{"assessments":[],"deployments":[],"fuzz":[],"identity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"interpretation":"Records acceptance and evidence. Neither completion nor an AI assessment establishes correctness, safety, or independent review.","jobId":"6fb417ea-c5fa-45cb-a911-01ca337c3d60","kind":"shape:chain","nodes":[{"acceptedSubmissionHash":"5d2630bcde7951dc440377c27b6e8a9d3db59e547327b61cd820bf5408307346","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_economics","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"5831d4129bb1d7b89d27a9693b8d3db7d8124f25c7eebff502ad8456a0e58c38","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_flow","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"de17cbff4f1171a12f55f763664812ccdf6f6ed0abd88017a9659a993032ca25","dependsOn":["build_contract_project","write_foundry_tests","manifest","audit_math","audit_permissions","audit_economics","audit_flow"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"af3aa01159bbf354f621cafa5c0006f6169e0938a8b015be508b7377dbf165bc","skillId":"audit-judge","tools":[]},"key":"audit_judge","kind":"code","role":"review","skillHash":"af3aa01159bbf354f621cafa5c0006f6169e0938a8b015be508b7377dbf165bc","skillId":"audit-judge","state":"accepted"},{"acceptedSubmissionHash":"c7d9c39ba299d7df379e82328fbd4063c13439510e2703be60370563e71fe26e","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_math","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"bf6499ec52157c24ca213d15f7832eeb236880a3fcf8ad2c7bb0794bf65c36a8","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_permissions","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"d8bd6394f363b3258d87deb3b6ae50c212b5b36f9157b20b28eae2e042421a4c","dependsOn":[],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"d59561da3b378461b7c749f6bd5084477d44993aa94972ddea90f542535751df","skillId":"build-contract-project","tools":[]},"key":"build_contract_project","kind":"code","role":"implement","skillHash":"d59561da3b378461b7c749f6bd5084477d44993aa94972ddea90f542535751df","skillId":"build-contract-project","state":"accepted"},{"acceptedSubmissionHash":"90a67660cabf786415d363d04fe8270e183c71ad34ab143daa1de19a428af8a5","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"tools":[]},"key":"manifest","kind":"code","role":"integrate","skillHash":null,"skillId":null,"state":"accepted"},{"acceptedSubmissionHash":"af62acc5a67448552aa62f48cda75ce29e5a798c9d60a46f6cb0241dd2a141c6","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"4c76766b00591dfe982fe85d3de589fdb2f810e5137c301155d1c5e36a1d3b23","skillId":"write-foundry-tests","tools":[]},"key":"write_foundry_tests","kind":"code","role":"tests","skillHash":"4c76766b00591dfe982fe85d3de589fdb2f810e5137c301155d1c5e36a1d3b23","skillId":"write-foundry-tests","state":"accepted"}],"objective":"A custom token: COINBASE (COIN).\nToken name: COINBASE\nToken symbol: COIN\nToken supply: 1,000,000,000 with 18 decimals, all minted once to the deployer in the constructor.","parentJobId":null,"planHash":"231c821a9fdc0fafee1457fec936e0dedba8ad59999012e2239b6936afb39b51","previousHash":"0000000000000000000000000000000000000000000000000000000000000000","projectId":"6fb417ea-c5fa-45cb-a911-01ca337c3d60","publication":{"commit":null,"deliveredAt":null,"repoUrl":"https://github.com/identity-md-launches/launch-2107-coinbase"},"receiptIdentity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"registry":"0xb6d0a187b050fa5bb0b87033a203f37becf4a775","research":[],"schema":"identitymd-work-v1","signals":[{"agentId":"51020","feedbackHash":"5a7d661ceb44e17bfdc6a1a9d2de126df785f1ea1a2dc0f3985b5915feee1f57","nodeKey":"audit_economics","submissionHash":"5d2630bcde7951dc440377c27b6e8a9d3db59e547327b61cd820bf5408307346","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52151","feedbackHash":"920583c51b59802ec0945bd0780c7e303ef02b82277b923eaf425112e2785f80","nodeKey":"audit_flow","submissionHash":"5831d4129bb1d7b89d27a9693b8d3db7d8124f25c7eebff502ad8456a0e58c38","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52667","feedbackHash":"ce466cf317f51b49c807f9a1a8c218b070cfdc2b8f5598491ae05c6b182cc984","nodeKey":"audit_judge","submissionHash":"de17cbff4f1171a12f55f763664812ccdf6f6ed0abd88017a9659a993032ca25","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52265","feedbackHash":"db0be1ba7ae2b47197121afc7b223733597b437ff199b1b6fcedc5cb2a4f347b","nodeKey":"audit_math","submissionHash":"c7d9c39ba299d7df379e82328fbd4063c13439510e2703be60370563e71fe26e","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51162","feedbackHash":"5c3a2bfcef848a7287691f43df51515e3d2b2895fcd821983a555020d10e38cd","nodeKey":"audit_permissions","submissionHash":"bf6499ec52157c24ca213d15f7832eeb236880a3fcf8ad2c7bb0794bf65c36a8","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51237","feedbackHash":"325445da8d406b39766437524e6ac4a386d1be1250f0bb83301cf801636e374c","nodeKey":"build_contract_project","submissionHash":"d8bd6394f363b3258d87deb3b6ae50c212b5b36f9157b20b28eae2e042421a4c","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"51196","feedbackHash":"0afd7fa409b9b4d3ea83cd1a12e736808d53350c0936a4c3764574b6e973999a","nodeKey":"manifest","submissionHash":"90a67660cabf786415d363d04fe8270e183c71ad34ab143daa1de19a428af8a5","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"51312","feedbackHash":"23362edf543ee982811d9bc8234bd880619c448193defdf7d7989809e55f0555","nodeKey":"write_foundry_tests","submissionHash":"af62acc5a67448552aa62f48cda75ce29e5a798c9d60a46f6cb0241dd2a141c6","tag1":"verification:checks","tag2":"acceptance-v2","value":1}],"site":null,"snapshotHash":"542a95211f551e66354cf809e093571de4122da8f4a1042d6bac661a45236365","state":"completed","submissions":[{"artifacts":[],"attempt":1,"bundleHash":null,"device":"cdeffb0cd839cbf7","findings":[{"citation":"resolved","description":"DEPENDENCIES.md line 8 states \"Sources are unmodified\" and line 10 instructs the reader to verify the vendored libraries with `sha256sum -c DEPENDENCIES.sha256`. On the committed tree that command fails for seven forge-std files (lib/forge-std/src/StdAssertions.sol, StdJson.sol, StdToml.sol, Vm.sol, console.sol, interfaces/IERC7540.sol, interfaces/IMulticall3.sol). The hashes recorded in DEPENDENCIES.sha256 (e.g. line 5, d4c89eec... for StdAssertions.sol) are the hashes of the genuine upstream forge-std v1.9.7 files, which I confirmed by downloading the archive named in DEPENDENCIES.md (its SHA-256 45157353... matches). The files actually in lib/ differ from upstream only by formatting (line wrapping of function signatures and assembly blocks; a whitespace-stripped diff is empty), so there is no behavioral change and no effect on the token, which does not import forge-std. All 29 other entries, including every OpenZeppelin file the token compiles against, verify and are byte-identical to upstream v5.0.2. Impact: the repository's own dependency-integrity statement is false, so a reviewer following the README cannot distinguish this benign reformatting from a real tampering of test infrastructure, and an automated provenance gate running the documented command rejects the tree. Fix: either restore the seven files to their upstream bytes, or regenerate DEPENDENCIES.sha256 from the tree as shipped and drop the \"Sources are unmodified\" claim (say \"reformatted with forge fmt\" instead).","line":10,"path":"DEPENDENCIES.md","reproduction":"From the repository root run: `sha256sum -c DEPENDENCIES.sha256`. Expected (per DEPENDENCIES.md): every line reports OK. Actual: 29 OK and 7 FAILED, with the summary `sha256sum: WARNING: 7 computed checksums did NOT match`. Cross-check: `sha256sum lib/forge-std/src/StdAssertions.sol` prints 3fbf4a025b4fc94e..., while DEPENDENCIES.sha256 line 5 records d4c89eec70d267de..., which is the hash of the file inside the upstream forge-std v1.9.7 archive whose SHA-256 (45157353ab49eab0...) matches DEPENDENCIES.md. `diff <(tr -d ' \\t\\n' < lib/forge-std/src/StdAssertions.sol) <(tr -d ' \\t\\n' < <upstream>/src/StdAssertions.sol)` is empty, so the difference is formatting only.","severity":"low","snippet":"`DEPENDENCIES.sha256` records the exact local dependency contents. Verify with `sha256sum -c DEPENDENCIES.sha256`.","title":"DEPENDENCIES.sha256 does not match the vendored forge-std: the documented provenance check fails on 7 files"}],"hash":"5831d4129bb1d7b89d27a9693b8d3db7d8124f25c7eebff502ad8456a0e58c38","nodeId":"c2e3c10a-979c-4494-b276-3fcd9f7da100","outcome":"completed","summary":"The review is complete and `.imd-findings.json` holds one finding plus nine coverage rows.\n\n**Outcome.** The token itself is clean in my area. `CoinbaseToken` is a 17-line contract over a byte-identical OpenZeppelin v5.0.2 ERC-20, and all three state-changing entry points behave as the README states.\n\n**What I verified**\n- **Execution trace.** Traced approve, transfer and transferFrom through the inherited OpenZeppelin code with concrete inputs: zero address, zero amount, self-transfer, max allowance, insufficient balance and allowance. Every failure path reverts atomically and every success path moves exactly the stated amount.\n- **Launch flows.** A scratch test deployed the token by CREATE2 from an address standing in for the factory, then ran the swarm share, claim, pool pull and pay, and remainder transfers. All amounts arrived whole, supply stayed at 10^27, and the factory could not pull a holder's balance without approval.\n- **First principles.** The constructor mints exactly 1,000,000,000 × 10^18 to msg.sender, takes no arguments, links no libraries, and leaves no owner, mint, burn, pause or freeze path. The compiled ABI exposes no receive, fallback or other non-view function.\n- **Periphery.** Downloaded the upstream archives named in DEPENDENCIES.md. Their hashes match the file's claims, and all six vendored OpenZeppelin files are byte-identical to upstream.\n\n**The one finding, severity low.** DEPENDENCIES.md tells the reader to verify the vendored libraries with `sha256sum -c DEPENDENCIES.sha256`, and that command fails on seven forge-std files. The recorded hashes are the genuine upstream v1.9.7 hashes. The files in the tree differ only by whitespace, so the token is unaffected, but the \"Sources are unmodified\" claim is false and any provenance gate running the documented command rejects the tree. The fix is to restore the upstream bytes or regenerate the checksum file.\n\n**Static analysis leads.** Slither reported nothing. Aderyn's large-literal note on line 10 is the supply constant, which evaluates to exactly 10^27, so it is not a defect.\n\n**Not reached.** The protected launch test needs Uniswap v4 core and the harness's LaunchLiquidity library, which are not in this tree, so I approximated the pool manager with transfer and transferFrom rather than running a real swap. The scratch test directory was removed after use.","treeHash":null,"usage":{"cachedInputTokens":792373,"inputTokens":290,"model":"claude-fable-5-1","outputTokens":16490,"runtime":"claude","turns":30,"wallClockMs":262686}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"a31e321b410aaa02","findings":[{"citation":"resolved","description":"DEPENDENCIES.md (line 8: \"Sources are unmodified\"; line 10: verify with `sha256sum -c DEPENDENCIES.sha256`) and README.md line 60 present DEPENDENCIES.sha256 as the proof that the vendored libraries are the pinned upstream files. Running that command on the committed tree fails for seven forge-std files: lib/forge-std/src/StdAssertions.sol, StdJson.sol, StdToml.sol, Vm.sol, console.sol, interfaces/IERC7540.sol and interfaces/IMulticall3.sol. The recorded digests are the genuine upstream v1.9.7 digests (for example Vm.sol 9068805b...9780 matches raw.githubusercontent.com/foundry-rs/forge-std/v1.9.7/src/Vm.sol), but the files in the tree were reformatted after the record was written (forge fmt with the project's 120-column setting joined multi-line signatures; Vm.sol in the tree hashes to a1b1c829...2a15). Stripping all whitespace, each vendored file is byte-identical to upstream, so no behaviour changed and the token's production dependency closure (the five OpenZeppelin v5.0.2 files) is byte-identical to upstream and does verify. Impact is limited to the integrity claim: a reviewer or the release pipeline following the README's verification step gets a failure on test-only files and cannot distinguish a harmless reformat from a tampered dependency without doing the whitespace comparison themselves. Fix: either restore the seven files to their upstream bytes (exclude lib/ from forge fmt) or regenerate DEPENDENCIES.sha256 from the tree and drop the \"Sources are unmodified\" sentence, so the documented check passes.","line":10,"path":"DEPENDENCIES.md","reproduction":"From the repository root run `sha256sum -c DEPENDENCIES.sha256`. Expected (per DEPENDENCIES.md line 10 and README.md line 60): every line reports OK. Actual: `lib/forge-std/src/StdAssertions.sol: FAILED`, `lib/forge-std/src/StdJson.sol: FAILED`, `lib/forge-std/src/StdToml.sol: FAILED`, `lib/forge-std/src/Vm.sol: FAILED`, `lib/forge-std/src/console.sol: FAILED`, `lib/forge-std/src/interfaces/IERC7540.sol: FAILED`, `lib/forge-std/src/interfaces/IMulticall3.sol: FAILED`, `sha256sum: WARNING: 7 computed checksums did NOT match`. `git status` is clean and `git diff HEAD -- lib` is empty, so this is the committed state. Confirming it is whitespace-only: `cmp <(tr -d ' \\t\\n\\r' < upstream/Vm.sol) <(tr -d ' \\t\\n\\r' < lib/forge-std/src/Vm.sol)` reports identical for all seven files.","severity":"low","snippet":"`DEPENDENCIES.sha256` records the exact local dependency contents. Verify with `sha256sum -c DEPENDENCIES.sha256`.","title":"DEPENDENCIES.sha256 does not match the vendored forge-std files, so the documented integrity check fails"}],"hash":"5d2630bcde7951dc440377c27b6e8a9d3db59e547327b61cd820bf5408307346","nodeId":"1d675129-bce3-423d-a552-ceaed9e0cb4a","outcome":"completed","summary":"The review is complete and the findings file is written at `.imd-findings.json`. The token itself has no economic defects.\n\n**What I checked**\n\n- `src/CoinbaseToken.sol` is a 17-line contract: it inherits OpenZeppelin ERC-20 unchanged and mints 10^27 units to msg.sender in the constructor. The constant evaluates to exactly 1,000,000,000 × 10^18.\n- The five vendored OpenZeppelin files are byte-identical to upstream v5.0.2, so `transfer`, `transferFrom` and `approve` carry no fee, exemption, callback or external call.\n- The compiled ABI exposes only those three state-changing functions. There is no mint, burn, pause, owner or upgrade path, so the supply cannot grow or shrink after deployment.\n- Against the Economic Security, Invariant and Flow Gap guides: no external dependencies to break, conservation of balances holds, launch flows to the distributor, PoolManager and requester move exact amounts, and the protected floor's swap and claim flows are satisfied by a plain ERC-20.\n- The existing suite passes with the documented seed. The three entry points each get a `holds` coverage row with reasons.\n\n**One low finding**\n\nRunning `sha256sum -c DEPENDENCIES.sha256`, which DEPENDENCIES.md and the README name as the integrity check, fails for seven forge-std files. The recorded digests are the real upstream v1.9.7 digests. The committed files were reformatted afterwards and are identical to upstream once whitespace is stripped. No behaviour changed and the production dependency closure verifies, but the documented check is broken and the \"Sources are unmodified\" claim is false. The fix is to restore the upstream bytes or regenerate the checksum file.\n\n**Not reachable from this tree**\n\nNo launch manifest exists yet. The README's claim of an 80 percent pool and 10 percent requester split comes from the job's economics, not this code, so I recorded it as unreached rather than verified. The token name \"COINBASE\" is the requester's stated choice and I did not treat it as a code defect.","treeHash":null,"usage":{"cachedInputTokens":741279,"inputTokens":354,"model":"claude-fable-5-1","outputTokens":13904,"runtime":"claude","turns":29,"wallClockMs":222243}},{"artifacts":[],"attempt":1,"bundleHash":"7ac8f29f9cd6f88c1d1c078a4b0dd16fe5a89e1a7cfc15e1aa49a51d818186f0","device":"6f30d6341cbff249","findings":[],"hash":"90a67660cabf786415d363d04fe8270e183c71ad34ab143daa1de19a428af8a5","nodeId":"734f343a-cdfa-4897-b08a-1145b236b770","outcome":"completed","summary":"Created [launch.json](/home/seat/.identitymd/work/6fb417ea-c5fa-45cb-a911-01ca337c3d60/734f343a-cdfa-4897-b08a-1145b236b770/launch.json) matching `CoinbaseToken`’s constructor, exact supply, and required pool and economics.\n\n`forge build` passed. All 33 tests passed with the specified fuzz seed. Only `launch.json` changed.","treeHash":"0603789f82d7005e8de3618b1011130d16513856","usage":{"cachedInputTokens":193280,"inputTokens":25686,"model":"gpt-6-astra","outputTokens":2318,"runtime":"codex","turns":3,"wallClockMs":68188}},{"artifacts":[],"attempt":1,"bundleHash":"f89d4eeb932de6981649bde31312efc8de1fa28713f0fccc7df7f887515f12f2","device":"71ee8cbe44073cf6","findings":[],"hash":"af62acc5a67448552aa62f48cda75ce29e5a798c9d60a46f6cb0241dd2a141c6","nodeId":"a5c03c70-6dfc-4dca-bd77-4b9d50d508d9","outcome":"completed","summary":"Added 9 tests and expanded randomized invariants to cover failure rollback, allowance boundaries, authorization isolation, and holder transferability.\n\n`forge build` and `forge test` pass with the required seed: **42 tests passed**, including **16,384 invariant calls**.\n\nOnly `test/` changed. No implementation defects found.","treeHash":"0e0df3b4269cf4943045a29e3e6fc667317e9e01","usage":{"cachedInputTokens":419072,"inputTokens":63715,"model":"gpt-6-astra","outputTokens":11022,"runtime":"codex","turns":5,"wallClockMs":287808}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"771f83f312eace21","findings":[{"citation":"resolved","description":"DEPENDENCIES.md states that the vendored sources are unmodified and that DEPENDENCIES.sha256 records their exact contents, and the README (line 60) and DEPENDENCIES.md (line 10) tell the reader to verify with `sha256sum -c DEPENDENCIES.sha256`. That command fails on the committed tree: 7 of 36 recorded checksums do not match. The 7 files are all under lib/forge-std/src (StdAssertions.sol, StdJson.sol, StdToml.sol, Vm.sol, console.sol, interfaces/IERC7540.sol, interfaces/IMulticall3.sol). I downloaded the upstream forge-std v1.9.7 archive named in DEPENDENCIES.md (archive SHA-256 matches the recorded 45157353...ee94) and byte-compared: the recorded hashes equal the upstream files, so the record is correct for upstream, and the vendored copies were changed after vendoring. The change is whitespace-only (identical after stripping spaces, tabs and newlines; it is `forge fmt` line-wrapping to the configured 120-column width), so it has no semantic effect, and all six OpenZeppelin files plus LICENSE are byte-identical to upstream v5.0.2, so the production transfer logic is not affected. The defect is that the repository's own provenance guarantee is false as committed: anyone following the documented verification step gets a failure and cannot distinguish this benign reformat from a tampered library without doing the upstream comparison themselves. Trust-gap lens: the record is what a reader is told to trust in place of reading lib/; a record that fails on a clean checkout trains readers to ignore it. Fix (either): regenerate DEPENDENCIES.sha256 from the committed files and amend the 'Sources are unmodified' sentence to say forge-std was reformatted by forge fmt; or restore the 7 byte-exact upstream files and exclude lib/ from forge fmt so the record stays true. No on-chain impact; test-only dependency.","line":8,"path":"DEPENDENCIES.md","reproduction":"State: a clean checkout of commit 430f7cd. Input: run `sha256sum -c DEPENDENCIES.sha256` from the repository root, as DEPENDENCIES.md line 10 and README.md line 60 instruct. Expected: every line reports OK. Actual: `lib/forge-std/src/StdAssertions.sol: FAILED`, `lib/forge-std/src/StdJson.sol: FAILED`, `lib/forge-std/src/StdToml.sol: FAILED`, `lib/forge-std/src/Vm.sol: FAILED`, `lib/forge-std/src/console.sol: FAILED`, `lib/forge-std/src/interfaces/IERC7540.sol: FAILED`, `lib/forge-std/src/interfaces/IMulticall3.sol: FAILED`, then `sha256sum: WARNING: 7 computed checksums did NOT match`. Example: recorded for Vm.sol 9068805b59ac1d0ea03a8fa1f15ae49c094e0c6c852a2500e0dd112f264b2cb1 (equals upstream v1.9.7 Vm.sol), actual committed file a1b1c82924aecf0f38b53192fd1e801cccc1e1fd2ecd6b2301e4f4c4ab102a15. `diff` of upstream vs committed Vm.sol shows only multi-line function signatures re-joined onto one line (50 changed lines, same content after whitespace removal). The 29 other recorded files, including all 6 OpenZeppelin files, match.","severity":"low","snippet":"Sources are unmodified. These are ordinary repository files, not submodules; no dependency installation or network access is needed to build or test.","title":"DEPENDENCIES.sha256 does not match the vendored forge-std files; the README's provenance check fails"}],"hash":"bf6499ec52157c24ca213d15f7832eeb236880a3fcf8ad2c7bb0794bf65c36a8","nodeId":"fa65021f-4d4f-410a-83e4-3e0f8fc63234","outcome":"completed","summary":"The review is complete and the findings file is valid. Nothing more to request.\n\n**Outcome:** the COINBASE token holds under the Access Control, Trust Gap and Asymmetry guides. One low-severity provenance defect is reported in `.imd-findings.json`, with coverage rows for all three entry points.\n\n**What I checked in the assigned area**\n\n- **Access control.** The contract inherits unmodified OpenZeppelin v5.0.2 ERC-20 and adds only a constructor. The compiled ABI has exactly three nonpayable functions and seven views, with no owner, minter, pauser, initializer, receive or fallback. A fuzzed sweep of non-ABI selectors from arbitrary callers reverts with no state change. The deployer keeps no residual power after moving the supply out and cannot pull a holder's balance.\n- **Asymmetry.** `transfer` and self-approved `transferFrom` reach identical end states for the same inputs. Every revert path in `transferFrom` leaves allowance and balances untouched. Allowance writes only touch the caller's own row.\n- **Trust gap.** No caller class is exempt or taxed. Factory, distributor, pool manager and trader paths all move exact amounts, so the launch flows the floor test requires arrive whole. I byte-compared the vendored OpenZeppelin files against the upstream v5.0.2 archive. All six plus the license are identical.\n- **Static-analysis lead.** The aderyn large-literal warning is a constant that folds to the manifest supply exactly. Dismissed.\n\n**The one finding (low).** The README and DEPENDENCIES.md tell readers to verify vendored sources with a checksum file, and that check fails on a clean checkout. Seven forge-std files differ from both upstream v1.9.7 and the committed record. The difference is whitespace-only reformatting, so there is no on-chain or semantic impact, but the repository's stated provenance guarantee is false as committed. The fix is to regenerate the record or restore the byte-exact upstream files and exclude the library from formatting.\n\n**Not substantiated, left out.** The README hardcodes an 80/10/10 split and names Ethereum chain ID 1 as the target. I have no job economics or chain table to check these against, so they are not reported.\n\nScratch tests live under `test/scratch/`, which is ignored and not kept. No repository file was modified.","treeHash":null,"usage":{"cachedInputTokens":802474,"inputTokens":322,"model":"claude-fable-5-1","outputTokens":19699,"runtime":"claude","turns":33,"wallClockMs":332917}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"8db4eebdd7bd2744","findings":[{"citation":"resolved","description":"DEPENDENCIES.md states that the vendored sources are unmodified (line 8) and that DEPENDENCIES.sha256 records the exact local contents (line 10). Neither holds for forge-std. Seven files under lib/forge-std/src (Vm.sol, StdAssertions.sol, StdJson.sol, StdToml.sol, console.sol, interfaces/IERC7540.sol, interfaces/IMulticall3.sol) were reformatted with the repository's `forge fmt` line_length=120 setting after the checksums were taken: the recorded digests (e.g. DEPENDENCIES.sha256 line 18 for Vm.sol, 9068805b...) equal the upstream v1.9.7 tarball digests, but the files in the tree hash differently (Vm.sol in tree: a1b1c829...). A `diff` against the upstream tarball (archive SHA-256 45157353... as recorded) shows only whitespace and line-joining changes, no semantic edits, so the test suite is unaffected and the production contract (which imports only OpenZeppelin) is unaffected. All six OpenZeppelin v5.0.2 files are byte-identical to upstream and pass. Impact is limited to the reviewer/verifier workflow: anyone following the README's own verification instruction gets a FAILED result and must independently establish that the divergence is cosmetic. Not a defect in CoinbaseToken.sol. Fix: either regenerate DEPENDENCIES.sha256 from the tree and drop the 'unmodified' claim, or restore the seven files from the v1.9.7 archive so the recorded digests match (the latter keeps the provenance claim true; lib/ is outside this reviewer's write scope).","line":10,"path":"DEPENDENCIES.md","reproduction":"From the repository root run `sha256sum -c DEPENDENCIES.sha256`. Expected (per DEPENDENCIES.md line 10): every line OK, exit 0. Actual: 'lib/forge-std/src/StdAssertions.sol: FAILED', 'lib/forge-std/src/StdJson.sol: FAILED', 'lib/forge-std/src/StdToml.sol: FAILED', 'lib/forge-std/src/Vm.sol: FAILED', 'lib/forge-std/src/console.sol: FAILED', 'lib/forge-std/src/interfaces/IERC7540.sol: FAILED', 'lib/forge-std/src/interfaces/IMulticall3.sol: FAILED', 'WARNING: 7 computed checksums did NOT match', exit 1. Cross-check: download https://codeload.github.com/foundry-rs/forge-std/tar.gz/refs/tags/v1.9.7 (sha256 45157353ab49eab01d294565866731e599b32401757229689ee459aa26b7ee94, matching DEPENDENCIES.md), then `diff forge-std-1.9.7/src/Vm.sol lib/forge-std/src/Vm.sol`: 2397 upstream lines vs 2369 in tree, every hunk a multi-line signature joined onto one line (e.g. upstream lines 827-830 `function getDeployment(string calldata contractName, uint64 chainId)\\n external\\n view\\n returns (address deployedAddress);` becomes one line).","severity":"low","snippet":"`DEPENDENCIES.sha256` records the exact local dependency contents. Verify with `sha256sum -c DEPENDENCIES.sha256`.","title":"DEPENDENCIES.sha256 does not match the vendored forge-std sources, so the documented provenance check fails"}],"hash":"c7d9c39ba299d7df379e82328fbd4063c13439510e2703be60370563e71fe26e","nodeId":"f2caa405-a80d-448c-ae51-85c778a007b2","outcome":"completed","summary":"The review is complete and the findings file is written and valid. The working tree shows no tracked changes; `.imd-findings.json` and `test/scratch/` are gitignored.\n\n**Result: the token's arithmetic holds.** CoinbaseToken is a bare OpenZeppelin v5.0.2 ERC20 with one constant mint, and the vendored OpenZeppelin files are byte-identical to the upstream v5.0.2 archive. I traced every path in my area:\n\n- **Math Precision:** the only arithmetic the contract adds is the compile-time constant, which evaluates to exactly 10^27 and divides by 10^18 with zero remainder. Inside the library, every unchecked subtraction is preceded by a bounds check and every unchecked addition is bounded by total supply. There is no division, fee, scale conversion or downcast anywhere.\n- **Boundary:** no external calls, no payable or fallback path, no bytes decoding. The only sentinel branches are the zero-address checks, and both sides of each were walked. Max-uint transfers, allowance equal to amount, max-minus-one versus max allowance, and unlimited allowance against an overdrawn balance all behave as the standard requires. I confirmed these with six scratch tests, all passing.\n- **Numerical Gap:** the sum-of-balances invariant holds exactly because integer arithmetic equals real arithmetic here. The launch split percentages of 10^27 produce no remainder.\n\n**One low finding, outside the contract itself.** DEPENDENCIES.md tells the reader to verify the vendored libraries with the checksum file, but that command fails on seven forge-std files. Diffing against the upstream v1.9.7 tarball shows they were only reformatted by `forge fmt`, with no semantic change, so tests and the production contract are unaffected. The judge gets the exact command, its output, and the cross-check in the finding. The aderyn large-literal lead was checked and is not a defect.\n\nThe coverage record answers all three entry points as `holds` plus four invariant and lead rows. Nothing in my area was left unreached.","treeHash":null,"usage":{"cachedInputTokens":774089,"inputTokens":354,"model":"claude-fable-5-1","outputTokens":14093,"runtime":"claude","turns":23,"wallClockMs":215352}},{"artifacts":[],"attempt":1,"bundleHash":"cbf0ef2fd18b265af5201aab23a54501e87d6da31280f1bc16de00467264432c","device":"308998a1407291a8","findings":[],"hash":"d8bd6394f363b3258d87deb3b6ae50c212b5b36f9157b20b28eae2e042421a4c","nodeId":"8e618af1-174b-401e-903c-5b3c84a5e285","outcome":"completed","summary":"Implemented [CoinbaseToken](src/CoinbaseToken.sol): COINBASE (COIN), 18 decimals, exactly 1,000,000,000 tokens minted once to the deployer.\n\nVendored dependencies and documented deployment parameters, assumptions, and operational responsibilities in [README.md](README.md).\n\nVerified:\n- `forge build`\n- `forge test`: 33 passed, including fuzzing and invariants with the supplied seed\n- `forge fmt --check`","treeHash":"cbe6ebc1b81c015494ad4aef26b3f9b64a4b1cc4","usage":{"cachedInputTokens":440320,"inputTokens":59494,"model":"gpt-6-astra","outputTokens":13846,"runtime":"codex","turns":4,"wallClockMs":315489}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"b38bea3c04869138","findings":[{"citation":"resolved","description":"All four specialists reported the same root cause; this is the single merged finding. DEPENDENCIES.md line 8 claims the vendored sources are unmodified and line 10 tells the reader to verify them with `sha256sum -c DEPENDENCIES.sha256` (README.md line 60 points to the same files). On the committed tree (HEAD 648f81e, `git status` clean) that command exits 1 with 7 of 36 checksums FAILED: lib/forge-std/src/StdAssertions.sol, StdJson.sol, StdToml.sol, Vm.sol, console.sol, interfaces/IERC7540.sol and interfaces/IMulticall3.sol. I reproduced the specialists' cross-check independently: I downloaded the two archives named in DEPENDENCIES.md (forge-std v1.9.7, archive sha256 45157353ab49eab01d294565866731e599b32401757229689ee459aa26b7ee94; OpenZeppelin v5.0.2, archive sha256 18c7b7e949b9a82dcd8cd394426c9c2636dfc263aa2317d4749dbfa0c7b3925a; both match the recorded archive digests) and compared every one of the 36 vendored files. The 7 recorded digests that fail are exactly the upstream v1.9.7 digests, so the record was taken from upstream and the files were changed afterwards. Each of the 7 is byte-identical to upstream once all whitespace is stripped (the change is `forge fmt` line-joining under the project's line_length = 120 setting), and the remaining 29 files, including all 6 OpenZeppelin files the token compiles against, are byte-identical to upstream and verify. Impact: no behavioural change and no effect on CoinbaseToken.sol, which imports only OpenZeppelin; forge-std is test-only. The defect is that the repository's own integrity statement is false as committed: anyone following the documented verification step gets a failure and cannot tell this benign reformat from a tampered test dependency without repeating the upstream comparison, and an automated provenance gate running the documented command rejects the tree. Fix (either): regenerate DEPENDENCIES.sha256 from the committed files and change line 8 to say forge-std was reformatted with forge fmt; or restore the 7 files to their upstream bytes and exclude lib/ from forge fmt so the record stays true. Both lib/ and the record are outside the specialists' write scope, which is why none of them could fix it.","line":8,"path":"DEPENDENCIES.md","reproduction":"State: clean checkout of HEAD 648f81e. Input: from the repository root run `sha256sum -c DEPENDENCIES.sha256` as DEPENDENCIES.md line 10 instructs. Expected: 36 lines reporting OK, exit 0. Actual: 29 OK and `lib/forge-std/src/StdAssertions.sol: FAILED`, `lib/forge-std/src/StdJson.sol: FAILED`, `lib/forge-std/src/StdToml.sol: FAILED`, `lib/forge-std/src/Vm.sol: FAILED`, `lib/forge-std/src/console.sol: FAILED`, `lib/forge-std/src/interfaces/IERC7540.sol: FAILED`, `lib/forge-std/src/interfaces/IMulticall3.sol: FAILED`, then `sha256sum: WARNING: 7 computed checksums did NOT match`, exit 1. Cross-check: `sha256sum lib/forge-std/src/Vm.sol` prints a1b1c82924aecf0f38b53192fd1e801cccc1e1fd2ecd6b2301e4f4c4ab102a15 while DEPENDENCIES.sha256 records 9068805b59ac1d0ea03a8fa1f15ae49c094e0c6c852a2500e0dd112f264b2cb1, which is the sha256 of src/Vm.sol inside the upstream v1.9.7 archive. `cmp <(tr -d ' \\t\\n\\r' < lib/forge-std/src/Vm.sol) <(tr -d ' \\t\\n\\r' < forge-std-1.9.7/src/Vm.sol)` reports no difference for each of the 7 files; `cmp` without stripping reports a difference. All 6 files under lib/openzeppelin-contracts are byte-identical to upstream v5.0.2.","severity":"low","snippet":"Sources are unmodified. These are ordinary repository files, not submodules; no dependency installation or network access is needed to build or test.","title":"DEPENDENCIES.sha256 does not match seven vendored forge-std files, so the documented provenance check fails (merged from audit_permissions, audit_math, audit_economics, audit_flow)"},{"citation":"resolved","description":"README.md line 47 was written before the manifest step ran and now contradicts the tree: launch.json is tracked at the repository root (commit 648f81e) and is the manifest the launch will use. The manifest itself is consistent with the code (contract CoinbaseToken, name COINBASE, symbol COIN, decimals 18, constructorArgs [], totalSupply 1000000000000000000000000000 equals INITIAL_SUPPLY, contracts [], pool and economics copied from the job, lowercase addresses, no extra keys), so this is a stale documentation statement only, with no deployment or on-chain effect. Fix: amend the sentence to say the manifest is launch.json at the root, or drop the clause.","line":47,"path":"README.md","reproduction":"State: clean checkout of HEAD 648f81e. Input: `git ls-files launch.json` and `sed -n 47p README.md`. Expected: either no launch.json in the tree, or a README sentence that does not deny it. Actual: `git ls-files launch.json` prints `launch.json` and README.md line 47 reads `This repository does not contain a launch manifest, sign transactions, or broadcast a deployment.`","severity":"info","snippet":"The separate IdentityMD manifest and deployment steps select and deploy `CoinbaseToken` with the parameters above. This repository does not contain a launch manifest, sign transactions, or broadcast a deployment.","title":"README states the repository contains no launch manifest, but launch.json is committed at the root"}],"hash":"de17cbff4f1171a12f55f763664812ccdf6f6ed0abd88017a9659a993032ca25","nodeId":"07679b29-9a11-4440-8a3c-335e9b2ce072","outcome":"completed","summary":"The review is complete and written to `.imd-findings.json`. No repository file was changed, and the working tree stays clean apart from the findings file the task asks for.\n\n**Outcome.** The token holds. Both findings are documentation defects, with no effect on the deployed contract.\n\n**Specialist findings.** All four specialists reported one and the same issue, so I merged them into a single low finding:\n\n- **DEPENDENCIES.sha256 fails the documented check.** I reproduced it on the clean HEAD: the documented `sha256sum -c` command reports seven forge-std files as FAILED. I downloaded both upstream archives named in DEPENDENCIES.md, confirmed their archive digests match, and compared all 36 vendored files. The seven recorded digests are the genuine upstream ones, the committed copies differ only by whitespace from a forge fmt pass, and every OpenZeppelin file the token compiles against is byte-identical to upstream. Severity stays low: forge-std is test-only, so the only harm is a false provenance statement.\n\n**My own pass found one more item, reported as info.** README line 47 says the repository contains no launch manifest, but launch.json is committed at the root. The manifest itself is consistent with the code and the schema.\n\n**What I verified about the token itself.** It is an unmodified OpenZeppelin v5.0.2 ERC-20 with a no-argument constructor minting exactly the manifest supply to msg.sender. The ABI exposes no mint, burn, owner, or pause function. The runtime bytecode contains no CALL, DELEGATECALL, CALLCODE, SELFDESTRUCT or CREATE opcodes. Creation and runtime sizes are far under the deployment limits. The full local suite of 42 tests, including the 256-run invariant suite, passes with the README's seed, and `forge fmt --check` is clean. The aderyn large-literal line is the underscore-formatted supply constant and is not a defect.\n\n**Coverage record.** All three listed entry points are marked `holds` with reasons, plus three invariant rows covering fixed supply, factory deployability, and manifest consistency.","treeHash":null,"usage":{"cachedInputTokens":598077,"inputTokens":354,"model":"claude-fable-5-1","outputTokens":9450,"runtime":"claude","turns":12,"wallClockMs":141094}}],"verification":[{"checks":[{"durationMs":1882,"exitCode":0,"name":"build","output":"Compiling 29 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.76s\nCompiler run successful!\n","passed":true},{"durationMs":6452,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 1 test for test/CoinbaseToken.launch.t.sol:CoinbaseTokenLaunchTest\n[PASS] test_distributionClaimsAndPoolTransfersDeliverExactAmounts() (gas: 437527)\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 1.03ms (270.18µs CPU time)\n\nRan 31 tests for test/CoinbaseToken.t.sol:CoinbaseTokenTest\n[PASS] testFuzz_approvalAndDelegatedTransfer(uint256,uint256) (runs: 1000, μ: 163630, ~: 165306)\nLogs:\n  Bound result 156\n  Bound result 23\n\n[PASS] testFuzz_overspendingRevertsAndPreservesState(uint256,uint256) (runs: 1000, μ: 137682, ~: 137757)\nLogs:\n  Bound result 476\n  Bound result 7702\n\n[PASS] testFuzz_spendingBeyondAllowanceReverts(uint256,uint256) (runs: 1000, μ: 123212, ~: 123448)\nLogs:\n  Bound result 3999635743\n  Bound result 1000000000000000000000000000\n\n[PASS] testFuzz_transferPreservesSupplyAndExactBalances(uint256) (runs: 1000, μ: 94124, ~: 94292)\nLogs:\n  Bound result 20651\n\n[PASS] test_approveEmitsEventAndOverwritesAllowance() (gas: 131872)\n[PASS] test_approveZeroAddressReverts() (gas: 37552)\n[PASS] test_constructorEmitsExactlyOneMintEvent() (gas: 9741)\n[PASS] test_create2DeploymentMintsToFactoryNotTransactionOrigin() (gas: 236053)\n[PASS] test_deployerCannotSpendHolderFundsWithoutApproval() (gas: 157904)\n[PASS] test_entireSupplyCanMoveAndReturn() (gas: 159510)\n[PASS] test_exhaustedAllowanceCannotBeReused() (gas: 161662)\n[PASS] test_infiniteAllowanceIsNotDecremented() (gas: 214613)\n[PASS] test_insufficientBalanceRevertsWithoutChangingBalances() (gas: 120027)\n[PASS] test_maximumTransferCannotOverflowBalances() (gas: 54955)\n[PASS] test_metadataAndEntireSupplyBelongToDeployer() (gas: 107693)\n[PASS] test_noMintBurnOrAdministrativeEntryPoints() (gas: 5516139)\n[PASS] test_revocationPreventsFurtherSpending() (gas: 141273)\n[PASS] test_runtimeIsDeployableAndHasNoForbiddenOpcodes() (gas: 1031383)\n[PASS] test_selfTransferDoesNotChangeBalance() (gas: 51475)\n[PASS] test_transferEmitsEventAndMovesExactAmount() (gas: 91549)\n[PASS] test_transferFromInsufficientAllowanceIsAtomic() (gas: 115687)\n[PASS] test_transferFromInsufficientBalanceRestoresAllowance() (gas: 188764)\n[PASS] test_transferFromMovesExactAmountAndConsumesAllowance() (gas: 159928)\n[PASS] test_transferFromRequiresAllowanceEvenWhenCallerOwnsTokens() (gas: 42574)\n[PASS] test_transferFromToSelfConsumesAllowanceWithoutChangingBalance() (gas: 109500)\n[PASS] test_transferFromToZeroRestoresAllowance() (gas: 114025)\n[PASS] test_transferToZeroRevertsEvenForZeroAmount() (gas: 71904)\n[PASS] test_unknownSelectorAndNativeEtherAreRejected() (gas: 64658)\n[PASS] test_zeroSourceCannotCreateTokensThroughTransferFrom() (gas: 80045)\n[PASS] test_zeroTransferFromEmptyAccountEmitsEvent() (gas: 63080)\n[PASS] test_zeroTransferFromNeedsNoPositiveAllowance() (gas: 81448)\nSuite result: ok. 31 passed; 0 failed; 0 skipped; finished in 51.13ms (228.54ms CPU time)\n\nRan 1 test for test/CoinbaseToken.invariant.t.sol:CoinbaseTokenInvariantTest\n[PASS]\nCoinbaseTokenInvariantTest invariants:\n[PASS] invariant_balancesAndAllowancesMatchIndependentLedger\n[PASS] invariant_supplyIsFixedAndAllBalancesAreAccountedFor\n CoinbaseTokenInvariantTest invariants (runs: 256, calls: 16384, reverts: 0)\n\n╭--------------+--------------+-------+---------+----------╮\n| Contract     | Selector     | Calls | Reverts | Discards |\n+==========================================================+\n| TokenHandler | approve      | 5455  | 0       | 0        |\n|--------------+--------------+-------+---------+----------|\n| TokenHandler | transfer     | 5456  | 0       | 0        |\n|--------------+--------------+-------+---------+----------|\n| TokenHandler | transferFrom | 5473  | 0       | 0        |\n╰--------------+--------------+-------+---------+----------╯\n\nLogs:\n  Bound result 0\n  Bound result 0\n  Bound result 15\n  Bound result 0\n  Bound result 0\n  Bound result 8\n  Bound result 206014920760115881997112768\n  Bound result 0\n  Bound result 1\n  Bound result 296885182627849795103276778\n  Bound result 127\n  Bound result 3\n  Bound result 25\n  Bound result 0\n  Bound result 20\n  Bound result 6692486444835\n  Bound result 2\n  Bound result 12\n  Bound result 10\n  Bound result 1797900577765\n  Bound result 0\n  Bound result 0\n  Bound result 4719\n  Bound result 127\n  Bound result 40\n  Bound result 5\n  Bound result 5963\n  Bound result 9\n  Bound result 2112\n  Bound result 327444860904278721\n  Bound result 0\n  Bound result 4668\n  Bound result 3\n  Bound result 0\n  Bound result 12\n  Bound result 4807\n  Bound result 983\n  Bound result 4\n  Bound result 10835\n  Bound result 3504860241431\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 6.32s (6.32s CPU time)\n\nRan 3 test suites in 6.32s (6.37s CPU time): 33 tests passed, 0 failed, 0 skipped (33 total tests)\n","passed":true},{"durationMs":66,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"CoinbaseToken.approve(address,uint256)\",\"CoinbaseToken.transfer(address,uint256)\",\"CoinbaseToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"DEPENDENCIES.md\":10,\"DEPENDENCIES.sha256\":36,\"README.md\":77,\"foundry.toml\":22,\"launch.json\":24,\"remappings.txt\":2,\"src/CoinbaseToken.sol\":17,\"test/CoinbaseToken.invariant.t.sol\":95,\"test/CoinbaseToken.launch.t.sol\":57,\"test/CoinbaseToken.t.sol\":397,\"test/helpers/TokenFactory.sol\":11},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"90a67660cabf786415d363d04fe8270e183c71ad34ab143daa1de19a428af8a5","verifiedTreeHash":"0603789f82d7005e8de3618b1011130d16513856","verifierVersion":"0.1.0+c3fba9eb"},{"checks":[{"durationMs":1598,"exitCode":0,"name":"build","output":"Compiling 30 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.51s\nCompiler run successful!\n","passed":true},{"durationMs":5530,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 1 test for test/CoinbaseToken.launch.t.sol:CoinbaseTokenLaunchTest\n[PASS] test_distributionClaimsAndPoolTransfersDeliverExactAmounts() (gas: 437527)\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 853.73µs (213.15µs CPU time)\n\nRan 31 tests for test/CoinbaseToken.t.sol:CoinbaseTokenTest\n[PASS] testFuzz_approvalAndDelegatedTransfer(uint256,uint256) (runs: 1000, μ: 163595, ~: 165306)\nLogs:\n  Bound result 476\n  Bound result 70\n\n[PASS] testFuzz_overspendingRevertsAndPreservesState(uint256,uint256) (runs: 1000, μ: 137704, ~: 137769)\nLogs:\n  Bound result 3999635743\n  Bound result 1000000000000000000000000000\n\n[PASS] testFuzz_spendingBeyondAllowanceReverts(uint256,uint256) (runs: 1000, μ: 123220, ~: 123450)\nLogs:\n  Bound result 476\n  Bound result 7702\n\n[PASS] testFuzz_transferPreservesSupplyAndExactBalances(uint256) (runs: 1000, μ: 94148, ~: 94304)\nLogs:\n  Bound result 786527649208888823706256148\n\n[PASS] test_approveEmitsEventAndOverwritesAllowance() (gas: 131872)\n[PASS] test_approveZeroAddressReverts() (gas: 37552)\n[PASS] test_constructorEmitsExactlyOneMintEvent() (gas: 9741)\n[PASS] test_create2DeploymentMintsToFactoryNotTransactionOrigin() (gas: 236053)\n[PASS] test_deployerCannotSpendHolderFundsWithoutApproval() (gas: 157904)\n[PASS] test_entireSupplyCanMoveAndReturn() (gas: 159510)\n[PASS] test_exhaustedAllowanceCannotBeReused() (gas: 161662)\n[PASS] test_infiniteAllowanceIsNotDecremented() (gas: 214613)\n[PASS] test_insufficientBalanceRevertsWithoutChangingBalances() (gas: 120027)\n[PASS] test_maximumTransferCannotOverflowBalances() (gas: 54955)\n[PASS] test_metadataAndEntireSupplyBelongToDeployer() (gas: 107693)\n[PASS] test_noMintBurnOrAdministrativeEntryPoints() (gas: 5516139)\n[PASS] test_revocationPreventsFurtherSpending() (gas: 141273)\n[PASS] test_runtimeIsDeployableAndHasNoForbiddenOpcodes() (gas: 1031383)\n[PASS] test_selfTransferDoesNotChangeBalance() (gas: 51475)\n[PASS] test_transferEmitsEventAndMovesExactAmount() (gas: 91549)\n[PASS] test_transferFromInsufficientAllowanceIsAtomic() (gas: 115687)\n[PASS] test_transferFromInsufficientBalanceRestoresAllowance() (gas: 188764)\n[PASS] test_transferFromMovesExactAmountAndConsumesAllowance() (gas: 159928)\n[PASS] test_transferFromRequiresAllowanceEvenWhenCallerOwnsTokens() (gas: 42574)\n[PASS] test_transferFromToSelfConsumesAllowanceWithoutChangingBalance() (gas: 109500)\n[PASS] test_transferFromToZeroRestoresAllowance() (gas: 114025)\n[PASS] test_transferToZeroRevertsEvenForZeroAmount() (gas: 71904)\n[PASS] test_unknownSelectorAndNativeEtherAreRejected() (gas: 64658)\n[PASS] test_zeroSourceCannotCreateTokensThroughTransferFrom() (gas: 80045)\n[PASS] test_zeroTransferFromEmptyAccountEmitsEvent() (gas: 63080)\n[PASS] test_zeroTransferFromNeedsNoPositiveAllowance() (gas: 81448)\nSuite result: ok. 31 passed; 0 failed; 0 skipped; finished in 89.78ms (348.20ms CPU time)\n\nRan 9 tests for test/CoinbaseToken.properties.t.sol:CoinbaseTokenPropertiesTest\n[PASS] testFuzz_allowancesAreIsolatedByBothOwnerAndSpender(uint256,uint256,uint256) (runs: 1000, μ: 589974, ~: 590942)\nLogs:\n  Bound result 326367\n  Bound result 105238\n\n[PASS] testFuzz_delegatedRoundTripRestoresBalancesButNotAllowances(uint256) (runs: 1000, μ: 388061, ~: 387641)\nLogs:\n  Bound result 496\n\n[PASS] testFuzz_failedTransferFromCanBeRetriedAfterFunding(uint256,bool) (runs: 1000, μ: 318351, ~: 318478)\nLogs:\n  Bound result 882508870\n\n[PASS] testFuzz_splitDelegatedSpendingMatchesSingleSpend(uint256,uint256,uint256,bool) (runs: 1000, μ: 374391, ~: 370720)\nLogs:\n  Bound result 242\n  Bound result 17\n  Bound result 18796\n\n[PASS] test_maxMinusOneAllowanceIsFiniteAndOneSmallestUnitIsSpendable() (gas: 225471)\n[PASS] test_selfApprovalIsRequiredAndConsumedLikeAnyOtherApproval() (gas: 248560)\n[PASS] test_unlimitedAllowanceCanBeReducedThenRevoked() (gas: 381180)\n[PASS] test_unlimitedAllowanceDoesNotAuthorizeMaximumTransferBeyondSupply() (gas: 220181)\n[PASS] test_zeroTransferFromToZeroRevertsEvenWithUnlimitedApproval() (gas: 121662)\nSuite result: ok. 9 passed; 0 failed; 0 skipped; finished in 89.87ms (348.09ms CPU time)\n\nRan 1 test for test/CoinbaseToken.invariant.t.sol:CoinbaseTokenInvariantTest\n[PASS]\nCoinbaseTokenInvariantTest invariants:\n[PASS] invariant_balancesAndAllowancesMatchIndependentLedger\n[PASS] invariant_supplyIsFixedAndAllBalancesAreAccountedFor\n CoinbaseTokenInvariantTest invariants (runs: 256, calls: 16384, reverts: 0)\n\n╭--------------+-----------------------------+-------+---------+----------╮\n| Contract     | Selector                    | Calls | Reverts | Discards |\n+=========================================================================+\n| TokenHandler | approve                     | 1446  | 0       | 0        |\n|--------------+-----------------------------+-------+---------+----------|\n| TokenHandler | approveBoundary             | 1499  | 0       | 0        |\n|--------------+-----------------------------+-------+---------+----------|\n| TokenHandler | approveZeroSpender          | 1501  | 0       | 0        |\n|--------------+-----------------------------+-------+---------+----------|\n| TokenHandler | transfer                    | 1532  | 0       | 0        |\n|--------------+-----------------------------+-------+---------+----------|\n| TokenHandler | transferAll                 | 1495  | 0       | 0        |\n|--------------+-----------------------------+-------+---------+----------|\n| TokenHandler | transferFrom                | 1522  | 0       | 0        |\n|--------------+-----------------------------+-------+---------+----------|\n| TokenHandler | transferFromBeyondAllowance | 1458  | 0       | 0        |\n|--------------+-----------------------------+-------+---------+----------|\n| TokenHandler | transferFromBeyondBalance   | 1537  | 0       | 0        |\n|--------------+-----------------------------+-------+---------+----------|\n| TokenHandler | transferFromToZero          | 1439  | 0       | 0        |\n|--------------+-----------------------------+-------+---------+----------|\n| TokenHandler | transferToZero              | 1431  | 0       | 0        |\n|--------------+-----------------------------+-------+---------+----------|\n| TokenHandler | transferTooMuch             | 1524  | 0       | 0        |\n╰--------------+-----------------------------+-------+---------+----------╯\n\nLogs:\n  Bound result 4\n  Bound result 107079783117362\n  Bound result 0\n  Bound result 1272\n  Bound result 1490\n  Bound result 0\n  Bound result 8787\n  Bound result 5030\n  Bound result 724556454840622872148520687\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 11582193902664056649656187677721104224410076214734\n  Bound result 0\n  Bound result 115792089237316195423570985008687907853269984665639571893798774793452428927976\n  Bound result 0\n  Bound result 0\n  Bound result 1768961820008383544575\n  Bound result 1\n  Bound result 0\n  Bound result 1000000000000000000000000000\n  Bound result 0\n  Bound result 4\n  Bound result 9653\n  Bound result 0\n  Bound result 0\n  Bound result 2\n  Bound result 96\n  Bound result 25000000000000000000\n  Bound result 115792089237316195423570985008687907853269984665639564039457584007913129647564\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 2\n  Bound result 1\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 5.42s (5.42s CPU time)\n\nRan 4 test suites in 5.43s (5.61s CPU time): 42 tests passed, 0 failed, 0 skipped (42 total tests)\n","passed":true},{"durationMs":41,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"CoinbaseToken.approve(address,uint256)\",\"CoinbaseToken.transfer(address,uint256)\",\"CoinbaseToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"DEPENDENCIES.md\":10,\"DEPENDENCIES.sha256\":36,\"README.md\":77,\"foundry.toml\":22,\"remappings.txt\":2,\"src/CoinbaseToken.sol\":17,\"test/CoinbaseToken.invariant.t.sol\":244,\"test/CoinbaseToken.launch.t.sol\":57,\"test/CoinbaseToken.properties.t.sol\":236,\"test/CoinbaseToken.t.sol\":397,\"test/helpers/TokenFactory.sol\":11},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"af62acc5a67448552aa62f48cda75ce29e5a798c9d60a46f6cb0241dd2a141c6","verifiedTreeHash":"0e0df3b4269cf4943045a29e3e6fc667317e9e01","verifierVersion":"0.1.0+c3fba9eb"},{"checks":[{"durationMs":2655,"exitCode":0,"name":"build","output":"Compiling 29 files with Solc 0.8.26\nSolc 0.8.26 finished in 2.50s\nCompiler run successful!\n","passed":true},{"durationMs":8021,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 1 test for test/CoinbaseToken.launch.t.sol:CoinbaseTokenLaunchTest\n[PASS] test_distributionClaimsAndPoolTransfersDeliverExactAmounts() (gas: 437527)\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 2.34ms (907.64µs CPU time)\n\nRan 31 tests for test/CoinbaseToken.t.sol:CoinbaseTokenTest\n[PASS] testFuzz_approvalAndDelegatedTransfer(uint256,uint256) (runs: 1000, μ: 163630, ~: 165306)\nLogs:\n  Bound result 80702494884482682886032020\n  Bound result 17221970721580212076\n\n[PASS] testFuzz_overspendingRevertsAndPreservesState(uint256,uint256) (runs: 1000, μ: 137682, ~: 137757)\nLogs:\n  Bound result 3999635743\n  Bound result 1000000000000000000000000000\n\n[PASS] testFuzz_spendingBeyondAllowanceReverts(uint256,uint256) (runs: 1000, μ: 123212, ~: 123448)\nLogs:\n  Bound result 476\n  Bound result 7702\n\n[PASS] testFuzz_transferPreservesSupplyAndExactBalances(uint256) (runs: 1000, μ: 94124, ~: 94292)\nLogs:\n  Bound result 2\n\n[PASS] test_approveEmitsEventAndOverwritesAllowance() (gas: 131872)\n[PASS] test_approveZeroAddressReverts() (gas: 37552)\n[PASS] test_constructorEmitsExactlyOneMintEvent() (gas: 9741)\n[PASS] test_create2DeploymentMintsToFactoryNotTransactionOrigin() (gas: 236053)\n[PASS] test_deployerCannotSpendHolderFundsWithoutApproval() (gas: 157904)\n[PASS] test_entireSupplyCanMoveAndReturn() (gas: 159510)\n[PASS] test_exhaustedAllowanceCannotBeReused() (gas: 161662)\n[PASS] test_infiniteAllowanceIsNotDecremented() (gas: 214613)\n[PASS] test_insufficientBalanceRevertsWithoutChangingBalances() (gas: 120027)\n[PASS] test_maximumTransferCannotOverflowBalances() (gas: 54955)\n[PASS] test_metadataAndEntireSupplyBelongToDeployer() (gas: 107693)\n[PASS] test_noMintBurnOrAdministrativeEntryPoints() (gas: 5516139)\n[PASS] test_revocationPreventsFurtherSpending() (gas: 141273)\n[PASS] test_runtimeIsDeployableAndHasNoForbiddenOpcodes() (gas: 1031383)\n[PASS] test_selfTransferDoesNotChangeBalance() (gas: 51475)\n[PASS] test_transferEmitsEventAndMovesExactAmount() (gas: 91549)\n[PASS] test_transferFromInsufficientAllowanceIsAtomic() (gas: 115687)\n[PASS] test_transferFromInsufficientBalanceRestoresAllowance() (gas: 188764)\n[PASS] test_transferFromMovesExactAmountAndConsumesAllowance() (gas: 159928)\n[PASS] test_transferFromRequiresAllowanceEvenWhenCallerOwnsTokens() (gas: 42574)\n[PASS] test_transferFromToSelfConsumesAllowanceWithoutChangingBalance() (gas: 109500)\n[PASS] test_transferFromToZeroRestoresAllowance() (gas: 114025)\n[PASS] test_transferToZeroRevertsEvenForZeroAmount() (gas: 71904)\n[PASS] test_unknownSelectorAndNativeEtherAreRejected() (gas: 64658)\n[PASS] test_zeroSourceCannotCreateTokensThroughTransferFrom() (gas: 80045)\n[PASS] test_zeroTransferFromEmptyAccountEmitsEvent() (gas: 63080)\n[PASS] test_zeroTransferFromNeedsNoPositiveAllowance() (gas: 81448)\nSuite result: ok. 31 passed; 0 failed; 0 skipped; finished in 50.41ms (219.88ms CPU time)\n\nRan 1 test for test/CoinbaseToken.invariant.t.sol:CoinbaseTokenInvariantTest\n[PASS]\nCoinbaseTokenInvariantTest invariants:\n[PASS] invariant_balancesAndAllowancesMatchIndependentLedger\n[PASS] invariant_supplyIsFixedAndAllBalancesAreAccountedFor\n CoinbaseTokenInvariantTest invariants (runs: 256, calls: 16384, reverts: 0)\n\n╭--------------+--------------+-------+---------+----------╮\n| Contract     | Selector     | Calls | Reverts | Discards |\n+==========================================================+\n| TokenHandler | approve      | 5455  | 0       | 0        |\n|--------------+--------------+-------+---------+----------|\n| TokenHandler | transfer     | 5456  | 0       | 0        |\n|--------------+--------------+-------+---------+----------|\n| TokenHandler | transferFrom | 5473  | 0       | 0        |\n╰--------------+--------------+-------+---------+----------╯\n\nLogs:\n  Bound result 0\n  Bound result 0\n  Bound result 15\n  Bound result 0\n  Bound result 0\n  Bound result 8\n  Bound result 206014920760115881997112768\n  Bound result 0\n  Bound result 1\n  Bound result 296885182627849795103276778\n  Bound result 127\n  Bound result 3\n  Bound result 25\n  Bound result 0\n  Bound result 20\n  Bound result 6692486444835\n  Bound result 2\n  Bound result 12\n  Bound result 10\n  Bound result 1797900577765\n  Bound result 0\n  Bound result 0\n  Bound result 4719\n  Bound result 127\n  Bound result 40\n  Bound result 5\n  Bound result 5963\n  Bound result 9\n  Bound result 2112\n  Bound result 59910087547440738\n  Bound result 0\n  Bound result 4668\n  Bound result 3\n  Bound result 0\n  Bound result 12\n  Bound result 4807\n  Bound result 983\n  Bound result 4\n  Bound result 10835\n  Bound result 3504860241431\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 7.87s (7.87s CPU time)\n\nRan 3 test suites in 7.87s (7.92s CPU time): 33 tests passed, 0 failed, 0 skipped (33 total tests)\n","passed":true},{"durationMs":77,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"CoinbaseToken.approve(address,uint256)\",\"CoinbaseToken.transfer(address,uint256)\",\"CoinbaseToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"DEPENDENCIES.md\":10,\"DEPENDENCIES.sha256\":36,\"README.md\":77,\"foundry.toml\":22,\"remappings.txt\":2,\"src/CoinbaseToken.sol\":17,\"test/CoinbaseToken.invariant.t.sol\":95,\"test/CoinbaseToken.launch.t.sol\":57,\"test/CoinbaseToken.t.sol\":397,\"test/helpers/TokenFactory.sol\":11},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true},{"durationMs":829,"exitCode":0,"name":"slither","output":"slither: no results at low impact or above","passed":true},{"durationMs":336,"exitCode":0,"name":"aderyn","output":"[low] large-numeric-literal at src/CoinbaseToken.sol:10: Large Numeric Literal","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"d8bd6394f363b3258d87deb3b6ae50c212b5b36f9157b20b28eae2e042421a4c","verifiedTreeHash":"cbe6ebc1b81c015494ad4aef26b3f9b64a4b1cc4","verifierVersion":"0.1.0+c3fba9eb"}]}