{"assessments":[],"deployments":[],"fuzz":[],"identity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"interpretation":"Records acceptance and evidence. Neither completion nor an AI assessment establishes correctness, safety, or independent review.","jobId":"39036790-6c53-464f-848f-fac7b2b38221","kind":"shape:chain","nodes":[{"acceptedSubmissionHash":"31a590f5409d719cd78e01bb55d77fe592ad50853595c9757f5fdb7b05b97c2e","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_economics","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"ade1bffa94d250da545f77967f6a84929397bce15a6e127239a0dc41f978c486","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_flow","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"615aef580de3a972d4493e858321546143712db0eda22dd9b21c926ae2a00edc","dependsOn":["build_contract_project","write_foundry_tests","manifest","audit_math","audit_permissions","audit_economics","audit_flow"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"af3aa01159bbf354f621cafa5c0006f6169e0938a8b015be508b7377dbf165bc","skillId":"audit-judge","tools":[]},"key":"audit_judge","kind":"code","role":"review","skillHash":"af3aa01159bbf354f621cafa5c0006f6169e0938a8b015be508b7377dbf165bc","skillId":"audit-judge","state":"accepted"},{"acceptedSubmissionHash":"fc2671802cb26472011c7b11275b12f578f01f6ca4b368130bde3b8d77f37362","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_math","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"9c3255334ef2f550d270f5a74f2575bd40214894cb4d668ee44d90990cdfb2ed","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_permissions","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"f686a3a006da4dd65fc32d886b477be6f2d2b0c7b6bc244ad1b9344e2f687c28","dependsOn":[],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"6b8d2c2ebd3301cff2be8edb1e1cc6ba65c858c02fe7247be81722b969842265","skillId":"build-contract-project","tools":[]},"key":"build_contract_project","kind":"code","role":"implement","skillHash":"6b8d2c2ebd3301cff2be8edb1e1cc6ba65c858c02fe7247be81722b969842265","skillId":"build-contract-project","state":"accepted"},{"acceptedSubmissionHash":"1e787ffa3ee0d6dd66bad75526370c8d4f821a19a63c94520c5c91281e0ba0c7","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"tools":[]},"key":"manifest","kind":"code","role":"integrate","skillHash":null,"skillId":null,"state":"accepted"},{"acceptedSubmissionHash":"c11e15eea3a1ca5065f5726335d833bfc29a1664251951fd54276321d654cd58","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"73431852439ad3a343f3d2b7db1c43cd363b9f48f9bb51497374a0cf6d50b223","skillId":"write-foundry-tests","tools":[]},"key":"write_foundry_tests","kind":"code","role":"tests","skillHash":"73431852439ad3a343f3d2b7db1c43cd363b9f48f9bb51497374a0cf6d50b223","skillId":"write-foundry-tests","state":"accepted"}],"objective":"A custom token: Cadence IMD (CADENCE).\nToken name: Cadence IMD\nToken symbol: CADENCE\nToken supply: 1,000,000,000 with 18 decimals, all minted once to the deployer in the constructor.","parentJobId":null,"planHash":"9839f4d101fbb258de237bbacb1a8c41a631f918c64bca72cf79f494b8437a31","previousHash":"0000000000000000000000000000000000000000000000000000000000000000","projectId":"39036790-6c53-464f-848f-fac7b2b38221","publication":{"commit":null,"deliveredAt":null,"repoUrl":"https://github.com/identity-md-launches/launch-1442-cadence-imd"},"receiptIdentity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"registry":"0xb6d0a187b050fa5bb0b87033a203f37becf4a775","research":[],"schema":"identitymd-work-v1","signals":[{"agentId":"52256","feedbackHash":"fe324751cb0a478543961b6e76b01d0f98819a7f5c3081ca0a62070e53b7937e","nodeKey":"audit_economics","submissionHash":"31a590f5409d719cd78e01bb55d77fe592ad50853595c9757f5fdb7b05b97c2e","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51509","feedbackHash":"658862177acf6ff8e8201dd7c8e1855ef016f06077855915d75fbb54a8112d51","nodeKey":"audit_flow","submissionHash":"ade1bffa94d250da545f77967f6a84929397bce15a6e127239a0dc41f978c486","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51345","feedbackHash":"e8a7e205ee824800507f83e806ef20259bfb6fd19aa6d436934b954ffcf8a0b0","nodeKey":"audit_judge","submissionHash":"615aef580de3a972d4493e858321546143712db0eda22dd9b21c926ae2a00edc","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51039","feedbackHash":"b2ba6106f3ebbc29d20e52605e2aeebba288c3cb10a41d50ec9a748a9c32ce97","nodeKey":"audit_math","submissionHash":"fc2671802cb26472011c7b11275b12f578f01f6ca4b368130bde3b8d77f37362","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"50976","feedbackHash":"ebbc1ada521251606cfdee893b3a0241e87e92eeb2a098b4663c956ed65200ab","nodeKey":"audit_permissions","submissionHash":"9c3255334ef2f550d270f5a74f2575bd40214894cb4d668ee44d90990cdfb2ed","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51013","feedbackHash":"9800eba473587d3e2d62a2ddc499295222ddbb4716124a815b0556cabf8d5626","nodeKey":"build_contract_project","submissionHash":"f686a3a006da4dd65fc32d886b477be6f2d2b0c7b6bc244ad1b9344e2f687c28","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"51011","feedbackHash":"b82b5f0bd2b07faab893e6c2004512b44489811e690be6dcb1095b095675ec32","nodeKey":"manifest","submissionHash":"1e787ffa3ee0d6dd66bad75526370c8d4f821a19a63c94520c5c91281e0ba0c7","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"52185","feedbackHash":"b8a8593d871098c195bf4f9636b55ea8d72d356c88b312b78d17fe58894b33f2","nodeKey":"write_foundry_tests","submissionHash":"c11e15eea3a1ca5065f5726335d833bfc29a1664251951fd54276321d654cd58","tag1":"verification:checks","tag2":"acceptance-v2","value":1}],"site":null,"snapshotHash":"452d8e174e1d1a357fd577b5e1399cb5690ac7cd7f0ad7ff82cadf1943417a96","state":"completed","submissions":[{"artifacts":[],"attempt":1,"bundleHash":"b06da611ee47aecaf4d3e048e7980cd2552c1f2caf2a9eeca7f84e0912eee94b","device":"20c10dbba93106ff","findings":[],"hash":"1e787ffa3ee0d6dd66bad75526370c8d4f821a19a63c94520c5c91281e0ba0c7","nodeId":"1fd74856-9cd8-4e2a-adbd-def42e50ef1e","outcome":"completed","summary":"Created `launch.json` matching `CadenceToken`, its empty constructor arguments, exact supply, and prescribed pool and economics.\n\nManifest checks and `forge build` passed. `forge test`: 26 passed, 0 failed.\n\nOnly `launch.json` is a submission change.","treeHash":"cd053556d35ad06bf61e02ac9e344d39753541bf","usage":{"cachedInputTokens":127744,"inputTokens":32593,"model":"gpt-6-astra","outputTokens":2247,"runtime":"codex","turns":3,"wallClockMs":71558}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"72f49cf84b9ab056","findings":[{"citation":"resolved","description":"DEPENDENCIES.md states the vendored files are unmodified and tells a reviewer to verify them with `sha256sum -c lib/SHA256SUMS`. Running that command on the committed tree reports 7 FAILED entries: lib/forge-std/src/StdAssertions.sol, StdJson.sol, StdToml.sol, Vm.sol, console.sol, interfaces/IERC7540.sol and interfaces/IMulticall3.sol. I fetched forge-std v1.9.7 from upstream and compared: every difference is whitespace/line-wrapping only (the files appear to have been re-formatted by `forge fmt` after the hashes were recorded), so no test-library semantics changed, and the five vendored OpenZeppelin v5.0.2 files (ERC20.sol, IERC20.sol, IERC20Metadata.sol, Context.sol, draft-IERC6093.sol) are byte-identical to upstream, so the deployed token code is the stock implementation. The defect is that the repository's own integrity claim is false and its documented verification step fails, which an offline verifier or a later contributor following DEPENDENCIES.md will read as tampering. This is outside the assigned economics area and has no effect on CadenceToken's deployed behaviour; it is reported because it is cheap to reproduce and concrete. Minimal fix: regenerate lib/SHA256SUMS from the committed files (or restore the 7 files to their upstream byte content) and keep the DEPENDENCIES.md statement accurate; `forge fmt` should be excluded from lib/ so the hashes stay stable.","line":5,"path":"DEPENDENCIES.md","reproduction":"From the repository root run `sha256sum -c lib/SHA256SUMS`. Expected (per DEPENDENCIES.md line 5 and line 22): every line `OK`. Actual: 29 OK, then `lib/forge-std/src/StdAssertions.sol: FAILED`, `lib/forge-std/src/StdJson.sol: FAILED`, `lib/forge-std/src/StdToml.sol: FAILED`, `lib/forge-std/src/Vm.sol: FAILED`, `lib/forge-std/src/console.sol: FAILED`, `lib/forge-std/src/interfaces/IERC7540.sol: FAILED`, `lib/forge-std/src/interfaces/IMulticall3.sol: FAILED`, `sha256sum: WARNING: 7 computed checksums did NOT match`, exit status 1. Cross-check: `diff -w` of each failing file against https://raw.githubusercontent.com/foundry-rs/forge-std/v1.9.7/src/<file> is empty (whitespace-only drift); the OpenZeppelin files under lib/openzeppelin-contracts/contracts are byte-identical to the v5.0.2 tag.","severity":"low","snippet":"Only the listed source subsets were copied; their contents are unmodified.","title":"Vendored dependency integrity manifest does not match the tree: documented `sha256sum -c lib/SHA256SUMS` check fails for 7 forge-std files"}],"hash":"31a590f5409d719cd78e01bb55d77fe592ad50853595c9757f5fdb7b05b97c2e","nodeId":"9467e41d-2dae-4d5d-883f-4feeab1b11fe","outcome":"completed","summary":"The review is complete and the findings file is written. The working tree is clean apart from the gitignored findings file.\n\n**Result:** the token holds under all three assigned guides. CadenceToken is the stock OpenZeppelin v5.0.2 ERC-20 with a single constructor mint, and I verified the vendored ERC-20 sources are byte-identical to the upstream tag. There are no external dependencies, no transfer taxes, no privileged roles, and no exposed mint or burn, so none of the Economic Security, Invariant, or Flow Gap failure modes apply. I reproduced the launch flows the floor demands against a sync/settle delta stub and they move exact amounts. The project's own 26 tests, including the stateful invariant suite, pass.\n\n**One low finding, outside my area:** the vendored dependency integrity manifest is wrong. DEPENDENCIES.md claims the vendored files are unmodified and tells reviewers to verify them with a checksum command, but that command fails on seven forge-std files. The differences are whitespace-only reformatting against upstream v1.9.7, so the test library's semantics are unchanged and no deployed code is affected. The fix is to regenerate the checksum file from the committed tree.\n\n**Coverage recorded** for all three entry points as `holds`, plus four invariant rows covering supply fixity, constructor behaviour, bytecode opcode scan, and dependency checks.\n\nTwo items I could not verify from inside the tree and leave as open notes rather than findings: the README states the launch chain is Ethereum mainnet, which nothing in the task confirms, and no launch.json exists yet, so the manifest's empty constructorArgs and totalSupply of 10^27 remain for the manifest step to get right.","treeHash":null,"usage":{"cachedInputTokens":645411,"inputTokens":290,"model":"claude-fable-5-1","outputTokens":15692,"runtime":"claude","turns":27,"wallClockMs":207858}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"fba19b641cdd6f27","findings":[{"citation":"resolved","description":"DEPENDENCIES.md line 5 states every vendored file is unmodified and line 22 directs a verifier to confirm this with `sha256sum -c lib/SHA256SUMS`. On the committed tree that command reports 7 FAILED entries, all under lib/forge-std/src: StdAssertions.sol, StdJson.sol, StdToml.sol, Vm.sol, console.sol, interfaces/IERC7540.sol and interfaces/IMulticall3.sol. I reproduced this and then compared against the upstream forge-std v1.9.7 archive (sha256 45157353ab49eab01d294565866731e599b32401757229689ee459aa26b7ee94, matching DEPENDENCIES.md line 16): with all whitespace stripped, each of the 7 local files hashes identically to its upstream copy, and `diff` shows only `forge fmt` line re-wrapping (e.g. the multi-line `assertApproxEqAbs(uint256,uint256,uint256,string)` signature collapsed to one line). The lib/SHA256SUMS entries are the genuine upstream hashes; the files were re-formatted after the list was recorded. The five vendored OpenZeppelin v5.0.2 files that CadenceToken actually compiles against (ERC20.sol, IERC20.sol, IERC20Metadata.sol, Context.sol, draft-IERC6093.sol) are byte-identical to the v5.0.2 archive (sha256 18c7b7e949b9a82dcd8cd394426c9c2636dfc263aa2317d4749dbfa0c7b3925a) and their hashes verify, so the deployed token code is the stock implementation and no bytecode or test semantics are affected. The defect is that the repository's own provenance claim is false and its own verification command exits non-zero: an offline verifier or later contributor following DEPENDENCIES.md cannot distinguish a formatter pass from a tampered test library without re-fetching upstream, which is exactly what the hash list exists to prevent. All four specialists (economics, permissions, flow, math) reported this same root cause; it is one finding. Minimal fix: either restore the 7 forge-std files byte-exact from the v1.9.7 archive and exclude lib/ from `forge fmt`, or regenerate lib/SHA256SUMS from the files as committed and reword line 5 of DEPENDENCIES.md to say the forge-std files were reformatted but are otherwise unchanged.","line":5,"path":"DEPENDENCIES.md","reproduction":"State: the committed tree at HEAD (5f3f038), no network needed. Input: from the repository root run `sha256sum -c lib/SHA256SUMS`. Expected (per DEPENDENCIES.md lines 5 and 19-23): 36 lines of `OK`, exit status 0. Actual: 29 `OK`, then `lib/forge-std/src/StdAssertions.sol: FAILED`, `lib/forge-std/src/StdJson.sol: FAILED`, `lib/forge-std/src/StdToml.sol: FAILED`, `lib/forge-std/src/Vm.sol: FAILED`, `lib/forge-std/src/console.sol: FAILED`, `lib/forge-std/src/interfaces/IERC7540.sol: FAILED`, `lib/forge-std/src/interfaces/IMulticall3.sol: FAILED`, `sha256sum: WARNING: 7 computed checksums did NOT match`, exit status 1. Cross-check (needs network): download https://codeload.github.com/foundry-rs/forge-std/tar.gz/refs/tags/v1.9.7 (sha256 45157353ab49eab01d294565866731e599b32401757229689ee459aa26b7ee94), then for each of the 7 files `tr -d ' \\t\\r\\n' < upstream | sha256sum` equals the same over the local file, while `diff` shows only line re-wrapping; `cmp` of each OpenZeppelin file under lib/openzeppelin-contracts/contracts against the v5.0.2 archive reports no difference.","severity":"low","snippet":"Only the listed source subsets were copied; their contents are unmodified.","title":"Vendored forge-std files do not match lib/SHA256SUMS, so the documented integrity check `sha256sum -c lib/SHA256SUMS` fails on the committed tree (merged from all four specialists)"}],"hash":"615aef580de3a972d4493e858321546143712db0eda22dd9b21c926ae2a00edc","nodeId":"f9027801-80e9-48b0-92fe-2c8958d8f447","outcome":"completed","summary":"The review is complete and `.imd-findings.json` is written with one merged finding and a full coverage record. No files other than the findings output were changed.\n\n**Outcome.** The token is a stock OpenZeppelin v5.0.2 ERC-20 with a single constructor mint, and it has no code defects. All four specialists reported the same root cause, which I reproduced and merged into one low-severity finding.\n\n**The one finding, low severity.** The documented integrity check in DEPENDENCIES.md fails on the committed tree. Running `sha256sum -c lib/SHA256SUMS` reports seven forge-std files as FAILED. I downloaded the upstream v1.9.7 archive, whose hash matches the one recorded in the repository, and confirmed the drift is whitespace-only: with whitespace stripped, every local file hashes identically to upstream, and the diff shows only `forge fmt` line re-wrapping. The five OpenZeppelin files the token compiles against are byte-identical to the v5.0.2 archive, so the deployed bytecode is the stock implementation. The defect is a false provenance claim and a failing verification step, not a behavioural one. The fix is to restore the seven files byte-exact and exclude lib from formatting, or regenerate the hash list and reword the \"unmodified\" claim.\n\n**Coverage.** All three entry points hold:\n\n- `approve`, `transfer` and `transferFrom` are unmodified OpenZeppelin code with the expected zero-address, balance and allowance reverts, no fees, hooks or exemptions, so the swarm, seed and swap flows move exactly the stated amounts.\n- The constructor mints exactly 10^27 units to msg.sender, matching the manifest's totalSupply, and the ABI exposes no mint, burn, owner or pause function.\n- The constructor takes no arguments, matching the manifest's empty constructorArgs, and creation and runtime code are far under the size limits with no DELEGATECALL, CALLCODE or SELFDESTRUCT.\n\nThe project's own 45 tests, including the 128-run stateful invariant suite, pass. No proof file was needed since nothing reaches high or critical severity.","treeHash":null,"usage":{"cachedInputTokens":390185,"inputTokens":194,"model":"claude-fable-5-1","outputTokens":7975,"runtime":"claude","turns":14,"wallClockMs":183161}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"9b06782c7559b54c","findings":[{"citation":"resolved","description":"DEPENDENCIES.md line 5 states the vendored files' \"contents are unmodified\" and line 22 gives `sha256sum -c lib/SHA256SUMS` as the integrity check. Running that check on the committed tree fails for 7 of the forge-std files (StdAssertions.sol, StdJson.sol, StdToml.sol, Vm.sol, console.sol, interfaces/IERC7540.sol, interfaces/IMulticall3.sol). The recorded hashes are the genuine upstream forge-std v1.9.7 hashes (verified against the v1.9.7 codeload tarball, whose SHA-256 45157353... matches DEPENDENCIES.md), but the committed files were re-wrapped (apparently by `forge fmt`, since `forge fmt --check` passes while the upstream files would not). The differences are whitespace-only: stripping all whitespace from each pair yields identical content, so test behaviour is unaffected and this is outside the assigned Access Control / Trust Gap / Asymmetry area. It is reported because the repository's own provenance claim and its own integrity command disagree with the tree, which is the kind of trust evidence a reviewer or the verifier relies on. The production dependency (OpenZeppelin ERC20.sol, IERC20.sol, IERC20Metadata.sol, Context.sol, draft-IERC6093.sol) is byte-identical to upstream v5.0.2 and its hashes verify. Minimal fix: either restore the 7 forge-std files byte-exact from the v1.9.7 tarball (and exclude lib/ from fmt), or regenerate lib/SHA256SUMS from the committed files and drop the \"unmodified\" wording.","line":5,"path":"lib/SHA256SUMS","reproduction":"State: the committed tree at HEAD a2d7e02. Input: run `sha256sum -c lib/SHA256SUMS` from the repository root. Expected (per DEPENDENCIES.md): every line reports OK. Actual: 29 OK and 7 FAILED (`lib/forge-std/src/StdAssertions.sol: FAILED`, `StdJson.sol: FAILED`, `StdToml.sol: FAILED`, `Vm.sol: FAILED`, `console.sol: FAILED`, `interfaces/IERC7540.sol: FAILED`, `interfaces/IMulticall3.sol: FAILED`), exit status 1. Cross-check: `sha256sum lib/forge-std/src/StdAssertions.sol` prints 3fbf4a025b4fc94eaca4c38c1f3dacb37bee10f12ee81994cfaf365ac1ce7384, while the upstream v1.9.7 file prints d4c89eec... as recorded; `diff` between them shows only line-wrapping changes (e.g. the multi-line `assertApproxEqAbs(uint256,uint256,uint256,string)` signature collapsed to one line).","severity":"low","snippet":"d4c89eec70d267dec6188461fbc74d3dc8c47e518d176a23417533a232ed9780  lib/forge-std/src/StdAssertions.sol","title":"Vendored forge-std hashes in lib/SHA256SUMS do not match the committed files; the documented provenance check fails"}],"hash":"9c3255334ef2f550d270f5a74f2575bd40214894cb4d668ee44d90990cdfb2ed","nodeId":"e4b01b8e-1b97-41c4-a064-734ebc23834c","outcome":"completed","summary":"The review is complete and `.imd-findings.json` is written. Nothing else is needed.\n\n**Result: the Cadence IMD token holds in the assigned area.** No Access Control, Trust Gap or Asymmetry defect was found. One low finding outside the area was recorded.\n\n**What was checked**\n\n- **Access control.** `src/CadenceToken.sol` is OpenZeppelin v5.0.2 ERC20 with a single constructor mint to `msg.sender`. The compiled ABI exposes exactly three state-changing functions: approve, transfer, transferFrom. There is no owner, initializer, minter, pauser, blacklist, receive or fallback. Under a CREATE2 factory the whole supply lands on the factory, not on the factory's caller or the transaction origin. The deployer has no allowance bypass over other holders.\n- **Trust gap.** No privileged actor, pricing formula or caller-class branch exists, so no access-times-economics or access-times-asymmetry seam can be built.\n- **Asymmetry.** transfer and transferFrom share the same `_update` path and move identical amounts under fuzzing. Self-transfers, zero amounts, zero-address recipient and zero-address spender behave symmetrically. The missing Approval event on transferFrom is OpenZeppelin v5 behaviour and is documented in the README.\n- **Launch floor.** Supply is fixed at 1e27 with 18 decimals, no path reaches `_mint` or `_burn`, and a corrected opcode scan of the runtime bytecode shows no DELEGATECALL, CALLCODE, SELFDESTRUCT, CREATE or CREATE2. The existing 26 tests and 5 scratch tests I wrote all pass. Scratch files were removed.\n\n**The one finding (low, outside area).** The repository documents `sha256sum -c lib/SHA256SUMS` as its provenance check and claims the vendored files are unmodified. The check fails for 7 forge-std files. The recorded hashes are the genuine upstream v1.9.7 hashes, but the committed files were re-wrapped by the formatter. The differences are whitespace only, so test behaviour is unaffected. The production OpenZeppelin files are byte-identical to upstream v5.0.2.\n\n**Coverage.** All three listed entry points are marked `holds`, plus rows for the constructor roles, the fixed-supply invariant, the no-privileged-hand invariant, trust-gap seams, and dependency integrity. The protected Uniswap v4 integration test could not be run locally because it needs v4-core and the launch environment variables.","treeHash":null,"usage":{"cachedInputTokens":856837,"inputTokens":354,"model":"claude-fable-5-1","outputTokens":17022,"runtime":"claude","turns":30,"wallClockMs":280665}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"74a99f640688d37b","findings":[{"citation":"resolved","description":"DEPENDENCIES.md states the vendored files are unmodified and README.md directs a verifier to confirm that with `sha256sum -c lib/SHA256SUMS`. Seven forge-std files (src/StdAssertions.sol, src/StdJson.sol, src/StdToml.sol, src/Vm.sol, src/console.sol, src/interfaces/IERC7540.sol, src/interfaces/IMulticall3.sol) were reformatted (forge fmt line re-wrapping) after lib/SHA256SUMS was recorded, so the recorded hashes are stale and the check reports 7 FAILED entries. I confirmed by downloading the upstream forge-std v1.9.7 archive (its SHA-256 matches the one recorded in DEPENDENCIES.md) that the differences are whitespace only, and that every vendored OpenZeppelin v5.0.2 file (ERC20.sol, IERC20.sol, IERC20Metadata.sol, Context.sol, draft-IERC6093.sol, LICENSE) is byte-identical to upstream. The production dependency is therefore sound; the defect is that the shipped provenance record is wrong and the repository's own verification step fails, which an offline verifier cannot distinguish from a tampered library without network access. Fix: regenerate lib/SHA256SUMS from the files as committed (or restore the upstream byte-exact forge-std files), and reword DEPENDENCIES.md if reformatting is intended.","line":5,"path":"DEPENDENCIES.md","reproduction":"From the repository root run `sha256sum -c lib/SHA256SUMS`. Expected (per DEPENDENCIES.md line 5 and README.md lines 19-24): every line `OK`, exit status 0. Actual: `lib/forge-std/src/StdAssertions.sol: FAILED`, `lib/forge-std/src/StdJson.sol: FAILED`, `lib/forge-std/src/StdToml.sol: FAILED`, `lib/forge-std/src/Vm.sol: FAILED`, `lib/forge-std/src/console.sol: FAILED`, `lib/forge-std/src/interfaces/IERC7540.sol: FAILED`, `lib/forge-std/src/interfaces/IMulticall3.sol: FAILED`, `sha256sum: WARNING: 7 computed checksums did NOT match`, exit status 1. Recorded hash for StdAssertions.sol is d4c89eec70d267dec6188461fbc74d3dc8c47e518d176a23417533a232ed9780; the file as committed hashes differently. Diffing against upstream v1.9.7 (archive sha256 45157353ab49eab01d294565866731e599b32401757229689ee459aa26b7ee94) with whitespace stripped shows identical content, so the change is formatting only.","severity":"low","snippet":"Only the listed source subsets were copied; their contents are unmodified.","title":"Vendored forge-std files no longer match lib/SHA256SUMS, so the documented integrity check fails"}],"hash":"ade1bffa94d250da545f77967f6a84929397bce15a6e127239a0dc41f978c486","nodeId":"3a566d17-3d8a-4654-b278-fafd9fd4baae","outcome":"completed","summary":"The review is complete and `.imd-findings.json` is written with one substantiated finding and full coverage.\n\n**Outcome.** The token is correct for its brief. `CadenceToken` is a three-line wrapper over an unmodified OpenZeppelin v5.0.2 ERC-20 that mints exactly 1e27 units to the deployer once. I found no defect in the contract itself.\n\n**What I checked, in my area.**\n- Execution Trace: traced approve, transfer and transferFrom through `_approve`, `_spendAllowance`, `_transfer` and `_update`. Allowance is spent before the balance moves, so any failure rolls both back. Max allowance stays fixed, a zero `from` reverts on every amount, and a spender cannot exceed its allowance across calls. The standard ERC-20 approve race exists and is documented in the README.\n- Periphery: every vendored OpenZeppelin file is byte-identical to the upstream v5.0.2 archive, whose SHA-256 matches the one recorded in `DEPENDENCIES.md`. `_msgSender` is plain `msg.sender`, so there is no forwarder path.\n- First Principles: the constructor takes no arguments and makes no external calls. Deployed by CREATE2 from a factory, the factory holds 100% and neither the caller nor the transaction origin holds anything. The ABI exposes only the nine ERC-20 functions, and unknown selectors and plain ETH revert. A scratch test replicating the protected floor's opcode scan finds no DELEGATECALL, CALLCODE or SELFDESTRUCT in the compiled runtime.\n- Static-analysis lead: the large literal at line 11 evaluates to exactly 1e27 and is not a defect.\n\n**The one finding, low severity.** Seven vendored forge-std files were reformatted after `lib/SHA256SUMS` was recorded, so the integrity check the README prescribes fails:\n\n```\nsha256sum -c lib/SHA256SUMS\n...\nsha256sum: WARNING: 7 computed checksums did NOT match\n```\n\nI verified against the upstream v1.9.7 archive that the differences are whitespace only, so the test dependency is sound. The defect is that the shipped provenance record contradicts the claim in `DEPENDENCIES.md` that the vendored contents are unmodified, and an offline verifier cannot tell that from tampering. Regenerating the checksum file fixes it.\n\n**Verification run.** Build succeeds, the existing 26 tests and the stateful invariant pass, `forge fmt --check` passes, and my seven scratch tests pass. The working tree is unchanged apart from ignored paths.","treeHash":null,"usage":{"cachedInputTokens":682045,"inputTokens":290,"model":"claude-fable-5-1","outputTokens":15620,"runtime":"claude","turns":27,"wallClockMs":218657}},{"artifacts":[],"attempt":1,"bundleHash":"a9ea28c33aaa6d2bb62a5748923103d03e96321fa93498294fb05d68636200d1","device":"2c985fa233fefc9e","findings":[],"hash":"c11e15eea3a1ca5065f5726335d833bfc29a1664251951fd54276321d654cd58","nodeId":"5d965ad1-3cce-4daf-9012-d0742dbad019","outcome":"completed","summary":"Added 19 failure-path and fuzz tests, and expanded stateful invariants across four actors.\n\nOffline `forge build` and `forge test` passed: 45 tests, including 32,768 invariant calls.\n\nOnly two files under `test/` changed. No implementation defects were found.","treeHash":"5334b2b8b9e5a6f6e2f3566d9bceca1c10b4b6e7","usage":{"cachedInputTokens":1161984,"inputTokens":85854,"model":"gpt-6-astra","outputTokens":15780,"runtime":"codex","turns":7,"wallClockMs":553667}},{"artifacts":[],"attempt":1,"bundleHash":"078cf43013aba1641a2e7ffedee6510908ef0f7b68a5774e85cd324eadd96999","device":"84a29c6575331b77","findings":[],"hash":"f686a3a006da4dd65fc32d886b477be6f2d2b0c7b6bc244ad1b9344e2f687c28","nodeId":"11a63074-1c9d-4502-9f9d-a7fb1a91454d","outcome":"completed","summary":"Implemented Cadence IMD (CADENCE): 1,000,000,000 tokens, 18 decimals, minted once to the deployer.\n\nIncluded vendored dependencies, deployment documentation, and success, failure, fuzz, and invariant tests.\n\nVerified:\n- `forge build` passes.\n- `forge test` passes all 26 tests.\n- `forge fmt --check` passes.","treeHash":"423f94e200db25d537afef6b234da6c2a013668a","usage":{"cachedInputTokens":378368,"inputTokens":58415,"model":"gpt-6-astra","outputTokens":12571,"runtime":"codex","turns":4,"wallClockMs":355713}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"9ab27edcfd62be02","findings":[{"citation":"resolved","description":"Outside my assigned area (math), reported because it is reproducible and breaks a verification step the project itself documents. DEPENDENCIES.md states the vendored files are unmodified and tells the reader to confirm that with `sha256sum -c lib/SHA256SUMS`. Seven forge-std v1.9.7 files in the tree (src/StdAssertions.sol, src/StdJson.sol, src/StdToml.sol, src/Vm.sol, src/console.sol, src/interfaces/IERC7540.sol, src/interfaces/IMulticall3.sol) have been re-formatted after the hashes were recorded: `forge fmt --check` passes on the local copies but fails on the pristine upstream copies, and after stripping all whitespace the local and upstream contents hash identically, so the change is whitespace only. lib/SHA256SUMS records the upstream (pre-format) hashes, which now fail. All OpenZeppelin v5.0.2 files, including the ERC20.sol the token inherits, are byte-identical to upstream and pass. No deployed bytecode is affected; forge-std is test-only. The defect is that the provenance record is wrong: a reviewer following the documented check gets 7 FAILED lines and cannot tell a formatter pass from a substantive edit without re-fetching upstream, which is exactly the situation the hash list exists to prevent.","line":5,"path":"DEPENDENCIES.md","reproduction":"From the repository root run `sha256sum -c lib/SHA256SUMS`. Expected (per DEPENDENCIES.md line 5 and lines 19-23): every line reports OK. Actual: `lib/forge-std/src/StdAssertions.sol: FAILED`, `lib/forge-std/src/StdJson.sol: FAILED`, `lib/forge-std/src/StdToml.sol: FAILED`, `lib/forge-std/src/Vm.sol: FAILED`, `lib/forge-std/src/console.sol: FAILED`, `lib/forge-std/src/interfaces/IERC7540.sol: FAILED`, `lib/forge-std/src/interfaces/IMulticall3.sol: FAILED`, `sha256sum: WARNING: 7 computed checksums did NOT match`. Cross-check: the upstream archive https://codeload.github.com/foundry-rs/forge-std/tar.gz/refs/tags/v1.9.7 hashes to 45157353ab49eab01d294565866731e599b32401757229689ee459aa26b7ee94 as DEPENDENCIES.md records, and its src/console.sol has sha256 896c5a5a5c23..., the value in lib/SHA256SUMS, while the tree's lib/forge-std/src/console.sol hashes to a2e632dcbc78.... Fix: either restore the seven upstream files byte-for-byte (and exclude lib/ from forge fmt, e.g. via a `[fmt] ignore` entry or by not formatting lib/), or regenerate lib/SHA256SUMS from the tree and reword DEPENDENCIES.md to say the files were reformatted but are otherwise unmodified.","severity":"low","snippet":"Only the listed source subsets were copied; their contents are unmodified.","title":"Vendored forge-std files no longer match lib/SHA256SUMS or the 'unmodified' claim; the documented hash check fails"}],"hash":"fc2671802cb26472011c7b11275b12f578f01f6ca4b368130bde3b8d77f37362","nodeId":"4145a3ea-ea4b-4f6b-9dd6-5bf7b0798b5e","outcome":"completed","summary":"The review is complete and the findings file is written and valid.\n\n**Result for the assigned area (Math Precision, Boundary, Numerical Gap): clean.** The token is the unmodified OpenZeppelin v5.0.2 ERC-20 with one constructor mint. There is no division, no downcast, no external call, no payable path and no bytes decoding anywhere in the token or its inherited code, so most of the three checklists have nothing to attach to. The items that do apply were traced and exercised:\n\n- **Supply literal.** The aderyn lead on line 11 is a compile-time constant equal to exactly 1e27, which is one billion whole tokens at 18 decimals. Not a defect.\n- **Arithmetic in the inherited code.** Every unchecked block in the transfer path is preceded by a guard, and all balances are bounded by the fixed supply. Full-supply, supply-plus-one and max-uint transfers behave exactly as specified.\n- **Boundary inputs.** Zero amounts, self-transfers, the zero-address sender and receiver, exact-allowance spends, and the infinite-allowance sentinel at max and max-minus-one were all exercised in a scratch test. All nine evidence tests pass, alongside the project's existing 26.\n- **Launch arithmetic.** The supply divides exactly into the 10/80/10 basis-point shares, and the token has no fee or hook, so the factory flows move exact amounts.\n- **Runtime bytecode.** The same opcode scan the protected floor runs found no DELEGATECALL, CALLCODE or SELFDESTRUCT.\n\n**One low finding, outside my area.** Seven vendored forge-std files were reformatted after their hashes were recorded, so the documented check `sha256sum -c lib/SHA256SUMS` fails and the claim in DEPENDENCIES.md that the files are unmodified is no longer true. I fetched both upstream archives: their hashes match DEPENDENCIES.md, every OpenZeppelin file is byte-identical to upstream, and the seven forge-std files differ only in whitespace. This touches test tooling only and not the deployed bytecode. The fix is to either restore the upstream bytes and keep the formatter off lib, or regenerate the hash list and correct the wording.\n\n**Coverage.** All three listed entry points are recorded as holds, with six additional rows for the invariants and provenance checks above. The findings file validates as JSON and the working tree is otherwise unchanged, with the scratch test living in the ignored scratch directory.","treeHash":null,"usage":{"cachedInputTokens":674891,"inputTokens":290,"model":"claude-fable-5-1","outputTokens":16663,"runtime":"claude","turns":25,"wallClockMs":236170}}],"verification":[{"checks":[{"durationMs":1153,"exitCode":0,"name":"build","output":"Compiling 27 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.06s\nCompiler run successful!\n","passed":true},{"durationMs":2127,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 25 tests for test/CadenceToken.t.sol:CadenceTokenTest\n[PASS] testAllowanceCanBeReplacedAndRevoked() (gas: 176919)\n[PASS] testApproveEmitsEventWithoutMovingFunds() (gas: 88821)\n[PASS] testApproveZeroSpenderReverts() (gas: 37575)\n[PASS] testConstructorEmitsExactlyOneMint() (gas: 9718)\n[PASS] testCreate2FactoryReceivesSupplyAndDistributesExactAmounts() (gas: 660021)\n[PASS] testDeployerCannotSpendHolderFundsWithoutApproval() (gas: 158016)\n[PASS] testFuzzDelegatedTransfersConsumeOnlyTheirAllowance(uint256,uint256) (runs: 512, μ: 162516, ~: 164790)\nLogs:\n  Bound result 1344944672304303\n  Bound result 1299246517490590\n\n[PASS] testFuzzOverspendingReverts(uint256) (runs: 512, μ: 69057, ~: 69418)\nLogs:\n  Bound result 115792089237316195423570985008687907853269984665639564039483596689797717446068\n\n[PASS] testFuzzTransfersConserveSupply(uint256) (runs: 512, μ: 189397, ~: 190071)\nLogs:\n  Bound result 12\n\n[PASS] testInfiniteAllowanceIsNotDecremented() (gas: 139332)\n[PASS] testMetadataAndEntireSupplyBelongToDeployer() (gas: 99395)\n[PASS] testNativeCurrencyTransferIsRejected() (gas: 42663)\n[PASS] testNoPostDeploymentMintBurnOrAdministrativeEntryPoints() (gas: 1121525)\n[PASS] testSelfTransferPreservesBalance() (gas: 51420)\n[PASS] testTransferFromInsufficientBalanceRollsBackAllowance() (gas: 126194)\n[PASS] testTransferFromRejectsInsufficientAllowanceWithoutChangingState() (gas: 115701)\n[PASS] testTransferFromRejectsUnapprovedSpender() (gas: 117675)\n[PASS] testTransferFromSpendsAllowanceAndEmitsTransfer() (gas: 242079)\n[PASS] testTransferFromToSelfConsumesAllowanceWithoutMovingBalance() (gas: 107710)\n[PASS] testTransferFromZeroRecipientRollsBackAllowance() (gas: 114155)\n[PASS] testTransferFullBalanceEmitsEvent() (gas: 88628)\n[PASS] testTransferRevertsWithInsufficientBalance() (gas: 67648)\n[PASS] testTransferToZeroRevertsEvenForZeroAmount() (gas: 82351)\n[PASS] testZeroTransferFromEmptyAccountEmitsEvent() (gas: 73355)\n[PASS] testZeroTransferFromNeedsNoAllowance() (gas: 81491)\nSuite result: ok. 25 passed; 0 failed; 0 skipped; finished in 12.29ms (36.12ms CPU time)\n\nRan 1 test for test/CadenceToken.invariant.t.sol:CadenceTokenInvariantTest\n[PASS] invariantSupplyBalancesAndAllowancesMatchModel() (runs: 128, calls: 8192, reverts: 0)\n\n╭----------------+--------------+-------+---------+----------╮\n| Contract       | Selector     | Calls | Reverts | Discards |\n+============================================================+\n| CadenceHandler | approve      | 2664  | 0       | 0        |\n|----------------+--------------+-------+---------+----------|\n| CadenceHandler | transfer     | 2726  | 0       | 0        |\n|----------------+--------------+-------+---------+----------|\n| CadenceHandler | transferFrom | 2802  | 0       | 0        |\n╰----------------+--------------+-------+---------+----------╯\n\nLogs:\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 773435946\n  Bound result 30000000000000000000\n  Bound result 232\n  Bound result 0\n  Bound result 5108597\n  Bound result 11000000000000000000\n  Bound result 0\n  Bound result 1088\n  Bound result 1111395\n  Bound result 0\n  Bound result 2409106\n  Bound result 1581846317\n  Bound result 8\n  Bound result 946121633\n  Bound result 0\n  Bound result 71593417884711893805525910\n  Bound result 690\n  Bound result 12\n  Bound result 18\n  Bound result 2\n  Bound result 802992\n  Bound result 392064\n  Bound result 6\n  Bound result 48\n  Bound result 30\n  Bound result 0\n  Bound result 442441\n  Bound result 0\n  Bound result 4679\n  Bound result 617537833102858695928304987\n  Bound result 0\n  Bound result 11\n  Bound result 0\n  Bound result 0\n  Bound result 8\n  Bound result 0\n  Bound result 0\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 2.05s (2.05s CPU time)\n\nRan 2 test suites in 2.05s (2.06s CPU time): 26 tests passed, 0 failed, 0 skipped (26 total tests)\n","passed":true},{"durationMs":38,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"CadenceToken.approve(address,uint256)\",\"CadenceToken.transfer(address,uint256)\",\"CadenceToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"DEPENDENCIES.md\":23,\"README.md\":107,\"foundry.toml\":18,\"launch.json\":24,\"remappings.txt\":2,\"src/CadenceToken.sol\":13,\"test/CadenceToken.invariant.t.sol\":94,\"test/CadenceToken.t.sol\":341},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"1e787ffa3ee0d6dd66bad75526370c8d4f821a19a63c94520c5c91281e0ba0c7","verifiedTreeHash":"cd053556d35ad06bf61e02ac9e344d39753541bf","verifierVersion":"0.1.0+fb8278c5"},{"checks":[{"durationMs":1416,"exitCode":0,"name":"build","output":"Compiling 28 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.30s\nCompiler run successful!\n","passed":true},{"durationMs":8470,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 25 tests for test/CadenceToken.t.sol:CadenceTokenTest\n[PASS] testAllowanceCanBeReplacedAndRevoked() (gas: 176919)\n[PASS] testApproveEmitsEventWithoutMovingFunds() (gas: 88821)\n[PASS] testApproveZeroSpenderReverts() (gas: 37575)\n[PASS] testConstructorEmitsExactlyOneMint() (gas: 9718)\n[PASS] testCreate2FactoryReceivesSupplyAndDistributesExactAmounts() (gas: 660021)\n[PASS] testDeployerCannotSpendHolderFundsWithoutApproval() (gas: 158016)\n[PASS] testFuzzDelegatedTransfersConsumeOnlyTheirAllowance(uint256,uint256) (runs: 512, μ: 162130, ~: 164828)\nLogs:\n  Bound result 6644014508228260344\n  Bound result 6078213955180683\n\n[PASS] testFuzzOverspendingReverts(uint256) (runs: 512, μ: 69067, ~: 69418)\nLogs:\n  Bound result 115792089237316195423570985008687907853269984665639564039457584009500221234180\n\n[PASS] testFuzzTransfersConserveSupply(uint256) (runs: 512, μ: 189834, ~: 190071)\nLogs:\n  Bound result 684805986126686514259918008\n\n[PASS] testInfiniteAllowanceIsNotDecremented() (gas: 139332)\n[PASS] testMetadataAndEntireSupplyBelongToDeployer() (gas: 99395)\n[PASS] testNativeCurrencyTransferIsRejected() (gas: 42663)\n[PASS] testNoPostDeploymentMintBurnOrAdministrativeEntryPoints() (gas: 1121525)\n[PASS] testSelfTransferPreservesBalance() (gas: 51420)\n[PASS] testTransferFromInsufficientBalanceRollsBackAllowance() (gas: 126194)\n[PASS] testTransferFromRejectsInsufficientAllowanceWithoutChangingState() (gas: 115701)\n[PASS] testTransferFromRejectsUnapprovedSpender() (gas: 117675)\n[PASS] testTransferFromSpendsAllowanceAndEmitsTransfer() (gas: 242079)\n[PASS] testTransferFromToSelfConsumesAllowanceWithoutMovingBalance() (gas: 107710)\n[PASS] testTransferFromZeroRecipientRollsBackAllowance() (gas: 114155)\n[PASS] testTransferFullBalanceEmitsEvent() (gas: 88628)\n[PASS] testTransferRevertsWithInsufficientBalance() (gas: 67648)\n[PASS] testTransferToZeroRevertsEvenForZeroAmount() (gas: 82351)\n[PASS] testZeroTransferFromEmptyAccountEmitsEvent() (gas: 73355)\n[PASS] testZeroTransferFromNeedsNoAllowance() (gas: 81491)\nSuite result: ok. 25 passed; 0 failed; 0 skipped; finished in 101.54ms (302.19ms CPU time)\n\nRan 19 tests for test/CadenceToken.adversarial.t.sol:CadenceTokenAdversarialTest\n[PASS] testAllowanceJustBelowMaximumIsFinite() (gas: 301118)\n[PASS] testApprovalRemainsUsableAfterBalanceFailure() (gas: 318928)\n[PASS] testDirectDeploymentMintsToSenderRatherThanOrigin() (gas: 76380)\n[PASS] testFuzzApprovalsAreIsolatedByBothOwnerAndSpender(uint256,uint256,uint256,uint256) (runs: 1000, μ: 592714, ~: 595640)\nLogs:\n  Bound result 489540704608976026585584465\n\n[PASS] testFuzzDelegationWithAliasedRoles(uint256,uint256,uint8,bool) (runs: 1000, μ: 284862, ~: 294114)\nLogs:\n  Bound result 752528023421251731920556895\n  Bound result 71795665544613618692556197\n\n[PASS] testFuzzInsufficientAllowanceWithSufficientBalance(uint256,uint256,uint256) (runs: 1000, μ: 254825, ~: 256241)\nLogs:\n  Bound result 812470981382\n  Bound result 17\n  Bound result 19\n\n[PASS] testFuzzInsufficientBalancePreservesEntireApproval(uint256,uint256) (runs: 1000, μ: 257517, ~: 258223)\nLogs:\n  Bound result 1000000000000000000000000000\n  Bound result 525508088809955847061776185642419526\n\n[PASS] testFuzzOverdrawFromPartiallyFundedHolder(uint256,uint256) (runs: 1000, μ: 198696, ~: 199417)\nLogs:\n  Bound result 999999999999999999999999999\n  Bound result 115792089237316195423570985008687907853269984665640564039457584007913129639935\n\n[PASS] testFuzzRejectedRecipientPreservesUsableApproval(uint256,uint256) (runs: 1000, μ: 350136, ~: 351249)\nLogs:\n  Bound result 1000000000000000000000000000\n  Bound result 525508088809955847061776185642419526\n\n[PASS] testInfiniteApprovalCanBeRevokedAndReplacedWithFiniteApproval() (gas: 389867)\n[PASS] testInfiniteApprovalDoesNotBypassBalanceCheck() (gas: 190061)\n[PASS] testMaximumTransferRevertsWithoutOverflowOrMutation() (gas: 126013)\n[PASS] testOneBaseUnitCanBeTransferredAndSpentOnlyOnce() (gas: 315514)\n[PASS] testSelfDelegationRequiresAndConsumesSelfAllowance() (gas: 300225)\n[PASS] testSelfTransferStillRequiresSufficientBalance() (gas: 153616)\n[PASS] testTransactionOriginCannotBorrowAnotherSpendersAllowance() (gas: 262924)\n[PASS] testZeroApprovalToZeroSpenderStillReverts() (gas: 108479)\n[PASS] testZeroDelegatedTransferToZeroRecipientStillReverts() (gas: 116580)\n[PASS] testZeroSourceCannotBeUsedToMintThroughTransferFrom() (gas: 167192)\nSuite result: ok. 19 passed; 0 failed; 0 skipped; finished in 101.55ms (600.61ms CPU time)\n\nRan 1 test for test/CadenceToken.invariant.t.sol:CadenceTokenInvariantTest\n[PASS] invariantSupplyBalancesAndAllowancesMatchModel() (runs: 256, calls: 32768, reverts: 0)\n\n╭----------------+---------------------------------+-------+---------+----------╮\n| Contract       | Selector                        | Calls | Reverts | Discards |\n+===============================================================================+\n| CadenceHandler | approve                         | 2647  | 0       | 0        |\n|----------------+---------------------------------+-------+---------+----------|\n| CadenceHandler | approveBoundary                 | 2716  | 0       | 0        |\n|----------------+---------------------------------+-------+---------+----------|\n| CadenceHandler | rejectTransferFromOverAllowance | 2741  | 0       | 0        |\n|----------------+---------------------------------+-------+---------+----------|\n| CadenceHandler | rejectTransferFromOverBalance   | 2758  | 0       | 0        |\n|----------------+---------------------------------+-------+---------+----------|\n| CadenceHandler | rejectTransferOverBalance       | 2780  | 0       | 0        |\n|----------------+---------------------------------+-------+---------+----------|\n| CadenceHandler | rejectZeroRecipient             | 2732  | 0       | 0        |\n|----------------+---------------------------------+-------+---------+----------|\n| CadenceHandler | rejectZeroSpender               | 2748  | 0       | 0        |\n|----------------+---------------------------------+-------+---------+----------|\n| CadenceHandler | revokeAndRejectSpend            | 2774  | 0       | 0        |\n|----------------+---------------------------------+-------+---------+----------|\n| CadenceHandler | roundTrip                       | 2765  | 0       | 0        |\n|----------------+---------------------------------+-------+---------+----------|\n| CadenceHandler | transfer                        | 2757  | 0       | 0        |\n|----------------+---------------------------------+-------+---------+----------|\n| CadenceHandler | transferFrom                    | 2642  | 0       | 0        |\n|----------------+---------------------------------+-------+---------+----------|\n| CadenceHandler | transferFullBalance             | 2708  | 0       | 0        |\n╰----------------+---------------------------------+-------+---------+----------╯\n\nLogs:\n  Bound result 250000000000000000000000000\n  Bound result 250000000000000000000000000\n  Bound result 250000000000000000000000000\n  Bound result 242255856\n  Bound result 1000000000000000000\n  Bound result 2361\n  Bound result 0\n  Bound result 531\n  Bound result 531\n  Bound result 531\n  Bound result 249\n  Bound result 207599490607229347908736468\n  Bound result 100000000000000000000\n  Bound result 100000000000000000000\n  Bound result 100000000000000000000\n  Bound result 0\n  Bound result 115792089237316195423570985008687907853269984665640314039457584007913129640191\n  Bound result 5\n  Bound result 28631299485700136113366332168168854408\n  Bound result 0\n  Bound result 0\n  Bound result 1\n  Bound result 40000000000000000000\n  Bound result 4\n  Bound result 115792089237316195423570985008687907853269984665640106440026976778565463159323\n  Bound result 115792089237316195423570985008687907853269984665640314039457584007912887384089\n  Bound result 0\n  Bound result 7800\n  Bound result 1\n  Bound result 1\n  Bound result 1\n  Bound result 1000000000\n  Bound result 1000000000\n  Bound result 1000000000\n  Bound result 739\n  Bound result 457599490607229347666480612\n  Bound result 0\n  Bound result 14\n  Bound result 6\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 1\n  Bound result 115792089237316195423570985008687907853269984665640521638948191237261038376153\n  Bound result 14984646186697566244229612046378\n  Bound result 10\n  Bound result 0\n  Bound result 115792089237316195423570985008687907853269984665639856439966976778565220999012\n  Bound result 0\n  Bound result 115792089237316195423570985008687907853269984665640314039457584007913129651112\n  Bound result 1307\n  Bound result 2\n  Bound result 210\n  Bound result 210\n  Bound result 210\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 115792089237316195423570985008687907853269984665640564039457584007913129639935\n  Bound result 3691\n  Bound result 81008942\n  Bound result 7\n  Bound result 3223\n  Bound result 249999999999999999999996522\n  Bound result 2430412327\n  Bound result 6302\n  Bound result 3\n  Bound result 1804\n  Bound result 1804\n  Bound result 1804\n  Bound result 0\n  Bound result 5639\n  Bound result 924819207504488774577149124\n  Bound result 924819207504488774577149124\n  Bound result 924819207504488774577149124\n  Bound result 0\n  Bound result 84471042615475038389662096233087664905619974609868782\n  Bound result 8\n  Bound result 997\n  Bound result 1\n  Bound result 7\n  Bound result 957599490607229345478326302\n  Bound result 115792089237316195423570985008687907853269984665639606467511630788151375389006\n  Bound result 957599490607229345478326301\n  Bound result 51\n  Bound result 51\n  Bound result 51\n  Bound result 42400509392770652091260709\n  Bound result 3\n  Bound result 3\n  Bound result 3\n  Bound result 30000000000000000000\n  Bound result 30000000000000000000\n  Bound result 30000000000000000000\n  Bound result 11000000000000000000\n  Bound result 2243\n  Bound result 115792089237316195423570985008687907853269984665640521638937191237261038379335\n  Bound result 0\n  Bound result 1000000000000000000000000000\n  Bound result 115792089237316195423570985008687907853269984665639891076297186968514390246690\n  Bound result 2430412990\n  Bound result 2\n  Bound result 9298920697235413745347807785491754015842050552051859258750503810525610103669\n  Bound result 115792089237316195423570985008687907853269984665640564039457584007910699226953\n  Bound result 0\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 8.38s (8.38s CPU time)\n\nRan 3 test suites in 8.38s (8.58s CPU time): 45 tests passed, 0 failed, 0 skipped (45 total tests)\n","passed":true},{"durationMs":36,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"CadenceToken.approve(address,uint256)\",\"CadenceToken.transfer(address,uint256)\",\"CadenceToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"DEPENDENCIES.md\":23,\"README.md\":107,\"foundry.toml\":18,\"remappings.txt\":2,\"src/CadenceToken.sol\":13,\"test/CadenceToken.adversarial.t.sol\":352,\"test/CadenceToken.invariant.t.sol\":220,\"test/CadenceToken.t.sol\":341},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"c11e15eea3a1ca5065f5726335d833bfc29a1664251951fd54276321d654cd58","verifiedTreeHash":"5334b2b8b9e5a6f6e2f3566d9bceca1c10b4b6e7","verifierVersion":"0.1.0+fb8278c5"},{"checks":[{"durationMs":1124,"exitCode":0,"name":"build","output":"Compiling 27 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.02s\nCompiler run successful!\n","passed":true},{"durationMs":2053,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 25 tests for test/CadenceToken.t.sol:CadenceTokenTest\n[PASS] testAllowanceCanBeReplacedAndRevoked() (gas: 176919)\n[PASS] testApproveEmitsEventWithoutMovingFunds() (gas: 88821)\n[PASS] testApproveZeroSpenderReverts() (gas: 37575)\n[PASS] testConstructorEmitsExactlyOneMint() (gas: 9718)\n[PASS] testCreate2FactoryReceivesSupplyAndDistributesExactAmounts() (gas: 660021)\n[PASS] testDeployerCannotSpendHolderFundsWithoutApproval() (gas: 158016)\n[PASS] testFuzzDelegatedTransfersConsumeOnlyTheirAllowance(uint256,uint256) (runs: 512, μ: 162315, ~: 164834)\nLogs:\n  Bound result 22885\n  Bound result 5\n\n[PASS] testFuzzOverspendingReverts(uint256) (runs: 512, μ: 69049, ~: 69097)\nLogs:\n  Bound result 115792089237316195423570985008687907853269984665639564039457584007913273381117\n\n[PASS] testFuzzTransfersConserveSupply(uint256) (runs: 512, μ: 189560, ~: 190071)\nLogs:\n  Bound result 882482972593462803462164737\n\n[PASS] testInfiniteAllowanceIsNotDecremented() (gas: 139332)\n[PASS] testMetadataAndEntireSupplyBelongToDeployer() (gas: 99395)\n[PASS] testNativeCurrencyTransferIsRejected() (gas: 42663)\n[PASS] testNoPostDeploymentMintBurnOrAdministrativeEntryPoints() (gas: 1121525)\n[PASS] testSelfTransferPreservesBalance() (gas: 51420)\n[PASS] testTransferFromInsufficientBalanceRollsBackAllowance() (gas: 126194)\n[PASS] testTransferFromRejectsInsufficientAllowanceWithoutChangingState() (gas: 115701)\n[PASS] testTransferFromRejectsUnapprovedSpender() (gas: 117675)\n[PASS] testTransferFromSpendsAllowanceAndEmitsTransfer() (gas: 242079)\n[PASS] testTransferFromToSelfConsumesAllowanceWithoutMovingBalance() (gas: 107710)\n[PASS] testTransferFromZeroRecipientRollsBackAllowance() (gas: 114155)\n[PASS] testTransferFullBalanceEmitsEvent() (gas: 88628)\n[PASS] testTransferRevertsWithInsufficientBalance() (gas: 67648)\n[PASS] testTransferToZeroRevertsEvenForZeroAmount() (gas: 82351)\n[PASS] testZeroTransferFromEmptyAccountEmitsEvent() (gas: 73355)\n[PASS] testZeroTransferFromNeedsNoAllowance() (gas: 81491)\nSuite result: ok. 25 passed; 0 failed; 0 skipped; finished in 14.28ms (39.40ms CPU time)\n\nRan 1 test for test/CadenceToken.invariant.t.sol:CadenceTokenInvariantTest\n[PASS] invariantSupplyBalancesAndAllowancesMatchModel() (runs: 128, calls: 8192, reverts: 0)\n\n╭----------------+--------------+-------+---------+----------╮\n| Contract       | Selector     | Calls | Reverts | Discards |\n+============================================================+\n| CadenceHandler | approve      | 2729  | 0       | 0        |\n|----------------+--------------+-------+---------+----------|\n| CadenceHandler | transfer     | 2705  | 0       | 0        |\n|----------------+--------------+-------+---------+----------|\n| CadenceHandler | transferFrom | 2758  | 0       | 0        |\n╰----------------+--------------+-------+---------+----------╯\n\nLogs:\n  Bound result 0\n  Bound result 8\n  Bound result 0\n  Bound result 0\n  Bound result 5\n  Bound result 973\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 5965\n  Bound result 7\n  Bound result 1874\n  Bound result 4524\n  Bound result 0\n  Bound result 11\n  Bound result 0\n  Bound result 0\n  Bound result 1378\n  Bound result 1\n  Bound result 0\n  Bound result 3150\n  Bound result 0\n  Bound result 692\n  Bound result 894\n  Bound result 60000000000000000000\n  Bound result 18\n  Bound result 64\n  Bound result 329\n  Bound result 1\n  Bound result 12\n  Bound result 436\n  Bound result 12\n  Bound result 694\n  Bound result 1\n  Bound result 1199\n  Bound result 5\n  Bound result 2\n  Bound result 0\n  Bound result 1000000000000000000\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 1.97s (1.97s CPU time)\n\nRan 2 test suites in 1.97s (1.98s CPU time): 26 tests passed, 0 failed, 0 skipped (26 total tests)\n","passed":true},{"durationMs":42,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"CadenceToken.approve(address,uint256)\",\"CadenceToken.transfer(address,uint256)\",\"CadenceToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"DEPENDENCIES.md\":23,\"README.md\":107,\"foundry.toml\":18,\"remappings.txt\":2,\"src/CadenceToken.sol\":13,\"test/CadenceToken.invariant.t.sol\":94,\"test/CadenceToken.t.sol\":341},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true},{"durationMs":438,"exitCode":0,"name":"slither","output":"slither: no results at low impact or above","passed":true},{"durationMs":224,"exitCode":0,"name":"aderyn","output":"[low] large-numeric-literal at src/CadenceToken.sol:11: Large Numeric Literal","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"f686a3a006da4dd65fc32d886b477be6f2d2b0c7b6bc244ad1b9344e2f687c28","verifiedTreeHash":"423f94e200db25d537afef6b234da6c2a013668a","verifierVersion":"0.1.0+fb8278c5"}]}