{"assessments":[],"deployments":[],"fuzz":[],"identity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"interpretation":"Records acceptance and evidence. Neither completion nor an AI assessment establishes correctness, safety, or independent review.","jobId":"20286bd1-41b4-4c6b-99f9-712a86a4f94f","kind":"shape:chain","nodes":[{"acceptedSubmissionHash":"162b014f3b8463fe4916ac68789aed1570a5364d4dc99aba7039c4b63dd9a28c","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_economics","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"aae4e8b9061e79158b6b4d8baf1d737d2aa0ce1f587c56f7de49c418d4654f53","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_flow","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"7813a05d73ea5515b787ad1ccf386fe73868f1a4d03eaefb4508ba1e9e0eef47","dependsOn":["build_contract_project","write_foundry_tests","manifest","audit_math","audit_permissions","audit_economics","audit_flow"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"af3aa01159bbf354f621cafa5c0006f6169e0938a8b015be508b7377dbf165bc","skillId":"audit-judge","tools":[]},"key":"audit_judge","kind":"code","role":"review","skillHash":"af3aa01159bbf354f621cafa5c0006f6169e0938a8b015be508b7377dbf165bc","skillId":"audit-judge","state":"accepted"},{"acceptedSubmissionHash":"a71e86ea17a8afa9cc0818bcc5f3dde7cf89c48760c72f595073548b65a5e6d4","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_math","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"38612130eeb2d9010ed5e6d80c6873a916ea3fc252c0b87f860f3b3bdcd0a68e","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_permissions","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"23eb529926a33466d8c4ea1df80dd9f11cc85a96159969ab62a4c7c071b26047","dependsOn":[],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"6b8d2c2ebd3301cff2be8edb1e1cc6ba65c858c02fe7247be81722b969842265","skillId":"build-contract-project","tools":[]},"key":"build_contract_project","kind":"code","role":"implement","skillHash":"6b8d2c2ebd3301cff2be8edb1e1cc6ba65c858c02fe7247be81722b969842265","skillId":"build-contract-project","state":"accepted"},{"acceptedSubmissionHash":"4f676c2d923d31e8790e3292705a602b3455a35ea22664c6c0188c81b60d9f39","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"tools":[]},"key":"manifest","kind":"code","role":"integrate","skillHash":null,"skillId":null,"state":"accepted"},{"acceptedSubmissionHash":"9bc6b3cd7da1b16b46cefb28f5f81edd2031ea1d50c5f1812b6054e29f78cfeb","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"4c76766b00591dfe982fe85d3de589fdb2f810e5137c301155d1c5e36a1d3b23","skillId":"write-foundry-tests","tools":[]},"key":"write_foundry_tests","kind":"code","role":"tests","skillHash":"4c76766b00591dfe982fe85d3de589fdb2f810e5137c301155d1c5e36a1d3b23","skillId":"write-foundry-tests","state":"accepted"}],"objective":"A custom token: Company.md (COMD).\nToken name: Company.md\nToken symbol: COMD\nToken supply: 1,000,000,000 with 18 decimals, all minted once to the deployer in the constructor.","parentJobId":null,"planHash":"3fb54b0b0aa513dd6ecfb74aa1eb046564c5ffc0890ad31d452304f332bafc5a","previousHash":"0000000000000000000000000000000000000000000000000000000000000000","projectId":"20286bd1-41b4-4c6b-99f9-712a86a4f94f","publication":{"commit":null,"deliveredAt":null,"repoUrl":"https://github.com/identity-md-launches/launch-1763-company-md"},"receiptIdentity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"registry":"0xb6d0a187b050fa5bb0b87033a203f37becf4a775","research":[],"schema":"identitymd-work-v1","signals":[{"agentId":"51146","feedbackHash":"b3bbf6d48ff833d9dd16e9abf570ad2704e07af94855edc2fcad423403fab63f","nodeKey":"audit_economics","submissionHash":"162b014f3b8463fe4916ac68789aed1570a5364d4dc99aba7039c4b63dd9a28c","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52179","feedbackHash":"3cf29ac98ac696bc36c1425d95f5e6ba9ac840d0b0e3e9a3d83e0b32fba6093c","nodeKey":"audit_flow","submissionHash":"aae4e8b9061e79158b6b4d8baf1d737d2aa0ce1f587c56f7de49c418d4654f53","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52082","feedbackHash":"1b167e40cfb6c9d2fa1e8828ef7ed4c75a80f6e72258115d0fbf62e6c4c8fdad","nodeKey":"audit_judge","submissionHash":"7813a05d73ea5515b787ad1ccf386fe73868f1a4d03eaefb4508ba1e9e0eef47","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51316","feedbackHash":"0dc96478558f29fd0ae78d250fec03ef7fa36c053aafb00902a491134cc65a3d","nodeKey":"audit_math","submissionHash":"a71e86ea17a8afa9cc0818bcc5f3dde7cf89c48760c72f595073548b65a5e6d4","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51476","feedbackHash":"4a7e06467edcf563145ba6d560d4cac398a36ae7daccfb16675f895b9ef95126","nodeKey":"audit_permissions","submissionHash":"38612130eeb2d9010ed5e6d80c6873a916ea3fc252c0b87f860f3b3bdcd0a68e","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51037","feedbackHash":"ef509132cf4225279e98c915df093688302dae7f52b1634d66071db8cfcec7c6","nodeKey":"build_contract_project","submissionHash":"23eb529926a33466d8c4ea1df80dd9f11cc85a96159969ab62a4c7c071b26047","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"51333","feedbackHash":"dad4df39bc22f4392264cf515b7d995887bd2174b8fd1bdda7e5cd33757deb32","nodeKey":"manifest","submissionHash":"4f676c2d923d31e8790e3292705a602b3455a35ea22664c6c0188c81b60d9f39","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"51389","feedbackHash":"9b64c76942b5157e84b18a91f0a7c6a38a4d88c4ed48e27a490c04354e7769a1","nodeKey":"write_foundry_tests","submissionHash":"9bc6b3cd7da1b16b46cefb28f5f81edd2031ea1d50c5f1812b6054e29f78cfeb","tag1":"verification:checks","tag2":"acceptance-v2","value":1}],"site":null,"snapshotHash":"52c1a3266220321ee98bcce0f5dcc5fec42564949b8155c70535cab39f8dcf14","state":"completed","submissions":[{"artifacts":[],"attempt":1,"bundleHash":null,"device":"824e6de6196c686f","findings":[{"citation":"resolved","description":"DEPENDENCIES.md states that every vendored file is byte-identical to its pinned upstream release and tells a verifier to confirm this with `sha256sum --check DEPENDENCIES.sha256` (line 22). That command fails on the committed tree: seven files under lib/forge-std/src/ (StdJson.sol, StdToml.sol, StdAssertions.sol, Vm.sol, console.sol, interfaces/IMulticall3.sol, interfaces/IERC7540.sol) have different hashes from the ones recorded. I downloaded the forge-std v1.9.7 archive named in DEPENDENCIES.md (its SHA-256 matches the one recorded, 45157353...ee94) and compared: the seven vendored files differ from upstream only in whitespace and line breaks (identical after stripping all whitespace), consistent with `forge fmt` having been run over lib/ after the hash list was generated. All six vendored OpenZeppelin v5.4.0 files match upstream byte for byte, so the deployed token's dependency is unmodified; the mismatch is confined to test-only code. Impact: the provenance claim in DEPENDENCIES.md is false for forge-std, and any reviewer, CI step or verifier that follows the documented check gets a hard failure and cannot distinguish this benign reformat from a tampered helper library. Not an economic or on-chain defect. Minimal fix: either regenerate DEPENDENCIES.sha256 from the current tree and amend DEPENDENCIES.md to say forge-std was reformatted with `forge fmt`, or restore the seven files from the v1.9.7 archive (and exclude lib/ from `forge fmt`, e.g. via `fmt.ignore` in foundry.toml) so the existing hash list is true. Either keeps the token and tests unchanged.","line":5,"path":"DEPENDENCIES.md","reproduction":"State: a clean checkout of commit a8d8b2b (git status --porcelain is empty). Input: run `sha256sum --check DEPENDENCIES.sha256` from the repository root, exactly as DEPENDENCIES.md line 22 instructs. Expected per DEPENDENCIES.md: all 36 lines report OK. Actual: 29 OK and 7 FAILED (lib/forge-std/src/StdJson.sol, lib/forge-std/src/interfaces/IMulticall3.sol, lib/forge-std/src/console.sol, lib/forge-std/src/Vm.sol, lib/forge-std/src/interfaces/IERC7540.sol, lib/forge-std/src/StdAssertions.sol, lib/forge-std/src/StdToml.sol), with the summary `sha256sum: WARNING: 7 computed checksums did NOT match`. Cross-check: fetch https://codeload.github.com/foundry-rs/forge-std/tar.gz/refs/tags/v1.9.7 (SHA-256 45157353ab49eab01d294565866731e599b32401757229689ee459aa26b7ee94, as recorded), extract, and `cmp` each vendored file against the archive: the same seven differ; `cmp <(tr -d '[:space:]' < upstream) <(tr -d '[:space:]' < vendored)` reports them identical, so the difference is formatting only. The six lib/openzeppelin-contracts files are byte-identical to the v5.4.0 archive.","severity":"low","snippet":"contents and license notices are unmodified.","title":"Documented dependency integrity check fails: 7 vendored forge-std files do not match DEPENDENCIES.sha256 or upstream v1.9.7 bytes"}],"hash":"162b014f3b8463fe4916ac68789aed1570a5364d4dc99aba7039c4b63dd9a28c","nodeId":"698ce613-805a-48eb-9610-c061b97d29e8","outcome":"completed","summary":"Review complete. The findings file is written and valid, scratch files are removed, and `git status --porcelain` shows nothing outside the allowed output.\n\n**Outcome:** the token has no economic, invariant, or flow-gap defect. One low-severity provenance finding is recorded.\n\n**What I checked**\n\n- The contract is a 16-line wrapper over OpenZeppelin v5.4.0 ERC20 that mints exactly 10^27 base units to the deployer in the constructor. I confirmed the six vendored OpenZeppelin files are byte-identical to the v5.4.0 release archive, so the transfer, approval and allowance semantics are the stock ones.\n- Economic Security guide: no fee, rebase, pause, blacklist, callback or mint path exists. Sentinel-address calls revert rather than burning or silently succeeding. The whole supply fits under the Uniswap v4 int128 delta bound.\n- Invariant guide: total supply is fixed after construction and the sum of balances conserves it. The project's 128x64 stateful invariant run and the privileged-selector probes pass with the README's seed.\n- Flow Gap guide: I ran a scratch test that moves the 10% swarm share, seeds 80% to a manager both by direct push and allowance pull, forwards the remainder, performs integer-split claims for 3 wallets and 7 seats, and round-trips a trader buy and sell. Every leg arrives exact.\n- All three listed entry points are marked `holds` with reasons, plus rows for the invariants, native ETH rejection and the not-yet-written manifest.\n\n**Finding (low):** the documented check `sha256sum --check DEPENDENCIES.sha256` fails on the clean checkout. Seven forge-std files differ from the recorded hashes and from upstream v1.9.7, but only in whitespace, consistent with a formatter pass over lib/. This is test-only code and does not affect the deployed token. The fix is either to regenerate the hash list and note the reformat, or to restore the seven files and exclude lib/ from formatting.\n\n**Not reached:** launch.json does not exist yet, so its contents could not be reviewed. The README's stated manifest parameters are consistent with the source and ABI.","treeHash":null,"usage":{"cachedInputTokens":1673932,"inputTokens":738,"model":"claude-fable-5-1","outputTokens":16189,"runtime":"claude","turns":24,"wallClockMs":250217}},{"artifacts":[],"attempt":1,"bundleHash":"ecf9a0b2856b9cb155927c65935b7b9f24dda4a6828d760bee7dd1be3356d8b2","device":"a8f78934be011e4c","findings":[],"hash":"23eb529926a33466d8c4ea1df80dd9f11cc85a96159969ab62a4c7c071b26047","nodeId":"a91338ec-2c5f-44e0-8fd8-2b4d30869fc9","outcome":"completed","summary":"Implemented `CompanyToken`: Company.md (COMD), 18 decimals, with 1,000,000,000 tokens minted once to the deployer.\n\nValidation passed:\n\n- `forge build` with Solidity 0.8.26\n- `forge test` with the required fuzz seed\n- `forge fmt --check`\n- Clean offline build and tests with identical bytecode\n\nDependencies are vendored. Assumptions, deployment parameters, and operational responsibilities are documented in `README.md`.","treeHash":"95dcd9d98cf3f1a5ffd58d53ce6172858cf6659c","usage":{"cachedInputTokens":478976,"inputTokens":61407,"model":"gpt-6-astra","outputTokens":15014,"runtime":"codex","turns":5,"wallClockMs":368967}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"e9049e5b12ba53ba","findings":[],"hash":"38612130eeb2d9010ed5e6d80c6873a916ea3fc252c0b87f860f3b3bdcd0a68e","nodeId":"74200f5e-fbfd-4d02-b5e0-c0f529433f91","outcome":"completed","summary":"I found no defects in the permissions area of `CompanyToken`, so `.imd-findings.json` holds an empty findings list and a full coverage record. No other files were changed.\n\n**What the token is:** `src/CompanyToken.sol` is OpenZeppelin v5.4.0's standard `ERC20` with nothing overridden. Its constructor takes no arguments and mints `1_000_000_000 * 10**18` once to `msg.sender`, which is the factory.\n\n**Coverage, all three entry points marked `holds`:**\n- **`approve`:** an account can only set its own allowances, and a zero spender is rejected. Nothing lets anyone set an allowance for someone else.\n- **`transfer`:** it only moves the caller's own balance. There is no fee, pause, blacklist or exemption list, so the transfers to the factory, the distributor and the pool manager arrive exact.\n- **`transferFrom`:** the allowance is checked and spent before the balance moves, and the call reverts if the allowance is too small. Nothing bypasses it, so nobody can move a holder's tokens without that holder's approval.\n\n**The three guides:**\n- **Access control:** the token has no owner, roles, mint, burn, pause or upgrade function.\n- **Trust gap:** after deployment no address holds any power over the token.\n- **Asymmetry:** every address is treated the same way.\n\nThe supply is fixed, because minting and burning can't be reached after the constructor runs.\n\n**Checks run:** the vendored OpenZeppelin files match their recorded SHA-256 hashes, so the library code is unmodified. The project's own 35 tests pass. The static-analysis lead (a large number at `src/CompanyToken.sol:11`) is a style note; the value equals exactly 1e27, so it isn't a defect.\n\n**Outside my area:** 7 of the vendored forge-std test-helper files don't match their hashes in `DEPENDENCIES.sha256`, although `DEPENDENCIES.md` says the vendored files are unmodified. This doesn't affect the deployed token. I didn't report it because it's outside my area and `lib/` can't be changed by this task.","treeHash":null,"usage":{"cachedInputTokens":227328,"inputTokens":12,"model":"claude-opus-5-5","outputTokens":2678,"runtime":"claude","turns":6,"wallClockMs":33182}},{"artifacts":[],"attempt":1,"bundleHash":"3b268479a5a2aad18d6b31a0ecf9b980a32b20298a104ca89101929ae1557167","device":"41f7c1458e1278ad","findings":[],"hash":"4f676c2d923d31e8790e3292705a602b3455a35ea22664c6c0188c81b60d9f39","nodeId":"407889f6-2a0e-47d6-ab6d-fca5c9b22d08","outcome":"completed","summary":"The deliverable is complete: `launch.json` is written, verified, and committed. No other file changed.\n\n**What the manifest describes.** The accepted tree contains one contract, `CompanyToken` in `src/CompanyToken.sol`. Its constructor takes no arguments and mints the full supply once to msg.sender, so the manifest lists an empty constructorArgs and a totalSupply of 10^27 minor units. There are no application contracts, so the contracts array is empty. The pool block and the economics block are copied exactly as the launch reference gives them, with the IMD pair address, fee 12500, tick spacing 60 and the one-to-one provenance price. Notes run just over a thousand characters and describe only what is actually in the tree.\n\n**Checks run.**\n\n- A JSON check confirmed kind, the exact key set, the supply string, the verbatim economics object and the notes length.\n- `forge build` compiled cleanly with Solidity 0.8.26.\n- `forge test` with the verifier's fuzz seed passed all 35 tests across both suites.\n- `forge inspect` confirmed the constructor ABI is `constructor()` with no parameters, matching the manifest.\n- `git status` showed launch.json as the only change, now committed as 2611318.\n\nThe protected tests themselves cannot run here because they import the network's factory harness, which lives outside this tree. They will run during independent verification with the manifest's values resolved into environment variables.","treeHash":"e803e6f1f34b03f674d5e638dbb49e3293e16389","usage":{"cachedInputTokens":224941,"inputTokens":162,"model":"claude-fable-5-1","outputTokens":3317,"runtime":"claude","turns":9,"wallClockMs":147792}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"401c4383398af47c","findings":[{"citation":"resolved","description":"Merged from audit_economics, audit_flow and audit_math (same root cause). DEPENDENCIES.md states every vendored file is unmodified and tells a verifier to confirm it with `sha256sum --check DEPENDENCIES.sha256` (line 22). On the committed tree that command fails for seven files under lib/forge-std/src/: StdJson.sol, StdToml.sol, StdAssertions.sol, Vm.sol, console.sol, interfaces/IMulticall3.sol, interfaces/IERC7540.sol. I downloaded both release archives named in DEPENDENCIES.md into a scratch directory: their SHA-256 match the recorded values (OZ b89829be...50d1, forge-std 45157353...ee94). The hashes in DEPENDENCIES.sha256 are the genuine upstream v1.9.7 hashes (upstream Vm.sol = 9068805b...2cb1 exactly as recorded at DEPENDENCIES.sha256 line 21), so the seven vendored copies were edited after the hash list was written. Comparing each with all whitespace stripped shows them identical to upstream: the differences are forge-fmt style line re-wrapping only. All five vendored OpenZeppelin v5.4.0 files (ERC20.sol, IERC20.sol, IERC20Metadata.sol, Context.sol, draft-IERC6093.sol) are byte-identical to upstream, so the deployed token's only dependency is unmodified. Impact is provenance only: the project's own documented integrity check fails, and a reviewer or CI step following it cannot distinguish this benign reformat from a tampered test helper without redoing the upstream diff. forge-std is test-only and not part of the deployed bytecode. Minimal fix (either): restore the seven files byte-for-byte from the v1.9.7 archive and keep lib/ out of `forge fmt` (fmt.ignore in foundry.toml); or regenerate DEPENDENCIES.sha256 from the tree and amend DEPENDENCIES.md to say forge-std was reformatted with forge fmt. Neither changes the token or the tests' behaviour.","line":5,"path":"DEPENDENCIES.md","reproduction":"State: clean checkout (git status --porcelain empty). Input: from the repository root run `sha256sum --check DEPENDENCIES.sha256` exactly as DEPENDENCIES.md line 22 instructs. Expected per DEPENDENCIES.md lines 5 and 19: all 36 lines OK, exit 0. Actual: 29 OK and 7 FAILED (lib/forge-std/src/StdJson.sol, interfaces/IMulticall3.sol, console.sol, Vm.sol, interfaces/IERC7540.sol, StdAssertions.sol, StdToml.sol) with `sha256sum: WARNING: 7 computed checksums did NOT match`, exit 1. Example: `sha256sum lib/forge-std/src/Vm.sol` gives a1b1c82924aecf0f38b53192fd1e801cccc1e1fd2ecd6b2301e4f4c4ab102a15 while DEPENDENCIES.sha256 line 21 records 9068805b59ac1d0ea03a8fa1f15ae49c094e0c6c852a2500e0dd112f264b2cb1. Cross-check: fetch https://codeload.github.com/foundry-rs/forge-std/tar.gz/refs/tags/v1.9.7 (SHA-256 45157353ab49eab01d294565866731e599b32401757229689ee459aa26b7ee94), extract, and for each of the seven files `cmp <(tr -d '[:space:]' < upstream) <(tr -d '[:space:]' < vendored)` reports identical, so the difference is whitespace only. The OpenZeppelin v5.4.0 archive (SHA-256 b89829be48bc501051002191733268a93ef6e238a4bb65d8fd1cbdf3969050d1) extracted and `cmp` against each vendored OZ file reports identical bytes.","severity":"low","snippet":"contents and license notices are unmodified.","title":"Documented dependency integrity check fails: 7 vendored forge-std files do not match DEPENDENCIES.sha256 (whitespace-only reformat of test helpers; token runtime unaffected)"},{"citation":"resolved","description":"From audit_flow; reproduced. CompanyToken inherits OpenZeppelin v5.4.0 ERC20 unmodified and overrides nothing. In ERC20._spendAllowance (lib/openzeppelin-contracts/contracts/token/ERC20/ERC20.sol lines 294-304) a zero value never fails the `currentAllowance < value` check, and _update accepts value 0 from any non-zero `from`, so transferFrom(victim, lookalike, 0) succeeds for any caller with no allowance and emits Transfer(victim, lookalike, 0). This is the ERC-20 standard's required behaviour (zero-value transfers are normal transfers and fire the event) and OpenZeppelin's documented choice; balances and allowances are untouched, so it is not an accounting defect and the token needs no change. README.md lines 24-25 already state that zero-value transfers between valid addresses succeed and emit; they do not mention that this lets a stranger emit such an event in a holder's name, which is the mechanism behind address-poisoning scams. Recorded for the author's awareness only: rejecting it would break ERC-20 conformance, so the recommended action is to leave the code as it is and optionally note the vector in README.md.","line":10,"path":"src/CompanyToken.sol","reproduction":"Deploy CompanyToken from D (D holds 1e27). D calls transfer(0x1111, 1000e18). Stranger 0x3333 with allowance(0x1111, 0x3333) == 0 calls transferFrom(0x1111, 0x2222, 0). Expected if event spam were prevented: revert ERC20InsufficientAllowance. Actual: returns true and emits exactly one Transfer(from=0x1111, to=0x2222, value=0); balanceOf(0x1111) stays 1000e18 and allowance stays 0. Verified with a scratch Foundry test (test/scratch/ZeroValue.t.sol, vm.recordLogs, 1 log with topics[0]=keccak256('Transfer(address,address,uint256)'), topics[1]=0x1111, topics[2]=0x2222, data=0), which passes on this code.","severity":"info","snippet":"contract CompanyToken is ERC20 {","title":"Anyone can emit a zero-value Transfer event from any holder via transferFrom without allowance (standard ERC-20 behaviour, address-poisoning vector; no code change required)"}],"hash":"7813a05d73ea5515b787ad1ccf386fe73868f1a4d03eaefb4508ba1e9e0eef47","nodeId":"1707359b-9211-4271-b0a8-d005e18f748b","outcome":"completed","summary":"The review is complete. `.imd-findings.json` is written at the repository root with two findings and a seven-row coverage record. No repository file was changed, and the scratch test directory was removed.\n\n**What I reproduced**\n\n- **Dependency hash check fails (low, merged).** The three specialist reports from audit_economics, audit_flow and audit_math describe one root cause, so they are one finding. Running the documented check from DEPENDENCIES.md fails on exactly seven forge-std files. I downloaded both release archives into a temporary directory. Their archive hashes match what DEPENDENCIES.md records, the recorded per-file hashes are the genuine upstream v1.9.7 values, and the seven vendored files are identical to upstream once whitespace is stripped. All five OpenZeppelin files are byte-identical to upstream v5.4.0, so the deployed token's only dependency is unmodified. Kept at low: provenance only, test helpers only.\n- **Zero-value transferFrom without allowance (info).** The audit_flow finding reproduces with a scratch Foundry test using recorded logs. It is standard ERC-20 and OpenZeppelin behaviour, the README already says zero-value transfers emit, and no code change is needed. Kept as info so the author knows about the address-poisoning vector without reopening the work.\n\n**My own pass**\n\nThe token is a bare OpenZeppelin v5.4.0 ERC20 with a no-argument constructor that mints once. I traced approve, transfer and transferFrom through the unmodified library and found nothing beyond the above. All 47 repository tests, including invariants, pass. Runtime code has no DELEGATECALL, CALLCODE or SELFDESTRUCT. Bytecode sizes are well under the limits, and launch.json is schema-valid with constructor arguments and supply matching the constructor.\n\n**What I could not do**\n\nThe two protected test files import the platform's Uniswap v4 sources and factory helpers, which are not in this tree, so they cannot compile here. I read their assertions instead. A plain fixed-supply ERC20 satisfies every one of them.","treeHash":null,"usage":{"cachedInputTokens":536183,"inputTokens":290,"model":"claude-fable-5-1","outputTokens":9785,"runtime":"claude","turns":10,"wallClockMs":158914}},{"artifacts":[],"attempt":1,"bundleHash":"ab12e1b6d57f61073c9d1d284615340968fbe9d60ac3be777059be59c57168fa","device":"63fda2736ec51b55","findings":[],"hash":"9bc6b3cd7da1b16b46cefb28f5f81edd2031ea1d50c5f1812b6054e29f78cfeb","nodeId":"4b7528b4-7898-4b25-a3cf-3d905c77b5eb","outcome":"completed","summary":"Added 12 edge/fuzz tests and strengthened invariants covering balances, supply, allowances, and failure rollback.\n\nOffline build and tests pass with the supplied seed: **47 tests passed**, including **16,384 invariant calls**.\n\nChanges are confined to `test/`. No implementation defects found.","treeHash":"563b302c2d6337a4136c8e7d3c749f7d93e16645","usage":{"cachedInputTokens":879360,"inputTokens":78930,"model":"gpt-6-astra","outputTokens":12331,"runtime":"codex","turns":5,"wallClockMs":360732}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"6b0a28df3d585600","findings":[{"citation":"resolved","description":"DEPENDENCIES.md states the vendored files are unmodified and tells the reviewer to confirm this with `sha256sum --check DEPENDENCIES.sha256`. Running that command in the tree fails for 7 forge-std files: lib/forge-std/src/StdJson.sol, interfaces/IMulticall3.sol, console.sol, Vm.sol, interfaces/IERC7540.sol, StdAssertions.sol, StdToml.sol. The hashes recorded in DEPENDENCIES.sha256 match the upstream v1.9.7 release (e.g. upstream Vm.sol = 9068805b...), so the vendored copies were changed after the hash file was written. I downloaded the v1.9.7 archive (SHA-256 45157353... matches DEPENDENCIES.md) and diffed: every difference is `forge fmt` line-wrapping; no semantic change. All OpenZeppelin files verify. This is outside the math area and does not touch src/CompanyToken.sol or its runtime bytecode, which depends only on the verified OpenZeppelin ERC20. It is reported because the project's own stated provenance check does not pass, which a release reviewer will trip over. Fix: regenerate DEPENDENCIES.sha256 from the tree (or restore the 7 files byte-for-byte from the upstream archive) so the documented check passes.","line":19,"path":"DEPENDENCIES.md","reproduction":"In the repository root run `sha256sum --check DEPENDENCIES.sha256`. Expected (per DEPENDENCIES.md line 5 and 19): every line OK. Actual: 7 lines FAILED, exit code 1, with `sha256sum: WARNING: 7 computed checksums did NOT match`. Example: DEPENDENCIES.sha256 lists 9068805b59ac1d0ea03a8fa1f15ae49c094e0c6c852a2500e0dd112f264b2cb1 for lib/forge-std/src/Vm.sol; the file in the tree hashes to a1b1c82924aecf0f38b53192fd1e801cccc1e1fd2ecd6b2301e4f4c4ab102a15.","severity":"info","snippet":"`DEPENDENCIES.sha256` records the SHA-256 of every vendored file. Verify locally:","title":"DEPENDENCIES.sha256 verification fails for 7 vendored forge-std files (whitespace-only reformatting of test helpers; token runtime unaffected)"}],"hash":"a71e86ea17a8afa9cc0818bcc5f3dde7cf89c48760c72f595073548b65a5e6d4","nodeId":"1189a770-5393-4d76-acdf-4e6974d9c999","outcome":"completed","summary":"Review complete. The findings file is written and the tree is clean apart from it.\n\n**Result: no math, boundary or numerical-gap defect in the token.** The contract is the unmodified OpenZeppelin v5.4.0 ERC20 plus one constant and one constructor mint, so there is no division, rounding, scale conversion, downcast, external call, payable path or sentinel branch to fail. I checked every failure mode in the three assigned guides against the actual arithmetic and verified the edges with a scratch Foundry suite before deleting it.\n\nWhat was verified concretely:\n\n- **Supply constant** evaluates to exactly 10^27 at compile time. The aderyn \"large numeric literal\" line is style only. The 10/80/10 launch split divides it without remainder, and it fits in int128, so Uniswap v4 balance deltas cannot truncate it.\n- **transfer and transferFrom** keep the checked guard before each unchecked subtraction. Zero, 1 wei, whole balance, self-transfer, max uint, exact-allowance-to-zero, max allowance, and max-minus-one allowance all behave as the standard says. A fuzzed two-hop transfer conserves the supply.\n- **approve** is a plain store with zero-address guards. No ETH path exists. The existing unit, fuzz and invariant suites all pass.\n\nOne info-level note is recorded outside the assigned area. The project's own documented provenance check fails for seven forge-std files:\n\n```\nsha256sum --check DEPENDENCIES.sha256   ->  7 computed checksums did NOT match\n```\n\nI downloaded the upstream v1.9.7 archive and diffed. Every difference is forge fmt line wrapping in test helpers, and all OpenZeppelin files verify, so the token runtime is unaffected. The fix is to regenerate the hash file or restore the files byte for byte.\n\nCoverage rows answer all three entry points as holds, plus four invariant rows. The findings file lists one finding, severity info, with no proof needed.","treeHash":null,"usage":{"cachedInputTokens":714227,"inputTokens":354,"model":"claude-fable-5-1","outputTokens":11446,"runtime":"claude","turns":20,"wallClockMs":361672}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"02f22d6f13810ca8","findings":[{"citation":"resolved","description":"DEPENDENCIES.md states that the vendored upstream subsets have unmodified contents and tells the reader to verify that with `sha256sum --check DEPENDENCIES.sha256`. The hashes in DEPENDENCIES.sha256 are the genuine upstream forge-std v1.9.7 hashes (I downloaded the release archive, SHA-256 45157353ab49eab01d294565866731e599b32401757229689ee459aa26b7ee94 as documented, and its src/Vm.sol hashes to 9068805b...2cb1 exactly as recorded), but seven files in lib/forge-std/src in this tree have been reformatted (forge fmt style: wrapped signatures joined onto one line) and so hash differently: StdAssertions.sol, StdJson.sol, StdToml.sol, console.sol, Vm.sol, interfaces/IERC7540.sol, interfaces/IMulticall3.sol. A whitespace-insensitive diff shows the changes are whitespace-only, so test semantics are unchanged, and every OpenZeppelin file matches upstream v5.4.0 byte for byte (verified against the archive with SHA-256 b89829be...50d1). Impact is limited to provenance: the documented integrity check the README and DEPENDENCIES.md rely on fails, and a reviewer following it cannot distinguish this benign reformat from a malicious edit to a test helper without doing the upstream diff themselves. forge-std is a test-only dependency and is not part of the deployed token. Fix: either restore the seven files to their upstream bytes (copy from the v1.9.7 archive) or regenerate DEPENDENCIES.sha256 from the tree and amend the 'unmodified' wording to say the files are forge-fmt reformatted.","line":22,"path":"DEPENDENCIES.md","reproduction":"In the repository root run `sha256sum --check DEPENDENCIES.sha256`. Expected (per DEPENDENCIES.md): every line OK, exit 0. Actual: 29 OK, 7 FAILED (lib/forge-std/src/StdJson.sol, interfaces/IMulticall3.sol, console.sol, Vm.sol, interfaces/IERC7540.sol, StdAssertions.sol, StdToml.sol), 'WARNING: 7 computed checksums did NOT match', exit 1. `sha256sum lib/forge-std/src/Vm.sol` gives a1b1c82924aecf0f38b53192fd1e801cccc1e1fd2ecd6b2301e4f4c4ab102a15 while DEPENDENCIES.sha256 line 21 and upstream v1.9.7 give 9068805b59ac1d0ea03a8fa1f15ae49c094e0c6c852a2500e0dd112f264b2cb1. `diff lib/forge-std/src/Vm.sol <(tar xzOf forge-std-1.9.7.tar.gz forge-std-1.9.7/src/Vm.sol)` shows only line-wrapping differences, e.g. line 827 `function getDeployment(string calldata contractName, uint64 chainId) external view returns (address deployedAddress);` joined from four upstream lines.","severity":"low","snippet":"sha256sum --check DEPENDENCIES.sha256","title":"Documented dependency verification fails: 7 vendored forge-std files differ from the recorded v1.9.7 hashes"},{"citation":"resolved","description":"CompanyToken inherits OpenZeppelin v5.4.0 ERC20 unmodified and overrides nothing. In ERC20._spendAllowance (lib/openzeppelin-contracts/contracts/token/ERC20/ERC20.sol lines 294-304) a zero value never fails the `currentAllowance < value` check, and _update accepts value 0 from any non-zero `from`, so transferFrom(victim, lookalike, 0) succeeds for any caller with no allowance and emits Transfer(victim, lookalike, 0). This is exactly the ERC-20 standard's required behaviour (zero-value transfers must be treated as normal transfers and fire the event) and OpenZeppelin's documented choice; it is not a defect in the token's accounting, balances and allowances are untouched. It is reported for the record because it is the mechanism behind 'address poisoning' scams (an attacker seeds a holder's transaction history with transfers to a look-alike address) and the README documents the approval race but not this. No code change is required; if the author wants to deviate from the standard they could override _update to reject value == 0 when msg.sender has no allowance, but that breaks ERC-20 conformance and some integrators, so the recommended action is to leave the code and note the behaviour in README.md.","line":10,"path":"src/CompanyToken.sol","reproduction":"Deploy CompanyToken from address D (D holds 1e27). D calls transfer(victim=0x1111, 1000e18). Stranger 0x3333 (allowance(victim, 0x3333) == 0) calls transferFrom(0x1111, 0x2222, 0). Expected if event spam were prevented: revert. Actual: returns true and emits exactly one log Transfer(from=0x1111, to=0x2222, value=0) from the token; balanceOf(0x1111) stays 1000e18 and allowance stays 0. Verified with a scratch Foundry test (test_strangerCanEmitZeroValueTransferFromAnyHolder) using vm.recordLogs.","severity":"info","snippet":"contract CompanyToken is ERC20 {","title":"Anyone can emit a zero-value Transfer event from any holder via transferFrom without allowance (standard ERC-20 behaviour, address-poisoning vector)"}],"hash":"aae4e8b9061e79158b6b4d8baf1d737d2aa0ce1f587c56f7de49c418d4654f53","nodeId":"5ab93d97-d99c-424e-837a-4787fb4b3f3b","outcome":"completed","summary":"Review complete. Findings are in `.imd-findings.json` and no tracked file was changed. The scratch tests live under test/scratch/, which git ignores.\n\n**Outcome:** the token is a 16-line wrapper over unmodified OpenZeppelin v5.4.0 ERC20 and holds across my three guides. Every entry point was traced and came back clean. Two items are recorded, neither affecting the deployed token.\n\n**Findings written**\n- **Low, dependency provenance.** DEPENDENCIES.md tells the reader to verify the vendored libraries with a checksum file, and that check fails on seven forge-std files. I downloaded both upstream archives and confirmed the recorded hashes are the genuine v1.9.7 hashes, while the files in the tree were reformatted by forge fmt. The diff is whitespace only, and every OpenZeppelin file matches v5.4.0 byte for byte. Fix is to restore the seven files or regenerate the checksum file.\n- **Info, standard ERC-20 behaviour.** Anyone can call transferFrom with a zero value and no allowance, emitting a Transfer event from any holder. Balances are unaffected. This is required ERC-20 behaviour and the address-poisoning vector, recorded so the author can mention it in the README. No code change recommended.\n\n**Coverage recorded, nine rows.** The three listed entry points hold, as do the constructor mint, the no-growth and no-privilege invariant, exact launch flows, and the OpenZeppelin vendoring. The forge-std row points at finding 1. The manifest row holds because launch.json has not been generated yet and the README's parameters are schema-consistent.\n\n**What I verified beyond reading**\n- Build and the full 35-test suite pass with the README's fuzz seed.\n- The supply constant evaluates to exactly 10^27, checked with node.\n- The compiled ABI exposes only the ERC-20 surface plus the supply constant. The 1753-byte runtime contains no CALL, DELEGATECALL, CALLCODE, CREATE, CREATE2 or SELFDESTRUCT.\n- A scratch suite reproduced the CREATE2 mint to an etched factory, the 10/80/10 launch split, atomic allowance restoration on every revert path, the zero-value event, and rejection of ETH and unknown selectors.\n\nNot reached: the protected launch harness itself, since Uniswap v4 core is not vendored here. Plain ERC20 semantics satisfy each of its checks by inspection. Static-analysis lead from aderyn about the large numeric literal was checked and is not a defect.","treeHash":null,"usage":{"cachedInputTokens":696470,"inputTokens":290,"model":"claude-fable-5-1","outputTokens":17933,"runtime":"claude","turns":29,"wallClockMs":257561}}],"verification":[{"checks":[{"durationMs":2119,"exitCode":0,"name":"build","output":"Compiling 27 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.92s\nCompiler run successful!\n","passed":true},{"durationMs":1271,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 34 tests for test/CompanyToken.t.sol:CompanyTokenTest\n[PASS] testFuzz_transferAboveBalanceReverts(uint256,uint256) (runs: 1024, μ: 127109, ~: 127246)\nLogs:\n  Bound result 447084692207655559301191436\n  Bound result 279483204913651510290866510452722017\n\n[PASS] testFuzz_transferConservesSupply(address,uint256) (runs: 1024, μ: 92941, ~: 93204)\nLogs:\n  Bound result 179385677474447953856965701\n\n[PASS] testFuzz_transferFromAboveAllowanceReverts(uint256,uint256) (runs: 1024, μ: 123130, ~: 123593)\nLogs:\n  Bound result 15331\n  Bound result 12\n\n[PASS] testFuzz_transferFromUsesOnlyApprovedAmount(uint256,uint256) (runs: 1024, μ: 162968, ~: 164913)\nLogs:\n  Bound result 287558280666792666678\n  Bound result 38019624583874\n\n[PASS] test_adminMintBurnAndUpgradeCallsAreUnavailable() (gas: 1115898)\n[PASS] test_allowanceCannotBeUsedByDifferentSpender() (gas: 94651)\n[PASS] test_approvalCanExceedBalance() (gas: 78592)\n[PASS] test_approveEmitsEventAndCanReplaceOrRevokeAllowance() (gas: 157919)\n[PASS] test_approveZeroSpenderReverts() (gas: 37552)\n[PASS] test_constructorEmitsExactlyOneMint() (gas: 9676)\n[PASS] test_create2MintsToFactoryAndNotItsCaller() (gas: 283529)\n[PASS] test_deployerCannotTakeBackHolderTokens() (gas: 157940)\n[PASS] test_factoryDistributionClaimsAndPoolTransfersArriveExactly() (gas: 632829)\n[PASS] test_metadataAndEntireInitialSupply() (gas: 107649)\n[PASS] test_nativeCurrencyIsRejected() (gas: 36821)\n[PASS] test_revokedSpenderCannotTransfer() (gas: 110516)\n[PASS] test_runtimeFitsDeploymentLimitAndHasNoForbiddenOpcodes() (gas: 787416)\n[PASS] test_selfTransferMoreThanBalanceReverts() (gas: 35841)\n[PASS] test_selfTransferPreservesBalance() (gas: 51410)\n[PASS] test_transferEntireBalance() (gas: 75765)\n[PASS] test_transferFromInsufficientBalanceRestoresAllowance() (gas: 126134)\n[PASS] test_transferFromMoreThanAllowanceRevertsAtomically() (gas: 115666)\n[PASS] test_transferFromSelfStillSpendsAllowance() (gas: 162231)\n[PASS] test_transferFromSpendsFiniteAllowanceAndEmitsTransfer() (gas: 202080)\n[PASS] test_transferFromWithInfiniteAllowanceDoesNotReduceIt() (gas: 133644)\n[PASS] test_transferFromWithoutApprovalReverts() (gas: 57802)\n[PASS] test_transferFromZeroAmountRequiresNoAllowance() (gas: 78697)\n[PASS] test_transferFromZeroRecipientRestoresAllowance() (gas: 114027)\n[PASS] test_transferMoreThanBalanceReverts() (gas: 109694)\n[PASS] test_transferReturnsTrueAndEmitsExactAmount() (gas: 91550)\n[PASS] test_transferToContractDoesNotCallRecipient() (gas: 172197)\n[PASS] test_transferToZeroRevertsWithoutBurning() (gas: 47554)\n[PASS] test_zeroTransferFromEmptyAccountEmitsEvent() (gas: 73367)\n[PASS] test_zeroTransferToZeroReverts() (gas: 30456)\nSuite result: ok. 34 passed; 0 failed; 0 skipped; finished in 61.10ms (228.40ms CPU time)\n\nRan 1 test for test/CompanyToken.invariant.t.sol:CompanyTokenInvariantTest\n[PASS]\nCompanyTokenInvariantTest invariants:\n[PASS] invariant_balancesConserveEntireSupply\n[PASS] invariant_supplyRemainsFixed\n CompanyTokenInvariantTest invariants (runs: 128, calls: 8192, reverts: 0)\n\n╭---------------------+--------------+-------+---------+----------╮\n| Contract            | Selector     | Calls | Reverts | Discards |\n+=================================================================+\n| CompanyTokenHandler | approve      | 2650  | 0       | 0        |\n|---------------------+--------------+-------+---------+----------|\n| CompanyTokenHandler | transfer     | 2790  | 0       | 0        |\n|---------------------+--------------+-------+---------+----------|\n| CompanyTokenHandler | transferFrom | 2752  | 0       | 0        |\n╰---------------------+--------------+-------+---------+----------╯\n\nLogs:\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 2197\n  Bound result 0\n  Bound result 7\n  Bound result 334\n  Bound result 10\n  Bound result 1448\n  Bound result 1605\n  Bound result 8\n  Bound result 0\n  Bound result 0\n  Bound result 9\n  Bound result 133\n  Bound result 0\n  Bound result 0\n  Bound result 6149\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 2\n  Bound result 12\n  Bound result 1418\n  Bound result 0\n  Bound result 5134\n  Bound result 1243\n  Bound result 13\n  Bound result 10\n  Bound result 4\n  Bound result 355\n  Bound result 9\n  Bound result 127\n  Bound result 0\n  Bound result 18\n  Bound result 0\n  Bound result 18\n  Bound result 4934\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 1.13s (1.11s CPU time)\n\nRan 2 test suites in 1.14s (1.19s CPU time): 35 tests passed, 0 failed, 0 skipped (35 total tests)\n","passed":true},{"durationMs":56,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"CompanyToken.approve(address,uint256)\",\"CompanyToken.transfer(address,uint256)\",\"CompanyToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":5,\"DEPENDENCIES.md\":26,\"DEPENDENCIES.sha256\":36,\"README.md\":116,\"SECURITY.md\":34,\"foundry.toml\":25,\"src/CompanyToken.sol\":16,\"test/CompanyToken.invariant.t.sol\":85,\"test/CompanyToken.t.sol\":406},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true},{"durationMs":1345,"exitCode":0,"name":"slither","output":"slither: no results at low impact or above","passed":true},{"durationMs":760,"exitCode":0,"name":"aderyn","output":"[low] large-numeric-literal at src/CompanyToken.sol:11: Large Numeric Literal","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"23eb529926a33466d8c4ea1df80dd9f11cc85a96159969ab62a4c7c071b26047","verifiedTreeHash":"95dcd9d98cf3f1a5ffd58d53ce6172858cf6659c","verifierVersion":"0.1.0+67c588fa"},{"checks":[{"durationMs":1143,"exitCode":0,"name":"build","output":"Compiling 27 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.07s\nCompiler run successful!\n","passed":true},{"durationMs":751,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 34 tests for test/CompanyToken.t.sol:CompanyTokenTest\n[PASS] testFuzz_transferAboveBalanceReverts(uint256,uint256) (runs: 1024, μ: 127109, ~: 127246)\nLogs:\n  Bound result 92716642\n  Bound result 2630551498836196714224301332975850512031128402542094296869402\n\n[PASS] testFuzz_transferConservesSupply(address,uint256) (runs: 1024, μ: 92941, ~: 93204)\nLogs:\n  Bound result 713017522122822560757158664\n\n[PASS] testFuzz_transferFromAboveAllowanceReverts(uint256,uint256) (runs: 1024, μ: 123130, ~: 123593)\nLogs:\n  Bound result 150697335755125732594\n  Bound result 448438096757057226600263229\n\n[PASS] testFuzz_transferFromUsesOnlyApprovedAmount(uint256,uint256) (runs: 1024, μ: 162968, ~: 164913)\nLogs:\n  Bound result 92716642\n  Bound result 43741893\n\n[PASS] test_adminMintBurnAndUpgradeCallsAreUnavailable() (gas: 1115898)\n[PASS] test_allowanceCannotBeUsedByDifferentSpender() (gas: 94651)\n[PASS] test_approvalCanExceedBalance() (gas: 78592)\n[PASS] test_approveEmitsEventAndCanReplaceOrRevokeAllowance() (gas: 157919)\n[PASS] test_approveZeroSpenderReverts() (gas: 37552)\n[PASS] test_constructorEmitsExactlyOneMint() (gas: 9676)\n[PASS] test_create2MintsToFactoryAndNotItsCaller() (gas: 283529)\n[PASS] test_deployerCannotTakeBackHolderTokens() (gas: 157940)\n[PASS] test_factoryDistributionClaimsAndPoolTransfersArriveExactly() (gas: 632829)\n[PASS] test_metadataAndEntireInitialSupply() (gas: 107649)\n[PASS] test_nativeCurrencyIsRejected() (gas: 36821)\n[PASS] test_revokedSpenderCannotTransfer() (gas: 110516)\n[PASS] test_runtimeFitsDeploymentLimitAndHasNoForbiddenOpcodes() (gas: 787416)\n[PASS] test_selfTransferMoreThanBalanceReverts() (gas: 35841)\n[PASS] test_selfTransferPreservesBalance() (gas: 51410)\n[PASS] test_transferEntireBalance() (gas: 75765)\n[PASS] test_transferFromInsufficientBalanceRestoresAllowance() (gas: 126134)\n[PASS] test_transferFromMoreThanAllowanceRevertsAtomically() (gas: 115666)\n[PASS] test_transferFromSelfStillSpendsAllowance() (gas: 162231)\n[PASS] test_transferFromSpendsFiniteAllowanceAndEmitsTransfer() (gas: 202080)\n[PASS] test_transferFromWithInfiniteAllowanceDoesNotReduceIt() (gas: 133644)\n[PASS] test_transferFromWithoutApprovalReverts() (gas: 57802)\n[PASS] test_transferFromZeroAmountRequiresNoAllowance() (gas: 78697)\n[PASS] test_transferFromZeroRecipientRestoresAllowance() (gas: 114027)\n[PASS] test_transferMoreThanBalanceReverts() (gas: 109694)\n[PASS] test_transferReturnsTrueAndEmitsExactAmount() (gas: 91550)\n[PASS] test_transferToContractDoesNotCallRecipient() (gas: 172197)\n[PASS] test_transferToZeroRevertsWithoutBurning() (gas: 47554)\n[PASS] test_zeroTransferFromEmptyAccountEmitsEvent() (gas: 73367)\n[PASS] test_zeroTransferToZeroReverts() (gas: 30456)\nSuite result: ok. 34 passed; 0 failed; 0 skipped; finished in 28.70ms (122.82ms CPU time)\n\nRan 1 test for test/CompanyToken.invariant.t.sol:CompanyTokenInvariantTest\n[PASS]\nCompanyTokenInvariantTest invariants:\n[PASS] invariant_balancesConserveEntireSupply\n[PASS] invariant_supplyRemainsFixed\n CompanyTokenInvariantTest invariants (runs: 128, calls: 8192, reverts: 0)\n\n╭---------------------+--------------+-------+---------+----------╮\n| Contract            | Selector     | Calls | Reverts | Discards |\n+=================================================================+\n| CompanyTokenHandler | approve      | 2650  | 0       | 0        |\n|---------------------+--------------+-------+---------+----------|\n| CompanyTokenHandler | transfer     | 2790  | 0       | 0        |\n|---------------------+--------------+-------+---------+----------|\n| CompanyTokenHandler | transferFrom | 2752  | 0       | 0        |\n╰---------------------+--------------+-------+---------+----------╯\n\nLogs:\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 2197\n  Bound result 0\n  Bound result 7\n  Bound result 334\n  Bound result 10\n  Bound result 1448\n  Bound result 1605\n  Bound result 8\n  Bound result 0\n  Bound result 0\n  Bound result 9\n  Bound result 133\n  Bound result 0\n  Bound result 0\n  Bound result 6149\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 2\n  Bound result 12\n  Bound result 1418\n  Bound result 0\n  Bound result 5134\n  Bound result 1243\n  Bound result 13\n  Bound result 10\n  Bound result 4\n  Bound result 355\n  Bound result 9\n  Bound result 127\n  Bound result 0\n  Bound result 18\n  Bound result 0\n  Bound result 18\n  Bound result 4934\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 671.47ms (670.04ms CPU time)\n\nRan 2 test suites in 672.91ms (700.17ms CPU time): 35 tests passed, 0 failed, 0 skipped (35 total tests)\n","passed":true},{"durationMs":36,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"CompanyToken.approve(address,uint256)\",\"CompanyToken.transfer(address,uint256)\",\"CompanyToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":5,\"DEPENDENCIES.md\":26,\"DEPENDENCIES.sha256\":36,\"README.md\":116,\"SECURITY.md\":34,\"foundry.toml\":25,\"launch.json\":24,\"src/CompanyToken.sol\":16,\"test/CompanyToken.invariant.t.sol\":85,\"test/CompanyToken.t.sol\":406},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"4f676c2d923d31e8790e3292705a602b3455a35ea22664c6c0188c81b60d9f39","verifiedTreeHash":"e803e6f1f34b03f674d5e638dbb49e3293e16389","verifierVersion":"0.1.0+5e560cc8"},{"checks":[{"durationMs":1912,"exitCode":0,"name":"build","output":"Compiling 28 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.81s\nCompiler run successful!\n","passed":true},{"durationMs":6713,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 12 tests for test/CompanyToken.edges.t.sol:CompanyTokenEdgeTest\n[PASS] testFuzz_approvalReplacementIsIdempotentAndIsolated(uint256,uint256) (runs: 1024, μ: 438663, ~: 439445)\n[PASS] testFuzz_failedDelegatedTransferCanBeRetriedAfterFunding(uint256,uint256,uint256) (runs: 1024, μ: 354235, ~: 354560)\nLogs:\n  Bound result 289498158034273530891079528\n  Bound result 167436653180\n  Bound result 115792089237316195423570985008687907853269984665640274541299549734214826491730\n\n[PASS] testFuzz_finiteAllowanceIsConsumedAcrossMultipleTransfers(uint256,uint256,uint256) (runs: 1024, μ: 281068, ~: 286045)\nLogs:\n  Bound result 289498158034273530891078815\n  Bound result 167436653180\n  Bound result 24584503\n\n[PASS] testFuzz_roundTripRestoresExistingBalances(uint256,uint256) (runs: 1024, μ: 258504, ~: 258560)\nLogs:\n  Bound result 11856155362926597407531374\n  Bound result 1990665932969140436758820\n\n[PASS] test_delegatedFullSupplyCannotBeSpentTwice() (gas: 241515)\n[PASS] test_infiniteApprovalCanBeReducedThenRevoked() (gas: 366182)\n[PASS] test_largestFiniteAllowanceDecreases() (gas: 210702)\n[PASS] test_maximumDelegatedTransferFailsDespiteInfiniteAllowance() (gas: 129434)\n[PASS] test_maximumTransferRevertsWithoutOverflowOrBalanceChanges() (gas: 65347)\n[PASS] test_transferFromByOwnerRequiresSelfApproval() (gas: 202526)\n[PASS] test_transferOneBaseUnitArrivesWithoutRounding() (gas: 91290)\n[PASS] test_zeroDelegatedTransferStillRejectsZeroRecipient() (gas: 79079)\nSuite result: ok. 12 passed; 0 failed; 0 skipped; finished in 89.21ms (332.98ms CPU time)\n\nRan 34 tests for test/CompanyToken.t.sol:CompanyTokenTest\n[PASS] testFuzz_transferAboveBalanceReverts(uint256,uint256) (runs: 1024, μ: 127007, ~: 127258)\nLogs:\n  Bound result 123000000000000000000\n  Bound result 20000000000000000000\n\n[PASS] testFuzz_transferConservesSupply(address,uint256) (runs: 1024, μ: 92878, ~: 93204)\nLogs:\n  Bound result 320047982464542624010852751\n\n[PASS] testFuzz_transferFromAboveAllowanceReverts(uint256,uint256) (runs: 1024, μ: 123013, ~: 123593)\nLogs:\n  Bound result 8\n  Bound result 50\n\n[PASS] testFuzz_transferFromUsesOnlyApprovedAmount(uint256,uint256) (runs: 1024, μ: 162662, ~: 164913)\nLogs:\n  Bound result 85402753978685356061\n  Bound result 66206676852157009689\n\n[PASS] test_adminMintBurnAndUpgradeCallsAreUnavailable() (gas: 1115898)\n[PASS] test_allowanceCannotBeUsedByDifferentSpender() (gas: 94651)\n[PASS] test_approvalCanExceedBalance() (gas: 78592)\n[PASS] test_approveEmitsEventAndCanReplaceOrRevokeAllowance() (gas: 157919)\n[PASS] test_approveZeroSpenderReverts() (gas: 37552)\n[PASS] test_constructorEmitsExactlyOneMint() (gas: 9676)\n[PASS] test_create2MintsToFactoryAndNotItsCaller() (gas: 283529)\n[PASS] test_deployerCannotTakeBackHolderTokens() (gas: 157940)\n[PASS] test_factoryDistributionClaimsAndPoolTransfersArriveExactly() (gas: 632829)\n[PASS] test_metadataAndEntireInitialSupply() (gas: 107649)\n[PASS] test_nativeCurrencyIsRejected() (gas: 36821)\n[PASS] test_revokedSpenderCannotTransfer() (gas: 110516)\n[PASS] test_runtimeFitsDeploymentLimitAndHasNoForbiddenOpcodes() (gas: 787416)\n[PASS] test_selfTransferMoreThanBalanceReverts() (gas: 35841)\n[PASS] test_selfTransferPreservesBalance() (gas: 51410)\n[PASS] test_transferEntireBalance() (gas: 75765)\n[PASS] test_transferFromInsufficientBalanceRestoresAllowance() (gas: 126134)\n[PASS] test_transferFromMoreThanAllowanceRevertsAtomically() (gas: 115666)\n[PASS] test_transferFromSelfStillSpendsAllowance() (gas: 162231)\n[PASS] test_transferFromSpendsFiniteAllowanceAndEmitsTransfer() (gas: 202080)\n[PASS] test_transferFromWithInfiniteAllowanceDoesNotReduceIt() (gas: 133644)\n[PASS] test_transferFromWithoutApprovalReverts() (gas: 57802)\n[PASS] test_transferFromZeroAmountRequiresNoAllowance() (gas: 78697)\n[PASS] test_transferFromZeroRecipientRestoresAllowance() (gas: 114027)\n[PASS] test_transferMoreThanBalanceReverts() (gas: 109694)\n[PASS] test_transferReturnsTrueAndEmitsExactAmount() (gas: 91550)\n[PASS] test_transferToContractDoesNotCallRecipient() (gas: 172197)\n[PASS] test_transferToZeroRevertsWithoutBurning() (gas: 47554)\n[PASS] test_zeroTransferFromEmptyAccountEmitsEvent() (gas: 73367)\n[PASS] test_zeroTransferToZeroReverts() (gas: 30456)\nSuite result: ok. 34 passed; 0 failed; 0 skipped; finished in 90.39ms (368.81ms CPU time)\n\nRan 1 test for test/CompanyToken.invariant.t.sol:CompanyTokenInvariantTest\n[PASS]\nCompanyTokenInvariantTest invariants:\n[PASS] invariant_balancesConserveEntireSupply\n[PASS] invariant_eachAllowanceMatchesAuthorizations\n[PASS] invariant_eachBalanceMatchesTransferHistory\n[PASS] invariant_supplyRemainsFixed\n CompanyTokenInvariantTest invariants (runs: 256, calls: 16384, reverts: 0)\n\n╭---------------------+-----------------------+-------+---------+----------╮\n| Contract            | Selector              | Calls | Reverts | Discards |\n+==========================================================================+\n| CompanyTokenHandler | approve               | 1541  | 0       | 0        |\n|---------------------+-----------------------+-------+---------+----------|\n| CompanyTokenHandler | approveInfinite       | 1417  | 0       | 0        |\n|---------------------+-----------------------+-------+---------+----------|\n| CompanyTokenHandler | approveZeroSpender    | 1407  | 0       | 0        |\n|---------------------+-----------------------+-------+---------+----------|\n| CompanyTokenHandler | revoke                | 1514  | 0       | 0        |\n|---------------------+-----------------------+-------+---------+----------|\n| CompanyTokenHandler | transfer              | 1516  | 0       | 0        |\n|---------------------+-----------------------+-------+---------+----------|\n| CompanyTokenHandler | transferAboveBalance  | 1490  | 0       | 0        |\n|---------------------+-----------------------+-------+---------+----------|\n| CompanyTokenHandler | transferFrom          | 1486  | 0       | 0        |\n|---------------------+-----------------------+-------+---------+----------|\n| CompanyTokenHandler | transferFromOverLimit | 1532  | 0       | 0        |\n|---------------------+-----------------------+-------+---------+----------|\n| CompanyTokenHandler | transferFromToZero    | 1507  | 0       | 0        |\n|---------------------+-----------------------+-------+---------+----------|\n| CompanyTokenHandler | transferFullBalance   | 1498  | 0       | 0        |\n|---------------------+-----------------------+-------+---------+----------|\n| CompanyTokenHandler | transferToZero        | 1476  | 0       | 0        |\n╰---------------------+-----------------------+-------+---------+----------╯\n\nLogs:\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 60040599447688\n  Bound result 3963\n  Bound result 4\n  Bound result 808\n  Bound result 0\n  Bound result 1\n  Bound result 9\n  Bound result 1\n  Bound result 2391\n  Bound result 255\n  Bound result 20\n  Bound result 24576\n  Bound result 7348\n  Bound result 0\n  Bound result 9468\n  Bound result 0\n  Bound result 0\n  Bound result 873\n  Bound result 4958\n  Bound result 60000000000000000000\n  Bound result 0\n  Bound result 2841\n  Bound result 0\n  Bound result 20\n  Bound result 0\n  Bound result 1\n  Bound result 5987\n  Bound result 1000000000000000000\n  Bound result 6840\n  Bound result 499999999999999999999986081\n  Bound result 8330768083720319\n  Bound result 0\n  Bound result 935538252\n  Bound result 1300\n  Bound result 3789\n  Bound result 8182\n  Bound result 1\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 6.60s (6.59s CPU time)\n\nRan 3 test suites in 6.60s (6.78s CPU time): 47 tests passed, 0 failed, 0 skipped (47 total tests)\n","passed":true},{"durationMs":80,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"CompanyToken.approve(address,uint256)\",\"CompanyToken.transfer(address,uint256)\",\"CompanyToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":5,\"DEPENDENCIES.md\":26,\"DEPENDENCIES.sha256\":36,\"README.md\":116,\"SECURITY.md\":34,\"foundry.toml\":25,\"src/CompanyToken.sol\":16,\"test/CompanyToken.edges.t.sol\":239,\"test/CompanyToken.invariant.t.sol\":221,\"test/CompanyToken.t.sol\":406},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"9bc6b3cd7da1b16b46cefb28f5f81edd2031ea1d50c5f1812b6054e29f78cfeb","verifiedTreeHash":"563b302c2d6337a4136c8e7d3c749f7d93e16645","verifierVersion":"0.1.0+5e560cc8"}]}