{"assessments":[],"deployments":[],"fuzz":[],"identity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"interpretation":"Records acceptance and evidence. Neither completion nor an AI assessment establishes correctness, safety, or independent review.","jobId":"744ff763-6db7-4b25-9bca-dd04ba71c043","kind":"shape:chain","nodes":[{"acceptedSubmissionHash":"e8bd21c7ba2b6674c7f441026419fe500110d5e7bfad83ed373c2159a3066ed5","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_economics","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"8719688a33728a0ada8bf1543d5cabd42ca47efc86a8adbbfe7ccdb51a6b1823","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_flow","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"c125c2df59dee4aa552b9ee60ceb69d4b5272d88ec142e6a031b717da5088fcc","dependsOn":["build_contract_project","write_foundry_tests","manifest","audit_math","audit_permissions","audit_economics","audit_flow"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"af3aa01159bbf354f621cafa5c0006f6169e0938a8b015be508b7377dbf165bc","skillId":"audit-judge","tools":[]},"key":"audit_judge","kind":"code","role":"review","skillHash":"af3aa01159bbf354f621cafa5c0006f6169e0938a8b015be508b7377dbf165bc","skillId":"audit-judge","state":"accepted"},{"acceptedSubmissionHash":"2905f01525d8091ff33ff14e832b1d60e36b797a070a34c2a159ff2b2905125a","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_math","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"5148a1e5ff12dcb351ced60bc902c34f8ff9447fb9a558c1eeb2198a3d54e396","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_permissions","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"30b6209128091802d2f2a6ad0edb5993848da52b1c6c6ffb7202720e6f704d1a","dependsOn":[],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"6b8d2c2ebd3301cff2be8edb1e1cc6ba65c858c02fe7247be81722b969842265","skillId":"build-contract-project","tools":[]},"key":"build_contract_project","kind":"code","role":"implement","skillHash":"6b8d2c2ebd3301cff2be8edb1e1cc6ba65c858c02fe7247be81722b969842265","skillId":"build-contract-project","state":"accepted"},{"acceptedSubmissionHash":"f67ca18d4c8033f941a1678af9da949eb13eaac52a47a1640da8e4875f16f27f","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"tools":[]},"key":"manifest","kind":"code","role":"integrate","skillHash":null,"skillId":null,"state":"accepted"},{"acceptedSubmissionHash":"7d03a21828a6fe3d66b9843eb603af3f19291c31126c09af7ca3550d21f829e7","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"4c76766b00591dfe982fe85d3de589fdb2f810e5137c301155d1c5e36a1d3b23","skillId":"write-foundry-tests","tools":[]},"key":"write_foundry_tests","kind":"code","role":"tests","skillHash":"4c76766b00591dfe982fe85d3de589fdb2f810e5137c301155d1c5e36a1d3b23","skillId":"write-foundry-tests","state":"accepted"}],"objective":"A custom token: Infernidentity.md (INFERN).\nToken name: Infernidentity.md\nToken symbol: INFERN\nToken supply: 1,000,000,000 with 18 decimals, all minted once to the deployer in the constructor.","parentJobId":null,"planHash":"852a1000b3f16c22e30db410184b240e407e6a583a0a3a9dfe64f1b5b301ab29","previousHash":"0000000000000000000000000000000000000000000000000000000000000000","projectId":"744ff763-6db7-4b25-9bca-dd04ba71c043","publication":{"commit":null,"deliveredAt":null,"repoUrl":"https://github.com/identity-md-launches/launch-1834-infernidentity-md"},"receiptIdentity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"registry":"0xb6d0a187b050fa5bb0b87033a203f37becf4a775","research":[],"schema":"identitymd-work-v1","signals":[{"agentId":"52179","feedbackHash":"c92f7ea0c07d276e79ff72551d03e96810732368ae076f1208009c22b6a0f513","nodeKey":"audit_economics","submissionHash":"e8bd21c7ba2b6674c7f441026419fe500110d5e7bfad83ed373c2159a3066ed5","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51146","feedbackHash":"17c792844a13d1e32e61f22b1eda379cec8db68a7626c1840019e9cb6a517475","nodeKey":"audit_flow","submissionHash":"8719688a33728a0ada8bf1543d5cabd42ca47efc86a8adbbfe7ccdb51a6b1823","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51873","feedbackHash":"7556a0fc376c9092497daaffcf0a4ec0c1b0d1f03b4160b988119e3436d1f53b","nodeKey":"audit_judge","submissionHash":"c125c2df59dee4aa552b9ee60ceb69d4b5272d88ec142e6a031b717da5088fcc","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51476","feedbackHash":"a351fb93fb022a054a871a13f9c4440a0875956ed1e409690606f1966950f369","nodeKey":"audit_math","submissionHash":"2905f01525d8091ff33ff14e832b1d60e36b797a070a34c2a159ff2b2905125a","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51333","feedbackHash":"8034a8fd968a3a98dccec19c67336963caef4af767badd4681f4189ef2ced16a","nodeKey":"audit_permissions","submissionHash":"5148a1e5ff12dcb351ced60bc902c34f8ff9447fb9a558c1eeb2198a3d54e396","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52569","feedbackHash":"9562e7536a7bd0e3001ecf472a477457087b067328c60e71fc05f58b9ba72ee7","nodeKey":"build_contract_project","submissionHash":"30b6209128091802d2f2a6ad0edb5993848da52b1c6c6ffb7202720e6f704d1a","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"52200","feedbackHash":"c2b225290dc3903c880cea45d4da0b4415f2acf552a9323788e12d7edf6177a1","nodeKey":"manifest","submissionHash":"f67ca18d4c8033f941a1678af9da949eb13eaac52a47a1640da8e4875f16f27f","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"50965","feedbackHash":"391c5a9dd8d794d7c9df6ddc95bb4e1d53433d644377f3b3f4d688666724e7c2","nodeKey":"write_foundry_tests","submissionHash":"7d03a21828a6fe3d66b9843eb603af3f19291c31126c09af7ca3550d21f829e7","tag1":"verification:checks","tag2":"acceptance-v2","value":1}],"site":null,"snapshotHash":"dbd2ee4e5ca4cfbf50886333c0adeca660144753b7f230f532187e51465018fe","state":"completed","submissions":[{"artifacts":[],"attempt":2,"bundleHash":null,"device":"e9049e5b12ba53ba","findings":[],"hash":"2905f01525d8091ff33ff14e832b1d60e36b797a070a34c2a159ff2b2905125a","nodeId":"82c7a6e2-3eeb-4907-bb9a-6a0c2d7359eb","outcome":"completed","summary":"I found no math defects in `src/InfernToken.sol`. `.imd-findings.json` holds an empty findings list and the coverage record. I changed no other file, and all 36 existing project tests pass.\n\n**What the code is:** a 17-line contract built on OpenZeppelin v5's standard ERC20. It mints the supply once, in the constructor, to whoever deploys it. It has no fees, taxes, rounding, or math of its own beyond the supply constant.\n\n**What I checked against the precision, boundary and numerical-gap guides:**\n- **Supply constant** (`src/InfernToken.sol:10`): `1_000_000_000 * 10 ** 18` is 1e27, about 2^90, far below the uint256 limit. It is worked out at compile time and matches `decimals() == 18`. The static-analysis \"large numeric literal\" note is about style, not a defect.\n- **Minting:** the overflow-checked mint runs only in the constructor. There is no mint or burn function, so the supply stays fixed at 1e27.\n- **Balances:** the library takes from the sender without an overflow check, but only after confirming the amount is at most the sender's balance. Sending balance + 1 reverts with `ERC20InsufficientBalance`. The credit to the receiver can't overflow, because no balance can exceed the fixed supply.\n- **Allowances:** the allowance is reduced without an overflow check only after confirming it covers the amount, so allowance + 1 reverts. A maximum (uint256 max) allowance is treated as unlimited and never reduced.\n- **Edge cases:** sending to yourself and sending zero both leave balances unchanged. Sending to or from the zero address reverts.\n- **Launch flow:** there is no fee or burn on transfer, so transfers to the factory, the distributor and the pool manager arrive in full.\n\n**Coverage:** `approve`, `transfer` and `transferFrom` are all marked `holds`. Two invariant rows are added: the supply is always 1e27, and decimals is 18. No entry point was left unreached.\n\nThe protected launch tests were not run, and I wrote no new tests because there was nothing to reproduce. The protected token test imports files this project doesn't contain (`src/LaunchLiquidity.sol`, `src/PoolInitializationGuard.sol`, `src/HookFlags.sol`), so it is not runnable against this tree as-is. That is something to check outside this math review.","treeHash":null,"usage":{"cachedInputTokens":156078,"inputTokens":10,"model":"claude-opus-5-5","outputTokens":2354,"runtime":"claude","turns":5,"wallClockMs":39883}},{"artifacts":[],"attempt":1,"bundleHash":"299f8b73095058c2173a8d6378b86c9cdfb032a34a413edb508de994fc20bdd3","device":"9523c8447c9485ed","findings":[],"hash":"30b6209128091802d2f2a6ad0edb5993848da52b1c6c6ffb7202720e6f704d1a","nodeId":"f0e2005f-f460-4679-b040-03394cea8ab5","outcome":"completed","summary":"Implemented `InfernToken`: Infernidentity.md (INFERN), 18 decimals, with all 1,000,000,000 tokens minted once to the deployer.\n\nDependencies are vendored. README documents assumptions, deployment, and operational responsibilities.\n\nVerified with Solidity 0.8.26:\n\n- `forge build` passed.\n- `forge test` passed using the supplied fuzz seed, including invariant tests.\n- `forge fmt --check` passed.","treeHash":"9333a0067552a54e5c0db5e4bda87d9df1c24c9f","usage":{"cachedInputTokens":562944,"inputTokens":48973,"model":"gpt-6-astra","outputTokens":13851,"runtime":"codex","turns":5,"wallClockMs":494885}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"41f7c1458e1278ad","findings":[{"citation":"resolved","description":"README.md line 4 states the token uses the 'vendored, unmodified OpenZeppelin Contracts v5.0.2 ERC-20 implementation' and that DEPENDENCIES.json 'records ... hashes of every vendored file' so a reviewer can verify provenance. The recorded SHA-256 values are the hashes of the pristine upstream files (I fetched raw.githubusercontent.com/OpenZeppelin/openzeppelin-contracts/v5.0.2/contracts/token/ERC20/ERC20.sol and it hashes to exactly 2d874da1...; draft-IERC6093.sol upstream hashes to 4aea8724...). The files actually on disk under lib/ do not hash to those values: lib/openzeppelin-contracts/contracts/token/ERC20/ERC20.sol hashes to 4a1db79b7b76a41b1d228242ad369c24fb293be6a62cd00b7e286333e965df59 and lib/openzeppelin-contracts/contracts/interfaces/draft-IERC6093.sol to 94e5638bf0e43993e72ed07612547554e9265b335ab69ad8e74b8d41d90368bd. A diff against upstream shows the only changes are forge-fmt line wrapping: the `_approve(address,address,uint256,bool) internal virtual {` signature (upstream line 284) is split over four lines in the vendored copy, and the `ERC1155InsufficientBalance` error declaration (upstream line 121) is split over three lines. The vendored production code is therefore semantically identical to upstream v5.0.2 and the token's access-control, allowance and transfer behaviour is unaffected; I confirmed this by reading the full vendored ERC20.sol and by the passing suite. However the repository's own integrity record is wrong for 23 of the 36 files it lists (2 of 6 OpenZeppelin files and 21 of 30 forge-std files; forge-std is test-only and was not diffed against upstream). Anyone following the README's instruction to verify the vendored tree against DEPENDENCIES.json gets a failure and cannot distinguish a harmless reformat from a tampered ERC20 base contract, which is exactly the trust gap the record exists to close. Fix: either re-vendor the pristine upstream files (and exclude lib/ from forge fmt), or regenerate filesSha256 from the files actually committed and state in README that they are forge-fmt-reformatted copies of v5.0.2.","line":11,"path":"DEPENDENCIES.json","reproduction":"State: the working tree as committed. Input: `sha256sum lib/openzeppelin-contracts/contracts/token/ERC20/ERC20.sol lib/openzeppelin-contracts/contracts/interfaces/draft-IERC6093.sol`. Expected (per DEPENDENCIES.json lines 10-11): 2d874da1c1478ed22a2d30dcf1a6ec0d09a13f897ca680d55fb49fbcc0e0c5b1 and 4aea87243e6de38804bf8737bf86f750443d3b5e63dd0fd0b7ad92f77cdbd3e3. Actual: 4a1db79b7b76a41b1d228242ad369c24fb293be6a62cd00b7e286333e965df59 and 94e5638bf0e43993e72ed07612547554e9265b335ab69ad8e74b8d41d90368bd. `diff <(curl -sL https://raw.githubusercontent.com/OpenZeppelin/openzeppelin-contracts/v5.0.2/contracts/token/ERC20/ERC20.sol) lib/openzeppelin-contracts/contracts/token/ERC20/ERC20.sol` prints only the 4-line rewrap of the `_approve(..., bool emitEvent)` signature at line 284. A script hashing every entry in DEPENDENCIES.json filesSha256 reports 23 mismatches out of 36 entries.","severity":"low","snippet":"      \"contracts/token/ERC20/ERC20.sol\": \"2d874da1c1478ed22a2d30dcf1a6ec0d09a13f897ca680d55fb49fbcc0e0c5b1\",","title":"DEPENDENCIES.json records upstream file hashes that do not match the vendored (reformatted) files, so the 'unmodified' provenance claim cannot be verified from the record"}],"hash":"5148a1e5ff12dcb351ced60bc902c34f8ff9447fb9a558c1eeb2198a3d54e396","nodeId":"79c703c3-11e7-4de9-bb01-fbd184262dcc","outcome":"completed","summary":"The review is complete and `.imd-findings.json` is written; `git status` shows no tracked file changed, so the submission touches nothing but the findings file (and the `out/` build directory, which is gitignored).\n\n**Outcome: the token's permission model is clean.** `InfernToken` is a 17-line wrapper around OpenZeppelin v5.0.2 `ERC20` that mints the full supply once to `msg.sender` in the constructor. I checked it against the Access Control, Trust Gap and Asymmetry guides and found no permission defect. One low-severity provenance finding is reported.\n\n**What I verified**\n\n- **Access control.** The compiled ABI exposes exactly three state-changing functions: `approve`, `transfer`, `transferFrom`. There is no owner, initializer, minter, pauser, blacklist, `receive` or `fallback`. `_mint` and `_burn` are internal and unreachable after construction. The deployer (the factory at launch) has no powers beyond those of any holder; an unapproved `transferFrom` by the deployer reverts.\n- **Asymmetry.** The approve and spend sides write the same slot in mirrored directions. `transfer` and `transferFrom` share one `_transfer` path, so no branch skips a check or takes a fee. Zero-value `transferFrom` with zero allowance passes, which is spec-conformant.\n- **Trust gap.** No privileged actor exists, so no access-times-economics seam exists. Launch flows (factory to distributor, seed into the PoolManager, trader buy and sell) are plain exact-amount transfers.\n- **Tests.** The existing 36 unit, fuzz and invariant tests pass with the README seed. Runtime bytecode contains no DELEGATECALL, CALLCODE or SELFDESTRUCT.\n\n**Finding (low).** `DEPENDENCIES.json` records SHA-256 hashes of the pristine upstream files, but the vendored copies were reformatted by `forge fmt`, so 23 of 36 recorded hashes fail. I fetched upstream v5.0.2 and diffed: the two OpenZeppelin production files differ only in line wrapping and are semantically identical, so token behaviour is unaffected. But the README's \"unmodified\" claim cannot be verified from the repository's own record, which is the trust gap that record exists to close. The fix is to re-vendor pristine files or regenerate the hashes from what is committed.\n\n**Coverage.** All three listed entry points are marked `holds`, plus rows for the constructor, the no-privileged-role invariant, fixed supply, the vendored-base provenance (`finding`, ref 1), and the launch flows. The protected launch harness itself was traced by reading, not run, since it needs the network's factory and Uniswap v4 environment. The forge-std hash mismatches were not diffed against upstream; that library is test-only and outside my area.","treeHash":null,"usage":{"cachedInputTokens":904492,"inputTokens":322,"model":"claude-fable-5-1","outputTokens":12757,"runtime":"claude","turns":25,"wallClockMs":230533}},{"artifacts":[],"attempt":1,"bundleHash":"f97338364b82682defb9b62a43cc8db7edbae9b6a22316fda7ab49a1a64d3d46","device":"1272a65455eb54ca","findings":[],"hash":"7d03a21828a6fe3d66b9843eb603af3f19291c31126c09af7ca3550d21f829e7","nodeId":"5ce88f4c-87a3-460c-86a1-ac939725da06","outcome":"completed","summary":"Added 18 regression/fuzz tests and expanded stateful invariants under `test/`, covering allowance abuse, rollback, boundary values, and balance conservation.\n\nVerified offline with the required seed: `forge build` and `forge test` pass—54 tests and 32,768 invariant calls.\n\nOnly `test/` changed. No implementation defects found.","treeHash":"ef6dfb384f9a0ad73d276876339c28ae863be50d","usage":{"cachedInputTokens":1564800,"inputTokens":105185,"model":"gpt-6-astra","outputTokens":16597,"runtime":"codex","turns":7,"wallClockMs":718290}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"824e6de6196c686f","findings":[{"citation":"resolved","description":"README.md line 4 states the token uses the 'vendored, unmodified OpenZeppelin Contracts v5.0.2 ERC-20 implementation' and README line 100 says DEPENDENCIES.json 'records ... hashes of every vendored file'. The recorded SHA-256 for lib/openzeppelin-contracts/contracts/token/ERC20/ERC20.sol (2d874da1...) is the hash of the genuine upstream v5.0.2 file, but the file in the tree hashes to 4a1db79b7b76a41b1d228242ad369c24fb293be6a62cd00b7e286333e965df59. The same holds for contracts/interfaces/draft-IERC6093.sol (recorded 4aea8724..., actual 94e5638b...) and for 21 of the 30 recorded forge-std v1.9.7 files (StdAssertions, StdChains, StdCheats, StdConstants, StdInvariant, StdJson, StdMath, StdStorage, StdStyle, StdToml, StdUtils, Vm, console, safeconsole and the IERC1155/IERC4626/IERC6909/IERC721/IERC7540/IERC7575/IMulticall3 interfaces). I diffed the vendored ERC20.sol and draft-IERC6093.sol against the upstream v5.0.2 files: the only differences are line-wrapping produced by `forge fmt` with the repository's `line_length = 100` (the `_approve(owner, spender, value, bool emitEvent)` signature and the `ERC1155InsufficientBalance` error were split across lines). The same whitespace-only reformatting explains the forge-std mismatches (checked StdCheats.sol and Vm.sol). So the base contract the token inherits is semantically genuine OpenZeppelin v5.0.2 and the deployed runtime is unaffected; the defect is that the repository's own provenance record is false. Anyone verifying the vendored base contract against DEPENDENCIES.json, as the README instructs, gets a mismatch and cannot distinguish this formatting change from a real tampering of _update/_spendAllowance, which defeats the purpose of the record (Periphery guide: the base contract is the code the core trusts implicitly). Fix: either restore the byte-exact upstream files under lib/ (exclude lib/ from `forge fmt`) so the recorded hashes verify, or recompute and record the hashes of the files actually in the tree and drop the word 'unmodified' from the README.","line":11,"path":"DEPENDENCIES.json","reproduction":"From the repository root run: `sha256sum lib/openzeppelin-contracts/contracts/token/ERC20/ERC20.sol lib/openzeppelin-contracts/contracts/interfaces/draft-IERC6093.sol`. Expected (per DEPENDENCIES.json lines 10-11): 2d874da1c1478ed22a2d30dcf1a6ec0d09a13f897ca680d55fb49fbcc0e0c5b1 and 4aea87243e6de38804bf8737bf86f750443d3b5e63dd0fd0b7ad92f77cdbd3e3. Actual: 4a1db79b7b76a41b1d228242ad369c24fb293be6a62cd00b7e286333e965df59 and 94e5638bf0e43993e72ed07612547554e9265b335ab69ad8e74b8d41d90368bd. Fetching https://raw.githubusercontent.com/OpenZeppelin/openzeppelin-contracts/v5.0.2/contracts/token/ERC20/ERC20.sol and hashing it gives the recorded 2d874da1..., and `diff` against the vendored copy shows only the four-line split of the `_approve(..., bool emitEvent)` signature at vendored lines 284-287. Only 4 of the 6 OpenZeppelin hashes and 9 of the 30 forge-std hashes in DEPENDENCIES.json verify against the tree.","severity":"low","snippet":"      \"contracts/token/ERC20/ERC20.sol\": \"2d874da1c1478ed22a2d30dcf1a6ec0d09a13f897ca680d55fb49fbcc0e0c5b1\",","title":"DEPENDENCIES.json integrity hashes do not match the vendored files (ERC20.sol, draft-IERC6093.sol and 21 forge-std files)"}],"hash":"8719688a33728a0ada8bf1543d5cabd42ca47efc86a8adbbfe7ccdb51a6b1823","nodeId":"a6a6cede-eaa0-4c0e-b9ea-8bbac82692e8","outcome":"completed","summary":"The review is complete. The findings file is valid JSON, holds one finding and six coverage rows, and the working tree has no stray files. Only the ignored build output and the findings file itself are new.\n\n**Outcome: the token's control flow holds. One low-severity provenance defect.**\n\nThe INFERN token is a 17-line contract that inherits the vendored OpenZeppelin v5.0.2 ERC-20 and mints 10^27 units once to the deployer. I traced all three state-changing entry points through the base contract against the Execution Trace, Periphery and First Principles guides.\n\n- **approve** holds. Zero spender reverts, the allowance is overwritten, and the standard approve race is documented in the README as intended behaviour.\n- **transfer** holds. Zero receiver and insufficient balance revert before any write, self-transfer nets to zero, and the exact amount arrives with no fee or callback. The launch flows to the distributor, pool seed and swaps move exactly what they say.\n- **transferFrom** holds. Allowance is read and decremented with no external call in between, unlimited allowance is not decremented, and a later balance or receiver failure rolls back the allowance write.\n- **Constructor and supply invariant** hold. No mint, burn, pause, blacklist, owner, upgrade, receive or fallback paths exist, and the runtime has no DELEGATECALL, CALLCODE or SELFDESTRUCT.\n\n**The one finding is in the periphery.** The README calls the vendored OpenZeppelin files unmodified and says DEPENDENCIES.json records their hashes. The recorded hashes for ERC20.sol and draft-IERC6093.sol do not match the files in the tree, nor do 21 of the 30 forge-std hashes. I fetched the upstream v5.0.2 and v1.9.7 files and diffed them. Every difference is the formatter re-wrapping lines at the repository's 100-character limit, so the inherited logic is genuine and the deployed bytecode is unaffected. The defect is that the integrity record is false, so a reviewer following the README cannot tell this reformatting apart from real tampering with the base contract. I rated it low and gave the exact hash commands and values as the reproduction. No proof test is needed at that severity.\n\nSlither reported nothing. Aderyn's large-literal note on the supply constant is style only, and the constant evaluates to exactly 10^27.","treeHash":null,"usage":{"cachedInputTokens":701459,"inputTokens":290,"model":"claude-fable-5-1","outputTokens":12367,"runtime":"claude","turns":25,"wallClockMs":195114}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"60ffae3cc413a0c6","findings":[],"hash":"8ddc71ba86f75cedac367d876f876b1551a51ea76daea04c9417354c5e65805b","nodeId":"82c7a6e2-3eeb-4907-bb9a-6a0c2d7359eb","outcome":"failed","summary":"could not start claude: spawn claude ENOENT","treeHash":null,"usage":{"cachedInputTokens":0,"inputTokens":0,"model":null,"outputTokens":0,"runtime":"claude","turns":0,"wallClockMs":12}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"42a6bb6aa496cd6b","findings":[{"citation":"resolved","description":"Merged from identical reports by audit_permissions, audit_flow and audit_economics (same root cause, same file, same line). README.md line 3-4 says InfernToken 'uses the vendored, unmodified OpenZeppelin Contracts v5.0.2 ERC-20 implementation' and line 100 says DEPENDENCIES.json 'records ... hashes of every vendored file' as the way to verify that. I recomputed SHA-256 for every entry in DEPENDENCIES.json: 23 of the 36 recorded files do not hash to the recorded value (lib/openzeppelin-contracts/contracts/token/ERC20/ERC20.sol, lib/openzeppelin-contracts/contracts/interfaces/draft-IERC6093.sol and 21 of 30 forge-std files). The recorded values are the hashes of the pristine upstream files: I fetched the five vendored OpenZeppelin files from raw.githubusercontent.com at tag v5.0.2 and they hash to exactly the recorded values, so the record was computed before the tree was reformatted. Diffing the upstream files against the vendored copies shows only `forge fmt` line wrapping at the repository's line_length = 100: ERC20.sol line 284 `_approve(address,address,uint256,bool)` signature split over four lines (vendored lines 284-287), and draft-IERC6093.sol line 121 `ERC1155InsufficientBalance` error split over three lines (vendored 121-123). IERC20.sol, IERC20Metadata.sol and Context.sol are byte-identical. The compiled token is therefore semantically the genuine OpenZeppelin v5.0.2 ERC-20 and approve/transfer/transferFrom behave as upstream; this is not a runtime defect. It is a provenance defect: the file the project offers as proof that its base contract is unmodified fails against the tree it ships with, so a reviewer or the source-publication step that follows the README gets a mismatch and cannot distinguish a whitespace pass from an edit to _update or _spendAllowance without redoing the upstream diff. Note also that `forge fmt --check` currently passes because lib/ was formatted; restoring byte-exact upstream files would make the README's `forge fmt --check` step fail unless lib/ is excluded from formatting. Fix (either): (a) restore the byte-exact upstream files under lib/ and exclude lib/ from `forge fmt` via `ignore = [\"lib/**\"]` in the [fmt] section (a foundry.toml change, so it belongs to the builder, not a reviewer); or (b) recompute filesSha256 from the files actually committed and change README to say the copies are forge-fmt-reformatted but semantically identical to v5.0.2.","line":11,"path":"DEPENDENCIES.json","reproduction":"State: the committed working tree. Input: from the repository root run `sha256sum lib/openzeppelin-contracts/contracts/token/ERC20/ERC20.sol lib/openzeppelin-contracts/contracts/interfaces/draft-IERC6093.sol`. Expected (DEPENDENCIES.json lines 10-11): 2d874da1c1478ed22a2d30dcf1a6ec0d09a13f897ca680d55fb49fbcc0e0c5b1 for ERC20.sol and 4aea87243e6de38804bf8737bf86f750443d3b5e63dd0fd0b7ad92f77cdbd3e3 for draft-IERC6093.sol. Actual: 4a1db79b7b76a41b1d228242ad369c24fb293be6a62cd00b7e286333e965df59 and 94e5638bf0e43993e72ed07612547554e9265b335ab69ad8e74b8d41d90368bd. Hashing every filesSha256 entry in both DEPENDENCIES.json blocks with a short Python script gives 23 mismatches of 36 (2 of 6 OpenZeppelin, 21 of 30 forge-std). `curl -sL https://raw.githubusercontent.com/OpenZeppelin/openzeppelin-contracts/v5.0.2/contracts/token/ERC20/ERC20.sol | sha256sum` prints the recorded 2d874da1..., and `diff` of that download against the vendored file prints only the rewrap of line 284 into lines 284-287; the same for draft-IERC6093.sol line 121 into 121-123. No semantic difference.","severity":"low","snippet":"      \"contracts/token/ERC20/ERC20.sol\": \"2d874da1c1478ed22a2d30dcf1a6ec0d09a13f897ca680d55fb49fbcc0e0c5b1\",","title":"DEPENDENCIES.json records upstream hashes that do not match the vendored files, so the README's 'unmodified' provenance claim cannot be verified from the tree"}],"hash":"c125c2df59dee4aa552b9ee60ceb69d4b5272d88ec142e6a031b717da5088fcc","nodeId":"d5c2ceb1-4b9f-4d72-8c8f-806ea38d805a","outcome":"completed","summary":"The review is complete and written to `.imd-findings.json`. The working tree is otherwise unchanged.\n\n**Outcome:** the token holds. The three specialist findings were one defect reported three times, and I merged them into a single low finding after reproducing it.\n\n**What I verified**\n\n- The three state-changing entry points are the unmodified OpenZeppelin v5.0.2 implementations. I diffed every vendored OpenZeppelin file against the upstream tag and found only whitespace rewraps in two files.\n- The constructor takes no arguments and mints exactly 10^27 units to the deployer, which matches the manifest's supply, decimals, name and symbol.\n- The compiled artifact exposes only approve, transfer and transferFrom as state-changing functions. The runtime contains no DELEGATECALL, CALLCODE or SELFDESTRUCT and is far under the size limits.\n- The full local suite passes with the README's fuzz seed, and the manifest conforms to the schema rules.\n\n**The one finding (low):** DEPENDENCIES.json records the hashes of the pristine upstream files, but the committed copies were run through the repository's formatter afterwards. 23 of the 36 recorded hashes fail against the tree, including the ERC20 base contract. The README's claim that the dependency is \"unmodified\" and verifiable from that record is therefore false, even though the code is semantically identical. The fix is either to restore the byte-exact files and exclude lib/ from formatting, or to re-record the hashes and reword the README.\n\nCoverage marks all three entry points as holding, plus rows for the supply invariant, factory deployability and the manifest. No proof file was needed since nothing reached high severity.","treeHash":null,"usage":{"cachedInputTokens":497753,"inputTokens":258,"model":"claude-fable-5-1","outputTokens":8333,"runtime":"claude","turns":11,"wallClockMs":150049}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"02f22d6f13810ca8","findings":[{"citation":"resolved","description":"README.md line 3-4 states the token 'uses the vendored, unmodified OpenZeppelin Contracts v5.0.2 ERC-20 implementation' and line 100 states that DEPENDENCIES.json 'records the upstream tags, archive SHA-256 values, and hashes of every vendored file'. The recorded per-file hashes are the upstream v5.0.2 / forge-std v1.9.7 values, but 23 of the 36 vendored files in the tree hash differently: lib/openzeppelin-contracts/contracts/token/ERC20/ERC20.sol (recorded 2d874da1..., actual 4a1db79b...), lib/openzeppelin-contracts/contracts/interfaces/draft-IERC6093.sol (recorded 4aea8724..., actual 94e5638b...), and 21 forge-std files. I fetched the upstream v5.0.2 files from GitHub and diffed them: the ERC20.sol difference is only the line-wrapping of the `_approve(address,address,uint256,bool)` signature at line 284-287 and the draft-IERC6093.sol difference is only the wrapping of `ERC1155InsufficientBalance` at line 121-123, i.e. `forge fmt` was applied to the vendored library after the hashes were recorded. The runtime behaviour of the token is therefore unchanged and this is not an economic or security defect in InfernToken. It is a provenance defect: the file the project offers as proof that its dependency is unmodified cannot verify the tree it ships with, so a reviewer or the source-publication / attestation step that recomputes the hashes gets a mismatch and cannot distinguish a formatting pass from a semantic edit without doing the upstream diff themselves. Fix: either restore the byte-exact upstream files (and exclude lib/ from `forge fmt`, e.g. via `ignore = [\"lib/**\"]` in the [fmt] section, which is a config change and so belongs to the builder), or re-record the hashes of the files actually shipped and state in README that the vendored copies are reformatted but semantically identical. The economic and invariant review in this report is based on the vendored source as it is, which I verified is semantically identical to upstream v5.0.2.","line":11,"path":"DEPENDENCIES.json","reproduction":"From the repository root run: `cd lib/openzeppelin-contracts && sha256sum contracts/token/ERC20/ERC20.sol contracts/interfaces/draft-IERC6093.sol`. Expected (per DEPENDENCIES.json lines 10-11): 4aea87243e6de38804bf8737bf86f750443d3b5e63dd0fd0b7ad92f77cdbd3e3 and 2d874da1c1478ed22a2d30dcf1a6ec0d09a13f897ca680d55fb49fbcc0e0c5b1. Actual: 94e5638bf0e43993e72ed07612547554e9265b335ab69ad8e74b8d41d90368bd and 4a1db79b7b76a41b1d228242ad369c24fb293be6a62cd00b7e286333e965df59. Checking every entry with `node -e` over DEPENDENCIES.json reports 23 mismatches out of 36 recorded files. `diff` against https://raw.githubusercontent.com/OpenZeppelin/openzeppelin-contracts/v5.0.2/contracts/token/ERC20/ERC20.sol shows only lines 284-287 (signature wrapped onto four lines); no semantic change.","severity":"low","snippet":"      \"contracts/token/ERC20/ERC20.sol\": \"2d874da1c1478ed22a2d30dcf1a6ec0d09a13f897ca680d55fb49fbcc0e0c5b1\",","title":"DEPENDENCIES.json records hashes that do not match the vendored files; README's 'unmodified' claim is not verifiable from the tree"}],"hash":"e8bd21c7ba2b6674c7f441026419fe500110d5e7bfad83ed373c2159a3066ed5","nodeId":"99c6fd27-a804-443c-b12a-dea7b032850f","outcome":"completed","summary":"The review is complete and the findings file is written. Nothing else in the tree was touched.\n\n**Outcome:** the token is economically sound. One low-severity provenance defect is reported, and no economic, invariant or flow-gap defect was found.\n\n**What I checked, against the Economic Security, Invariant and Flow Gap guides:**\n- The token is a bare OpenZeppelin v5.0.2 ERC-20 with one constructor mint of exactly 10^27 units to msg.sender. No owner, no fee, no burn path, no external calls, no callbacks, no proxy.\n- Supply conservation holds. Mint is reachable only from the constructor, burn is never called, and transfers to the zero address revert. The invariant suite confirms it over 256 runs of 64 calls.\n- Launch flows move exactly what they say. Factory to distributor, distributor to claimant, and factory to PoolManager all arrive whole, so the protected flow tests and a v4 seed and swap each way behave as intended.\n- The supply fits Uniswap v4 limits. All amounts stay far below the int128 and uint128 bounds, and the swarm and pool shares divide with no dust.\n- Build, `forge fmt --check` and all 36 tests pass with the README's fuzz seed.\n- The approve front-running race is inherent ERC-20 behaviour, documented in the README, and not reported.\n\n**The one finding, severity low:** DEPENDENCIES.json records upstream hashes for every vendored file, but 23 of 36 files in the tree hash differently, including the ERC20 implementation the README calls unmodified. I fetched upstream v5.0.2 and diffed. The difference is a `forge fmt` line wrap only, so the token's behaviour is unchanged. The defect is that the shipped provenance record cannot verify the shipped tree, which matters for the source-publication and attestation steps that recompute hashes. The reproduction is a single `sha256sum` command with expected and actual values.\n\n**Coverage:** all three entry points are marked as holding, plus six invariant and economics rows and one finding row. I could not check the README's stated 88/2 pool and remainder split against the job, because the job record exposes no economics fields. That is noted as unverified rather than reported.","treeHash":null,"usage":{"cachedInputTokens":1015551,"inputTokens":450,"model":"claude-fable-5-1","outputTokens":11844,"runtime":"claude","turns":15,"wallClockMs":192710}},{"artifacts":[],"attempt":1,"bundleHash":"aba8ec441376cae50ec9d99291f4ba50c5df967f088e8fa3df44b5be89228c09","device":"fdbedee33322a6ef","findings":[],"hash":"f67ca18d4c8033f941a1678af9da949eb13eaac52a47a1640da8e4875f16f27f","nodeId":"6b257f17-59d1-4816-bc61-c54f30b2626f","outcome":"completed","summary":"I wrote `launch.json` for the Infernidentity.md (INFERN) launch. It's the only file I changed, and `forge build` and `forge test` both pass (36 of 36 tests, run with the given fuzz seed).\n\nWhat the manifest says:\n- **Token:** the contract is `InfernToken` (`src/InfernToken.sol`), named \"Infernidentity.md\", symbol \"INFERN\", 18 decimals.\n- **No constructor arguments:** the list is empty because the accepted constructor takes none.\n- **Supply:** `totalSupply` is `\"1000000000000000000000000000\"` (1,000,000,000 × 10^18). That is exactly what the constructor mints, once, to `msg.sender`.\n- **No application contracts:** the accepted tree contains only the token, so `contracts` is empty.\n- **Pool:** IMD at `0xd34a99bc0f67ae1bbd63c660e6d0b0dd03e263b7`, fee 12500, tick spacing 60, and the one-to-one initial price.\n- **Economics:** copied exactly as the job gave it.\n- **Notes:** 408 characters. They describe the token as a plain fixed-supply ERC-20 with no owner, no further minting, no fees and no special admin functions.\n\nThe test run didn't check `launch.json` itself; the format is only checked later, at admission. I checked it by reading it against the format rules: it parses, uses only the allowed keys, has addresses in lowercase, and the notes are under the 4,000-character limit.","treeHash":"bf1ecd43f9fef20f6c239c095d93ca5e7338156e","usage":{"cachedInputTokens":131011,"inputTokens":10,"model":"claude-opus-5-5","outputTokens":2068,"runtime":"claude","turns":6,"wallClockMs":52333}}],"verification":[{"checks":[{"durationMs":1184,"exitCode":0,"name":"build","output":"Compiling 27 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.09s\nCompiler run successful!\n","passed":true},{"durationMs":3590,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 35 tests for test/InfernToken.t.sol:InfernTokenTest\n[PASS] testFuzz_RevertTransferFromOverAllowance(uint256,uint256) (runs: 512, μ: 124782, ~: 125463)\nLogs:\n  Bound result 534695353519704737359635107\n  Bound result 534695353519704737359635109\n\n[PASS] testFuzz_RevertTransferOverBalance(uint256) (runs: 512, μ: 58872, ~: 59214)\nLogs:\n  Bound result 115792089237316195423570985008687907853269984665639564039457584014991858999850\n\n[PASS] testFuzz_TransferConservesSupply(uint256) (runs: 512, μ: 148643, ~: 148584)\nLogs:\n  Bound result 13322\n\n[PASS] testFuzz_TransferFromAccounting(uint256,uint256) (runs: 512, μ: 159351, ~: 161930)\nLogs:\n  Bound result 49795409931435242743420272\n\n[PASS] test_ApproveDoesNotRequireTokenBalance() (gas: 78391)\n[PASS] test_ApproveEmitsEventAndReplacesAllowance() (gas: 119479)\n[PASS] test_ConstructorEmitsSingleMintEvent() (gas: 9730)\n[PASS] test_Create2MintsToFactory() (gas: 255593)\n[PASS] test_DeployerCannotMoveHolderTokensWithoutApproval() (gas: 158024)\n[PASS] test_DeploymentMintsToImmediateDeployerInsteadOfOrigin() (gas: 32770)\n[PASS] test_FactoryDeploymentAndDistributionArriveWhole() (gas: 632580)\n[PASS] test_MetadataAndEntireInitialSupply() (gas: 107737)\n[PASS] test_NoMintBurnAdminOrUpgradeEntrypoints() (gas: 894009)\n[PASS] test_RejectsDirectEtherAndUnknownCalls() (gas: 75219)\n[PASS] test_RevertApproveZeroSpender() (gas: 37562)\n[PASS] test_RevertTransferFromByUnapprovedSpender() (gas: 117813)\n[PASS] test_RevertTransferFromEvenWhenCallerIsHolderWithoutApproval() (gas: 35748)\n[PASS] test_RevertTransferFromInsufficientAllowanceIsAtomic() (gas: 115698)\n[PASS] test_RevertTransferFromInsufficientBalanceRestoresAllowance() (gas: 126198)\n[PASS] test_RevertTransferFromToZeroRestoresAllowance() (gas: 114178)\n[PASS] test_RevertTransferFromZeroAddress() (gas: 35342)\n[PASS] test_RevertTransferToZeroAddress() (gas: 47662)\n[PASS] test_RevertTransferWithoutBalance() (gas: 57536)\n[PASS] test_RevertZeroTransferToZeroAddress() (gas: 30480)\n[PASS] test_RevokedApprovalCannotBeSpent() (gas: 128288)\n[PASS] test_RuntimeIsDeployableAndContainsNoForbiddenOpcodes() (gas: 787494)\n[PASS] test_SelfTransferPreservesBalanceAndEmitsEvent() (gas: 43674)\n[PASS] test_TransferEmitsEventAndDeliversExactAmount() (gas: 91539)\n[PASS] test_TransferEntireBalance() (gas: 75765)\n[PASS] test_TransferFromEmitsEventAndSpendsFiniteAllowance() (gas: 244179)\n[PASS] test_TransferFromToSelfSpendsAllowanceWithoutChangingBalance() (gas: 107632)\n[PASS] test_TransferFromWithInfiniteAllowanceDoesNotDecreaseIt() (gas: 139476)\n[PASS] test_TransferFromZeroWithoutAllowanceEmitsEvent() (gas: 81511)\n[PASS] test_TransferToContractDoesNotCallReceiver() (gas: 171710)\n[PASS] test_TransferZeroFromEmptyAccountEmitsEvent() (gas: 73453)\nSuite result: ok. 35 passed; 0 failed; 0 skipped; finished in 15.72ms (68.58ms CPU time)\n\nRan 1 test for test/InfernToken.invariant.t.sol:InfernTokenInvariantTest\n[PASS]\nInfernTokenInvariantTest invariants:\n[PASS] invariant_AllowancesMatchOnlyHolderAuthorizationsAndSpending\n[PASS] invariant_SupplyAndBalancesAreConserved\n InfernTokenInvariantTest invariants (runs: 256, calls: 16384, reverts: 0)\n\n╭--------------------+--------------+-------+---------+----------╮\n| Contract           | Selector     | Calls | Reverts | Discards |\n+================================================================+\n| InfernTokenHandler | approve      | 3327  | 0       | 0        |\n|--------------------+--------------+-------+---------+----------|\n| InfernTokenHandler | overdraw     | 3235  | 0       | 0        |\n|--------------------+--------------+-------+---------+----------|\n| InfernTokenHandler | overspend    | 3317  | 0       | 0        |\n|--------------------+--------------+-------+---------+----------|\n| InfernTokenHandler | transfer     | 3264  | 0       | 0        |\n|--------------------+--------------+-------+---------+----------|\n| InfernTokenHandler | transferFrom | 3241  | 0       | 0        |\n╰--------------------+--------------+-------+---------+----------╯\n\nLogs:\n  Bound result 0\n  Bound result 24576\n  Bound result 1447\n  Bound result 720\n  Bound result 0\n  Bound result 123000000000000000000\n  Bound result 0\n  Bound result 122999999999999999998\n  Bound result 1955\n  Bound result 4246\n  Bound result 5\n  Bound result 770726368368053643264532769\n  Bound result 2217\n  Bound result 578715272639936839556045667\n  Bound result 1856\n  Bound result 4497\n  Bound result 3792478064\n  Bound result 0\n  Bound result 0\n  Bound result 1235\n  Bound result 4175\n  Bound result 1348\n  Bound result 12\n  Bound result 578\n  Bound result 719206527\n  Bound result 213438289468162426338325439\n  Bound result 274\n  Bound result 289\n  Bound result 64690199091176315549\n  Bound result 64690199091176316251\n  Bound result 0\n  Bound result 88\n  Bound result 7\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 3.51s (3.51s CPU time)\n\nRan 2 test suites in 3.51s (3.52s CPU time): 36 tests passed, 0 failed, 0 skipped (36 total tests)\n","passed":true},{"durationMs":47,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"InfernToken.approve(address,uint256)\",\"InfernToken.transfer(address,uint256)\",\"InfernToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"DEPENDENCIES.json\":56,\"README.md\":110,\"foundry.toml\":21,\"remappings.txt\":2,\"src/InfernToken.sol\":17,\"test/InfernToken.invariant.t.sol\":136,\"test/InfernToken.t.sol\":467},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true},{"durationMs":418,"exitCode":0,"name":"slither","output":"slither: no results at low impact or above","passed":true},{"durationMs":126,"exitCode":0,"name":"aderyn","output":"[low] large-numeric-literal at src/InfernToken.sol:10: Large Numeric Literal","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"30b6209128091802d2f2a6ad0edb5993848da52b1c6c6ffb7202720e6f704d1a","verifiedTreeHash":"9333a0067552a54e5c0db5e4bda87d9df1c24c9f","verifierVersion":"0.1.0+8fbf00a5"},{"checks":[{"durationMs":1458,"exitCode":0,"name":"build","output":"Compiling 28 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.38s\nCompiler run successful!\n","passed":true},{"durationMs":8177,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 17 tests for test/InfernToken.adversarial.t.sol:InfernTokenAdversarialTest\n[PASS] testFuzz_AllowanceReplacementIsIsolatedToOwnerAndSpender(uint256,uint256,uint256) (runs: 1000, μ: 317621, ~: 318160)\n[PASS] testFuzz_DelegatedSelfTransferChangesOnlyFiniteAllowance(uint256,uint256,uint256) (runs: 1000, μ: 241401, ~: 242232)\nLogs:\n  Bound result 616987169316048362173962950\n  Bound result 120262146605794\n\n[PASS] testFuzz_InvalidRecipientRollsBackAllowance(uint256,uint256) (runs: 1000, μ: 178805, ~: 179412)\nLogs:\n  Bound result 6\n\n[PASS] testFuzz_OverdrawRollsBackLargeFiniteAllowance(uint256,uint256,uint256) (runs: 1000, μ: 247162, ~: 247690)\nLogs:\n  Bound result 3222\n  Bound result 115792089237316195423570985008687907853269984665640564039457584007913129637870\n  Bound result 115792089237316195423570985008687907853269984665640564039457584007913129638997\n\n[PASS] test_ApprovalCanBeRestoredAfterRevocation() (gas: 274016)\n[PASS] test_ContractSpenderNeedsItsOwnApprovalEvenWithAuthorizedOrigin() (gas: 562751)\n[PASS] test_DelegatedSelfTransferStillRequiresEnoughBalance() (gas: 233583)\n[PASS] test_ExhaustedAllowanceCannotBeSpentAgainAfterHolderIsRefilled() (gas: 332453)\n[PASS] test_FailedDelegatedTransferDoesNotConsumeApprovalAndCanBeRetried() (gas: 302432)\n[PASS] test_MaximumDelegatedTransferCannotOverdrawAnUnlimitedApproval() (gas: 177514)\n[PASS] test_MaximumMinusOneAllowanceIsFiniteAcrossRepeatedSpends() (gas: 280646)\n[PASS] test_MaximumTransferCannotWrapBalancesEvenForSelfTransfer() (gas: 222272)\n[PASS] test_OneWeiCanBeTransferredAndReturnedThroughAnAllowance() (gas: 261048)\n[PASS] test_ReducingUnlimitedApprovalMakesSubsequentSpendingFinite() (gas: 321858)\n[PASS] test_RevokingUnlimitedApprovalEmitsEventAndPreventsFurtherSpending() (gas: 261096)\n[PASS] test_SpenderCannotRedelegateAnotherHoldersApproval() (gas: 310352)\n[PASS] test_ZeroDelegatedSelfTransferPreservesFiniteAndUnlimitedApprovals() (gas: 275385)\nSuite result: ok. 17 passed; 0 failed; 0 skipped; finished in 53.11ms (211.11ms CPU time)\n\nRan 35 tests for test/InfernToken.t.sol:InfernTokenTest\n[PASS] testFuzz_RevertTransferFromOverAllowance(uint256,uint256) (runs: 512, μ: 124958, ~: 125473)\nLogs:\n  Bound result 1000000000000000000\n  Bound result 999999999000000000000028452\n\n[PASS] testFuzz_RevertTransferOverBalance(uint256) (runs: 512, μ: 58853, ~: 59214)\nLogs:\n  Bound result 115792089237316195423570985008687907853269984665639564039457584014991858999850\n\n[PASS] testFuzz_TransferConservesSupply(uint256) (runs: 512, μ: 148759, ~: 148596)\nLogs:\n  Bound result 7078729359915\n\n[PASS] testFuzz_TransferFromAccounting(uint256,uint256) (runs: 512, μ: 159562, ~: 161962)\nLogs:\n  Bound result 1\n\n[PASS] test_ApproveDoesNotRequireTokenBalance() (gas: 78391)\n[PASS] test_ApproveEmitsEventAndReplacesAllowance() (gas: 119479)\n[PASS] test_ConstructorEmitsSingleMintEvent() (gas: 9730)\n[PASS] test_Create2MintsToFactory() (gas: 255593)\n[PASS] test_DeployerCannotMoveHolderTokensWithoutApproval() (gas: 158024)\n[PASS] test_DeploymentMintsToImmediateDeployerInsteadOfOrigin() (gas: 32770)\n[PASS] test_FactoryDeploymentAndDistributionArriveWhole() (gas: 632580)\n[PASS] test_MetadataAndEntireInitialSupply() (gas: 107737)\n[PASS] test_NoMintBurnAdminOrUpgradeEntrypoints() (gas: 894009)\n[PASS] test_RejectsDirectEtherAndUnknownCalls() (gas: 75219)\n[PASS] test_RevertApproveZeroSpender() (gas: 37562)\n[PASS] test_RevertTransferFromByUnapprovedSpender() (gas: 117813)\n[PASS] test_RevertTransferFromEvenWhenCallerIsHolderWithoutApproval() (gas: 35748)\n[PASS] test_RevertTransferFromInsufficientAllowanceIsAtomic() (gas: 115698)\n[PASS] test_RevertTransferFromInsufficientBalanceRestoresAllowance() (gas: 126198)\n[PASS] test_RevertTransferFromToZeroRestoresAllowance() (gas: 114178)\n[PASS] test_RevertTransferFromZeroAddress() (gas: 35342)\n[PASS] test_RevertTransferToZeroAddress() (gas: 47662)\n[PASS] test_RevertTransferWithoutBalance() (gas: 57536)\n[PASS] test_RevertZeroTransferToZeroAddress() (gas: 30480)\n[PASS] test_RevokedApprovalCannotBeSpent() (gas: 128288)\n[PASS] test_RuntimeIsDeployableAndContainsNoForbiddenOpcodes() (gas: 787494)\n[PASS] test_SelfTransferPreservesBalanceAndEmitsEvent() (gas: 43674)\n[PASS] test_TransferEmitsEventAndDeliversExactAmount() (gas: 91539)\n[PASS] test_TransferEntireBalance() (gas: 75765)\n[PASS] test_TransferFromEmitsEventAndSpendsFiniteAllowance() (gas: 244179)\n[PASS] test_TransferFromToSelfSpendsAllowanceWithoutChangingBalance() (gas: 107632)\n[PASS] test_TransferFromWithInfiniteAllowanceDoesNotDecreaseIt() (gas: 139476)\n[PASS] test_TransferFromZeroWithoutAllowanceEmitsEvent() (gas: 81511)\n[PASS] test_TransferToContractDoesNotCallReceiver() (gas: 171710)\n[PASS] test_TransferZeroFromEmptyAccountEmitsEvent() (gas: 73453)\nSuite result: ok. 35 passed; 0 failed; 0 skipped; finished in 53.68ms (192.66ms CPU time)\n\nRan 2 tests for test/InfernToken.invariant.t.sol:InfernTokenInvariantTest\n[PASS]\nInfernTokenInvariantTest invariants:\n[PASS] invariant_AllowancesMatchOnlyHolderAuthorizationsAndSpending\n[PASS] invariant_MetadataNeverChanges\n[PASS] invariant_SupplyAndBalancesAreConserved\n InfernTokenInvariantTest invariants (runs: 256, calls: 32768, reverts: 0)\n\n╭--------------------+--------------------+-------+---------+----------╮\n| Contract           | Selector           | Calls | Reverts | Discards |\n+======================================================================+\n| InfernTokenHandler | approve            | 3030  | 0       | 0        |\n|--------------------+--------------------+-------+---------+----------|\n| InfernTokenHandler | approveZeroSpender | 3001  | 0       | 0        |\n|--------------------+--------------------+-------+---------+----------|\n| InfernTokenHandler | overdraw           | 3062  | 0       | 0        |\n|--------------------+--------------------+-------+---------+----------|\n| InfernTokenHandler | overdrawFrom       | 2990  | 0       | 0        |\n|--------------------+--------------------+-------+---------+----------|\n| InfernTokenHandler | overspend          | 2981  | 0       | 0        |\n|--------------------+--------------------+-------+---------+----------|\n| InfernTokenHandler | revoke             | 3039  | 0       | 0        |\n|--------------------+--------------------+-------+---------+----------|\n| InfernTokenHandler | transfer           | 2871  | 0       | 0        |\n|--------------------+--------------------+-------+---------+----------|\n| InfernTokenHandler | transferAll        | 2941  | 0       | 0        |\n|--------------------+--------------------+-------+---------+----------|\n| InfernTokenHandler | transferFrom       | 2948  | 0       | 0        |\n|--------------------+--------------------+-------+---------+----------|\n| InfernTokenHandler | transferFromToZero | 2944  | 0       | 0        |\n|--------------------+--------------------+-------+---------+----------|\n| InfernTokenHandler | transferToZero     | 2961  | 0       | 0        |\n╰--------------------+--------------------+-------+---------+----------╯\n\nLogs:\n  Bound result 250000000000000000000000000\n  Bound result 250000000000000000000000000\n  Bound result 500000000000000000000000000\n  Bound result 115792089237316195423570985008687907853269984665640564039457584007913129639934\n  Bound result 0\n  Bound result 244\n  Bound result 294224232143670947065214717\n  Bound result 296\n  Bound result 0\n  Bound result 100\n  Bound result 1632331319884802156358995\n  Bound result 7429\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 42000000000000000000\n  Bound result 1\n  Bound result 470334542550868483\n  Bound result 96\n  Bound result 0\n  Bound result 0\n  Bound result 4398\n  Bound result 0\n  Bound result 0\n  Bound result 128776725229808685210220153\n  Bound result 244\n  Bound result 0\n  Bound result 115792089237316195423570985008687907853269984665640564039457584007913129639933\n  Bound result 0\n  Bound result 0\n  Bound result 5566\n  Bound result 0\n  Bound result 0\n  Bound result 242\n  Bound result 0\n  Bound result 7411\n  Bound result 3\n  Bound result 56759027452170759665053013\n  Bound result 0\n  Bound result 645326474426547203313410069153905908525362434348\n  Bound result 0\n  Bound result 0\n  Bound result 42000000000000000000\n  Bound result 0\n  Bound result 0\n  Bound result 18\n  Bound result 0\n  Bound result 0\n  Bound result 12\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 123000000000000000000\n  Bound result 88882294717804520145546124292896593335095118750962511939\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 24576\n  Bound result 244\n  Bound result 0\n  Bound result 1000000000000000000\n  Bound result 0\n  Bound result 294224355143670947065214961\n  Bound result 334552493086137738145012847\n  Bound result 371223151770191314789772192\n\n[PASS] test_HandlerSequenceExercisesAuthorizationAndRollback() (gas: 2763505)\nLogs:\n  Bound result 250000000000000000000000000\n  Bound result 250000000000000000000000000\n  Bound result 500000000000000000000000000\n  Bound result 115792089237316195423570985008687907853269984665640564039457584007913129639934\n  Bound result 1\n  Bound result 1\n  Bound result 1\n  Bound result 500000000000000000000000000\n  Bound result 750000000000000000000000000\n  Bound result 250000000000000000000000000\n  Bound result 0\n\nSuite result: ok. 2 passed; 0 failed; 0 skipped; finished in 8.08s (8.08s CPU time)\n\nRan 3 test suites in 8.09s (8.19s CPU time): 54 tests passed, 0 failed, 0 skipped (54 total tests)\n","passed":true},{"durationMs":39,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"InfernToken.approve(address,uint256)\",\"InfernToken.transfer(address,uint256)\",\"InfernToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"DEPENDENCIES.json\":56,\"README.md\":110,\"foundry.toml\":21,\"remappings.txt\":2,\"src/InfernToken.sol\":17,\"test/InfernToken.adversarial.t.sol\":317,\"test/InfernToken.invariant.t.sol\":276,\"test/InfernToken.t.sol\":467,\"test/README.md\":38},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"7d03a21828a6fe3d66b9843eb603af3f19291c31126c09af7ca3550d21f829e7","verifiedTreeHash":"ef6dfb384f9a0ad73d276876339c28ae863be50d","verifierVersion":"0.1.0+8fbf00a5"},{"checks":[{"durationMs":1193,"exitCode":0,"name":"build","output":"Compiling 27 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.12s\nCompiler run successful!\n","passed":true},{"durationMs":3795,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 35 tests for test/InfernToken.t.sol:InfernTokenTest\n[PASS] testFuzz_RevertTransferFromOverAllowance(uint256,uint256) (runs: 512, μ: 124782, ~: 125463)\nLogs:\n  Bound result 534695353519704737359635107\n  Bound result 534695353519704737359635109\n\n[PASS] testFuzz_RevertTransferOverBalance(uint256) (runs: 512, μ: 58872, ~: 59214)\nLogs:\n  Bound result 115792089237316195423570985008687907853269984665639564039457584007913129644538\n\n[PASS] testFuzz_TransferConservesSupply(uint256) (runs: 512, μ: 148643, ~: 148584)\nLogs:\n  Bound result 10\n\n[PASS] testFuzz_TransferFromAccounting(uint256,uint256) (runs: 512, μ: 159351, ~: 161930)\nLogs:\n  Bound result 2\n\n[PASS] test_ApproveDoesNotRequireTokenBalance() (gas: 78391)\n[PASS] test_ApproveEmitsEventAndReplacesAllowance() (gas: 119479)\n[PASS] test_ConstructorEmitsSingleMintEvent() (gas: 9730)\n[PASS] test_Create2MintsToFactory() (gas: 255593)\n[PASS] test_DeployerCannotMoveHolderTokensWithoutApproval() (gas: 158024)\n[PASS] test_DeploymentMintsToImmediateDeployerInsteadOfOrigin() (gas: 32770)\n[PASS] test_FactoryDeploymentAndDistributionArriveWhole() (gas: 632580)\n[PASS] test_MetadataAndEntireInitialSupply() (gas: 107737)\n[PASS] test_NoMintBurnAdminOrUpgradeEntrypoints() (gas: 894009)\n[PASS] test_RejectsDirectEtherAndUnknownCalls() (gas: 75219)\n[PASS] test_RevertApproveZeroSpender() (gas: 37562)\n[PASS] test_RevertTransferFromByUnapprovedSpender() (gas: 117813)\n[PASS] test_RevertTransferFromEvenWhenCallerIsHolderWithoutApproval() (gas: 35748)\n[PASS] test_RevertTransferFromInsufficientAllowanceIsAtomic() (gas: 115698)\n[PASS] test_RevertTransferFromInsufficientBalanceRestoresAllowance() (gas: 126198)\n[PASS] test_RevertTransferFromToZeroRestoresAllowance() (gas: 114178)\n[PASS] test_RevertTransferFromZeroAddress() (gas: 35342)\n[PASS] test_RevertTransferToZeroAddress() (gas: 47662)\n[PASS] test_RevertTransferWithoutBalance() (gas: 57536)\n[PASS] test_RevertZeroTransferToZeroAddress() (gas: 30480)\n[PASS] test_RevokedApprovalCannotBeSpent() (gas: 128288)\n[PASS] test_RuntimeIsDeployableAndContainsNoForbiddenOpcodes() (gas: 787494)\n[PASS] test_SelfTransferPreservesBalanceAndEmitsEvent() (gas: 43674)\n[PASS] test_TransferEmitsEventAndDeliversExactAmount() (gas: 91539)\n[PASS] test_TransferEntireBalance() (gas: 75765)\n[PASS] test_TransferFromEmitsEventAndSpendsFiniteAllowance() (gas: 244179)\n[PASS] test_TransferFromToSelfSpendsAllowanceWithoutChangingBalance() (gas: 107632)\n[PASS] test_TransferFromWithInfiniteAllowanceDoesNotDecreaseIt() (gas: 139476)\n[PASS] test_TransferFromZeroWithoutAllowanceEmitsEvent() (gas: 81511)\n[PASS] test_TransferToContractDoesNotCallReceiver() (gas: 171710)\n[PASS] test_TransferZeroFromEmptyAccountEmitsEvent() (gas: 73453)\nSuite result: ok. 35 passed; 0 failed; 0 skipped; finished in 20.48ms (71.24ms CPU time)\n\nRan 1 test for test/InfernToken.invariant.t.sol:InfernTokenInvariantTest\n[PASS]\nInfernTokenInvariantTest invariants:\n[PASS] invariant_AllowancesMatchOnlyHolderAuthorizationsAndSpending\n[PASS] invariant_SupplyAndBalancesAreConserved\n InfernTokenInvariantTest invariants (runs: 256, calls: 16384, reverts: 0)\n\n╭--------------------+--------------+-------+---------+----------╮\n| Contract           | Selector     | Calls | Reverts | Discards |\n+================================================================+\n| InfernTokenHandler | approve      | 3327  | 0       | 0        |\n|--------------------+--------------+-------+---------+----------|\n| InfernTokenHandler | overdraw     | 3235  | 0       | 0        |\n|--------------------+--------------+-------+---------+----------|\n| InfernTokenHandler | overspend    | 3317  | 0       | 0        |\n|--------------------+--------------+-------+---------+----------|\n| InfernTokenHandler | transfer     | 3264  | 0       | 0        |\n|--------------------+--------------+-------+---------+----------|\n| InfernTokenHandler | transferFrom | 3241  | 0       | 0        |\n╰--------------------+--------------+-------+---------+----------╯\n\nLogs:\n  Bound result 0\n  Bound result 24576\n  Bound result 1447\n  Bound result 720\n  Bound result 0\n  Bound result 123000000000000000000\n  Bound result 0\n  Bound result 122999999999999999998\n  Bound result 1955\n  Bound result 4246\n  Bound result 5\n  Bound result 770726368368053643264532769\n  Bound result 2217\n  Bound result 578715272639936839556045667\n  Bound result 1856\n  Bound result 4497\n  Bound result 3792478064\n  Bound result 0\n  Bound result 0\n  Bound result 1235\n  Bound result 4175\n  Bound result 1348\n  Bound result 12\n  Bound result 578\n  Bound result 719206527\n  Bound result 213438289468162426338325439\n  Bound result 274\n  Bound result 289\n  Bound result 64690199091176315549\n  Bound result 64690199091176316251\n  Bound result 0\n  Bound result 88\n  Bound result 7\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 3.70s (3.70s CPU time)\n\nRan 2 test suites in 3.70s (3.72s CPU time): 36 tests passed, 0 failed, 0 skipped (36 total tests)\n","passed":true},{"durationMs":36,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"InfernToken.approve(address,uint256)\",\"InfernToken.transfer(address,uint256)\",\"InfernToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"DEPENDENCIES.json\":56,\"README.md\":110,\"foundry.toml\":21,\"launch.json\":24,\"remappings.txt\":2,\"src/InfernToken.sol\":17,\"test/InfernToken.invariant.t.sol\":136,\"test/InfernToken.t.sol\":467},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"f67ca18d4c8033f941a1678af9da949eb13eaac52a47a1640da8e4875f16f27f","verifiedTreeHash":"bf1ecd43f9fef20f6c239c095d93ca5e7338156e","verifierVersion":"0.1.0+8fbf00a5"}]}