# Audit d0fd + h100s (auditor3, 10 Oct, #787 #788)
Scripts: /opt/crew/work/auditor3/{imp.py,resv.py,os.py,d0sell.py,tt*.py,rs.py} (free RPC only).

## d0fd (A tp5, native fee-100 unhooked, launcher 0xd0fd42..)  -> NOT VERIFIED (FIX: sellability proof)
1. Replay numbers reproduce: 30d replay arm A n=60, mean 3.74x, 48 tp (all exactly 4.676x = cap by design), 12 zeros (20%). Forward n=1 (4.68x) = no forward evidence yet.
2. Reserve / impact (the A2 "no reserve impact" worry): pool net ETH inflow at TP exit >= 0.5 ETH in 47/48 tp trades (median 1.29 ETH), so the pool can pay. Exact v4 concentrated-liquidity walk (buy 0.1 ETH at entry, sell all at exit, pool fee 0.01%, using the swap's liq and sqrtP): tp median 4.58x (min 4.06x), arm mean 3.62x vs reported 3.74x. Impact at 0.1 ETH is small: PASS. Our own 0.5 ETH exit is bigger than all outside ETH-sell volume in 35/48 cases, so size must stay <= 0.1 ETH.
3. Outside sellers: in all 48 tp pools there are outside ETH-sells at >= 3.5x price within -20..+120 s of our exit (median 4.5 sells, 0.27 ETH). 36/48 have >= 3 sells. PASS (price discovery is real, not only the launcher).
4. Sellability (eth_call, free): 12 most recent tp pools, token.transfer(PoolManager) from a fresh address with overridden balance reverts "salg spaerret" (Danish: sale blocked) in 12/12, any size 1M-32M tokens. The same transfer from REAL buyers (6 random sellers in pool 0x5b93.., different wallets, their real balance, block before their sell) succeeds 6/6, and a real buyer with balance forced to 30M tokens also passes. So the token has a custom sale lock keyed on the address (buyer state), not on size or balance. A fresh-address sim cannot prove sellability here (same case as the 0xcc hook, #326). Our live bot buys first, so it probably passes, but the rule is unknown (bytecode has Danish blacklist/lock strings, ~10 KB custom code).
5. Not done: hand rebuild of 3 fills from receipts; replay vs live (live has 1 pool).
Verdict: replay and impact are real; stays UNVERIFIED until a buy-then-sell proof: Ben $5 on a fresh d0fd pool (buy via router, sell at once; token address from the d0fd feed), or testmgr2 simulates buy+sell in one block from one address. Cheap check for testmgr2: log if a bought-wallet can sell (read tape sells by non-launcher tx.from, done above: yes).

## h100s (hooked WETH fee-100, hook 0x144, slot1 gate)  -> NOT VERIFIED (FIX)
- Forward evidence: arm A n=3 (on-time 2), control Z n=15 mean 1.50x with 8 zeros. Kill needs 40 trades. Far too small.
- Replay 3.40x n=107 uses the same 529 hooked pools the gate was derived on (in-sample): not independent. Need a split: choose gate on pools before 5 Oct, replay after.
- Sellability: free sell sim on the two forward tp pools (0xe7a8eb.., 0xb91c35..) reverts with empty data (sell_ok false), matching the earlier 0/62 for hook family 0x144. Empty revert may be sim incompatibility, but nothing proves a sell works. Ben $5 test still pending (#525/#528).
- Outside sellers and hand rebuild not done (n too small to be worth it now).
Verdict: UNVERIFIED. Fix list for testmgr2: (1) time-split replay; (2) on-time forward n>=40; (3) sellability proof via real sell; (4) re-submit then.