# Control check pilot — independent view 4

Checker 4 of 5. I worked alone and did not read any other view or any published summary (swarmcard.imd.site included). I only read public data. I did no exploit or bug hunting and sent no write or private requests.

## Method and read points

- **Ethereum (chain id 1):** I read the public JSON-RPC `https://ethereum-rpc.publicnode.com` with `cast` (Foundry). Reads ran at blocks **26398572–26398581**, 2026-11-12 11:30–11:33 UTC. No block was pinned, so each read is the latest block at that moment.
- **Robinhood Chain (chain id 4663, confirmed by `cast chain-id`):** I read the public RPC `https://rpc.mainnet.chain.robinhood.com`. Reads ran at blocks **112493273–112494208**, 2026-11-12 11:30–11:33 UTC.
- **Proxy detection:** I read the EIP-1967 slots with `cast storage <addr> <slot>`:
  - implementation slot `0x360894a1…2bbc`
  - admin slot `0xb5312768…6103`
  - beacon slot `0xa3f0ad74…3d50`
  - old OZ slot `0x7050c9e0…f8c3`

  I also checked the head of the runtime bytecode with `cast code`.
- **Source:**
  - Ethereum: the Blockscout explorer API `https://eth.blockscout.com/api/v2/smart-contracts/<addr>`. The UI page is `https://eth.blockscout.com/address/<addr>?tab=contract`.
  - Robinhood Chain: `https://robinhoodchain.blockscout.com` returned a Cloudflare challenge (HTTP 403, `cf-mitigated: challenge`) to scripted requests, so I used Sourcify instead: `https://sourcify.dev/server/v2/contract/4663/<addr>`.
  - I did not use Etherscan. Its API needs a key, and I did not log in anywhere.
- **Labels:** **FACT** means read directly from chain or explorer. **INFERENCE** means my reading of verified source code or bytecode. **UNKNOWN** means I could not establish it.
- **Time taken:** about 35 minutes of wall time for all eight contracts, roughly 4 minutes each. Contracts that share code (both Intakes) were faster. Proxies took longer.
- **Limit that applies everywhere:** I read the project's own source files in full or in their relevant parts. I did **not** check every imported library (OpenZeppelin, solady, LayerZero) line by line against upstream. The Robinhood proxy was built from a vendored folder `../upgrade-lab-20261105/vendor-extensibility/…`, and the Ethereum `TokenProxy` overrides `_unsafeAllowUninitialized()`, which upstream OpenZeppelin does not have. So the libraries used by contracts 1–3 are not stock. Anything I say about library behaviour is an INFERENCE.

### Roles found (lower case)

| address | chain | what it is | evidence |
|---|---|---|---|
| 0xbb145ca83272c3806d4ddc75ca1d5514789cf1c5 | RH: plain wallet (codesize 0). ETH: 23-byte code `0xef0100 63c0c19a282a1b52b07dd5a65b58948a07dae32b`, an EIP-7702 delegated EOA | founder/owner wallet | `cast codesize`, `cast code`, both chains, 11:33Z |
| 0x047f606fd5b2baa5f5c6c4ab8958e45cb6b054b7 | plain wallet on ETH and RH (codesize 0) | IMD owner wallet | `cast codesize`, 11:32Z |
| 0x8aca8890d34086d7a30b9c06fae25e0c3cda4cfa | RH plain wallet (codesize 0) | ClausAdministrator `operator` | `cast call 0x979d…dc46 "operator()(address)"`, RH block ~112494208 |
| 0x4e59b44847b379578588920ca78fbf26c0b4956c | ETH contract, 69 bytes | INFERENCE: the well-known keyless CREATE2 deterministic-deployment proxy. Its code only performs CREATE2, so it cannot call `onlyOwner` functions | `cast codesize`, ETH block ~26398581 |

---

## Summary table

| # | contract | proxy | owners (type) | mint / cap | pause | fees | delay | source |
|---|---|---|---|---|---|---|---|---|
| 1 | CLAUS (RH) | yes, transparent (OZ 5.5 style). impl 0xd687…4bff. admin ProxyAdmin 0xcbc4…22a8, owned by 0x979d…dc46 | token owner 0x979d…dc46 (contract, ClausAdministrator) → owner 0xbb14…f1c5 (wallet); operator 0x8aca…4cfa (wallet) | yes, owner `mint()`, **no cap**; adminMintedSupply = 0 so far | no transfer pause (only migration-claim pause) | no token fee; owner sets declared canonical pools (pool fee field) | no | yes (Sourcify full match) |
| 2 | ClausAdministrator (RH) | no | owner 0xbb14…f1c5 (wallet); operator 0x8aca…4cfa (wallet) | n/a (not a token) | n/a, but it can call pause/mint/upgrade on its managed targets | n/a | no | yes (Sourcify full match) |
| 3 | old CLAUS (ETH) | yes, transparent. impl 0x55d5…18a7. admin ProxyAdmin 0xfb4b…7a57, owner **0x0 (renounced)** | token owner 0xbb14…f1c5 (EIP-7702 delegated EOA) | no | no | no | no | yes |
| 4 | Claus NFT (ETH) | no | immutable `owner` 0xbb14…f1c5 | yes, any user via `requestMint` with 50,000 CLAUS backing; **cap 300** in code | no | no owner setter; VRF oracle fee is external | no | yes |
| 5 | Intake (ETH) | no | owner 0x047f…54b7 (wallet) | n/a | no | yes, owner `setPrice`, `setPayTo` | no | yes (Blockscout, partial match) |
| 6 | Intake (RH) | no | owner 0x047f…54b7 (wallet) | n/a | no | yes, owner `setPrice`, `setPayTo` | unknown (source not verified for this address) | unknown |
| 7 | IMD token (ETH) | no | owner 0x047f…54b7 (wallet) | yes, through LayerZero receive from peers the owner sets; no cap in the main file | unknown | unknown | unknown | yes |
| 8 | IMD seat NFT (ETH) | no | owner 0x4e59…956c (CREATE2 factory contract, no owner) | yes, free public `mint(id)`, **cap 2000**; totalSupply = 2000 | no | no | no | yes (Blockscout partial; Sourcify full match) |

---

## Per-contract detail

### 1. CLAUS token, Robinhood Chain: 0x163015276f3244bc2ccb78b4d69cc8a4069effac

**FACTS**
- **Proxy slots:** implementation slot = `0xd68727ddd50e8ba07e4be20d37a5ecf3dd814bff` and admin slot = `0xcbc4bbd337e62c926c995e66a231e5e2b0a722a8`. Read with `cast storage`, RH block 112493558, 11:31:25Z.
- **Bytecode:** the head embeds the admin as an immutable and checks selector `0x4f1ef286` (`upgradeToAndCall`).
- **Sourcify:** the proxy is a full match as `TransparentUpgradeableProxy`. The implementation is a full match as `MigrationToken`. The admin is a full match as OZ `ProxyAdmin`.
  - `https://sourcify.dev/server/v2/contract/4663/0x163015276f3244bc2ccb78b4d69cc8a4069effac`, verifiedAt 2026-11-06T00:10:58Z
  - implementation: same endpoint at `…/0xd68727ddd50e8ba07e4be20d37a5ecf3dd814bff`
- **Live reads (`cast call`, RH block ~112494208, 11:32:30Z):**
  - `owner()` = 0x979d5810d32292358639f25294472f01c95bdc46
  - `pendingOwner()` = 0x0
  - `totalSupply()` = 983872663400486075752008619
  - `adminMintedSupply()` = 0
  - `migrationPaused()` = true
  - `receiptSigner()` = 0xdbeae9444c38375a75d78ff3992cc5058a352d05 (codesize 0)
  - `initialReserveSupply()` = 991774322581396126684300341
- **ProxyAdmin:** `0xcbc4…22a8.owner()` = 0x979d…dc46.
- **ClausAdministrator:** `managedTarget(0x1630…effac)` = true and `managedTarget(0xcbc4…22a8)` = true.

**INFERENCES (from MigrationToken.sol)**
- **Mint:** `mint(address,uint256)` is `onlyOwner` and has **no cap**. `mintFromBurn` and `distributeSnapshot` only move tokens out of the pre-minted reserve; they are not new issuance.
- **Pause:** there is no transfer pause or blacklist. `setMigrationPaused` only gates `mintFromBurn`. `venueAllowed` is a pure function returning true, and `venueEnforcement` is Preferred.
- **Fees:** there is no transfer fee. The owner can call `setCanonicalPools`, which records declared Uniswap v4 pool keys with a fee field. That is a declaration only and is not enforced on transfers.
- **Upgrades:** the ProxyAdmin, through ClausAdministrator, can replace the implementation at any time. That means every answer above can change. No timelock exists in the proxy, the ProxyAdmin or the administrator.

```json
{"contract":"0x163015276f3244bc2ccb78b4d69cc8a4069effac","chain_id":4663,
"proxy":"yes","implementation":"0xd68727ddd50e8ba07e4be20d37a5ecf3dd814bff","admin":"0xcbc4bbd337e62c926c995e66a231e5e2b0a722a8","admin_owner":"0x979d5810d32292358639f25294472f01c95bdc46",
"owners":[{"role":"token owner (Ownable2Step)","address":"0x979d5810d32292358639f25294472f01c95bdc46","type":"contract","owned_by":"0xbb145ca83272c3806d4ddc75ca1d5514789cf1c5 (wallet); operator 0x8aca8890d34086d7a30b9c06fae25e0c3cda4cfa (wallet) can also execute"},{"role":"proxyadmin owner","address":"0x979d5810d32292358639f25294472f01c95bdc46","type":"contract","owned_by":"0xbb145ca83272c3806d4ddc75ca1d5514789cf1c5"}],
"mint":"yes","mint_cap":"no","pause":"no","fees":"no","delay":"no","source_verified":"yes",
"block":"robinhood 112493558-112494208, 2026-11-12T11:31-11:33Z",
"evidence":"cast storage eip1967 impl/admin slots; cast call owner(), adminMintedSupply(), migrationPaused(); cast call 0xcbc4..22a8 owner(); sourcify.dev/server/v2/contract/4663/<proxy|impl|admin> full match; MigrationToken.sol mint() onlyOwner without cap, no transfer hook"}
```

### 2. ClausAdministrator, Robinhood Chain: 0x979d5810d32292358639f25294472f01c95bdc46

**FACTS**
- All EIP-1967 slots are zero. Slot 0 = 0xbb14…f1c5, which is the Ownable `_owner`. Read with `cast storage`, RH block 112493558.
- Sourcify full match as `src/ClausAdministrator.sol:ClausAdministrator`, verifiedAt 2026-11-06T11:06:36Z.
- `owner()` = 0xbb145ca83272c3806d4ddc75ca1d5514789cf1c5 (RH codesize 0, plain wallet).
- `pendingOwner()` = 0x0.
- `operator()` = 0x8aca8890d34086d7a30b9c06fae25e0c3cda4cfa (RH codesize 0).
- These reads were at RH block ~112494208.

**INFERENCES (from source)**
- The owner, or the operator, can `execute()` any call on any managed target: the CLAUS proxy and its ProxyAdmin. That covers upgrade, mint and metadata.
- Only the owner can send `transferOwnership` through it. `renounceOwnership` is blocked.
- The owner can change the operator and the target list at once.
- There is no delay in this contract. It is not a token, so mint, pause and fees do not apply to it directly.

```json
{"contract":"0x979d5810d32292358639f25294472f01c95bdc46","chain_id":4663,
"proxy":"no","implementation":"none","admin":"none","admin_owner":"none",
"owners":[{"role":"owner (Ownable2Step)","address":"0xbb145ca83272c3806d4ddc75ca1d5514789cf1c5","type":"wallet"},{"role":"operator (may call execute)","address":"0x8aca8890d34086d7a30b9c06fae25e0c3cda4cfa","type":"wallet"}],
"mint":"no","mint_cap":"no","pause":"no","fees":"no","delay":"no","source_verified":"yes",
"block":"robinhood 112493558-112494208, 2026-11-12T11:31-11:33Z",
"evidence":"cast call owner(), pendingOwner(), operator(), managedTarget(address); cast codesize of owner/operator = 0; sourcify.dev/server/v2/contract/4663/0x979d5810d32292358639f25294472f01c95bdc46 full match. mint/pause/fees 'no' = not a token itself; it holds execute() power over contract 1 and its ProxyAdmin"}
```

### 3. Old CLAUS token, Ethereum: 0x1b54e762aa34cf6e28e9c082f2848e28e45da6b8

**FACTS**
- **Proxy slots:** implementation slot = 0x55d555bd85fed6ecf30fda9b4c76019b844218a7 and admin slot = 0xfb4b9d2ba3ef17787bfe3fd90c3ea7b319807a57. Read with `cast storage`, ETH block 26398575.
- **Blockscout:**
  - proxy: `TokenProxy`, fully verified 2026-10-04 (`https://eth.blockscout.com/address/0x1b54e762aa34cf6e28e9c082f2848e28e45da6b8?tab=contract`)
  - implementation: `ProtectedToken`, fully verified 2026-10-15
  - admin: OZ `ProxyAdmin`, fully verified
- **Live reads (`cast call`, ETH block ~26398581, 11:32:30Z):**
  - `0xfb4b…7a57.owner()` = **0x0000000000000000000000000000000000000000**
  - token `owner()` = 0xbb145ca83272c3806d4ddc75ca1d5514789cf1c5
  - `pendingOwner()` = 0x0
  - `totalSupply()` = 709042947478354457048853218
- `cast code 0xbb14…f1c5` on ETH = `0xef010063c0c19a282a1b52b07dd5a65b58948a07dae32b`, the EIP-7702 delegation designator.

**INFERENCES**
- **No more upgrades:** the ProxyAdmin owner is zero, so nobody can call `upgradeAndCall`. The implementation is fixed unless the non-stock vendored proxy library has some other path, which I did not audit.
- **ProtectedToken:**
  - no mint function; only a holder `burn`
  - no pause and no transfer hook
  - `maximumTotalTaxPips` is a pure constant and no transfer logic uses it
  - the owner can only call `updateMetadata`
- **Owner type:** the token owner is an EOA. On Ethereum it carries an EIP-7702 delegation to 0x63c0…ae32b, which I did not inspect. I list it as a "wallet (7702-delegated)".

```json
{"contract":"0x1b54e762aa34cf6e28e9c082f2848e28e45da6b8","chain_id":1,
"proxy":"yes","implementation":"0x55d555bd85fed6ecf30fda9b4c76019b844218a7","admin":"0xfb4b9d2ba3ef17787bfe3fd90c3ea7b319807a57","admin_owner":"0x0000000000000000000000000000000000000000",
"owners":[{"role":"token owner (Ownable2Step, metadata only)","address":"0xbb145ca83272c3806d4ddc75ca1d5514789cf1c5","type":"wallet","note":"eip-7702 delegated to 0x63c0c19a282a1b52b07dd5a65b58948a07dae32b on ethereum"},{"role":"proxyadmin owner","address":"0x0000000000000000000000000000000000000000","type":"none (renounced)"}],
"mint":"no","mint_cap":"no","pause":"no","fees":"no","delay":"no","source_verified":"yes",
"block":"ethereum 26398575-26398581, 2026-11-12T11:31-11:33Z",
"evidence":"cast storage eip1967 slots; cast call 0xfb4b..7a57 owner() = 0x0; cast call owner(); cast code 0xbb14.. = 0xef0100..; eth.blockscout.com/api/v2/smart-contracts/<proxy|impl|admin> is_verified true; ProtectedToken.sol has no mint/pause/fee logic"}
```

### 4. Claus NFT, Ethereum: 0x80396c7131159eb92e7e84839e51c9887a7a95d9

**FACTS**
- All EIP-1967 slots are zero. Read at ETH block 26398575.
- Blockscout: `ClausNFT`, fully verified 2026-10-05.
- `owner()` = 0xbb145ca83272c3806d4ddc75ca1d5514789cf1c5 and `totalSupply()` = 300. Read at ETH block ~26398581.

**INFERENCES (from ClausNFT.sol)**
- **Owner:** `owner` is `immutable` and there is no transfer function. The owner's only power is `openMint()`, a one-time switch.
- **Mint:** any address can mint through `requestMint()`, which needs a 50,000 CLAUS deposit plus the Chainlink VRF native fee. IDs come from a fixed pool of `CAPACITY = 300`. All 300 are minted now. Redeemed IDs can be reminted.
- **Pause:** `_update` adds no transfer restriction.
- **Fees:** the VRF fee comes from the external Chainlink wrapper. There is no owner fee, price or payee setter.

```json
{"contract":"0x80396c7131159eb92e7e84839e51c9887a7a95d9","chain_id":1,
"proxy":"no","implementation":"none","admin":"none","admin_owner":"none",
"owners":[{"role":"immutable owner (openMint only)","address":"0xbb145ca83272c3806d4ddc75ca1d5514789cf1c5","type":"wallet","note":"eip-7702 delegated eoa on ethereum"}],
"mint":"yes","mint_cap":"yes","pause":"no","fees":"no","delay":"no","source_verified":"yes",
"block":"ethereum 26398575-26398581, 2026-11-12T11:31-11:33Z",
"evidence":"cast storage eip1967 slots = 0; cast call owner(), totalSupply()=300; eth.blockscout.com/api/v2/smart-contracts/0x80396c7131159eb92e7e84839e51c9887a7a95d9 fully verified; ClausNFT.sol CAPACITY=300, owner immutable, only openMint gated"}
```

### 5. IMD Intake, Ethereum: 0xa43e6f75ee006411f79ac1c84120606c2330de82

**FACTS**
- EIP-1967 slots are zero. Slot 0 = 0x047f…54b7.
- Blockscout: `Intake`, verified (is_fully_verified false, so a partial match), verified_at 2026-10-10.
- **Live reads (ETH block ~26398581, 11:33Z):**
  - `owner()` = 0x047f606fd5b2baa5f5c6c4ab8958e45cb6b054b7 (codesize 0)
  - `pendingOwner()` = 0x0
  - `payTo()` = 0x4e0fa57bde726079356537e2f34d671e9f41adbc
  - `writer()` = 0x3d3c0df7c1a17d384545e9d7c8228897bd9625cb
  - `signer()` = 0x169b08ea234d7819eeabb246e34d8cd81e32279f
- I did not check the codesize of `payTo`, `writer` or `signer`.

**INFERENCES (from Intake.sol)**
- **Fees:** the owner can call `setPrice`, `setPayTo`, `setWriter`, `setSigner` and `setCallbackGas`, all `onlyOwner` with immediate effect.
- **Mint:** none; it is not a token.
- **Pause:** no pause. Setting a price to 0 makes an action unsellable (`ActionNotSold`), so the owner can stop sales that way.

```json
{"contract":"0xa43e6f75ee006411f79ac1c84120606c2330de82","chain_id":1,
"proxy":"no","implementation":"none","admin":"none","admin_owner":"none",
"owners":[{"role":"owner (Ownable2Step)","address":"0x047f606fd5b2baa5f5c6c4ab8958e45cb6b054b7","type":"wallet"}],
"mint":"no","mint_cap":"no","pause":"no","fees":"yes","delay":"no","source_verified":"yes",
"block":"ethereum 26398575-26398581, 2026-11-12T11:31-11:33Z",
"evidence":"cast call owner(), pendingOwner(), payTo(), writer(), signer(); cast codesize owner=0; eth.blockscout.com/api/v2/smart-contracts/0xa43e6f75ee006411f79ac1c84120606c2330de82 is_verified true (partial); Intake.sol setPrice/setPayTo onlyOwner, no timelock"}
```

### 6. IMD Intake, Robinhood Chain: 0xa43e6f75ee006411f79ac1c84120606c2330de82

**FACTS**
- Codesize is 7384, the same as on Ethereum. EIP-1967 slots are zero. Slot 0 = 0x047f…54b7.
- The runtime code hash differs from Ethereum:
  - RH: 0xd96f270d009efd0fda0a2da91bb7f835a2686182e3abccd18966984134d3b5e8
  - ETH: 0xdf76139e1b7dfe05bdf55e48e65076e4763a40d470fcf5da58034a488e30bdaf
- **Live reads (RH block ~112494208):**
  - `owner()` = 0x047f606fd5b2baa5f5c6c4ab8958e45cb6b054b7 (RH codesize 0)
  - `pendingOwner()` = 0x0
  - `payTo()`, `writer()` and `signer()` return the same values as on Ethereum
- Sourcify for chain 4663 returned `match: null`, meaning not verified there.
- Robinhood Blockscout returned a Cloudflare challenge, so I could not read its verification status.

**INFERENCES / UNKNOWN**
- **Same code?** The size and the bytecode head are identical. The different hash is consistent with differing immutables (EIP712 chain id or address cache), but I did not diff the bytes to prove that. So I answer from the getters only.
  - owner: FACT
  - fees "yes": FACT, because `setPrice` and `setPayTo` selectors exist and the getters respond
  - mint "no" and pause "no": INFERENCE by assuming the same code as Ethereum
  - delay: unknown, because no verified source exists for this address
- **source_verified:** unknown. It is "no" on Sourcify, and I could not read Blockscout.

```json
{"contract":"0xa43e6f75ee006411f79ac1c84120606c2330de82","chain_id":4663,
"proxy":"no","implementation":"none","admin":"none","admin_owner":"none",
"owners":[{"role":"owner","address":"0x047f606fd5b2baa5f5c6c4ab8958e45cb6b054b7","type":"wallet"}],
"mint":"no","mint_cap":"no","pause":"no","fees":"yes","delay":"unknown","source_verified":"unknown",
"block":"robinhood 112493558-112494208, 2026-11-12T11:31-11:33Z",
"evidence":"cast call owner(), pendingOwner(), payTo(), writer(), signer(); cast storage eip1967 slots = 0; codehash differs from ethereum copy; sourcify 4663 match null; robinhoodchain.blockscout.com blocked by cloudflare challenge (HTTP 403) so verification status unknown; mint/pause 'no' inferred from the ethereum source of same-size code"}
```

### 7. IMD token, Ethereum: 0xd34a99bc0f67ae1bbd63c660e6d0b0dd03e263b7

**FACTS**
- EIP-1967 slots are zero. Slot 0 = 0x047f…54b7.
- Blockscout: `BridgedFP`, fully verified 2026-03-28.
- **Live reads (ETH block ~26398581):**
  - `owner()` = 0x047f606fd5b2baa5f5c6c4ab8958e45cb6b054b7 (codesize 0)
  - `endpoint()` = 0x1a44076050125825900e736c501f859c50fe728c
  - `totalSupply()` = 4244003621776000000000000
  - `name()` = "Identity.md"
  - `pendingOwner()` reverts, so it is not Ownable2Step

**INFERENCES / UNKNOWN**
- **Mint:** BridgedFP extends LayerZero `OFT`. The main file has no mint function, and its owner functions only change name and symbol. In the standard OFT design, tokens are minted on receive (`_credit`) when the LayerZero endpoint delivers a message from a peer, and the owner sets peers with `setPeer`. So supply can grow through bridge messages the owner configures, with no cap. This is an INFERENCE from standard OFT behaviour: I did not read the vendored LayerZero library at this address line by line.
- **Pause:** unknown. The main file has none, and I did not audit the library.
- **Fees:** unknown, for the same reason. Messaging fees and enforced options are LayerZero configuration controlled by the owner/delegate in the standard library.
- **Delay:** unknown, for the same reason.

```json
{"contract":"0xd34a99bc0f67ae1bbd63c660e6d0b0dd03e263b7","chain_id":1,
"proxy":"no","implementation":"none","admin":"none","admin_owner":"none",
"owners":[{"role":"owner (Ownable) and layerzero delegate per constructor","address":"0x047f606fd5b2baa5f5c6c4ab8958e45cb6b054b7","type":"wallet"}],
"mint":"yes","mint_cap":"no","pause":"unknown","fees":"unknown","delay":"unknown","source_verified":"yes",
"block":"ethereum 26398575-26398581, 2026-11-12T11:31-11:33Z",
"evidence":"cast call owner(), endpoint(), totalSupply(); pendingOwner() reverts; eth.blockscout.com/api/v2/smart-contracts/0xd34a99bc0f67ae1bbd63c660e6d0b0dd03e263b7 fully verified BridgedFP is OFT; mint via OFT _credit on lzReceive from owner-set peers (inference, library not audited); pause/fees/delay unknown because layerzero library not read"}
```

### 8. IMD seat NFT, Ethereum: 0x0000ec93127baa929e58e97dd0095a2bfb38ec1d

**FACTS**
- EIP-1967 slots are zero.
- Blockscout: `IdentityMD`, verified (partial). Sourcify: `match` on chain 1, verifiedAt 2026-05-14T01:34:25Z.
- **Live reads (ETH block ~26398581):**
  - `owner()` = 0x4e59b44847b379578588920ca78fbf26c0b4956c (a contract, 69 bytes)
  - `totalSupply()` = 2000
  - `name()` = "identity.md"

**INFERENCES**
- **Mint:** public, free `mint(id)`, one per wallet, `MAX_SUPPLY = 2000` enforced. totalSupply is 2000, so it is fully minted. There is no burn in the main file.
- **Owner powers:** the `onlyOwner` setters (`setIdentityAllowed`, `setEpoch`, `setUniv4Hook`, `setUniv4Pool`) do not touch transfers. The `univ4*` values are only stored.
- **Who owns it:** the owner was set to `msg.sender` at deployment, which is the CREATE2 factory at 0x4e59…956c. That factory is keyless and only executes CREATE2 with its calldata. So nobody can effectively exercise the owner role. This depends on my identification of the 69-byte code as the standard deterministic-deployment proxy, which I did not disassemble here.

```json
{"contract":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","chain_id":1,
"proxy":"no","implementation":"none","admin":"none","admin_owner":"none",
"owners":[{"role":"owner (solady Ownable)","address":"0x4e59b44847b379578588920ca78fbf26c0b4956c","type":"contract","owned_by":"none (keyless create2 deployer; inference)"}],
"mint":"yes","mint_cap":"yes","pause":"no","fees":"no","delay":"no","source_verified":"yes",
"block":"ethereum 26398575-26398581, 2026-11-12T11:31-11:33Z",
"evidence":"cast call owner(), totalSupply()=2000; cast codesize 0x4e59..=69; eth.blockscout.com/api/v2/smart-contracts/0x0000ec93127baa929e58e97dd0095a2bfb38ec1d verified; sourcify.dev/server/v2/contract/1/0x0000ec93127baa929e58e97dd0095a2bfb38ec1d match; IdentityMD.sol MAX_SUPPLY=2000, public mint, onlyOwner setters do not affect transfers"}
```

---

## Open questions and notes for the summary step

1. **"mint" for non-tokens:** for contracts 2, 5 and 6 I answered "no" (not applicable). Other checkers may write "n/a", which is a wording ambiguity in the form.
2. **Contract 1 has two control paths:** the owner (ClausAdministrator) and the operator wallet. The form's `admin_owner` field only allows one address, so I put the contract and named the founder and operator in `owners`.
3. **Contract 3:** the ProxyAdmin owner is zero. Some checkers may answer `admin_owner` as "none" instead of the zero address.
4. **Contract 6 source status** depends on the explorer. Robinhood Blockscout could not be read by script here, and Sourcify had no match.
5. **Contract 7's pause, fees and delay** need a line-by-line read of the vendored LayerZero OFT library. I did not do that, so I answered unknown.
6. **EIP-7702 owner (0xbb14…f1c5 on ETH):** it has code, so a strict "contract or wallet" test via codesize would call it a contract. I call it a wallet: an EOA with a delegation.