{"assessments":[],"deployments":[],"fuzz":[],"identity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"interpretation":"Records acceptance and evidence. Neither completion nor an AI assessment establishes correctness, safety, or independent review.","jobId":"b03bb654-b15e-4c77-b747-dee0b1626176","kind":"shape:chain","nodes":[{"acceptedSubmissionHash":"58d82ad377b9d8d133c04849de7cd286356aa88c7975e39c38ffc26aa5d65039","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_economics","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"1b4eb06595cab1adbe42d7c4fb40f109d6d9a4760df212ced9dd23b87f1e8e1a","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_flow","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"ac40e518251cf2f1bf03c5e58b86216101d81a4155da65b022fae80bac8a501c","dependsOn":["build_contract_project","write_foundry_tests","manifest","audit_math","audit_permissions","audit_economics","audit_flow"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"af3aa01159bbf354f621cafa5c0006f6169e0938a8b015be508b7377dbf165bc","skillId":"audit-judge","tools":[]},"key":"audit_judge","kind":"code","role":"review","skillHash":"af3aa01159bbf354f621cafa5c0006f6169e0938a8b015be508b7377dbf165bc","skillId":"audit-judge","state":"accepted"},{"acceptedSubmissionHash":"59e9f977d032ffd496a92d42a87a1a94fe369350eb1e27dffc10e1154ef16f47","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_math","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"6a4cf011d11e0b9f41c1de892d41df62e4ee568a3cfacf35bd0f6a40a9ed904f","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_permissions","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"08a17dcf8e226c2294a16dc51dbac260650e4c9de7234f2634d6f194bd82e32b","dependsOn":[],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"d59561da3b378461b7c749f6bd5084477d44993aa94972ddea90f542535751df","skillId":"build-contract-project","tools":[]},"key":"build_contract_project","kind":"code","role":"implement","skillHash":"d59561da3b378461b7c749f6bd5084477d44993aa94972ddea90f542535751df","skillId":"build-contract-project","state":"accepted"},{"acceptedSubmissionHash":"076705a39988d9e7e3b7a44951305155211540c0286f63241c4cb7758819547a","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"tools":[]},"key":"manifest","kind":"code","role":"integrate","skillHash":null,"skillId":null,"state":"accepted"},{"acceptedSubmissionHash":"6fc0b2a941ec1d8943e95b4246e7a0bf2668b8e817ea4927b237b33fb019b607","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"4c76766b00591dfe982fe85d3de589fdb2f810e5137c301155d1c5e36a1d3b23","skillId":"write-foundry-tests","tools":[]},"key":"write_foundry_tests","kind":"code","role":"tests","skillHash":"4c76766b00591dfe982fe85d3de589fdb2f810e5137c301155d1c5e36a1d3b23","skillId":"write-foundry-tests","state":"accepted"}],"objective":"A custom token: SqueekChain (SQK).\nToken name: SqueekChain\nToken symbol: SQK\nToken supply: 1,000,000,000 with 18 decimals, all minted once to the deployer in the constructor.","parentJobId":null,"planHash":"fff2c6078cf6f6123d69bc145bb5763bfd60a74ea9aa05aa3ca7141d4c50c12d","previousHash":"0000000000000000000000000000000000000000000000000000000000000000","projectId":"b03bb654-b15e-4c77-b747-dee0b1626176","publication":{"commit":null,"deliveredAt":null,"repoUrl":"https://github.com/identity-md-launches/launch-2206-squeekchain"},"receiptIdentity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"registry":"0xb6d0a187b050fa5bb0b87033a203f37becf4a775","research":[],"schema":"identitymd-work-v1","signals":[{"agentId":"54230","feedbackHash":"5a3551d15eecac202cfe58cdf0dbafa7fb416f34d2b0124b7d3a074c4ec962b1","nodeKey":"audit_economics","submissionHash":"58d82ad377b9d8d133c04849de7cd286356aa88c7975e39c38ffc26aa5d65039","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52603","feedbackHash":"b1aefe8bb64b9ded170cc6f66afd2dab639fe725c5d884eba49449c04664c6d8","nodeKey":"audit_flow","submissionHash":"1b4eb06595cab1adbe42d7c4fb40f109d6d9a4760df212ced9dd23b87f1e8e1a","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51064","feedbackHash":"66ffbc7795c101a1b3bbd965f20ab66a2bc800c01db11d6095d526a29a7da076","nodeKey":"audit_judge","submissionHash":"ac40e518251cf2f1bf03c5e58b86216101d81a4155da65b022fae80bac8a501c","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52612","feedbackHash":"bc2b9d2c51dbad7b6e8d775a08ec0a3bf60cbb91f0d297f667cb2504e6eb9467","nodeKey":"audit_math","submissionHash":"59e9f977d032ffd496a92d42a87a1a94fe369350eb1e27dffc10e1154ef16f47","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51021","feedbackHash":"9f7d672f4c52dc137d949d442d0e30abd5fed4792f099a3d7a9338030caf889a","nodeKey":"audit_permissions","submissionHash":"6a4cf011d11e0b9f41c1de892d41df62e4ee568a3cfacf35bd0f6a40a9ed904f","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51549","feedbackHash":"dba8931ed8e6e8e8d37fec94dce37869006634188e4a0e4cbad0d1265130e353","nodeKey":"build_contract_project","submissionHash":"08a17dcf8e226c2294a16dc51dbac260650e4c9de7234f2634d6f194bd82e32b","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"51544","feedbackHash":"9a6c139968d4a1d71fb16cb6b882ca0097450aee3030410fd48bea91bb643c34","nodeKey":"manifest","submissionHash":"076705a39988d9e7e3b7a44951305155211540c0286f63241c4cb7758819547a","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"51018","feedbackHash":"f92c78fc156339aec7094a3882aa2ee70fd27ec989973d15dd555e47746865e8","nodeKey":"write_foundry_tests","submissionHash":"6fc0b2a941ec1d8943e95b4246e7a0bf2668b8e817ea4927b237b33fb019b607","tag1":"verification:checks","tag2":"acceptance-v2","value":1}],"site":null,"snapshotHash":"dc5dea044dad92e48d58890a0ecf3ea066f3480205448977cad9808f945c0b25","state":"completed","submissions":[{"artifacts":[],"attempt":1,"bundleHash":"39015912f4c6b24144778a186959ca7f1277b12235ad835ddb9a1ade22e2d439","device":"cf6bec70b883c22a","findings":[],"hash":"076705a39988d9e7e3b7a44951305155211540c0286f63241c4cb7758819547a","nodeId":"08e123b2-f1ee-4246-98b6-4b7021179d1b","outcome":"completed","summary":"Created `launch.json` with the correct SqueekChain supply, empty constructor arguments, no application contracts, and exact pool/economics values.\n\n`forge build` succeeded; all 34 tests passed with the supplied fuzz seed. Only `launch.json` is changed for submission.","treeHash":"b9ac3f7414ce896b48fcafd058ae325a7588d050","usage":{"cachedInputTokens":188160,"inputTokens":26196,"model":"gpt-6-astra","outputTokens":2478,"runtime":"codex","turns":3,"wallClockMs":66276}},{"artifacts":[],"attempt":1,"bundleHash":"2ab1cae1f5215ce72570e7b747ddb210154531262f9a8d45f6d67f5e8a713a00","device":"d25fbf67753e5494","findings":[],"hash":"08a17dcf8e226c2294a16dc51dbac260650e4c9de7234f2634d6f194bd82e32b","nodeId":"1a9f5624-5d99-4140-ac0f-a241b530142d","outcome":"completed","summary":"Implemented SQK: 1 billion tokens, 18 decimals, minted once to the deployer. Included vendored dependencies, deployment documentation, and success/failure tests.\n\nPassed:\n- `forge build`\n- `forge test` — 34 tests, specified fuzz seed\n- `forge fmt --check`\n\nFull protected launch checks require the separate verifier’s infrastructure.","treeHash":"8f7c6bb7fd20dbaae68195429766d68ebb330d0c","usage":{"cachedInputTokens":411648,"inputTokens":66268,"model":"gpt-6-astra","outputTokens":14749,"runtime":"codex","turns":5,"wallClockMs":330178}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"7e64d4917fa814e6","findings":[{"citation":"resolved","description":"Periphery: the README (line 71) lists `sha256sum -c dependencies.sha256` as part of the build-and-test procedure and says (line 101) that the file records the hashes of the vendored files. It does not. Seven of the 30 forge-std entries record the hash of the upstream v1.9.7 file, while the file actually vendored under lib/forge-std/src/ is a reformatted copy (long signatures and the console.sol assembly block were re-wrapped to the project's 120-column style). I downloaded the pinned archive named in dependencies.json (its sha256 45157353...ee94 matches), and for each of the seven files the recorded hash equals the upstream file's hash and differs from the vendored file's hash; stripping all whitespace from both copies makes them byte-identical, so the drift is formatting only. The six OpenZeppelin entries and the other 23 forge-std entries verify. Impact: the project's own supply-chain record cannot be used to verify the tree as shipped, and anyone following the README's instructions gets a failed check. forge-std is test-only, so the compiled token (src/SqueekChain.sol, 1752 runtime bytes) is unaffected. Fix: either re-vendor the seven files byte-for-byte from the v1.9.7 archive (so the recorded upstream hashes hold and the `ignore = [\"lib/**\"]` fmt rule keeps them that way), or regenerate dependencies.sha256 from the files actually in the tree and state in the README that forge-std was reformatted.","line":18,"path":"dependencies.sha256","reproduction":"State: the repository at HEAD 5073f13 as checked out. Input: run `sha256sum -c dependencies.sha256` from the repository root, as README.md line 71 instructs. Expected: every line reports OK and the exit status is 0. Actual: exit status 1 with `sha256sum: WARNING: 7 computed checksums did NOT match`, the failing lines being lib/forge-std/src/StdAssertions.sol, StdJson.sol, StdToml.sol, Vm.sol, console.sol, interfaces/IERC7540.sol and interfaces/IMulticall3.sol. For Vm.sol the file records 9068805b59ac1d0e... (the upstream v1.9.7 hash) while `sha256sum lib/forge-std/src/Vm.sol` gives a1b1c82924aecf0f.... `cmp <(tr -d ' \\t\\n\\r' < upstream/src/Vm.sol) <(tr -d ' \\t\\n\\r' < lib/forge-std/src/Vm.sol)` reports no difference, confirming whitespace-only drift.","severity":"low","snippet":"9068805b59ac1d0ea03a8fa1f15ae49c094e0c6c852a2500e0dd112f264b2cb1  lib/forge-std/src/Vm.sol","title":"dependencies.sha256 does not match the vendored forge-std files, so the documented integrity check fails"},{"citation":"resolved","description":"Execution Trace, approval residuals: SqueekChain inherits OpenZeppelin v5.0.2 ERC20 unchanged, whose approve(spender, value) overwrites the allowance rather than adjusting it, and v5 ships no increaseAllowance/decreaseAllowance. A spender watching the mempool can consume the old allowance before the owner's replacement approve lands, then consume the new one. This is the standard ERC-20 approve race; it is not a departure from the requested design (ordinary ERC-20 transfers), the README's Behavior section already documents it and tells holders to revoke to zero first, and no funds move without the owner having granted an allowance to that spender. Recorded here so the judge has the concrete trace and can decide it needs no change; if the author wants to remove the race, adding increaseAllowance/decreaseAllowance (as in OZ v4) is the minimal change and preserves every launch flow.","line":10,"path":"src/SqueekChain.sol","reproduction":"State: owner holds the supply after deploying; spender has no balance. Calls: (1) owner: approve(spender, 10 ether). (2) owner broadcasts approve(spender, 5 ether) intending to lower the allowance. (3) spender, before (2) is mined: transferFrom(owner, spender, 10 ether) succeeds and sets allowance to 0. (4) (2) is mined: allowance becomes 5 ether. (5) spender: transferFrom(owner, spender, 5 ether) succeeds. Expected by the owner: spender can move at most 10 ether total (the larger of the two grants). Actual: spender's balance is 15 ether. Verified with a scratch Foundry test executing exactly this sequence with vm.prank; the final assertEq(balanceOf(spender), 15 ether) passes.","severity":"info","snippet":"contract SqueekChain is ERC20 {","title":"Allowance replacement is not atomic: a spender who front-runs approve(newValue) can spend old plus new allowance (inherent ERC-20 behaviour, documented)"}],"hash":"1b4eb06595cab1adbe42d7c4fb40f109d6d9a4760df212ced9dd23b87f1e8e1a","nodeId":"ec0dbd48-7afe-43c6-8b8f-bbe291af4ea2","outcome":"completed","summary":"Review complete. The findings file is written and validated, and the tree is otherwise untouched.\n\n**Outcome.** The SqueekChain token holds under the Execution Trace, Periphery and First Principles guides. It is twelve lines over an unmodified OpenZeppelin v5.0.2 ERC20, with one constructor mint of 1e27 units to the caller and no other state-changing path. All three ABI entry points behave as intended, and the existing 34-test suite passes. No critical, high or medium defect exists, so no proof test was attached.\n\n**Findings written to `.imd-findings.json`:**\n\n- **Low, integrity record is wrong.** The README instructs running `sha256sum -c dependencies.sha256`, and that command fails with 7 mismatches. The seven forge-std entries record the upstream v1.9.7 hashes, while the vendored copies were re-wrapped to 120 columns. I downloaded the pinned archive, confirmed its hash matches dependencies.json, and confirmed the drift is whitespace only. The compiled token is unaffected since forge-std is test-only. Fix is to re-vendor those seven files byte for byte or regenerate the hash file.\n- **Info, allowance replacement race.** Standard ERC-20 approve-overwrite behaviour, already documented in the README. A scratch test confirmed a front-running spender nets the old plus the new allowance. Recorded for the judge with the concrete trace, labelled as accepted design.\n\n**Coverage.** All three listed entry points have rows, plus five invariant rows covering the constructor mint, supply conservation, exact launch flows, and the vendored OpenZeppelin sources, which I read line by line and found genuine. Nothing in my area was left unreached.","treeHash":null,"usage":{"cachedInputTokens":646326,"inputTokens":322,"model":"claude-fable-5-1","outputTokens":13204,"runtime":"claude","turns":24,"wallClockMs":217242}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"aa333626543c4dee","findings":[{"citation":"resolved","description":"README.md line 71 lists `sha256sum -c dependencies.sha256` as one of the four commands that verify this tree, and the README states that forge-std v1.9.7 is vendored with per-file hashes recorded in dependencies.sha256. On the tree as delivered the command exits 1 and reports 7 files FAILED: lib/forge-std/src/StdAssertions.sol, StdJson.sol, StdToml.sol, Vm.sol, console.sol, interfaces/IERC7540.sol and interfaces/IMulticall3.sol. I fetched the same files from the forge-std v1.9.7 tag and compared: the recorded hashes equal the upstream files exactly, while the vendored copies differ from upstream only by `forge fmt` line-wrapping (multi-line function headers collapsed to one line, console.sol assembly reflowed). The code is semantically identical, so no production behaviour is affected and the five OpenZeppelin v5.0.2 files (ERC20.sol, IERC20.sol, IERC20Metadata.sol, Context.sol, draft-IERC6093.sol, LICENSE) are byte-identical to upstream. The defect is that the project's own integrity check, which a verifier or the launch's source-publication step would run from the README, fails on an unmodified checkout, which makes a genuine tampering of a vendored file indistinguishable from this formatting drift. Fix: either restore the seven files to their upstream bytes (the hashes already match upstream) or re-record their hashes; the first is preferable since dependencies.json claims the v1.9.7 tag and `fmt.ignore` already excludes lib/**.","line":5,"path":"dependencies.sha256","reproduction":"State: clean checkout of this tree. Run `sha256sum -c dependencies.sha256` from the repository root. Expected (per README.md line 71 and line 100-101): every line OK, exit 0. Actual: `lib/forge-std/src/StdAssertions.sol: FAILED` (and six more), `sha256sum: WARNING: 7 computed checksums did NOT match`, exit status 1. Confirming the direction of the drift: `sha256sum lib/forge-std/src/StdAssertions.sol` gives 3fbf4a025b4fc94eaca4c38c1f3dacb37bee10f12ee81994cfaf365ac1ce7384, while the upstream v1.9.7 file (https://raw.githubusercontent.com/foundry-rs/forge-std/v1.9.7/src/StdAssertions.sol) hashes to d4c89eec70d267dec6188461fbc74d3dc8c47e518d176a23417533a232ed9780, the value recorded on line 5. `diff` of the two shows only whitespace/line-wrapping changes.","severity":"low","snippet":"d4c89eec70d267dec6188461fbc74d3dc8c47e518d176a23417533a232ed9780  lib/forge-std/src/StdAssertions.sol","title":"Documented provenance check `sha256sum -c dependencies.sha256` fails: 7 vendored forge-std files were reformatted after their hashes were recorded"}],"hash":"58d82ad377b9d8d133c04849de7cd286356aa88c7975e39c38ffc26aa5d65039","nodeId":"92d7bb4d-c1c8-4145-8654-d39b38a8111c","outcome":"completed","summary":"The findings file is in place and excluded from git by the harness, as intended. Nothing else is needed; the review is complete.\n\n**Outcome.** The economics of SqueekChain hold. The token is a verbatim OpenZeppelin v5.0.2 ERC-20 with a single constructor mint of 10^27 units to msg.sender, no owner, no hooks, no fee, and no path that changes supply after construction. I report one low-severity defect, in the repository's provenance check rather than in the token.\n\n**What I verified in the assigned area.**\n- Economic Security: no external dependency, oracle, callback or sentinel branch exists. Transfers to the zero address revert, ETH sent to the token reverts, and the supply fits comfortably under 2^128 for Uniswap v4 liquidity math. The vendored production files are byte-identical to upstream OpenZeppelin v5.0.2, confirmed by fetching the tagged sources and diffing.\n- Invariants: total supply is constant and equals the sum of balances. Only the constructor reaches `_mint`, the ABI exposes no mint, burn, initialize or owner function, and selector probes for those revert. The project's invariant suite and my own 512-run fuzz both hold.\n- Flow Gap: the launch legs factory to distributor, factory to pool manager, factory to requester, distributor to claimant, and trader buy and sell all move exactly the requested amount with no partial state on failure. The factory cannot pull tokens back from a holder without an allowance. Infinite allowance is preserved and finite allowance is exhausted exactly.\n\n**The one finding.** The README lists `sha256sum -c dependencies.sha256` as a verification step, but on a clean checkout it exits 1 with seven forge-std files reported FAILED. The recorded hashes match upstream forge-std v1.9.7 exactly. The vendored copies were reformatted after hashing, with whitespace-only differences. Test tooling only, so no production impact, but the project's own integrity check cannot distinguish this drift from real tampering. The fix is to restore those seven files to their upstream bytes.\n\n**Coverage record.** All three listed entry points are marked `holds`, with four extra rows for the supply, conservation, launch-economics and provenance invariants. The findings file validates as JSON with one finding and seven coverage rows, and my scratch test directory has been removed.","treeHash":null,"usage":{"cachedInputTokens":736277,"inputTokens":418,"model":"claude-fable-5-1","outputTokens":13145,"runtime":"claude","turns":21,"wallClockMs":256749}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"fbdcf3c80b280e3b","findings":[],"hash":"59e9f977d032ffd496a92d42a87a1a94fe369350eb1e27dffc10e1154ef16f47","nodeId":"b39f1795-f8ae-4027-8e9b-61207bf00aa4","outcome":"completed","summary":"I found no math-precision, boundary or numerical-gap defects in SqueekChain, so `.imd-findings.json` has an empty findings list. It also holds coverage for all three entry points, each marked **holds**, plus one row for the supply invariant.\n\n**What I checked:**\n- **The contract:** `src/SqueekChain.sol` is a plain ERC-20 built on OpenZeppelin v5.0.2. It has no overrides, no fee or burn on transfer, and no mint or burn function after deployment. The OpenZeppelin `ERC20.sol` in `lib/` has no changes I could see; I compared it from memory, not against a fetched upstream copy.\n- **Supply:** `INITIAL_SUPPLY = 1_000_000_000 * 10 ** 18` is 1e27, far below the uint256 limit. It is minted once, to whoever deploys the contract, and `decimals()` returns 18 as required.\n- **`transfer` and `transferFrom`:** both check the sender's balance before subtracting without overflow checks. Adding to the recipient cannot overflow, because all balances together equal the fixed supply. Amounts arrive exactly, since nothing is taken in transit. I traced sending zero and sending a full balance.\n- **Allowances:** `transferFrom` checks the allowance before reducing it. An allowance set to the maximum uint256 is treated as unlimited and is never reduced, which is OpenZeppelin's intended behaviour.\n- **`approve`:** it stores the exact amount given and refuses a zero owner or spender. It does no arithmetic.\n- **Static analysis:** Slither reported nothing. Aderyn's \"large numeric literal\" note at `src/SqueekChain.sol:12` is about style only; the value is correct.\n\nThe existing test suite (34 tests) passes. I changed no files.","treeHash":null,"usage":{"cachedInputTokens":149922,"inputTokens":10,"model":"claude-opus-5-5","outputTokens":1971,"runtime":"claude","turns":5,"wallClockMs":29060}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"72ae9b5bbd1a54b6","findings":[{"citation":"resolved","description":"README.md (Build and test) lists `sha256sum -c dependencies.sha256` as one of the four checks a verifier should run, and the Dependencies section says individual vendored file hashes are recorded there. On the committed tree the check fails for seven forge-std files (StdAssertions.sol, StdJson.sol, StdToml.sol, Vm.sol, console.sol, interfaces/IERC7540.sol, interfaces/IMulticall3.sol). I compared each vendored file against upstream forge-std v1.9.7 from GitHub: every difference is whitespace only (multi-line function signatures reflowed onto one line, as `forge fmt` does), so the vendored code is semantically identical to upstream and no behaviour changes. The production dependency is unaffected: all five vendored OpenZeppelin v5.0.2 files match both dependencies.sha256 and upstream byte for byte. The defect is that the repository's own supply-chain claim is unverifiable as documented: a reviewer following the README gets a FAILED result and cannot distinguish a cosmetic reflow from a tampered test harness without re-fetching upstream themselves. Fix: regenerate dependencies.sha256 from the committed lib/ tree (or restore the seven files to their upstream byte-exact form) so the documented command passes. Test-only dependency; not in my assigned area (Access Control / Trust Gap / Asymmetry), reported because it is reproducible.","line":5,"path":"dependencies.sha256","reproduction":"In the repository root run `sha256sum -c dependencies.sha256`. Expected (per README): every line prints `: OK`. Actual: `lib/forge-std/src/StdAssertions.sol: FAILED`, `lib/forge-std/src/StdJson.sol: FAILED`, `lib/forge-std/src/StdToml.sol: FAILED`, `lib/forge-std/src/Vm.sol: FAILED`, `lib/forge-std/src/console.sol: FAILED`, `lib/forge-std/src/interfaces/IERC7540.sol: FAILED`, `lib/forge-std/src/interfaces/IMulticall3.sol: FAILED`, then `sha256sum: WARNING: 7 computed checksums did NOT match`. Confirming the difference is whitespace-only: `diff <(curl -sL https://raw.githubusercontent.com/foundry-rs/forge-std/v1.9.7/src/Vm.sol | tr -d ' \\n\\t') <(tr -d ' \\n\\t' < lib/forge-std/src/Vm.sol)` prints nothing, while `sha256sum lib/forge-std/src/Vm.sol` differs from the hash recorded on the dependencies.sha256 line for Vm.sol.","severity":"low","snippet":"d4c89eec70d267dec6188461fbc74d3dc8c47e518d176a23417533a232ed9780  lib/forge-std/src/StdAssertions.sol","title":"Documented dependency integrity check fails: dependencies.sha256 does not match 7 vendored forge-std files"}],"hash":"6a4cf011d11e0b9f41c1de892d41df62e4ee568a3cfacf35bd0f6a40a9ed904f","nodeId":"0d233c03-1034-4a96-bc14-62cc9f91c6de","outcome":"completed","summary":"The review is complete. `.imd-findings.json` is written and valid, and the tree shows no other changes.\n\n**Result: the token's permission model holds.** SqueekChain is a bare OpenZeppelin v5.0.2 ERC20 with a constructor that mints the full supply to msg.sender and nothing else. There is no owner, role, initializer, proxy, hook, fee branch, mint, burn, pause or blacklist surface. The compiled ABI exposes only approve, transfer and transferFrom as state-changing functions, with no receive or fallback. I verified all five vendored OpenZeppelin files byte for byte against upstream v5.0.2, so the inherited guards are exactly the audited ones.\n\n**What I checked against the three guides**\n\n- Access Control: no role to escalate, no second writer with a weaker guard on balances or allowances, no initialization to front-run, no delegatecall. The constructor hands the supply to the factory, which is the intended launch trust assumption.\n- Asymmetry: transfer and transferFrom funnel into the same internal path, with transferFrom adding only the allowance spend. Zero-address checks are symmetric on both sides. The only asymmetric event emission is OpenZeppelin v5 design and is documented in the README.\n- Trust Gap: with no privileged actor after deployment, the access-by-economics and access-by-asymmetry seams have no actor to exploit them.\n\n**One low finding, outside my area.** The README directs verifiers to run `sha256sum -c dependencies.sha256`, and that check fails on seven forge-std files. I compared each against upstream forge-std v1.9.7 and every difference is whitespace only, so the test harness code is unchanged. The defect is a stale hash list that makes the repo's own supply-chain claim fail as documented. The fix is to regenerate the hash file from the committed lib tree.\n\n**Checks run:** forge build, the full test suite of 34 unit, fuzz and invariant tests, forge fmt --check, the sha256 check, and upstream comparisons for every vendored file. Build, tests and fmt all pass. Slither and aderyn leads were reviewed. The aderyn large-literal line is the supply constant, which evaluates to exactly 10^27.\n\n**Coverage:** all three entry points are marked holds, plus five invariant rows covering the constructor mint, the absent privilege surface, the paired-function symmetry, the vendored production dependency, and the documented repository checks, the last of which points at the finding.","treeHash":null,"usage":{"cachedInputTokens":990490,"inputTokens":386,"model":"claude-fable-5-1","outputTokens":13816,"runtime":"claude","turns":21,"wallClockMs":297398}},{"artifacts":[],"attempt":1,"bundleHash":"73890ddfeb7f37e4bd77dab3ffcd78007b61e8ca19040a24ad63f20ce6d7103f","device":"30a6c1a419ef4f9c","findings":[],"hash":"6fc0b2a941ec1d8943e95b4246e7a0bf2668b8e817ea4927b237b33fb019b607","nodeId":"354a120e-2565-4e88-b4b8-794ab5d5a381","outcome":"completed","summary":"I added two test files on top of the existing suite. `forge build` succeeds and `forge test` passes with the verifier's fuzz seed: 49 tests in 5 suites, none failing or skipped.\n\n**What the token is:** `src/SqueekChain.sol` is a plain OpenZeppelin ERC-20 called SqueekChain (SQK). Its constructor mints 1,000,000,000 × 10¹⁸ to whoever deploys it. There is no fee, owner, mint, burn or pause, so nothing in it lets anyone change the supply or move or freeze a balance.\n\n**`test/SqueekChainFailurePathInvariant.t.sol`**\n- **One-call launch:** a helper contract deploys the token and splits the supply (10% swarm, 60% pool, the rest to the requester) in a single call, the way the factory would. A test checks that each share arrives exactly.\n- **Random call sequences:** a handler acts as six launch roles: distributor, pool manager, requester, claimant, trader and the deployer. It mixes normal transfers, approvals (including unlimited ones) and transfer-from calls with five kinds of call that must fail:\n  - sending more than the balance\n  - sending to the zero address\n  - spending more than the allowance\n  - spending more than the balance while within the allowance\n  - a stranger spending with no approval\n\n  Each failing call must revert with OpenZeppelin's exact error and leave balances, allowances and supply unchanged.\n- **Invariants:** the supply stays fixed and the six roles always hold all of it; balances and allowances match an independent model; the stranger never gets tokens or an allowance; no rejected call changed anything. A final check confirms the failing calls actually ran, so the suite can't pass without testing anything. Run counts are set in the file (256 runs, depth 64).\n\n**`test/SqueekChainEdgeCases.t.sol`**\n- **Unit tests for edge cases:**\n  - the zero address as sender or approver\n  - an owner using transfer-from on their own tokens without an allowance\n  - the exact balance limit (the full amount passes, one more fails)\n  - an allowance of one below the maximum still being used up\n  - spent allowance not being reusable\n  - `transfer`, `approve` and `transferFrom` each returning exactly `true`\n  - tokens sent to the token contract itself staying there\n- **Fuzz tests:** approving any value, spending more than the balance but within the allowance, chained transfers adding up, and the launch split at any pool share up to 90%.\n\n**Defects:** none found, so I didn't write `.imd-findings.json`. One thing that's expected, not a bug: tokens sent to the token contract's own address can never be recovered, because the contract has no rescue function. A test records this.\n\nThe new files are in `test/` and not committed. I didn't change anything outside `test/`.","treeHash":"6ad2e59cd14588c75e66b9e2d28b26351ca8d61b","usage":{"cachedInputTokens":359729,"inputTokens":16,"model":"claude-opus-5-5","outputTokens":13057,"runtime":"claude","turns":10,"wallClockMs":198689}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"63274cc86a9400de","findings":[{"citation":"resolved","description":"Merged from three specialists (audit_flow, audit_economics, audit_permissions), who all reported the same root cause. README.md line 71 lists `sha256sum -c dependencies.sha256` as one of the four build-and-test commands and line 101 says the file records the hashes of the vendored files. On the tree as committed the check fails for seven forge-std files: StdAssertions.sol, StdJson.sol, StdToml.sol, Vm.sol, console.sol, interfaces/IERC7540.sol and interfaces/IMulticall3.sol. I reproduced the failure and then fetched each of the seven from the forge-std v1.9.7 tag: in every case the hash recorded in dependencies.sha256 equals the upstream file's hash, and the vendored copy is byte-identical to upstream once all whitespace is stripped, so the drift is formatting only (forge fmt re-wrapping to the project's 120-column style, applied before `ignore = [\"lib/**\"]` was in place). The other 23 forge-std entries and all six OpenZeppelin entries verify; I separately confirmed the five OpenZeppelin v5.0.2 Solidity files are byte-identical to upstream. forge-std is test-only, so the compiled token is unaffected and no on-chain behaviour changes. Impact: the project's own supply-chain record cannot be used as documented, and a reviewer following the README cannot distinguish this cosmetic reflow from a tampered test harness without re-fetching upstream. Fix: restore the seven files to their upstream bytes (the recorded hashes already match upstream and the fmt ignore rule keeps them untouched), or regenerate dependencies.sha256 from the committed lib/ tree and note the reformatting in the README.","line":5,"path":"dependencies.sha256","reproduction":"State: clean checkout of this tree (HEAD 633874b). Input: from the repository root run `sha256sum -c dependencies.sha256` (on macOS `shasum -a 256 -c dependencies.sha256`), as README.md line 71 instructs. Expected: every line reports OK and the exit status is 0. Actual: `lib/forge-std/src/StdAssertions.sol: FAILED`, `lib/forge-std/src/StdJson.sol: FAILED`, `lib/forge-std/src/StdToml.sol: FAILED`, `lib/forge-std/src/Vm.sol: FAILED`, `lib/forge-std/src/console.sol: FAILED`, `lib/forge-std/src/interfaces/IERC7540.sol: FAILED`, `lib/forge-std/src/interfaces/IMulticall3.sol: FAILED`, then `WARNING: 7 computed checksums did NOT match`. Direction of the drift: `curl -sL https://raw.githubusercontent.com/foundry-rs/forge-std/v1.9.7/src/StdAssertions.sol | sha256sum` gives d4c89eec70d267de..., the value recorded on line 5, while the vendored file hashes differently; `cmp <(tr -d ' \\t\\n\\r' < upstream/StdAssertions.sol) <(tr -d ' \\t\\n\\r' < lib/forge-std/src/StdAssertions.sol)` reports no difference. The same holds for the other six files.","severity":"low","snippet":"d4c89eec70d267dec6188461fbc74d3dc8c47e518d176a23417533a232ed9780  lib/forge-std/src/StdAssertions.sol","title":"Documented integrity check `sha256sum -c dependencies.sha256` fails: seven vendored forge-std files were reformatted after their upstream hashes were recorded"},{"citation":"resolved","description":"Reported by audit_flow; kept as information only. SqueekChain inherits OpenZeppelin v5.0.2 ERC20 unchanged. Its approve(spender, value) overwrites the allowance rather than adjusting it, and v5 ships no increaseAllowance/decreaseAllowance. A spender who sees a replacement approve in the mempool can spend the old allowance first, then the new one. This is the standard ERC-20 approve race, not a departure from the requested design (ordinary ERC-20 transfers); README.md's Behavior section documents it and tells holders to revoke to zero first, and no funds move without the holder having granted that spender an allowance. Recorded so the trace is on file; the author need not change anything. If they want to remove the race, adding increaseAllowance/decreaseAllowance is the minimal change and leaves every launch flow intact.","line":10,"path":"src/SqueekChain.sol","reproduction":"State: owner deploys SqueekChain and holds the supply; spender holds nothing. Calls: (1) owner: approve(spender, 10 ether). (2) owner broadcasts approve(spender, 5 ether) to lower the allowance. (3) spender, before (2) is mined: transferFrom(owner, spender, 10 ether) succeeds; allowance is 0. (4) (2) is mined; allowance becomes 5 ether. (5) spender: transferFrom(owner, spender, 5 ether) succeeds. Expected by the owner: spender moves at most 10 ether. Actual: spender's balance is 15 ether. Verified with a scratch Foundry test running exactly this sequence under vm.prank; assertEq(balanceOf(spender), 15 ether) passes and totalSupply is unchanged at 1e27.","severity":"info","snippet":"contract SqueekChain is ERC20 {","title":"Allowance replacement is not atomic: a spender who front-runs approve(newValue) can spend old plus new allowance (inherent ERC-20 behaviour, already documented; no change required)"}],"hash":"ac40e518251cf2f1bf03c5e58b86216101d81a4155da65b022fae80bac8a501c","nodeId":"457295b0-1b6e-4f84-b533-adbde851ca6a","outcome":"completed","summary":"Review complete. The findings file is written and validated, the working tree is otherwise untouched, and the scratch test was removed.\n\n**Outcome:** the token is clean. SqueekChain is 17 lines inheriting OpenZeppelin v5.0.2 ERC20 unchanged, with a no-argument constructor that mints exactly 1e27 units to the factory. All three entry points hold, the manifest matches the constructor and supply, bytecode sizes are far below the limits, and the project's 49 tests plus `forge fmt --check` pass.\n\n**Findings kept in `.imd-findings.json`:**\n\n- **Low, merged from three specialists:** the documented `sha256sum -c dependencies.sha256` check fails on seven forge-std files. I reproduced the failure and fetched each file from the v1.9.7 tag. The recorded hashes equal upstream, and the vendored copies match upstream byte for byte once whitespace is stripped, so the drift is formatting only. forge-std is test-only, so no production behaviour is affected. The five vendored OpenZeppelin files are byte-identical to upstream.\n- **Info, from audit_flow:** the standard ERC-20 approve race. Reproduced with a scratch test where a front-running spender ends up with old plus new allowance. The README already documents it, and it is inherent to the requested ordinary ERC-20 design, so no change is required.\n\n**Dropped or absent:** nothing was dropped, since every specialist finding reproduced. The aderyn large-numeric-literal lead is the supply constant written with underscores and exponent, which is correct and not a defect. My own pass over the code against the Pashov, x-ray, Trail of Bits and ethskills checklists found nothing the specialists missed.\n\n**Coverage record:** all three ABI entry points answered as holds, plus rows for constructor and launch deployability and for the vendored dependencies.","treeHash":null,"usage":{"cachedInputTokens":449831,"inputTokens":258,"model":"claude-fable-5-1","outputTokens":8072,"runtime":"claude","turns":11,"wallClockMs":134008}}],"verification":[{"checks":[{"durationMs":1109,"exitCode":0,"name":"build","output":"Compiling 28 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.05s\nCompiler run successful!\n","passed":true},{"durationMs":1819,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 2 tests for test/SqueekChainLaunch.t.sol:SqueekChainLaunchTest\n[PASS] test_Create2FactoryReceivesEntireSupply() (gas: 56297)\n[PASS] test_LaunchTransferRoutesDeliverExactAmounts() (gas: 453691)\nSuite result: ok. 2 passed; 0 failed; 0 skipped; finished in 15.47ms (558.08µs CPU time)\n\nRan 31 tests for test/SqueekChain.t.sol:SqueekChainTest\n[PASS] testFuzz_ApprovedTransferConservesSupply(uint256,uint256) (runs: 512, μ: 169408, ~: 170076)\nLogs:\n  Bound result 781931607940288561962489293\n  Bound result 115792089237316195423570985008687907853269984665640564039457584007913129639934\n\n[PASS] testFuzz_RevertWhenTransferExceedsAllowance(uint256,uint256) (runs: 512, μ: 127581, ~: 128242)\nLogs:\n  Bound result 999999999999999999999999998\n  Bound result 999999999999999999999999999\n\n[PASS] testFuzz_RevertWhenTransferExceedsBalance(uint256) (runs: 512, μ: 61616, ~: 61933)\nLogs:\n  Bound result 115792089237316195423570985008687907853269984665639564039457584007913436464522\n\n[PASS] testFuzz_SelfTransferPreservesBalance(uint256) (runs: 512, μ: 57775, ~: 57518)\nLogs:\n  Bound result 13\n\n[PASS] testFuzz_TransferConservesSupply(address,uint256) (runs: 512, μ: 99697, ~: 99924)\nLogs:\n  Bound result 196423279093139048016742507\n\n[PASS] test_AllowanceIsScopedToOwnerAndSpender() (gas: 140063)\n[PASS] test_ApprovalDoesNotRequireBalance() (gas: 80320)\n[PASS] test_ApproveEmitsEventAndReplacesAllowance() (gas: 126956)\n[PASS] test_ConstructorEmitsExactlyOneMint() (gas: 12268)\n[PASS] test_DeployerCannotSpendHolderFundsWithoutApproval() (gas: 98257)\n[PASS] test_EntireSupplyCanBeTransferred() (gas: 88734)\n[PASS] test_MaximumAllowanceIsNotReduced() (gas: 136420)\n[PASS] test_MetadataAndInitialSupply() (gas: 111827)\n[PASS] test_NoMintBurnPauseSeizureOrUpgradeEntrypoints() (gas: 2952983)\n[PASS] test_RejectsNativeCurrencyAndUnknownCalls() (gas: 64659)\n[PASS] test_RevertWhenApproveZeroSpender() (gas: 40162)\n[PASS] test_RevertWhenTransferExceedsBalance() (gas: 57645)\n[PASS] test_RevertWhenTransferFromExceedsAllowance() (gas: 120587)\n[PASS] test_RevertWhenTransferFromExceedsBalanceRestoresAllowance() (gas: 113628)\n[PASS] test_RevertWhenTransferFromToZeroRestoresAllowance() (gas: 108694)\n[PASS] test_RevertWhenTransferFromZeroAddress() (gas: 37838)\n[PASS] test_RevertWhenTransferToZeroEvenForZeroAmount() (gas: 75150)\n[PASS] test_RevokeAllowancePreventsFurtherSpending() (gas: 136598)\n[PASS] test_RuntimeFitsAndHasNoForbiddenOpcodes() (gas: 1033564)\n[PASS] test_SelfTransferFromConsumesAllowanceWithoutChangingBalance() (gas: 112539)\n[PASS] test_TransferDeliversExactAmountAndEmitsEvent() (gas: 96219)\n[PASS] test_TransferFromExhaustsAllowance() (gas: 166625)\n[PASS] test_TransferFromSpendsFiniteAllowanceAndEmitsTransfer() (gas: 177524)\n[PASS] test_TransferToContractDoesNotCallRecipient() (gas: 174185)\n[PASS] test_ZeroTransferFromEmptyAccountEmitsEvent() (gas: 63057)\n[PASS] test_ZeroTransferFromNeedsNoAllowance() (gas: 56349)\nSuite result: ok. 31 passed; 0 failed; 0 skipped; finished in 15.86ms (87.87ms CPU time)\n\nRan 1 test for test/SqueekChainInvariant.t.sol:SqueekChainInvariantTest\n[PASS]\nSqueekChainInvariantTest invariants:\n[PASS] invariant_AllowancesMatchModel\n[PASS] invariant_SupplyAndBalancesMatchModel\n SqueekChainInvariantTest invariants (runs: 128, calls: 8192, reverts: 0)\n\n╭--------------+--------------+-------+---------+----------╮\n| Contract     | Selector     | Calls | Reverts | Discards |\n+==========================================================+\n| TokenHandler | approve      | 2715  | 0       | 0        |\n|--------------+--------------+-------+---------+----------|\n| TokenHandler | transfer     | 2717  | 0       | 0        |\n|--------------+--------------+-------+---------+----------|\n| TokenHandler | transferFrom | 2760  | 0       | 0        |\n╰--------------+--------------+-------+---------+----------╯\n\nLogs:\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 204\n  Bound result 0\n  Bound result 0\n  Bound result 15\n  Bound result 0\n  Bound result 148\n  Bound result 0\n  Bound result 0\n  Bound result 1\n  Bound result 3256\n  Bound result 101962382403162511107185203\n  Bound result 10\n  Bound result 1473\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 1162\n  Bound result 3714247998\n  Bound result 6000000000000000000\n  Bound result 3345\n  Bound result 0\n  Bound result 6000000000000003375\n  Bound result 4\n  Bound result 0\n  Bound result 5504\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 3\n  Bound result 3\n  Bound result 0\n  Bound result 7\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 1.75s (1.74s CPU time)\n\nRan 3 test suites in 1.75s (1.78s CPU time): 34 tests passed, 0 failed, 0 skipped (34 total tests)\n","passed":true},{"durationMs":29,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"SqueekChain.approve(address,uint256)\",\"SqueekChain.transfer(address,uint256)\",\"SqueekChain.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"LICENSE\":21,\"README.md\":121,\"dependencies.json\":18,\"dependencies.sha256\":36,\"foundry.toml\":23,\"launch.json\":24,\"remappings.txt\":2,\"src/SqueekChain.sol\":17,\"test/SqueekChain.t.sol\":399,\"test/SqueekChainInvariant.t.sol\":97,\"test/SqueekChainLaunch.t.sol\":76},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"076705a39988d9e7e3b7a44951305155211540c0286f63241c4cb7758819547a","verifiedTreeHash":"b9ac3f7414ce896b48fcafd058ae325a7588d050","verifierVersion":"0.1.0+a6ee6548"},{"checks":[{"durationMs":2578,"exitCode":0,"name":"build","output":"Compiling 28 files with Solc 0.8.26\nSolc 0.8.26 finished in 2.42s\nCompiler run successful!\n","passed":true},{"durationMs":3162,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 2 tests for test/SqueekChainLaunch.t.sol:SqueekChainLaunchTest\n[PASS] test_Create2FactoryReceivesEntireSupply() (gas: 56297)\n[PASS] test_LaunchTransferRoutesDeliverExactAmounts() (gas: 453691)\nSuite result: ok. 2 passed; 0 failed; 0 skipped; finished in 23.41ms (770.31µs CPU time)\n\nRan 31 tests for test/SqueekChain.t.sol:SqueekChainTest\n[PASS] testFuzz_ApprovedTransferConservesSupply(uint256,uint256) (runs: 512, μ: 169408, ~: 170076)\nLogs:\n  Bound result 1231072448518949699808\n  Bound result 115792089237316195423570985008687907853269984665640564038226520258553819704672\n\n[PASS] testFuzz_RevertWhenTransferExceedsAllowance(uint256,uint256) (runs: 512, μ: 127581, ~: 128242)\nLogs:\n  Bound result 44420060232844062969073126\n  Bound result 955579960324556871001941082\n\n[PASS] testFuzz_RevertWhenTransferExceedsBalance(uint256) (runs: 512, μ: 61616, ~: 61933)\nLogs:\n  Bound result 115792089237316195423570985008687907853269984665639564039655634434356588057983\n\n[PASS] testFuzz_SelfTransferPreservesBalance(uint256) (runs: 512, μ: 57775, ~: 57518)\nLogs:\n  Bound result 13\n\n[PASS] testFuzz_TransferConservesSupply(address,uint256) (runs: 512, μ: 99697, ~: 99924)\nLogs:\n  Bound result 946810261643486391816540532\n\n[PASS] test_AllowanceIsScopedToOwnerAndSpender() (gas: 140063)\n[PASS] test_ApprovalDoesNotRequireBalance() (gas: 80320)\n[PASS] test_ApproveEmitsEventAndReplacesAllowance() (gas: 126956)\n[PASS] test_ConstructorEmitsExactlyOneMint() (gas: 12268)\n[PASS] test_DeployerCannotSpendHolderFundsWithoutApproval() (gas: 98257)\n[PASS] test_EntireSupplyCanBeTransferred() (gas: 88734)\n[PASS] test_MaximumAllowanceIsNotReduced() (gas: 136420)\n[PASS] test_MetadataAndInitialSupply() (gas: 111827)\n[PASS] test_NoMintBurnPauseSeizureOrUpgradeEntrypoints() (gas: 2952983)\n[PASS] test_RejectsNativeCurrencyAndUnknownCalls() (gas: 64659)\n[PASS] test_RevertWhenApproveZeroSpender() (gas: 40162)\n[PASS] test_RevertWhenTransferExceedsBalance() (gas: 57645)\n[PASS] test_RevertWhenTransferFromExceedsAllowance() (gas: 120587)\n[PASS] test_RevertWhenTransferFromExceedsBalanceRestoresAllowance() (gas: 113628)\n[PASS] test_RevertWhenTransferFromToZeroRestoresAllowance() (gas: 108694)\n[PASS] test_RevertWhenTransferFromZeroAddress() (gas: 37838)\n[PASS] test_RevertWhenTransferToZeroEvenForZeroAmount() (gas: 75150)\n[PASS] test_RevokeAllowancePreventsFurtherSpending() (gas: 136598)\n[PASS] test_RuntimeFitsAndHasNoForbiddenOpcodes() (gas: 1033564)\n[PASS] test_SelfTransferFromConsumesAllowanceWithoutChangingBalance() (gas: 112539)\n[PASS] test_TransferDeliversExactAmountAndEmitsEvent() (gas: 96219)\n[PASS] test_TransferFromExhaustsAllowance() (gas: 166625)\n[PASS] test_TransferFromSpendsFiniteAllowanceAndEmitsTransfer() (gas: 177524)\n[PASS] test_TransferToContractDoesNotCallRecipient() (gas: 174185)\n[PASS] test_ZeroTransferFromEmptyAccountEmitsEvent() (gas: 63057)\n[PASS] test_ZeroTransferFromNeedsNoAllowance() (gas: 56349)\nSuite result: ok. 31 passed; 0 failed; 0 skipped; finished in 25.29ms (124.21ms CPU time)\n\nRan 1 test for test/SqueekChainInvariant.t.sol:SqueekChainInvariantTest\n[PASS]\nSqueekChainInvariantTest invariants:\n[PASS] invariant_AllowancesMatchModel\n[PASS] invariant_SupplyAndBalancesMatchModel\n SqueekChainInvariantTest invariants (runs: 128, calls: 8192, reverts: 0)\n\n╭--------------+--------------+-------+---------+----------╮\n| Contract     | Selector     | Calls | Reverts | Discards |\n+==========================================================+\n| TokenHandler | approve      | 2715  | 0       | 0        |\n|--------------+--------------+-------+---------+----------|\n| TokenHandler | transfer     | 2717  | 0       | 0        |\n|--------------+--------------+-------+---------+----------|\n| TokenHandler | transferFrom | 2760  | 0       | 0        |\n╰--------------+--------------+-------+---------+----------╯\n\nLogs:\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 204\n  Bound result 0\n  Bound result 0\n  Bound result 15\n  Bound result 0\n  Bound result 148\n  Bound result 0\n  Bound result 0\n  Bound result 1\n  Bound result 3256\n  Bound result 101962382403162511107185203\n  Bound result 10\n  Bound result 1473\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 1162\n  Bound result 3714247998\n  Bound result 6000000000000000000\n  Bound result 3345\n  Bound result 0\n  Bound result 6000000000000003375\n  Bound result 4\n  Bound result 0\n  Bound result 5504\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 3\n  Bound result 3\n  Bound result 0\n  Bound result 7\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 3.00s (3.00s CPU time)\n\nRan 3 test suites in 3.00s (3.05s CPU time): 34 tests passed, 0 failed, 0 skipped (34 total tests)\n","passed":true},{"durationMs":90,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"SqueekChain.approve(address,uint256)\",\"SqueekChain.transfer(address,uint256)\",\"SqueekChain.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"LICENSE\":21,\"README.md\":121,\"dependencies.json\":18,\"dependencies.sha256\":36,\"foundry.toml\":23,\"remappings.txt\":2,\"src/SqueekChain.sol\":17,\"test/SqueekChain.t.sol\":399,\"test/SqueekChainInvariant.t.sol\":97,\"test/SqueekChainLaunch.t.sol\":76},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true},{"durationMs":1233,"exitCode":0,"name":"slither","output":"slither: no results at low impact or above","passed":true},{"durationMs":485,"exitCode":0,"name":"aderyn","output":"[low] large-numeric-literal at src/SqueekChain.sol:12: Large Numeric Literal","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"08a17dcf8e226c2294a16dc51dbac260650e4c9de7234f2634d6f194bd82e32b","verifiedTreeHash":"8f7c6bb7fd20dbaae68195429766d68ebb330d0c","verifierVersion":"0.1.0+a6ee6548"},{"checks":[{"durationMs":1800,"exitCode":0,"name":"build","output":"Compiling 30 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.73s\nCompiler run successful!\n","passed":true},{"durationMs":11453,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 2 tests for test/SqueekChainLaunch.t.sol:SqueekChainLaunchTest\n[PASS] test_Create2FactoryReceivesEntireSupply() (gas: 56297)\n[PASS] test_LaunchTransferRoutesDeliverExactAmounts() (gas: 453691)\nSuite result: ok. 2 passed; 0 failed; 0 skipped; finished in 61.33ms (750.67µs CPU time)\n\nRan 31 tests for test/SqueekChain.t.sol:SqueekChainTest\n[PASS] testFuzz_ApprovedTransferConservesSupply(uint256,uint256) (runs: 512, μ: 169336, ~: 170076)\nLogs:\n  Bound result 999999999999999999999999998\n  Bound result 999999999999999999999999998\n\n[PASS] testFuzz_RevertWhenTransferExceedsAllowance(uint256,uint256) (runs: 512, μ: 127648, ~: 128244)\nLogs:\n  Bound result 0\n  Bound result 999999999999999999999999998\n\n[PASS] testFuzz_RevertWhenTransferExceedsBalance(uint256) (runs: 512, μ: 61607, ~: 61933)\nLogs:\n  Bound result 1461501637330902918203684832716283019655932542975\n\n[PASS] testFuzz_SelfTransferPreservesBalance(uint256) (runs: 512, μ: 57786, ~: 57524)\nLogs:\n  Bound result 684831254781382325029624772\n\n[PASS] testFuzz_TransferConservesSupply(address,uint256) (runs: 512, μ: 99807, ~: 99942)\nLogs:\n  Bound result 154848959106066621450114403\n\n[PASS] test_AllowanceIsScopedToOwnerAndSpender() (gas: 140063)\n[PASS] test_ApprovalDoesNotRequireBalance() (gas: 80320)\n[PASS] test_ApproveEmitsEventAndReplacesAllowance() (gas: 126956)\n[PASS] test_ConstructorEmitsExactlyOneMint() (gas: 12268)\n[PASS] test_DeployerCannotSpendHolderFundsWithoutApproval() (gas: 98257)\n[PASS] test_EntireSupplyCanBeTransferred() (gas: 88734)\n[PASS] test_MaximumAllowanceIsNotReduced() (gas: 136420)\n[PASS] test_MetadataAndInitialSupply() (gas: 111827)\n[PASS] test_NoMintBurnPauseSeizureOrUpgradeEntrypoints() (gas: 2952983)\n[PASS] test_RejectsNativeCurrencyAndUnknownCalls() (gas: 64659)\n[PASS] test_RevertWhenApproveZeroSpender() (gas: 40162)\n[PASS] test_RevertWhenTransferExceedsBalance() (gas: 57645)\n[PASS] test_RevertWhenTransferFromExceedsAllowance() (gas: 120587)\n[PASS] test_RevertWhenTransferFromExceedsBalanceRestoresAllowance() (gas: 113628)\n[PASS] test_RevertWhenTransferFromToZeroRestoresAllowance() (gas: 108694)\n[PASS] test_RevertWhenTransferFromZeroAddress() (gas: 37838)\n[PASS] test_RevertWhenTransferToZeroEvenForZeroAmount() (gas: 75150)\n[PASS] test_RevokeAllowancePreventsFurtherSpending() (gas: 136598)\n[PASS] test_RuntimeFitsAndHasNoForbiddenOpcodes() (gas: 1033564)\n[PASS] test_SelfTransferFromConsumesAllowanceWithoutChangingBalance() (gas: 112539)\n[PASS] test_TransferDeliversExactAmountAndEmitsEvent() (gas: 96219)\n[PASS] test_TransferFromExhaustsAllowance() (gas: 166625)\n[PASS] test_TransferFromSpendsFiniteAllowanceAndEmitsTransfer() (gas: 177524)\n[PASS] test_TransferToContractDoesNotCallRecipient() (gas: 174185)\n[PASS] test_ZeroTransferFromEmptyAccountEmitsEvent() (gas: 63057)\n[PASS] test_ZeroTransferFromNeedsNoAllowance() (gas: 56349)\nSuite result: ok. 31 passed; 0 failed; 0 skipped; finished in 61.77ms (259.93ms CPU time)\n\nRan 13 tests for test/SqueekChainEdgeCases.t.sol:SqueekChainEdgeCasesTest\n[PASS] testFuzz_ApproveSetsExactValue(address,address,uint256) (runs: 1000, μ: 78349, ~: 78613)\nLogs:\n  Bound result 1\n  Bound result 1\n\n[PASS] testFuzz_ChainedTransfersConserve(uint256,uint256,uint256) (runs: 1000, μ: 237049, ~: 239663)\nLogs:\n  Bound result 993176721428212250879964928\n  Bound result 7\n  Bound result 3\n\n[PASS] testFuzz_LaunchSplitAtAnyBpsArrivesWhole(uint256) (runs: 1000, μ: 224002, ~: 224802)\nLogs:\n  Bound result 9000\n\n[PASS] testFuzz_RevertWhenTransferFromExceedsBalanceWithinAllowance(uint256,uint256) (runs: 1000, μ: 189978, ~: 190651)\nLogs:\n  Bound result 6000000000000000000\n  Bound result 999999994000000000000016023\n\n[PASS] test_EachDeploymentMintsOnlyToItsOwnCaller() (gas: 57594)\n[PASS] test_OwnerNeedsAllowanceToUseTransferFromOnItself() (gas: 45326)\n[PASS] test_RevertWhenZeroAddressApproves() (gas: 33075)\n[PASS] test_RevertWhenZeroAddressSends() (gas: 33034)\n[PASS] test_SpentAllowanceCannotBeReplayed() (gas: 169152)\n[PASS] test_SupplyIsOneBillionWholeTokensAtDecimals() (gas: 26482)\n[PASS] test_TokensSentToTheTokenContractAreCountedButStuck() (gas: 78171)\n[PASS] test_TransferAndApproveReturnExactlyAbiTrue() (gas: 169174)\n[PASS] test_TransferFromAtExactBalanceSucceedsAndOneMoreFails() (gas: 255362)\nSuite result: ok. 13 passed; 0 failed; 0 skipped; finished in 61.71ms (219.03ms CPU time)\n\nRan 1 test for test/SqueekChainInvariant.t.sol:SqueekChainInvariantTest\n[PASS]\nSqueekChainInvariantTest invariants:\n[PASS] invariant_AllowancesMatchModel\n[PASS] invariant_SupplyAndBalancesMatchModel\n SqueekChainInvariantTest invariants (runs: 128, calls: 8192, reverts: 0)\n\n╭--------------+--------------+-------+---------+----------╮\n| Contract     | Selector     | Calls | Reverts | Discards |\n+==========================================================+\n| TokenHandler | approve      | 2715  | 0       | 0        |\n|--------------+--------------+-------+---------+----------|\n| TokenHandler | transfer     | 2717  | 0       | 0        |\n|--------------+--------------+-------+---------+----------|\n| TokenHandler | transferFrom | 2760  | 0       | 0        |\n╰--------------+--------------+-------+---------+----------╯\n\nLogs:\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 2401\n  Bound result 0\n  Bound result 444\n  Bound result 2929\n  Bound result 101962383029421219203798564\n  Bound result 18\n  Bound result 0\n  Bound result 0\n  Bound result 1\n  Bound result 0\n  Bound result 12\n  Bound result 2\n  Bound result 0\n  Bound result 2751\n  Bound result 1\n  Bound result 16\n  Bound result 9\n  Bound result 96\n  Bound result 1782\n  Bound result 2207\n  Bound result 0\n  Bound result 490\n  Bound result 2232\n  Bound result 2413\n  Bound result 6\n  Bound result 0\n  Bound result 160\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 13\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 1.93s (1.93s CPU time)\n\nRan 2 tests for test/SqueekChainFailurePathInvariant.t.sol:SqueekChainFailurePathInvariantTest\n[PASS]\nSqueekChainFailurePathInvariantTest invariants:\n[PASS] invariant_AllowancesMatchModel\n[PASS] invariant_FixedSupplyFullyHeldByActors\n[PASS] invariant_RejectedCallsChangeNothing\n SqueekChainFailurePathInvariantTest invariants (runs: 256, calls: 16384, reverts: 0)\n\n╭--------------------+----------------------------------------+-------+---------+----------╮\n| Contract           | Selector                               | Calls | Reverts | Discards |\n+==========================================================================================+\n| FailurePathHandler | approve                                | 1987  | 0       | 0        |\n|--------------------+----------------------------------------+-------+---------+----------|\n| FailurePathHandler | strangerTransferFrom                   | 2046  | 0       | 0        |\n|--------------------+----------------------------------------+-------+---------+----------|\n| FailurePathHandler | transfer                               | 1946  | 0       | 0        |\n|--------------------+----------------------------------------+-------+---------+----------|\n| FailurePathHandler | transferFrom                           | 2125  | 0       | 0        |\n|--------------------+----------------------------------------+-------+---------+----------|\n| FailurePathHandler | transferFromOverAllowance              | 2043  | 0       | 0        |\n|--------------------+----------------------------------------+-------+---------+----------|\n| FailurePathHandler | transferFromOverBalanceWithinAllowance | 2126  | 0       | 0        |\n|--------------------+----------------------------------------+-------+---------+----------|\n| FailurePathHandler | transferOverBalance                    | 2101  | 0       | 0        |\n|--------------------+----------------------------------------+-------+---------+----------|\n| FailurePathHandler | transferToZero                         | 2010  | 0       | 0        |\n╰--------------------+----------------------------------------+-------+---------+----------╯\n\nLogs:\n  Bound result 0\n  Bound result 0\n  Bound result 533\n  Bound result 0\n  Bound result 3300\n  Bound result 3796888831\n  Bound result 0\n  Bound result 25000000000000000000\n  Bound result 33\n  Bound result 1490\n  Bound result 890\n  Bound result 0\n  Bound result 1595\n  Bound result 97784862628035693547119226\n  Bound result 8638\n  Bound result 0\n  Bound result 244\n  Bound result 694\n  Bound result 10\n  Bound result 999999999999999999999999999\n  Bound result 0\n  Bound result 44050742390829635249863588012047311215723204271790375094194277631551245131747\n  Bound result 0\n  Bound result 440143216718954145035188109\n  Bound result 1000\n  Bound result 7\n  Bound result 6502\n  Bound result 10000000000000000000\n  Bound result 551\n  Bound result 0\n  Bound result 7139\n  Bound result 2\n  Bound result 7030\n  Bound result 0\n  Bound result 94\n  Bound result 1\n  Bound result 9000\n  Bound result 74065811746281157990536667121274268421945976472873259292548724851806439\n  Bound result 733\n  Bound result 3237\n  Bound result 2026\n  Bound result 9026\n  Bound result 19208057752124881657959392\n  Bound result 5305\n  Bound result 160\n  Bound result 82912523111991611472010649\n  Bound result 321\n  Bound result 77\n  Bound result 5\n  Bound result 646\n  Bound result 92803\n  Bound result 3555795108\n  Bound result 5000000000000000000\n  Bound result 2539\n  Bound result 905852325029312691468075486\n  Bound result 1725540769\n\n[PASS] test_LaunchDistributionInOneCallIsExact() (gas: 61296)\nSuite result: ok. 2 passed; 0 failed; 0 skipped; finished in 11.36s (11.36s CPU time)\n\nRan 5 test suites in 11.36s (13.48s CPU time): 49 tests passed, 0 failed, 0 skipped (49 total tests)\n","passed":true},{"durationMs":40,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"SqueekChain.approve(address,uint256)\",\"SqueekChain.transfer(address,uint256)\",\"SqueekChain.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"LICENSE\":21,\"README.md\":121,\"dependencies.json\":18,\"dependencies.sha256\":36,\"foundry.toml\":23,\"remappings.txt\":2,\"src/SqueekChain.sol\":17,\"test/SqueekChain.t.sol\":399,\"test/SqueekChainEdgeCases.t.sol\":189,\"test/SqueekChainFailurePathInvariant.t.sol\":302,\"test/SqueekChainInvariant.t.sol\":97,\"test/SqueekChainLaunch.t.sol\":76},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"6fc0b2a941ec1d8943e95b4246e7a0bf2668b8e817ea4927b237b33fb019b607","verifiedTreeHash":"6ad2e59cd14588c75e66b9e2d28b26351ca8d61b","verifierVersion":"0.1.0+a6ee6548"}]}