diff --git a/onchain/script/backtesting/AttackRunner.s.sol b/onchain/script/backtesting/AttackRunner.s.sol
index 44c68ba..d0281b0 100644
--- a/onchain/script/backtesting/AttackRunner.s.sol
+++ b/onchain/script/backtesting/AttackRunner.s.sol
@@ -152,7 +152,8 @@ contract AttackRunner is Script {
     uint24 internal constant POOL_FEE = 10_000;
     address internal constant WETH = 0x4200000000000000000000000000000000000006;
     address internal constant SWAP_ROUTER = 0x94cC0AaC535CCDB3C01d6787D6413C739ae12bc4;
-    address internal constant NPM_ADDR = 0x27F971cb582BF9E50F397e4d29a5C7A34f11faA2;
+    // Base mainnet NonfungiblePositionManager — https://basescan.org/address/0x03a520B32c04bf3beef7BEb72E919cF822Ed34F3
+    address internal constant NPM_ADDR = 0x03a520B32c04bf3beef7BEb72E919cF822Ed34F3;
     address internal constant V3_FACTORY = 0x4752ba5DBc23f44D87826276BF6Fd6b1C372aD24;
 
     // ─── Anvil test accounts ──────────────────────────────────────────────────
diff --git a/onchain/test/FitnessEvaluator.t.sol b/onchain/test/FitnessEvaluator.t.sol
index 2fc5052..dc4025a 100644
--- a/onchain/test/FitnessEvaluator.t.sol
+++ b/onchain/test/FitnessEvaluator.t.sol
@@ -139,7 +139,8 @@ contract FitnessEvaluator is Test {
     uint24 internal constant POOL_FEE = 10_000;
     address internal constant WETH_ADDR = 0x4200000000000000000000000000000000000006;
     address internal constant SWAP_ROUTER = 0x94cC0AaC535CCDB3C01d6787D6413C739ae12bc4;
-    address internal constant NPM_ADDR = 0x27F971cb582BF9E50F397e4d29a5C7A34f11faA2;
+    // Base mainnet NonfungiblePositionManager — https://basescan.org/address/0x03a520B32c04bf3beef7BEb72E919cF822Ed34F3
+    address internal constant NPM_ADDR = 0x03a520B32c04bf3beef7BEb72E919cF822Ed34F3;
     address internal constant V3_FACTORY = 0x4752ba5DBc23f44D87826276BF6Fd6b1C372aD24;
     address internal constant FEE_DEST = 0xf6a3eef9088A255c32b6aD2025f83E57291D9011;
 
diff --git a/scripts/harb-evaluator/export-attacks.py b/scripts/harb-evaluator/export-attacks.py
index 8b8f1f4..3a0c391 100755
--- a/scripts/harb-evaluator/export-attacks.py
+++ b/scripts/harb-evaluator/export-attacks.py
@@ -34,7 +34,8 @@ from pathlib import Path
 # ── Constants (must match red-team.sh and AttackRunner.s.sol) ──────────────────
 WETH_ADDR = "0x4200000000000000000000000000000000000006"
 SWAP_ROUTER_ADDR = "0x94cC0AaC535CCDB3C01d6787D6413C739ae12bc4"
-NPM_ADDR = "0x27F971cb582BF9E50F397e4d29a5C7A34f11faA2"
+# Base mainnet NonfungiblePositionManager — https://basescan.org/address/0x03a520B32c04bf3beef7BEb72E919cF822Ed34F3
+NPM_ADDR = "0x03a520B32c04bf3beef7BEb72E919cF822Ed34F3"
 
 
 def _normalise_addr(addr: str) -> str:
diff --git a/scripts/harb-evaluator/red-team.sh b/scripts/harb-evaluator/red-team.sh
index 950c389..8a8bef3 100755
--- a/scripts/harb-evaluator/red-team.sh
+++ b/scripts/harb-evaluator/red-team.sh
@@ -40,7 +40,8 @@ RECENTER_PK=0x5de4111afa1a4b94908f83103eb1f1706367c2e68ca870fc3fb9a804cdab365a
 WETH=0x4200000000000000000000000000000000000006
 SWAP_ROUTER=0x94cC0AaC535CCDB3C01d6787D6413C739ae12bc4
 V3_FACTORY=0x4752ba5DBc23f44D87826276BF6Fd6b1C372aD24
-NPM=0x27F971cb582BF9E50F397e4d29a5C7A34f11faA2
+# Base mainnet NonfungiblePositionManager — https://basescan.org/address/0x03a520B32c04bf3beef7BEb72E919cF822Ed34F3
+NPM=0x03a520B32c04bf3beef7BEb72E919cF822Ed34F3
 POOL_FEE=10000
 
 # ── Logging helpers ────────────────────────────────────────────────────────────