{"assessments":[],"deployments":[],"fuzz":[],"identity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"interpretation":"Records acceptance and evidence. Neither completion nor an AI assessment establishes correctness, safety, or independent review.","jobId":"5c8e38a7-747c-40a3-82e2-a17224ba48fa","kind":"shape:chain","nodes":[{"acceptedSubmissionHash":"8879ae41bc5cf5301b723b67013e4837f47793b26013eaaa9e481dd47c648cae","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_economics","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"3190693bedfbb2dd11c7570ca34cf21ce10fa997bd63f3738b29827025e21088","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_flow","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"d087e518caebb0cd295ecc4699d72ad1189f767d2f68eec07db8411d9718b9f0","dependsOn":["build_contract_project","write_foundry_tests","manifest","audit_math","audit_permissions","audit_economics","audit_flow"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"af3aa01159bbf354f621cafa5c0006f6169e0938a8b015be508b7377dbf165bc","skillId":"audit-judge","tools":[]},"key":"audit_judge","kind":"code","role":"review","skillHash":"af3aa01159bbf354f621cafa5c0006f6169e0938a8b015be508b7377dbf165bc","skillId":"audit-judge","state":"accepted"},{"acceptedSubmissionHash":"c8d02fc42ee9fe28c990b4a25da3b2923364817bd31a5c0ee962a4e4c8efc4d3","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_math","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"328f9cef46df6fd83dcea86fe1c112178fef339332cea0336a3f82c1bab7351b","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_permissions","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"d2092326b31c470d104f9ce4a942c9debcb051e92261b774569219231261d3f9","dependsOn":[],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"6b8d2c2ebd3301cff2be8edb1e1cc6ba65c858c02fe7247be81722b969842265","skillId":"build-contract-project","tools":[]},"key":"build_contract_project","kind":"code","role":"implement","skillHash":"6b8d2c2ebd3301cff2be8edb1e1cc6ba65c858c02fe7247be81722b969842265","skillId":"build-contract-project","state":"accepted"},{"acceptedSubmissionHash":"93d87cc540c1de8d8e7305afb661211c7355d1082e0115903c1accc2ae966bd6","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"tools":[]},"key":"manifest","kind":"code","role":"integrate","skillHash":null,"skillId":null,"state":"accepted"},{"acceptedSubmissionHash":"69e572c0e655159a4c3151719a4e866e2426a7afb931d87778aded2512656b3a","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"4c76766b00591dfe982fe85d3de589fdb2f810e5137c301155d1c5e36a1d3b23","skillId":"write-foundry-tests","tools":[]},"key":"write_foundry_tests","kind":"code","role":"tests","skillHash":"4c76766b00591dfe982fe85d3de589fdb2f810e5137c301155d1c5e36a1d3b23","skillId":"write-foundry-tests","state":"accepted"}],"objective":"A custom token: PLEA (PLEA).\nToken name: PLEA\nToken symbol: PLEA\nToken supply: 1,000,000,000 with 18 decimals, all minted once to the deployer in the constructor.\nWhat it does: Total Supply: 1,000,000,000 tokens\n\nDistribution:\n\n87% Liquidity Pool\n\n3% Season Rewards\n\n10% Merkle Distribution\n\nOfficial Website: https://imdacc.fun/","parentJobId":null,"planHash":"066dab2526fb94f6e694b20097b086178cd2f7b1bc326a21719f9258b14f3c54","previousHash":"0000000000000000000000000000000000000000000000000000000000000000","projectId":"5c8e38a7-747c-40a3-82e2-a17224ba48fa","publication":{"commit":null,"deliveredAt":null,"repoUrl":"https://github.com/identity-md-launches/launch-1728-plea"},"receiptIdentity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"registry":"0xb6d0a187b050fa5bb0b87033a203f37becf4a775","research":[],"schema":"identitymd-work-v1","signals":[{"agentId":"51333","feedbackHash":"87aabb15dda788a8ed4ae18eadc2365a56c1b885b8421e035bf84eaa923daf54","nodeKey":"audit_economics","submissionHash":"8879ae41bc5cf5301b723b67013e4837f47793b26013eaaa9e481dd47c648cae","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52479","feedbackHash":"ee2895da1e58df2e2d21bc7dbb115aff5e8f418d1699b5bab8d790799773651e","nodeKey":"audit_flow","submissionHash":"3190693bedfbb2dd11c7570ca34cf21ce10fa997bd63f3738b29827025e21088","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52597","feedbackHash":"2fd1010977bb8debe9454c3313427bd1cc49417ca8f727eff2788ed4134c15b2","nodeKey":"audit_judge","submissionHash":"d087e518caebb0cd295ecc4699d72ad1189f767d2f68eec07db8411d9718b9f0","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51082","feedbackHash":"d9e771ed820d74ad78046eb95227884756c32944d653d11433e42525eb1e688c","nodeKey":"audit_math","submissionHash":"c8d02fc42ee9fe28c990b4a25da3b2923364817bd31a5c0ee962a4e4c8efc4d3","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52623","feedbackHash":"2bcd2275cd92e6f5e7949e7ee3c61df9684605d426a6263799e61f3e0d365ae6","nodeKey":"audit_permissions","submissionHash":"328f9cef46df6fd83dcea86fe1c112178fef339332cea0336a3f82c1bab7351b","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52154","feedbackHash":"b9c3002b62c214edce3e42f8fa6ae88d3ebcb6e7fabd9af8176c2b0e75f1b3b3","nodeKey":"build_contract_project","submissionHash":"d2092326b31c470d104f9ce4a942c9debcb051e92261b774569219231261d3f9","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"52161","feedbackHash":"e158e81d2822cf520122f33ad2496ede11be5ad71ec5de0b0ada91259c38c3fc","nodeKey":"manifest","submissionHash":"93d87cc540c1de8d8e7305afb661211c7355d1082e0115903c1accc2ae966bd6","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"51191","feedbackHash":"d0c11bdaa00a037c7b43a369416b490f8ed9709dca56589fb0806e7e6393c423","nodeKey":"write_foundry_tests","submissionHash":"69e572c0e655159a4c3151719a4e866e2426a7afb931d87778aded2512656b3a","tag1":"verification:checks","tag2":"acceptance-v2","value":1}],"site":null,"snapshotHash":"3f03e24389881f4d22c1248b70f1e8055d2c6bd737c9930e83dd381ac6826c42","state":"completed","submissions":[{"artifacts":[],"attempt":1,"bundleHash":null,"device":"dfa08759ca0424de","findings":[{"citation":"resolved","description":"The README's 'Build and check' section instructs the verifier to run `sha256sum --check lib/SHA256SUMS` and lib/README.md states 'Upstream sources are unchanged'. On the delivered tree the check fails for seven files under lib/forge-std/src (Vm.sol, StdJson.sol, StdToml.sol, StdAssertions.sol, console.sol, interfaces/IMulticall3.sol, interfaces/IERC7540.sol). The recorded digests in lib/SHA256SUMS are the genuine upstream forge-std v1.9.7 digests (confirmed by fetching each file from raw.githubusercontent.com/foundry-rs/forge-std/v1.9.7), but the files in the tree were reformatted after the manifest was written (forge fmt line-length 120 style: multi-line signatures collapsed to one line and vice versa). Stripping all whitespace, every one of the seven files is byte-identical to upstream, so the change is semantically nil and affects only test-only code. The five OpenZeppelin files the production token inherits (ERC20.sol, IERC20.sol, IERC20Metadata.sol, Context.sol, draft-IERC6093.sol) are byte-identical to upstream v5.4.0 and pass the check. Impact: the project's own provenance check, which is the documented way for an offline verifier to trust lib/ without network access, reports tampering on a clean checkout, so a reviewer either cannot distinguish this benign drift from a real modification or learns to ignore the check. Fix (either): regenerate lib/SHA256SUMS from the files as committed, or restore the seven files to their upstream bytes so the existing manifest validates. Keep the whitespace-insensitive equivalence in mind when choosing; restoring upstream bytes keeps the digests meaningful as a pin to the release.","line":121,"path":"README.md","reproduction":"From the repository root run `sha256sum --check lib/SHA256SUMS`. Expected (per README.md:121 and lib/README.md 'Upstream sources are unchanged'): every line OK, exit 0. Actual: 7 lines report FAILED (lib/forge-std/src/StdJson.sol, lib/forge-std/src/interfaces/IMulticall3.sol, lib/forge-std/src/console.sol, lib/forge-std/src/Vm.sol, lib/forge-std/src/interfaces/IERC7540.sol, lib/forge-std/src/StdAssertions.sol, lib/forge-std/src/StdToml.sol) and 'WARNING: 7 computed checksums did NOT match', exit 1. Example: recorded 9068805b59ac1d0ea03a8fa1f15ae49c094e0c6c852a2500e0dd112f264b2cb1 for lib/forge-std/src/Vm.sol (equals upstream v1.9.7), actual sha256 of the tree file a1b1c82924aecf0f38b53192fd1e801cccc1e1fd2ecd6b2301e4f4c4ab102a15. `diff <(curl -sL https://raw.githubusercontent.com/foundry-rs/forge-std/v1.9.7/src/Vm.sol) lib/forge-std/src/Vm.sol` shows only line-wrapping changes; `tr -d ' \\t\\n\\r'` on both sides yields identical digests for all seven files.","severity":"low","snippet":"sha256sum --check lib/SHA256SUMS","title":"Documented vendored-dependency integrity check fails: 7 forge-std files do not match lib/SHA256SUMS"}],"hash":"3190693bedfbb2dd11c7570ca34cf21ce10fa997bd63f3738b29827025e21088","nodeId":"b10494bf-c108-4872-95ef-fee4cc90313f","outcome":"completed","summary":"The review is complete and the findings file is written and validated. Only the untracked `.imd-findings.json` was added to the tree.\n\n**Result: the token is clean. One low-severity periphery finding.**\n\nPLEA is an unmodified OpenZeppelin v5.4.0 ERC20 with a single constructor mint of 1,000,000,000e18 to the deployer. I traced all three entry points under the Execution Trace, Periphery and First Principles guides and found no defect in `src/PLEA.sol`:\n\n- **Execution trace.** No parameter divergence, sentinel paths, external calls, callbacks or partial updates exist. Every revert path restores balances and allowances. Launch flows to the distributor, pool and rewards recipient move exactly the stated amount, and the factory cannot spend a holder's balance without approval.\n- **Periphery.** The five OpenZeppelin files the token inherits are byte-identical to upstream v5.4.0, verified by fetching each file from GitHub and comparing SHA-256 digests.\n- **First principles.** No owner, mint, burn, pause, blacklist, permit, receive or fallback. ETH and unknown selectors revert. The runtime has no forbidden opcodes. CREATE2 from the factory credits the factory, not the transaction origin. The 87/3/10 split sums to the whole supply and is consistent with the pool share and swarm share described for the launch.\n\n**Finding (low).** The README's documented integrity check `sha256sum --check lib/SHA256SUMS` fails on the delivered tree. Seven forge-std files were reformatted after the manifest was recorded. The recorded digests match genuine upstream v1.9.7, and the tree files are identical to upstream once whitespace is stripped, so the drift is semantically nil and test-only. The defect is that the project's own offline provenance check reports tampering on a clean checkout. Fix by regenerating the manifest or restoring the upstream bytes.\n\n**Checks run.** The full suite passed: 37 tests across three files including 512-run fuzzing and the 128x64 stateful invariant. `forge fmt --check` passed. Slither and aderyn output from the verifier reported nothing actionable beyond a numeric-literal style note, which I did not report.\n\n**Coverage.** All three entry points are recorded as `holds`, plus rows for the constructor mint, the fixed-supply and no-privileged-hand invariants, the OpenZeppelin provenance, and the forge-std provenance that carries the finding. The protected suite's real Uniswap v4 seed and swap could not be executed locally because v4-core is not in this repository, but a plain ERC20 without exemptions cannot fail those flows.","treeHash":null,"usage":{"cachedInputTokens":609509,"inputTokens":258,"model":"claude-fable-5-1","outputTokens":11630,"runtime":"claude","turns":23,"wallClockMs":197518}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"05f71cd1a5206480","findings":[{"citation":"resolved","description":"README.md lists `sha256sum --check lib/SHA256SUMS` as one of the four build-and-check commands, and lib/README.md states \"Upstream sources are unchanged. `SHA256SUMS` records each included file; from the project root run `sha256sum --check lib/SHA256SUMS` to check them.\" On the committed tree that command exits non-zero: seven forge-std files (StdJson.sol, StdToml.sol, StdAssertions.sol, Vm.sol, console.sol, interfaces/IMulticall3.sol, interfaces/IERC7540.sol) hash differently from the values recorded in lib/SHA256SUMS. The recorded hashes are the genuine upstream v1.9.7 hashes (verified against the codeload tarball, whose digest 45157353...7ee94 matches lib/README.md); the committed files were reformatted after hashing (forge fmt at line_length 120 re-joined multi-line signatures). The differences are whitespace-only, so compiled behaviour is unchanged and no production code is affected: all five OpenZeppelin files, including ERC20.sol, match their recorded hashes. Impact is limited to a false documentation claim: a reviewer or the release process following the README's own verification step gets a failed check and cannot distinguish this benign drift from a tampered dependency without repeating the upstream comparison done here. This is outside the assigned access-control area and carries no on-chain impact; it is reported because it is concrete and the author can resolve it. Because contributors may not modify lib/, the fix available to the author is in README.md: either drop the sha256 step from the documented checks and the \"unchanged\" claim in lib/README.md, or regenerate lib/SHA256SUMS through whichever process is permitted to touch lib/.","line":121,"path":"README.md","reproduction":"State: the committed tree at HEAD (dced2dc), git status clean. Input: run from the repository root `sha256sum --check lib/SHA256SUMS`. Expected (per README.md line 121 and lib/README.md lines 3-5): every line reports OK and the command exits 0. Actual: exit status 1 with `lib/forge-std/src/StdJson.sol: FAILED`, `lib/forge-std/src/interfaces/IMulticall3.sol: FAILED`, `lib/forge-std/src/console.sol: FAILED`, `lib/forge-std/src/Vm.sol: FAILED`, `lib/forge-std/src/interfaces/IERC7540.sol: FAILED`, `lib/forge-std/src/StdAssertions.sol: FAILED`, `lib/forge-std/src/StdToml.sol: FAILED`, `sha256sum: WARNING: 7 computed checksums did NOT match`. Cross-check: `curl -sSL https://codeload.github.com/foundry-rs/forge-std/tar.gz/refs/tags/v1.9.7 | sha256sum` gives 45157353ab49eab01d294565866731e599b32401757229689ee459aa26b7ee94 (matches lib/README.md); the upstream src/StdJson.sol hashes to 0211b47e... (the value in lib/SHA256SUMS) while lib/forge-std/src/StdJson.sol hashes to 61bbf9b3...; `diff` between the two shows only re-wrapped function signatures, and comparing with all spaces and newlines stripped shows the files identical.","severity":"low","snippet":"sha256sum --check lib/SHA256SUMS","title":"Documented integrity check `sha256sum --check lib/SHA256SUMS` fails: seven committed forge-std files do not match the committed checksum list"}],"hash":"328f9cef46df6fd83dcea86fe1c112178fef339332cea0336a3f82c1bab7351b","nodeId":"2622fd9a-46a6-4452-87be-4d2cbd466e13","outcome":"completed","summary":"The review is complete and the findings file is written and validated.\n\n**Outcome: no access-control, trust-gap or asymmetry defect in the PLEA token.** One low-severity documentation defect outside the assigned area is reported.\n\n**What the token is.** `src/PLEA.sol` is 17 lines: an unmodified OpenZeppelin v5.4.0 ERC20 whose constructor mints 1,000,000,000e18 to the deployer. The compiled ABI holds only the ten standard ERC-20 selectors plus the supply constant. There is no owner, initializer, fallback, mint, burn, pause, blacklist or upgrade path, and the runtime contains no DELEGATECALL, CALLCODE or SELFDESTRUCT.\n\n**Area coverage.**\n- Access control: the only writers of balances and allowances are the holder's own calls. The factory cannot spend a holder's balance without approval, which both the local launch test and the protected privileged-hand test exercise.\n- Asymmetry: transfer and transferFrom share one `_update` path. Zero-address checks mirror each other on approve and transfer. Self-transfer re-reads storage, so balance is preserved. No caller class is exempted or taxed, so the factory, distributor, PoolManager and traders all move exactly the requested amount.\n- Trust gap: the 87/3/10 split is not enforced by the token. It comes from the launch policy, the swarm's fixed share and the remainder recipient. That is the intended design and is recorded in the coverage record as a trust assumption, not a defect.\n\n**The one finding (low).** The README lists `sha256sum --check lib/SHA256SUMS` as a build check, and lib/README.md claims upstream sources are unchanged. On the committed tree that command fails for seven forge-std files. I fetched the upstream v1.9.7 archive, confirmed its digest matches the one documented, and confirmed the differences are whitespace-only reflows from forge fmt. The OpenZeppelin files, including ERC20.sol, all match. There is no on-chain impact. Since contributors may not modify lib/, the available fix is to correct the README claim or regenerate the checksum list through a process allowed to touch lib/.\n\n**Checks run.** forge build succeeded, all 37 existing tests passed with the documented fuzz seed, and forge fmt --check passed. Slither and aderyn output from the verifier had nothing above a benign large-literal note, which is the supply constant.\n\n**Coverage record.** All three listed entry points are marked `holds`, plus rows for the constructor, the no-privileged-surface invariant, the genuine-OZ check and the distribution trust assumption. No files in the tree were changed. The temporary download directory was removed.","treeHash":null,"usage":{"cachedInputTokens":715040,"inputTokens":290,"model":"claude-fable-5-1","outputTokens":11487,"runtime":"claude","turns":19,"wallClockMs":183850}},{"artifacts":[],"attempt":1,"bundleHash":"fc50208488c79e54b99f0df0478b0fbb4d3863cd6fdb489c8affc6accb1236ff","device":"96f910d48c47b222","findings":[],"hash":"69e572c0e655159a4c3151719a4e866e2426a7afb931d87778aded2512656b3a","nodeId":"b75e2dc2-b606-4b59-99cb-435502ba3745","outcome":"completed","summary":"Added 15 tests covering allowance boundaries, authorization, and failure rollback. Expanded stateful invariants to 32,768 calls.\n\nValidation passed offline:\n- `forge build`\n- `forge test` with the required seed: **52 passed, 0 failed**\n\nOnly `test/` changed. No implementation defects found.","treeHash":"3fadd4e1270a7777e6f8146dbc7ec555286b13aa","usage":{"cachedInputTokens":848128,"inputTokens":80456,"model":"gpt-6-astra","outputTokens":10216,"runtime":"codex","turns":5,"wallClockMs":284152}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"41f7c1458e1278ad","findings":[{"citation":"resolved","description":"README.md (Build and check) and lib/README.md (\"Upstream sources are unchanged. ... run `sha256sum --check lib/SHA256SUMS` to check them\") present the checksum verification as part of the project's reproducible check set. On the committed tree the command fails for lib/forge-std/src/StdJson.sol, interfaces/IMulticall3.sol, console.sol, Vm.sol, interfaces/IERC7540.sol, StdAssertions.sol and StdToml.sol. I downloaded the pinned forge-std v1.9.7 tarball (sha256 45157353ab49...ee94, matching lib/README.md) and confirmed that (a) the 30 other SHA256SUMS entries match upstream byte for byte, (b) the hashes recorded for the 7 failing files are the upstream hashes, and (c) the 7 vendored files differ from upstream only in whitespace/line wrapping (identical after stripping all whitespace), i.e. they were run through a formatter after the sums were recorded. Impact is limited to test tooling: the OpenZeppelin ERC20 and its four imports are byte-identical to upstream v5.4.0, so the production bytecode is unaffected. But a verifier or reviewer who follows the README's own instructions gets a FAILED integrity result and cannot distinguish this from a tampered dependency without re-deriving upstream themselves. Fix: either restore the 7 files from the upstream archive (they are already excluded from `forge fmt` by foundry.toml `ignore = [\"lib/**\"]`), or regenerate lib/SHA256SUMS from the tree as committed and drop the \"unchanged\" wording.","line":121,"path":"README.md","reproduction":"From the repository root run `sha256sum --check lib/SHA256SUMS`. Expected (per README.md:121 and lib/README.md:4-5): every line `OK`, exit 0. Actual: `lib/forge-std/src/StdJson.sol: FAILED`, `lib/forge-std/src/interfaces/IMulticall3.sol: FAILED`, `lib/forge-std/src/console.sol: FAILED`, `lib/forge-std/src/Vm.sol: FAILED`, `lib/forge-std/src/interfaces/IERC7540.sol: FAILED`, `lib/forge-std/src/StdAssertions.sol: FAILED`, `lib/forge-std/src/StdToml.sol: FAILED`, `WARNING: 7 computed checksums did NOT match`, exit 1. Cross-check: `diff <(tr -d ' \\t\\n' < forge-std-1.9.7/src/Vm.sol) <(tr -d ' \\t\\n' < lib/forge-std/src/Vm.sol)` on the upstream tarball is empty, while `diff` without stripping shows only re-wrapped function signatures (e.g. Vm.sol line 827 `getDeployment(...)` joined onto one line).","severity":"low","snippet":"sha256sum --check lib/SHA256SUMS","title":"Documented dependency integrity check fails: 7 vendored forge-std files were reformatted after lib/SHA256SUMS was generated"},{"citation":"resolved","description":"Not a code defect; recorded so the judge has the economic trust surface explicitly. PLEA is an unmodified OpenZeppelin v5.4.0 ERC20 with a single constructor mint to msg.sender (the factory under launchCustom) and no other entry points. The brief's 87% / 3% / 10% split is therefore produced entirely by the factory: 10% to the launch MerkleDistributor, 87% single-sided into the v4 pool, and the remaining 3% forwarded to economics.remainderTo (0xee2aaa315cf7ed169f93148d30d24af9318dbb66 per README). Nothing on chain locks, vests, or schedules the 3% \"Season Rewards\": the recipient holds 30,000,000 PLEA as an ordinary freely transferable balance from the launch block onward, and the 10% swarm share is likewise liquid once claimed. This matches the brief (\"all minted once to the deployer\", no vesting requested) and the README's stated assumptions, so it is reported as a trust assumption rather than a defect. Economic consequence for the reader: at the stated opening cap of 1,000 IMD for the whole supply, the 3% tranche is 30 IMD of notional at the opening price and 3.4% of the pool's 870,000,000 PLEA depth, so its custodian can sell the entire tranche into the pool at any time; that risk is custody/operational, not contractual.","line":15,"path":"src/PLEA.sol","reproduction":"Deploy PLEA from a factory contract F (CREATE2 or CREATE, no args); F holds 1_000_000_000e18. F transfers 100_000_000e18 to the distributor, 870_000_000e18 to the pool and 30_000_000e18 to remainderTo R. Then `vm.prank(R); token.transfer(anyAddress, 30_000_000e18)` succeeds immediately and `token.balanceOf(anyAddress) == 30_000_000e18`. Expected per brief: exactly this (no lock is specified). There is no call on PLEA, from F, R or anyone, that can restrict it, which is the point being documented. Verified locally in a scratch Foundry test (factory-held supply, three transfers, immediate onward transfer, totalSupply unchanged at 1e27).","severity":"info","snippet":"        _mint(msg.sender, INITIAL_SUPPLY);","title":"Trust assumption: the 3% season-rewards allocation and the 87% pool share are enforced only by the launch infrastructure and the remainderTo key, not by the token"}],"hash":"8879ae41bc5cf5301b723b67013e4837f47793b26013eaaa9e481dd47c648cae","nodeId":"7bfafde9-eb90-4c95-b5e1-4e50439ea5d1","outcome":"completed","summary":"The review is complete and the findings file is written. The working tree is clean apart from the review output itself.\n\n**Outcome:** no economic, invariant or flow-gap defect in the token. PLEA is an unmodified OpenZeppelin v5.4.0 ERC20 with one constructor mint and no other entry points, so every flow the launch depends on moves exactly what it says.\n\n**What I checked, in my area**\n\n- Economic Security: no external dependencies, no fee, rebase, pause or blacklist behaviour, sentinel handling reverts correctly on the zero address, and no mint, burn, permit, receive or fallback path exists.\n- Invariant: supply is fixed at one billion tokens, the sum of balances equals total supply under a fuzzed run, and allowance accounting matches the documented semantics.\n- Flow Gap: the 10% distributor, 87% pool and 3% remainder transfers arrive whole, and claims and pool-direction transfers are exact. The vendored OpenZeppelin files are byte-identical to upstream v5.4.0.\n\n**Findings written to .imd-findings.json**\n\n1. Low. The README's documented check `sha256sum --check lib/SHA256SUMS` fails on seven forge-std files. I downloaded the pinned v1.9.7 archive and confirmed they differ only by whitespace, so production bytecode is unaffected, but the documented integrity step does not pass on the committed tree.\n2. Info. The 3% season-rewards tranche and the swarm share have no on-chain lock. This matches the brief and is recorded as a trust assumption, not a defect.\n\n**Coverage** has rows for all three ABI entry points plus four invariant rows. The one thing not reached is an actual Uniswap v4 swap, since v4-core is not vendored here. The token side of that path is the plain transfer and transferFrom that already hold.","treeHash":null,"usage":{"cachedInputTokens":825221,"inputTokens":322,"model":"claude-fable-5-1","outputTokens":17258,"runtime":"claude","turns":23,"wallClockMs":257067}},{"artifacts":[],"attempt":1,"bundleHash":"b46f92073ad083d5081ee9ce6c7848ecbc89cc66e5d25e854662fc7e93f1b8e5","device":"ca075d17c94a854b","findings":[],"hash":"93d87cc540c1de8d8e7305afb661211c7355d1082e0115903c1accc2ae966bd6","nodeId":"6f4f7cd3-f12b-4fd1-85b5-3f566f73a9a3","outcome":"completed","summary":"Done. The only file added is launch.json, and the build and full test suite pass with the verifier's fuzz seed.\n\n**What the manifest says**\n\n- Kind is custom_token with token contract PLEA, name PLEA, symbol PLEA, 18 decimals, and an empty constructorArgs list, matching the accepted constructor in `src/PLEA.sol:14`, which takes no parameters.\n- totalSupply is 1000000000000000000000000000, exactly the one billion tokens in base units that the constructor mints once to msg.sender.\n- contracts is empty because the accepted tree deploys nothing besides the token. The 87% / 3% / 10% split is the factory's work after construction, not a contract here.\n- pool and economics are copied verbatim from the launch terms: IMD as the paired currency, fee 12500, tick spacing 60, the one-to-one provenance price, and the requester's economics object.\n- notes explain the token's fixed supply, lack of privileged functions, and that no application contracts exist, in about 1,000 characters.\n\n**Checks run**\n\n- A script confirmed the manifest uses only schema keys, lowercase addresses, string uint256s, numeric fee, tickSpacing and decimals, and that economics and pool match the job verbatim.\n- forge build compiled cleanly, and forge test with the pinned seed passed all 37 tests across 3 suites.\n- git status shows launch.json as the only change.","treeHash":"2c2dcb16456121abadb59d641bd7c0af8a2667b8","usage":{"cachedInputTokens":182684,"inputTokens":130,"model":"claude-fable-5-1","outputTokens":2834,"runtime":"claude","turns":8,"wallClockMs":60477}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"f47f953f8e35921e","findings":[{"citation":"resolved","description":"Outside the assigned math area; reported because it is a concrete, reproducible defect in the delivered tree. README.md lists `sha256sum --check lib/SHA256SUMS` as one of the four build-and-check commands and states that all vendored dependencies are pinned by these checksums. In the committed tree (git status clean at HEAD dced2dc) seven forge-std files hash differently from the manifest: StdJson.sol, interfaces/IMulticall3.sol, console.sol, Vm.sol, interfaces/IERC7540.sol, StdAssertions.sol, StdToml.sol. The actual sha256 of lib/forge-std/src/StdJson.sol is 61bbf9b3219f3636d459e74799e642ee80a9e4d51ef66e793814a032ed97cb83, not the 0211b47e... recorded on line 2. The OpenZeppelin entries (including contracts/token/ERC20/ERC20.sol, the only dependency the production token compiles against) all verify, so the token's bytecode provenance is unaffected; only the test-side dependency pin is stale. Impact is limited to a failing documented check and a weakened provenance claim for the test toolchain. Fix: regenerate lib/SHA256SUMS from the vendored tree (or re-vendor the forge-std revision the manifest was generated from) so the README's check passes. The fix touches lib/, which is a path the review rules forbid a worker from modifying, so it is left to the author.","line":2,"path":"lib/SHA256SUMS","reproduction":"From the repository root at HEAD dced2dc run `sha256sum --check lib/SHA256SUMS`. Expected (per README 'Build and check'): every line reports OK. Actual: 'sha256sum: WARNING: 7 computed checksums did NOT match' with FAILED for lib/forge-std/src/StdJson.sol, interfaces/IMulticall3.sol, console.sol, Vm.sol, interfaces/IERC7540.sol, StdAssertions.sol, StdToml.sol. `sha256sum lib/forge-std/src/StdJson.sol` prints 61bbf9b3219f3636d459e74799e642ee80a9e4d51ef66e793814a032ed97cb83 while line 2 of lib/SHA256SUMS records 0211b47e93dbeb6a7de6112470a77137038ed73b79b015847f013e49fcd7511f. `git status --short` is empty, so this is the committed state, not a local modification.","severity":"low","snippet":"0211b47e93dbeb6a7de6112470a77137038ed73b79b015847f013e49fcd7511f  lib/forge-std/src/StdJson.sol","title":"Committed lib/SHA256SUMS does not match the committed forge-std files, so the README's documented integrity check fails as shipped"}],"hash":"c8d02fc42ee9fe28c990b4a25da3b2923364817bd31a5c0ee962a4e4c8efc4d3","nodeId":"d19b3584-50b4-4190-a08a-d2046a307276","outcome":"completed","summary":"Review complete. The findings file is written and parses.\n\n**Outcome.** The PLEA token has no defects in the assigned area. It is an unmodified OpenZeppelin v5.4.0 ERC-20 with one constructor mint of a compile-time constant. There is no division, scaling, fee, cast, external call, payable path or bytes decoding anywhere in the token, so the Math Precision, Boundary and Numerical Gap failure modes have nothing to attach to.\n\n**What I checked and verified with a scratch Foundry test** (8 tests, all passing, in `test/scratch/MathBoundary.t.sol`):\n- The supply constant equals exactly 1e27 on chain, decimals are 18, and the 87/3/10 split in basis points is exact with zero remainder.\n- Transfers of 1 wei, the full balance, zero value from an empty balance, and a full-balance self-transfer all behave correctly. Transfers of supply+1 and max-uint revert.\n- Exact allowances go to zero and then revert. Infinite allowance is never decremented. Max-minus-one decrements correctly. An allowance larger than the balance reverts atomically and leaves the allowance intact.\n- Zero-address sender, recipient and spender all revert.\n- A 512-run fuzz confirms balance conservation and a constant total supply across reverting and non-reverting transfers.\n\n**One low finding, outside my area.** The committed checksum manifest in lib does not match seven committed forge-std files, so the README's documented integrity check fails on the tree as shipped. The OpenZeppelin entries, including the only file the production token compiles against, all verify. The fix touches lib, which a worker may not modify, so it is left to the author. Line, snippet and the exact reproduction command are in the findings file.\n\n**Coverage.** All three ABI entry points are marked holds with reasons. Five extra rows record the invariants and math checks above. The existing 37-test suite and the format check both pass. The aderyn large-literal lead was examined and not promoted. The Slither output was empty.","treeHash":null,"usage":{"cachedInputTokens":597745,"inputTokens":354,"model":"claude-fable-5-1","outputTokens":10205,"runtime":"claude","turns":12,"wallClockMs":169014}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"9f3c23750c16c22c","findings":[{"citation":"resolved","description":"Merged from the audit_permissions, audit_flow, audit_math and audit_economics reports, which all describe the same root cause; reproduced here. README.md's 'Build and check' section lists `sha256sum --check lib/SHA256SUMS` as one of the four commands a verifier runs, and lib/README.md states 'Upstream sources are unchanged' and points at the same command. On the committed tree (HEAD 09a3391, `git status` clean) the command exits 1: lib/forge-std/src/StdJson.sol, interfaces/IMulticall3.sol, console.sol, Vm.sol, interfaces/IERC7540.sol, StdAssertions.sol and StdToml.sol hash differently from the values in lib/SHA256SUMS. I downloaded the pinned forge-std v1.9.7 tarball (sha256 45157353ab49eab01d294565866731e599b32401757229689ee459aa26b7ee94, which matches lib/README.md) and confirmed that the recorded digests are the genuine upstream digests, and that each of the seven vendored files is identical to upstream once all whitespace is stripped: the files were run through a formatter after the sums were taken. Production code is unaffected: all five OpenZeppelin v5.4.0 files the token compiles against (ERC20.sol, IERC20.sol, IERC20Metadata.sol, Context.sol, draft-IERC6093.sol) are byte-identical to the upstream v5.4.0 tarball (sha256 b89829be48bc501051002191733268a93ef6e238a4bb65d8fd1cbdf3969050d1) and pass the check, and forge-std is test-only. Impact is limited to a false documentation claim: an offline verifier who follows the project's own instructions gets a tampering report on a clean checkout and cannot tell this benign drift from a real modification without redoing the upstream comparison. Fix, either: restore the seven files to their upstream bytes (foundry.toml already excludes lib/** from `forge fmt`, so they will stay that way), or regenerate lib/SHA256SUMS from the tree as committed and soften the 'Upstream sources are unchanged' wording in lib/README.md. Both touch lib/, which contributors may not modify, so this is left to the author; if neither is possible, drop the sha256 step from README.md line 121.","line":121,"path":"README.md","reproduction":"State: the committed tree at HEAD 09a3391 with `git status --short` empty. Input: from the repository root run `sha256sum --check lib/SHA256SUMS`. Expected (README.md line 121, lib/README.md lines 3-5): every line reports OK and the command exits 0. Actual: `lib/forge-std/src/StdJson.sol: FAILED`, `lib/forge-std/src/interfaces/IMulticall3.sol: FAILED`, `lib/forge-std/src/console.sol: FAILED`, `lib/forge-std/src/Vm.sol: FAILED`, `lib/forge-std/src/interfaces/IERC7540.sol: FAILED`, `lib/forge-std/src/StdAssertions.sol: FAILED`, `lib/forge-std/src/StdToml.sol: FAILED`, `sha256sum: WARNING: 7 computed checksums did NOT match`, exit status 1; the other 30 entries report OK. Example: line 2 of lib/SHA256SUMS records 0211b47e93dbeb6a7de6112470a77137038ed73b79b015847f013e49fcd7511f for lib/forge-std/src/StdJson.sol, which is the upstream v1.9.7 digest, while the committed file hashes to 61bbf9b3219f3636d459e74799e642ee80a9e4d51ef66e793814a032ed97cb83. Cross-check: after `curl -sSL https://codeload.github.com/foundry-rs/forge-std/tar.gz/refs/tags/v1.9.7 | tar xz`, `diff <(tr -d ' \\t\\n\\r' < forge-std-1.9.7/src/Vm.sol) <(tr -d ' \\t\\n\\r' < lib/forge-std/src/Vm.sol)` is empty for all seven files, and `cmp` on each of the five vendored OpenZeppelin files against the v5.4.0 tarball reports no difference.","severity":"low","snippet":"sha256sum --check lib/SHA256SUMS","title":"Documented integrity check `sha256sum --check lib/SHA256SUMS` fails on the committed tree: seven vendored forge-std files were reformatted after the checksum list was recorded"},{"citation":"resolved","description":"Not a code defect; kept from the audit_economics report so the economic trust surface is explicit for the judge. PLEA is an unmodified OpenZeppelin v5.4.0 ERC20 whose only custom code is one constructor mint of 1e27 base units to msg.sender (the factory under launchCustom). The token has no other entry points, so the distribution in the brief is produced entirely by the factory: 10% to the launch MerkleDistributor, poolBps 8700 seeded single-sided into the v4 pool against IMD, and the remaining 3% forwarded to economics.remainderTo (0xee2aaa315cf7ed169f93148d30d24af9318dbb66). Nothing on chain locks, vests or schedules the 3% 'Season Rewards': the recipient holds 30,000,000 PLEA as a freely transferable balance from the launch block onward. This matches the brief ('all minted once to the deployer', no vesting requested) and the README's stated assumptions, so it is a trust assumption, not a defect. The protected floor's checks (supply minted whole to the factory, whole transfers to the distributor and through the pool manager, no admin calls, no DELEGATECALL/CALLCODE/SELFDESTRUCT) are all satisfied by construction for a plain ERC20.","line":15,"path":"src/PLEA.sol","reproduction":"Deploy PLEA from a contract F (the project's own test/PLEALaunch.t.sol does this with CREATE2): `token.balanceOf(F) == 1_000_000_000e18` and `token.totalSupply() == 1_000_000_000e18`. F transfers 100_000_000e18 to the distributor, 870_000_000e18 to the pool account and 30_000_000e18 to remainderTo R; each recipient's balance equals the amount sent. Then `vm.prank(R); token.transfer(anyAddress, 30_000_000e18)` returns true immediately and `token.balanceOf(anyAddress) == 30_000_000e18`, with totalSupply unchanged at 1e27. Expected per brief: exactly this. There is no call on PLEA, from F, R or anyone else, that can restrict, lock or reverse it; `forge test` on the delivered suite (52 tests) passes and exercises this flow.","severity":"info","snippet":"        _mint(msg.sender, INITIAL_SUPPLY);","title":"Trust assumption: the 87% / 3% / 10% split and the season-rewards custody are enforced by the launch factory and the remainderTo key, not by the token"}],"hash":"d087e518caebb0cd295ecc4699d72ad1189f767d2f68eec07db8411d9718b9f0","nodeId":"917afcaf-80c9-410d-82f1-cfd55d92fe87","outcome":"completed","summary":"The review is complete and the findings file is written. Only the findings file is new in the working tree, and both quoted snippets match the files line for line.\n\n**Outcome:** the PLEA token is sound. It is an unmodified OpenZeppelin v5.4.0 ERC20 with one no-argument constructor that mints the full supply to the factory, and nothing else. No critical, high or medium defect exists.\n\n**What I reproduced and kept:**\n\n- **Low, merged from all four specialists.** The README's documented check `sha256sum --check lib/SHA256SUMS` fails on a clean checkout. Seven forge-std files were reformatted after the checksum list was recorded. I fetched the pinned forge-std v1.9.7 and OpenZeppelin v5.4.0 tarballs: both archive digests match the project's lib README, the seven files are identical to upstream once whitespace is stripped, and all five OpenZeppelin files the token compiles against are byte-identical to upstream. So production bytecode is unaffected and the impact is a false provenance claim. The fix lives in lib or the README, which the author must do.\n- **Info.** The 87% / 3% / 10% split and the season-rewards custody are enforced by the factory and the remainderTo key, not the token. This is the requested design, recorded as a trust assumption.\n\n**My own pass:** I built the project, ran its 52 tests with the README's fuzz seed, ran the format check, and checked the manifest against the source and schema rules. The three entry points, the constructor mint, the manifest and CREATE2 deployability all hold, and each has a coverage row with its reason.\n\n**Not run here:** the protected Uniswap v4 harness, which needs the network's factory and pool environment the verifier supplies.","treeHash":null,"usage":{"cachedInputTokens":429910,"inputTokens":226,"model":"claude-fable-5-1","outputTokens":7202,"runtime":"claude","turns":8,"wallClockMs":110790}},{"artifacts":[],"attempt":1,"bundleHash":"b49fe6821392f4281521ef835a1135ff5789e3ae49f2cb7f170cb2652c1e5f2b","device":"24282732aac890f7","findings":[],"hash":"d2092326b31c470d104f9ce4a942c9debcb051e92261b774569219231261d3f9","nodeId":"129eea32-57b3-4198-9738-39d272546e21","outcome":"completed","summary":"Implemented PLEA with 1,000,000,000 tokens, 18 decimals, minted once to the deployer. Dependencies are vendored, and README documents factory distribution and launch responsibilities.\n\nVerified with Solidity 0.8.26:\n\n- `forge build` passes.\n- All 37 local tests pass with the requested fuzz seed, including offline.\n- `forge fmt --check` passes.\n\nProtected integration checks remain for the independent verifier.","treeHash":"5c146d3fc26b2c97f5e458229c7927ea05d1af65","usage":{"cachedInputTokens":571520,"inputTokens":55891,"model":"gpt-6-astra","outputTokens":16737,"runtime":"codex","turns":6,"wallClockMs":416079}}],"verification":[{"checks":[{"durationMs":2882,"exitCode":0,"name":"build","output":"Compiling 29 files with Solc 0.8.26\nSolc 0.8.26 finished in 2.78s\nCompiler run successful!\n","passed":true},{"durationMs":14988,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 8 tests for test/PLEALaunch.t.sol:PLEALaunchTest\n[PASS] test_ClaimAndPoolTransfersArriveWholeInBothDirections() (gas: 397865)\n[PASS] test_ConstructorUsesImmediateDeployerRegardlessOfOrigin() (gas: 477519)\n[PASS] test_Create2MintsEntireSupplyToFactory() (gas: 71260)\n[PASS] test_DistributionArrivesExactlyAndEmptiesFactory() (gas: 173011)\n[PASS] test_FactoryCannotSpendHolderFundsWithoutApproval() (gas: 237542)\n[PASS] test_NoMintBurnFreezeOwnershipOrUpgradeEntryPoints() (gas: 2114547)\n[PASS] test_RuntimeHasNoForbiddenOpcodes() (gas: 1034392)\n[PASS] test_TransfersDoNotCallReceiverCode() (gas: 292620)\nSuite result: ok. 8 passed; 0 failed; 0 skipped; finished in 94.25ms (7.69ms CPU time)\n\nRan 28 tests for test/PLEA.t.sol:PLEATest\n[PASS] testFuzz_InsufficientAllowanceDoesNotChangeState(uint256,uint256) (runs: 512, μ: 123284, ~: 123429)\nLogs:\n  Bound result 83409302481886961311300000\n  Bound result 916590802129333276106045929\n\n[PASS] testFuzz_InsufficientBalanceDoesNotChangeState(uint256,uint256) (runs: 512, μ: 127081, ~: 127025)\nLogs:\n  Bound result 1\n  Bound result 20893724695867019558734116077467020492\n\n[PASS] testFuzz_TransferConservesSupply(address,uint256) (runs: 512, μ: 93149, ~: 93805)\nLogs:\n  Bound result 9\n\n[PASS] testFuzz_TransferFromRespectsFiniteAllowance(uint256,uint256) (runs: 512, μ: 163016, ~: 164842)\nLogs:\n  Bound result 3963891461\n  Bound result 11922\n\n[PASS] test_ApprovalBelongsOnlyToCaller() (gas: 113848)\n[PASS] test_ApprovalCanBeOverwrittenAndRevoked() (gas: 166618)\n[PASS] test_ApproveEmitsEventAndDoesNotMoveFunds() (gas: 88809)\n[PASS] test_ApproveZeroSpenderReverts() (gas: 37640)\n[PASS] test_ConstructorEmitsExactlyOneMint() (gas: 9692)\n[PASS] test_EtherAndUnknownCallsAreRejected() (gas: 58921)\n[PASS] test_InfiniteAllowanceIsNotDecremented() (gas: 206266)\n[PASS] test_MetadataAndEntireInitialSupply() (gas: 107628)\n[PASS] test_SelfTransferPreservesBalance() (gas: 51474)\n[PASS] test_SelfTransferStillRequiresSufficientBalance() (gas: 35864)\n[PASS] test_TransferEmitsEventAndArrivesWhole() (gas: 91494)\n[PASS] test_TransferEntireSupplyAndSmallestUnitBack() (gas: 141389)\n[PASS] test_TransferFromByHolderStillRequiresAllowance() (gas: 42599)\n[PASS] test_TransferFromOverAllowanceRevertsAtomically() (gas: 115713)\n[PASS] test_TransferFromOverBalanceRestoresAllowance() (gas: 178368)\n[PASS] test_TransferFromSpendsAllowanceAndEmitsTransfer() (gas: 231526)\n[PASS] test_TransferFromToSelfConsumesFiniteAllowance() (gas: 103263)\n[PASS] test_TransferFromToZeroRestoresAllowance() (gas: 114060)\n[PASS] test_TransferFromZeroCannotMint() (gas: 56132)\n[PASS] test_TransferOverBalanceRevertsAtomically() (gas: 119983)\n[PASS] test_TransferToZeroRevertsWithoutBurning() (gas: 47552)\n[PASS] test_ZeroTransferFromEmptyAccountEmitsEvent() (gas: 63046)\n[PASS] test_ZeroTransferFromWithoutAllowanceSucceeds() (gas: 78797)\n[PASS] test_ZeroTransferToZeroAlsoReverts() (gas: 30368)\nSuite result: ok. 28 passed; 0 failed; 0 skipped; finished in 115.93ms (454.62ms CPU time)\n\nRan 15 tests for test/PLEAAllowanceProperties.t.sol:PLEAAllowancePropertiesTest\n[PASS] testFuzz_FailedDestinationPreservesApprovalForValidRetry(uint256,uint256) (runs: 1000, μ: 229343, ~: 229751)\nLogs:\n  Bound result 4202047187\n  Bound result 115792089237316195423570985008687907853269984665640564039457584007908927592846\n\n[PASS] testFuzz_InsufficientBalanceRestoresAnySufficientAllowance(uint256,uint256,uint256) (runs: 1000, μ: 210280, ~: 210758)\nLogs:\n  Bound result 9714\n  Bound result 9715\n  Bound result 22999\n\n[PASS] testFuzz_LargeFiniteAllowanceSpendsExactly(uint256,uint256) (runs: 1000, μ: 165244, ~: 165688)\nLogs:\n  Bound result 1000000000000000000000000001\n  Bound result 409\n\n[PASS] testFuzz_SpendingDoesNotChangeOtherOwnersOrSpendersApprovals(uint256,uint256,uint256) (runs: 1000, μ: 446143, ~: 446621)\nLogs:\n  Bound result 8\n\n[PASS] testFuzz_SplitAndSingleDelegatedTransfersAgree(uint256,uint256,uint256) (runs: 1000, μ: 369113, ~: 371327)\nLogs:\n  Bound result 60\n  Bound result 6\n  Bound result 18217\n\n[PASS] test_ApprovalBeforeFundingSurvivesEmptyBalanceAndRefill() (gas: 378824)\n[PASS] test_ApprovalDoesNotAuthorizeTheSpendersSpender() (gas: 252341)\n[PASS] test_DelegatedSelfTransferCannotExceedBalanceEvenWithInfiniteApproval() (gas: 274118)\n[PASS] test_HolderCanGrantAndSpendSelfApproval() (gas: 195327)\n[PASS] test_InfiniteApprovalCanBeRevokedAfterUse() (gas: 212506)\n[PASS] test_LargestFiniteApprovalReplacesInfiniteAndDecreases() (gas: 184232)\n[PASS] test_MaximumTransferCannotOverflowBalancesOrBurnSupply() (gas: 158191)\n[PASS] test_SpentApprovalCannotBeReplayedAfterTokensReturn() (gas: 201230)\n[PASS] test_ZeroApprovalToZeroSpenderStillReverts() (gas: 48033)\n[PASS] test_ZeroDelegatedTransferToZeroRevertsForFiniteAndInfiniteApproval() (gas: 261414)\nSuite result: ok. 15 passed; 0 failed; 0 skipped; finished in 115.99ms (555.47ms CPU time)\n\nRan 1 test for test/PLEAInvariant.t.sol:PLEAInvariantTest\n[PASS] invariant_ExactAccountingAndFixedSupply() (runs: 256, calls: 32768, reverts: 0)\n\n╭-------------+----------------------+-------+---------+----------╮\n| Contract    | Selector             | Calls | Reverts | Discards |\n+=================================================================+\n| PLEAHandler | approve              | 4624  | 0       | 0        |\n|-------------+----------------------+-------+---------+----------|\n| PLEAHandler | rejectZeroAddress    | 4707  | 0       | 0        |\n|-------------+----------------------+-------+---------+----------|\n| PLEAHandler | revokeAndRejectSpend | 4615  | 0       | 0        |\n|-------------+----------------------+-------+---------+----------|\n| PLEAHandler | roundTrip            | 4709  | 0       | 0        |\n|-------------+----------------------+-------+---------+----------|\n| PLEAHandler | spendApprovedBalance | 4709  | 0       | 0        |\n|-------------+----------------------+-------+---------+----------|\n| PLEAHandler | transfer             | 4732  | 0       | 0        |\n|-------------+----------------------+-------+---------+----------|\n| PLEAHandler | transferFrom         | 4672  | 0       | 0        |\n╰-------------+----------------------+-------+---------+----------╯\n\nLogs:\n  Bound result 1\n  Bound result 0\n  Bound result 417483204248107417911842158\n  Bound result 0\n  Bound result 123000000000000000000\n  Bound result 0\n  Bound result 100958694002760070174064701\n  Bound result 1239446557\n  Bound result 0\n  Bound result 0\n  Bound result 4\n  Bound result 0\n  Bound result 0\n  Bound result 17\n  Bound result 0\n  Bound result 365800833174160658318927731\n  Bound result 5743\n  Bound result 127\n  Bound result 255\n  Bound result 0\n  Bound result 950839288069116559293649854\n  Bound result 0\n  Bound result 96\n  Bound result 1\n  Bound result 0\n  Bound result 2074101770\n  Bound result 0\n  Bound result 0\n  Bound result 1000000000000000000\n  Bound result 0\n  Bound result 4\n  Bound result 0\n  Bound result 11\n  Bound result 244\n  Bound result 255\n  Bound result 0\n  Bound result 999999999999999999999999998\n  Bound result 0\n  Bound result 2\n  Bound result 2\n  Bound result 2\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 188\n  Bound result 21850901079067147141016707\n  Bound result 127\n  Bound result 0\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 14.87s (14.87s CPU time)\n\nRan 4 test suites in 14.87s (15.19s CPU time): 52 tests passed, 0 failed, 0 skipped (52 total tests)\n","passed":true},{"durationMs":52,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"PLEA.approve(address,uint256)\",\"PLEA.transfer(address,uint256)\",\"PLEA.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"README.md\":157,\"foundry.toml\":22,\"remappings.txt\":2,\"src/PLEA.sol\":17,\"test/PLEA.t.sol\":293,\"test/PLEAAllowanceProperties.t.sol\":284,\"test/PLEAInvariant.t.sol\":220,\"test/PLEALaunch.t.sol\":176},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"69e572c0e655159a4c3151719a4e866e2426a7afb931d87778aded2512656b3a","verifiedTreeHash":"3fadd4e1270a7777e6f8146dbc7ec555286b13aa","verifierVersion":"0.1.0+67c588fa"},{"checks":[{"durationMs":2260,"exitCode":0,"name":"build","output":"Compiling 28 files with Solc 0.8.26\nSolc 0.8.26 finished in 2.11s\nCompiler run successful!\n","passed":true},{"durationMs":3764,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 8 tests for test/PLEALaunch.t.sol:PLEALaunchTest\n[PASS] test_ClaimAndPoolTransfersArriveWholeInBothDirections() (gas: 397865)\n[PASS] test_ConstructorUsesImmediateDeployerRegardlessOfOrigin() (gas: 477519)\n[PASS] test_Create2MintsEntireSupplyToFactory() (gas: 71260)\n[PASS] test_DistributionArrivesExactlyAndEmptiesFactory() (gas: 173011)\n[PASS] test_FactoryCannotSpendHolderFundsWithoutApproval() (gas: 237542)\n[PASS] test_NoMintBurnFreezeOwnershipOrUpgradeEntryPoints() (gas: 2114547)\n[PASS] test_RuntimeHasNoForbiddenOpcodes() (gas: 1034392)\n[PASS] test_TransfersDoNotCallReceiverCode() (gas: 292620)\nSuite result: ok. 8 passed; 0 failed; 0 skipped; finished in 31.88ms (12.65ms CPU time)\n\nRan 28 tests for test/PLEA.t.sol:PLEATest\n[PASS] testFuzz_InsufficientAllowanceDoesNotChangeState(uint256,uint256) (runs: 512, μ: 123273, ~: 123427)\nLogs:\n  Bound result 795483805797842025704074806\n  Bound result 895879050375215093032234041\n\n[PASS] testFuzz_InsufficientBalanceDoesNotChangeState(uint256,uint256) (runs: 512, μ: 127067, ~: 127013)\nLogs:\n  Bound result 11922\n  Bound result 3963891461\n\n[PASS] testFuzz_TransferConservesSupply(address,uint256) (runs: 512, μ: 93192, ~: 93805)\nLogs:\n  Bound result 812745021216553372628814428\n\n[PASS] testFuzz_TransferFromRespectsFiniteAllowance(uint256,uint256) (runs: 512, μ: 163170, ~: 164842)\nLogs:\n  Bound result 983763147061889538194011957\n  Bound result 907135549900145361943717046\n\n[PASS] test_ApprovalBelongsOnlyToCaller() (gas: 113848)\n[PASS] test_ApprovalCanBeOverwrittenAndRevoked() (gas: 166618)\n[PASS] test_ApproveEmitsEventAndDoesNotMoveFunds() (gas: 88809)\n[PASS] test_ApproveZeroSpenderReverts() (gas: 37640)\n[PASS] test_ConstructorEmitsExactlyOneMint() (gas: 9692)\n[PASS] test_EtherAndUnknownCallsAreRejected() (gas: 58921)\n[PASS] test_InfiniteAllowanceIsNotDecremented() (gas: 206266)\n[PASS] test_MetadataAndEntireInitialSupply() (gas: 107628)\n[PASS] test_SelfTransferPreservesBalance() (gas: 51474)\n[PASS] test_SelfTransferStillRequiresSufficientBalance() (gas: 35864)\n[PASS] test_TransferEmitsEventAndArrivesWhole() (gas: 91494)\n[PASS] test_TransferEntireSupplyAndSmallestUnitBack() (gas: 141389)\n[PASS] test_TransferFromByHolderStillRequiresAllowance() (gas: 42599)\n[PASS] test_TransferFromOverAllowanceRevertsAtomically() (gas: 115713)\n[PASS] test_TransferFromOverBalanceRestoresAllowance() (gas: 178368)\n[PASS] test_TransferFromSpendsAllowanceAndEmitsTransfer() (gas: 231526)\n[PASS] test_TransferFromToSelfConsumesFiniteAllowance() (gas: 103263)\n[PASS] test_TransferFromToZeroRestoresAllowance() (gas: 114060)\n[PASS] test_TransferFromZeroCannotMint() (gas: 56132)\n[PASS] test_TransferOverBalanceRevertsAtomically() (gas: 119983)\n[PASS] test_TransferToZeroRevertsWithoutBurning() (gas: 47552)\n[PASS] test_ZeroTransferFromEmptyAccountEmitsEvent() (gas: 63046)\n[PASS] test_ZeroTransferFromWithoutAllowanceSucceeds() (gas: 78797)\n[PASS] test_ZeroTransferToZeroAlsoReverts() (gas: 30368)\nSuite result: ok. 28 passed; 0 failed; 0 skipped; finished in 32.00ms (111.04ms CPU time)\n\nRan 1 test for test/PLEAInvariant.t.sol:PLEAInvariantTest\n[PASS] invariant_ExactAccountingAndFixedSupply() (runs: 128, calls: 8192, reverts: 0)\n\n╭-------------+--------------+-------+---------+----------╮\n| Contract    | Selector     | Calls | Reverts | Discards |\n+=========================================================+\n| PLEAHandler | approve      | 2680  | 0       | 0        |\n|-------------+--------------+-------+---------+----------|\n| PLEAHandler | transfer     | 2765  | 0       | 0        |\n|-------------+--------------+-------+---------+----------|\n| PLEAHandler | transferFrom | 2747  | 0       | 0        |\n╰-------------+--------------+-------+---------+----------╯\n\nLogs:\n  Bound result 40\n  Bound result 2351\n  Bound result 1184\n  Bound result 264\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 177362147\n  Bound result 0\n  Bound result 0\n  Bound result 3380\n  Bound result 55207840108201329054225826\n  Bound result 3380\n  Bound result 12\n  Bound result 358\n  Bound result 6677\n  Bound result 0\n  Bound result 0\n  Bound result 16\n  Bound result 867\n  Bound result 20\n  Bound result 0\n  Bound result 0\n  Bound result 8700\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 244\n  Bound result 1\n  Bound result 4482\n  Bound result 0\n  Bound result 0\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 3.64s (3.63s CPU time)\n\nRan 3 test suites in 3.64s (3.70s CPU time): 37 tests passed, 0 failed, 0 skipped (37 total tests)\n","passed":true},{"durationMs":50,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"PLEA.approve(address,uint256)\",\"PLEA.transfer(address,uint256)\",\"PLEA.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"README.md\":157,\"foundry.toml\":22,\"launch.json\":24,\"remappings.txt\":2,\"src/PLEA.sol\":17,\"test/PLEA.t.sol\":293,\"test/PLEAInvariant.t.sol\":106,\"test/PLEALaunch.t.sol\":176},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"93d87cc540c1de8d8e7305afb661211c7355d1082e0115903c1accc2ae966bd6","verifiedTreeHash":"2c2dcb16456121abadb59d641bd7c0af8a2667b8","verifierVersion":"0.1.0+67c588fa"},{"checks":[{"durationMs":2219,"exitCode":0,"name":"build","output":"Compiling 28 files with Solc 0.8.26\nSolc 0.8.26 finished in 2.12s\nCompiler run successful!\n","passed":true},{"durationMs":3698,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 8 tests for test/PLEALaunch.t.sol:PLEALaunchTest\n[PASS] test_ClaimAndPoolTransfersArriveWholeInBothDirections() (gas: 397865)\n[PASS] test_ConstructorUsesImmediateDeployerRegardlessOfOrigin() (gas: 477519)\n[PASS] test_Create2MintsEntireSupplyToFactory() (gas: 71260)\n[PASS] test_DistributionArrivesExactlyAndEmptiesFactory() (gas: 173011)\n[PASS] test_FactoryCannotSpendHolderFundsWithoutApproval() (gas: 237542)\n[PASS] test_NoMintBurnFreezeOwnershipOrUpgradeEntryPoints() (gas: 2114547)\n[PASS] test_RuntimeHasNoForbiddenOpcodes() (gas: 1034392)\n[PASS] test_TransfersDoNotCallReceiverCode() (gas: 292620)\nSuite result: ok. 8 passed; 0 failed; 0 skipped; finished in 24.01ms (8.00ms CPU time)\n\nRan 28 tests for test/PLEA.t.sol:PLEATest\n[PASS] testFuzz_InsufficientAllowanceDoesNotChangeState(uint256,uint256) (runs: 512, μ: 123273, ~: 123427)\nLogs:\n  Bound result 83409302481886961311300000\n  Bound result 916590802129333276106045929\n\n[PASS] testFuzz_InsufficientBalanceDoesNotChangeState(uint256,uint256) (runs: 512, μ: 127067, ~: 127013)\nLogs:\n  Bound result 83409302481726534241638998\n  Bound result 104611220237417345929\n\n[PASS] testFuzz_TransferConservesSupply(address,uint256) (runs: 512, μ: 93192, ~: 93805)\nLogs:\n  Bound result 9\n\n[PASS] testFuzz_TransferFromRespectsFiniteAllowance(uint256,uint256) (runs: 512, μ: 163170, ~: 164842)\nLogs:\n  Bound result 983763147061889538194011957\n  Bound result 907135549900145361943717046\n\n[PASS] test_ApprovalBelongsOnlyToCaller() (gas: 113848)\n[PASS] test_ApprovalCanBeOverwrittenAndRevoked() (gas: 166618)\n[PASS] test_ApproveEmitsEventAndDoesNotMoveFunds() (gas: 88809)\n[PASS] test_ApproveZeroSpenderReverts() (gas: 37640)\n[PASS] test_ConstructorEmitsExactlyOneMint() (gas: 9692)\n[PASS] test_EtherAndUnknownCallsAreRejected() (gas: 58921)\n[PASS] test_InfiniteAllowanceIsNotDecremented() (gas: 206266)\n[PASS] test_MetadataAndEntireInitialSupply() (gas: 107628)\n[PASS] test_SelfTransferPreservesBalance() (gas: 51474)\n[PASS] test_SelfTransferStillRequiresSufficientBalance() (gas: 35864)\n[PASS] test_TransferEmitsEventAndArrivesWhole() (gas: 91494)\n[PASS] test_TransferEntireSupplyAndSmallestUnitBack() (gas: 141389)\n[PASS] test_TransferFromByHolderStillRequiresAllowance() (gas: 42599)\n[PASS] test_TransferFromOverAllowanceRevertsAtomically() (gas: 115713)\n[PASS] test_TransferFromOverBalanceRestoresAllowance() (gas: 178368)\n[PASS] test_TransferFromSpendsAllowanceAndEmitsTransfer() (gas: 231526)\n[PASS] test_TransferFromToSelfConsumesFiniteAllowance() (gas: 103263)\n[PASS] test_TransferFromToZeroRestoresAllowance() (gas: 114060)\n[PASS] test_TransferFromZeroCannotMint() (gas: 56132)\n[PASS] test_TransferOverBalanceRevertsAtomically() (gas: 119983)\n[PASS] test_TransferToZeroRevertsWithoutBurning() (gas: 47552)\n[PASS] test_ZeroTransferFromEmptyAccountEmitsEvent() (gas: 63046)\n[PASS] test_ZeroTransferFromWithoutAllowanceSucceeds() (gas: 78797)\n[PASS] test_ZeroTransferToZeroAlsoReverts() (gas: 30368)\nSuite result: ok. 28 passed; 0 failed; 0 skipped; finished in 24.20ms (92.94ms CPU time)\n\nRan 1 test for test/PLEAInvariant.t.sol:PLEAInvariantTest\n[PASS] invariant_ExactAccountingAndFixedSupply() (runs: 128, calls: 8192, reverts: 0)\n\n╭-------------+--------------+-------+---------+----------╮\n| Contract    | Selector     | Calls | Reverts | Discards |\n+=========================================================+\n| PLEAHandler | approve      | 2680  | 0       | 0        |\n|-------------+--------------+-------+---------+----------|\n| PLEAHandler | transfer     | 2765  | 0       | 0        |\n|-------------+--------------+-------+---------+----------|\n| PLEAHandler | transferFrom | 2747  | 0       | 0        |\n╰-------------+--------------+-------+---------+----------╯\n\nLogs:\n  Bound result 40\n  Bound result 2351\n  Bound result 1184\n  Bound result 264\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 177362147\n  Bound result 0\n  Bound result 0\n  Bound result 3380\n  Bound result 55207840108201329054225826\n  Bound result 3380\n  Bound result 12\n  Bound result 358\n  Bound result 6677\n  Bound result 0\n  Bound result 0\n  Bound result 16\n  Bound result 867\n  Bound result 20\n  Bound result 0\n  Bound result 0\n  Bound result 8700\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 244\n  Bound result 1\n  Bound result 4482\n  Bound result 0\n  Bound result 0\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 3.59s (3.58s CPU time)\n\nRan 3 test suites in 3.59s (3.63s CPU time): 37 tests passed, 0 failed, 0 skipped (37 total tests)\n","passed":true},{"durationMs":44,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"PLEA.approve(address,uint256)\",\"PLEA.transfer(address,uint256)\",\"PLEA.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"README.md\":157,\"foundry.toml\":22,\"remappings.txt\":2,\"src/PLEA.sol\":17,\"test/PLEA.t.sol\":293,\"test/PLEAInvariant.t.sol\":106,\"test/PLEALaunch.t.sol\":176},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true},{"durationMs":588,"exitCode":0,"name":"slither","output":"slither: no results at low impact or above","passed":true},{"durationMs":303,"exitCode":0,"name":"aderyn","output":"[low] large-numeric-literal at src/PLEA.sol:12: Large Numeric Literal","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"d2092326b31c470d104f9ce4a942c9debcb051e92261b774569219231261d3f9","verifiedTreeHash":"5c146d3fc26b2c97f5e458229c7927ea05d1af65","verifierVersion":"0.1.0+67c588fa"}]}