costs 0.0408 ETH ≈ **$114** from the fresh pool: no sized buyer can enter for 30 min, sybil wallets bypass it trivially. Reaching $100k FDV needs ~4 ETH net inflow (pool 6 ETH), $1M needs ~17 ETH net inflow (pool 19 ETH).

**Evidence.** DEXTools: liquidity under $10k is "thin" ([DEXTools](https://www.dextools.io/news/early-crypto-scam-signals)). Uriel did 33 ETH volume in hours from a 2 ETH seed (BRIEF §1) — volume is there if the pool can absorb it.

**Change.** Seed **4 ETH** (FDV ≈ $22k, max-wallet 2% ≈ $460). Replace "1% max wallet 30 min" with the A4 window (0.25% per wallet for 10 min, then free). Keep the 50M tokens.

**Impact.** Slippage halves for the first buyers; the curve to $100k needs 8 ETH of net buys instead of 4, which is the right trade for a project meant to run months, not minutes.

### A8. Team/treasury concentration reads as 10% + 4×2.5% top holders — MEDIUM

**Problem.** Scanners read the vesting and locker contracts as holders: top holder (after the pool) = 10% team vesting = "warning 5–15%", dev wallet > 5% = "danger"; top-10 = pool 50% + team 10% + treasury 10% = 70% = "danger > 40%" ([DEXTools](https://www.dextools.io/news/early-crypto-scam-signals)). Meta cliffs are longer: 6–12 months cliff, 2–4 years vest ([Bitget/8 mistakes](https://www.bitget.com/news/detail/12560605802866)); Flaunch's FLAY team 20% has a 6-month cliff + 2.5 years and a $75M FDV performance gate ([Blocmates](https://www.blocmates.com/articles/flaunch-redefining-launchpads-with-fixed-price-fair-launch)).

**Change.** Team 10% → **6-month cliff, 18-month linear** (first token ~2 May 2027). Add a performance gate like Flaunch: vested tokens claimable only if 7-day TWAP FDV ≥ $250k (otherwise they keep accruing but cannot be claimed). Tag `TeamVesting`, the 4 treasury lockers and `WorkRewards` on Basescan before launch and list them with holder % on `code.html`. Consider treasury 10% → 7% and work emissions 30% → 33% (treasury is the least defensible bucket to a scanner; emissions are "earned").

**Impact.** Zero liquid team tokens for 6 months is a stronger larpcheck line than 3; the FDV gate makes "team is paid only if holders are" verifiable.

### A9. Reward Pool and uptime pay are unfunded at launch volumes — MEDIUM

**Problem.** §3.4 promises "up to $30/day" uptime + $10 per confirmed freeze. §8's own scenario: 1 ETH/day × 3% = 0.03 ETH/day fees → 30% = 0.009 ETH ≈ **$25/day** to the Reward Pool; subscriptions 200 × $5 = $1,000/mo → 30% = $10/day. Total ≈ $35/day for everything. §8 also still says "200 Sanctums × $2" (superseded by §9's $5).

**Change.** State the uptime pool as **"50% of trailing-7d Reward Pool inflow"**, never a dollar figure. Fix §8 to $5. Publish the pool balance and trailing inflow on `watchers.html`.

**Impact.** No unkeepable promise on the site (BRIEF §2.3 "story vs on-chain gap").

### A10. Hook: trapped third-party LPs and exact-output paths — MEDIUM (design, before step 2)

**Problem.** §4: "beforeRemoveLiquidity lets only the locker remove." If external LPs can `addLiquidity`, their positions are trapped = extractive = allowlist refusal and a scanner "malicious" flag. Exact-output swaps need the fee taken in `afterSwap` on the unspecified currency (ETH-in for exact-out buys), which doubles the code paths and is the named bug class ("asymmetric swap handling").

**Evidence.** Zealynx and Trail of Bits both list exact-in/exact-out asymmetry, missing `onlyPoolManager` (Cork, ~$12M), donate griefing and flag/callback mismatch (Angstrom) as the live hook bug classes ([Zealynx](https://www.zealynx.io/research/protocol-deep-dives/uniswap-v4-hook-attacks), [Trail of Bits](https://blog.trailofbits.com/2026/07/30/building-secure-uniswap-v4-hooks/)); OpenZeppelin: "a hook can change `specifiedAmount` only in beforeSwap and `unspecifiedAmount` only in afterSwap" ([OZ](https://www.openzeppelin.com/news/6-questions-to-ask-before-writing-a-uniswap-v4-hook)); V4LaunchHook on Base simply reverts exact-output and blocks external `addLiquidity` ([hooklist #8418](https://github.com/Uniswap/hooklist/pull/8418)).

**Change.** v1 hook: (1) **revert exact-output** (`amountSpecified > 0`), take the fee in ETH in `beforeSwap` for ETH-in (specified) and in `afterSwap` for ETH-out (unspecified) — two paths, both tested; (2) **block external `addLiquidity`** (only the seeder/locker), so `beforeRemoveLiquidity` can be locker-only without trapping anyone; (3) `beforeDonate` reverts; (4) single-pool hook: `afterInitialize` records the one `PoolId` and reverts any second pool; (5) `onlyPoolManager` on every callback, `BaseHook` address validation, no proxy; (6) fee constant, no setter, `dynamicFee` flag **off** (use fixed `PoolKey.fee = 0` + hook take, not LP fee override, so LP fee and hook fee are not confused). Fuzz: fee taken == 3%/2% of ETH leg on both directions, hook ETH balance == Σ fees, dust == 0.

**Impact.** Fewer paths = fewer bugs; matches the one hook already allowlisted on Base; removes the "trapped LP" refusal reason.

### A11. Subscription price and currency vs comparables — LOW-MEDIUM

**Problem.** $5/month per Sanctum in ETH.

**Evidence.** Revoke.cash Premium $99/yr for 10 wallets (**$0.83/wallet/mo**), Ultimate $199/yr (**$1.66/wallet/mo**, includes auto-revoke + gas budget), paid in **USDC on Base** among others ([Revoke](https://revoke.cash/blog/2026/introducing-revoke-premium-and-ultimate)); Webacy Pro **$10/mo**, unlimited wallets, Starter free ([Webacy](https://webacy.com/pricing)); Pocket Universe free extension + per-tx paid coverage up to $30k, 200k users ([Pocket Universe](https://www.pocketuniverse.app/)); Harpie (Coinbase-backed on-chain firewall) **shut down Mar 2025** ([The Block](https://www.theblock.co/news/business/2025-03-27-coinbase-web3-security-shop-harpie-announces-shutdown-348421)) — the consumer on-chain-firewall segment has one dead body already.

**Change.** $5/mo stays defensible as a per-vault (not per-wallet) price, but: (1) accept **USDC on Base** as well as ETH (Revoke's choice; removes the Chainlink dependency for payers); (2) annual $39 (≈$3.25/mo) to match Revoke's annual-only model; (3) trial 14 days → **7 days and only for Sanctums with ≥ $100 TVL** (trial farming otherwise gives free watcher coverage to empty Sanctums — see B2). The 0.25% queued-transfer fee is fine but expect ≈0 revenue: 10%/day of balance is free via caps and `coldWithdraw` is free, so only urgent large hot-key moves pay.

**Impact.** Benchmarked pricing on the site ("$5/mo vs Webacy $10, Revoke Ultimate $1.66/wallet") is a larpcheck-neutral, conversion-positive line.

### A12. Clean the spec's internal contradictions — LOW (but do before code)

- §4 LP row: "Uniswap v2 (Base), LP tokens" → v4 position in `LPLocker`.
- §6 day 0–30: `setPair`, `setTaxExempt` → delete; SNCTM has no owner.
- §8: "$2" → "$5"; "35% still burned" → "35% of fee inflow to buyback".
- §3.1 queued fee "same asset" vs FeeRouter "keeper converts non-ETH via Uniswap": define the allowlisted asset set (ETH, WETH, USDC, cbBTC) and send anything else to a `dust` account rather than a keeper swap (B4).
- §4 addresses: PoolManager `0x498581ff718922c3f8e6a244956af099b2652b2b`, PositionManager `0x7c5f5a4bbd8fd63184577525326123b519429bdc` confirmed against Uniswap docs; add Universal Router `0x6ff5693b99212da76ad316178a184ab56d299b43` (2.1.2 at `0xd6145b2D3F379919E8CdEda7B97e37c4b2Ca9c40`), StateView `0xa3c0c9b65bad0b08107aa264b0f3db444b867a71`, Quoter `0xE1A6C5803e3c44368b171BD680c7D32dfc92CA47` ([Uniswap deployments](https://developers.uniswap.org/docs/protocols/v4/deployments.md)). Chainlink ETH/USD on Base: use the proxy listed in Chainlink's Base feed table (the long-standing one is `0x71041dddad3595F9CEd3DcCFBe3D1F4b0a16Bb70`; confirm on the fork, and enforce `updatedAt ≥ now − 2×heartbeat` and `answer > 0`).

---

## B. Attack and farming vectors, with mitigations

### B1. Watcher market

| # | Vector | Mechanics / cost | Mitigation |
|---|---|---|---|
| W1 | **Owner farms own watcher** (confirm self-dealing) | 1 Sanctum + $50 bond; `panic` + `confirmFreeze` daily → $10 + 200 SNCTM + rep +1; 250 Sanctums = full 50k/day mint cap + $2,500/day from the pool; ~$0.02 gas each. Pool is ~$35/day → drained in hours. | A1 rules 1–4: reward from the Sanctum's own coverage balance; evidence-gated and TVL-scaled mint; 1 reward/Sanctum/30d; rep excludes own-created Sanctums. |
| W2 | **Reputation → oracle/guardian capture** | Rep ≥ 10 in 10 days via W1 → `Blacklist.flag` rights → flag Uniswap Universal Router / USDC as "drainer" → every `Firewall7702` user's approvals to it revert; or become BountySanctum guardian and freeze the showcase daily. | Watcher flags are **proposals** with a 24h challenge window, need 3 distinct watchers ≥ rep 25 ≥ 90 days or admin; hard allowlist of never-flaggable addresses (routers, Permit2, major tokens); BountySanctum guardians chosen by admin only in v1. |
| W3 | **Mass freeze griefing** | One $50 bond can `panic` every `watchersOn` Sanctum in one tx (24h freeze each); slashing is per rejection (50%), so after 2 rejections the bond is gone but N Sanctums were frozen. | Per-panic collateral: each open panic locks $25 of bond; max 2 unsettled panics per watcher; bond scales `$50 × 2^(open panics)`. Owners' choice: `watchersOn` can carry a `minRep` (default 5). |
| W4 | **Uptime sybil** | 10 identities × $50 = $500 bond, 3 heartbeats/day each (~$0.01) → all of a $30/day pool when alone = 2,190% APR. | A1 rule 5 + A9: uptime only for watchers with a rule-2 freeze in 30d or top-10 rep; pool = 50% of inflow. |
| W5 | **Collusive reject** (owner slashes an honest watcher) | Owner sets `watchersOn`, waits for a legitimate panic on a self-staged "attack", rejects → takes 50% of the watcher's bond ($25). Repeatable with new Sanctums. | Slash goes **to the Reward Pool, not the owner** (removes the incentive); a Sanctum that rejects twice loses `watchersOn` for 90 days; reject requires the owner to have ≥ 30 days of paid subscription. |
| W6 | **Oracle staleness** | USD-priced bond/reward via Chainlink; stale or sequencer-down price → bond under-collateralised or $10 overpaid. | Staleness check (2× heartbeat), Base L2 sequencer uptime feed check, clamp reward to ±20% of last-good value. |

### B2. Subscription and Sanctum fees

| # | Vector | Mitigation |
|---|---|---|
| S1 | **Trial farming:** unlimited free Sanctums × 14 days = free watcher coverage and (with W1) rewards. | Trial only when TVL ≥ $100 for 24h; 7 days; one trial per cold key. |
| S2 | **Fee avoidance:** 0.25% on `executeQueued` is avoided by 10%/day capped withdrawals or `coldWithdraw`. | Accept (it is a convenience fee); do not forecast revenue from it. |
| S3 | **Non-ETH queued fee assets** → FeeRouter holds random tokens; keeper swap is sandwichable / can be fed a honeypot token. | Fee only on allowlisted assets (ETH/WETH/USDC/cbBTC); others: fee waived (or taken but parked, no swap). |
| S4 | **Price in USD, pay in ETH:** payer front-runs a Chainlink update to pay 0.15% less. | Irrelevant at $5; ignore. |
| S5 | **Guardian recovery abuse:** 2-of-3 guardians `proposeCold` while the hot key keeps draining caps during the 7-day timer; or lost-cold user's guardians collude. | During a pending recovery the Sanctum auto-enters **freeze** (no outflow) until executed or cancelled; any cold-key tx cancels the proposal implicitly; show pending recoveries in the UI and to watchers. |

### B3. Bounty Sanctum

| # | Vector | Mitigation |
|---|---|---|
| R1 | **Legal faucet:** caps 5%/h, 10%/24h on 0.5 ETH = 0.05 ETH/day taken by anyone for ~$0.01 gas; after 30 days 0.5 × 0.9³⁰ ≈ 0.021 ETH; weekly top-up (10% of fees ≈ 0.09 ETH/mo at 1 ETH/day volume) does not keep up. Visitors see a prize that only goes down. | Tighten the bounty Sanctum's own caps (owner may tighten-only): **1%/h, 2%/24h** → 2%/day leak; frame the number on `raid.html` as a *leak meter* ("caps let out X, attackers got nothing above it"), not a prize; "win" = any outflow above caps. |
| R2 | **Permanent freeze:** anyone queues a >10% transfer → watchers/guardians panic → 24h frozen; repeat daily → the showcase is frozen 24/7 and shows no activity. | Bounty Sanctum ships with **queue disabled** (`maxQueue = 0`, only caps) in v1; watchers on it earn only when a freeze stops a queued transfer (impossible) → so the bounty Sanctum reward (300 SNCTM) is dropped or paid only for the team-adjudicated "cap breach" event. |
| R3 | **Robber = watcher collusion:** queue → own panic → admin confirms → 300 SNCTM + $10 daily. | Follows from R2; if the queue is kept, cap bounty-Sanctum rewards to 1/week and admin-only confirm. |
| R4 | **Guardian capture** (top-2 watchers by rep) | Admin-chosen guardians in v1 (W2). |

### B4. FeeRouter

| # | Vector | Mitigation |
|---|---|---|
| F1 | **Buyback MEV:** 35% of inflow buys SNCTM on a predictable schedule in a 2–4 ETH pool → sandwiched every time. | Buy in clips ≤ 0.5% of pool ETH, randomised block offset, `minOut` from `Quoter` at −2%, executed by the hook's own `unlock` path (no router), or route through the site's private RPC/Flashblocks on Base. Publish each burn tx. |
| F2 | **Split-band drift:** admin can move team to 25%, buyback to 25%, inside bands. | Keep bands, but any change takes effect after the 48h timelock and is shown on the site with before/after (spec already emits an event — add the delay). |
| F3 | **Bounty top-up is a faucet to robbers (R1).** | Top-up only when the bounty Sanctum's balance < 0.25 ETH; cap 0.1 ETH/week. |
| F4 | **Backstop 5% held idle** | Park in the `LPLocker`-style vault with `unlockAt = +90d`, labelled; do not let it sit in the router (one key, no timelock in days 0–30 under the current spec). |

### B5. Hook

| # | Vector | Mitigation |
|---|---|---|
| H1 | **Exact-output asymmetry**: fee taken on the wrong leg or not at all for exact-out swaps; quote ≠ realised → honeypot simulators flag. | Revert exact-output in v1 (A10); fuzz both exact-in directions. |
| H2 | **Direct hook call** (Cork pattern): `beforeSwap` callable by anyone with crafted `hookData`. | `onlyPoolManager` on every callback; `BaseHook`. |
| H3 | **Flag/callback mismatch** (Angstrom): returns-delta flag missing → fee silently 0; or flag set with missing function → every swap reverts. | `HookMiner` salt + `validateHookAddress` in constructor; fork test that a 1 ETH buy leaves exactly 0.03 ETH in the router. |
| H4 | **Donate griefing** of any fee-growth-dependent logic. | `beforeDonate` reverts. |
| H5 | **Second pool with the same hook** (SNCTM/USDC or any token) inherits the 30-min limits/curve state or dilutes the fee stream. | Single `PoolId` lock in `afterInitialize`. |
| H6 | **Trapped external LPs** under locker-only `beforeRemoveLiquidity`. | Block external `addLiquidity` (A10). |
| H7 | **Native ETH reentrancy** on `take`/`settle` with ETH to `FeeRouter`. | `FeeRouter.receive()` is storage-only (no external calls), `nonReentrant` on hook, CEI. |
| H8 | **Locker as the only remover + `unlockAt` 30 days** = after day 30 the locker beneficiary (admin) can pull 100% LP. | A2: 365d lock, migration-only path. |
| H9 | **Max-wallet sybil** (1% ≈ $114). | A4/A7 window + bigger seed; accept that wallet caps are advisory. |

---

## C. Benchmark: Sanctum vs live comparables

| Parameter | **Sanctum (spec)** | Clanker v4 (Base) | Flaunch (Base) | Zora coins (Base) | Virtuals (Base) | Doppler rails (Base) | Pump.fun (Sol) | Uriel (own, ETH, 1 Nov) | Forta (security token) |
|---|---|---|---|---|---|---|---|---|---|
| Swap fee | 3% both sides | 1% token / 2% paired (static example); +20% protocol on top; dynamic option | "zero platform fee"; creator-set fee split, fees in ETH | 1% | 1% (70% creator / 30% treasury) | protocol earns trading fees post-launch (Dutch-auction curve) | 1.25% curve + 0.45% app = 1.70% | in-token tax (v2) | n/a |
| Fee currency | ETH (hook) | WETH (fee locker) + token | ETH | — | VIRTUAL | — | SOL | URIEL | FORT |
| Sniper defence | 60%→3% fee over 60 s + 1% max wallet 30 min | 2-block delay | 30-min fixed price, 0.25% max buy, no sells | — | bonding curve | Dutch auction | bonding curve | 97% opening tax + exempt pre-buy | — |
| LP | 50% in v4 full-range, locker **30 d** extend-only | protocol-controlled, permanent | "effectively burned", ETH in flETH (Aave) | protocol-controlled | graduates to v2 at 42k VIRTUAL | protocol-controlled | graduated LP locked | 7-day lock | — |
| Team alloc / vest | 10%, 3 m cliff, 12 m linear | creator vault: ≥7 d lockup, then linear | FLAY: 20%, 6 m cliff, 2.5 y, $75M FDV gate | — | — | — | — | ~50% liquid at launch | staking-based |
| Buyback | 35% of fees burn | ecosystem fund recycles fees | Progressive Bid Wall: every 0.1 ETH of fees → 0.1 ETH bid below spot | — | — | — | 50% of net revenue (cut from 100%) | — | — |
| Admin | dev EOA 30 d → Safe 2/3 + 48 h | immutable admin/treasury; audited (Macro, Cantina) | immutable split after launch | — | — | — | — | single EOA | DAO |
| Work-for-token | per confirmed freeze / flag | — | — | — | — | — | — | per staked node | per bot subscription + node stake (100/2,500 FORT) |
| Traction signal | — | $271k fees/30d, $16.6k/7d (falling); $90.5M cumulative | $600k+ paid to creators (early 2026) | content coins "didn't work" (Armstrong, Jul 2026) | — | >90% of Base pool launches, >40k/day creations | 79% dead after day 1; 1.5% trading in week 5; graduated 43% in week 5 | 33 ETH vol first hours; larpcheck 42→15 | FORT ~$10.7M cap, −77% y/y (Apr 2026) |

Reading across: the meta is **1% fee, time/size-based sniper defence, permanent or ≥6-month liquidity, immutable or audited admin, and ≥6-month team cliffs**. The spec is at or beyond the meta on "no pre-buy, no exemptions, fee in paired currency, work-only emissions" and below it on LP lock, admin at launch, fee level and the opening tax.

---

## D. Do not change (already right vs the meta)

1. **Time + user keys, not stake**, for security; token pays for work. This is the exact lesson Forta learned the expensive way and it is what makes the product honest at $100k.
2. **Fee in the paired currency via the hook, SNCTM a plain fixed-cap ERC-20.** Token-contract tax fields read 0/0 on every scanner; no tax wallet, no keeper dumps; no `_update` logic to flag.
3. **No hook exemption list, team pays like everyone, no pre-buy.** Directly fixes BRIEF §2.6.
4. **100M hard cap, 30M only mintable by `WorkRewards`, never minted if not earned.** Keep, with the fee-linked daily cap (A6).
5. **USD-priced, ETH-settled** bonds/rewards/subscriptions via Chainlink — correct for a token that will move 10x either way.
6. **Sanctum never locks out its own user for non-payment.** Keep this sentence on the site verbatim.
7. **Extend-only lockers, immutable vesting beneficiary, bands on FeeRouter splits, constant fee rate with no setter.**
8. **Split launch (deploy → seed → light), fork rehearsal, resumable scripts, `verify.sh`, proof section** — Uriel's shipping discipline.
9. **Launch after step 3 with dated releases** rather than everything at once. But make the first dated release the watcher market *with A1 rules*, not without.
10. **Honest limits §10** — add one line: "Watcher rewards are paid from the subscription of the Sanctum they protected; the shared pool pays only for the bounty Sanctum and canaries."
11. **Full-range single position** (simple, auditable, no range-management admin).
12. **Guardians 0–5 with cold-only unfreeze and 7-day M-of-N recovery** — standard social-recovery shape; only add the auto-freeze during pending recovery (S5).

---

## E. Sources

Market / launch meta
- TrustSwap — Best launchpads on Base (fee table: Clanker 20% of LP fees on 1–3%; Zora 1%; Virtuals 1% 70/30; Flaunch 0.1% creation): https://trustswap.com/base/best-launchpads
- TrustSwap — Clanker vs Zora vs Flaunch vs own contract (Team Finance does not lock v4 on Base): https://trustswap.com/base/clanker-vs-zora-vs-flaunch
- Clanker v4 announcement (static 1%/2% example, 20% protocol fee, 2-block MEV delay, vault ≥7 d, audits Macro/Cantina): https://paragraph.com/@dish/introducing-clanker-v4
- DefiLlama — Clanker fees ($271k/30d, $16.6k/7d, $90.5M cumulative): https://defillama.com/protocol/clanker
- Blocmates — Flaunch (30-min fixed price, 0.25% max buy, PBW 0.1 ETH, FLAY vesting + $75M gate): https://www.blocmates.com/articles/flaunch-redefining-launchpads-with-fixed-price-fair-launch
- Alea Research — Flaunch ($600k+ to creators): https://alearesearch.substack.com/p/flaunch-no-fee-pumpfun-alternative
- Yellow — Doppler hosts >90% of Base pool launches, >40k/day: https://yellow.com/news/doppler-which-hosts-90-of-base-token-launches-moves-into-solana-with-a-native-rebuild
- The Defiant — Armstrong: Base content coins "didn't work" (Jul 2026): https://thedefiant.io/news/blockchains/coinbase-ceo-says-base-s-content-coins-didn-t-work
- Ricosworks — 11.5M tokens, 79% dead after day 1, 1.5% trading in week 5, Pump 1.70% all-in (Nov 2026): https://github.com/Ricosworks1/blockchain-payment-flow-analysis/releases/tag/market-update-memecoin-factory-79pct-day-one-death-rate-nov-2026
- Bitget — 8 mistakes that kill token launches 2026 (6–12 m cliff, 2–4 y vest, >25% team red flag): https://www.bitget.com/news/detail/12560605802866
- Hooklist PR #8418 — V4LaunchHook on Base (exact-output revert, external LP blocked, permanent full-range on graduation): https://github.com/Uniswap/hooklist/pull/8418

Scanners / larpcheck
- larpcheck.app (site unreachable at audit time; features from public posts: holder-analysis memory, insider crews, EVM support, token-gated plans): http://larpcheck.app/ · https://x.com/Larpcheckbot
- MetaMask eth-phishing-detect issue #305556 (larpcheck.app false-positive listing): https://github.com/MetaMask/eth-phishing-detect/issues/305556
- DEXTools — 2026 rug checklist thresholds (top holder <5/5–15/>15%, top-10 <20/20–40/>40%, dev <2/2–5/>5%, lock <30 d suspicious, 6–12 m legit, <$10k thin): https://www.dextools.io/news/early-crypto-scam-signals
- DEXTools — tax bands (green 0, yellow <5%, red >10% or modifiable; Token Sniffer <70/<50): https://www.dextools.io/news/how-to-check-buy-and-sell-tax-before-buying-a-token-2026
- GoPlus — SafeToken Locker for Uni v4 (Base `0x4F26fa33bCE395d50671CbC8C7a5D3c55a95519e`): https://docs.gopluslabs.io/page/goplus-safetoken-locker-for-uni-v4

Wallet security comparables
- Revoke.cash — Premium $99/yr, Ultimate $199/yr, 10 wallets, USDC on Base: https://revoke.cash/blog/2026/introducing-revoke-premium-and-ultimate · Q2 update: https://revoke.cash/blog/2026/update-q2
- Webacy pricing — Pro $10/mo: https://webacy.com/pricing
- Pocket Universe — free + per-tx coverage up to $30k, 200k users: https://www.pocketuniverse.app/
- The Block — Harpie shuts down (Mar 2025): https://www.theblock.co/news/business/2025-03-27-coinbase-web3-security-shop-harpie-announces-shutdown-348421
- Hypernative — Binance $6.3B 7702 drain timeline (50 authorizations, sweeper, $3B frozen): https://www.hypernative.io/insights/blog/inside-the-largest-crypto-theft-of-all-time-the-6-3b-binance-hot-wallet-drain
- CoinDesk — how EIP-7702 was used in the Binance hack: https://www.coindesk.com/tech/2026/10/30/here-s-how-one-ethereum-permission-let-an-attacker-drain-usd2-5-billion-from-binance
- Shattered — 2026 7702 drainer losses, CrimeEnjoyor sweeper, wallet responses: https://shattered.io/eip-7702-wallet-drainer-1-54-million-2026/
- Gate — Forta tokenomics (100 FORT/bot, 2,500 FORT/pool, SLA slashing, ~$10.7M cap): https://www.gate.com/blog/102049/forta-onchain-real-time-security-ai-firewall-fort-tokenomics-decentralized-security-monitoring-blockchain-risk-detection-web3-security-layer

Uniswap v4 hooks
- Trail of Bits — Building secure v4 hooks (Jul 2026): https://blog.trailofbits.com/2026/07/30/building-secure-uniswap-v4-hooks/
- Zealynx — 4 hook exploit patterns (Cork, Angstrom, LiquidityPenaltyHook, donate): https://www.zealynx.io/research/protocol-deep-dives/uniswap-v4-hook-attacks
- Composable Security — liquidity theft via hook fee: https://composable-security.com/blog/uniswap-v4-liquidity-theft-via-hook-fee/
- OpenZeppelin — 6 questions before writing a v4 hook: https://www.openzeppelin.com/news/6-questions-to-ask-before-writing-a-uniswap-v4-hook
- Uniswap — Routing for hooked pools (returns-delta/dynamicFees → manual allowlist; "extractive" refused): https://support.uniswap.org/hc/en-us/articles/48291859140621-Routing-for-hooked-pools
- Uniswap — hook allowlist submission requirements: https://developers.uniswap.org/hook-allowlist
- Uniswap — v4 deployments (Base addresses): https://developers.uniswap.org/docs/protocols/v4/deployments.md
- Cyfrin CodeHawks — TokenLaunchHook fee-collection finding (afterSwap `take` pattern): https://codehawks.cyfrin.io/c/2026-01-vanguard/s/175

Tokenomics / value accrual
- Tokenomist — $19B buyback meta, 11 tokens, only BNB and RAY net-deflationary: https://tokenomist.ai/research/buyback-and-burn-explained-what-they-are-who-is-doing-them-and-whether-they-actually-work
- CryptoDaily — Uniswap fee switch: burns without volume are cosmetic: https://cryptodaily.co.uk/2026/05/uniswap-fee-switch-aftermath-token-burns-volume
- crypto.news — token buybacks hit record $638M in 2026: https://crypto.news/crypto-token-buybacks-hit-record-638m-in-2026/

Work-for-reward / sybil precedents
- Sherlock — 2026 bounty programmes (Sherlock $250 stake per report, Immunefi KYC, median payout ~$2k): https://sherlock.xyz/post/best-web3-bug-bounties-in-2026-the-highest-paying-programs-on-every-platform
- SquirrelVPN — sybil resistance in DePIN (stake, hardware-bound keys, reputation): https://squirrelvpn.com/blog/sybil-attack-resistance-in-depin-architectures
- Chainscore — why social recovery depends on sybil resistance: https://www.chainscorelabs.com/blog/decentralized-identity-did-and-reputation/identity-recovery-and-key-management/why-social-recoverys-success-depends-on-sybil-resistance