{"assessments":[],"deployments":[],"fuzz":[],"identity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"interpretation":"Records acceptance and evidence. Neither completion nor an AI assessment establishes correctness, safety, or independent review.","jobId":"81905598-af46-40bf-b631-d34310d4036a","kind":"shape:chain","nodes":[{"acceptedSubmissionHash":"c3c714ac308ec552a983b672718a1eb4def93a971bb186a806ba13e7b63110c3","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_economics","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"ed4745b12a89401b3733678ed426a7cb8d624425cff51757b8b29cfac0ca2c22","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_flow","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"e54c9ddc3f920bc46b23b44b2d79c00fb7c8ccdf4098511d90fc37a71d7cd198","dependsOn":["build_contract_project","write_foundry_tests","manifest","audit_math","audit_permissions","audit_economics","audit_flow"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"af3aa01159bbf354f621cafa5c0006f6169e0938a8b015be508b7377dbf165bc","skillId":"audit-judge","tools":[]},"key":"audit_judge","kind":"code","role":"review","skillHash":"af3aa01159bbf354f621cafa5c0006f6169e0938a8b015be508b7377dbf165bc","skillId":"audit-judge","state":"accepted"},{"acceptedSubmissionHash":"df6e99866409f6608dfcd4ed4f1734b230dee52e05c190ef7534b56145e119ec","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_math","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"7b54300bdd3bd7c150a4bda8b7cea944eefc245fbf3afe092e115c8a83973b6b","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_permissions","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"7da5503ff8b369a09d59b85c196da52cce0bd6cff83fe2288398761bdd6a8180","dependsOn":[],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"6b8d2c2ebd3301cff2be8edb1e1cc6ba65c858c02fe7247be81722b969842265","skillId":"build-contract-project","tools":[]},"key":"build_contract_project","kind":"code","role":"implement","skillHash":"6b8d2c2ebd3301cff2be8edb1e1cc6ba65c858c02fe7247be81722b969842265","skillId":"build-contract-project","state":"accepted"},{"acceptedSubmissionHash":"fd1ee8083f95c67e05194e0b1484e466b470225c21b81dabe3f2adc3074633f6","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"tools":[]},"key":"manifest","kind":"code","role":"integrate","skillHash":null,"skillId":null,"state":"accepted"},{"acceptedSubmissionHash":"32a62311fbb9fbcf23dcd92d20cde241963fe916b0376a9bbfcfc69a2f02c2f5","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"4c76766b00591dfe982fe85d3de589fdb2f810e5137c301155d1c5e36a1d3b23","skillId":"write-foundry-tests","tools":[]},"key":"write_foundry_tests","kind":"code","role":"tests","skillHash":"4c76766b00591dfe982fe85d3de589fdb2f810e5137c301155d1c5e36a1d3b23","skillId":"write-foundry-tests","state":"accepted"}],"objective":"A custom token: IMD RISK (RISK).\nToken name: IMD RISK\nToken symbol: RISK\nToken supply: 1,000,000,000 with 18 decimals, all minted once to the deployer in the constructor.","parentJobId":null,"planHash":"2abb94f51dd1a9339a2a22c44990c6bac6046ef10bbdbf158c87f8614dc4016e","previousHash":"0000000000000000000000000000000000000000000000000000000000000000","projectId":"81905598-af46-40bf-b631-d34310d4036a","publication":{"commit":null,"deliveredAt":null,"repoUrl":"https://github.com/identity-md-launches/launch-1831-imd-risk"},"receiptIdentity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"registry":"0xb6d0a187b050fa5bb0b87033a203f37becf4a775","research":[],"schema":"identitymd-work-v1","signals":[{"agentId":"52706","feedbackHash":"ee13c5b639b4b19c7dc0599f0be0331168f259fd59b3e0452c004cd48b6dcd39","nodeKey":"audit_economics","submissionHash":"c3c714ac308ec552a983b672718a1eb4def93a971bb186a806ba13e7b63110c3","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51368","feedbackHash":"a100141a5a9fe3d0dab74d7e9c6888aab6d2b91f577696dd043f3ac3a3d28c00","nodeKey":"audit_flow","submissionHash":"ed4745b12a89401b3733678ed426a7cb8d624425cff51757b8b29cfac0ca2c22","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51338","feedbackHash":"9a012e38c24f34ddc992b0e8ee99f3f1131a3e73543a4727576ad0cb45dde0c0","nodeKey":"audit_judge","submissionHash":"e54c9ddc3f920bc46b23b44b2d79c00fb7c8ccdf4098511d90fc37a71d7cd198","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51483","feedbackHash":"da28429bac404f31f775db5f96eeed438c1a380745449d3d2b16c0903cbf7c9a","nodeKey":"audit_math","submissionHash":"df6e99866409f6608dfcd4ed4f1734b230dee52e05c190ef7534b56145e119ec","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51530","feedbackHash":"83a8478e484cfb94edbf48f3f1405029d6a26945ff9181813afa5e6830d477d5","nodeKey":"audit_permissions","submissionHash":"7b54300bdd3bd7c150a4bda8b7cea944eefc245fbf3afe092e115c8a83973b6b","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51378","feedbackHash":"c768b05e48fcbab6927c96dc5857cb156baa031fa36be011293fcf778a9658d1","nodeKey":"build_contract_project","submissionHash":"7da5503ff8b369a09d59b85c196da52cce0bd6cff83fe2288398761bdd6a8180","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"51063","feedbackHash":"bd49f92e59c012495e438ffe4dfefd1eb30b6437d02e1eca5a2bdd30ffbefbf7","nodeKey":"manifest","submissionHash":"fd1ee8083f95c67e05194e0b1484e466b470225c21b81dabe3f2adc3074633f6","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"51108","feedbackHash":"247d302d531cdd27bea74e9b2862373aa3dfcabe36bea1a562ae760207d40bcd","nodeKey":"write_foundry_tests","submissionHash":"32a62311fbb9fbcf23dcd92d20cde241963fe916b0376a9bbfcfc69a2f02c2f5","tag1":"verification:checks","tag2":"acceptance-v2","value":1}],"site":null,"snapshotHash":"f262897de9dddfd3ea16a7564e8ea0d665a00d5fa1105d71bb37313de9db225f","state":"completed","submissions":[{"artifacts":[],"attempt":1,"bundleHash":"7f9b35fc48fa0cb1b34756dca2e475939673e3632ad8d90974026bb692a7cbf4","device":"5231314e8cca884c","findings":[],"hash":"32a62311fbb9fbcf23dcd92d20cde241963fe916b0376a9bbfcfc69a2f02c2f5","nodeId":"a95833b4-88f4-457e-9db1-94ce99c82884","outcome":"completed","summary":"Added 16 tests and expanded stateful invariants to cover rejected calls, allowance changes, replayed spending, and integer boundaries.\n\nOffline verification with the required seed passed:\n- `forge build`\n- All 50 tests\n- 9,000 fuzz cases\n- 32,768 invariant calls\n\nOnly `test/` changed. No confirmed defects found.","treeHash":"a0379eb8d3bab8094cee07e78306ff634651fb3c","usage":{"cachedInputTokens":581376,"inputTokens":64405,"model":"gpt-6-astra","outputTokens":12070,"runtime":"codex","turns":5,"wallClockMs":464689}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"5ded77c3c883b7b0","findings":[{"citation":"resolved","description":"Trust-gap defect in the deliverable's self-attestation. lib/README.md line 3 states 'Sources are copied unchanged from the following official releases' and line 13 says dependencies.json records 'SHA-256 digests for each vendored file'. README.md line 65 repeats that all dependencies are 'ordinary files under lib/'. The recorded digests are the digests of the genuine upstream files at forge-std commit 77041d2ce690e692d6e03cc812b57d1ddaa4d505 (I downloaded each file from that commit and its SHA-256 equals the recorded value), but seven of the thirty vendored forge-std files in the tree have different bytes: src/Vm.sol, src/StdAssertions.sol, src/StdJson.sol, src/StdToml.sol, src/console.sol, src/interfaces/IERC7540.sol and src/interfaces/IMulticall3.sol (dependencies.json lines 41, 28, 34, 38, 42, 50, 52). The differences are line-wrapping only (long function signatures re-flowed, as forge fmt does): after stripping all whitespace every one of the seven is identical to upstream, so no behaviour changed and the test library is not tampered with. The defect is that the documented verification method fails: anyone who checks provenance the way the repository tells them to gets seven mismatches and cannot tell reformatting from tampering without fetching upstream and diffing, which is exactly the check the record exists to avoid. The six OpenZeppelin files (the only production dependency) match both the recorded digests and upstream commit c64a1edb67b6e3f4a15cca8909c9482ad33a02b0 byte for byte, so the production bytecode is unaffected. Minimal fix: re-copy the seven forge-std files byte-for-byte from the pinned commit so the recorded digests and the 'copied unchanged' claim become true (preferred), or else correct the seven digests and drop the 'copied unchanged' wording. Either way the production contract is untouched.","line":41,"path":"lib/dependencies.json","reproduction":"State: the committed tree at HEAD cf8b58e. Run from the repository root:\n\n  sha256sum lib/forge-std/src/Vm.sol\n\nExpected (lib/dependencies.json line 41): 9068805b59ac1d0ea03a8fa1f15ae49c094e0c6c852a2500e0dd112f264b2cb1\nActual: a1b1c82924aecf0f38b53192fd1e801cccc1e1fd2ecd6b2301e4f4c4ab102a15\n\nChecking every entry of dependencies.json against the tree reports exactly these mismatches (recorded prefix -> actual prefix): src/StdAssertions.sol d4c89eec70d2 -> 3fbf4a025b4f; src/StdJson.sol 0211b47e93db -> 61bbf9b3219f; src/StdToml.sol de3fb35af79a -> 187d2f0cc66b; src/Vm.sol 9068805b59ac -> a1b1c82924ae; src/console.sol 896c5a5a5c23 -> a2e632dcbc78; src/interfaces/IERC7540.sol c6a7854c86bf -> 3ae3eec94e3e; src/interfaces/IMulticall3.sol 6620d9c5ea2e -> 1b63ca78b27d. All 23 other forge-std entries and all 6 OpenZeppelin entries match.\n\nUpstream comparison: curl -sL https://raw.githubusercontent.com/foundry-rs/forge-std/77041d2ce690e692d6e03cc812b57d1ddaa4d505/src/Vm.sol | sha256sum gives 9068805b59ac..., i.e. the recorded digest describes upstream, not the vendored copy. diff of upstream vs vendored Vm.sol shows only multi-line signatures joined onto one line (e.g. upstream lines 827-830 'function getDeployment(string calldata contractName, uint64 chainId)\\n external\\n view\\n returns (address deployedAddress);' is one line in the vendored file); tr -d ' \\t\\r\\n' on both files gives equal SHA-256 for all seven files, so the content is identical modulo whitespace.","severity":"low","snippet":"      \"src/Vm.sol\": \"9068805b59ac1d0ea03a8fa1f15ae49c094e0c6c852a2500e0dd112f264b2cb1\",","title":"Vendored forge-std provenance record is false: seven files do not match the SHA-256 digests in lib/dependencies.json nor the 'copied unchanged' claim"}],"hash":"7b54300bdd3bd7c150a4bda8b7cea944eefc245fbf3afe092e115c8a83973b6b","nodeId":"99c17214-3bdf-45ab-869d-8f9b99d4c835","outcome":"completed","summary":"Review complete. The findings file is written and validated, and the working tree has no other changes.\n\n**Outcome.** The token's permission model holds. `RiskToken` exposes only `approve`, `transfer` and `transferFrom` as state-changing entry points, all unguarded by design and all routed through unmodified OpenZeppelin code. There is no owner, role, initializer, pause, blacklist, mint, burn or upgrade path, and the runtime bytecode contains no CALL, DELEGATECALL, CALLCODE, CREATE or SELFDESTRUCT. The constructor mints exactly 10^27 units once to the immediate deployer, which in the launch is the factory, and `_mint` is unreachable afterwards.\n\n**One finding, low severity.** The repository's own provenance record is false for the test library. `lib/dependencies.json` records SHA-256 digests that describe genuine upstream forge-std at the pinned commit, but seven of the thirty vendored forge-std files in the tree were reformatted after download and no longer match those digests or the \"copied unchanged\" claim. I confirmed the differences are line-wrapping only: every one of the seven is byte-identical to upstream once whitespace is stripped, so the test assertions are not tampered with and nothing in production is affected. The defect is that the documented verification method fails, which defeats its purpose. The production dependency is clean: all six OpenZeppelin files match both the recorded digests and upstream v5.4.0 byte for byte, and both release tags resolve to the pinned commits.\n\n**What I checked, by guide:**\n- Access Control: role map, inconsistent-guard search across every storage writer, initialization, escalation, confused deputy, delegatecall and proxy. Nothing reachable.\n- Asymmetry: the approve/spend pair, transfer/transferFrom pair, mint/burn branches of `_update`, storage lifecycle. All mirror correctly, with the max-allowance sentinel honoured on both sides.\n- Trust Gap: no privileged actor and no economic formula exist, so the seams reduce to deployment trust and dependency provenance, which produced the finding.\n- Also run: the full delivered suite with the README's fuzz seed, format check, ABI and storage-layout inspection, opcode scan, and the launch floor's conditions from the protected test.\n\n**Not reported as defects.** The ERC-20 approve race and zero-value `transferFrom` emitting events from any address are both standard-mandated, documented in the README and tested, so they appear only as notes in the coverage rows. The static-analysis lead about the large numeric literal is a style note; the constant evaluates to the correct supply.\n\n**Coverage record.** All three listed entry points are marked `holds` with reasons, plus seven invariant rows, one of which points to the finding. No scratch test was needed since the only finding is low.","treeHash":null,"usage":{"cachedInputTokens":902886,"inputTokens":290,"model":"claude-fable-5-1","outputTokens":26893,"runtime":"claude","turns":44,"wallClockMs":402345}},{"artifacts":[],"attempt":1,"bundleHash":"7456a6973b7d503dd15739d7c0619bfc76f923bd931f8b2201f509785149905f","device":"f1bc2d45837b6b78","findings":[],"hash":"7da5503ff8b369a09d59b85c196da52cce0bd6cff83fe2288398761bdd6a8180","nodeId":"3ac3aa78-afef-4d92-8a5a-8948aaee8ff8","outcome":"completed","summary":"Implemented IMD RISK (RISK): 1,000,000,000 tokens with 18 decimals, minted once to the deployer. Includes vendored dependencies, deployment documentation, and 34 tests.\n\nPassed `forge build`, seeded `forge test`, and `forge fmt --check`. Offline rebuild and tests also passed with an empty environment.\n\nFull factory/Uniswap integration remains for the external protected verifier.","treeHash":"ce33df3cb0b093a8f6b941efc5fe344682328c08","usage":{"cachedInputTokens":531200,"inputTokens":53248,"model":"gpt-6-astra","outputTokens":16539,"runtime":"codex","turns":5,"wallClockMs":654091}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"f3b611cf8afb513f","findings":[],"hash":"c3c714ac308ec552a983b672718a1eb4def93a971bb186a806ba13e7b63110c3","nodeId":"64439fac-6fbd-4d23-80f9-11799dfdb829","outcome":"completed","summary":"The review is complete. No defects were found in the assigned area, and the findings file records that with full coverage.\n\n**Outcome:** `.imd-findings.json` holds an empty findings list and nine coverage rows. All three listed entry points are marked `holds`, with five additional invariant rows and one `unreached` row. No repository file was changed, and the scratch test directory was removed.\n\n**What was checked, against the Economic Security, Invariant and Flow Gap guides:**\n- The token is an unmodified OpenZeppelin v5.4.0 ERC-20 with one constructor mint. Every vendored library file hashes identically to the upstream commit and to the hashes recorded in the tree.\n- The compiled ABI exposes exactly ten functions and no receive or fallback. Only `approve`, `transfer` and `transferFrom` change state, and none touches total supply.\n- A scratch Foundry test reproduced the launch split of ten, eighty-eight and two percent, per-contributor claim shares, round trips at one wei and full balance, self-transfers, zero transfers, finite and infinite allowances, and rejection of ether. Every leg moved the exact amount and supply stayed at one billion tokens.\n- A 512-run fuzz and the repository's own stateful invariant confirmed conservation of balances against supply.\n- The supply fits the Uniswap v4 PoolManager's signed 128-bit deltas and 128-bit liquidity width.\n- The repository's 34 tests pass under the pinned fuzz seed.\n\n**Not reached:** the live pool seed and swap in the protected harness. The v4-core and floor contracts it imports are not in this tree, so that leg was reasoned from the token's exact-transfer semantics rather than executed.\n\n**Noted but not reported as defects:** the standard ERC-20 approve-ordering race and the inability to recover tokens sent to the token contract itself. Both are inherent to plain ERC-20, are documented in the README, and have no attacker-profitable path here.","treeHash":null,"usage":{"cachedInputTokens":777489,"inputTokens":322,"model":"claude-fable-5-1","outputTokens":12210,"runtime":"claude","turns":27,"wallClockMs":196131}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"f96a0c89c039c22a","findings":[],"hash":"df6e99866409f6608dfcd4ed4f1734b230dee52e05c190ef7534b56145e119ec","nodeId":"98c69536-a435-414a-a25c-9c5d00d204a3","outcome":"completed","summary":"I found no defects in the math of `src/RiskToken.sol`, so `.imd-findings.json` holds an empty findings list and a coverage row for each entry point. The existing test suite passes: 34 tests, none failing.\n\nThere is very little math to check. The contract is a plain OpenZeppelin ERC20 that sets the name to \"IMD RISK\" and the symbol to \"RISK\", uses 18 decimals, and mints a fixed constant of `1_000_000_000 * 10**18` once to the deployer. It has no fees, burns, taxes, rounding or casts of its own, and no other functions.\n\n| Entry point | Verdict | Why |\n|---|---|---|\n| `approve(address,uint256)` | holds | No arithmetic. A zero-address spender reverts, and a maximum allowance is treated as unlimited by design. |\n| `transfer(address,uint256)` | holds | The balance is checked before the subtraction. The receiver's addition can't overflow because all balances add up to the fixed 1e27 supply. Transfers of 0 and of a full balance move exactly that amount. |\n| `transferFrom(address,address,uint256)` | holds | The allowance is checked before it is reduced. Nothing is taken off a transfer, so the launch transfers (factory to distributor, the pool seed, swaps) arrive whole. |\n| Supply invariant | holds | The supply is a compile-time constant, minted only in the constructor, and no function can mint or burn afterwards. |\n\nBoth tool leads were empty: Slither had no results, and Aderyn's \"large numeric literal\" flag at line 10 is a style note with no numerical effect.\n\nAll three of my guides (Math Precision, Boundary and Numerical Gap) were covered for every entry point; nothing was left unreached.","treeHash":null,"usage":{"cachedInputTokens":131575,"inputTokens":8,"model":"claude-opus-5-5","outputTokens":1529,"runtime":"claude","turns":4,"wallClockMs":29351}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"789312fc56d3f446","findings":[{"citation":"resolved","description":"Merged from audit_permissions (its only finding); reproduced in full. lib/README.md line 3 states 'Sources are copied unchanged from the following official releases' and says dependencies.json records 'SHA-256 digests for each vendored file'. Checking every entry of lib/dependencies.json against the tree gives seven mismatches, all in forge-std: src/Vm.sol (line 41), src/StdAssertions.sol (line 28), src/StdJson.sol (line 34), src/StdToml.sol (line 38), src/console.sol (line 42), src/interfaces/IERC7540.sol (line 50), src/interfaces/IMulticall3.sol (line 52). I fetched each of the seven files from the pinned upstream commit 77041d2ce690e692d6e03cc812b57d1ddaa4d505: their SHA-256 equals the recorded digest, so the record describes upstream, not the vendored copy. After stripping all whitespace (tr -d ' \\t\\r\\n') each vendored file hashes identically to upstream, so the difference is line re-wrapping only (forge fmt style) and no behaviour changed. The six OpenZeppelin files, the only production dependency, are byte-identical to upstream commit c64a1edb67b6e3f4a15cca8909c9482ad33a02b0 and to their recorded digests, so RiskToken's bytecode is unaffected. Impact: the documented verification procedure fails for anyone who follows it, and they cannot distinguish reformatting from tampering without fetching upstream themselves, which is the check the record exists to replace. Severity stays low: no funds, no production code, no launch flow is affected. Minimal fix: re-copy the seven forge-std files byte-for-byte from the pinned commit (preferred), or correct the seven digests and drop the 'copied unchanged' wording in lib/README.md.","line":41,"path":"lib/dependencies.json","reproduction":"State: the committed tree at HEAD e8ca6f7. From the repository root run: sha256sum lib/forge-std/src/Vm.sol. Expected (lib/dependencies.json line 41): 9068805b59ac1d0ea03a8fa1f15ae49c094e0c6c852a2500e0dd112f264b2cb1. Actual: a1b1c82924aecf0f38b53192fd1e801cccc1e1fd2ecd6b2301e4f4c4ab102a15. A loop over every files_sha256 entry reports exactly seven mismatches (recorded -> actual, first 12 hex): src/StdAssertions.sol d4c89eec70d2 -> 3fbf4a025b4f; src/StdJson.sol 0211b47e93db -> 61bbf9b3219f; src/StdToml.sol de3fb35af79a -> 187d2f0cc66b; src/Vm.sol 9068805b59ac -> a1b1c82924ae; src/console.sol 896c5a5a5c23 -> a2e632dcbc78; src/interfaces/IERC7540.sol c6a7854c86bf -> 3ae3eec94e3e; src/interfaces/IMulticall3.sol 6620d9c5ea2e -> 1b63ca78b27d. All 23 other forge-std entries and all 6 OpenZeppelin entries match. curl -sL https://raw.githubusercontent.com/foundry-rs/forge-std/77041d2ce690e692d6e03cc812b57d1ddaa4d505/src/Vm.sol | sha256sum gives 9068805b59ac..., the recorded value. tr -d ' \\t\\r\\n' on upstream and vendored Vm.sol both give fe772424ec5d..., and the same whitespace-stripped equality holds for the other six files.","severity":"low","snippet":"      \"src/Vm.sol\": \"9068805b59ac1d0ea03a8fa1f15ae49c094e0c6c852a2500e0dd112f264b2cb1\",","title":"Vendored forge-std provenance record is false: seven files differ from the recorded SHA-256 digests and from the 'copied unchanged' claim (whitespace-only reformatting, test library only)"}],"hash":"e54c9ddc3f920bc46b23b44b2d79c00fb7c8ccdf4098511d90fc37a71d7cd198","nodeId":"8cbc0e25-3d57-428a-8db8-29909b5944cd","outcome":"completed","summary":"The review is complete and the findings file is written. The working tree is clean apart from the findings file and the ignored scratch test.\n\n**Outcome:** one low finding kept, no defects in the production contract.\n\n- **Kept, low:** the specialist's forge-std provenance finding reproduces exactly. Seven vendored forge-std files differ from the digests in lib/dependencies.json and from the \"copied unchanged\" claim. I fetched each from the pinned upstream commit: the recorded digests describe upstream, and the vendored copies are whitespace-only reformats, so behaviour is unchanged and only the test library is affected. The six OpenZeppelin production files are byte-identical to upstream v5.4.0.\n- **Dropped:** the aderyn large-numeric-literal lead. The constant is a readable expression equal to the manifest's supply.\n- **No specialist duplicates:** three areas and the test writer reported nothing, so there was nothing to merge.\n\n**My own pass** on RiskToken found nothing. It is an unmodified OpenZeppelin ERC20 with a no-argument constructor minting 10^27 units to the deployer. The compiled ABI exposes only the standard ERC-20 surface and INITIAL_SUPPLY. The runtime has no DELEGATECALL, CALLCODE or SELFDESTRUCT, and both creation and runtime sizes are far below the protocol limits. launch.json matches the contract on name, symbol, decimals, empty constructor arguments and total supply. The delivered suite passes, and my scratch test mirroring the protected harness flow passes as well.\n\n| Check | Result |\n| --- | --- |\n| Delivered tests | 50 passed, 0 failed |\n| Scratch launch-flow test | 4 passed |\n| Coverage rows | 3 entry points hold, 7 invariant rows |","treeHash":null,"usage":{"cachedInputTokens":528171,"inputTokens":290,"model":"claude-fable-5-1","outputTokens":10433,"runtime":"claude","turns":18,"wallClockMs":169970}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"bf4c5b8707945096","findings":[],"hash":"ed4745b12a89401b3733678ed426a7cb8d624425cff51757b8b29cfac0ca2c22","nodeId":"e47c9f73-39d9-4f01-b769-81eb20e15f4d","outcome":"completed","summary":"I found no defects in `RiskToken`, so `.imd-findings.json` has an empty findings list. It also has a `holds` coverage row for each of the three entry points, plus one for the fixed-supply rule.\n\n**What the code is:** `src/RiskToken.sol` is a 17-line OpenZeppelin v5.4.0 `ERC20`. It has no overrides, and its constructor mints 1,000,000,000 × 10^18 to `msg.sender` once, with name \"IMD RISK\", symbol \"RISK\" and 18 decimals. The `ERC20.sol`, `Context.sol` and `IERC20.sol` files in `lib/` match the pinned hashes, so the inherited code is the standard library, unmodified.\n\n**Execution Trace guide:**\n- **`transfer`:** the zero-address checks hold, an amount above the balance reverts, and the unchecked arithmetic is bounded by the balance check and the total supply.\n- **`transferFrom`:** the allowance is spent before the transfer, so a revert undoes both. A finite allowance is reduced exactly; the maximum allowance is never reduced, which is intended. A zero amount needs no allowance and moves nothing.\n- **Settling transfers to self or of zero:** both leave balances unchanged.\n- **`approve`:** changing a nonzero allowance has the usual ERC-20 approve race. That's part of the standard, so I didn't report it.\n\n**Periphery guide:** the only inherited code is the pinned OpenZeppelin ERC20 and its `Context`, interface and errors.\n\n**First Principles guide:** the total supply can't change after the constructor. There are no mint or burn functions, no owner, no pause, no fee or burn on transfer, and no `DELEGATECALL`, `CALLCODE` or `SELFDESTRUCT`. Launch transfers to the distributor and the pool manager therefore arrive whole.\n\n**Static analysis:** aderyn's one low lead, the large number at line 10, is the supply constant written as `1_000_000_000 * 10 ** 18`, which is correct. Slither reported nothing.\n\n**Checks:** the project's 34 existing tests pass, including the invariant run. I also ran a 7-test scratch file covering transfers to self, over-balance and zero-address reverts, infinite and finite allowances, zero-amount `transferFrom` and the token's name, symbol and decimals. All passed, and I deleted the file afterwards.\n\n**Not covered:** I didn't run the two protected floor tests, because the harness and Uniswap v4 files they import aren't in this tree. No pass was cut short; the whole area was covered.\n\nThe working tree is unchanged apart from `.imd-findings.json`, which git ignores.","treeHash":null,"usage":{"cachedInputTokens":381685,"inputTokens":18,"model":"claude-opus-5-5","outputTokens":4741,"runtime":"claude","turns":9,"wallClockMs":57900}},{"artifacts":[],"attempt":1,"bundleHash":"94b7373f5c96800d98a4a9389d5c61722beec64530750c0621d72eb34a1e9a44","device":"f4b1cf15e799d705","findings":[],"hash":"fd1ee8083f95c67e05194e0b1484e466b470225c21b81dabe3f2adc3074633f6","nodeId":"8a314730-1b55-45b4-8a4b-73810b074d2f","outcome":"completed","summary":"Created `launch.json` matching `RiskToken`, its constructor supply, and the exact pool and economics values. No other submitted files changed.\n\nValidation passed: manifest and constructor ABI checks, `forge build`, and all 34 tests using the supplied fuzz seed.","treeHash":"832e50db5b155616a549eed5ac28246ffcf25c85","usage":{"cachedInputTokens":169600,"inputTokens":36268,"model":"gpt-6-astra","outputTokens":2286,"runtime":"codex","turns":3,"wallClockMs":95486}}],"verification":[{"checks":[{"durationMs":1520,"exitCode":0,"name":"build","output":"Compiling 29 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.45s\nCompiler run successful!\n","passed":true},{"durationMs":8685,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 28 tests for test/RiskToken.t.sol:RiskTokenTest\n[PASS] testFuzz_overspendingAllowanceAlwaysReverts(uint256,uint256) (runs: 1000, μ: 122893, ~: 123355)\nLogs:\n  Bound result 0\n  Bound result 24\n\n[PASS] testFuzz_overspendingBalanceAlwaysReverts(uint256) (runs: 1000, μ: 69110, ~: 69458)\nLogs:\n  Bound result 115792089237316195423570985008687907853269984665639564039457584007913129639982\n\n[PASS] testFuzz_transferConservesSupply(address,uint256) (runs: 1000, μ: 103711, ~: 104031)\nLogs:\n  Bound result 540587310967732442670784526848260536327217923183\n  Bound result 644681358519642920714142478\n\n[PASS] testFuzz_transferFromAccountsForAllowance(uint256,uint256) (runs: 1000, μ: 159490, ~: 161589)\nLogs:\n  Bound result 273453337905\n\n[PASS] test_allowanceCannotBeUsedByAnotherSpender() (gas: 105109)\n[PASS] test_approvalDoesNotRequireCurrentBalance() (gas: 88914)\n[PASS] test_approveReplacesAllowanceAndEmitsEvent() (gas: 134473)\n[PASS] test_approveZeroSpenderReverts() (gas: 37552)\n[PASS] test_constructorEmitsExactlyOneMintEvent() (gas: 26601)\n[PASS] test_deployerCannotSpendHoldersTokensWithoutApproval() (gas: 166610)\n[PASS] test_entireSupplyCanMoveAndReturn() (gas: 159510)\n[PASS] test_metadataAndInitialSupply() (gas: 107583)\n[PASS] test_nativeCurrencyIsRejected() (gas: 42794)\n[PASS] test_revokePreventsFurtherSpending() (gas: 131161)\n[PASS] test_selfTransferPreservesBalanceAndEmitsEvent() (gas: 54013)\n[PASS] test_selfTransferStillRequiresSufficientBalance() (gas: 42744)\n[PASS] test_transferEmitsEventAndDeliversExactAmount() (gas: 93575)\n[PASS] test_transferFromDeliversExactlyAndConsumesFiniteAllowance() (gas: 242007)\n[PASS] test_transferFromInsufficientAllowanceRevertsWithoutChanges() (gas: 115726)\n[PASS] test_transferFromInsufficientBalanceRestoresAllowance() (gas: 178472)\n[PASS] test_transferFromInvalidRecipientRestoresAllowance() (gas: 114156)\n[PASS] test_transferFromPreservesInfiniteAllowance() (gas: 214751)\n[PASS] test_transferFromSelfConsumesAllowanceWithoutChangingBalance() (gas: 109624)\n[PASS] test_transferFromZeroSourceReverts() (gas: 65072)\n[PASS] test_transferRevertsWhenBalanceIsInsufficient() (gas: 119870)\n[PASS] test_transferToZeroAddressRevertsEvenForZeroValue() (gas: 71970)\n[PASS] test_zeroTransferFromEmptyAccountSucceedsAndEmitsEvent() (gas: 63034)\n[PASS] test_zeroTransferFromNeedsNoAllowanceForValidAddresses() (gas: 81471)\nSuite result: ok. 28 passed; 0 failed; 0 skipped; finished in 65.54ms (232.68ms CPU time)\n\nRan 5 tests for test/RiskTokenLaunch.t.sol:RiskTokenLaunchTest\n[PASS] test_contractAndOrdinaryHolderCanTransferInBothDirections() (gas: 294388)\n[PASS] test_create2MintsEverythingToImmediateFactory() (gas: 69168)\n[PASS] test_launchTransfersAndClaimArriveWhole() (gas: 509847)\n[PASS] test_noMintBurnFreezeOrUpgradeEntryPointsForFactoryOrStranger() (gas: 4408670)\n[PASS] test_runtimeHasNoForbiddenOpcodesAndFitsDeploymentLimit() (gas: 2261777)\nSuite result: ok. 5 passed; 0 failed; 0 skipped; finished in 69.19ms (8.59ms CPU time)\n\nRan 15 tests for test/RiskTokenEdgeCases.t.sol:RiskTokenEdgeCasesTest\n[PASS] testFuzz_delegatedTransferCanPayTheSpender(uint256,uint256) (runs: 1000, μ: 163223, ~: 163599)\nLogs:\n  Bound result 244\n  Bound result 5816\n\n[PASS] testFuzz_directTransfersDoNotConsumeOrMoveApprovals(uint256,uint256) (runs: 1000, μ: 181839, ~: 182447)\nLogs:\n  Bound result 244\n\n[PASS] testFuzz_failedBalanceSpendPreservesApprovalAndCanBeRetried(uint256,uint256,bool) (runs: 1000, μ: 349566, ~: 349764)\nLogs:\n  Bound result 1\n  Bound result 625549972359299695401038825\n\n[PASS] testFuzz_reducingApprovalImmediatelyLimitsSpending(uint256,uint256) (runs: 1000, μ: 255370, ~: 257013)\nLogs:\n  Bound result 422379185441795607095629709\n  Bound result 273453337905\n\n[PASS] testFuzz_splitDelegatedTransfersAndRoundTripConserveEveryUnit(uint256,uint256) (runs: 1000, μ: 334631, ~: 336395)\nLogs:\n  Bound result 16833\n  Bound result 11847\n\n[PASS] test_approveZeroSpenderRejectsZeroAndMaximumAmounts() (gas: 83069)\n[PASS] test_fullSupplyDelegatedTransferCannotBeReplayed() (gas: 264685)\n[PASS] test_maximumAmountRevertsWithoutOverflowOrStateChanges() (gas: 231773)\n[PASS] test_maximumFiniteAllowanceIsNotTreatedAsInfinite() (gas: 158289)\n[PASS] test_oneWeiCanMoveThroughDirectAndDelegatedTransfers() (gas: 263778)\n[PASS] test_ownerMustApproveItselfToUseTransferFrom() (gas: 247646)\n[PASS] test_spendingAuthorityUsesCallerNotTransactionOrigin() (gas: 221548)\n[PASS] test_tokensSentToTokenContractRemainPartOfFixedSupply() (gas: 193709)\n[PASS] test_unlimitedApprovalCanBeRevokedThenReplacedWithFiniteApproval() (gas: 353062)\n[PASS] test_zeroDelegatedTransferToZeroRevertsWithUnlimitedAllowance() (gas: 122092)\nSuite result: ok. 15 passed; 0 failed; 0 skipped; finished in 69.22ms (338.00ms CPU time)\n\nRan 2 tests for test/RiskTokenInvariant.t.sol:RiskTokenInvariantTest\n[PASS] invariant_supplyBalancesAndAllowancesMatchModel() (runs: 256, calls: 32768, reverts: 0)\n\n╭------------------+----------------------------+-------+---------+----------╮\n| Contract         | Selector                   | Calls | Reverts | Discards |\n+============================================================================+\n| RiskTokenHandler | approve                    | 3011  | 0       | 0        |\n|------------------+----------------------------+-------+---------+----------|\n| RiskTokenHandler | approveInfinite            | 2957  | 0       | 0        |\n|------------------+----------------------------+-------+---------+----------|\n| RiskTokenHandler | approveZeroSpender         | 3001  | 0       | 0        |\n|------------------+----------------------------+-------+---------+----------|\n| RiskTokenHandler | revoke                     | 3033  | 0       | 0        |\n|------------------+----------------------------+-------+---------+----------|\n| RiskTokenHandler | transfer                   | 2968  | 0       | 0        |\n|------------------+----------------------------+-------+---------+----------|\n| RiskTokenHandler | transferAboveBalance       | 3023  | 0       | 0        |\n|------------------+----------------------------+-------+---------+----------|\n| RiskTokenHandler | transferEntireBalance      | 2943  | 0       | 0        |\n|------------------+----------------------------+-------+---------+----------|\n| RiskTokenHandler | transferFrom               | 3010  | 0       | 0        |\n|------------------+----------------------------+-------+---------+----------|\n| RiskTokenHandler | transferFromAboveAllowance | 2952  | 0       | 0        |\n|------------------+----------------------------+-------+---------+----------|\n| RiskTokenHandler | transferFromAboveBalance   | 2898  | 0       | 0        |\n|------------------+----------------------------+-------+---------+----------|\n| RiskTokenHandler | transferToZero             | 2972  | 0       | 0        |\n╰------------------+----------------------------+-------+---------+----------╯\n\nLogs:\n  Bound result 115792089237316195423570985008687907853269984665639564039457584007913129639940\n  Bound result 0\n  Bound result 7170\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 5137\n  Bound result 999999999999999999999994958\n  Bound result 0\n  Bound result 0\n  Bound result 612738447933561536009397818\n  Bound result 901346562689079173351193053\n  Bound result 677\n  Bound result 8\n  Bound result 115792089237316195423570985008687907853269984665639564039457584007913129640855\n  Bound result 0\n  Bound result 4607\n  Bound result 180319948891367460030091941535420926414557573971\n  Bound result 4216\n  Bound result 999999999999999999999995793\n  Bound result 123000000000000000001\n  Bound result 6\n  Bound result 1224268464\n  Bound result 1140\n  Bound result 7997\n  Bound result 123000000000000000001\n  Bound result 54684994304896959657666845817092322405612\n  Bound result 0\n  Bound result 537499592517160516815319130\n  Bound result 589008543618222025850772029\n  Bound result 0\n  Bound result 7\n  Bound result 10\n  Bound result 0\n  Bound result 26\n  Bound result 152\n  Bound result 4\n  Bound result 2066114166\n  Bound result 999999999999999997933885853\n  Bound result 3\n  Bound result 3\n  Bound result 999999876999999999999998174\n  Bound result 30797826186538141472076760254382634\n  Bound result 0\n  Bound result 123000000000000001283\n  Bound result 511\n  Bound result 1\n  Bound result 973269825969356252395581109\n  Bound result 987599300748063968579901886\n  Bound result 7\n  Bound result 0\n  Bound result 636\n  Bound result 3000000000000000000\n  Bound result 1983352004024268228615611\n  Bound result 1000000000000000000\n  Bound result 89389712283019655932542975\n  Bound result 352\n  Bound result 999999999999999999999999657\n  Bound result 0\n  Bound result 5264\n  Bound result 2066114167\n  Bound result 115792089237316195423570985008687907853269984665639564039457584007913129640576\n  Bound result 624950735743839270060957667747327474757680811167510\n  Bound result 20\n  Bound result 0\n  Bound result 115792089237316195423570985008687907853269984665639564039457584007913129649280\n  Bound result 544\n  Bound result 943477615523587143303610809\n  Bound result 966577456194534854715033635\n  Bound result 423\n  Bound result 999999999999999999999999455\n  Bound result 186538141472076760254382635\n  Bound result 813461981527923239745617365\n  Bound result 0\n  Bound result 7008\n\n[PASS] test_handlerSupportsNonzeroSpendsAndFailureRecovery() (gas: 2832290)\nLogs:\n  Bound result 20\n  Bound result 7\n  Bound result 14\n  Bound result 3\n  Bound result 4\n  Bound result 14\n  Bound result 1\n  Bound result 0\n  Bound result 13\n\nSuite result: ok. 2 passed; 0 failed; 0 skipped; finished in 8.60s (8.60s CPU time)\n\nRan 4 test suites in 8.60s (8.80s CPU time): 50 tests passed, 0 failed, 0 skipped (50 total tests)\n","passed":true},{"durationMs":33,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"RiskToken.approve(address,uint256)\",\"RiskToken.transfer(address,uint256)\",\"RiskToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"LICENSE\":21,\"README.md\":141,\"foundry.toml\":19,\"remappings.txt\":2,\"src/RiskToken.sol\":17,\"test/RiskToken.t.sol\":324,\"test/RiskTokenEdgeCases.t.sol\":296,\"test/RiskTokenInvariant.t.sol\":251,\"test/RiskTokenLaunch.t.sol\":153},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"32a62311fbb9fbcf23dcd92d20cde241963fe916b0376a9bbfcfc69a2f02c2f5","verifiedTreeHash":"a0379eb8d3bab8094cee07e78306ff634651fb3c","verifierVersion":"0.1.0+8fbf00a5"},{"checks":[{"durationMs":1161,"exitCode":0,"name":"build","output":"Compiling 28 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.08s\nCompiler run successful!\n","passed":true},{"durationMs":2080,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 5 tests for test/RiskTokenLaunch.t.sol:RiskTokenLaunchTest\n[PASS] test_contractAndOrdinaryHolderCanTransferInBothDirections() (gas: 294388)\n[PASS] test_create2MintsEverythingToImmediateFactory() (gas: 69168)\n[PASS] test_launchTransfersAndClaimArriveWhole() (gas: 509847)\n[PASS] test_noMintBurnFreezeOrUpgradeEntryPointsForFactoryOrStranger() (gas: 4408670)\n[PASS] test_runtimeHasNoForbiddenOpcodesAndFitsDeploymentLimit() (gas: 2261777)\nSuite result: ok. 5 passed; 0 failed; 0 skipped; finished in 13.10ms (7.11ms CPU time)\n\nRan 28 tests for test/RiskToken.t.sol:RiskTokenTest\n[PASS] testFuzz_overspendingAllowanceAlwaysReverts(uint256,uint256) (runs: 512, μ: 122903, ~: 123345)\nLogs:\n  Bound result 4\n  Bound result 8\n\n[PASS] testFuzz_overspendingBalanceAlwaysReverts(uint256) (runs: 512, μ: 69120, ~: 69458)\nLogs:\n  Bound result 115792089237316195423570985008687907853269984665639564039457585288612397293189\n\n[PASS] testFuzz_transferConservesSupply(address,uint256) (runs: 512, μ: 103271, ~: 103608)\nLogs:\n  Bound result 579636962016380459518807170\n\n[PASS] testFuzz_transferFromAccountsForAllowance(uint256,uint256) (runs: 512, μ: 159423, ~: 161589)\nLogs:\n  Bound result 2\n\n[PASS] test_allowanceCannotBeUsedByAnotherSpender() (gas: 105109)\n[PASS] test_approvalDoesNotRequireCurrentBalance() (gas: 88914)\n[PASS] test_approveReplacesAllowanceAndEmitsEvent() (gas: 134473)\n[PASS] test_approveZeroSpenderReverts() (gas: 37552)\n[PASS] test_constructorEmitsExactlyOneMintEvent() (gas: 26601)\n[PASS] test_deployerCannotSpendHoldersTokensWithoutApproval() (gas: 166610)\n[PASS] test_entireSupplyCanMoveAndReturn() (gas: 159510)\n[PASS] test_metadataAndInitialSupply() (gas: 107583)\n[PASS] test_nativeCurrencyIsRejected() (gas: 42794)\n[PASS] test_revokePreventsFurtherSpending() (gas: 131161)\n[PASS] test_selfTransferPreservesBalanceAndEmitsEvent() (gas: 54013)\n[PASS] test_selfTransferStillRequiresSufficientBalance() (gas: 42744)\n[PASS] test_transferEmitsEventAndDeliversExactAmount() (gas: 93575)\n[PASS] test_transferFromDeliversExactlyAndConsumesFiniteAllowance() (gas: 242007)\n[PASS] test_transferFromInsufficientAllowanceRevertsWithoutChanges() (gas: 115726)\n[PASS] test_transferFromInsufficientBalanceRestoresAllowance() (gas: 178472)\n[PASS] test_transferFromInvalidRecipientRestoresAllowance() (gas: 114156)\n[PASS] test_transferFromPreservesInfiniteAllowance() (gas: 214751)\n[PASS] test_transferFromSelfConsumesAllowanceWithoutChangingBalance() (gas: 109624)\n[PASS] test_transferFromZeroSourceReverts() (gas: 65072)\n[PASS] test_transferRevertsWhenBalanceIsInsufficient() (gas: 119870)\n[PASS] test_transferToZeroAddressRevertsEvenForZeroValue() (gas: 71970)\n[PASS] test_zeroTransferFromEmptyAccountSucceedsAndEmitsEvent() (gas: 63034)\n[PASS] test_zeroTransferFromNeedsNoAllowanceForValidAddresses() (gas: 81471)\nSuite result: ok. 28 passed; 0 failed; 0 skipped; finished in 14.16ms (55.95ms CPU time)\n\nRan 1 test for test/RiskTokenInvariant.t.sol:RiskTokenInvariantTest\n[PASS] invariant_supplyBalancesAndAllowancesMatchModel() (runs: 128, calls: 8192, reverts: 0)\n\n╭------------------+--------------+-------+---------+----------╮\n| Contract         | Selector     | Calls | Reverts | Discards |\n+==============================================================+\n| RiskTokenHandler | approve      | 2051  | 0       | 0        |\n|------------------+--------------+-------+---------+----------|\n| RiskTokenHandler | revoke       | 2089  | 0       | 0        |\n|------------------+--------------+-------+---------+----------|\n| RiskTokenHandler | transfer     | 2012  | 0       | 0        |\n|------------------+--------------+-------+---------+----------|\n| RiskTokenHandler | transferFrom | 2040  | 0       | 0        |\n╰------------------+--------------+-------+---------+----------╯\n\nLogs:\n  Bound result 724338232899924288495574847\n  Bound result 17186945061340785362\n  Bound result 0\n  Bound result 3218\n  Bound result 2605\n  Bound result 382\n  Bound result 0\n  Bound result 6287\n  Bound result 11\n  Bound result 242\n  Bound result 13\n  Bound result 14\n  Bound result 3\n  Bound result 25\n  Bound result 2868\n  Bound result 634651499171442313016341043\n  Bound result 118334103355515905345338592\n  Bound result 3999999999999991108\n  Bound result 3999999999999991463\n  Bound result 773435946\n  Bound result 12\n  Bound result 0\n  Bound result 5000000000000000000\n  Bound result 89686728728481975479230357\n  Bound result 96\n  Bound result 96\n  Bound result 1541\n  Bound result 0\n  Bound result 200\n  Bound result 2656\n  Bound result 0\n  Bound result 0\n  Bound result 211\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 1969\n  Bound result 4591\n  Bound result 763\n  Bound result 402\n  Bound result 262\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 2.01s (2.01s CPU time)\n\nRan 3 test suites in 2.01s (2.04s CPU time): 34 tests passed, 0 failed, 0 skipped (34 total tests)\n","passed":true},{"durationMs":30,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"RiskToken.approve(address,uint256)\",\"RiskToken.transfer(address,uint256)\",\"RiskToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"LICENSE\":21,\"README.md\":141,\"foundry.toml\":19,\"remappings.txt\":2,\"src/RiskToken.sol\":17,\"test/RiskToken.t.sol\":323,\"test/RiskTokenInvariant.t.sol\":100,\"test/RiskTokenLaunch.t.sol\":153},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true},{"durationMs":387,"exitCode":0,"name":"slither","output":"slither: no results at low impact or above","passed":true},{"durationMs":114,"exitCode":0,"name":"aderyn","output":"[low] large-numeric-literal at src/RiskToken.sol:10: Large Numeric Literal","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"7da5503ff8b369a09d59b85c196da52cce0bd6cff83fe2288398761bdd6a8180","verifiedTreeHash":"ce33df3cb0b093a8f6b941efc5fe344682328c08","verifierVersion":"0.1.0+8fbf00a5"},{"checks":[{"durationMs":1275,"exitCode":0,"name":"build","output":"Compiling 28 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.20s\nCompiler run successful!\n","passed":true},{"durationMs":2214,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 5 tests for test/RiskTokenLaunch.t.sol:RiskTokenLaunchTest\n[PASS] test_contractAndOrdinaryHolderCanTransferInBothDirections() (gas: 294388)\n[PASS] test_create2MintsEverythingToImmediateFactory() (gas: 69168)\n[PASS] test_launchTransfersAndClaimArriveWhole() (gas: 509847)\n[PASS] test_noMintBurnFreezeOrUpgradeEntryPointsForFactoryOrStranger() (gas: 4408670)\n[PASS] test_runtimeHasNoForbiddenOpcodesAndFitsDeploymentLimit() (gas: 2261777)\nSuite result: ok. 5 passed; 0 failed; 0 skipped; finished in 12.58ms (7.64ms CPU time)\n\nRan 28 tests for test/RiskToken.t.sol:RiskTokenTest\n[PASS] testFuzz_overspendingAllowanceAlwaysReverts(uint256,uint256) (runs: 512, μ: 122903, ~: 123345)\nLogs:\n  Bound result 4\n  Bound result 8\n\n[PASS] testFuzz_overspendingBalanceAlwaysReverts(uint256) (runs: 512, μ: 69120, ~: 69458)\nLogs:\n  Bound result 3665175829350836376709226614771037650422869720661349717\n\n[PASS] testFuzz_transferConservesSupply(address,uint256) (runs: 512, μ: 103271, ~: 103608)\nLogs:\n  Bound result 38411734055605339675258957\n\n[PASS] testFuzz_transferFromAccountsForAllowance(uint256,uint256) (runs: 512, μ: 159423, ~: 161589)\nLogs:\n  Bound result 2\n\n[PASS] test_allowanceCannotBeUsedByAnotherSpender() (gas: 105109)\n[PASS] test_approvalDoesNotRequireCurrentBalance() (gas: 88914)\n[PASS] test_approveReplacesAllowanceAndEmitsEvent() (gas: 134473)\n[PASS] test_approveZeroSpenderReverts() (gas: 37552)\n[PASS] test_constructorEmitsExactlyOneMintEvent() (gas: 26601)\n[PASS] test_deployerCannotSpendHoldersTokensWithoutApproval() (gas: 166610)\n[PASS] test_entireSupplyCanMoveAndReturn() (gas: 159510)\n[PASS] test_metadataAndInitialSupply() (gas: 107583)\n[PASS] test_nativeCurrencyIsRejected() (gas: 42794)\n[PASS] test_revokePreventsFurtherSpending() (gas: 131161)\n[PASS] test_selfTransferPreservesBalanceAndEmitsEvent() (gas: 54013)\n[PASS] test_selfTransferStillRequiresSufficientBalance() (gas: 42744)\n[PASS] test_transferEmitsEventAndDeliversExactAmount() (gas: 93575)\n[PASS] test_transferFromDeliversExactlyAndConsumesFiniteAllowance() (gas: 242007)\n[PASS] test_transferFromInsufficientAllowanceRevertsWithoutChanges() (gas: 115726)\n[PASS] test_transferFromInsufficientBalanceRestoresAllowance() (gas: 178472)\n[PASS] test_transferFromInvalidRecipientRestoresAllowance() (gas: 114156)\n[PASS] test_transferFromPreservesInfiniteAllowance() (gas: 214751)\n[PASS] test_transferFromSelfConsumesAllowanceWithoutChangingBalance() (gas: 109624)\n[PASS] test_transferFromZeroSourceReverts() (gas: 65072)\n[PASS] test_transferRevertsWhenBalanceIsInsufficient() (gas: 119870)\n[PASS] test_transferToZeroAddressRevertsEvenForZeroValue() (gas: 71970)\n[PASS] test_zeroTransferFromEmptyAccountSucceedsAndEmitsEvent() (gas: 63034)\n[PASS] test_zeroTransferFromNeedsNoAllowanceForValidAddresses() (gas: 81471)\nSuite result: ok. 28 passed; 0 failed; 0 skipped; finished in 13.74ms (56.33ms CPU time)\n\nRan 1 test for test/RiskTokenInvariant.t.sol:RiskTokenInvariantTest\n[PASS] invariant_supplyBalancesAndAllowancesMatchModel() (runs: 128, calls: 8192, reverts: 0)\n\n╭------------------+--------------+-------+---------+----------╮\n| Contract         | Selector     | Calls | Reverts | Discards |\n+==============================================================+\n| RiskTokenHandler | approve      | 2051  | 0       | 0        |\n|------------------+--------------+-------+---------+----------|\n| RiskTokenHandler | revoke       | 2089  | 0       | 0        |\n|------------------+--------------+-------+---------+----------|\n| RiskTokenHandler | transfer     | 2012  | 0       | 0        |\n|------------------+--------------+-------+---------+----------|\n| RiskTokenHandler | transferFrom | 2040  | 0       | 0        |\n╰------------------+--------------+-------+---------+----------╯\n\nLogs:\n  Bound result 724338232899924288495574847\n  Bound result 17186945061340785362\n  Bound result 0\n  Bound result 3218\n  Bound result 2605\n  Bound result 382\n  Bound result 0\n  Bound result 6287\n  Bound result 11\n  Bound result 242\n  Bound result 13\n  Bound result 14\n  Bound result 3\n  Bound result 25\n  Bound result 2868\n  Bound result 634651499171442313016341044\n  Bound result 118333646123944748660731520\n  Bound result 3999999999999991108\n  Bound result 3999999999999991463\n  Bound result 773435946\n  Bound result 12\n  Bound result 0\n  Bound result 5000000000000000000\n  Bound result 89686728728481975479230356\n  Bound result 96\n  Bound result 96\n  Bound result 1541\n  Bound result 0\n  Bound result 200\n  Bound result 2656\n  Bound result 0\n  Bound result 0\n  Bound result 211\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 1969\n  Bound result 4591\n  Bound result 763\n  Bound result 402\n  Bound result 262\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 2.12s (2.12s CPU time)\n\nRan 3 test suites in 2.12s (2.14s CPU time): 34 tests passed, 0 failed, 0 skipped (34 total tests)\n","passed":true},{"durationMs":34,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"RiskToken.approve(address,uint256)\",\"RiskToken.transfer(address,uint256)\",\"RiskToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"LICENSE\":21,\"README.md\":141,\"foundry.toml\":19,\"launch.json\":20,\"remappings.txt\":2,\"src/RiskToken.sol\":17,\"test/RiskToken.t.sol\":323,\"test/RiskTokenInvariant.t.sol\":100,\"test/RiskTokenLaunch.t.sol\":153},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"fd1ee8083f95c67e05194e0b1484e466b470225c21b81dabe3f2adc3074633f6","verifiedTreeHash":"832e50db5b155616a549eed5ac28246ffcf25c85","verifierVersion":"0.1.0+8fbf00a5"}]}