{"assessments":[],"deployments":[],"fuzz":[],"identity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"interpretation":"Records acceptance and evidence. Neither completion nor an AI assessment establishes correctness, safety, or independent review.","jobId":"e7e83ec1-fd08-44d7-93d3-168850b98cf1","kind":"shape:chain","nodes":[{"acceptedSubmissionHash":"24b42198021a15d0ecfb523fff0e05cfac322b69350c81c86b877a8870cfc887","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_economics","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"9868e3536320c77283a0dbf6acdc0773dd0ed44036a3dc451c823cc605f05fb7","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_flow","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"a58b6f7cff389a7fcfb5f4b97ac80a4c3eb001115acd86044d7bd77a1a91a7d2","dependsOn":["build_contract_project","write_foundry_tests","manifest","audit_math","audit_permissions","audit_economics","audit_flow"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"af3aa01159bbf354f621cafa5c0006f6169e0938a8b015be508b7377dbf165bc","skillId":"audit-judge","tools":[]},"key":"audit_judge","kind":"code","role":"review","skillHash":"af3aa01159bbf354f621cafa5c0006f6169e0938a8b015be508b7377dbf165bc","skillId":"audit-judge","state":"accepted"},{"acceptedSubmissionHash":"ad8e88f151070d41180aadaf2c1353a63233a6f0eec5afbd2479c565383854da","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_math","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"59b124bfd70c88a362164745eefa948aabe3681aebb224b13f14ba76ac55233e","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_permissions","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"c7a073aed4fb2dda226aee31ef54f2503257674068536f6c32412c5041f62e21","dependsOn":[],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"d59561da3b378461b7c749f6bd5084477d44993aa94972ddea90f542535751df","skillId":"build-contract-project","tools":[]},"key":"build_contract_project","kind":"code","role":"implement","skillHash":"d59561da3b378461b7c749f6bd5084477d44993aa94972ddea90f542535751df","skillId":"build-contract-project","state":"accepted"},{"acceptedSubmissionHash":"b6e62ea396ba0c20c5071292a64bfaf332e6781d725b5abb88e8a0248c00fd0e","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"tools":[]},"key":"manifest","kind":"code","role":"integrate","skillHash":null,"skillId":null,"state":"accepted"},{"acceptedSubmissionHash":"9f8269b670a7de1ab50341d7c91dd17b14a9cac5fda96e6906223b22e25ed72d","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"4c76766b00591dfe982fe85d3de589fdb2f810e5137c301155d1c5e36a1d3b23","skillId":"write-foundry-tests","tools":[]},"key":"write_foundry_tests","kind":"code","role":"tests","skillHash":"4c76766b00591dfe982fe85d3de589fdb2f810e5137c301155d1c5e36a1d3b23","skillId":"write-foundry-tests","state":"accepted"}],"objective":"A custom token: VisualIdentity.md (VIMD).\nToken name: VisualIdentity.md\nToken symbol: VIMD\nToken supply: 1,000,000,000 with 18 decimals, all minted once to the deployer in the constructor.","parentJobId":null,"planHash":"7f7a715b7386bb90c1361c134a0c45acc6d2599810e059b8491d8d1c947500e3","previousHash":"0000000000000000000000000000000000000000000000000000000000000000","projectId":"e7e83ec1-fd08-44d7-93d3-168850b98cf1","publication":{"commit":null,"deliveredAt":null,"repoUrl":"https://github.com/identity-md-launches/launch-2115-visualidentity-md"},"receiptIdentity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"registry":"0xb6d0a187b050fa5bb0b87033a203f37becf4a775","research":[],"schema":"identitymd-work-v1","signals":[{"agentId":"51101","feedbackHash":"8132d4986be212f96cc102553c90f6957f53c6d28c2f93bb46d494763697c539","nodeKey":"audit_economics","submissionHash":"24b42198021a15d0ecfb523fff0e05cfac322b69350c81c86b877a8870cfc887","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51027","feedbackHash":"4d04ca2d128114854a139b0b5c1e78f65dd255356dcd6f4eda9dd96fba968c30","nodeKey":"audit_flow","submissionHash":"9868e3536320c77283a0dbf6acdc0773dd0ed44036a3dc451c823cc605f05fb7","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51104","feedbackHash":"f229111986251301d6cc225c3bc0c4438e6b8115997dee97e9bbcadb5e523d4e","nodeKey":"audit_judge","submissionHash":"a58b6f7cff389a7fcfb5f4b97ac80a4c3eb001115acd86044d7bd77a1a91a7d2","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52253","feedbackHash":"f1a3e47f98dbc6badfbb939035cc87ee94d63a332eb142995da35c6809354f69","nodeKey":"audit_math","submissionHash":"ad8e88f151070d41180aadaf2c1353a63233a6f0eec5afbd2479c565383854da","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52166","feedbackHash":"dcad40107e1f5bac49244500010ba7d3ca4a991a52c58e7a0fdbd9947668f1f2","nodeKey":"audit_permissions","submissionHash":"59b124bfd70c88a362164745eefa948aabe3681aebb224b13f14ba76ac55233e","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"54228","feedbackHash":"eeb23d4e9c9877f9a3456943a6c7cc36febd9501789fe1c05172b53c7c8b3932","nodeKey":"build_contract_project","submissionHash":"c7a073aed4fb2dda226aee31ef54f2503257674068536f6c32412c5041f62e21","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"51182","feedbackHash":"32ce2c8203bc3b2fb8832fb20725be6e25b7756df760bca7baa2219261775077","nodeKey":"manifest","submissionHash":"b6e62ea396ba0c20c5071292a64bfaf332e6781d725b5abb88e8a0248c00fd0e","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"51326","feedbackHash":"774af8f50f022ad83d4a210333012ccedf30f0e13128c0f6e58b47a4426db935","nodeKey":"write_foundry_tests","submissionHash":"9f8269b670a7de1ab50341d7c91dd17b14a9cac5fda96e6906223b22e25ed72d","tag1":"verification:checks","tag2":"acceptance-v2","value":1}],"site":null,"snapshotHash":"6958a7bc1596618b3b9617b4be5aa48603ba3fbb4b1580f4885ccd4d00656045","state":"completed","submissions":[{"artifacts":[],"attempt":1,"bundleHash":null,"device":"b1d937213bbfd9cf","findings":[],"hash":"24b42198021a15d0ecfb523fff0e05cfac322b69350c81c86b877a8870cfc887","nodeId":"960fc7cd-8eae-4df8-9531-e61427f02b68","outcome":"completed","summary":"The review is complete and the findings file is written. No defects were found in the economics area.\n\n**What was reviewed.** The token at `src/VIMDToken.sol` is an unmodified OpenZeppelin v5.0.2 ERC-20 plus a constructor that mints the full supply to the caller. I checked it against the Pashov Economic Security, Invariant and Flow Gap guides, the x-ray token profile, and the Trail of Bits entry-point inventory.\n\n**Evidence gathered**\n- Vendored OpenZeppelin files hash-match the lock file, so no hidden value path was introduced locally.\n- The compiled ABI exposes only approve, transfer and transferFrom as state-changing functions. There is no owner, pause, blacklist, mint, burn, receive or fallback, and the opcode scan finds no delegation or destruction opcodes.\n- The project's 26 tests and both invariants pass with the documented fuzz seed. The format check passes.\n- A scratch test I wrote and then removed emulated the launch flows: factory to distributor, distributor to claimant, factory to a pool-manager stand-in using the sync/settle balance-delta pattern, factory to the remainder address, and a trader buying and selling back through allowance. Every flow moved exactly the stated amount and total supply stayed at 10^27.\n- The 10 percent swarm, 88 percent pool and 2 percent remainder split sums exactly to the supply with no rounding loss.\n\n**Leads considered and not reported.** The approve-race on a nonzero allowance is inherent ERC-20 behavior that the README documents, not an implementation defect. The aderyn large-numeric-literal note is style only, since the constant equals exactly 10^27.\n\n**Output.** `.imd-findings.json` holds an empty findings list and eight coverage rows: one for each of the three entry points, all marked holds, plus rows for the supply-conservation invariant, the no-growth and no-privilege invariant, the constructor mint flow, the launch economics split, and dependency integrity. The working tree is clean apart from that file.","treeHash":null,"usage":{"cachedInputTokens":765472,"inputTokens":354,"model":"claude-fable-5-1","outputTokens":11987,"runtime":"claude","turns":27,"wallClockMs":190072}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"7f1dec5ffcbde1d8","findings":[{"citation":"resolved","description":"Outside the assigned area (access control / trust gap / asymmetry); reported because the repository's own provenance claim is false and a reviewer or verifier who checks the lock file gets a mismatch. DEPENDENCIES.md line 4 states that the selected upstream files are unmodified, and dependencies.lock.json states (line 11-12 of DEPENDENCIES.md) that it records the SHA-256 of every included file. For lib/forge-std, seven files in the tree do not hash to the value the lock records: src/StdAssertions.sol, src/StdJson.sol, src/StdToml.sol, src/Vm.sol, src/console.sol, src/interfaces/IERC7540.sol, src/interfaces/IMulticall3.sol. Comparing each against the file at the pinned upstream commit 77041d2ce690e692d6e03cc812b57d1ddaa4d505 shows the differences are whitespace only (multi-line signatures joined onto one line, i.e. the files were run through forge fmt after vendoring), so the lock hashes describe upstream, not the tree. All six OpenZeppelin files (the production dependency that VIMDToken compiles against) match both the lock and upstream byte for byte, so the deployable bytecode is unaffected; forge-std is used only by tests. Impact: the integrity record does not verify, which defeats its purpose and would fail any provenance check that recomputes it. Fix: either restore the seven files to their upstream bytes (or exclude lib/ from forge fmt) or regenerate the per-file hashes in dependencies.lock.json from the tree and drop the word 'unmodified'.","line":4,"path":"DEPENDENCIES.md","reproduction":"In the repository root run: python3 -I -c \"import json,hashlib;L=json.load(open('dependencies.lock.json'));[print(d,f,hashlib.sha256(open(d+'/'+f,'rb').read()).hexdigest()!=h) for d,i in L.items() for f,h in i['files'].items()]\". Expected per DEPENDENCIES.md line 4 and the lock file: every line prints False. Actual: seven lib/forge-std entries print True (mismatch). Concretely: sha256sum lib/forge-std/src/Vm.sol gives a1b1c82924aecf0f38b53192fd1e801cccc1e1fd2ecd6b2301e4f4c4ab102a15, while dependencies.lock.json line 39 records 9068805b59ac1d0ea03a8fa1f15ae49c094e0c6c852a2500e0dd112f264b2cb1 for that file; the upstream file at the pinned commit hashes to the lock's value, and diff against it shows only line-wrapping differences (e.g. Vm.sol line 827 'function getDeployment(string calldata contractName, uint64 chainId)' split across four lines upstream vs one line in the tree).","severity":"low","snippet":"dependency resolution. The selected upstream files are unmodified.","title":"DEPENDENCIES.md and dependencies.lock.json misdescribe seven vendored forge-std files: they are reformatted, not the unmodified upstream files whose hashes the lock records"}],"hash":"59b124bfd70c88a362164745eefa948aabe3681aebb224b13f14ba76ac55233e","nodeId":"56e4412e-3b7f-4e95-9384-fe3b3476cd25","outcome":"completed","summary":"The review is complete and the findings file is written. The tree is otherwise unchanged, and my scratch test directory has been removed.\n\n**Outcome.** The token's permission model is clean. VIMDToken adds only a constructor and a constant to the unmodified OpenZeppelin v5.0.2 ERC20. There are no roles, owners, setters, pause, blacklist, exemption lists, callbacks, or fallback paths, so the Access Control, Trust Gap and Asymmetry guides find nothing to exploit. I recorded one low-severity finding outside my area.\n\n**What I checked in the assigned area**\n\n- **Access control map.** The compiled ABI exposes only the three ERC-20 writers plus views. Each writes only the caller's own balance or allowance row. The constructor hands out no role and mints once to the deployer, which is the factory in the launch flow.\n- **Trust gap.** No actor class is treated differently from another, and no admin-controlled value can be redirected mid-flight. The sole trust assumption is that the factory forwards the supply as the launch policy says, which the token cannot affect.\n- **Asymmetry.** The approve and transferFrom pair writes and decrements the same slot. The transfer and transferFrom paths share one internal routine, so validation and accounting match. Every revert path leaves state untouched.\n- **Verification.** The project suite passes with the documented seed, including the invariant run. A scratch test I wrote and ran confirmed the deployer has no residual power after forwarding, a stranger cannot pull from a holder, an approved spender is bounded exactly, and plain ETH sends revert.\n\n**The one finding (low, outside my area).** DEPENDENCIES.md claims the vendored upstream files are unmodified and the lock file records their hashes, but seven forge-std files in the tree do not match the recorded values. I compared them against the pinned upstream commit over the network. The differences are whitespace only, from running the formatter over the vendored files. All OpenZeppelin files, the only production dependency, match both the lock and upstream byte for byte, so deployable bytecode is unaffected. The reproduction in the report is a one-line hash check anyone can run.\n\n**Coverage.** All three listed entry points hold, with rows for the constructor, the no-role invariant, supply fixity, the trust and asymmetry pairs, manifest compatibility, and the dependency integrity row tied to the finding. Nothing was left unreached. The protected launch tests that need a real PoolManager were not run locally, since the platform runs that harness separately. Slither and Mythril were not run; the supplied static analysis reported only a large-literal note, which is the exact supply constant and not a defect.","treeHash":null,"usage":{"cachedInputTokens":679050,"inputTokens":258,"model":"claude-fable-5-1","outputTokens":14656,"runtime":"claude","turns":29,"wallClockMs":210798}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"61b4050710026370","findings":[{"citation":"resolved","description":"Periphery check: the README and DEPENDENCIES.md present dependencies.lock.json as the integrity record for the vendored libraries and state the upstream files are unmodified. The six OpenZeppelin v5.0.2 files match both the lock and upstream commit dbb6104c byte for byte, so the deployed token's base contract is genuine. The forge-std entry does not hold: the lock's SHA-256 values match upstream forge-std commit 77041d2c exactly, but seven files committed under lib/forge-std/src (StdAssertions.sol, StdJson.sol, StdToml.sol, Vm.sol, console.sol, interfaces/IERC7540.sol, interfaces/IMulticall3.sol) hash differently from both. Diffing them against upstream shows the difference is whitespace-only reformatting produced by `forge fmt`, which the README's `forge fmt --check` validation step runs over lib/ because foundry.toml does not exclude it (the upstream console.sol fails `forge fmt --check` while the committed copy passes). The code is semantically identical and forge-std is used only by tests, so the deployed bytecode is unaffected. The defect is that the provenance record cannot be used as documented: anyone verifying the tree against dependencies.lock.json gets seven mismatches, and the claim that upstream files are unmodified is untrue for this directory. Minimal fix: either restore the seven upstream files and add `ignore = [\"lib/**\"]` to the fmt section (configuration change, outside a worker's write budget) or re-record the hashes of the committed files and state in DEPENDENCIES.md that forge-std was reformatted.","line":4,"path":"DEPENDENCIES.md","reproduction":"State: the committed tree at c548bf9. Steps: (1) for each path under dependencies.lock.json['lib/forge-std']['files'], compute sha256 of lib/forge-std/<path> and compare with the recorded value. Expected: all 30 match. Actual: 7 mismatch, e.g. src/Vm.sol recorded 9068805b59ac1d0ea03a8fa1f15ae49c094e0c6c852a2500e0dd112f264b2cb1, on disk a1b1c82924aecf0f38b53192fd1e801cccc1e1fd2ecd6b2301e4f4c4ab102a15; src/console.sol recorded 896c5a5a...f178, on disk a2e632dc...79e9. (2) curl https://raw.githubusercontent.com/foundry-rs/forge-std/77041d2ce690e692d6e03cc812b57d1ddaa4d505/src/Vm.sol and hash it: it equals the lock value, not the committed file. (3) `diff <(tr -d ' \\n' < upstream/Vm.sol) <(tr -d ' \\n' < lib/forge-std/src/Vm.sol)` is empty: whitespace-only change. All six lib/openzeppelin-contracts files match both the lock and upstream.","severity":"low","snippet":"dependency resolution. The selected upstream files are unmodified.","title":"Seven vendored forge-std files differ from the lock-file hashes and the pinned upstream commit, so the 'unmodified' provenance claim is false"}],"hash":"9868e3536320c77283a0dbf6acdc0773dd0ed44036a3dc451c823cc605f05fb7","nodeId":"9760e1f5-73e6-4a0d-9470-dbe22e4577f9","outcome":"completed","summary":"The review is complete. The findings file is written and validated, and the working tree is clean apart from the ignored findings file.\n\n**Outcome.** The token is correct in my area. The only defect found is a low-severity provenance inconsistency in a test-only dependency.\n\n**What I covered.** The token is a 17-line wrapper over OpenZeppelin v5.0.2 ERC20 with one constructor mint of 10^27 units to the deployer. I applied the Execution Trace, Periphery and First Principles guides against the three entry points and the constructor:\n\n- **approve, transfer, transferFrom** all hold. I traced each through the inherited `_approve`, `_transfer`, `_update` and `_spendAllowance` paths. Zero-address sender, receiver and spender revert. Balance and allowance checks happen before the unchecked arithmetic, reverts are atomic, and no external call, callback or sentinel path exists. Launch flows deliver the exact amount, so the swarm share, pool seed and remainder arrive whole.\n- **Constructor** holds. One mint of a compile-time constant, one Transfer event, no arguments, nonpayable. The aderyn large-literal lead is exact integer math and is not a defect.\n- **Base contracts** are genuine. All six vendored OpenZeppelin files hash equal to the lock file and to upstream commit `dbb6104c`, which I fetched for comparison.\n- **ABI inventory** confirms no receive, fallback, mint, burn or admin function. The existing 26 tests and the 128x64 invariant run pass under the pinned fuzz seed.\n\n**The one finding (low).** Seven files under `lib/forge-std/src` do not match the hashes in the lock file or upstream forge-std v1.9.7. The lock matches upstream exactly. The committed copies are whitespace-only reformats produced by `forge fmt`, because the README's format check runs over `lib/` too. The code is semantically identical and forge-std is used only by tests, so the deployed bytecode is unaffected. But the integrity record cannot be verified as documented, and the \"unmodified\" claim in DEPENDENCIES.md is untrue for that directory. The reproduction lists the exact recorded versus on-disk hashes.\n\n**Not reached.** No launch.json exists yet, so I recorded the manifest as unreached. The README's stated constructor arguments and total supply are consistent with the constructor.","treeHash":null,"usage":{"cachedInputTokens":708635,"inputTokens":290,"model":"claude-fable-5-1","outputTokens":15168,"runtime":"claude","turns":29,"wallClockMs":231479}},{"artifacts":[],"attempt":1,"bundleHash":"ffbcdcd5d6a2025d077e70e99115075fccb131214dd1e9d6f1e13376a99157c4","device":"e8a3697ab46868ba","findings":[],"hash":"9f8269b670a7de1ab50341d7c91dd17b14a9cac5fda96e6906223b22e25ed72d","nodeId":"25d5baa9-f4f7-4ffd-88ef-968f966fbe0d","outcome":"completed","summary":"Added 15 unit/fuzz tests covering allowance isolation, revocation, boundary values, and failure recovery. Expanded invariants to 256 sequences totaling 32,768 randomized calls.\n\n`forge build` and `forge test` pass with the required seed: **41 passed, 0 failed**.\n\nOnly `test/` changed. No implementation defects were found.","treeHash":"21276f0c0ced8bf64c0bf98293ec609ce33f3904","usage":{"cachedInputTokens":475264,"inputTokens":65068,"model":"gpt-6-astra","outputTokens":10082,"runtime":"codex","turns":6,"wallClockMs":223396}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"e67cc6ec4009b226","findings":[{"citation":"resolved","description":"Merged from audit_flow and audit_permissions (same root cause, same file, same fix). DEPENDENCIES.md line 4 states the vendored upstream files are unmodified, and lines 11-12 present dependencies.lock.json as recording the SHA-256 of every included file. Recomputing the hashes over the tree: all six lib/openzeppelin-contracts files match the lock, and ERC20.sol also matches the file at upstream commit dbb6104c byte for byte (sha256 2d874da1...c5b1), so the production dependency VIMDToken compiles against is genuine. Seven lib/forge-std files do not match the lock: src/StdAssertions.sol, src/StdJson.sol, src/StdToml.sol, src/Vm.sol, src/console.sol, src/interfaces/IERC7540.sol, src/interfaces/IMulticall3.sol. Fetching each from upstream commit 77041d2c shows the lock's hashes are the upstream hashes (e.g. Vm.sol upstream = 9068805b... = lock), and that the committed copies differ from upstream only in whitespace (diff of whitespace-stripped content is empty for all seven). The cause is `forge fmt`: foundry.toml has no fmt ignore for lib/, the README's validation step runs `forge fmt --check`, the committed tree passes it, and the pristine upstream console.sol fails it. Impact: forge-std is test-only and the deployable bytecode is unaffected, but the repository's integrity record cannot be used as documented; anyone verifying the tree against dependencies.lock.json gets seven mismatches and the statement that upstream files are unmodified is untrue. Minimal fix within a builder's write budget: regenerate the seven lib/forge-std hashes in dependencies.lock.json from the committed files and state in DEPENDENCIES.md that forge-std sources were reformatted with forge fmt (or restore the upstream bytes and exclude lib/ from fmt, which needs a foundry.toml change).","line":4,"path":"DEPENDENCIES.md","reproduction":"State: the committed tree (HEAD 47305c8). Run from the repository root: python3 -I -c \"import json,hashlib;L=json.load(open('dependencies.lock.json'));[print(d,f) for d,i in L.items() for f,h in i['files'].items() if hashlib.sha256(open(d+'/'+f,'rb').read()).hexdigest()!=h]\". Expected (per DEPENDENCIES.md line 4 and lines 11-12): no output, every file matches. Actual: seven lines, all under lib/forge-std: src/StdAssertions.sol, src/StdJson.sol, src/StdToml.sol, src/Vm.sol, src/console.sol, src/interfaces/IERC7540.sol, src/interfaces/IMulticall3.sol. Concretely sha256sum lib/forge-std/src/Vm.sol = a1b1c82924aecf0f38b53192fd1e801cccc1e1fd2ecd6b2301e4f4c4ab102a15 while dependencies.lock.json records 9068805b59ac1d0ea03a8fa1f15ae49c094e0c6c852a2500e0dd112f264b2cb1; curl https://raw.githubusercontent.com/foundry-rs/forge-std/77041d2ce690e692d6e03cc812b57d1ddaa4d505/src/Vm.sol | sha256sum gives the lock's value, and diff <(tr -d ' \\n\\t' < upstream/Vm.sol) <(tr -d ' \\n\\t' < lib/forge-std/src/Vm.sol) is empty (whitespace-only change). The same holds for the other six. Also: forge fmt --check on the tree exits 0; forge fmt --check on the pristine upstream console.sol exits 1.","severity":"low","snippet":"dependency resolution. The selected upstream files are unmodified.","title":"Provenance record does not verify: seven vendored forge-std files are forge-fmt reformatted copies, so DEPENDENCIES.md's 'unmodified' claim and dependencies.lock.json's per-file hashes are false for l"}],"hash":"a58b6f7cff389a7fcfb5f4b97ac80a4c3eb001115acd86044d7bd77a1a91a7d2","nodeId":"87013889-9e16-4ea5-8844-5387d17bfc9c","outcome":"completed","summary":"The review is complete and `.imd-findings.json` is written. The working tree is otherwise untouched.\n\n**Outcome.** The token at `src/VIMDToken.sol` is a plain OpenZeppelin v5.0.2 ERC20 subclass whose constructor mints the manifest supply to its deployer. I found no defect in the contract. The one finding kept is the provenance issue both specialists reported, merged into a single low.\n\n**Specialist findings.**\n- audit_flow and audit_permissions reported the same root cause, so they are one finding. I reproduced it: seven vendored forge-std files hash differently from dependencies.lock.json, the lock's hashes match the pinned upstream commit, and the committed copies differ from upstream only in whitespace. The tree passes `forge fmt --check` while pristine upstream console.sol fails it, which confirms the reformatting cause. Severity stays low: forge-std is test-only and the deployed bytecode is unaffected. All six OpenZeppelin files match both the lock and upstream.\n- audit_economics, audit_math and write_foundry_tests reported nothing, and my own pass agreed.\n\n**My own pass.** Every state-changing entry point holds. The three ERC20 functions are unmodified OpenZeppelin code with no overrides, no fees, no callbacks and no external calls. The runtime contains no CALL, DELEGATECALL, CALLCODE or SELFDESTRUCT opcodes, and the bytecode is far under both size limits. No mint, burn, owner, pause or upgrade selector exists, so supply cannot grow after launch. launch.json uses only schema keys, has an empty constructorArgs list matching the parameterless constructor, and states the exact minted supply. The project's 41 unit, fuzz and invariant tests pass. The protected floor tests cannot run here because they import the platform's v4 harness, but each of their checks passes by trace against this code. The aderyn large-numeric-literal line is an exact integer product and is not a defect.\n\n**Coverage record.** Six rows: the three listed entry points plus the fixed-supply invariant, deployability under the factory model, and the manifest, all marked holds except where linked to the one finding.","treeHash":null,"usage":{"cachedInputTokens":526719,"inputTokens":322,"model":"claude-fable-5-1","outputTokens":8855,"runtime":"claude","turns":14,"wallClockMs":169578}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"7591760a616c6429","findings":[],"hash":"ad8e88f151070d41180aadaf2c1353a63233a6f0eec5afbd2479c565383854da","nodeId":"51ac685e-18bf-4235-bb15-eb35fdc2dd55","outcome":"completed","summary":"The review is complete and the findings file is valid JSON. No tracked file was changed.\n\n**Result: no defects found in the Math Precision, Boundary or Numerical Gap areas.** The findings file at `.imd-findings.json` holds an empty findings list and seven coverage rows, one for each of the three listed entry points plus the constructor and three invariants.\n\nWhat I verified:\n\n- **Vendored library is genuine.** All five OpenZeppelin files hash byte-for-byte to upstream v5.0.2 at the pinned commit, fetched directly from GitHub. There is no modified arithmetic hiding in the dependency.\n- **Supply constant is exact.** The literal flagged by aderyn evaluates at compile time to exactly 10^27, equals the manifest's minor-unit supply, and `decimals()` returns 18. That lead is not a defect.\n- **No math surface exists.** The token has no division, scaling, fee, cast, external call, payable path or bytes decoding. The only arithmetic is OpenZeppelin's checked subtraction and bounded unchecked addition in `_update`.\n- **Boundaries behave as intended.** A scratch suite confirmed balance-plus-one and max-uint transfers revert cleanly, whole-balance transfers move everything, zero-amount and self-transfers preserve state, finite allowances decrement exactly, and the max allowance stays infinite while max-minus-one does not.\n- **Launch arithmetic has no dust.** The ten percent swarm share, the 8800 basis point pool share and the remainder sum exactly to the supply, and every flow moves the requested amount because there is no transfer tax.\n- **Supply conservation holds.** Fuzzed three-way partitions and the project's own 128 by 64 invariant run keep the sum of balances equal to the supply, with no path that grows it.\n\nThe existing suite of 26 tests passes under the README's seed and `forge fmt --check` is clean. Trust assumptions are nil: the token has no owner, pause, mint or admin role. Coverage I could not reach is none; the assigned area is fully traced, and the Trust Gap and Flow Gap guides belong to other specialists.","treeHash":null,"usage":{"cachedInputTokens":703296,"inputTokens":418,"model":"claude-fable-5-1","outputTokens":10396,"runtime":"claude","turns":18,"wallClockMs":183823}},{"artifacts":[],"attempt":1,"bundleHash":"f5c3d1cb89d503b29cdc0667d2448cb16d765669478825a61984324f3b5d2d8f","device":"d75dd2bcf4a95f45","findings":[],"hash":"b6e62ea396ba0c20c5071292a64bfaf332e6781d725b5abb88e8a0248c00fd0e","nodeId":"826ae0cc-c267-4c37-8917-b4e3b2e9a5b0","outcome":"completed","summary":"Created `launch.json` matching `VIMDToken`, its exact supply, empty constructor arguments, and the specified pool and economics.\n\n`forge build` succeeded. All 26 tests passed with the supplied fuzz seed. Only `launch.json` is changed for submission.","treeHash":"5bdc462f648aca1117e017a02bd5ea081f8ce45f","usage":{"cachedInputTokens":184064,"inputTokens":23770,"model":"gpt-6-astra","outputTokens":2171,"runtime":"codex","turns":3,"wallClockMs":58919}},{"artifacts":[],"attempt":1,"bundleHash":"5dbe7aab8014dd987e8fffb7f37290c602078b52be737b91f95e262ae246f1ea","device":"564841ef9657d63c","findings":[],"hash":"c7a073aed4fb2dda226aee31ef54f2503257674068536f6c32412c5041f62e21","nodeId":"0fd11162-74f7-4d9b-afaf-38a1c94a6d1d","outcome":"completed","summary":"Implemented VIMD with 1,000,000,000 tokens, 18 decimals, minted once to the deployer. No further minting or administrative powers.\n\nIncluded vendored dependencies, deployment documentation, and success, failure, fuzz, and invariant tests.\n\nAll checks passed:\n\n- `forge build`\n- Seeded `forge test`: 26 passed\n- `forge fmt --check`","treeHash":"0f7d001d60951d0491d3c099264783952a4f68e4","usage":{"cachedInputTokens":426240,"inputTokens":45875,"model":"gpt-6-astra","outputTokens":15225,"runtime":"codex","turns":4,"wallClockMs":315935}}],"verification":[{"checks":[{"durationMs":2405,"exitCode":0,"name":"build","output":"Compiling 28 files with Solc 0.8.26\nSolc 0.8.26 finished in 2.28s\nCompiler run successful!\n","passed":true},{"durationMs":15241,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 25 tests for test/VIMDToken.t.sol:VIMDTokenTest\n[PASS] testApproveReplacesAndRevokesAllowance() (gas: 199501)\n[PASS] testConstructorEmitsExactlyOneMint() (gas: 18254)\n[PASS] testCreate2MintsToImmediateFactoryCaller() (gas: 276148)\n[PASS] testFactoryDistributionAndPoolTransfersArriveWhole() (gas: 685125)\n[PASS] testFuzzApproveZeroSpenderReverts(uint256) (runs: 1024, μ: 40359, ~: 40301)\n[PASS] testFuzzSelfTransferPreservesBalance(uint256) (runs: 1024, μ: 57839, ~: 57575)\nLogs:\n  Bound result 1000000000\n\n[PASS] testFuzzTransferConservesSupply(address,uint256) (runs: 1024, μ: 99552, ~: 99875)\nLogs:\n  Bound result 137849094177132\n\n[PASS] testFuzzTransferFromCannotExceedAllowance(uint256,uint256) (runs: 1024, μ: 127981, ~: 128249)\nLogs:\n  Bound result 41713456415726\n  Bound result 792874606235095022423488893\n\n[PASS] testFuzzTransferFromConservesSupply(uint256,uint256) (runs: 1024, μ: 168944, ~: 169960)\nLogs:\n  Bound result 17\n  Bound result 244\n\n[PASS] testFuzzTransferOverBalanceReverts(uint256) (runs: 1024, μ: 71846, ~: 72178)\nLogs:\n  Bound result 115792089237316195423570985008687907853269984665640564039457584007913129639933\n\n[PASS] testFuzzTransferToZeroReverts(uint256) (runs: 1024, μ: 50450, ~: 50392)\n[PASS] testInfiniteAllowanceIsNotReduced() (gas: 211962)\n[PASS] testMetadataAndInitialSupply() (gas: 109694)\n[PASS] testNoMintBurnOrAdministrativeEntrypoints() (gas: 1023900)\n[PASS] testOwnerStillNeedsAllowanceForTransferFrom() (gas: 38485)\n[PASS] testRuntimeHasNoDelegationOrDestructionOpcodes() (gas: 785695)\n[PASS] testSelfTransferFromPreservesBalanceButSpendsAllowance() (gas: 109993)\n[PASS] testTransferFromInsufficientBalanceRollsBackAllowance() (gas: 136495)\n[PASS] testTransferFromSpendsFiniteAllowanceAndEmitsTransfer() (gas: 219146)\n[PASS] testTransferFromZeroReceiverRollsBackAllowance() (gas: 119063)\n[PASS] testTransferSmallestUnitThenEntireRemainingBalance() (gas: 127489)\n[PASS] testZeroOwnerCannotApprove() (gas: 33141)\n[PASS] testZeroSenderCannotTransferEvenZeroTokens() (gas: 33078)\n[PASS] testZeroValueTransferFromEmptyAccountEmitsEvent() (gas: 73403)\n[PASS] testZeroValueTransferFromNeedsNoAllowance() (gas: 78761)\nSuite result: ok. 25 passed; 0 failed; 0 skipped; finished in 151.76ms (1.05s CPU time)\n\nRan 15 tests for test/VIMDToken.edge.t.sol:VIMDTokenEdgeTest\n[PASS] testApprovalBeforeFundingDoesNotCreateSpendableTokens() (gas: 278883)\n[PASS] testApprovalBelongsToSpecificOwnerAndSpender() (gas: 410459)\n[PASS] testDelegatedSelfTransferStillRequiresSufficientBalance() (gas: 240956)\n[PASS] testFuzzDirectTransferRoundTripPreservesApprovals(uint256,uint256) (runs: 1024, μ: 262697, ~: 263570)\nLogs:\n  Bound result 41713456415726\n\n[PASS] testFuzzInsufficientBalancePreservesFiniteApprovalAndCanRecover(uint256,uint256) (runs: 1024, μ: 337219, ~: 337545)\nLogs:\n  Bound result 244\n  Bound result 999999999999999999999999773\n\n[PASS] testFuzzInvalidReceiverPreservesApprovalAndCanRecover(uint256,uint256) (runs: 1024, μ: 224201, ~: 226386)\nLogs:\n  Bound result 5248\n\n[PASS] testFuzzRepeatedApprovalIsIdempotentAndIsolated(uint256,uint256) (runs: 1024, μ: 216891, ~: 217536)\n[PASS] testFuzzSplitDelegatedTransfersExhaustExactlyOneApproval(uint256,uint256) (runs: 1024, μ: 269957, ~: 270698)\nLogs:\n  Bound result 1000000000000000000000000000\n  Bound result 501805403615415280937840441\n\n[PASS] testMaximumFiniteAllowanceIsNotTheInfiniteSentinel() (gas: 153473)\n[PASS] testMaximumTransferAmountsRevertWithoutSpendingInfiniteAllowance() (gas: 156597)\n[PASS] testReturningTokensDoesNotRestoreSpentAllowance() (gas: 211260)\n[PASS] testRevokingInfiniteAllowanceBlocksFurtherSpending() (gas: 310240)\n[PASS] testSelfApprovalPermitsOwnerToUseTransferFrom() (gas: 139820)\n[PASS] testZeroAmountStillRejectsZeroRecipientAndSpender() (gas: 136234)\n[PASS] testZeroTransferFromEmitsEventAndPreservesAllowance() (gas: 124285)\nSuite result: ok. 15 passed; 0 failed; 0 skipped; finished in 151.87ms (749.35ms CPU time)\n\nRan 1 test for test/VIMDToken.invariant.t.sol:VIMDTokenInvariantTest\n[PASS]\nVIMDTokenInvariantTest invariants:\n[PASS] invariantAllowancesMatchIndependentLedger\n[PASS] invariantMetadataNeverChanges\n[PASS] invariantSupplyAndBalancesMatchIndependentLedger\n VIMDTokenInvariantTest invariants (runs: 256, calls: 32768, reverts: 0)\n\n╭--------------+----------------------+-------+---------+----------╮\n| Contract     | Selector             | Calls | Reverts | Discards |\n+==================================================================+\n| TokenHandler | approve              | 4766  | 0       | 0        |\n|--------------+----------------------+-------+---------+----------|\n| TokenHandler | rejectedApproval     | 4735  | 0       | 0        |\n|--------------+----------------------+-------+---------+----------|\n| TokenHandler | rejectedTransfer     | 4717  | 0       | 0        |\n|--------------+----------------------+-------+---------+----------|\n| TokenHandler | rejectedTransferFrom | 4602  | 0       | 0        |\n|--------------+----------------------+-------+---------+----------|\n| TokenHandler | rejectedZeroReceiver | 4694  | 0       | 0        |\n|--------------+----------------------+-------+---------+----------|\n| TokenHandler | transfer             | 4668  | 0       | 0        |\n|--------------+----------------------+-------+---------+----------|\n| TokenHandler | transferFrom         | 4586  | 0       | 0        |\n╰--------------+----------------------+-------+---------+----------╯\n\nLogs:\n  Bound result 122584\n  Bound result 0\n  Bound result 0\n  Bound result 205\n  Bound result 115792089237316195423570985008687907853269984665640314039457584007914010464931\n  Bound result 0\n  Bound result 4358\n  Bound result 115792089237316195423570985008687907853269984665640314039457584007914010464521\n  Bound result 115792089237316195423570985008687907853269984665640314039457584007913129639942\n  Bound result 220234244239989269691698996\n  Bound result 115792089237316195423570985008687907853269984665640093805213344018643437947446\n  Bound result 0\n  Bound result 4\n  Bound result 115792089237316195423570985008687907853269984665640093805213344018643437940943\n  Bound result 0\n  Bound result 0\n  Bound result 8372865210542730083672456\n  Bound result 80009459505624682635884624832293853156252630659184210832326450869492639722\n  Bound result 53790898524976774157505559980703541148832\n  Bound result 125\n  Bound result 0\n  Bound result 115792089237316195423570985008687907853269984665640525900836613454452737672888\n  Bound result 115792089237316195423570985008687907853269984665640314039458413724493915538345\n  Bound result 1\n  Bound result 115792089237316195423570985008687907853269984665640525900836613454452737666810\n  Bound result 115792089237316195423570985008687907853269984665640322412322794550643213314855\n  Bound result 115792089237316195423570985008687907853269984665640525900836613454453737666683\n  Bound result 0\n  Bound result 11\n  Bound result 5754\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 115792089237316195423570985008687907853269984665640093805213344018643437965501\n  Bound result 0\n  Bound result 1719639407\n  Bound result 0\n  Bound result 244\n  Bound result 999999999999999999999999999\n  Bound result 14\n  Bound result 2\n  Bound result 100\n  Bound result 13\n  Bound result 6843\n  Bound result 524\n  Bound result 3812\n  Bound result 497\n  Bound result 3850\n  Bound result 903\n  Bound result 4678\n  Bound result 137979264657842693768905879\n  Bound result 0\n  Bound result 115792089237316195423570985008687907853269984665640093805213344018643437940937\n  Bound result 40159077082809881263068376488338763384055867969\n  Bound result 0\n  Bound result 0\n  Bound result 3668\n  Bound result 12\n  Bound result 11\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 241306558294232840936181155\n  Bound result 6526\n  Bound result 7336\n  Bound result 0\n  Bound result 0\n  Bound result 3518976949329120111863987\n  Bound result 115792089237316195423570985008687907853269984665640529419837036730109144998565\n  Bound result 0\n  Bound result 0\n  Bound result 85185227\n  Bound result 115792089237316195423570985008687907853269984665640310520480634678795570625052\n  Bound result 0\n  Bound result 115792089237316195423570985008687907853269984665640322412322794550643213309517\n  Bound result 10\n  Bound result 147496882624734990869258471128744750046983003782\n  Bound result 14\n  Bound result 3965\n  Bound result 115792089237316195423570985008687907853269984665640310520480634678793017782000\n  Bound result 0\n  Bound result 4083\n  Bound result 115792089237316195423570985008687907853269984665640310520480634678793017773543\n  Bound result 62365408604002945234851413\n  Bound result 97134887799459\n  Bound result 115792089237316195423570985008687907853269984665640322412322794550643213309512\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 15.12s (15.11s CPU time)\n\nRan 3 test suites in 15.12s (15.42s CPU time): 41 tests passed, 0 failed, 0 skipped (41 total tests)\n","passed":true},{"durationMs":76,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"VIMDToken.approve(address,uint256)\",\"VIMDToken.transfer(address,uint256)\",\"VIMDToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"DEPENDENCIES.md\":22,\"README.md\":135,\"dependencies.lock.json\":54,\"foundry.toml\":19,\"remappings.txt\":2,\"src/VIMDToken.sol\":17,\"test/VIMDToken.edge.t.sol\":286,\"test/VIMDToken.invariant.t.sol\":193,\"test/VIMDToken.t.sol\":379},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"9f8269b670a7de1ab50341d7c91dd17b14a9cac5fda96e6906223b22e25ed72d","verifiedTreeHash":"21276f0c0ced8bf64c0bf98293ec609ce33f3904","verifierVersion":"0.1.0+c3fba9eb"},{"checks":[{"durationMs":1211,"exitCode":0,"name":"build","output":"Compiling 27 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.14s\nCompiler run successful!\n","passed":true},{"durationMs":2641,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 25 tests for test/VIMDToken.t.sol:VIMDTokenTest\n[PASS] testApproveReplacesAndRevokesAllowance() (gas: 199501)\n[PASS] testConstructorEmitsExactlyOneMint() (gas: 18254)\n[PASS] testCreate2MintsToImmediateFactoryCaller() (gas: 276148)\n[PASS] testFactoryDistributionAndPoolTransfersArriveWhole() (gas: 685125)\n[PASS] testFuzzApproveZeroSpenderReverts(uint256) (runs: 1024, μ: 40357, ~: 40289)\n[PASS] testFuzzSelfTransferPreservesBalance(uint256) (runs: 1024, μ: 57835, ~: 57563)\nLogs:\n  Bound result 999999999999999999999999998\n\n[PASS] testFuzzTransferConservesSupply(address,uint256) (runs: 1024, μ: 99496, ~: 99875)\nLogs:\n  Bound result 15287\n\n[PASS] testFuzzTransferFromCannotExceedAllowance(uint256,uint256) (runs: 1024, μ: 127945, ~: 128249)\nLogs:\n  Bound result 625\n  Bound result 999999999999999999999999380\n\n[PASS] testFuzzTransferFromConservesSupply(uint256,uint256) (runs: 1024, μ: 169041, ~: 169978)\nLogs:\n  Bound result 299762313348243889464970062\n  Bound result 386883626351726341969462345463997715457468368021999508987035984\n\n[PASS] testFuzzTransferOverBalanceReverts(uint256) (runs: 1024, μ: 71855, ~: 72178)\nLogs:\n  Bound result 115792089237316195423570985008687907853269984665640564039457584007913129639933\n\n[PASS] testFuzzTransferToZeroReverts(uint256) (runs: 1024, μ: 50448, ~: 50380)\n[PASS] testInfiniteAllowanceIsNotReduced() (gas: 211962)\n[PASS] testMetadataAndInitialSupply() (gas: 109694)\n[PASS] testNoMintBurnOrAdministrativeEntrypoints() (gas: 1023900)\n[PASS] testOwnerStillNeedsAllowanceForTransferFrom() (gas: 38485)\n[PASS] testRuntimeHasNoDelegationOrDestructionOpcodes() (gas: 785695)\n[PASS] testSelfTransferFromPreservesBalanceButSpendsAllowance() (gas: 109993)\n[PASS] testTransferFromInsufficientBalanceRollsBackAllowance() (gas: 136495)\n[PASS] testTransferFromSpendsFiniteAllowanceAndEmitsTransfer() (gas: 219146)\n[PASS] testTransferFromZeroReceiverRollsBackAllowance() (gas: 119063)\n[PASS] testTransferSmallestUnitThenEntireRemainingBalance() (gas: 127489)\n[PASS] testZeroOwnerCannotApprove() (gas: 33141)\n[PASS] testZeroSenderCannotTransferEvenZeroTokens() (gas: 33078)\n[PASS] testZeroValueTransferFromEmptyAccountEmitsEvent() (gas: 73403)\n[PASS] testZeroValueTransferFromNeedsNoAllowance() (gas: 78761)\nSuite result: ok. 25 passed; 0 failed; 0 skipped; finished in 41.91ms (279.95ms CPU time)\n\nRan 1 test for test/VIMDToken.invariant.t.sol:VIMDTokenInvariantTest\n[PASS]\nVIMDTokenInvariantTest invariants:\n[PASS] invariantAllowancesMatchIndependentLedger\n[PASS] invariantSupplyAndBalancesMatchIndependentLedger\n VIMDTokenInvariantTest invariants (runs: 128, calls: 8192, reverts: 0)\n\n╭--------------+----------------------+-------+---------+----------╮\n| Contract     | Selector             | Calls | Reverts | Discards |\n+==================================================================+\n| TokenHandler | approve              | 2052  | 0       | 0        |\n|--------------+----------------------+-------+---------+----------|\n| TokenHandler | rejectedTransferFrom | 2127  | 0       | 0        |\n|--------------+----------------------+-------+---------+----------|\n| TokenHandler | transfer             | 2000  | 0       | 0        |\n|--------------+----------------------+-------+---------+----------|\n| TokenHandler | transferFrom         | 2013  | 0       | 0        |\n╰--------------+----------------------+-------+---------+----------╯\n\nLogs:\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 4091\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 112180180671161212007763806\n  Bound result 628\n  Bound result 0\n  Bound result 0\n  Bound result 669\n  Bound result 0\n  Bound result 0\n  Bound result 11\n  Bound result 17\n  Bound result 1233\n  Bound result 1184\n  Bound result 558803372749658279154929361\n  Bound result 1160\n  Bound result 106744900723945618716037910\n  Bound result 0\n  Bound result 0\n  Bound result 1\n  Bound result 0\n  Bound result 7\n  Bound result 0\n  Bound result 1501\n  Bound result 107477463\n  Bound result 292591613566647179176199075\n  Bound result 0\n  Bound result 4069\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 2.55s (2.55s CPU time)\n\nRan 2 test suites in 2.55s (2.59s CPU time): 26 tests passed, 0 failed, 0 skipped (26 total tests)\n","passed":true},{"durationMs":33,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"VIMDToken.approve(address,uint256)\",\"VIMDToken.transfer(address,uint256)\",\"VIMDToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"DEPENDENCIES.md\":22,\"README.md\":135,\"dependencies.lock.json\":54,\"foundry.toml\":19,\"launch.json\":20,\"remappings.txt\":2,\"src/VIMDToken.sol\":17,\"test/VIMDToken.invariant.t.sol\":119,\"test/VIMDToken.t.sol\":379},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"b6e62ea396ba0c20c5071292a64bfaf332e6781d725b5abb88e8a0248c00fd0e","verifiedTreeHash":"5bdc462f648aca1117e017a02bd5ea081f8ce45f","verifierVersion":"0.1.0+c3fba9eb"},{"checks":[{"durationMs":2351,"exitCode":0,"name":"build","output":"Compiling 27 files with Solc 0.8.26\nSolc 0.8.26 finished in 2.19s\nCompiler run successful!\n","passed":true},{"durationMs":4448,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 25 tests for test/VIMDToken.t.sol:VIMDTokenTest\n[PASS] testApproveReplacesAndRevokesAllowance() (gas: 199501)\n[PASS] testConstructorEmitsExactlyOneMint() (gas: 18254)\n[PASS] testCreate2MintsToImmediateFactoryCaller() (gas: 276148)\n[PASS] testFactoryDistributionAndPoolTransfersArriveWhole() (gas: 685125)\n[PASS] testFuzzApproveZeroSpenderReverts(uint256) (runs: 1024, μ: 40357, ~: 40289)\n[PASS] testFuzzSelfTransferPreservesBalance(uint256) (runs: 1024, μ: 57835, ~: 57563)\nLogs:\n  Bound result 999999999999999999999999998\n\n[PASS] testFuzzTransferConservesSupply(address,uint256) (runs: 1024, μ: 99496, ~: 99875)\nLogs:\n  Bound result 137849094177132\n\n[PASS] testFuzzTransferFromCannotExceedAllowance(uint256,uint256) (runs: 1024, μ: 127945, ~: 128249)\nLogs:\n  Bound result 244\n  Bound result 999999999999999999999999773\n\n[PASS] testFuzzTransferFromConservesSupply(uint256,uint256) (runs: 1024, μ: 169041, ~: 169978)\nLogs:\n  Bound result 16761\n  Bound result 2010035882\n\n[PASS] testFuzzTransferOverBalanceReverts(uint256) (runs: 1024, μ: 71855, ~: 72178)\nLogs:\n  Bound result 109242287533525912058528515355578798222\n\n[PASS] testFuzzTransferToZeroReverts(uint256) (runs: 1024, μ: 50448, ~: 50380)\n[PASS] testInfiniteAllowanceIsNotReduced() (gas: 211962)\n[PASS] testMetadataAndInitialSupply() (gas: 109694)\n[PASS] testNoMintBurnOrAdministrativeEntrypoints() (gas: 1023900)\n[PASS] testOwnerStillNeedsAllowanceForTransferFrom() (gas: 38485)\n[PASS] testRuntimeHasNoDelegationOrDestructionOpcodes() (gas: 785695)\n[PASS] testSelfTransferFromPreservesBalanceButSpendsAllowance() (gas: 109993)\n[PASS] testTransferFromInsufficientBalanceRollsBackAllowance() (gas: 136495)\n[PASS] testTransferFromSpendsFiniteAllowanceAndEmitsTransfer() (gas: 219146)\n[PASS] testTransferFromZeroReceiverRollsBackAllowance() (gas: 119063)\n[PASS] testTransferSmallestUnitThenEntireRemainingBalance() (gas: 127489)\n[PASS] testZeroOwnerCannotApprove() (gas: 33141)\n[PASS] testZeroSenderCannotTransferEvenZeroTokens() (gas: 33078)\n[PASS] testZeroValueTransferFromEmptyAccountEmitsEvent() (gas: 73403)\n[PASS] testZeroValueTransferFromNeedsNoAllowance() (gas: 78761)\nSuite result: ok. 25 passed; 0 failed; 0 skipped; finished in 55.59ms (388.56ms CPU time)\n\nRan 1 test for test/VIMDToken.invariant.t.sol:VIMDTokenInvariantTest\n[PASS]\nVIMDTokenInvariantTest invariants:\n[PASS] invariantAllowancesMatchIndependentLedger\n[PASS] invariantSupplyAndBalancesMatchIndependentLedger\n VIMDTokenInvariantTest invariants (runs: 128, calls: 8192, reverts: 0)\n\n╭--------------+----------------------+-------+---------+----------╮\n| Contract     | Selector             | Calls | Reverts | Discards |\n+==================================================================+\n| TokenHandler | approve              | 2052  | 0       | 0        |\n|--------------+----------------------+-------+---------+----------|\n| TokenHandler | rejectedTransferFrom | 2127  | 0       | 0        |\n|--------------+----------------------+-------+---------+----------|\n| TokenHandler | transfer             | 2000  | 0       | 0        |\n|--------------+----------------------+-------+---------+----------|\n| TokenHandler | transferFrom         | 2013  | 0       | 0        |\n╰--------------+----------------------+-------+---------+----------╯\n\nLogs:\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 4091\n  Bound result 0\n  Bound result 2534\n  Bound result 685\n  Bound result 112180173873588854075138068\n  Bound result 610\n  Bound result 0\n  Bound result 0\n  Bound result 6224\n  Bound result 0\n  Bound result 0\n  Bound result 11\n  Bound result 17\n  Bound result 26\n  Bound result 32\n  Bound result 76354556171914062280582905\n  Bound result 1001\n  Bound result 110991520912827435718074626\n  Bound result 0\n  Bound result 0\n  Bound result 1\n  Bound result 0\n  Bound result 7\n  Bound result 0\n  Bound result 481\n  Bound result 107477464\n  Bound result 6381267185197886291108016\n  Bound result 0\n  Bound result 4324\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 4.30s (4.29s CPU time)\n\nRan 2 test suites in 4.30s (4.35s CPU time): 26 tests passed, 0 failed, 0 skipped (26 total tests)\n","passed":true},{"durationMs":69,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"VIMDToken.approve(address,uint256)\",\"VIMDToken.transfer(address,uint256)\",\"VIMDToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"DEPENDENCIES.md\":22,\"README.md\":135,\"dependencies.lock.json\":54,\"foundry.toml\":19,\"remappings.txt\":2,\"src/VIMDToken.sol\":17,\"test/VIMDToken.invariant.t.sol\":119,\"test/VIMDToken.t.sol\":379},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true},{"durationMs":790,"exitCode":0,"name":"slither","output":"slither: no results at low impact or above","passed":true},{"durationMs":309,"exitCode":0,"name":"aderyn","output":"[low] large-numeric-literal at src/VIMDToken.sol:10: Large Numeric Literal","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"c7a073aed4fb2dda226aee31ef54f2503257674068536f6c32412c5041f62e21","verifiedTreeHash":"0f7d001d60951d0491d3c099264783952a4f68e4","verifierVersion":"0.1.0+c3fba9eb"}]}