{"assessments":[],"deployments":[],"fuzz":[],"identity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"interpretation":"Records acceptance and evidence. Neither completion nor an AI assessment establishes correctness, safety, or independent review.","jobId":"4ef8d7ce-1dd4-47dc-bdd4-1eda55163381","kind":"shape:chain","nodes":[{"acceptedSubmissionHash":"3bf255ac55ba4610141c2e2b568b71d748278aa3179d3f86657364856c3512b9","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"bc5bfc8455464381f2db18badb2b55cf8bec1e535c019349a0378fa990741171","skillId":"audit-specialist","subagents":3,"tools":[]},"key":"audit_economics","kind":"code","role":"review","skillHash":"bc5bfc8455464381f2db18badb2b55cf8bec1e535c019349a0378fa990741171","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"c809081ddf71405e80eda2b062ca489c4758ca5d74a0df653940b102e5bcb952","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"bc5bfc8455464381f2db18badb2b55cf8bec1e535c019349a0378fa990741171","skillId":"audit-specialist","subagents":3,"tools":[]},"key":"audit_flow","kind":"code","role":"review","skillHash":"bc5bfc8455464381f2db18badb2b55cf8bec1e535c019349a0378fa990741171","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"8cf406de42493c04c6f9982144b7046fbb399151472be4361d7967b74077bd04","dependsOn":["build_contract_project","write_foundry_tests","manifest","audit_math","audit_permissions","audit_economics","audit_flow"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"b89279670f5a00f5d26286edee00c97dd158b997031350a01cafe6e0329ad227","skillId":"audit-judge","subagents":4,"tools":[]},"key":"audit_judge","kind":"code","role":"review","skillHash":"b89279670f5a00f5d26286edee00c97dd158b997031350a01cafe6e0329ad227","skillId":"audit-judge","state":"accepted"},{"acceptedSubmissionHash":"79cf71e4b1659b19f0f2058579a1c71c023a34f5e10b2590781fb44050fd2db4","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"bc5bfc8455464381f2db18badb2b55cf8bec1e535c019349a0378fa990741171","skillId":"audit-specialist","subagents":3,"tools":[]},"key":"audit_math","kind":"code","role":"review","skillHash":"bc5bfc8455464381f2db18badb2b55cf8bec1e535c019349a0378fa990741171","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"55b4237401f2fd8db0c822670669a294f45c5a25d261994a58ba888ea4a9db7d","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"bc5bfc8455464381f2db18badb2b55cf8bec1e535c019349a0378fa990741171","skillId":"audit-specialist","subagents":3,"tools":[]},"key":"audit_permissions","kind":"code","role":"review","skillHash":"bc5bfc8455464381f2db18badb2b55cf8bec1e535c019349a0378fa990741171","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"9af017c5c90704e3e6ffd34e0f9c2af5aa2db68f5e4c0e029af1b98b7ca3246a","dependsOn":[],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"15b04fc8f60521936b9e2b37c09a804685ec689fc98cd5b04510d986d3106a15","skillId":"build-contract-project","tools":[]},"key":"build_contract_project","kind":"code","role":"implement","skillHash":"15b04fc8f60521936b9e2b37c09a804685ec689fc98cd5b04510d986d3106a15","skillId":"build-contract-project","state":"accepted"},{"acceptedSubmissionHash":"35727650e87fa508eedbf0c69b776db967a8cffc8cbb71342797c9ce0a785f77","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"tools":[]},"key":"manifest","kind":"code","role":"integrate","skillHash":null,"skillId":null,"state":"accepted"},{"acceptedSubmissionHash":"7368cb05a061d634a0a9da79228f7fbe5cca2467afcae7b5ff852975a5559544","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"606842ccca0e7c5d3017a54684625438eab9b351eb51dcf0cf88c43d1ea41464","skillId":"write-foundry-tests","subagents":4,"tools":[]},"key":"write_foundry_tests","kind":"code","role":"tests","skillHash":"606842ccca0e7c5d3017a54684625438eab9b351eb51dcf0cf88c43d1ea41464","skillId":"write-foundry-tests","state":"accepted"}],"objective":"A custom token: plea (PLEA).\nToken name: plea\nToken symbol: PLEA\nToken supply: 1,000,000,000 with 18 decimals, all minted once to the deployer in the constructor.","parentJobId":null,"planHash":"444b9d6ab4e9e3360418de5b31fd0a90adc32c63d2704944687a06869db50e03","previousHash":"0000000000000000000000000000000000000000000000000000000000000000","projectId":"4ef8d7ce-1dd4-47dc-bdd4-1eda55163381","publication":{"commit":null,"deliveredAt":null,"repoUrl":"https://github.com/identity-md-launches/launch-2835-plea"},"receiptIdentity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"registry":"0xb6d0a187b050fa5bb0b87033a203f37becf4a775","research":[],"schema":"identitymd-work-v1","signals":[{"agentId":"52618","feedbackHash":"1b64cfd2c831873584a86635063b94c9125b74b93e8ca313adcc675b32e1efd0","nodeKey":"audit_economics","submissionHash":"3bf255ac55ba4610141c2e2b568b71d748278aa3179d3f86657364856c3512b9","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51162","feedbackHash":"3ee46d6e772eb8d163e92027ef42d1a581e1cf6ad9323fc3d4df19f9cee213b3","nodeKey":"audit_flow","submissionHash":"c809081ddf71405e80eda2b062ca489c4758ca5d74a0df653940b102e5bcb952","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51352","feedbackHash":"183efa99dfe50f8ae59c60d1ac7b2f03cff32de92434df9a338426118ea4d6f1","nodeKey":"audit_judge","submissionHash":"8cf406de42493c04c6f9982144b7046fbb399151472be4361d7967b74077bd04","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52179","feedbackHash":"2a5e1b4353d4588d09f739811503e40aa57c70f6cd6e7001a86eeb96206d9e01","nodeKey":"audit_math","submissionHash":"79cf71e4b1659b19f0f2058579a1c71c023a34f5e10b2590781fb44050fd2db4","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52621","feedbackHash":"9ca0df1f1d1377b7db3eaf436f50f5b4238ba52fd2f0e69ac0c19270644cb6ac","nodeKey":"audit_permissions","submissionHash":"55b4237401f2fd8db0c822670669a294f45c5a25d261994a58ba888ea4a9db7d","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52206","feedbackHash":"df602dbfc1ade2e946d7be2e2c4b6358364e892bbd1273127a7bed54f95bb1e8","nodeKey":"build_contract_project","submissionHash":"9af017c5c90704e3e6ffd34e0f9c2af5aa2db68f5e4c0e029af1b98b7ca3246a","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"51879","feedbackHash":"5da3dda1ce0a74c06f3e1b16cec539bee7e2a5263111450e36c8394523f4a7f7","nodeKey":"manifest","submissionHash":"35727650e87fa508eedbf0c69b776db967a8cffc8cbb71342797c9ce0a785f77","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"51010","feedbackHash":"b0b25c8bbfb25d15e9cfdc4bef315a35ce0f576732578578e8e680aaf1fa693b","nodeKey":"write_foundry_tests","submissionHash":"7368cb05a061d634a0a9da79228f7fbe5cca2467afcae7b5ff852975a5559544","tag1":"verification:checks","tag2":"acceptance-v2","value":1}],"site":null,"snapshotHash":"1c9431341449a71af121001050bba5399753e6668ee261b3fc7bae286362d509","state":"completed","submissions":[{"artifacts":[],"attempt":1,"bundleHash":"430d43b6d47f35eb0e6eec9a386753310987f5315bdff0abd1ab15db6e00f98d","device":"4faf975f1178e1f8","findings":[],"hash":"35727650e87fa508eedbf0c69b776db967a8cffc8cbb71342797c9ce0a785f77","nodeId":"a6957d91-7c38-4caa-aa0a-7623ecaca0e1","outcome":"completed","summary":"Done. The manifest is written and verified, and it is the only changed file.\n\n**What I wrote** in launch.json:\n- Kind is custom_token. The token entry names the Solidity contract `PleaToken`, with name plea, symbol PLEA, 18 decimals, an empty constructorArgs list, and totalSupply of 10^27 minor units.\n- The contracts list is empty. The accepted tree contains only the token, with no application contracts.\n- Pool and economics are copied exactly from the brief: IMD pair at the given address, fee 12500, tick spacing 60, the one-to-one initialPrice, and the requester's economics object verbatim.\n- Notes describe the fixed supply token, its lack of admin powers, and that the launch flows move exact amounts. The notes are well under the 4000 character limit.\n\n**What I verified**:\n- The compiled ABI confirms the constructor takes no inputs, matching the empty constructorArgs.\n- The constructor mints exactly 1,000,000,000 times 10^18 to msg.sender, matching totalSupply.\n- The JSON parses and contains only the schema's six top level keys, with addresses in lowercase.\n- Build succeeds and all 32 tests pass with the verifier's fuzz seed.\n- Git status shows launch.json as the only new or changed file.","treeHash":"b519ba34d13a4323013214cc0d32935344f081c6","usage":{"cachedInputTokens":165535,"inputTokens":162,"model":"claude-fable-5-1","outputTokens":3118,"runtime":"claude","turns":11,"wallClockMs":46557}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"faf271d05ee8ea0f","findings":[{"citation":"resolved","description":"DEPENDENCIES.md says the vendored files are unmodified release sources and tells readers to run `sha256sum --check DEPENDENCIES.sha256`. That check fails on six forge-std files. The hashes in DEPENDENCIES.sha256 are correct for the upstream v1.9.6 release (archive SHA-256 53d2b498...c1b6, as documented). The committed files differ from upstream only in whitespace and line wrapping, which looks like a `forge fmt` pass. When all whitespace is removed, each file is byte-identical to upstream. forge-std is used only by tests, and every OpenZeppelin file the token compiles against passes its hash. So this has no effect on the token, its economics or the deployed bytecode. The only problem is that the provenance statement and its integrity check do not hold for the committed tree.","line":13,"path":"DEPENDENCIES.md","reproduction":"From the repository root, run `sha256sum --check DEPENDENCIES.sha256`. Expected: every line OK. Actual: lib/forge-std/src/StdJson.sol, Vm.sol, interfaces/IMulticall3.sol, console.sol, StdAssertions.sol and StdToml.sol report FAILED (\"6 computed checksums did NOT match\"). For example, the expected StdJson.sol hash 0211b47e...511f matches the file in the upstream v1.9.6 tarball, but the committed file hashes to 61bbf9b3...cb83. The cause is whitespace only: `tr -d ' \\n\\t'` on the upstream and committed copies gives identical hashes for all six files. Fix: restore the six files from the v1.9.6 tarball byte for byte. Do not change the hash list.","severity":"info","snippet":"These files are unmodified release sources. Their upstream copyright and license","title":"Outside economics area: six vendored forge-std files fail the documented DEPENDENCIES.sha256 check (whitespace-only reformatting, test-only)"}],"hash":"3bf255ac55ba4610141c2e2b568b71d748278aa3179d3f86657364856c3512b9","nodeId":"85fe0a84-edbe-42b2-b20f-0ea8a7654dff","outcome":"completed","summary":"I found no economic defects in the PLEA token. The findings file holds one informational item from outside the economics area. The report is in `.imd-findings.json`; it is valid JSON and nothing in the repository was changed.\n\n**The contract:** `src/PleaToken.sol` is a stock OpenZeppelin v5.0.2 ERC20. The OZ files it builds from match their pinned hashes. Its constructor mints exactly 1,000,000,000 × 10¹⁸ to the deployer, which is the factory. It takes no constructor arguments, so the manifest's `constructorArgs` should be `[]`. The name is \"plea\", the symbol \"PLEA\", and decimals 18. The public functions are only the standard ERC-20 ones.\n\n**What I checked against the three guides:**\n- **Economic Security:** transfers have no fee, burn, rebase or hook, so the factory's transfers to the distributor and the pool, and traders' swaps, all move exactly the stated amount. There is no external dependency or oracle, and no owner, pause, blacklist or seize power.\n- **Invariant:** the supply is fixed (the constructor is the only place tokens are created) and always equals the sum of balances. A finite allowance drops by exactly the amount spent, an unlimited one stays unlimited, and a failed transfer rolls the allowance back.\n- **Flow Gap:** none of the four seams applies here, because the token makes no outside calls and runs no code mid-transfer.\n\n**Testing:** the project's 32 tests pass. I also ran my own fuzz test (1,024 runs) on exact transfer amounts, allowance accounting and supply conservation, and it passed. I then deleted it. I could not run the protected floor tests here, because the files they import aren't in this tree.\n\n**Coverage:** `approve`, `transfer` and `transferFrom` each have a row marked `holds`, plus two rows for the supply invariant and the constructor and metadata.\n\n**The informational item:** running `sha256sum --check DEPENDENCIES.sha256` fails on six vendored forge-std files. I compared them with the upstream v1.9.6 release, and the only differences are whitespace and line wrapping. This contradicts the statement at `DEPENDENCIES.md:13` that the files are unmodified, but it doesn't affect the token, because forge-std is used only by tests. The fix is to restore those six files exactly from the release.\n\n**Leads I dropped:**\n- The large-number warning from aderyn is just the supply constant, which is correct.\n- The approve front-running race is standard ERC-20 behaviour.\n- Tokens sent to the token contract's own address are stuck for good, which is expected for a token with no admin.","treeHash":null,"usage":{"cachedInputTokens":397378,"inputTokens":25,"model":"claude-opus-5-5","outputTokens":7206,"runtime":"claude","turns":13,"wallClockMs":100343}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"bfeaa965edf57623","findings":[],"hash":"55b4237401f2fd8db0c822670669a294f45c5a25d261994a58ba888ea4a9db7d","nodeId":"4469663c-37c0-4faa-bdb1-d8d75f2b9031","outcome":"completed","summary":"I found no permission defects in `PleaToken`. `.imd-findings.json` holds an empty findings list and a coverage row for each of the three entry points, all marked `holds`, plus two rows for supply and minting invariants. I changed no other files.\n\n**Scope:** `src/PleaToken.sol` and the OpenZeppelin v5.0.2 `ERC20` it inherits. I made the Access Control, Trust Gap and Asymmetry passes myself; no helpers were used.\n\n- **Access Control:** the contract adds only a constant and a constructor. The constructor mints all 1,000,000,000 × 10^18 units once to `msg.sender`, which in a launch is the factory. There is no owner, role, pause, blacklist, freeze, seize, burn function or further minting. `_mint` runs only from the constructor and `_burn` never runs, so the total supply cannot change.\n- **Trust Gap:** none of the inherited functions are overridden, so there are no fees, hooks or exemptions. The factory's handoffs, the distributor's claims and pool swaps all move exactly the amount stated.\n- **Asymmetry:** `transfer` and `transferFrom` both go through the same internal transfer. `transferFrom` checks the spender's allowance before moving anything. An unlimited allowance is not reduced when spent, which is the standard documented behaviour. The race when changing an existing allowance is a known property of every ERC-20, not a defect here.\n- **Leads:** slither reported nothing. Aderyn's only line, a \"large numeric literal\" at line 10, is the supply constant and is not a defect.\n- **Checks run:** the project's own tests pass (32 of 32). The OpenZeppelin files match the hashes in `DEPENDENCIES.sha256`.\n\n**Outside my area (no finding filed):** six forge-std files (`Vm.sol`, `StdJson.sol`, `StdToml.sol`, `StdAssertions.sol`, `console.sol`, `IMulticall3.sol`) do not match `DEPENDENCIES.sha256`. That contradicts `DEPENDENCIES.md`, which says the files are unmodified. forge-std is used only by tests and is not part of the deployed token, so it has no effect on the contract. I didn't look into why the files differ.\n\n**Not run:** the protected launch checks depend on floor files that aren't in this tree, so I didn't run them. A clean review here does not prove the token has no defects.","treeHash":null,"usage":{"cachedInputTokens":146543,"inputTokens":12,"model":"claude-opus-5-5","outputTokens":3149,"runtime":"claude","turns":6,"wallClockMs":38283}},{"artifacts":[],"attempt":1,"bundleHash":"b209d1dc3cacd10dcc4b6558a7530cfd2ee8ea66d3afb4637453b1c9c792f678","device":"e7f8c6542ba6fced","findings":[],"hash":"7368cb05a061d634a0a9da79228f7fbe5cca2467afcae7b5ff852975a5559544","nodeId":"86e512c3-c2ad-44e5-985c-b43d5de4edc4","outcome":"completed","summary":"Added 15 boundary, failure-path, and fuzz tests. Strengthened invariants to track exact balances and allowances across random call sequences.\n\nOffline `forge build` and `forge test` pass with the supplied seed: **47 tests passed**, including **16,384 invariant handler calls**.\n\nChanges are confined to `test/`. No contract defects were found.","treeHash":"aac223a9f25f2996e207a70108cffb7e349ca457","usage":{"cachedInputTokens":977664,"inputTokens":75326,"model":"gpt-6.1-sol","outputTokens":11973,"runtime":"codex","turns":5,"wallClockMs":288455}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"02f22d6f13810ca8","findings":[{"citation":"resolved","description":"Outside the math area, reported because it is concrete and reproducible. DEPENDENCIES.md line 18 tells the reader to run `sha256sum --check DEPENDENCIES.sha256` and states the vendored files are unmodified release sources. In the committed tree the listed hashes for six forge-std files do not match the files: lib/forge-std/src/Vm.sol, StdJson.sol, StdToml.sol, console.sol, StdAssertions.sol and interfaces/IMulticall3.sol. `git show HEAD:lib/forge-std/src/Vm.sol | sha256sum` gives 9ef7ee8c9a0a4fb18b830e85ce5cd31a56b97781e126ad1e7801389c49b0f408, while line 9 lists 37cdc224...bc73c. All OpenZeppelin entries verify, and forge-std is imported only by tests, so the token's compiled bytecode and behaviour are unaffected; the defect is that the provenance claim the author ships is false for the test library, so a reader cannot use the file to confirm the vendored forge-std is the v1.9.6 release it claims to be. Fix: regenerate DEPENDENCIES.sha256 from the files actually committed (or restore the exact v1.9.6 release files) so the documented check passes.","line":9,"path":"DEPENDENCIES.sha256","reproduction":"From the repository root on the committed tree (git status clean), run `sha256sum --check DEPENDENCIES.sha256`. Expected per DEPENDENCIES.md: every line OK, exit 0. Actual: six lines report FAILED (lib/forge-std/src/StdJson.sol, Vm.sol, interfaces/IMulticall3.sol, console.sol, StdAssertions.sol, StdToml.sol), `sha256sum: WARNING: 6 computed checksums did NOT match`, exit 1.","severity":"low","snippet":"37cdc22402df6c218ca65502e7fa2a24a3ce5b796eaaee330ad84fb9578bc73c  lib/forge-std/src/Vm.sol","title":"DEPENDENCIES.sha256 does not match six committed forge-std files, so the documented provenance check fails"}],"hash":"79cf71e4b1659b19f0f2058579a1c71c023a34f5e10b2590781fb44050fd2db4","nodeId":"b5269407-6af8-49f1-b1a0-49883824ec90","outcome":"completed","summary":"The review is complete and `.imd-findings.json` is written. The working tree is clean apart from that file.\n\n**Outcome:** the math area of PleaToken is clean. The token is an unmodified OpenZeppelin v5.0.2 ERC-20 with one compile-time constant supply, no division, no downcast, no scale conversion and no mint or burn entry point after the constructor. I traced all three entry points through the vendored `_update`, `_spendAllowance` and `_approve` paths and found every unchecked block guarded by the check that makes it safe.\n\n**What I checked in depth** (Math Precision, Boundary, Numerical Gap guides):\n- **Supply constant.** `1_000_000_000 * 10 ** 18` evaluates to exactly 10^27 and matches the manifest supply; decimals return 18. The aderyn large-literal lead is a style note, not a defect.\n- **Transfer arithmetic.** The balance guard precedes the unchecked subtraction, and the unchecked addition is bounded by the fixed supply. Values at max uint, supply plus one, one wei, zero and self-transfer all behave as specified and conserve the sum of balances.\n- **Allowance arithmetic.** The max-uint sentinel is never decremented, max minus one decrements normally, an allowance equal to the value reaches zero, and a balance revert rolls back the allowance write.\n- **Invariants.** The project's invariant suite and a fuzz conservation test of my own pass.\n\n**One finding, low severity, outside my area.** DEPENDENCIES.md tells readers to verify the vendored libraries with the checksum file, but six committed forge-std files do not match it, so the documented check fails. OpenZeppelin verifies and forge-std is test-only, so the token bytecode is unaffected. The author should regenerate the checksum list or restore the exact release files.\n\n**Coverage:** all three listed entry points are marked `holds`, plus rows for the supply invariant, balance conservation, the decimals scale and the static-analysis lead. Nothing was left unreached. No proof file was needed since no finding is high or critical.","treeHash":null,"usage":{"cachedInputTokens":581428,"inputTokens":290,"model":"claude-fable-5-1","outputTokens":12281,"runtime":"claude","turns":22,"wallClockMs":169399}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"8f08088e7a7f557f","findings":[{"citation":"resolved","description":"DEPENDENCIES.md states that every vendored file is an unmodified release source and tells the reader to confirm it with `sha256sum --check DEPENDENCIES.sha256`; README.md lists the same command as the fourth build-and-check step. On the committed tree (HEAD 8c1a2c8, clean working copy) the check fails for six forge-std files: lib/forge-std/src/StdJson.sol, Vm.sol, interfaces/IMulticall3.sol, console.sol, StdAssertions.sol and StdToml.sol. Reproduced and root-caused in this review: the hashes recorded in DEPENDENCIES.sha256 are the correct upstream v1.9.6 hashes (fetched from raw.githubusercontent.com/foundry-rs/forge-std/v1.9.6 and hashed; all six match the recorded values), so it is the committed files that were altered after vendoring. For each of the six files, the upstream and committed copies are byte-identical once all whitespace is stripped (`tr -d ' \\t\\n'`), so the change is line re-wrapping consistent with a `forge fmt` pass and no cheatcode or assertion semantics changed. All five OpenZeppelin v5.0.2 files hash identically to upstream, forge-std is imported only by tests, and the token's compiled bytecode is unaffected, so there is no on-chain impact. The defect is that the deliverable's own integrity gate is red and the 'unmodified release sources' statement in DEPENDENCIES.md is false for the test library, so a reader cannot use the shipped hash list to confirm the vendored forge-std is pristine. Three specialists (audit_flow, audit_economics, audit_math) reported this same root cause; they are merged here at low severity. Fix: restore the six files byte for byte from the v1.9.6 archive named in DEPENDENCIES.md (and keep `forge fmt` off lib/), or, if the reformatting is intended, regenerate DEPENDENCIES.sha256 from the committed files and reword the 'unmodified' claim. The protected launch tests do not depend on this.","line":9,"path":"DEPENDENCIES.sha256","reproduction":"From the repository root on the committed tree (git status clean): run `sha256sum --check --quiet DEPENDENCIES.sha256; echo exit=$?`. Expected (per DEPENDENCIES.md and README.md): no FAILED lines, exit=0. Actual: `lib/forge-std/src/StdJson.sol: FAILED`, `lib/forge-std/src/Vm.sol: FAILED`, `lib/forge-std/src/interfaces/IMulticall3.sol: FAILED`, `lib/forge-std/src/console.sol: FAILED`, `lib/forge-std/src/StdAssertions.sol: FAILED`, `lib/forge-std/src/StdToml.sol: FAILED`, `sha256sum: WARNING: 6 computed checksums did NOT match`, exit=1. Cause check: `sha256sum lib/forge-std/src/Vm.sol` prints 9ef7ee8c9a0a4fb18b830e85ce5cd31a56b97781e126ad1e7801389c49b0f408 while line 9 of DEPENDENCIES.sha256 records 37cdc22402df6c218ca65502e7fa2a24a3ce5b796eaaee330ad84fb9578bc73c, which is the hash of https://raw.githubusercontent.com/foundry-rs/forge-std/v1.9.6/src/Vm.sol; `diff <(tr -d ' \\t\\n' < upstream/Vm.sol) <(tr -d ' \\t\\n' < lib/forge-std/src/Vm.sol)` is empty. The same holds for the other five files.","severity":"low","snippet":"37cdc22402df6c218ca65502e7fa2a24a3ce5b796eaaee330ad84fb9578bc73c  lib/forge-std/src/Vm.sol","title":"Documented provenance check fails: six committed forge-std files do not match DEPENDENCIES.sha256 (merged from audit_flow, audit_economics, audit_math)"},{"citation":"resolved","description":"The README's Deployment parameters section says the separate manifest step supplies the pool and economic parameters and that this repository does not supply a launch.json. The committed tree contains launch.json at the root (kind custom_token, token PleaToken, totalSupply 1000000000000000000000000000, pool and economics filled in). The manifest itself is consistent with the code: the contract name, name, symbol, decimals 18, empty constructorArgs and totalSupply all match src/PleaToken.sol, only schema keys are present, addresses are lowercase and notes are under 4,000 characters. This is a documentation statement that is no longer true of the shipped tree, with no effect on the token, the tests or the launch. Fix: update the sentence to say launch.json is present and was written by the manifest step.","line":92,"path":"README.md","reproduction":"From the repository root run `ls launch.json && sed -n 92p README.md`. Expected: the README and the tree agree about whether a manifest is shipped. Actual: `launch.json` exists (1,551 bytes, kind custom_token) and line 92 of README.md reads `this repository does not supply a \\`launch.json\\` or execute transactions.`","severity":"info","snippet":"this repository does not supply a `launch.json` or execute transactions.","title":"README states the repository does not supply a launch.json, but launch.json is committed at the root"}],"hash":"8cf406de42493c04c6f9982144b7046fbb399151472be4361d7967b74077bd04","nodeId":"0a655206-ee82-49a0-8313-276e733454df","outcome":"completed","summary":"The findings file is valid, both cited snippets match the tree byte for byte, and git status shows no files changed besides the findings output (which is gitignored by the harness).\n\n**Outcome:** the PLEA token itself is clean. The only substantiated defect is the one all three specialists reported, merged into a single low finding.\n\n**What I verified**\n- Build, formatting check and all 47 tests pass with the README's fuzz seed.\n- The token is a bare OpenZeppelin v5.0.2 ERC20 with one constructor mint of exactly 1e27 to the deployer. All five vendored OpenZeppelin files hash identically to upstream, so the inherited approve, transfer and transferFrom behave as documented. The runtime has no DELEGATECALL, CALLCODE or SELFDESTRUCT in reachable code, and both bytecode sizes are far under the limits.\n- The manifest matches the code: contract name, token name, symbol, decimals, empty constructor arguments and total supply, with only schema keys, lowercase addresses and short notes.\n- The aderyn large-literal lead is the correct 1e27 constant, so it was dropped.\n\n**Findings written to .imd-findings.json**\n1. **Low, merged from three specialists.** The documented `sha256sum --check DEPENDENCIES.sha256` fails on six forge-std files. I reproduced it and confirmed the cause: the recorded hashes match upstream v1.9.6 exactly, while the committed files differ only in whitespace, consistent with a formatter pass. Test-only, no bytecode impact, but the shipped provenance claim is false.\n2. **Info.** README line 92 says the repository ships no launch.json, yet one is committed at the root. Documentation drift only.\n\n**Coverage:** all three entry points marked `holds` with traced reasons, plus one row for the constructor and supply invariant. No critical or high findings, so no proof tests were needed.","treeHash":null,"usage":{"cachedInputTokens":837885,"inputTokens":290,"model":"claude-fable-5-1","outputTokens":11344,"runtime":"claude","turns":22,"wallClockMs":175999}},{"artifacts":[],"attempt":1,"bundleHash":"f0e19b412cefb5c48a58967d2499bebb8b38e0e5dfa4b6eda8449eca4bcf557f","device":"cf3b0a0c089b1430","findings":[],"hash":"9af017c5c90704e3e6ffd34e0f9c2af5aa2db68f5e4c0e029af1b98b7ca3246a","nodeId":"b71ce45d-6865-4d82-8617-94e294409d17","outcome":"completed","summary":"Implemented `PleaToken`: **plea (PLEA)**, 18 decimals, with **1,000,000,000 tokens minted once to the deployer**.\n\nIncluded vendored dependencies, success/failure tests, conservation invariants, and deployment documentation.\n\nVerified with Solidity 0.8.26:\n\n- `forge build` passed.\n- `forge test` passed using the required fuzz seed.\n- `forge fmt --check` passed.\n\nProtected launch integration remains for the separate launch harness.","treeHash":"4d211a9006f977b5d6aa7298750760d0f3d1aed1","usage":{"cachedInputTokens":536064,"inputTokens":45113,"model":"gpt-6-astra","outputTokens":16168,"runtime":"codex","turns":5,"wallClockMs":442789}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"771f83f312eace21","findings":[{"citation":"resolved","description":"README.md line 57 lists `sha256sum --check DEPENDENCIES.sha256` as one of the four build-and-check commands, and DEPENDENCIES.md line 13 states every vendored file is an unmodified release source. On the committed tree (commit bc25990, clean working copy) the check fails for six forge-std v1.9.6 files: lib/forge-std/src/StdJson.sol, Vm.sol, interfaces/IMulticall3.sol, console.sol, StdAssertions.sol and StdToml.sol. The hashes recorded in DEPENDENCIES.sha256 (for example line 9 for Vm.sol and line 24 for StdAssertions.sol) are the correct upstream v1.9.6 hashes; it is the committed files that were changed after vendoring. Diffing against upstream shows only line re-wrapping in the style forge fmt produces (function signatures joined or split across lines, an assembly staticcall re-flowed); a whitespace-stripped comparison of each file is identical to upstream, so no test or cheatcode semantics changed and the deployed token bytecode is unaffected (forge-std is test-only). The defect is that the deliverable's own integrity gate is red: anyone following the README cannot confirm the test library is pristine, and the dependency statement is false as written. All five OpenZeppelin v5.0.2 files were verified byte-identical to upstream. Fix: restore the six files from the v1.9.6 archive named in DEPENDENCIES.md (and keep forge fmt off lib/), or, if the reformatting is intended, regenerate DEPENDENCIES.sha256 and reword the 'unmodified' claim.","line":13,"path":"DEPENDENCIES.md","reproduction":"From the repository root on commit bc25990: run `sha256sum --check DEPENDENCIES.sha256`. Expected: 32 lines of OK and exit status 0, as the README's check sequence implies. Actual: `lib/forge-std/src/StdJson.sol: FAILED`, `lib/forge-std/src/Vm.sol: FAILED`, `lib/forge-std/src/interfaces/IMulticall3.sol: FAILED`, `lib/forge-std/src/console.sol: FAILED`, `lib/forge-std/src/StdAssertions.sol: FAILED`, `lib/forge-std/src/StdToml.sol: FAILED`, `sha256sum: WARNING: 6 computed checksums did NOT match`, exit status 1. Confirm the cause with `curl -sL https://raw.githubusercontent.com/foundry-rs/forge-std/v1.9.6/src/Vm.sol | sha256sum` which prints 37cdc224...8bc73c (the recorded value) while `sha256sum lib/forge-std/src/Vm.sol` prints 9ef7ee8c...c49b0f408; `diff <(tr -d ' \\t\\n' < upstream/Vm.sol) <(tr -d ' \\t\\n' < lib/forge-std/src/Vm.sol)` is empty.","severity":"low","snippet":"These files are unmodified release sources. Their upstream copyright and license","title":"Documented provenance check fails: six committed forge-std files do not match DEPENDENCIES.sha256"}],"hash":"c809081ddf71405e80eda2b062ca489c4758ca5d74a0df653940b102e5bcb952","nodeId":"cf27665d-95f7-4567-81dc-4471bc8e19c2","outcome":"completed","summary":"The review is complete. The findings and coverage record are written to `.imd-findings.json` in the repository root, and no tracked file was changed.\n\n**Outcome.** The token is a 17-line wrapper over an unmodified OpenZeppelin v5.0.2 ERC-20, and the control-flow audit found no defect in the contract itself. One low-severity defect was substantiated in the vendored test library.\n\n**Finding 1, low.** The repository's own provenance gate is red. The README lists a `sha256sum --check` of the dependency hashes as a build step, and the dependency notes claim every vendored file is an unmodified release source. On the committed tree that check fails for six forge-std v1.9.6 files. The recorded hashes are the correct upstream values. The committed files were re-wrapped in forge fmt style after vendoring. A whitespace-stripped comparison against upstream is identical for every file, so test semantics and the deployed bytecode are unaffected. The fix is to restore the six pristine files or regenerate the hash list and reword the claim.\n\n**What was traced and holds.**\n- The three entry points, approve, transfer and transferFrom, follow the stock OpenZeppelin paths. Zero-address sentinels revert, self-transfers re-read storage so balances are preserved, and a failed allowance spend or transfer rolls both back.\n- The constructor mints the whole supply once to the immediate caller. Deployed through a CREATE2 factory, that is the factory, not the transaction origin.\n- The ABI exposes only the ten standard ERC-20 functions plus the supply constant. No mint, burn, pause, blacklist or owner path exists, so the supply is fixed and launch flows move exact amounts.\n- A reachable-opcode scan of the compiled runtime and creation code found no DELEGATECALL, CALLCODE, SELFDESTRUCT or external call, and no metadata hash.\n- Chain 1 and chain 4663 both accept PUSH0 and TSTORE, so the Cancun build target is deployable on either.\n- All five OpenZeppelin files are byte-identical to upstream v5.0.2.\n- Build, the seeded test suite of 31 tests and 2 invariants, and `forge fmt --check` all pass.\n\n**Not reached.** The Uniswap v4 seed and swap path in the protected floor could not be executed locally because v4-core is not vendored. The token has no transfer override, so nothing in it can tax or block that path.","treeHash":null,"usage":{"cachedInputTokens":642528,"inputTokens":290,"model":"claude-fable-5-1","outputTokens":17174,"runtime":"claude","turns":28,"wallClockMs":237455}}],"verification":[{"checks":[{"durationMs":1610,"exitCode":0,"name":"build","output":"Compiling 26 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.52s\nCompiler run successful!\n","passed":true},{"durationMs":937,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 31 tests for test/PleaToken.t.sol:PleaTokenTest\n[PASS] testFuzz_ApprovedSpending(uint256,uint256) (runs: 1024, μ: 157590, ~: 158515)\nLogs:\n  Bound result 216692491651190959095785384\n  Bound result 2914333837723883315083327989200056546230378568182053187803477\n\n[PASS] testFuzz_RevertSpendingAboveAllowance(uint256,uint256) (runs: 1024, μ: 126587, ~: 127219)\nLogs:\n  Bound result 0\n  Bound result 18190\n\n[PASS] testFuzz_RevertTransferAboveBalance(uint256,uint256) (runs: 1024, μ: 130677, ~: 131026)\nLogs:\n  Bound result 0\n  Bound result 18190\n\n[PASS] testFuzz_TransferConservesSupply(address,uint256) (runs: 1024, μ: 92849, ~: 93159)\nLogs:\n  Bound result 821915624067438583628451863\n\n[PASS] test_ApproveDoesNotRequireABalance() (gas: 71547)\n[PASS] test_ApproveEmitsEventAndReplacesAllowance() (gas: 124673)\n[PASS] test_ConstructorEmitsExactlyOneMint() (gas: 9718)\n[PASS] test_DeployerCannotSpendHolderBalanceWithoutApproval() (gas: 102854)\n[PASS] test_FactoryReceivesSupplyAndDistributesExactAmounts() (gas: 652533)\n[PASS] test_InfiniteAllowanceIsNotDecreased() (gas: 209388)\n[PASS] test_MetadataAndEntireSupply() (gas: 103381)\n[PASS] test_NoMintBurnPauseSeizureOrUpgradeEntryPoints() (gas: 1334639)\n[PASS] test_RejectsEtherAndUnknownCalls() (gas: 64712)\n[PASS] test_RevertApprovalToZero() (gas: 37618)\n[PASS] test_RevertOverAllowancePreservesState() (gas: 108948)\n[PASS] test_RevertOverBalanceRollsBackAllowance() (gas: 177455)\n[PASS] test_RevertSelfTransferOverBalance() (gas: 33343)\n[PASS] test_RevertTransferFromByDifferentSpender() (gas: 98532)\n[PASS] test_RevertTransferFromToZeroRollsBackAllowance() (gas: 111944)\n[PASS] test_RevertTransferFromWithoutAllowance() (gas: 51171)\n[PASS] test_RevertTransferOverBalance() (gas: 50519)\n[PASS] test_RevertTransferToZeroEvenForZeroAmount() (gas: 71971)\n[PASS] test_RevertZeroSourceEvenForZeroTransferFrom() (gas: 33393)\n[PASS] test_RevokeApprovalPreventsFurtherSpending() (gas: 126544)\n[PASS] test_SelfTransferFromStillConsumesAllowance() (gas: 101091)\n[PASS] test_SelfTransferPreservesBalance() (gas: 51463)\n[PASS] test_TransferEntireBalanceEmitsEvent() (gas: 84089)\n[PASS] test_TransferFromConsumesFiniteAllowanceAndEmitsTransfer() (gas: 228460)\n[PASS] test_TransferToContractWithoutReceiverHook() (gas: 86583)\n[PASS] test_ZeroTransferFromEmptyAccountEmitsEvent() (gas: 66427)\n[PASS] test_ZeroTransferFromNeedsNoPositiveAllowance() (gas: 69990)\nSuite result: ok. 31 passed; 0 failed; 0 skipped; finished in 47.67ms (197.39ms CPU time)\n\nRan 1 test for test/PleaToken.invariant.t.sol:PleaTokenInvariantTest\n[PASS]\nPleaTokenInvariantTest invariants:\n[PASS] invariant_AllBalancesConserveTheEntireSupply\n[PASS] invariant_TotalSupplyIsAlwaysOneBillionTokens\n PleaTokenInvariantTest invariants (runs: 128, calls: 8192, reverts: 0)\n\n╭------------------+----------------------+-------+---------+----------╮\n| Contract         | Selector             | Calls | Reverts | Discards |\n+======================================================================+\n| PleaTokenHandler | approve              | 1611  | 0       | 0        |\n|------------------+----------------------+-------+---------+----------|\n| PleaTokenHandler | overspend            | 1674  | 0       | 0        |\n|------------------+----------------------+-------+---------+----------|\n| PleaTokenHandler | revokeAndTrySpending | 1611  | 0       | 0        |\n|------------------+----------------------+-------+---------+----------|\n| PleaTokenHandler | transfer             | 1652  | 0       | 0        |\n|------------------+----------------------+-------+---------+----------|\n| PleaTokenHandler | transferFrom         | 1644  | 0       | 0        |\n╰------------------+----------------------+-------+---------+----------╯\n\nLogs:\n  Bound result 0\n  Bound result 2287400824\n  Bound result 0\n  Bound result 2090546159\n  Bound result 0\n  Bound result 45\n  Bound result 45\n  Bound result 134931599\n  Bound result 3\n  Bound result 0\n  Bound result 40\n  Bound result 0\n  Bound result 204\n  Bound result 7\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 2\n  Bound result 11507\n  Bound result 0\n  Bound result 1669855126\n  Bound result 24301\n  Bound result 81008942\n  Bound result 659918\n  Bound result 0\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 813.37ms (811.84ms CPU time)\n\nRan 2 test suites in 815.01ms (861.04ms CPU time): 32 tests passed, 0 failed, 0 skipped (32 total tests)\n","passed":true},{"durationMs":38,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"PleaToken.approve(address,uint256)\",\"PleaToken.transfer(address,uint256)\",\"PleaToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":5,\"DEPENDENCIES.md\":26,\"DEPENDENCIES.sha256\":32,\"LICENSE\":21,\"README.md\":118,\"foundry.toml\":19,\"launch.json\":24,\"remappings.txt\":2,\"src/PleaToken.sol\":17,\"test/PleaToken.invariant.t.sol\":111,\"test/PleaToken.t.sol\":404},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"35727650e87fa508eedbf0c69b776db967a8cffc8cbb71342797c9ce0a785f77","verifiedTreeHash":"b519ba34d13a4323013214cc0d32935344f081c6","verifierVersion":"0.1.0+a6eb4461"},{"checks":[{"durationMs":1903,"exitCode":0,"name":"build","output":"Compiling 27 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.80s\nCompiler run successful!\n","passed":true},{"durationMs":7497,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 15 tests for test/PleaToken.edges.t.sol:PleaTokenEdgesTest\n[PASS] testFuzz_DirectTransferDoesNotConsumeEitherSpendersAllowance(uint256,uint256,uint256) (runs: 1024, μ: 205252, ~: 205984)\nLogs:\n  Bound result 647668705365813538884165604\n\n[PASS] testFuzz_FailedSpendCanRetryAfterReceivingMissingUnit(uint256,uint256) (runs: 1024, μ: 316196, ~: 316760)\nLogs:\n  Bound result 25492998\n  Bound result 25493000\n\n[PASS] testFuzz_ReplacedApprovalIsTheEntireNewBudget(uint256,uint256) (runs: 1024, μ: 249645, ~: 249896)\nLogs:\n  Bound result 1\n\n[PASS] testFuzz_SplittingATransferHasTheSameResult(uint256,uint256) (runs: 1024, μ: 219976, ~: 221614)\nLogs:\n  Bound result 25492998\n  Bound result 1\n\n[PASS] test_ApprovalForOneOwnerCannotSpendAnotherOwnersBalance() (gas: 172284)\n[PASS] test_InfiniteApprovalSurvivesFailuresAndCanBeUsedAfterwards() (gas: 232510)\n[PASS] test_MaximumFiniteAllowanceIsSpentUnlikeInfiniteAllowance() (gas: 313714)\n[PASS] test_MaximumTransferFailsWithBalanceErrorAndPreservesApprovals() (gas: 118811)\n[PASS] test_OneMinorUnitCanMoveAndReturn() (gas: 207171)\n[PASS] test_SpendingIntoSpendersOwnAccountStillConsumesBudget() (gas: 173441)\n[PASS] test_SplitSpendingCannotExceedOriginalApproval() (gas: 242135)\n[PASS] test_TransactionOriginDoesNotAuthorizeSpending() (gas: 119812)\n[PASS] test_TransferFromByOwnerStillRequiresSelfApproval() (gas: 162528)\n[PASS] test_ZeroRecipientIsRejectedForZeroDelegatedTransfer() (gas: 72237)\n[PASS] test_ZeroSpenderIsRejectedForZeroAndMaximumApproval() (gas: 72710)\nSuite result: ok. 15 passed; 0 failed; 0 skipped; finished in 122.89ms (489.12ms CPU time)\n\nRan 31 tests for test/PleaToken.t.sol:PleaTokenTest\n[PASS] testFuzz_ApprovedSpending(uint256,uint256) (runs: 1024, μ: 157780, ~: 158515)\nLogs:\n  Bound result 47717251120700534\n  Bound result 115792089237316195423570985008687907853269984665640564039457536290662009353905\n\n[PASS] testFuzz_RevertSpendingAboveAllowance(uint256,uint256) (runs: 1024, μ: 126575, ~: 127223)\nLogs:\n  Bound result 845\n  Bound result 2540\n\n[PASS] testFuzz_RevertTransferAboveBalance(uint256,uint256) (runs: 1024, μ: 130676, ~: 131038)\nLogs:\n  Bound result 12394\n  Bound result 18\n\n[PASS] testFuzz_TransferConservesSupply(address,uint256) (runs: 1024, μ: 92814, ~: 93159)\nLogs:\n  Bound result 460320356903407111682999230\n\n[PASS] test_ApproveDoesNotRequireABalance() (gas: 71547)\n[PASS] test_ApproveEmitsEventAndReplacesAllowance() (gas: 124673)\n[PASS] test_ConstructorEmitsExactlyOneMint() (gas: 9718)\n[PASS] test_DeployerCannotSpendHolderBalanceWithoutApproval() (gas: 102854)\n[PASS] test_FactoryReceivesSupplyAndDistributesExactAmounts() (gas: 652533)\n[PASS] test_InfiniteAllowanceIsNotDecreased() (gas: 209388)\n[PASS] test_MetadataAndEntireSupply() (gas: 103381)\n[PASS] test_NoMintBurnPauseSeizureOrUpgradeEntryPoints() (gas: 1334639)\n[PASS] test_RejectsEtherAndUnknownCalls() (gas: 64712)\n[PASS] test_RevertApprovalToZero() (gas: 37618)\n[PASS] test_RevertOverAllowancePreservesState() (gas: 108948)\n[PASS] test_RevertOverBalanceRollsBackAllowance() (gas: 177455)\n[PASS] test_RevertSelfTransferOverBalance() (gas: 33343)\n[PASS] test_RevertTransferFromByDifferentSpender() (gas: 98532)\n[PASS] test_RevertTransferFromToZeroRollsBackAllowance() (gas: 111944)\n[PASS] test_RevertTransferFromWithoutAllowance() (gas: 51171)\n[PASS] test_RevertTransferOverBalance() (gas: 50519)\n[PASS] test_RevertTransferToZeroEvenForZeroAmount() (gas: 71971)\n[PASS] test_RevertZeroSourceEvenForZeroTransferFrom() (gas: 33393)\n[PASS] test_RevokeApprovalPreventsFurtherSpending() (gas: 126544)\n[PASS] test_SelfTransferFromStillConsumesAllowance() (gas: 101091)\n[PASS] test_SelfTransferPreservesBalance() (gas: 51463)\n[PASS] test_TransferEntireBalanceEmitsEvent() (gas: 84089)\n[PASS] test_TransferFromConsumesFiniteAllowanceAndEmitsTransfer() (gas: 228460)\n[PASS] test_TransferToContractWithoutReceiverHook() (gas: 86583)\n[PASS] test_ZeroTransferFromEmptyAccountEmitsEvent() (gas: 66427)\n[PASS] test_ZeroTransferFromNeedsNoPositiveAllowance() (gas: 69990)\nSuite result: ok. 31 passed; 0 failed; 0 skipped; finished in 122.89ms (498.37ms CPU time)\n\nRan 1 test for test/PleaToken.invariant.t.sol:PleaTokenInvariantTest\n[PASS]\nPleaTokenInvariantTest invariants:\n[PASS] invariant_AllAllowancesMatchTheirIndependentBudgets\n[PASS] invariant_AllBalancesConserveTheEntireSupply\n[PASS] invariant_EachBalanceMatchesItsTransactionHistory\n[PASS] invariant_TotalSupplyIsAlwaysOneBillionTokens\n PleaTokenInvariantTest invariants (runs: 256, calls: 16384, reverts: 0)\n\n╭------------------+----------------------+-------+---------+----------╮\n| Contract         | Selector             | Calls | Reverts | Discards |\n+======================================================================+\n| PleaTokenHandler | approve              | 1662  | 0       | 0        |\n|------------------+----------------------+-------+---------+----------|\n| PleaTokenHandler | approveBoundary      | 1618  | 0       | 0        |\n|------------------+----------------------+-------+---------+----------|\n| PleaTokenHandler | overdrawWithApproval | 1645  | 0       | 0        |\n|------------------+----------------------+-------+---------+----------|\n| PleaTokenHandler | overspend            | 1584  | 0       | 0        |\n|------------------+----------------------+-------+---------+----------|\n| PleaTokenHandler | rejectZeroRecipient  | 1620  | 0       | 0        |\n|------------------+----------------------+-------+---------+----------|\n| PleaTokenHandler | revokeAndTrySpending | 1626  | 0       | 0        |\n|------------------+----------------------+-------+---------+----------|\n| PleaTokenHandler | roundTrip            | 1629  | 0       | 0        |\n|------------------+----------------------+-------+---------+----------|\n| PleaTokenHandler | transfer             | 1648  | 0       | 0        |\n|------------------+----------------------+-------+---------+----------|\n| PleaTokenHandler | transferBoundary     | 1686  | 0       | 0        |\n|------------------+----------------------+-------+---------+----------|\n| PleaTokenHandler | transferFrom         | 1666  | 0       | 0        |\n╰------------------+----------------------+-------+---------+----------╯\n\nLogs:\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 633\n  Bound result 40\n  Bound result 0\n  Bound result 0\n  Bound result 1\n  Bound result 0\n  Bound result 5453\n  Bound result 0\n  Bound result 0\n  Bound result 18\n  Bound result 20\n  Bound result 4856\n  Bound result 24\n  Bound result 828417\n  Bound result 0\n  Bound result 17\n  Bound result 6\n  Bound result 0\n  Bound result 0\n  Bound result 1\n  Bound result 0\n  Bound result 0\n  Bound result 184474896731780405414800864\n  Bound result 854087732162361777724112306\n  Bound result 4426\n  Bound result 5\n  Bound result 0\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 7.36s (7.36s CPU time)\n\nRan 3 test suites in 7.37s (7.61s CPU time): 47 tests passed, 0 failed, 0 skipped (47 total tests)\n","passed":true},{"durationMs":47,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"PleaToken.approve(address,uint256)\",\"PleaToken.transfer(address,uint256)\",\"PleaToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":5,\"DEPENDENCIES.md\":26,\"DEPENDENCIES.sha256\":32,\"LICENSE\":21,\"README.md\":118,\"foundry.toml\":19,\"remappings.txt\":2,\"src/PleaToken.sol\":17,\"test/PROPERTIES.md\":56,\"test/PleaToken.edges.t.sol\":260,\"test/PleaToken.invariant.t.sol\":229,\"test/PleaToken.t.sol\":404},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"7368cb05a061d634a0a9da79228f7fbe5cca2467afcae7b5ff852975a5559544","verifiedTreeHash":"aac223a9f25f2996e207a70108cffb7e349ca457","verifierVersion":"0.1.0+a6eb4461"},{"checks":[{"durationMs":1410,"exitCode":0,"name":"build","output":"Compiling 26 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.31s\nCompiler run successful!\n","passed":true},{"durationMs":1101,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 31 tests for test/PleaToken.t.sol:PleaTokenTest\n[PASS] testFuzz_ApprovedSpending(uint256,uint256) (runs: 1024, μ: 157590, ~: 158515)\nLogs:\n  Bound result 688858785629247878540012561\n  Bound result 115792089237316195423570985008687907853269984665639875180671954760059357200844\n\n[PASS] testFuzz_RevertSpendingAboveAllowance(uint256,uint256) (runs: 1024, μ: 126587, ~: 127219)\nLogs:\n  Bound result 924288792933642644309707707\n  Bound result 62132369259\n\n[PASS] testFuzz_RevertTransferAboveBalance(uint256,uint256) (runs: 1024, μ: 130677, ~: 131026)\nLogs:\n  Bound result 12394\n  Bound result 18\n\n[PASS] testFuzz_TransferConservesSupply(address,uint256) (runs: 1024, μ: 92849, ~: 93159)\nLogs:\n  Bound result 8130\n\n[PASS] test_ApproveDoesNotRequireABalance() (gas: 71547)\n[PASS] test_ApproveEmitsEventAndReplacesAllowance() (gas: 124673)\n[PASS] test_ConstructorEmitsExactlyOneMint() (gas: 9718)\n[PASS] test_DeployerCannotSpendHolderBalanceWithoutApproval() (gas: 102854)\n[PASS] test_FactoryReceivesSupplyAndDistributesExactAmounts() (gas: 652533)\n[PASS] test_InfiniteAllowanceIsNotDecreased() (gas: 209388)\n[PASS] test_MetadataAndEntireSupply() (gas: 103381)\n[PASS] test_NoMintBurnPauseSeizureOrUpgradeEntryPoints() (gas: 1334639)\n[PASS] test_RejectsEtherAndUnknownCalls() (gas: 64712)\n[PASS] test_RevertApprovalToZero() (gas: 37618)\n[PASS] test_RevertOverAllowancePreservesState() (gas: 108948)\n[PASS] test_RevertOverBalanceRollsBackAllowance() (gas: 177455)\n[PASS] test_RevertSelfTransferOverBalance() (gas: 33343)\n[PASS] test_RevertTransferFromByDifferentSpender() (gas: 98532)\n[PASS] test_RevertTransferFromToZeroRollsBackAllowance() (gas: 111944)\n[PASS] test_RevertTransferFromWithoutAllowance() (gas: 51171)\n[PASS] test_RevertTransferOverBalance() (gas: 50519)\n[PASS] test_RevertTransferToZeroEvenForZeroAmount() (gas: 71971)\n[PASS] test_RevertZeroSourceEvenForZeroTransferFrom() (gas: 33393)\n[PASS] test_RevokeApprovalPreventsFurtherSpending() (gas: 126544)\n[PASS] test_SelfTransferFromStillConsumesAllowance() (gas: 101091)\n[PASS] test_SelfTransferPreservesBalance() (gas: 51463)\n[PASS] test_TransferEntireBalanceEmitsEvent() (gas: 84089)\n[PASS] test_TransferFromConsumesFiniteAllowanceAndEmitsTransfer() (gas: 228460)\n[PASS] test_TransferToContractWithoutReceiverHook() (gas: 86583)\n[PASS] test_ZeroTransferFromEmptyAccountEmitsEvent() (gas: 66427)\n[PASS] test_ZeroTransferFromNeedsNoPositiveAllowance() (gas: 69990)\nSuite result: ok. 31 passed; 0 failed; 0 skipped; finished in 45.19ms (184.90ms CPU time)\n\nRan 1 test for test/PleaToken.invariant.t.sol:PleaTokenInvariantTest\n[PASS]\nPleaTokenInvariantTest invariants:\n[PASS] invariant_AllBalancesConserveTheEntireSupply\n[PASS] invariant_TotalSupplyIsAlwaysOneBillionTokens\n PleaTokenInvariantTest invariants (runs: 128, calls: 8192, reverts: 0)\n\n╭------------------+----------------------+-------+---------+----------╮\n| Contract         | Selector             | Calls | Reverts | Discards |\n+======================================================================+\n| PleaTokenHandler | approve              | 1611  | 0       | 0        |\n|------------------+----------------------+-------+---------+----------|\n| PleaTokenHandler | overspend            | 1674  | 0       | 0        |\n|------------------+----------------------+-------+---------+----------|\n| PleaTokenHandler | revokeAndTrySpending | 1611  | 0       | 0        |\n|------------------+----------------------+-------+---------+----------|\n| PleaTokenHandler | transfer             | 1652  | 0       | 0        |\n|------------------+----------------------+-------+---------+----------|\n| PleaTokenHandler | transferFrom         | 1644  | 0       | 0        |\n╰------------------+----------------------+-------+---------+----------╯\n\nLogs:\n  Bound result 0\n  Bound result 2287400824\n  Bound result 0\n  Bound result 2090546159\n  Bound result 0\n  Bound result 45\n  Bound result 45\n  Bound result 134931599\n  Bound result 3\n  Bound result 0\n  Bound result 40\n  Bound result 0\n  Bound result 204\n  Bound result 7\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 2\n  Bound result 11507\n  Bound result 0\n  Bound result 1669855126\n  Bound result 24301\n  Bound result 81008942\n  Bound result 659918\n  Bound result 0\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 969.36ms (967.74ms CPU time)\n\nRan 2 test suites in 971.88ms (1.01s CPU time): 32 tests passed, 0 failed, 0 skipped (32 total tests)\n","passed":true},{"durationMs":47,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"PleaToken.approve(address,uint256)\",\"PleaToken.transfer(address,uint256)\",\"PleaToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":5,\"DEPENDENCIES.md\":26,\"DEPENDENCIES.sha256\":32,\"LICENSE\":21,\"README.md\":118,\"foundry.toml\":19,\"remappings.txt\":2,\"src/PleaToken.sol\":17,\"test/PleaToken.invariant.t.sol\":111,\"test/PleaToken.t.sol\":404},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true},{"durationMs":590,"exitCode":0,"name":"slither","output":"slither: no results at low impact or above","passed":true},{"durationMs":177,"exitCode":0,"name":"aderyn","output":"[low] large-numeric-literal at src/PleaToken.sol:10: Large Numeric Literal","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"9af017c5c90704e3e6ffd34e0f9c2af5aa2db68f5e4c0e029af1b98b7ca3246a","verifiedTreeHash":"4d211a9006f977b5d6aa7298750760d0f3d1aed1","verifierVersion":"0.1.0+a6eb4461"}]}