# Audit batch: h100 / busy60 / fast5 / d0fd / h100s (auditor3, 10 Oct 20:00-21:30 UTC, #830-#834)
New tool: one-address buy-then-sell via `eth_simulateV1` (free rpcpool supports it; state carries across calls): /opt/crew/work/auditor3/{bs.py,bs2.py,tg.py,sw.py,lst.py}. Fresh address buys 0.1 ETH through UniversalRouter, then sells the exact balance in the same simulation. Calibrated: a real seller (0x597d..) passes the same sell build; fresh-address calls match real outcomes.

## Sellability results
| family | test | result |
|---|---|---|
| native, unhooked, fee 100, std token (code 5fcfacb98bd0) | busy60 / native arms | buy->sell from fresh EOA works, ratio 0.9998 of the ETH in (pool fee only), 5/5 recent pools (+800 blocks). PASS |
| WETH, unhooked | busy60 WETH / fast5 A | token.transfer(PoolManager) from fresh address passes 25/25 recent tokens (token has no sale gate). The swap itself could not be simulated: every WETH-quoted swap sim reverts empty on this RPC even for unhooked pools (WETH approve() reverts for all callers, tooling limit). Token gate PASS, swap path unproven |
| WETH, hooked (h100, h100s) | token gate | token transfer passes 24/24. Hook gate (registry 0x6f8e52.. per auditor2: 19/19 traders listed, fresh = 0) NOT testable with the WETH sim limit. Unproven |
| native, unhooked, d0fd launcher token (code 5c6a0cc204ea) | d0fd | **FAILS**. Fresh EOA buys fine, then sell = TRANSFER_FROM_FAILED (token reverts "salg spaerret" on transfer to PoolManager). Reproduced with allowance override, 0.1 ETH, at 3 blocks after pool creation +300/+1400/+8000; giving the fresh address EIP-7702 code does not help. |

### d0fd gate found
Token storage `mapping(address=>uint) @slot 14` = 1 for every real seller (0x597d.. = 1), 0 for fresh and for a wallet that just bought through UR in the simulation. Buying does NOT set it, so a bought wallet is not automatically allowed to sell. In pool 0xe92bb9.. sampled 23 traders by tx.from: 21 listed (all 17 who sold), 2 unlisted (only bought). Who writes slot 14 (token owner 0xd368dfe85cbe934acd04471a1b1e0ef699ee31dd in slot 10, a keeper after the buy, or the launcher) is unknown. If listing needs the launcher/owner, the replay 3.74x is reachable only by insiders. Free getLogs is range-blocked on old blocks, so I could not find the setter tx.

## Per item
- **#833 d0fd: NOT VERIFIED, BLOCKED (FIX: prove listing).** Replay numbers and impact reproduce (earlier audit). Sellability: fresh-wallet buy-then-sell fails; listing mechanism unknown. Ben's $5 buy-then-sell on a fresh d0fd pool is now the deciding test (it must sell some minutes after the buy, in case a keeper lists later); dataeng to find the slot-14 writer tx (#posted). Without it d0fd must not go near live.
- **#834 h100s: NOT VERIFIED (FIX).** Token gate fine, hook registry gate unproven, forward n=3 arm A, replay in-sample then time split OOS n=7 (A 3.85x vs Z 2.21x per testmgr2) still tiny. Needs: hook-gate proof (Ben $5 or someone fixes WETH sim), forward n>=40.
- **#830 h100: NOT VERIFIED (FIX).** Same hook-gate gap (0x..144 family, WETH). Replay 2.22x n=474 vs forward 2.04x n=20 consistent; 4-trade v4 hand rebuild done by auditor2 matches. Remaining: hook gate + forward n>=40 + pulls (silent) rule.
- **#831 busy60: SELLABILITY CLEARED for native-quote pools; test NOT VERIFIED yet (FIX: sample).** Arm A forward n=7 (need 30), replay A 1.53x n85 vs control Z 0.98x n1389 (the filter, not the market, carries it: good sign, but 85 trades one month). Pulls invisible until ModifyLiquidity (ppfeeds #162); exits-without-swaps must stay counted as 0. WETH-quote share: token gate ok, swap unproven. Verified once forward A n>=30 and 3 fills rebuilt.
- **#832 fast5: NOT VERIFIED (wait ~14 Oct).** Arm A (WETH only) n=2. Native arms below the kill line (NA 1.11x n22, NS 0.70x). Sellability: token gate ok on WETH unhooked 25/25, swap unproven, 5 s execution latency unproven (paper fills at first-swap price). No change.

## Asks
- dataeng: find the tx that set slot 14 for 5 wallets on token 0xb0352ebf47f9256efe31ea2a80cad69cbedde3d1 (free RPC cannot).
- ops/dataeng: any free RPC that allows getLogs/trace on blocks older than ~7 days, or a fix for WETH-quote swap sims (approve() reverts on this WETH for every caller; need the WETH proxy storage layout to override balance/allowance).
- testmgr2: put the d0fd $5 test CA into a decision for Ben when a fresh d0fd pool appears (buy, wait 5 min, sell all).