{"assessments":[],"deployments":[{"attestationHash":"023e2ffc0e793c98036d054c6c21deab66f3605ecf14ecfc8a7a76bbf67c22be","chainId":1,"contracts":[{"address":"0xa47a7719d45ea64a9488821b4b65ab4317c152df","blockNumber":26412474,"name":"MerkleDistributor","role":"distributor","txHash":"0x489771f3381142696aad611b00ced4add4aebdde62b76d1345dee402a5e36cd7"},{"address":"0x538301debfff7173ee634f37850dbb858e65a97f","blockNumber":26412474,"name":"TheImdDaily","role":"token","txHash":"0x489771f3381142696aad611b00ced4add4aebdde62b76d1345dee402a5e36cd7"},{"address":"0x784ff9a3ac5d88a30bfff6f7f2a270161fbe6000","blockNumber":26412474,"name":"PoolInitializationGuard","role":"hook","txHash":"0x489771f3381142696aad611b00ced4add4aebdde62b76d1345dee402a5e36cd7"}],"id":"0f90d130-f037-4618-a1a3-b25e0746a1e6","manifestHash":"00ced28a207bfb2664895098a73f7c5af89057536361c14372558d082550fa52","status":"live"}],"fuzz":[],"identity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"interpretation":"Records acceptance and evidence. Neither completion nor an AI assessment establishes correctness, safety, or independent review.","jobId":"e947be72-104d-4a9b-b43f-bca5ce85ebf4","kind":"shape:chain","nodes":[{"acceptedSubmissionHash":"1e4434b1b7726dce83ccb9f43ea5206f86dbe00fdcf7664f6725b56f6a07c212","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"bc5bfc8455464381f2db18badb2b55cf8bec1e535c019349a0378fa990741171","skillId":"audit-specialist","subagents":3,"tools":[]},"key":"audit_economics","kind":"code","role":"review","skillHash":"bc5bfc8455464381f2db18badb2b55cf8bec1e535c019349a0378fa990741171","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"9e70a67bcb5038ec50ff69ed19f3192b2082a3328729245524fc19d94676ed0b","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"bc5bfc8455464381f2db18badb2b55cf8bec1e535c019349a0378fa990741171","skillId":"audit-specialist","subagents":3,"tools":[]},"key":"audit_flow","kind":"code","role":"review","skillHash":"bc5bfc8455464381f2db18badb2b55cf8bec1e535c019349a0378fa990741171","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"a208d83eb1c9aaa89fc645485412364c74bea7394ec1e1d2848a27e6d0b58a38","dependsOn":["build_contract_project","write_foundry_tests","manifest","audit_math","audit_permissions","audit_economics","audit_flow"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"b89279670f5a00f5d26286edee00c97dd158b997031350a01cafe6e0329ad227","skillId":"audit-judge","subagents":4,"tools":[]},"key":"audit_judge","kind":"code","role":"review","skillHash":"b89279670f5a00f5d26286edee00c97dd158b997031350a01cafe6e0329ad227","skillId":"audit-judge","state":"accepted"},{"acceptedSubmissionHash":"5cd8fa42f66b7616e22ef6fee44320d63ce42b8d4341f85e4d51408e8b6b2ad2","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"bc5bfc8455464381f2db18badb2b55cf8bec1e535c019349a0378fa990741171","skillId":"audit-specialist","subagents":3,"tools":[]},"key":"audit_math","kind":"code","role":"review","skillHash":"bc5bfc8455464381f2db18badb2b55cf8bec1e535c019349a0378fa990741171","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"d3f9d5622ca5689f01d7e9891b40987f34e205231b94863b8b97184dcbb12665","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"bc5bfc8455464381f2db18badb2b55cf8bec1e535c019349a0378fa990741171","skillId":"audit-specialist","subagents":3,"tools":[]},"key":"audit_permissions","kind":"code","role":"review","skillHash":"bc5bfc8455464381f2db18badb2b55cf8bec1e535c019349a0378fa990741171","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"27e5abb7612a760deebe238a77ae0817e18c41e1a6f59f3241fdd1e4fb26cb63","dependsOn":[],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"15b04fc8f60521936b9e2b37c09a804685ec689fc98cd5b04510d986d3106a15","skillId":"build-contract-project","tools":[]},"key":"build_contract_project","kind":"code","role":"implement","skillHash":"15b04fc8f60521936b9e2b37c09a804685ec689fc98cd5b04510d986d3106a15","skillId":"build-contract-project","state":"accepted"},{"acceptedSubmissionHash":"8fe8ff9e85084fc55f425b60ce398b288e8105640e295853982a0ac24c8825e2","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"tools":[]},"key":"manifest","kind":"code","role":"integrate","skillHash":null,"skillId":null,"state":"accepted"},{"acceptedSubmissionHash":"236c122fa8c47fdff28f05dda06c1668f73715c8295b9e4f391761a8e63bd992","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"6c8cf11980f74125d34b6f2b05c5495824fcaadbed08be63708f2f4c4e8114a2","skillId":"write-foundry-tests","subagents":4,"tools":[]},"key":"write_foundry_tests","kind":"code","role":"tests","skillHash":"6c8cf11980f74125d34b6f2b05c5495824fcaadbed08be63708f2f4c4e8114a2","skillId":"write-foundry-tests","state":"accepted"}],"objective":"A custom token: TheImdDaily (TID).\nToken name: TheImdDaily\nToken symbol: TID\nToken supply: 1,000,000,000 with 18 decimals, all minted once to the deployer in the constructor.","parentJobId":null,"planHash":"59c7152fbd53bcab9ba85c5ebf84a4f886b16748bccd1263642068e2a8b80a57","previousHash":"1a65ff020f4a06cdc0bb62b47e7755118a5407db46bf039472fe1ff039a1d1f1","projectId":"e947be72-104d-4a9b-b43f-bca5ce85ebf4","publication":{"commit":"4f9e6d19afeb4f1ada22c1acfb79e4b634d41a13","deliveredAt":"2026-11-14T09:57:45.745Z","repoUrl":"https://github.com/identity-md-launches/launch-3265-theimddaily"},"receiptIdentity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"registry":"0xb6d0a187b050fa5bb0b87033a203f37becf4a775","research":[],"schema":"identitymd-work-v1","signals":[],"site":null,"snapshotHash":"4e1b7a086b7a6cf2d84c4b15dd4353010a04e95b9b71f82adc7db0191a632ee2","state":"completed","submissions":[{"artifacts":[],"attempt":1,"bundleHash":null,"device":"df74f6c887684f20","findings":[{"citation":"resolved","description":"lib/DEPENDENCIES.md states that the vendored upstream files are unmodified and that `sha256sum -c lib/SHA256SUMS` verifies them. Running that command from the repository root reports 23 of 36 files FAILED, among them the two production sources the token compiles against: lib/openzeppelin-contracts/contracts/token/ERC20/ERC20.sol and lib/openzeppelin-contracts/contracts/interfaces/draft-IERC6093.sol. The recorded hashes are the real upstream ones (fetched OpenZeppelin v5.1.0 at commit 69c8def5f222ff96f2b5beff05dfba996368aa79: ERC20.sol = be0df7e4...cf64, draft-IERC6093.sol = 56380323...3338, both equal to the SHA256SUMS entries). The vendored copies were re-wrapped by `forge fmt` (line_length = 100) after the sums were recorded: ERC20.sol line 280 `function _approve(address owner, address spender, uint256 value, bool emitEvent) internal virtual {` is split across four lines, and draft-IERC6093.sol line 121 `error ERC1155InsufficientBalance(...)` across three. A whitespace-insensitive diff shows no other change, so compiled behaviour and runtime bytecode are unaffected (bytecode_hash = none). The defect is that the project's only stated provenance control is broken: a reviewer or the launch's source-verification step following the documented procedure cannot distinguish this benign reformat from a substantive edit to the ERC20 base, and the claim 'Upstream files are unmodified' is false as shipped. Minimal fix: restore the byte-exact upstream files under lib/ (they are not subject to the project's fmt rules) so `sha256sum -c lib/SHA256SUMS` passes, or, if the reformatted copies are intended, re-record SHA256SUMS and drop the 'unmodified' wording. Restoring upstream bytes is preferable because it keeps the pinned-commit provenance verifiable.","line":4,"path":"lib/DEPENDENCIES.md","reproduction":"From the repository root run `sha256sum -c lib/SHA256SUMS`. Expected (per lib/DEPENDENCIES.md): every line `OK`. Actual: 23 lines `FAILED` and `sha256sum: WARNING: 23 computed checksums did NOT match`, including `lib/openzeppelin-contracts/contracts/token/ERC20/ERC20.sol: FAILED` and `lib/openzeppelin-contracts/contracts/interfaces/draft-IERC6093.sol: FAILED`. `sha256sum lib/openzeppelin-contracts/contracts/token/ERC20/ERC20.sol` gives 41a3a1416d22d70f92f86b1e0d152cdf88874d36f5350c0146fc880acdc75c8a while SHA256SUMS records be0df7e4b899a61a4beb3c8675088de494866438600ce2d529523807b558cf64, which is the hash of the upstream file at the pinned commit. `diff -w <upstream ERC20.sol> lib/openzeppelin-contracts/contracts/token/ERC20/ERC20.sol` shows only the line-wrap at line 280.","severity":"low","snippet":"submodule initialization. Upstream files are unmodified; `SHA256SUMS` records","title":"Documented dependency integrity check fails: 23 vendored files do not match lib/SHA256SUMS, including the production ERC20 base"}],"hash":"1e4434b1b7726dce83ccb9f43ea5206f86dbe00fdcf7664f6725b56f6a07c212","nodeId":"987261af-9930-4265-a1c5-3c84770399af","outcome":"completed","summary":"The review is complete and `.imd-findings.json` is written and validated. Nothing in the repository was modified apart from that file.\n\n**Outcome.** TheImdDaily is a 17-line OpenZeppelin v5.1.0 ERC20 that mints 1e27 units to msg.sender in the constructor and adds nothing else. Within my area (Economic Security, Invariant, Flow Gap) it holds. I found one low-severity integrity defect outside the token code.\n\n**Finding (low).** The project's documented dependency integrity check fails. `lib/DEPENDENCIES.md` says the vendored upstream files are unmodified and that `sha256sum -c lib/SHA256SUMS` verifies them. Running it reports 23 of 36 files FAILED, including the production ERC20 base and the ERC-6093 errors interface. I fetched the pinned upstream commit and confirmed the recorded hashes are the genuine upstream ones. The vendored copies were re-wrapped by `forge fmt` afterward (two long lines split). The diff is whitespace-only, so behaviour and runtime bytecode are unaffected, but the provenance claim is false as shipped and the stated verification procedure cannot be used. Suggested fix: restore byte-exact upstream files under lib/, or re-record the sums and drop the \"unmodified\" wording.\n\n**What I checked and verified holds:**\n- All three entry points (approve, transfer, transferFrom): exact amounts, revert-and-rollback on every failure path, no fee, hook, callback, or deployer bypass.\n- Supply is fixed at exactly 1e27 and cannot grow. Only the constructor reaches `_mint`; no burn, owner, pause, blacklist, seize, or upgrade selectors exist.\n- Launch flows (10% to distributor, 85% seed through the PoolManager, 5% remainder, claims, trader buy and sell) all move exactly what they say. The token needs no exemptions and has no distributorOf dependency.\n- No external calls or oracles, so no periphery seam exists.\n- Existing suite builds and passes (33 tests, fuzz and stateful invariants). Slither reported nothing; the aderyn \"large numeric literal\" lead is noise, since the constant equals 10^27 exactly.\n\n**Coverage record.** Nine rows: the three ABI entry points plus six invariant rows, all `holds` except the provenance row, which references finding 1.\n\n**Not reached.** No launch.json exists yet, so manifest review was not possible. A live Uniswap v4 seed-and-swap could not be run locally because v4-core is not vendored; that remains for the protected floor harness.","treeHash":null,"usage":{"cachedInputTokens":489886,"cost":{"source":"runtime","usdMicros":2341662},"inputTokens":258,"model":"claude-fable-5-1","outputTokens":13713,"runtime":"claude","turns":17,"wallClockMs":247429}},{"artifacts":[],"attempt":1,"bundleHash":"bdad6c7de6386360c5c71d69df1742fe8e12b66fcb4fb0ff286e9e06d84cf3f0","device":"523ef565dd740e25","findings":[],"hash":"236c122fa8c47fdff28f05dda06c1668f73715c8295b9e4f391761a8e63bd992","nodeId":"58a88372-70dd-4e2d-8a16-5887c0120dea","outcome":"completed","summary":"I added 30 tests to the TheImdDaily (TID) suite, and the full suite passes: `forge build` succeeds and `forge test` runs 63 tests with no failures, using the verifier's fuzz seed. I found no defects, so I didn't write `.imd-findings.json`.\n\n**The contract:** `src/TheImdDaily.sol` is a plain OpenZeppelin v5.1 ERC-20. It mints 1,000,000,000 × 10¹⁸ to the deployer in the constructor and has no owner, admin, mint or burn functions. I kept the 33 tests earlier contributors wrote and added these files under `test/`:\n\n- **`test/properties/WalletGas.sol`**: the supplied helper, copied unchanged except that its compiler version is pinned to 0.8.26.\n- **`test/TheImdDaily.walletgas.t.sol`** (12 tests): checks `transfer`, `approve` and `transferFrom` at a wallet's gas against gas to spare, covering:\n  - transfers to new and existing holders, of a whole balance, of the entire supply, and of zero;\n  - finite, unlimited and revoked approvals;\n  - spending part of an allowance, all of it, and an unlimited one;\n  - a check that the helper leaves state unchanged.\n\n  The token never checks remaining gas, forwards a fixed amount of gas or catches a failed call. That makes this criterion technically not apply, but the tests confirm a wallet's gas makes no difference.\n- **`test/TheImdDaily.openHolders.invariant.t.sol`**: an invariant test over random call sequences (256 runs, 16,384 calls) where any non-zero address can become a holder. Alongside normal transfers and approvals, it sends calls that should fail, checks each one reverts with the right error, and confirms nothing changed:\n  - overdrafts and overspent allowances;\n  - transfers to the zero address and approvals for it;\n  - attempts to call mint, burn, burnFrom, pause or seize.\n\n  After every call it checks that the total supply is fixed, that every holder's balance matches the expected value and all balances add up to the supply, that allowances match, and that the contract holds no ETH and its name, symbol and decimals don't change.\n- **`test/TheImdDaily.edges.t.sol`** (17 tests, some fuzzed):\n  - **Limits:** spending exactly the balance or allowance works, and one unit more fails.\n  - **Error order:** the allowance is checked before the balance.\n  - **Zero-address owner:** `transferFrom` with it reverts.\n  - **Events:** `transferFrom` emits only a `Transfer`; `approve` replaces an earlier allowance rather than adding to it.\n  - **Unlimited allowances:** they are never reduced, while the largest finite value minus one is.\n  - **Arbitrary addresses:** fuzzed transfers and `transferFrom` keep balances correct.\n  - **Failed `transferFrom`:** it changes nothing.\n  - **Stray inputs:** ETH and unknown calls are rejected.\n\n**One thing to know, by design rather than a defect:** tokens sent to the token contract's own address are accepted and stay there, because there is no recovery function. This is normal ERC-20 behaviour, so I recorded it in a test rather than reporting it.\n\nI didn't install anything. Only `test/` files were added, and I haven't committed them.","treeHash":"aa1ca9386d9a55010e9dad8d01b36d123eddc4e4","usage":{"cachedInputTokens":854331,"cost":{"source":"runtime","usdMicros":1108474},"inputTokens":32,"model":"claude-opus-5-5","outputTokens":19317,"runtime":"claude","turns":20,"wallClockMs":217083}},{"artifacts":[],"attempt":1,"bundleHash":"a13697a94d8e4bd3c7822426084a50d052bebb3ce365539c3e179d4238786dda","device":"9b84a1e2e2a9ac5e","findings":[],"hash":"27e5abb7612a760deebe238a77ae0817e18c41e1a6f59f3241fdd1e4fb26cb63","nodeId":"26b31cd8-102d-4f29-8d6d-e6fb7b958da6","outcome":"completed","summary":"Implemented TheImdDaily (TID): 1 billion tokens, 18 decimals, minted once to the deployer, with no additional minting or admin powers.\n\nDependencies are vendored for offline builds. Deployment assumptions and responsibilities are documented in README.md.\n\nPassed `forge build`, `forge test` (33 tests, including fuzz and invariants), and `forge fmt --check`.\n\nFull protected launch integration remains for the independent verifier.","treeHash":"75d78c57f377cb5f587722905c330432a181f0aa","usage":{"cachedInputTokens":650880,"cost":{"source":"estimated","usdMicros":1916090},"inputTokens":48391,"model":"gpt-6-astra","outputTokens":15626,"runtime":"codex","turns":6,"wallClockMs":407328}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"f9cb4fd544aa3c68","findings":[{"citation":"resolved","description":"DEPENDENCIES.md states the vendored upstream files are unmodified and that `sha256sum -c lib/SHA256SUMS` verifies them. The hashes in SHA256SUMS are the upstream file hashes (the recorded hash for ERC20.sol, be0df7e4...cf64, equals the hash of upstream contracts/token/ERC20/ERC20.sol at commit 69c8def5), but 23 of the 36 vendored files were reformatted after the hashes were recorded (forge fmt rewrapped lines longer than 100 characters, e.g. the `_approve(address,address,uint256,bool)` signature in ERC20.sol and the `ERC1155InsufficientBalance` error in draft-IERC6093.sol). The reformatted files hash differently, so the integrity check the project tells reviewers and the launch operator to run reports 23 failures. Behavioural impact: none. A line-by-line diff of the production files (ERC20.sol, IERC20.sol, IERC20Metadata.sol, Context.sol, draft-IERC6093.sol) against upstream shows whitespace-only changes, so the token's arithmetic is OpenZeppelin v5.1.0's. The defect is that the delivered evidence of provenance is broken: a reviewer following the documented command cannot distinguish this cosmetic reformat from a semantic edit to the ERC20 arithmetic without fetching upstream and diffing by hand. Fix: either regenerate SHA256SUMS from the files as vendored (and drop the word 'unmodified'), or restore the upstream byte-exact files and exclude lib/ from forge fmt.","line":4,"path":"lib/DEPENDENCIES.md","reproduction":"From the project root run `sha256sum -c lib/SHA256SUMS`. Expected (per DEPENDENCIES.md): every line OK. Actual: 23 lines FAILED, 13 OK, including lib/openzeppelin-contracts/contracts/token/ERC20/ERC20.sol (recorded be0df7e4b899a61a4beb3c8675088de494866438600ce2d529523807b558cf64, actual 41a3a1416d22d70f92f86b1e0d152cdf88874d36f5350c0146fc880acdc75c8a) and lib/openzeppelin-contracts/contracts/interfaces/draft-IERC6093.sol. `diff lib/openzeppelin-contracts/contracts/token/ERC20/ERC20.sol <upstream ERC20.sol at 69c8def5f222ff96f2b5beff05dfba996368aa79>` shows only lines 280-283 differ (one function signature split across four lines).","severity":"low","snippet":"submodule initialization. Upstream files are unmodified; `SHA256SUMS` records\ntheir contents (run `sha256sum -c lib/SHA256SUMS` from the project root).","title":"lib/SHA256SUMS does not match the vendored OpenZeppelin and forge-std files; the documented integrity check fails"}],"hash":"5cd8fa42f66b7616e22ef6fee44320d63ce42b8d4341f85e4d51408e8b6b2ad2","nodeId":"ba727038-90ca-4268-9a6f-c9fdb4cf5556","outcome":"completed","summary":"The review is complete and the findings file is written.\n\n**Outcome.** The math area is clean. TheImdDaily is OpenZeppelin v5.1.0's ERC20 with one constructor mint and nothing else, so there is no division, scaling, fixed point, cast, external call, payable path or fallback for the Math Precision, Boundary or Numerical Gap failure modes to attach to. I traced the arithmetic in OZ's transfer, allowance and mint paths and confirmed the edges with a scratch Foundry test, since removed:\n\n- The supply constant is exactly 1e27 and decimals is 18, matching the manifest's minor units. The aderyn large-literal lead is dismissed.\n- A fuzzed three-hop transfer chain conserves the sum of balances exactly. The project's own 33 tests, including the invariant suite, pass.\n- Allowance at max minus one decrements normally, and at max it is sticky. Overdrafts by one wei revert atomically.\n- ETH and unknown selectors revert, so no value can enter the contract.\n\n**One finding, low severity, outside my area.** The dependency manifest in lib/DEPENDENCIES.md tells reviewers to run a checksum verification and says the upstream files are unmodified. That command fails on 23 of 36 files. The recorded hashes are the true upstream hashes, but the vendored files were reformatted afterwards by the formatter rewrapping long lines. I diffed the production files against upstream at the pinned commit and confirmed the changes are whitespace only, so the token's arithmetic is upstream's. The defect is that the delivered provenance evidence is broken and cannot distinguish a cosmetic reformat from a semantic edit without a manual diff. The fix is to regenerate the checksum file from the files as vendored, or restore byte-exact upstream files and exclude lib from formatting.\n\n**Coverage.** All three entry points are recorded as holds, with five extra rows for the supply invariant, the constructor constant, boundary enumeration, the numerical-gap seams, and the provenance finding. No launch.json exists in the tree yet, which is expected at this stage. Nothing in my area was left unreached.","treeHash":null,"usage":{"cachedInputTokens":341235,"cost":{"source":"runtime","usdMicros":1809955},"inputTokens":226,"model":"claude-fable-5-1","outputTokens":10284,"runtime":"claude","turns":10,"wallClockMs":203857}},{"artifacts":[],"attempt":1,"bundleHash":"14b6b0191ce06832a62372922a977810059044d78be32cacbfefc7c6897bb91f","device":"b0001bc8a5c908cd","findings":[],"hash":"8fe8ff9e85084fc55f425b60ce398b288e8105640e295853982a0ac24c8825e2","nodeId":"3afb19fc-a06b-4257-bde1-2e322f3893b8","outcome":"completed","summary":"I wrote `launch.json` for TheImdDaily (TID). It parses as JSON, and `forge build` and `forge test` both pass (33 of 33 tests). Nothing checks the manifest against the schema, so I checked it by reading it. I didn't run the two protected floor tests because their supporting files aren't in this tree.\n\n- **Token:** the contract is `TheImdDaily` in `src/TheImdDaily.sol`. Its name is \"TheImdDaily\", its symbol \"TID\", and it has 18 decimals.\n- **Constructor arguments:** none, because the constructor takes no parameters.\n- **Total supply:** `\"1000000000000000000000000000\"`. That is the 1,000,000,000 × 10¹⁸ the constructor mints once to `msg.sender`, which is the factory at launch.\n- **Application contracts:** none. The accepted tree contains only the token.\n- **Pool:** IMD (`0xd34a99bc0f67ae1bbd63c660e6d0b0dd03e263b7`) as the paired currency, fee 12500, tick spacing 60, and the one-to-one initial price.\n- **Economics:** copied exactly from the brief.\n- **Notes:** a short description saying the token has a fixed supply, no owner and no privileged functions, and that the launch deploys no other contracts.\n\n`launch.json` is the only file changed, and I haven't committed it.","treeHash":"d840915b07790d45d4c7fcc90b9d2da71ed095c1","usage":{"cachedInputTokens":53724,"cost":{"source":"runtime","usdMicros":191896},"inputTokens":6,"model":"claude-opus-5-5","outputTokens":1396,"runtime":"claude","turns":3,"wallClockMs":33282}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"9ab27edcfd62be02","findings":[{"citation":"resolved","description":"The periphery the token trusts is the vendored OpenZeppelin ERC20 (lib/openzeppelin-contracts/contracts/token/ERC20/ERC20.sol) and the IERC6093 error interface. DEPENDENCIES.md states the upstream files are unmodified and tells a verifier to prove it with `sha256sum -c lib/SHA256SUMS`. That command fails on the tree as delivered: 23 of the 36 recorded checksums do not match, including the production file ERC20.sol and draft-IERC6093.sol. The recorded hashes are the true upstream hashes (I fetched OpenZeppelin v5.1.0 at commit 69c8def5 and forge-std at 77041d2c and they match SHA256SUMS exactly), while the files in the tree have been re-wrapped to the project's 100-column `forge fmt` style (e.g. ERC20.sol:280 `_approve(...) internal virtual {` is split over four lines; draft-IERC6093.sol:121 the ERC1155InsufficientBalance error is split over three lines). I confirmed by stripping all whitespace that every one of the 23 differing files is identical to upstream modulo whitespace, so the production ERC-20 semantics are intact and the compiled token is unaffected. The defect is that the project's own supply-chain evidence is broken: a reviewer or the launch's verifier following the documented procedure gets a hard failure and cannot tell a benign reformat from a tampered library without doing the upstream diff themselves. Minimal fix (choose one): regenerate lib/SHA256SUMS over the files actually in the tree and reword DEPENDENCIES.md to say they are upstream reformatted by forge fmt; or restore the upstream bytes and keep forge fmt off lib/ (an `ignore = [\"lib/**\"]` entry in [fmt] of foundry.toml, which is a configuration change outside a token-only fix and so a scope decision for the author).","line":4,"path":"lib/DEPENDENCIES.md","reproduction":"Input: run `sha256sum -c lib/SHA256SUMS` from the repository root, as lib/DEPENDENCIES.md:5 instructs. Expected: every line `OK`. Actual: `sha256sum: WARNING: 23 computed checksums did NOT match`, with FAILED for lib/openzeppelin-contracts/contracts/token/ERC20/ERC20.sol, lib/openzeppelin-contracts/contracts/interfaces/draft-IERC6093.sol and 21 forge-std files. Concretely for ERC20.sol: recorded be0df7e4b899a61a4beb3c8675088de494866438600ce2d529523807b558cf64 (equals upstream v5.1.0), actual 41a3a1416d22d70f92f86b1e0d152cdf88874d36f5350c0146fc880acdc75c8a. `diff` against upstream shows only line 280 re-wrapped; `tr -d ' \\t\\n\\r' | sha256sum` on both files gives the same digest, so the difference is whitespace only.","severity":"low","snippet":"submodule initialization. Upstream files are unmodified; `SHA256SUMS` records\ntheir contents (run `sha256sum -c lib/SHA256SUMS` from the project root).","title":"Documented dependency integrity check fails: lib/SHA256SUMS records upstream bytes but 23 of 36 vendored files were reformatted"}],"hash":"9e70a67bcb5038ec50ff69ed19f3192b2082a3328729245524fc19d94676ed0b","nodeId":"8a07129a-64a8-4787-bd6b-7fc45083d3e5","outcome":"completed","summary":"The review is complete and the findings file is written and validated. Nothing further is needed; here is the recap.\n\n**Outcome.** The token itself is sound in my area. `TheImdDaily` is a bare OpenZeppelin v5.1.0 ERC-20 whose constructor mints exactly 10^27 units to its immediate creator and exposes no other state-changing surface. I found one low-severity defect in the periphery, and no defect in the three entry points.\n\n**What I checked, by guide**\n\n- **Execution Trace.** Traced `approve`, `transfer` and `transferFrom` from entry to final state. No external calls, no stale reads, no partial updates. Reverts are atomic. The infinite-allowance sentinel is exact-max only. The approval race is inherent ERC-20 and already documented in the README, so I did not report it as a defect.\n- **Periphery.** Diffed every vendored OpenZeppelin and forge-std file against the pinned upstream commits. All differ only in whitespace. I also reviewed the solc 0.8.26 known-bug list. None of its six entries applies to this build, which uses legacy codegen with no assembly or recursion. The runtime bytecode contains no DELEGATECALL, CALLCODE, SELFDESTRUCT or CALL.\n- **First Principles.** The mint goes to `msg.sender`, not `tx.origin`, so a CREATE2 factory deployment leaves the whole supply with the factory. Transfers deliver exact amounts, so the swarm share, pool seed and swaps in the protected harness cannot arrive short. Decimals and supply constant match the brief.\n\n**The one finding (low).** The project's documented integrity check fails. `lib/DEPENDENCIES.md` says the upstream files are unmodified and tells a verifier to run the checksum file, but that command reports 23 of 36 files as FAILED, including the production ERC20.sol. The recorded hashes are the genuine upstream ones. The files in the tree were re-wrapped by `forge fmt`. Semantics are intact, but the supply-chain evidence the project relies on cannot be passed, and a tamper would be indistinguishable from this reformat without redoing the upstream diff. The fix is to regenerate the checksum file over the actual tree, or to restore upstream bytes and keep the formatter off `lib/`.\n\n**Coverage.** All three listed entry points are recorded as `holds`, plus four invariant rows. One limitation: the protected Uniswap v4 harness could not be executed locally because its supporting sources are not in the tree. I verified the launch flows by reading and by the project's own distribution tests instead.\n\nScratch tests live under `test/scratch/` and are not part of the submission. No tracked file was changed.","treeHash":null,"usage":{"cachedInputTokens":562551,"cost":{"source":"runtime","usdMicros":2748084},"inputTokens":258,"model":"claude-fable-5-1","outputTokens":18089,"runtime":"claude","turns":26,"wallClockMs":294805}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"e096d0a2b0992309","findings":[{"citation":"resolved","description":"Merged from four specialist reports (permissions, economics, flow, math), all the same root cause. lib/DEPENDENCIES.md states the vendored upstream files are unmodified and that `sha256sum -c lib/SHA256SUMS` proves it; README.md line 108 points reviewers to that check. In the tree as delivered the check fails for 23 of 36 files: lib/openzeppelin-contracts/contracts/token/ERC20/ERC20.sol, lib/openzeppelin-contracts/contracts/interfaces/draft-IERC6093.sol and 21 forge-std sources. I reproduced it and determined the cause: the recorded hashes are the true upstream hashes (I fetched OpenZeppelin commit 69c8def5 and forge-std commit 77041d2c; ERC20.sol upstream sha256 be0df7e4...cf64 and draft-IERC6093.sol 56380323...3338 equal the SHA256SUMS entries), while the vendored files were re-wrapped by the project's `forge fmt` (line_length = 100) after the sums were recorded. ERC20.sol differs only at line 280, where `function _approve(address owner, address spender, uint256 value, bool emitEvent) internal virtual {` is split over four lines; draft-IERC6093.sol only at line 121 (`error ERC1155InsufficientBalance(...)` split over three). For all 23 files, stripping whitespace gives identical bytes to upstream, so semantics and compiled bytecode (bytecode_hash = none, so no metadata hash either) are unaffected; this is why severity is low, not medium. The defect is that the project's only stated provenance control is broken and its claim untrue: a reviewer or the launch's source-verification step following the documented procedure gets 23 FAILED lines and cannot separate a harmless reformat from a substantive edit to the ERC20 base without redoing the upstream diff, and any future real edit would hide among 22 expected failures. Minimal fix without behaviour change: restore the 23 files byte-for-byte from the pinned commits (SHA256SUMS already holds the upstream hashes and then passes unchanged) and keep the formatter off lib/ (an [fmt] ignore entry is a configuration change outside the token, so a scope decision for the author). Regenerating SHA256SUMS over the reformatted files instead would make the command pass but requires rewording 'unmodified', and loses the direct link to upstream bytes.","line":4,"path":"lib/DEPENDENCIES.md","reproduction":"State: the tree as delivered, from the repository root. Run `sha256sum -c lib/SHA256SUMS`. Expected (lib/DEPENDENCIES.md lines 4-5): 36 lines ending `: OK`. Actual: 13 OK, 23 `: FAILED`, and `sha256sum: WARNING: 23 computed checksums did NOT match`, including `lib/openzeppelin-contracts/contracts/token/ERC20/ERC20.sol: FAILED` and `lib/openzeppelin-contracts/contracts/interfaces/draft-IERC6093.sol: FAILED`. `sha256sum lib/openzeppelin-contracts/contracts/token/ERC20/ERC20.sol` = 41a3a1416d22d70f92f86b1e0d152cdf88874d36f5350c0146fc880acdc75c8a; SHA256SUMS records be0df7e4b899a61a4beb3c8675088de494866438600ce2d529523807b558cf64, which is the sha256 of upstream contracts/token/ERC20/ERC20.sol at commit 69c8def5f222ff96f2b5beff05dfba996368aa79. `diff <upstream ERC20.sol> lib/openzeppelin-contracts/contracts/token/ERC20/ERC20.sol` prints one hunk, 280c280,283 (the `_approve(address,address,uint256,bool)` signature re-wrapped); `tr -d ' \\t\\n\\r' | sha256sum` on both gives the same digest. Same for draft-IERC6093.sol (121c121,123) and the 21 forge-std files against commit 77041d2ce690e692d6e03cc812b57d1ddaa4d505.","severity":"low","snippet":"submodule initialization. Upstream files are unmodified; `SHA256SUMS` records","title":"Documented dependency integrity check fails: 23 of 36 vendored files (including the production ERC20.sol) do not match lib/SHA256SUMS, so 'Upstream files are unmodified' is false"}],"hash":"a208d83eb1c9aaa89fc645485412364c74bea7394ec1e1d2848a27e6d0b58a38","nodeId":"63d72657-d491-48be-8e53-3f4b5f10ca06","outcome":"completed","summary":"The review is complete and `.imd-findings.json` holds the result. No repository files were changed; the scratch test directory I used was removed.\n\n**Outcome**\n\n- **One finding kept, severity low.** All four specialists reported the same root cause, so they merge into one. The documented integrity check in lib/DEPENDENCIES.md fails for 23 of 36 vendored files, including the production ERC20.sol and the IERC6093 error interface.\n- **Reproduced directly.** Running `sha256sum -c lib/SHA256SUMS` from the repository root gives 13 OK and 23 FAILED. I fetched the pinned upstream commits of OpenZeppelin and forge-std and confirmed the recorded hashes are the true upstream ones. Every differing file is byte-identical to upstream once whitespace is stripped. The only changes are line re-wraps from the project's 100-column formatter, such as the four-argument internal approve signature at ERC20.sol line 280.\n- **Why low, not medium.** Whitespace does not change compiled output, and bytecode_hash is set to none, so the deployed token is unaffected. The defect is that the project's only stated provenance control is broken and the claim \"Upstream files are unmodified\" is false as shipped. The fix is to restore the upstream bytes under lib/ and keep the formatter off that directory, or to re-record the sums and reword the claim.\n\n**Coverage**\n\n- All three entry points hold. The token adds nothing to OpenZeppelin v5.1.0 ERC20. Approve rejects a zero spender, transfer reverts on zero addresses and insufficient balance and moves the exact amount, and transferFrom checks and consumes allowance with the infinite-allowance exception intact.\n- The constructor mints exactly one billion tokens with 18 decimals to the deployer, matching the manifest's totalSupply and decimals. There are no mint, burn, owner or pause functions, and no forbidden opcodes. Runtime and creation sizes are far under the protocol limits.\n- The project's 63 tests, including fuzz and stateful invariants, all pass. The verifier's protected tests could not be compiled here because they need the launch harness that is not in this tree, so their checks were traced by hand instead.\n- The static analysis lead about a large numeric literal is not a defect. The constant is readable and its value is asserted by tests.","treeHash":null,"usage":{"cachedInputTokens":246374,"cost":{"source":"runtime","usdMicros":1320099},"inputTokens":162,"model":"claude-fable-5-1","outputTokens":7813,"runtime":"claude","turns":6,"wallClockMs":183024}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"401c4383398af47c","findings":[{"citation":"resolved","description":"Trust gap in the only code the token's permission model rests on. TheImdDaily adds no logic of its own: every guard on transfer, approve and transferFrom lives in the vendored lib/openzeppelin-contracts/contracts/token/ERC20/ERC20.sol, and README.md:108 and lib/DEPENDENCIES.md:4-5 tell a reviewer to trust that file because it is byte-identical to OpenZeppelin v5.1.0 (commit 69c8def5) and to prove it with `sha256sum -c lib/SHA256SUMS`. That check fails in this tree. lib/SHA256SUMS records the upstream hashes (e.g. be0df7e4...8cf64 for ERC20.sol, which is exactly the sha256 of the upstream file at the pinned commit), but 23 of the 36 listed files have since been rewritten: 2 OpenZeppelin files (token/ERC20/ERC20.sol and interfaces/draft-IERC6093.sol) and 21 forge-std files. The vendored ERC20.sol now hashes differently because its 4-argument `_approve` signature at line 280 was re-wrapped over four lines. I checked what the rewrite was: running `forge fmt` with this project's `line_length = 100` over pristine upstream copies of all 23 files reproduces the vendored bytes exactly, and building src/TheImdDaily.sol against pristine upstream OpenZeppelin gives creation and runtime bytecode identical to this tree's (creation bytecode keccak256 0xcaee1847113c0dcbd3bc90abf8f984d0930bc0e9b0cf392eb6f14f710aeb0d16). So today the edits are whitespace only and nothing on chain changes. The defect is that the documented integrity control is broken and its claim untrue: a reviewer or the launch operator following the README gets 23 FAILED lines and cannot separate a harmless reformat from a changed allowance or balance check without redoing the upstream diff by hand, and any later real edit to ERC20.sol would be hidden among 22 expected failures. Fix without changing behaviour: restore the 23 files byte-for-byte from the pinned commits (the recorded hashes are already the upstream ones, so SHA256SUMS then passes unchanged) and keep the formatter off lib/; regenerating SHA256SUMS from the reformatted files instead would make the check pass but would leave 'Upstream files are unmodified' false and lose the link to upstream.","line":4,"path":"lib/DEPENDENCIES.md","reproduction":"State: the tree as delivered. From the repository root run `sha256sum -c lib/SHA256SUMS`. Expected (lib/DEPENDENCIES.md:4-5, README.md:108): 36 lines ending ': OK'. Actual: 13 OK, 23 ': FAILED', and 'sha256sum: WARNING: 23 computed checksums did NOT match'. Failing entries include lib/openzeppelin-contracts/contracts/token/ERC20/ERC20.sol and lib/openzeppelin-contracts/contracts/interfaces/draft-IERC6093.sol, plus forge-std's Vm.sol, StdCheats.sol, StdAssertions.sol, StdStorage.sol, StdUtils.sol, StdJson.sol, StdToml.sol, StdChains.sol, StdStyle.sol, StdMath.sol, StdInvariant.sol, StdConstants.sol, console.sol, safeconsole.sol and interfaces/{IERC721,IERC1155,IERC4626,IERC6909,IERC7540,IERC7575,IMulticall3}.sol. Concrete differing input: `diff` of upstream ERC20.sol at commit 69c8def5f222ff96f2b5beff05dfba996368aa79 against the vendored file prints one hunk, 280c280,283: upstream's single line `function _approve(address owner, address spender, uint256 value, bool emitEvent) internal virtual {` is four lines in the tree; draft-IERC6093.sol differs at 121c121,123 (`error ERC1155InsufficientBalance(...)` re-wrapped). Upstream sha256 of ERC20.sol = be0df7e4b899a61a4beb3c8675088de494866438600ce2d529523807b558cf64, equal to the SHA256SUMS entry and not to the file in the tree.","severity":"low","snippet":"submodule initialization. Upstream files are unmodified; `SHA256SUMS` records\ntheir contents (run `sha256sum -c lib/SHA256SUMS` from the project root).","title":"Dependency integrity manifest fails for 23 of 36 vendored files, including the production ERC20.sol; 'Upstream files are unmodified' is false"}],"hash":"d3f9d5622ca5689f01d7e9891b40987f34e205231b94863b8b97184dcbb12665","nodeId":"1971afbf-0dea-495c-860c-21d8fec1a427","outcome":"completed","summary":"The review is written to `.imd-findings.json`: one low-severity finding and seven coverage rows. All three entry points hold, and no tracked file was changed.\n\n## Finding\n\n**Low — the dependency integrity check fails for 23 of 36 vendored files** (`lib/DEPENDENCIES.md:4`).\n\n- **What fails:** `sha256sum -c lib/SHA256SUMS` from the repository root reports 23 `FAILED`, although `lib/DEPENDENCIES.md` says \"Upstream files are unmodified\". The failures include the production `ERC20.sol`.\n- **Why it matters here:** the token adds no logic of its own, so every permission check lives in that vendored `ERC20.sol`. A reviewer following the README cannot tell a harmless reformat from a changed allowance check.\n- **What the edits are:** whitespace only. Running `forge fmt` at `line_length = 100` over pristine upstream copies reproduces all 23 vendored files exactly. Building the token against pristine OpenZeppelin v5.1.0 gives identical creation and runtime bytecode. Nothing changes on chain.\n- **Fix:** restore the 23 files byte-for-byte from the pinned commits. The recorded hashes are already the upstream ones, so the manifest then passes unchanged.\n\nThis sits at the edge of the permissions area (trust in the code the guards live in) and is not a permission bypass.\n\n## Coverage\n\n| Target | Verdict | Reason |\n| --- | --- | --- |\n| `approve(address,uint256)` | holds | Writes only the caller's own allowance; a zero spender reverts. |\n| `transfer(address,uint256)` | holds | Debits only the caller; a zero recipient reverts, so nothing can be burned. |\n| `transferFrom(address,address,uint256)` | holds | Allowance is spent before the move; finite and unlimited allowances hit the same balance check; a zero `from` reverts, so nothing can be minted. |\n| No role, owner or initializer | holds | Ten selectors, three state-changing; no `receive`, `fallback` or payable function; no reachable call, delegatecall, create or selfdestruct in the runtime. |\n| Supply fixed at 10^27, minted once | holds | `_mint` is called only in the constructor and `_burn` is not exposed. |\n| Deployer keeps no power | holds | After handing out the whole supply, the deployer cannot move a holder's balance. |\n| Vendored dependencies match upstream | finding 1 | See above. |\n\n## How I checked\n\n- **Access Control, Asymmetry and Trust Gap passes:** I made all three myself against the token and the vendored ERC-20, with no helpers.\n- **Existing suite:** `forge build` and `forge test` pass (33 tests), and `forge fmt --check` passes.\n- **Scratch tests:** seven edge-case tests under `test/scratch/` all passed and were then deleted. They covered zero-address `transferFrom`, how allowances are keyed, the unlimited-allowance branch, deployer residual power, storage slots and unknown selectors.\n- **Upstream comparison:** I diffed the vendored files against the pinned OpenZeppelin and forge-std commits fetched from GitHub.\n\n## Not done\n\n- **Protected launch tests:** not run. They need the external factory and Uniswap v4 harness, which is not in this tree.\n- **`launch.json`:** not present yet, so not reviewed.\n- **Math, economics and control-flow guides:** left to the other specialists.\n- **Not reported:** the approve race and tokens sent to the token's own address. Both are standard ERC-20 behaviour and documented in the README.","treeHash":null,"usage":{"cachedInputTokens":656954,"cost":{"source":"runtime","usdMicros":2201594},"inputTokens":21,"model":"claude-fable-5-2","outputTokens":18546,"runtime":"claude","turns":13,"wallClockMs":209998}}],"verification":[{"checks":[{"durationMs":1753,"exitCode":0,"name":"build","output":"Compiling 31 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.67s\nCompiler run successful!\n","passed":true},{"durationMs":7336,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 12 tests for test/TheImdDaily.walletgas.t.sol:TheImdDailyWalletGasTest\n[PASS] test_ApproveAtWalletGas() (gas: 1048295)\n[PASS] test_ApproveInfiniteAtWalletGas() (gas: 1050994)\n[PASS] test_CheckLeavesStateUnchanged() (gas: 1187799)\n[PASS] test_RevokeApprovalAtWalletGas() (gas: 518084)\n[PASS] test_TransferEntireSupplyFromDeployerAtWalletGas() (gas: 1080600)\n[PASS] test_TransferFromExhaustingAllowanceAtWalletGas() (gas: 1241380)\n[PASS] test_TransferFromFiniteAllowanceAtWalletGas() (gas: 1332668)\n[PASS] test_TransferFromInfiniteAllowanceAtWalletGas() (gas: 1116522)\n[PASS] test_TransferToExistingHolderAtWalletGas() (gas: 746138)\n[PASS] test_TransferToFreshRecipientAtWalletGas() (gas: 1156328)\n[PASS] test_TransferWholeBalanceAtWalletGas() (gas: 1074836)\n[PASS] test_ZeroTransferAtWalletGas() (gas: 616817)\nSuite result: ok. 12 passed; 0 failed; 0 skipped; finished in 67.26ms (49.85ms CPU time)\n\nRan 32 tests for test/TheImdDaily.t.sol:TheImdDailyTest\n[PASS] testFuzz_AllowanceOverspendRevertsAtomically(uint256,uint256) (runs: 1024, μ: 133682, ~: 134055)\nLogs:\n  Bound result 19814\n  Bound result 999999999999999999999980196\n\n[PASS] testFuzz_DelegatedTransferAccounting(uint256,uint256) (runs: 1024, μ: 163338, ~: 165269)\nLogs:\n  Bound result 999999999999999999999999998\n  Bound result 927699983171041152994991808\n\n[PASS] testFuzz_OverdraftRevertsAtomically(uint256,uint256) (runs: 1024, μ: 138042, ~: 138729)\nLogs:\n  Bound result 567\n  Bound result 6476327166076451314170\n\n[PASS] testFuzz_TransferConservesSupply(uint256,address) (runs: 1024, μ: 92835, ~: 93242)\nLogs:\n  Bound result 147345739847722132288929641\n\n[PASS] test_AllowanceCannotBeUsedByAnotherSpender() (gas: 116179)\n[PASS] test_AllowanceCannotBeUsedForAnotherOwner() (gas: 160441)\n[PASS] test_ApproveEmitsEventAndCanReplaceAndRevoke() (gas: 157777)\n[PASS] test_ApproveFromEmptyAccountIsAllowed() (gas: 78594)\n[PASS] test_ApproveZeroSpenderReverts() (gas: 37573)\n[PASS] test_ConstructorEmitsExactlyOneMint() (gas: 579039)\n[PASS] test_Create2MintsToFactoryInsteadOfCallerOrOrigin() (gas: 712152)\n[PASS] test_DeployerCannotSpendHolderBalanceWithoutApproval() (gas: 158265)\n[PASS] test_LaunchDistributionAndCustodyTransfersArriveWhole() (gas: 1041243)\n[PASS] test_MaximumTransferRevertsWithoutOverflow() (gas: 55065)\n[PASS] test_MetadataAndInitialSupply() (gas: 107649)\n[PASS] test_NoMintBurnOrAdministrativeEntryPoints() (gas: 3480902)\n[PASS] test_OwnerUsingTransferFromAlsoNeedsAllowance() (gas: 144140)\n[PASS] test_RejectsNativeCurrency() (gas: 45300)\n[PASS] test_RevokedAllowanceCannotBeSpent() (gas: 130716)\n[PASS] test_SelfTransferPreservesBalance() (gas: 51507)\n[PASS] test_TransferDoesNotCallRecipient() (gas: 171704)\n[PASS] test_TransferEmitsEventAndMovesExactAmount() (gas: 93539)\n[PASS] test_TransferEntireSupply() (gas: 86086)\n[PASS] test_TransferFromBalanceFailureRollsBackAllowance() (gas: 126595)\n[PASS] test_TransferFromConsumesAllowanceAndEmitsTransfer() (gas: 231983)\n[PASS] test_TransferFromInfiniteAllowanceIsNotReduced() (gas: 139807)\n[PASS] test_TransferFromToSelfConsumesAllowanceWithoutChangingBalance() (gas: 107908)\n[PASS] test_TransferFromZeroReceiverRollsBackAllowance() (gas: 114486)\n[PASS] test_TransferToZeroRevertsEvenForZeroAmount() (gas: 71904)\n[PASS] test_TransferWithInsufficientBalanceReverts() (gas: 57449)\n[PASS] test_ZeroTransferFromEmptyAccountEmitsEvent() (gas: 63079)\n[PASS] test_ZeroTransferFromRequiresNoAllowance() (gas: 80738)\nSuite result: ok. 32 passed; 0 failed; 0 skipped; finished in 70.72ms (261.92ms CPU time)\n\nRan 17 tests for test/TheImdDaily.edges.t.sol:TheImdDailyEdgesTest\n[PASS] testFuzz_ApproveReplacesNotAccumulates(uint256,uint256) (runs: 1024, μ: 93538, ~: 93663)\n[PASS] testFuzz_InfiniteAllowanceSurvivesRepeatedSpends(uint8,uint256) (runs: 1024, μ: 415162, ~: 376105)\nLogs:\n  Bound result 2\n  Bound result 16116202901727573390107706\n\n[PASS] testFuzz_TransferBetweenArbitraryParties(address,address,uint256,uint256) (runs: 1024, μ: 176201, ~: 182080)\nLogs:\n  Bound result 1\n  Bound result 6390\n  Bound result 950351249761644656794114039\n  Bound result 500\n\n[PASS] testFuzz_TransferFromArbitraryParties(address,address,address,uint256,uint256,uint256) (runs: 1024, μ: 243329, ~: 250188)\nLogs:\n  Bound result 339954703516663635169740707183561444769382360208\n  Bound result 440082260175214085127051971422700020652990327859\n  Bound result 144763574614207039029173768044338162527591069298\n  Bound result 7849751688904284680777\n  Bound result 40087\n  Bound result 3738\n\n[PASS] testFuzz_TransferFromOverLimitIsAtomic(uint256,uint256,uint256) (runs: 1024, μ: 208161, ~: 208249)\nLogs:\n  Bound result 415695802518808354059514\n  Bound result 99145041047415\n  Bound result 4111343788320522542928391568782128010010632655144\n\n[PASS] test_AllowanceCheckedBeforeBalance() (gas: 88389)\n[PASS] test_AllowanceJustBelowMaxIsDecremented() (gas: 124807)\n[PASS] test_ApproveEmitsExactlyOneApprovalAndIsIdempotent() (gas: 156583)\n[PASS] test_EachDeploymentMintsOnlyToItsOwnDeployer() (gas: 1205822)\n[PASS] test_RejectsUnknownCalldataAndEther() (gas: 64800)\n[PASS] test_SpenderCannotUseApprovalToApproveOthers() (gas: 159525)\n[PASS] test_SupplyConstantIsExactlyOneBillionWholeTokens() (gas: 40446)\n[PASS] test_TransferExactBalanceSucceedsAndOneMoreFails() (gas: 180943)\n[PASS] test_TransferFromEmitsOnlyTransfer() (gas: 123269)\n[PASS] test_TransferFromExactAllowanceThenOneWeiMoreFails() (gas: 162013)\n[PASS] test_TransferFromZeroOwnerRevertsAsInsufficientAllowance() (gas: 38128)\n[PASS] test_TransferToTokenContractIsAcceptedAndSupplyUnchanged() (gas: 111396)\nSuite result: ok. 17 passed; 0 failed; 0 skipped; finished in 75.54ms (344.90ms CPU time)\n\nRan 1 test for test/TheImdDaily.invariant.t.sol:TheImdDailyInvariantTest\n[PASS]\nTheImdDailyInvariantTest invariants:\n[PASS] invariant_AllowancesMatchModel\n[PASS] invariant_BalancesMatchModelAndSupplyIsConserved\n TheImdDailyInvariantTest invariants (runs: 128, calls: 8192, reverts: 0)\n\n╭--------------+----------------------+-------+---------+----------╮\n| Contract     | Selector             | Calls | Reverts | Discards |\n+==================================================================+\n| TokenHandler | approve              | 2074  | 0       | 0        |\n|--------------+----------------------+-------+---------+----------|\n| TokenHandler | rejectedTransferFrom | 1992  | 0       | 0        |\n|--------------+----------------------+-------+---------+----------|\n| TokenHandler | transfer             | 2124  | 0       | 0        |\n|--------------+----------------------+-------+---------+----------|\n| TokenHandler | transferFrom         | 2002  | 0       | 0        |\n╰--------------+----------------------+-------+---------+----------╯\n\nLogs:\n  Bound result 15\n  Bound result 77\n  Bound result 0\n  Bound result 7\n  Bound result 0\n  Bound result 4907\n  Bound result 0\n  Bound result 500\n  Bound result 5772\n  Bound result 42\n  Bound result 17000000000000000000\n  Bound result 218067482410354008644639446\n  Bound result 2349\n  Bound result 6337\n  Bound result 25\n  Bound result 5468\n  Bound result 10269563\n  Bound result 1000000000000000000000000000\n  Bound result 5987\n  Bound result 17\n  Bound result 0\n  Bound result 501\n  Bound result 1\n  Bound result 2740463\n  Bound result 763600052\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 85\n  Bound result 4\n  Bound result 521067514809958595075388660\n  Bound result 0\n  Bound result 0\n  Bound result 5447\n  Bound result 0\n  Bound result 1812\n  Bound result 5832\n  Bound result 7003\n  Bound result 2952781\n  Bound result 454012415604383\n  Bound result 501\n  Bound result 40\n  Bound result 3093743779\n  Bound result 1412853\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 3.42s (3.42s CPU time)\n\nRan 1 test for test/TheImdDaily.openHolders.invariant.t.sol:TheImdDailyOpenHolderInvariantTest\n[PASS]\nTheImdDailyOpenHolderInvariantTest invariants:\n[PASS] invariant_AllowancesMatchModel\n[PASS] invariant_EveryHolderMatchesModelAndHoldingsSumToSupply\n[PASS] invariant_SupplyIsFixed\n[PASS] invariant_TokenHoldsNoEtherAndMetadataIsStable\n TheImdDailyOpenHolderInvariantTest invariants (runs: 256, calls: 16384, reverts: 0)\n\n╭-------------------+--------------------+-------+---------+----------╮\n| Contract          | Selector           | Calls | Reverts | Discards |\n+=====================================================================+\n| OpenHolderHandler | approve            | 2009  | 0       | 0        |\n|-------------------+--------------------+-------+---------+----------|\n| OpenHolderHandler | approveZero        | 2088  | 0       | 0        |\n|-------------------+--------------------+-------+---------+----------|\n| OpenHolderHandler | overdraft          | 2132  | 0       | 0        |\n|-------------------+--------------------+-------+---------+----------|\n| OpenHolderHandler | overspendAllowance | 2075  | 0       | 0        |\n|-------------------+--------------------+-------+---------+----------|\n| OpenHolderHandler | privilegedAttempt  | 2033  | 0       | 0        |\n|-------------------+--------------------+-------+---------+----------|\n| OpenHolderHandler | sendToZero         | 2035  | 0       | 0        |\n|-------------------+--------------------+-------+---------+----------|\n| OpenHolderHandler | transfer           | 2007  | 0       | 0        |\n|-------------------+--------------------+-------+---------+----------|\n| OpenHolderHandler | transferFrom       | 2005  | 0       | 0        |\n╰-------------------+--------------------+-------+---------+----------╯\n\nLogs:\n  Bound result 0\n  Bound result 1000000000000000000\n  Bound result 891410798\n  Bound result 8011\n  Bound result 0\n  Bound result 0\n  Bound result 16777216\n  Bound result 0\n  Bound result 7\n  Bound result 0\n  Bound result 0\n  Bound result 2863\n  Bound result 1708\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 11\n  Bound result 17\n  Bound result 16777216\n  Bound result 0\n  Bound result 361764947177186856478122841\n  Bound result 0\n  Bound result 85\n  Bound result 0\n  Bound result 11932080645945905030\n  Bound result 1763962018339735638976635377\n  Bound result 0\n  Bound result 1000000000\n  Bound result 0\n  Bound result 6928\n  Bound result 0\n  Bound result 6927\n  Bound result 0\n  Bound result 115792089237316195423570985008687907853269984665640564039457584007913129639934\n  Bound result 6\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 7.24s (7.23s CPU time)\n\nRan 5 test suites in 7.24s (10.88s CPU time): 63 tests passed, 0 failed, 0 skipped (63 total tests)\n","passed":true},{"durationMs":42,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"TheImdDaily.approve(address,uint256)\",\"TheImdDaily.transfer(address,uint256)\",\"TheImdDaily.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"LICENSE\":21,\"README.md\":140,\"foundry.toml\":23,\"remappings.txt\":2,\"src/TheImdDaily.sol\":17,\"test/TheImdDaily.edges.t.sol\":276,\"test/TheImdDaily.invariant.t.sol\":130,\"test/TheImdDaily.openHolders.invariant.t.sol\":229,\"test/TheImdDaily.t.sol\":443,\"test/TheImdDaily.walletgas.t.sol\":101,\"test/properties/WalletGas.sol\":83},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"236c122fa8c47fdff28f05dda06c1668f73715c8295b9e4f391761a8e63bd992","verifiedTreeHash":"aa1ca9386d9a55010e9dad8d01b36d123eddc4e4","verifierVersion":"0.1.0+a490e3c0"},{"checks":[{"durationMs":1114,"exitCode":0,"name":"build","output":"Compiling 27 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.03s\nCompiler run successful!\n","passed":true},{"durationMs":3411,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 32 tests for test/TheImdDaily.t.sol:TheImdDailyTest\n[PASS] testFuzz_AllowanceOverspendRevertsAtomically(uint256,uint256) (runs: 1024, μ: 133641, ~: 134049)\nLogs:\n  Bound result 395628441041329441774250673\n  Bound result 902644331327093759491100315\n\n[PASS] testFuzz_DelegatedTransferAccounting(uint256,uint256) (runs: 1024, μ: 162986, ~: 165269)\nLogs:\n  Bound result 999999999999999999999999998\n  Bound result 927699983171041152994991808\n\n[PASS] testFuzz_OverdraftRevertsAtomically(uint256,uint256) (runs: 1024, μ: 137993, ~: 138705)\nLogs:\n  Bound result 1736337\n  Bound result 3337540646\n\n[PASS] testFuzz_TransferConservesSupply(uint256,address) (runs: 1024, μ: 92849, ~: 93242)\nLogs:\n  Bound result 147345739847722132288929641\n\n[PASS] test_AllowanceCannotBeUsedByAnotherSpender() (gas: 116179)\n[PASS] test_AllowanceCannotBeUsedForAnotherOwner() (gas: 160441)\n[PASS] test_ApproveEmitsEventAndCanReplaceAndRevoke() (gas: 157777)\n[PASS] test_ApproveFromEmptyAccountIsAllowed() (gas: 78594)\n[PASS] test_ApproveZeroSpenderReverts() (gas: 37573)\n[PASS] test_ConstructorEmitsExactlyOneMint() (gas: 579039)\n[PASS] test_Create2MintsToFactoryInsteadOfCallerOrOrigin() (gas: 712152)\n[PASS] test_DeployerCannotSpendHolderBalanceWithoutApproval() (gas: 158265)\n[PASS] test_LaunchDistributionAndCustodyTransfersArriveWhole() (gas: 1041243)\n[PASS] test_MaximumTransferRevertsWithoutOverflow() (gas: 55065)\n[PASS] test_MetadataAndInitialSupply() (gas: 107649)\n[PASS] test_NoMintBurnOrAdministrativeEntryPoints() (gas: 3480902)\n[PASS] test_OwnerUsingTransferFromAlsoNeedsAllowance() (gas: 144140)\n[PASS] test_RejectsNativeCurrency() (gas: 45300)\n[PASS] test_RevokedAllowanceCannotBeSpent() (gas: 130716)\n[PASS] test_SelfTransferPreservesBalance() (gas: 51507)\n[PASS] test_TransferDoesNotCallRecipient() (gas: 171704)\n[PASS] test_TransferEmitsEventAndMovesExactAmount() (gas: 93539)\n[PASS] test_TransferEntireSupply() (gas: 86086)\n[PASS] test_TransferFromBalanceFailureRollsBackAllowance() (gas: 126595)\n[PASS] test_TransferFromConsumesAllowanceAndEmitsTransfer() (gas: 231983)\n[PASS] test_TransferFromInfiniteAllowanceIsNotReduced() (gas: 139807)\n[PASS] test_TransferFromToSelfConsumesAllowanceWithoutChangingBalance() (gas: 107908)\n[PASS] test_TransferFromZeroReceiverRollsBackAllowance() (gas: 114486)\n[PASS] test_TransferToZeroRevertsEvenForZeroAmount() (gas: 71904)\n[PASS] test_TransferWithInsufficientBalanceReverts() (gas: 57449)\n[PASS] test_ZeroTransferFromEmptyAccountEmitsEvent() (gas: 63079)\n[PASS] test_ZeroTransferFromRequiresNoAllowance() (gas: 80738)\nSuite result: ok. 32 passed; 0 failed; 0 skipped; finished in 31.98ms (134.64ms CPU time)\n\nRan 1 test for test/TheImdDaily.invariant.t.sol:TheImdDailyInvariantTest\n[PASS]\nTheImdDailyInvariantTest invariants:\n[PASS] invariant_AllowancesMatchModel\n[PASS] invariant_BalancesMatchModelAndSupplyIsConserved\n TheImdDailyInvariantTest invariants (runs: 128, calls: 8192, reverts: 0)\n\n╭--------------+----------------------+-------+---------+----------╮\n| Contract     | Selector             | Calls | Reverts | Discards |\n+==================================================================+\n| TokenHandler | approve              | 2074  | 0       | 0        |\n|--------------+----------------------+-------+---------+----------|\n| TokenHandler | rejectedTransferFrom | 1992  | 0       | 0        |\n|--------------+----------------------+-------+---------+----------|\n| TokenHandler | transfer             | 2124  | 0       | 0        |\n|--------------+----------------------+-------+---------+----------|\n| TokenHandler | transferFrom         | 2002  | 0       | 0        |\n╰--------------+----------------------+-------+---------+----------╯\n\nLogs:\n  Bound result 14\n  Bound result 0\n  Bound result 5\n  Bound result 0\n  Bound result 4908\n  Bound result 0\n  Bound result 18\n  Bound result 5818\n  Bound result 0\n  Bound result 6\n  Bound result 498251146424328782691036114\n  Bound result 2390\n  Bound result 6400\n  Bound result 0\n  Bound result 115293163400432173399793\n  Bound result 20\n  Bound result 17\n  Bound result 100\n  Bound result 0\n  Bound result 0\n  Bound result 4\n  Bound result 0\n  Bound result 2740463\n  Bound result 5726\n  Bound result 826074470\n  Bound result 15\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 19\n  Bound result 521067514809958595075388660\n  Bound result 3\n  Bound result 0\n  Bound result 1\n  Bound result 844\n  Bound result 1691\n  Bound result 0\n  Bound result 3219\n  Bound result 5345\n  Bound result 454012415604383\n  Bound result 4\n  Bound result 7\n  Bound result 2334952\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 3.31s (3.31s CPU time)\n\nRan 2 test suites in 3.31s (3.34s CPU time): 33 tests passed, 0 failed, 0 skipped (33 total tests)\n","passed":true},{"durationMs":55,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"TheImdDaily.approve(address,uint256)\",\"TheImdDaily.transfer(address,uint256)\",\"TheImdDaily.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"LICENSE\":21,\"README.md\":140,\"foundry.toml\":23,\"remappings.txt\":2,\"src/TheImdDaily.sol\":17,\"test/TheImdDaily.invariant.t.sol\":130,\"test/TheImdDaily.t.sol\":443},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true},{"durationMs":540,"exitCode":0,"name":"slither","output":"slither: no results at low impact or above","passed":true},{"durationMs":259,"exitCode":0,"name":"aderyn","output":"[low] large-numeric-literal at src/TheImdDaily.sol:10: Large Numeric Literal","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"27e5abb7612a760deebe238a77ae0817e18c41e1a6f59f3241fdd1e4fb26cb63","verifiedTreeHash":"75d78c57f377cb5f587722905c330432a181f0aa","verifierVersion":"0.1.0+a490e3c0"},{"checks":[{"durationMs":1208,"exitCode":0,"name":"build","output":"Compiling 27 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.13s\nCompiler run successful!\n","passed":true},{"durationMs":3368,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 32 tests for test/TheImdDaily.t.sol:TheImdDailyTest\n[PASS] testFuzz_AllowanceOverspendRevertsAtomically(uint256,uint256) (runs: 1024, μ: 133641, ~: 134049)\nLogs:\n  Bound result 567\n  Bound result 6476327166076451314170\n\n[PASS] testFuzz_DelegatedTransferAccounting(uint256,uint256) (runs: 1024, μ: 162986, ~: 165269)\nLogs:\n  Bound result 314787219751585684495751552\n  Bound result 8311537931320949626\n\n[PASS] testFuzz_OverdraftRevertsAtomically(uint256,uint256) (runs: 1024, μ: 137993, ~: 138705)\nLogs:\n  Bound result 19814\n  Bound result 1000000000000000000\n\n[PASS] testFuzz_TransferConservesSupply(uint256,address) (runs: 1024, μ: 92849, ~: 93242)\nLogs:\n  Bound result 1\n\n[PASS] test_AllowanceCannotBeUsedByAnotherSpender() (gas: 116179)\n[PASS] test_AllowanceCannotBeUsedForAnotherOwner() (gas: 160441)\n[PASS] test_ApproveEmitsEventAndCanReplaceAndRevoke() (gas: 157777)\n[PASS] test_ApproveFromEmptyAccountIsAllowed() (gas: 78594)\n[PASS] test_ApproveZeroSpenderReverts() (gas: 37573)\n[PASS] test_ConstructorEmitsExactlyOneMint() (gas: 579039)\n[PASS] test_Create2MintsToFactoryInsteadOfCallerOrOrigin() (gas: 712152)\n[PASS] test_DeployerCannotSpendHolderBalanceWithoutApproval() (gas: 158265)\n[PASS] test_LaunchDistributionAndCustodyTransfersArriveWhole() (gas: 1041243)\n[PASS] test_MaximumTransferRevertsWithoutOverflow() (gas: 55065)\n[PASS] test_MetadataAndInitialSupply() (gas: 107649)\n[PASS] test_NoMintBurnOrAdministrativeEntryPoints() (gas: 3480902)\n[PASS] test_OwnerUsingTransferFromAlsoNeedsAllowance() (gas: 144140)\n[PASS] test_RejectsNativeCurrency() (gas: 45300)\n[PASS] test_RevokedAllowanceCannotBeSpent() (gas: 130716)\n[PASS] test_SelfTransferPreservesBalance() (gas: 51507)\n[PASS] test_TransferDoesNotCallRecipient() (gas: 171704)\n[PASS] test_TransferEmitsEventAndMovesExactAmount() (gas: 93539)\n[PASS] test_TransferEntireSupply() (gas: 86086)\n[PASS] test_TransferFromBalanceFailureRollsBackAllowance() (gas: 126595)\n[PASS] test_TransferFromConsumesAllowanceAndEmitsTransfer() (gas: 231983)\n[PASS] test_TransferFromInfiniteAllowanceIsNotReduced() (gas: 139807)\n[PASS] test_TransferFromToSelfConsumesAllowanceWithoutChangingBalance() (gas: 107908)\n[PASS] test_TransferFromZeroReceiverRollsBackAllowance() (gas: 114486)\n[PASS] test_TransferToZeroRevertsEvenForZeroAmount() (gas: 71904)\n[PASS] test_TransferWithInsufficientBalanceReverts() (gas: 57449)\n[PASS] test_ZeroTransferFromEmptyAccountEmitsEvent() (gas: 63079)\n[PASS] test_ZeroTransferFromRequiresNoAllowance() (gas: 80738)\nSuite result: ok. 32 passed; 0 failed; 0 skipped; finished in 32.37ms (128.78ms CPU time)\n\nRan 1 test for test/TheImdDaily.invariant.t.sol:TheImdDailyInvariantTest\n[PASS]\nTheImdDailyInvariantTest invariants:\n[PASS] invariant_AllowancesMatchModel\n[PASS] invariant_BalancesMatchModelAndSupplyIsConserved\n TheImdDailyInvariantTest invariants (runs: 128, calls: 8192, reverts: 0)\n\n╭--------------+----------------------+-------+---------+----------╮\n| Contract     | Selector             | Calls | Reverts | Discards |\n+==================================================================+\n| TokenHandler | approve              | 2074  | 0       | 0        |\n|--------------+----------------------+-------+---------+----------|\n| TokenHandler | rejectedTransferFrom | 1992  | 0       | 0        |\n|--------------+----------------------+-------+---------+----------|\n| TokenHandler | transfer             | 2124  | 0       | 0        |\n|--------------+----------------------+-------+---------+----------|\n| TokenHandler | transferFrom         | 2002  | 0       | 0        |\n╰--------------+----------------------+-------+---------+----------╯\n\nLogs:\n  Bound result 14\n  Bound result 0\n  Bound result 5\n  Bound result 0\n  Bound result 4908\n  Bound result 0\n  Bound result 18\n  Bound result 5818\n  Bound result 0\n  Bound result 6\n  Bound result 498251146424328782691036114\n  Bound result 2390\n  Bound result 6400\n  Bound result 0\n  Bound result 115293163400432173399793\n  Bound result 20\n  Bound result 17\n  Bound result 100\n  Bound result 0\n  Bound result 0\n  Bound result 4\n  Bound result 0\n  Bound result 2740463\n  Bound result 5726\n  Bound result 826074470\n  Bound result 15\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 19\n  Bound result 521067514809958595075388660\n  Bound result 3\n  Bound result 0\n  Bound result 1\n  Bound result 844\n  Bound result 1691\n  Bound result 0\n  Bound result 3219\n  Bound result 5345\n  Bound result 454012415604383\n  Bound result 4\n  Bound result 7\n  Bound result 2334952\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 3.27s (3.26s CPU time)\n\nRan 2 test suites in 3.27s (3.30s CPU time): 33 tests passed, 0 failed, 0 skipped (33 total tests)\n","passed":true},{"durationMs":35,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"TheImdDaily.approve(address,uint256)\",\"TheImdDaily.transfer(address,uint256)\",\"TheImdDaily.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"LICENSE\":21,\"README.md\":140,\"foundry.toml\":23,\"launch.json\":24,\"remappings.txt\":2,\"src/TheImdDaily.sol\":17,\"test/TheImdDaily.invariant.t.sol\":130,\"test/TheImdDaily.t.sol\":443},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"8fe8ff9e85084fc55f425b60ce398b288e8105640e295853982a0ac24c8825e2","verifiedTreeHash":"d840915b07790d45d4c7fcc90b9d2da71ed095c1","verifierVersion":"0.1.0+a490e3c0"}]}