{"assessments":[],"deployments":[],"fuzz":[],"identity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"interpretation":"Records acceptance and evidence. Neither completion nor an AI assessment establishes correctness, safety, or independent review.","jobId":"6e0cd68f-376c-4e7d-9b39-81f1a6493288","kind":"shape:chain","nodes":[{"acceptedSubmissionHash":"0d6c71fb27cfd0dc782142a0919d2dc36ea2a031460b20121de1f20e0d8b2158","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_economics","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"e4402847a033edd891bad9eaa1a35e83a912db3b9454b1974aa7adbfc67c89db","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_flow","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"3336a5b3e69a1dfa94db824d4916391d34d4b97aa97dfd842245e80d57f91425","dependsOn":["build_contract_project","write_foundry_tests","manifest","audit_math","audit_permissions","audit_economics","audit_flow"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"af3aa01159bbf354f621cafa5c0006f6169e0938a8b015be508b7377dbf165bc","skillId":"audit-judge","tools":[]},"key":"audit_judge","kind":"code","role":"review","skillHash":"af3aa01159bbf354f621cafa5c0006f6169e0938a8b015be508b7377dbf165bc","skillId":"audit-judge","state":"accepted"},{"acceptedSubmissionHash":"905da51dbc5daa3cb0a1cffb90fb50616d088bb2b77612e4eea10fc294c5f78a","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_math","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"809956c9ddecac8cf55ca7b3191e908251713fa46ed370ae63bac4d88358c2cd","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_permissions","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"d04a43bfc0d53da8d25ff2d454175e2dd8a11f90db2b567461d8f0ae467ef795","dependsOn":[],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"6b8d2c2ebd3301cff2be8edb1e1cc6ba65c858c02fe7247be81722b969842265","skillId":"build-contract-project","tools":[]},"key":"build_contract_project","kind":"code","role":"implement","skillHash":"6b8d2c2ebd3301cff2be8edb1e1cc6ba65c858c02fe7247be81722b969842265","skillId":"build-contract-project","state":"accepted"},{"acceptedSubmissionHash":"aaf0d1963d63929c115fac65121893665101a267cfd4640fb1396c6880871e25","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"tools":[]},"key":"manifest","kind":"code","role":"integrate","skillHash":null,"skillId":null,"state":"accepted"},{"acceptedSubmissionHash":"572c3495849c00e337d82026ce7e2358e4f23419a1b471e5bec4d17ffb0470e8","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"73431852439ad3a343f3d2b7db1c43cd363b9f48f9bb51497374a0cf6d50b223","skillId":"write-foundry-tests","tools":[]},"key":"write_foundry_tests","kind":"code","role":"tests","skillHash":"73431852439ad3a343f3d2b7db1c43cd363b9f48f9bb51497374a0cf6d50b223","skillId":"write-foundry-tests","state":"accepted"}],"objective":"A custom token: Company.MD (COMD).\nToken name: Company.MD\nToken symbol: COMD\nToken supply: 1,000,000,000 with 18 decimals, all minted once to the deployer in the constructor.","parentJobId":null,"planHash":"e2057a115f8a6b1335bd16569540a8536640a80c9be1cfafca8ea7c0adbefe1e","previousHash":"0000000000000000000000000000000000000000000000000000000000000000","projectId":"6e0cd68f-376c-4e7d-9b39-81f1a6493288","publication":{"commit":null,"deliveredAt":null,"repoUrl":"https://github.com/identity-md-launches/launch-1508-company-md"},"receiptIdentity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"registry":"0xb6d0a187b050fa5bb0b87033a203f37becf4a775","research":[],"schema":"identitymd-work-v1","signals":[{"agentId":"52548","feedbackHash":"f3f48f07460d6935d21e47eca7bf20b8f0603626385585ed44e45a2f14320dda","nodeKey":"audit_economics","submissionHash":"0d6c71fb27cfd0dc782142a0919d2dc36ea2a031460b20121de1f20e0d8b2158","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52337","feedbackHash":"5758abb9de6437c5564a06a6fba8d1c9b50d80c0276ec988dba5e537de3975fb","nodeKey":"audit_flow","submissionHash":"e4402847a033edd891bad9eaa1a35e83a912db3b9454b1974aa7adbfc67c89db","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51229","feedbackHash":"2c7f2aae2ad117a8472344730d5c98df3c3dda200bc1d921a4584f8dff67d69c","nodeKey":"audit_judge","submissionHash":"3336a5b3e69a1dfa94db824d4916391d34d4b97aa97dfd842245e80d57f91425","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51104","feedbackHash":"6c4b214e0e7e6e5d9c6e4d7d6a68a0307843455097d2be1a5affbb16eac7382b","nodeKey":"audit_math","submissionHash":"905da51dbc5daa3cb0a1cffb90fb50616d088bb2b77612e4eea10fc294c5f78a","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52584","feedbackHash":"407fc2c588fad3366bd60b9a80b22b49ee69e647c02651b9d8c145d6fba5a90f","nodeKey":"audit_permissions","submissionHash":"809956c9ddecac8cf55ca7b3191e908251713fa46ed370ae63bac4d88358c2cd","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51726","feedbackHash":"c48cd241cd6205212a5ac565b279e11d72ce9bd3cba3ab4199b285b8d489cc27","nodeKey":"build_contract_project","submissionHash":"d04a43bfc0d53da8d25ff2d454175e2dd8a11f90db2b567461d8f0ae467ef795","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"51010","feedbackHash":"fa3fb5445e29c002f3897b563390edb97ecc937f06345acd8cee07492a6e6a2e","nodeKey":"manifest","submissionHash":"aaf0d1963d63929c115fac65121893665101a267cfd4640fb1396c6880871e25","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"51378","feedbackHash":"d12d3ccd61b8de02dc724592746a873f4c04aa160d1c03674acae7ec3cc25bcf","nodeKey":"write_foundry_tests","submissionHash":"572c3495849c00e337d82026ce7e2358e4f23419a1b471e5bec4d17ffb0470e8","tag1":"verification:checks","tag2":"acceptance-v2","value":1}],"site":null,"snapshotHash":"553be722e0386eabbd6d4ed34e730ec0421f842c2a8397562df0e94a6ab1cae6","state":"completed","submissions":[{"artifacts":[],"attempt":1,"bundleHash":null,"device":"9b657b3675e34ec5","findings":[],"hash":"0d6c71fb27cfd0dc782142a0919d2dc36ea2a031460b20121de1f20e0d8b2158","nodeId":"d6da01bc-858e-475c-a2c8-11cad644293b","outcome":"completed","summary":"The review is complete. The findings file at `.imd-findings.json` holds an empty findings list and ten coverage rows. The scratch test directory has been removed and the working tree is otherwise untouched.\n\n**Outcome: no defects found in the economics area.** The token is a 16-line fixed-supply ERC-20 over an unmodified OpenZeppelin v5.1.0 base. Nothing in it can leak, tax, freeze or grow value.\n\nWhat I verified:\n\n- **Vendored dependency integrity.** I fetched the ERC20 import closure from upstream OpenZeppelin at the pinned v5.1.0 commit and diffed it. Every file is byte-identical, so the inherited transfer and approval logic is the audited upstream code.\n- **Three entry points.** `approve`, `transfer` and `transferFrom` are the unmodified OpenZeppelin implementations. I traced each through its guards, state changes and revert paths. All three are marked `holds`.\n- **Conservation and supply.** The only mint is in the constructor, the compiled ABI exposes no mint, burn or admin selector, and transfers to the zero address revert. The supply is fixed at 1e27 forever. The project's own invariant suite and my scratch probe both confirm the sum of balances equals total supply.\n- **Launch flows.** A scratch test simulated the factory deploying through CREATE2, the 10 percent swarm move, an allowance-based pool-manager pull for the 80 percent seed, the remainder forward, a distributor claim, and a buy and sell through the manager. Every leg moved exactly the stated amount and returned true.\n- **Privileged powers.** None exist. Every admin-style selector reverts from the deployer and from strangers, and the deployer cannot pull a holder's balance without allowance.\n- **Static-analysis lead.** The aderyn large-literal note is style only. The constant is a compile-time 1e27 that matches the manifest supply.\n\nTwo residual notes are recorded as coverage rows rather than findings. The standard ERC-20 approve front-running window is inherent to the token type the job requested and is documented in the README. Tokens sent to the token contract itself are stranded with no recovery path, which the README also states as intended.","treeHash":null,"usage":{"cachedInputTokens":442844,"inputTokens":194,"model":"claude-fable-5-1","outputTokens":11391,"runtime":"claude","turns":22,"wallClockMs":157606}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"4199bf0c80a9d6cf","findings":[{"citation":"resolved","description":"Reported by audit_flow; reproduced by this review. lib/forge-std/VENDORED.md states the Solidity sources are unmodified upstream v1.9.4 (commit 1eea5bae12ae557d589f9f0f0edae2faa47cb262) and that SHA256SUMS records their contents, and README.md points reviewers to those recorded hashes as the integrity evidence for every vendored dependency. Running the shipped check fails on 7 of 28 files: src/StdJson.sol, src/interfaces/IMulticall3.sol, src/console.sol, src/Vm.sol, src/StdAssertions.sol, src/StdToml.sol, src/mocks/MockERC721.sol. The hashes in SHA256SUMS are the correct upstream hashes; the vendored files were altered after hashing. I re-fetched all 7 files from the pinned upstream commit and compared: with all whitespace stripped, every local file is identical to upstream, so the change is formatter re-wrapping only (consistent with forge fmt run over lib/). lib/openzeppelin-contracts is byte-identical to its pinned commit 69c8def5f222ff96f2b5beff05dfba996368aa79 on all 6 files, and CompanyToken's creation and runtime bytecode depend only on OpenZeppelin, not on forge-std, so the deployed token is unaffected. Impact is limited to a false provenance statement and a broken integrity check for the test-only dependency: a reviewer following the README cannot distinguish this benign reformat from a tampered test library without re-fetching upstream. Fix: either restore the 7 files to upstream bytes (and exclude lib/ from forge fmt), or regenerate SHA256SUMS from the shipped files and reword VENDORED.md line 9 to say the sources were reformatted.","line":9,"path":"lib/forge-std/VENDORED.md","reproduction":"From the repository root run `cd lib/forge-std && sha256sum -c SHA256SUMS`. Expected per VENDORED.md lines 9-10: 28 lines `OK`, exit 0. Actual: 7 lines `FAILED` (src/StdJson.sol, src/interfaces/IMulticall3.sol, src/console.sol, src/Vm.sol, src/StdAssertions.sol, src/StdToml.sol, src/mocks/MockERC721.sol) and `sha256sum: WARNING: 7 computed checksums did NOT match`, exit 1. Cross-check: `curl -sSfL https://raw.githubusercontent.com/foundry-rs/forge-std/1eea5bae12ae557d589f9f0f0edae2faa47cb262/src/Vm.sol | sha256sum` equals the SHA256SUMS entry for src/Vm.sol, while `sha256sum lib/forge-std/src/Vm.sol` does not. `tr -d ' \\n\\t\\r' < <upstream Vm.sol> | sha256sum` and `tr -d ' \\n\\t\\r' < lib/forge-std/src/Vm.sol | sha256sum` are equal (4c8f89772cdc760b...), and the same holds for the other 6 files. By contrast `cd lib/openzeppelin-contracts && sha256sum -c SHA256SUMS` prints 6 `OK` lines, and each file is byte-identical to the pinned upstream commit.","severity":"low","snippet":"Unmodified Solidity sources and upstream MIT/Apache-2.0 licenses are included for tests.","title":"Vendored forge-std is not the unmodified upstream its provenance note claims; shipped SHA256SUMS check fails on 7 files"}],"hash":"3336a5b3e69a1dfa94db824d4916391d34d4b97aa97dfd842245e80d57f91425","nodeId":"2e217d18-fce6-42d0-89a9-d040318ed031","outcome":"completed","summary":"The review is complete. The findings file is in place and the working tree has no stray files.\n\n**Outcome:** one low finding kept, nothing else found. The token is sound.\n\n**What I checked**\n\n- `CompanyToken` is a bare subclass of the vendored OpenZeppelin v5.1.0 ERC20 with a constant supply and a no-argument constructor that mints the full supply to the deployer. All six vendored OpenZeppelin files are byte-identical to the pinned upstream commit, so the three entry points are unmodified upstream code. I traced approve, transfer and transferFrom through OpenZeppelin's checks, state changes and revert paths and marked each as holds.\n- The manifest matches the code: empty constructor arguments, supply string equal to the constructor mint, 18 decimals, lowercase addresses, schema keys only.\n- Creation and runtime bytecode are far below the protocol limits, with no linked libraries and no forbidden opcodes, so the factory's CREATE2 deployment works.\n- The build compiles and all 47 existing tests pass.\n- The aderyn large-numeric-literal lead is a style note on a compile-time constant and was dropped.\n\n**Specialist finding kept, at low severity**\n\nThe audit_flow finding reproduces. Running the shipped checksum file under `lib/forge-std` fails on 7 of 28 files, while the provenance note on line 9 of `lib/forge-std/VENDORED.md` claims the sources are unmodified. I re-fetched the 7 files from the pinned upstream commit. With whitespace stripped, each is identical to upstream, so the change is formatter re-wrapping only. forge-std is compiled only into tests and does not affect the token's bytecode, which is why this stays low. The fix is to restore upstream bytes or regenerate the checksums and reword the note.\n\n**Output**\n\n`.imd-findings.json` holds the finding and 7 coverage rows covering the three listed entry points plus the constructor, deployability, manifest consistency and the static-analysis lead. The file is excluded by the repository's git info exclude, which is why git status reports it as ignored rather than untracked. No proof file was needed since the only finding is low severity.","treeHash":null,"usage":{"cachedInputTokens":431565,"inputTokens":290,"model":"claude-fable-5-1","outputTokens":7237,"runtime":"claude","turns":10,"wallClockMs":127517}},{"artifacts":[],"attempt":1,"bundleHash":"ef6e8e2bf70864f540899849da89990134edd55f8428ec13f974347bc0d8f35e","device":"f1bc2d45837b6b78","findings":[],"hash":"572c3495849c00e337d82026ce7e2358e4f23419a1b471e5bec4d17ffb0470e8","nodeId":"14ffa364-7ebc-44a1-8bcc-bc3478941c13","outcome":"completed","summary":"Added 18 boundary and failure-path tests, and expanded invariants covering supply, balances, allowances, and metadata across 24,576 random calls.\n\n`forge build` and `forge test` pass: 47 tests reported, zero failures.\n\nNo implementation defects found. All changes are under `test/`.","treeHash":"80d5feed090718ef53c3cd9c92dfd3cc248a040a","usage":{"cachedInputTokens":410240,"inputTokens":71304,"model":"gpt-6-astra","outputTokens":10152,"runtime":"codex","turns":5,"wallClockMs":310656}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"6f41bd9b44d3e708","findings":[],"hash":"809956c9ddecac8cf55ca7b3191e908251713fa46ed370ae63bac4d88358c2cd","nodeId":"e6f4531b-4d33-46cb-9cd7-5fa8f709682d","outcome":"completed","summary":"I found no defects in the permissions review of `CompanyToken` (COMD), so `.imd-findings.json` holds an empty findings list and a full coverage record.\n\n**What the code is.** `src/CompanyToken.sol` is a plain ERC-20 built on the vendored OpenZeppelin v5.1.0 code. Its only additions are the `INITIAL_SUPPLY` constant (10^27) and a constructor that mints all of it to `msg.sender`. All six vendored files match `SHA256SUMS`, so the inherited code is unmodified. `forge test` passed: 29 tests, including the invariant suite.\n\n**Access Control.** After deployment there is no owner, role, modifier, initializer, mint, burn, pause, blacklist, upgrade path or delegatecall. The compiled method list contains only the standard ERC-20 functions plus `INITIAL_SUPPLY()`. The factory ends up holding the supply and nothing else. `_mint` is internal and only the constructor calls it, so the supply cannot grow. A stranger, including the factory, cannot move a holder's tokens through `transferFrom`: the allowance is checked and reduced before the transfer runs.\n\n**Asymmetry.** I compared the matching pairs (`transfer` against `transferFrom`, `approve` against spending an allowance) and found no write that one side makes and the other misses. Every sender and recipient goes through the same code path, with no fee, exemption list or special-cased address. The one special case is that an allowance of `type(uint256).max` is treated as unlimited, which is standard. Each written value has a matching reader.\n\n**Trust Gap.** None of the four seams can occur here, because there is no privileged actor, no economic formula, and no setter that could redirect value already in transit.\n\n**Coverage rows:**\n- `approve`, `transfer` and `transferFrom` are each marked `holds`.\n- I added three invariant rows, also `holds`:\n  - no privileged role exists after deployment;\n  - the supply cannot grow;\n  - the launch transfers (factory to distributor to claimant, and in and out of the pool manager) move exact amounts.\n\n**Leads I set aside:**\n- The static-analysis \"large numeric literal\" warning is a style note on `1_000_000_000 * 10 ** 18`, not a defect.\n- The well-known ERC-20 approve front-running race is standard behaviour.\n\nI didn't check the launch manifest, because there is none yet. I changed no tracked files. `git status` now shows several untracked dotfiles and folders in the repository root (`.bashrc`, `.claude/`, `.vscode` and others) that I didn't create. They look like environment artifacts, but you should remove them before anything is uploaded.","treeHash":null,"usage":{"cachedInputTokens":307749,"inputTokens":14,"model":"claude-opus-5-5","outputTokens":3744,"runtime":"claude","turns":7,"wallClockMs":49668}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"e67cc6ec4009b226","findings":[],"hash":"905da51dbc5daa3cb0a1cffb90fb50616d088bb2b77612e4eea10fc294c5f78a","nodeId":"3678ffe6-3e4b-44be-8093-2e3f9591794b","outcome":"completed","summary":"The review is complete. The findings file is written, the scratch test is removed, and the working tree is clean apart from the gitignored output.\n\n**Result: no defects found in the math, boundary, or numerical-gap area.** The findings list in `.imd-findings.json` is empty, with ten coverage rows.\n\n**What the token is.** A single file, `src/CompanyToken.sol`, inheriting the vendored OpenZeppelin v5.1.0 ERC-20 unchanged and adding only a supply constant and a constructor mint to the deployer. The vendored library matches its recorded SHA256 sums.\n\n**Math Precision.** There is no division, scaling, fee, cast, or shift anywhere in the token. The supply literal evaluates to exactly 10^27 and agrees with the 18 decimals, so the aderyn large-literal lead is not a defect. The constructor's checked addition starts from zero and cannot overflow. The three unchecked blocks are all in the OpenZeppelin `_update` and `_spendAllowance` functions, and each sits behind the revert that bounds it.\n\n**Boundary.** The token makes no external calls, has no payable function, no receive or fallback, and decodes no bytes. ETH and unknown selectors revert. The only sentinel branches are the zero-address checks. I confirmed that `transferFrom` with a zero `from` cannot reach the mint branch for either a zero or nonzero amount, because the allowance of the zero address can never be set and spending it reverts first.\n\n**Numerical Gap.** The sum of balances equals the total supply exactly under any sequence of moves, confirmed by the tree's own invariant run and a scratch fuzz over arbitrary splits. The launch's 10/80/10 split of 10^27 divides with no residue, so no launch flow arrives short on the token side.\n\n**Verification run.** The existing suite of 29 tests passes, formatting is clean, and nine scratch edge probes passed before I deleted them.\n\n**Trust assumption recorded, not a defect.** Tokens sent to the token's own address are stranded. The README documents this as intended for an ownerless token, so it is noted in coverage rather than reported.","treeHash":null,"usage":{"cachedInputTokens":651740,"inputTokens":290,"model":"claude-fable-5-1","outputTokens":10534,"runtime":"claude","turns":19,"wallClockMs":162373}},{"artifacts":[],"attempt":1,"bundleHash":"38255ec0da8d1c05c0f18e784684c0eaaa22736fef74cffcf63ed924bfde1cee","device":"e7f8c6542ba6fced","findings":[],"hash":"aaf0d1963d63929c115fac65121893665101a267cfd4640fb1396c6880871e25","nodeId":"5b40ef9f-a245-4881-96b5-6dc444069955","outcome":"completed","summary":"Created [launch.json](/home/imd2/.identitymd/work/6e0cd68f-376c-4e7d-9b39-81f1a6493288/5b40ef9f-a245-4881-96b5-6dc444069955/launch.json) matching `CompanyToken`, its constructor, exact supply, and required pool/economics values.\n\nValidation passed: manifest checks, `forge build`, and `forge test`—29 tests passed. Only `launch.json` changed outside permitted scratch files.","treeHash":"fd0e719e8934e0c613ab23c556950de9f1de7012","usage":{"cachedInputTokens":140800,"inputTokens":21345,"model":"gpt-6-astra","outputTokens":2244,"runtime":"codex","turns":3,"wallClockMs":65171}},{"artifacts":[],"attempt":1,"bundleHash":"e82689879e02df750084d60646db7c50af2166fd58535d1b4799a6f2cd75e7b0","device":"2b4e97bb63195f54","findings":[],"hash":"d04a43bfc0d53da8d25ff2d454175e2dd8a11f90db2b567461d8f0ae467ef795","nodeId":"a5bfcc48-ae11-4e6d-af39-241aeb97b50a","outcome":"completed","summary":"Implemented Company.MD (COMD): 1 billion tokens, 18 decimals, minted once to the deployer.\n\nIncluded vendored dependencies, success/failure tests, fuzz and invariant tests, and deployment documentation in README.md.\n\n`forge build`, `forge test`, and `forge fmt --check` pass with Solidity 0.8.26. A clean offline run with an empty environment also passed and reproduced identical bytecode.","treeHash":"4562b0146c518070f237b054b06768a5e1367131","usage":{"cachedInputTokens":494464,"inputTokens":69667,"model":"gpt-6-astra","outputTokens":13697,"runtime":"codex","turns":5,"wallClockMs":479347}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"da7ed792c3bf5b80","findings":[{"citation":"resolved","description":"The periphery pass checked every vendored dependency against the provenance it ships with. lib/openzeppelin-contracts passes: all 6 files match SHA256SUMS and are byte-identical to upstream commit 69c8def5f222ff96f2b5beff05dfba996368aa79. lib/forge-std does not: 7 of the 28 files listed in lib/forge-std/SHA256SUMS have a different SHA-256 than the one recorded (src/StdJson.sol, src/interfaces/IMulticall3.sol, src/console.sol, src/Vm.sol, src/StdAssertions.sol, src/StdToml.sol, src/mocks/MockERC721.sol). The recorded hashes are the correct upstream hashes for v1.9.4 at commit 1eea5bae12ae557d589f9f0f0edae2faa47cb262; it is the vendored files that were changed after hashing. Diffing against upstream shows the change is formatter re-wrapping of function signatures only (whitespace-normalized contents are identical), consistent with `forge fmt` having been run over lib/. Impact: the statement that the sources are unmodified is false, and the integrity check the README points reviewers to (\"file hashes ... are recorded alongside each vendored dependency\") fails, so a reviewer cannot distinguish this benign reformat from a tampered test library without re-fetching upstream as I did. forge-std is compiled only into the test suite (Vm.sol and StdAssertions.sol are in the import closure of every test); CompanyToken's creation and runtime bytecode do not depend on it, so the deployed token is unaffected. Fix: either restore the 7 files to their upstream bytes (and keep lib/ out of forge fmt), or regenerate SHA256SUMS from the files as shipped and reword VENDORED.md to say the sources were reformatted. Pinned-commit comparison should still pass after either change.","line":9,"path":"lib/forge-std/VENDORED.md","reproduction":"From the repository root run:\n\n    cd lib/forge-std && sha256sum -c SHA256SUMS\n\nExpected (per VENDORED.md line 9-10): every line `OK`, exit 0.\nActual: 7 lines `FAILED` (src/StdJson.sol, src/interfaces/IMulticall3.sol, src/console.sol, src/Vm.sol, src/StdAssertions.sol, src/StdToml.sol, src/mocks/MockERC721.sol), `sha256sum: WARNING: 7 computed checksums did NOT match`, exit 1.\n\nCross-check against upstream: `curl -sSfL https://raw.githubusercontent.com/foundry-rs/forge-std/1eea5bae12ae557d589f9f0f0edae2faa47cb262/src/Vm.sol | sha256sum` gives 9ed10705966cec6d7e92a705659039aa8859c8d34bf2e6ba83de7165e984ea91, which equals the SHA256SUMS entry, while `sha256sum lib/forge-std/src/Vm.sol` gives a97ae3a5a13313815470d8b06bc6352c75ecde73761606567872f98cf0d51391. `diff` of the two shows only multi-line signature wrapping collapsed onto single lines (e.g. `parseJsonAddressArray`, `parseJsonBytes32Array`, `assertApproxEqRel`); stripping all whitespace from both files yields identical strings. The same holds for the other 6 files. By contrast `cd lib/openzeppelin-contracts && sha256sum -c SHA256SUMS` prints 6 `OK` lines.","severity":"low","snippet":"Unmodified Solidity sources and upstream MIT/Apache-2.0 licenses are included for tests.\n`SHA256SUMS` records the upstream file contents. No submodule or install step is needed.","title":"Vendored forge-std is not the unmodified upstream its provenance note and SHA256SUMS claim; the shipped integrity check fails on 7 files"}],"hash":"e4402847a033edd891bad9eaa1a35e83a912db3b9454b1974aa7adbfc67c89db","nodeId":"e8784a2e-4887-4630-b8ac-209e33dafd35","outcome":"completed","summary":"The findings file is in place and valid, and the working tree is otherwise untouched. The review is complete.\n\n## Review complete: Company.MD (COMD) control flow\n\n**Result: the token is clean in my area. One low-severity periphery finding, written to `.imd-findings.json` with 11 coverage rows.**\n\n**What the contract is.** `CompanyToken` is 16 lines: it inherits OpenZeppelin v5.1.0 `ERC20`, sets name and symbol, and mints a constant to the deployer. There is no owner, no mint or burn entry point, no hooks, no external calls. The compiled ABI has exactly 10 functions. Seven are views. The other three are the listed entry points.\n\n**Execution Trace pass.** I traced `approve`, `transfer` and `transferFrom` from selector to final storage write through the vendored `_approve`, `_transfer`, `_spendAllowance` and `_update`. Every sentinel path reverts before any write. The `from == address(0)` mint branch of `_update` is unreachable from outside, since `transfer` uses `msg.sender` and `transferFrom` reverts in `_spendAllowance` first. Allowance debit and balance move are one atomic step, so a revert on either restores both. Finite allowances are decremented exactly, `type(uint256).max` is sticky, and `max - 1` is treated as finite. Launch legs (factory to distributor, pool manager and remainder; distributor to claimant; pool manager in and out) arrive to the wei.\n\n**First Principles pass.** The supply constant evaluates to exactly 10^27, which is the manifest figure in 18-decimal minor units. One `Transfer(0, deployer)` event. Decimals is the OpenZeppelin default of 18. Supply cannot grow after the constructor, confirmed by walking the only two supply writes and by probing 12 admin, mint, burn, permit and initializer selectors from both deployer and stranger. Conservation held under a fuzzed transfer/transferFrom probe and the project's own stateful invariant suite.\n\n**Periphery pass.** This is where the one finding lives.\n\n- **OpenZeppelin closure holds.** All 6 vendored files match the shipped `SHA256SUMS` and are byte-identical to upstream commit `69c8def5`. I fetched upstream and compared directly.\n- **forge-std does not match its provenance.** The note says the sources are unmodified and the checksums record upstream contents. Running the shipped check fails on 7 of 28 files, including `Vm.sol` and `StdAssertions.sol`, which sit in every test's import closure. The recorded hashes are the correct upstream hashes. The files were reformatted after hashing. Whitespace-normalized contents are identical, so this is `forge fmt` output, not tampering. It is low severity because the deployed token's creation and runtime bytecode do not depend on forge-std at all, and I verified that independently.\n- **Bytecode.** An opcode walk of both creation and runtime bytecode from the compiled artifact finds no DELEGATECALL, CALLCODE, SELFDESTRUCT, CREATE, CALL or STATICCALL. No immutables, no link references. Metadata confirms solc 0.8.26, Cancun, optimizer at 200 runs, `bytecode_hash = none`, matching `foundry.toml`.\n\n**The aderyn lead** at `src/CompanyToken.sol:10` is the supply constant. It is a compile-time literal equal to the intended supply. Not a defect.\n\n**What I could not reach.** The protected harness imports `src/LaunchLiquidity.sol`, `src/PoolInitializationGuard.sol`, `src/HookFlags.sol` and v4-core, none of which are in this tree, so I could not run the actual Uniswap v4 seed and swap. I verified every token-side leg that harness exercises directly instead, and recorded the row as unreached.\n\n**Housekeeping.** The scratch probe tests and the temporary upstream fetch directories are removed. `git status` shows a clean tree. The findings file is present and parses, and is hidden from `git status` only because `.git/info/exclude` lists it.","treeHash":null,"usage":{"cachedInputTokens":1266722,"inputTokens":321,"model":"claude-fable-5-1","outputTokens":34497,"runtime":"claude","turns":35,"wallClockMs":553156}}],"verification":[{"checks":[{"durationMs":2062,"exitCode":0,"name":"build","output":"Compiling 32 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.92s\nCompiler run successful!\n","passed":true},{"durationMs":7951,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 18 tests for test/CompanyToken.boundaries.t.sol:CompanyTokenBoundaryTest\n[PASS] testFuzz_ApprovalsAndSpendsAreIsolatedByOwnerAndSpender(uint256,uint256) (runs: 1000, μ: 490112, ~: 490204)\nLogs:\n  Bound result 3195757\n  Bound result 355751870454933670068538280\n\n[PASS] testFuzz_FailedSpendCanBeRetriedAfterFunding(uint256,uint256) (runs: 1000, μ: 333925, ~: 334375)\nLogs:\n  Bound result 13452\n  Bound result 999999999999999999999990165\n\n[PASS] testFuzz_SplitTransfersEqualSingleTransfer(uint256,uint256) (runs: 1000, μ: 205100, ~: 205551)\nLogs:\n  Bound result 232176424781560799518194516\n  Bound result 438802701120721175834556597\n\n[PASS] testFuzz_TransfersRoundTripWithExistingRecipientBalance(uint256,uint256) (runs: 1000, μ: 166438, ~: 166650)\nLogs:\n  Bound result 1\n  Bound result 11428\n\n[PASS] test_ApprovalBeforeFundingCanOnlyBeSpentAfterFunding() (gas: 257673)\n[PASS] test_ApprovalsDoNotGrantTransitiveAuthority() (gas: 252304)\n[PASS] test_DelegatedSelfTransferAboveBalanceRollsBackAllowance() (gas: 173931)\n[PASS] test_InfiniteApprovalCanBeReplacedAndRevoked() (gas: 298193)\n[PASS] test_InfiniteApprovalSurvivesEmptyBalanceAndRefill() (gas: 337807)\n[PASS] test_LargestFiniteAllowanceIsConsumed() (gas: 147538)\n[PASS] test_MaximumAmountCannotOverflowDirectOrDelegatedTransfer() (gas: 156114)\n[PASS] test_OneWeiTransferRoundTripIsExact() (gas: 143007)\n[PASS] test_OwnerUsingTransferFromStillNeedsSelfApproval() (gas: 247339)\n[PASS] test_SelfTransferAboveBalanceStillReverts() (gas: 105416)\n[PASS] test_TransferFromZeroOwnerCannotMintEvenZeroAmount() (gas: 103977)\n[PASS] test_ZeroDelegatedTransferEmitsEventAndPreservesFiniteApproval() (gas: 123890)\n[PASS] test_ZeroDelegatedTransferToZeroStillReverts() (gas: 79041)\n[PASS] test_ZeroSpenderRejectsZeroAndMaximumApproval() (gas: 72712)\nSuite result: ok. 18 passed; 0 failed; 0 skipped; finished in 67.90ms (265.61ms CPU time)\n\nRan 28 tests for test/CompanyToken.t.sol:CompanyTokenTest\n[PASS] testFuzz_TransferAboveAllowanceReverts(uint256,uint256) (runs: 512, μ: 123004, ~: 123343)\nLogs:\n  Bound result 668\n  Bound result 7706\n\n[PASS] testFuzz_TransferAboveBalanceReverts(uint256) (runs: 512, μ: 69147, ~: 69480)\nLogs:\n  Bound result 115792089237316195423570985008687907853269984665639564039457584007913129650559\n\n[PASS] testFuzz_TransferFromPreservesBalancesAndAllowance(uint256,uint256) (runs: 512, μ: 164251, ~: 165194)\nLogs:\n  Bound result 24218\n  Bound result 115792089237316195423570985008687907853269984665640564039457584007913129632585\n\n[PASS] testFuzz_TransferPreservesSupplyAndExactBalances(uint256) (runs: 512, μ: 92285, ~: 92278)\nLogs:\n  Bound result 167\n\n[PASS] test_ApprovalCanBeRevoked() (gas: 130804)\n[PASS] test_ApproveEmitsEventAndReplacesAllowance() (gas: 132004)\n[PASS] test_ApproveZeroSpenderReverts() (gas: 37551)\n[PASS] test_ConstructorEmitsExactlyOneMintToImmediateDeployer() (gas: 26536)\n[PASS] test_Create2MintsWholeSupplyToFactory() (gas: 289479)\n[PASS] test_DeployerCannotMoveHolderTokensWithoutApproval() (gas: 158000)\n[PASS] test_InsufficientBalanceRevertsWithoutChanges() (gas: 67703)\n[PASS] test_LaunchDistributionAndTokenRoundTripAreExact() (gas: 650054)\n[PASS] test_MaximumAllowanceIsNotDecremented() (gas: 139355)\n[PASS] test_MetadataAndFixedSupply() (gas: 107672)\n[PASS] test_NoMintBurnOrAdministrativeEntryPoints() (gas: 1295805)\n[PASS] test_RuntimeFitsDeploymentLimitAndHasNoForbiddenOpcodes() (gas: 1038901)\n[PASS] test_SelfTransferPreservesBalance() (gas: 51485)\n[PASS] test_TransferEmitsEventAndDeliversExactAmount() (gas: 91526)\n[PASS] test_TransferEntireSupply() (gas: 86085)\n[PASS] test_TransferFromConsumesFiniteAllowanceAndEmitsTransfer() (gas: 244560)\n[PASS] test_TransferFromInsufficientBalanceRollsBackAllowance() (gas: 126219)\n[PASS] test_TransferFromSelfConsumesAllowanceWithoutChangingBalance() (gas: 105312)\n[PASS] test_TransferFromToZeroRollsBackAllowance() (gas: 114242)\n[PASS] test_TransferToContractDoesNotInvokeReceiver() (gas: 173854)\n[PASS] test_TransferToZeroRevertsEvenForZeroAmount() (gas: 71970)\n[PASS] test_UnapprovedSpenderCannotMoveTokens() (gas: 119815)\n[PASS] test_ZeroTransferFromEmptyAccountEmitsEvent() (gas: 63121)\n[PASS] test_ZeroTransferFromNeedsNoAllowance() (gas: 66109)\nSuite result: ok. 28 passed; 0 failed; 0 skipped; finished in 67.74ms (273.39ms CPU time)\n\nRan 1 test for test/CompanyToken.invariant.t.sol:CompanyTokenInvariantTest\n[PASS]\nCompanyTokenInvariantTest invariants:\n[PASS] invariant_AllAllowancesMatchModel\n[PASS] invariant_MetadataNeverChanges\n[PASS] invariant_TotalSupplyAndAllBalancesMatchModel\n CompanyTokenInvariantTest invariants (runs: 256, calls: 24576, reverts: 0)\n\n╭--------------+-------------------------------------+-------+---------+----------╮\n| Contract     | Selector                            | Calls | Reverts | Discards |\n+=================================================================================+\n| TokenHandler | approve                             | 2521  | 0       | 0        |\n|--------------+-------------------------------------+-------+---------+----------|\n| TokenHandler | approveAndSpend                     | 2510  | 0       | 0        |\n|--------------+-------------------------------------+-------+---------+----------|\n| TokenHandler | rejectDelegatedTransferAboveBalance | 2414  | 0       | 0        |\n|--------------+-------------------------------------+-------+---------+----------|\n| TokenHandler | rejectTransferAboveAllowance        | 2458  | 0       | 0        |\n|--------------+-------------------------------------+-------+---------+----------|\n| TokenHandler | rejectTransferAboveBalance          | 2417  | 0       | 0        |\n|--------------+-------------------------------------+-------+---------+----------|\n| TokenHandler | rejectZeroRecipient                 | 2517  | 0       | 0        |\n|--------------+-------------------------------------+-------+---------+----------|\n| TokenHandler | rejectZeroSpender                   | 2425  | 0       | 0        |\n|--------------+-------------------------------------+-------+---------+----------|\n| TokenHandler | revokeAndRejectSpend                | 2404  | 0       | 0        |\n|--------------+-------------------------------------+-------+---------+----------|\n| TokenHandler | transfer                            | 2442  | 0       | 0        |\n|--------------+-------------------------------------+-------+---------+----------|\n| TokenHandler | transferFrom                        | 2468  | 0       | 0        |\n╰--------------+-------------------------------------+-------+---------+----------╯\n\nLogs:\n  Bound result 7\n  Bound result 580\n  Bound result 0\n  Bound result 0\n  Bound result 999999999999999999999999999\n  Bound result 115792089237316195423570985008687907853269984665640564039457584007913129639934\n  Bound result 0\n  Bound result 78555183788136289922959179412898518425519075774460979925\n  Bound result 4000000000000000000\n  Bound result 0\n  Bound result 1\n  Bound result 10335\n  Bound result 7000000000000000000\n  Bound result 5164\n  Bound result 341\n  Bound result 115792089237316195423570985008687907853269984665640564039457584007913129639934\n  Bound result 96\n  Bound result 16601293455269333379769211165920575946400006927330827471995173226329402849412\n  Bound result 0\n  Bound result 0\n  Bound result 1075\n  Bound result 1\n  Bound result 0\n  Bound result 255\n  Bound result 1\n  Bound result 4537\n  Bound result 115792089237316195423570985008687907853269984665639564039457584007913129648026\n  Bound result 972\n  Bound result 0\n  Bound result 999999999999999999999994833\n  Bound result 2225404287\n  Bound result 115792089237316195423570985008687907853269984665639564039457584007913129645661\n  Bound result 2124644171\n  Bound result 115792089237316195423570985008687907853269984665639564039457584007913129647831\n  Bound result 115792089237316195423570985008687907853269984665639564039457584007913129645676\n  Bound result 115792089237316195423570985008687907853269984665640564039457584007913129639935\n  Bound result 154701729661136434860532681\n  Bound result 9431\n  Bound result 1531\n  Bound result 79613507213630655664976\n  Bound result 8969\n  Bound result 0\n  Bound result 9016\n  Bound result 69745862034039527547732752\n  Bound result 10365\n  Bound result 9237\n  Bound result 1000000000000000000\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 18\n  Bound result 845218656831649934483797162\n  Bound result 4449\n  Bound result 18\n  Bound result 10000000000000000000\n  Bound result 2159204680\n  Bound result 0\n  Bound result 115792089237316195423570985008687907853269984665640563959844076794282473970038\n  Bound result 2084\n  Bound result 3141\n  Bound result 10000000000000000000\n  Bound result 95\n  Bound result 10000000000000000000\n  Bound result 115792089237316195423570985008687907853269984665639718820790752357978645843020\n  Bound result 115792089237316195423570985008687907853269984665640564039457584007913129639935\n  Bound result 115792089237316195423570985008687907853269984665640409337747922871479850953551\n  Bound result 2918\n  Bound result 845218666831649934483800077\n  Bound result 7790\n  Bound result 1149\n  Bound result 0\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 7.84s (7.83s CPU time)\n\nRan 3 test suites in 7.84s (7.97s CPU time): 47 tests passed, 0 failed, 0 skipped (47 total tests)\n","passed":true},{"durationMs":54,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"CompanyToken.approve(address,uint256)\",\"CompanyToken.transfer(address,uint256)\",\"CompanyToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"README.md\":57,\"foundry.toml\":21,\"remappings.txt\":2,\"src/CompanyToken.sol\":16,\"test/CompanyToken.boundaries.t.sol\":298,\"test/CompanyToken.invariant.t.sol\":228,\"test/CompanyToken.t.sol\":394},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"572c3495849c00e337d82026ce7e2358e4f23419a1b471e5bec4d17ffb0470e8","verifiedTreeHash":"80d5feed090718ef53c3cd9c92dfd3cc248a040a","verifierVersion":"0.1.0+327e1e9f"},{"checks":[{"durationMs":2162,"exitCode":0,"name":"build","output":"Compiling 31 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.98s\nCompiler run successful!\n","passed":true},{"durationMs":3563,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 28 tests for test/CompanyToken.t.sol:CompanyTokenTest\n[PASS] testFuzz_TransferAboveAllowanceReverts(uint256,uint256) (runs: 512, μ: 122700, ~: 123341)\nLogs:\n  Bound result 95\n  Bound result 1000000000000000000000000000\n\n[PASS] testFuzz_TransferAboveBalanceReverts(uint256) (runs: 512, μ: 69148, ~: 69480)\nLogs:\n  Bound result 1000000000000000000000000004\n\n[PASS] testFuzz_TransferFromPreservesBalancesAndAllowance(uint256,uint256) (runs: 512, μ: 164355, ~: 165236)\nLogs:\n  Bound result 586616976241875336813268\n  Bound result 14255130673875919707923543627615201046565591419956304814637056621\n\n[PASS] testFuzz_TransferPreservesSupplyAndExactBalances(uint256) (runs: 512, μ: 91923, ~: 92278)\nLogs:\n  Bound result 548094120553967372340910999\n\n[PASS] test_ApprovalCanBeRevoked() (gas: 130804)\n[PASS] test_ApproveEmitsEventAndReplacesAllowance() (gas: 132004)\n[PASS] test_ApproveZeroSpenderReverts() (gas: 37551)\n[PASS] test_ConstructorEmitsExactlyOneMintToImmediateDeployer() (gas: 26536)\n[PASS] test_Create2MintsWholeSupplyToFactory() (gas: 289479)\n[PASS] test_DeployerCannotMoveHolderTokensWithoutApproval() (gas: 158000)\n[PASS] test_InsufficientBalanceRevertsWithoutChanges() (gas: 67703)\n[PASS] test_LaunchDistributionAndTokenRoundTripAreExact() (gas: 650054)\n[PASS] test_MaximumAllowanceIsNotDecremented() (gas: 139355)\n[PASS] test_MetadataAndFixedSupply() (gas: 107672)\n[PASS] test_NoMintBurnOrAdministrativeEntryPoints() (gas: 1295805)\n[PASS] test_RuntimeFitsDeploymentLimitAndHasNoForbiddenOpcodes() (gas: 1038901)\n[PASS] test_SelfTransferPreservesBalance() (gas: 51485)\n[PASS] test_TransferEmitsEventAndDeliversExactAmount() (gas: 91526)\n[PASS] test_TransferEntireSupply() (gas: 86085)\n[PASS] test_TransferFromConsumesFiniteAllowanceAndEmitsTransfer() (gas: 244560)\n[PASS] test_TransferFromInsufficientBalanceRollsBackAllowance() (gas: 126219)\n[PASS] test_TransferFromSelfConsumesAllowanceWithoutChangingBalance() (gas: 105312)\n[PASS] test_TransferFromToZeroRollsBackAllowance() (gas: 114242)\n[PASS] test_TransferToContractDoesNotInvokeReceiver() (gas: 173854)\n[PASS] test_TransferToZeroRevertsEvenForZeroAmount() (gas: 71970)\n[PASS] test_UnapprovedSpenderCannotMoveTokens() (gas: 119815)\n[PASS] test_ZeroTransferFromEmptyAccountEmitsEvent() (gas: 63121)\n[PASS] test_ZeroTransferFromNeedsNoAllowance() (gas: 66109)\nSuite result: ok. 28 passed; 0 failed; 0 skipped; finished in 31.91ms (126.08ms CPU time)\n\nRan 1 test for test/CompanyToken.invariant.t.sol:CompanyTokenInvariantTest\n[PASS]\nCompanyTokenInvariantTest invariants:\n[PASS] invariant_AllAllowancesMatchModel\n[PASS] invariant_TotalSupplyAndAllBalancesMatchModel\n CompanyTokenInvariantTest invariants (runs: 128, calls: 8192, reverts: 0)\n\n╭--------------+--------------+-------+---------+----------╮\n| Contract     | Selector     | Calls | Reverts | Discards |\n+==========================================================+\n| TokenHandler | approve      | 2764  | 0       | 0        |\n|--------------+--------------+-------+---------+----------|\n| TokenHandler | transfer     | 2695  | 0       | 0        |\n|--------------+--------------+-------+---------+----------|\n| TokenHandler | transferFrom | 2733  | 0       | 0        |\n╰--------------+--------------+-------+---------+----------╯\n\nLogs:\n  Bound result 127\n  Bound result 542711525879964914778682153\n  Bound result 2894\n  Bound result 5403\n  Bound result 0\n  Bound result 5070\n  Bound result 1131\n  Bound result 0\n  Bound result 0\n  Bound result 252303348699174050863100893\n  Bound result 3657\n  Bound result 456027526293571428316437055\n  Bound result 4603\n  Bound result 23186230028847142\n  Bound result 4355\n  Bound result 145\n  Bound result 0\n  Bound result 1000000000000000000\n  Bound result 2998\n  Bound result 12\n  Bound result 343\n  Bound result 6\n  Bound result 982\n  Bound result 255\n  Bound result 12\n  Bound result 742\n  Bound result 24576\n  Bound result 0\n  Bound result 0\n  Bound result 682\n  Bound result 2563\n  Bound result 148\n  Bound result 8\n  Bound result 10000000000000000000\n  Bound result 4288775754\n  Bound result 127\n  Bound result 3787\n  Bound result 255\n  Bound result 6940\n  Bound result 4000000000000000000\n  Bound result 3\n  Bound result 127\n  Bound result 949\n  Bound result 444285961813995026418524690\n  Bound result 1000000000\n  Bound result 659\n  Bound result 34\n  Bound result 8\n  Bound result 558\n  Bound result 17000000000000000000\n  Bound result 314\n  Bound result 839\n  Bound result 1260947826463656904897798\n  Bound result 335\n  Bound result 327\n  Bound result 43\n  Bound result 1572\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 3.42s (3.42s CPU time)\n\nRan 2 test suites in 3.42s (3.45s CPU time): 29 tests passed, 0 failed, 0 skipped (29 total tests)\n","passed":true},{"durationMs":80,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"CompanyToken.approve(address,uint256)\",\"CompanyToken.transfer(address,uint256)\",\"CompanyToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"README.md\":57,\"foundry.toml\":21,\"launch.json\":24,\"remappings.txt\":2,\"src/CompanyToken.sol\":16,\"test/CompanyToken.invariant.t.sol\":102,\"test/CompanyToken.t.sol\":394},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"aaf0d1963d63929c115fac65121893665101a267cfd4640fb1396c6880871e25","verifiedTreeHash":"fd0e719e8934e0c613ab23c556950de9f1de7012","verifierVersion":"0.1.0+327e1e9f"},{"checks":[{"durationMs":1194,"exitCode":0,"name":"build","output":"Compiling 31 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.08s\nCompiler run successful!\n","passed":true},{"durationMs":2213,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 28 tests for test/CompanyToken.t.sol:CompanyTokenTest\n[PASS] testFuzz_TransferAboveAllowanceReverts(uint256,uint256) (runs: 512, μ: 123052, ~: 123331)\nLogs:\n  Bound result 2395\n  Bound result 2397\n\n[PASS] testFuzz_TransferAboveBalanceReverts(uint256) (runs: 512, μ: 69152, ~: 69480)\nLogs:\n  Bound result 134931986202881115724822790586450160293349905165623442\n\n[PASS] testFuzz_TransferFromPreservesBalancesAndAllowance(uint256,uint256) (runs: 512, μ: 164437, ~: 165258)\nLogs:\n  Bound result 1\n  Bound result 2395\n\n[PASS] testFuzz_TransferPreservesSupplyAndExactBalances(uint256) (runs: 512, μ: 91969, ~: 92278)\nLogs:\n  Bound result 10000000000000000000\n\n[PASS] test_ApprovalCanBeRevoked() (gas: 130804)\n[PASS] test_ApproveEmitsEventAndReplacesAllowance() (gas: 132004)\n[PASS] test_ApproveZeroSpenderReverts() (gas: 37551)\n[PASS] test_ConstructorEmitsExactlyOneMintToImmediateDeployer() (gas: 26536)\n[PASS] test_Create2MintsWholeSupplyToFactory() (gas: 289479)\n[PASS] test_DeployerCannotMoveHolderTokensWithoutApproval() (gas: 158000)\n[PASS] test_InsufficientBalanceRevertsWithoutChanges() (gas: 67703)\n[PASS] test_LaunchDistributionAndTokenRoundTripAreExact() (gas: 650054)\n[PASS] test_MaximumAllowanceIsNotDecremented() (gas: 139355)\n[PASS] test_MetadataAndFixedSupply() (gas: 107672)\n[PASS] test_NoMintBurnOrAdministrativeEntryPoints() (gas: 1295805)\n[PASS] test_RuntimeFitsDeploymentLimitAndHasNoForbiddenOpcodes() (gas: 1038901)\n[PASS] test_SelfTransferPreservesBalance() (gas: 51485)\n[PASS] test_TransferEmitsEventAndDeliversExactAmount() (gas: 91526)\n[PASS] test_TransferEntireSupply() (gas: 86085)\n[PASS] test_TransferFromConsumesFiniteAllowanceAndEmitsTransfer() (gas: 244560)\n[PASS] test_TransferFromInsufficientBalanceRollsBackAllowance() (gas: 126219)\n[PASS] test_TransferFromSelfConsumesAllowanceWithoutChangingBalance() (gas: 105312)\n[PASS] test_TransferFromToZeroRollsBackAllowance() (gas: 114242)\n[PASS] test_TransferToContractDoesNotInvokeReceiver() (gas: 173854)\n[PASS] test_TransferToZeroRevertsEvenForZeroAmount() (gas: 71970)\n[PASS] test_UnapprovedSpenderCannotMoveTokens() (gas: 119815)\n[PASS] test_ZeroTransferFromEmptyAccountEmitsEvent() (gas: 63121)\n[PASS] test_ZeroTransferFromNeedsNoAllowance() (gas: 66109)\nSuite result: ok. 28 passed; 0 failed; 0 skipped; finished in 17.19ms (68.17ms CPU time)\n\nRan 1 test for test/CompanyToken.invariant.t.sol:CompanyTokenInvariantTest\n[PASS]\nCompanyTokenInvariantTest invariants:\n[PASS] invariant_AllAllowancesMatchModel\n[PASS] invariant_TotalSupplyAndAllBalancesMatchModel\n CompanyTokenInvariantTest invariants (runs: 128, calls: 8192, reverts: 0)\n\n╭--------------+--------------+-------+---------+----------╮\n| Contract     | Selector     | Calls | Reverts | Discards |\n+==========================================================+\n| TokenHandler | approve      | 2739  | 0       | 0        |\n|--------------+--------------+-------+---------+----------|\n| TokenHandler | transfer     | 2708  | 0       | 0        |\n|--------------+--------------+-------+---------+----------|\n| TokenHandler | transferFrom | 2745  | 0       | 0        |\n╰--------------+--------------+-------+---------+----------╯\n\nLogs:\n  Bound result 5717\n  Bound result 0\n  Bound result 0\n  Bound result 4\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 562638967353758887432161012\n  Bound result 0\n  Bound result 0\n  Bound result 445792387456198902\n  Bound result 1588\n  Bound result 0\n  Bound result 1\n  Bound result 614\n  Bound result 0\n  Bound result 5\n  Bound result 107477463\n  Bound result 613\n  Bound result 442\n  Bound result 9\n  Bound result 13\n  Bound result 7\n  Bound result 1\n  Bound result 519\n  Bound result 0\n  Bound result 255\n  Bound result 2481\n  Bound result 2\n  Bound result 0\n  Bound result 999999999554207612543797543\n  Bound result 4792\n  Bound result 3\n  Bound result 3762676340406947866\n  Bound result 0\n  Bound result 5\n  Bound result 13\n  Bound result 49\n  Bound result 5\n  Bound result 187\n  Bound result 14\n  Bound result 5\n  Bound result 8\n  Bound result 24814\n  Bound result 4\n  Bound result 127\n  Bound result 0\n  Bound result 2110234842\n  Bound result 4233\n  Bound result 48852980310366539947385308\n  Bound result 123\n  Bound result 759\n  Bound result 95\n  Bound result 222076021941233388\n  Bound result 0\n  Bound result 2670\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 2.13s (2.13s CPU time)\n\nRan 2 test suites in 2.13s (2.15s CPU time): 29 tests passed, 0 failed, 0 skipped (29 total tests)\n","passed":true},{"durationMs":37,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"CompanyToken.approve(address,uint256)\",\"CompanyToken.transfer(address,uint256)\",\"CompanyToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"README.md\":57,\"foundry.toml\":21,\"remappings.txt\":2,\"src/CompanyToken.sol\":16,\"test/CompanyToken.invariant.t.sol\":102,\"test/CompanyToken.t.sol\":394},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true},{"durationMs":378,"exitCode":0,"name":"slither","output":"slither: no results at low impact or above","passed":true},{"durationMs":199,"exitCode":0,"name":"aderyn","output":"[low] large-numeric-literal at src/CompanyToken.sol:10: Large Numeric Literal","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"d04a43bfc0d53da8d25ff2d454175e2dd8a11f90db2b567461d8f0ae467ef795","verifiedTreeHash":"4562b0146c518070f237b054b06768a5e1367131","verifierVersion":"0.1.0+327e1e9f"}]}