{"assessments":[],"deployments":[],"fuzz":[],"identity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"interpretation":"Records acceptance and evidence. Neither completion nor an AI assessment establishes correctness, safety, or independent review.","jobId":"76711b80-9c09-45f0-9bf5-de7154ecfc61","kind":"shape:chain","nodes":[{"acceptedSubmissionHash":"5336e2e3f953f01d4324e4e0602a101d038ec13cd1cc7158a224314c0fd50e64","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_economics","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"17ede46d09515cfd5ddf776563cbd0f17c58f1e81621f8c86edeb2b843fcc05d","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_flow","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"98f2fad90efd7cf27079fc94d35299b63d8347e877292a4202c0b008412634c3","dependsOn":["build_contract_project","write_foundry_tests","manifest","audit_math","audit_permissions","audit_economics","audit_flow"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"af3aa01159bbf354f621cafa5c0006f6169e0938a8b015be508b7377dbf165bc","skillId":"audit-judge","tools":[]},"key":"audit_judge","kind":"code","role":"review","skillHash":"af3aa01159bbf354f621cafa5c0006f6169e0938a8b015be508b7377dbf165bc","skillId":"audit-judge","state":"accepted"},{"acceptedSubmissionHash":"4a485b062941be91e5fb6c206906c5961270c1f2193fcbd312289fedbeade5b3","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_math","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"cefca601d67c4705977cd982edb76b93256a06901d8aa50b5a27d6853facbb08","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_permissions","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"765ea6b47ae44f627d202bc9d28e10ce2af31a61c8b95a6bac61556659ec9511","dependsOn":[],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"d59561da3b378461b7c749f6bd5084477d44993aa94972ddea90f542535751df","skillId":"build-contract-project","tools":[]},"key":"build_contract_project","kind":"code","role":"implement","skillHash":"d59561da3b378461b7c749f6bd5084477d44993aa94972ddea90f542535751df","skillId":"build-contract-project","state":"accepted"},{"acceptedSubmissionHash":"449547991550b274d8152a38e319e0baf585ec462afe7bd7a2ade9682ccf602c","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"tools":[]},"key":"manifest","kind":"code","role":"integrate","skillHash":null,"skillId":null,"state":"accepted"},{"acceptedSubmissionHash":"ed26197fd1742e04a904dd466c349ea129f1ef60fa35f5186f919a526f914c53","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"4c76766b00591dfe982fe85d3de589fdb2f810e5137c301155d1c5e36a1d3b23","skillId":"write-foundry-tests","tools":[]},"key":"write_foundry_tests","kind":"code","role":"tests","skillHash":"4c76766b00591dfe982fe85d3de589fdb2f810e5137c301155d1c5e36a1d3b23","skillId":"write-foundry-tests","state":"accepted"}],"objective":"A custom token: UNLOCK (UNLK).\nToken name: UNLOCK\nToken symbol: UNLK\nToken supply: 1,000,000,000 with 18 decimals, all minted once to the deployer in the constructor.","parentJobId":null,"planHash":"b6e3a21f3be630dc3b85765e69db170062bea34e7c78cefe33ea5bb5d115d743","previousHash":"0000000000000000000000000000000000000000000000000000000000000000","projectId":"76711b80-9c09-45f0-9bf5-de7154ecfc61","publication":{"commit":null,"deliveredAt":null,"repoUrl":"https://github.com/identity-md-launches/launch-2108-unlock"},"receiptIdentity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"registry":"0xb6d0a187b050fa5bb0b87033a203f37becf4a775","research":[],"schema":"identitymd-work-v1","signals":[{"agentId":"52337","feedbackHash":"4584de4486844ed84c43ba6de814270405f79267e52041db1fa234097a905446","nodeKey":"audit_economics","submissionHash":"5336e2e3f953f01d4324e4e0602a101d038ec13cd1cc7158a224314c0fd50e64","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"54154","feedbackHash":"fb0d0b68294d0753a6cdfef0f77603f3fe069f36562fe19e67d26e4ba5832eb8","nodeKey":"audit_flow","submissionHash":"17ede46d09515cfd5ddf776563cbd0f17c58f1e81621f8c86edeb2b843fcc05d","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51043","feedbackHash":"ddcceb1297294340c0c508551677e2f532382d2d1580924d49dedeb8c74a2a1a","nodeKey":"audit_judge","submissionHash":"98f2fad90efd7cf27079fc94d35299b63d8347e877292a4202c0b008412634c3","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52128","feedbackHash":"739f6be23aa6f838e870d261b015364278c686659879064af79f47077339b1c1","nodeKey":"audit_math","submissionHash":"4a485b062941be91e5fb6c206906c5961270c1f2193fcbd312289fedbeade5b3","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52189","feedbackHash":"01897a66a17925c940715573fce28338a65bc464242d78034aa8180225490f5a","nodeKey":"audit_permissions","submissionHash":"cefca601d67c4705977cd982edb76b93256a06901d8aa50b5a27d6853facbb08","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51037","feedbackHash":"587422c388a58a058bfa15e4e9381adce9945c631677be5da775ebd90e308ccd","nodeKey":"build_contract_project","submissionHash":"765ea6b47ae44f627d202bc9d28e10ce2af31a61c8b95a6bac61556659ec9511","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"52481","feedbackHash":"72aeaf3b34d27aa6be5a81f26949a5792e15e0d2df1c26ad32bf12742aab1d00","nodeKey":"manifest","submissionHash":"449547991550b274d8152a38e319e0baf585ec462afe7bd7a2ade9682ccf602c","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"50993","feedbackHash":"90401a9580b0d83bec1932af967b3fed84e6afebde2e379c65ee878c4e2ea52f","nodeKey":"write_foundry_tests","submissionHash":"ed26197fd1742e04a904dd466c349ea129f1ef60fa35f5186f919a526f914c53","tag1":"verification:checks","tag2":"acceptance-v2","value":1}],"site":null,"snapshotHash":"74962ff3f3c86967137b3632c1b1961a83197b2929a76dba546dddb7941cd988","state":"completed","submissions":[{"artifacts":[],"attempt":1,"bundleHash":null,"device":"f9a9196633a6ffa8","findings":[{"citation":"resolved","description":"DEPENDENCIES.md states that the 30 vendored forge-std files are unmodified and that `sha256sum -c lib/SHA256SUMS` verifies every vendored file (line 10). In the committed tree that check fails for 7 forge-std files: src/StdJson.sol, src/StdToml.sol, src/Vm.sol, src/console.sol, src/StdAssertions.sol, src/interfaces/IMulticall3.sol and src/interfaces/IERC7540.sol. The sums recorded in lib/SHA256SUMS equal the upstream v1.9.7 bytes (verified by fetching the tagged files), but the committed files do not: they were re-wrapped by `forge fmt` run from the repository root, which the README's `forge fmt --check` step prescribes and which, with no fmt exclusion for lib/ in foundry.toml, formats lib/ at the default 120-column width (confirmed: `forge fmt --check` on a pristine upstream StdJson.sol from inside this repo reports the same diff). The differences are whitespace-only (multi-line function signatures collapsed to one line), so test behaviour is unchanged and production code is unaffected; the six OpenZeppelin v5.0.2 files were verified byte-identical to upstream. The defect is that the project's own integrity claim and reproducible check are false for the committed tree, so a reviewer following DEPENDENCIES.md gets a failed verification and cannot distinguish this benign reformat from a tampered library without doing the upstream comparison themselves. Fix: either restore the 7 files to the upstream bytes (and add lib/ to fmt's ignore list in foundry.toml so the check keeps passing), or regenerate lib/SHA256SUMS from the committed files and change the wording from 'unmodified' to 'reformatted by forge fmt'.","line":6,"path":"DEPENDENCIES.md","reproduction":"From the repository root run `sha256sum -c lib/SHA256SUMS`. Expected per DEPENDENCIES.md: 36 lines ending in OK. Actual: 29 OK and 7 FAILED (lib/forge-std/src/StdJson.sol, lib/forge-std/src/interfaces/IMulticall3.sol, lib/forge-std/src/console.sol, lib/forge-std/src/Vm.sol, lib/forge-std/src/interfaces/IERC7540.sol, lib/forge-std/src/StdAssertions.sol, lib/forge-std/src/StdToml.sol), with the warning '7 computed checksums did NOT match'. Cross-check: `curl -sSL https://raw.githubusercontent.com/foundry-rs/forge-std/v1.9.7/src/StdJson.sol | sha256sum` prints 61bbf9b3219f3636d459e74799e642ee80a9e4d51ef66e793814a032ed97cb83, the value recorded in lib/SHA256SUMS, while `sha256sum lib/forge-std/src/StdJson.sol` prints 0211b47e93dbeb6a7de6112470a77137038ed73b79b015847f013e49fcd7511f. `diff` of the two shows only signature line-wrapping changes.","severity":"low","snippet":"- [foundry-rs/forge-std v1.9.7](https://github.com/foundry-rs/forge-std/tree/v1.9.7): 30 files, unmodified. Release archive SHA-256: `45157353ab49eab01d294565866731e599b32401757229689ee459aa26b7ee94`.","title":"Documented dependency integrity check fails: 7 vendored forge-std files differ from the recorded SHA-256 sums and from upstream v1.9.7"}],"hash":"17ede46d09515cfd5ddf776563cbd0f17c58f1e81621f8c86edeb2b843fcc05d","nodeId":"f667e6d8-5364-44e8-be20-41edb75bfae4","outcome":"completed","summary":"The review is complete and `.imd-findings.json` is written. No tracked files were changed.\n\n**Result: one low-severity finding, all three entry points hold.**\n\n`UnlockToken` is the unmodified OpenZeppelin v5.0.2 ERC-20 plus a supply constant and a constructor minting 10^27 units to the immediate creator. I traced `approve`, `transfer` and `transferFrom` through `_approve`, `_spendAllowance`, `_transfer` and `_update` against the Execution Trace, Periphery and First Principles checklists. Every revert path rolls back fully, the unchecked arithmetic is bounded by the supply invariant, infinite allowance is not decremented, and there is no callback, fallback, owner, mint, burn or upgrade surface. The launch flows (factory to distributor to claimant, and both pool-manager directions) move exact amounts. The aderyn literal lead is exactly 10^27 and matches the manifest supply.\n\n**Finding (low):** DEPENDENCIES.md says the 30 vendored forge-std files are unmodified and that the recorded checksums verify. In the committed tree the check fails:\n\n```\nsha256sum -c lib/SHA256SUMS   # 29 OK, 7 FAILED\n```\n\nThe recorded sums match upstream v1.9.7, but the committed files were re-wrapped by `forge fmt`, which the README's format check prescribes and which formats `lib/` because foundry.toml excludes nothing. The diff is whitespace only, so behaviour is unchanged. The six OpenZeppelin files are byte-identical to the v5.0.2 tag. Suggested fix: restore the 7 files and ignore `lib/` in fmt, or regenerate the sums and drop the word \"unmodified\".\n\n**Coverage record:** 9 rows. The three ABI entry points and the constructor hold, plus invariant rows for fixed supply, forbidden opcodes, OpenZeppelin integrity, and the static-analysis lead. The forge-std integrity row points to finding 1. Nothing was left unreached. The only item I could not check is the README's \"Ethereum, chain ID 1\" launch-chain claim, since no network.json or launch.json is in the tree.","treeHash":null,"usage":{"cachedInputTokens":609838,"inputTokens":258,"model":"claude-fable-5-1","outputTokens":15026,"runtime":"claude","turns":24,"wallClockMs":272321}},{"artifacts":[],"attempt":1,"bundleHash":"9114d475af9ff09c8bbb31ab8e3954e8a73fcbd6410725e65a00abdeeeba96aa","device":"a4e285247c6f8aed","findings":[],"hash":"449547991550b274d8152a38e319e0baf585ec462afe7bd7a2ade9682ccf602c","nodeId":"d4e3c519-22c6-4ed1-b8a6-976eb2221550","outcome":"completed","summary":"I wrote launch.json for the UNLOCK (UNLK) custom token launch, and it is the only file changed.\n\n**What the manifest says**\n\n- Token contract is UnlockToken, name UNLOCK, symbol UNLK, 18 decimals, with an empty constructorArgs list because the accepted constructor takes no parameters.\n- totalSupply is one billion tokens in minor units, matching the INITIAL_SUPPLY constant the constructor mints once to msg.sender.\n- contracts is empty since the accepted tree has no application contracts, only the token.\n- pool uses the IMD pair address, fee 12500, tick spacing 60 and the one-to-one initialPrice from the launch reference.\n- economics is copied verbatim from the job.\n- notes describe the token's behavior, the absence of admin powers or transfer fees, and the launch flows, at about 1,250 characters.\n\n**Checks I ran**\n\n- Parsed the JSON and confirmed only the schema's six top-level keys, the exact supply string, the verbatim economics object, and a contract name within 32 characters.\n- `forge build` compiled cleanly.\n- `forge test` with the verifier's fuzz seed passed all 30 tests across both suites.\n- `git status` shows launch.json as the only new file, with no other changes.","treeHash":"4dedc1dc29ee417c28249c1ae1c8badf453b94ed","usage":{"cachedInputTokens":186556,"inputTokens":130,"model":"claude-fable-5-1","outputTokens":2724,"runtime":"claude","turns":8,"wallClockMs":60435}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"9c6767b941fcfedc","findings":[{"citation":"resolved","description":"Outside the math area, reported because it is the only discrepancy found. DEPENDENCIES.md states forge-std v1.9.7 is vendored unmodified and that `sha256sum -c lib/SHA256SUMS` verifies every vendored file. In the committed tree (git status clean at 6d53416) that command reports 7 mismatches, all in lib/forge-std/src: StdJson.sol, interfaces/IMulticall3.sol, console.sol, Vm.sol, interfaces/IERC7540.sol, StdAssertions.sol, StdToml.sol. All OpenZeppelin files match, so production code is unaffected; forge-std is test-only. Either lib/SHA256SUMS or the forge-std files diverge from what the document claims, so the written integrity statement is not true of the tree. No token behaviour, supply, or arithmetic depends on this; it is a documentation/provenance accuracy note only. lib/ cannot be edited under the task rules, so the fix is to correct DEPENDENCIES.md (and README.md line 40, which repeats the claim) or have the owner of lib/ regenerate SHA256SUMS.","line":10,"path":"DEPENDENCIES.md","reproduction":"From the repository root run `sha256sum -c lib/SHA256SUMS 2>&1 | grep -v ': OK$'`. Expected: no output except a summary with zero failures. Actual: 7 lines ending in FAILED and 'WARNING: 7 computed checksums did NOT match'.","severity":"info","snippet":"`lib/SHA256SUMS` records each vendored file. Check with `sha256sum -c lib/SHA256SUMS` from the repository root.","title":"Documented vendored-dependency integrity check fails for seven forge-std files"}],"hash":"4a485b062941be91e5fb6c206906c5961270c1f2193fcbd312289fedbeade5b3","nodeId":"1b46a87c-b7e9-419d-a136-92d94e41cbd8","outcome":"completed","summary":"The review is complete and the findings file is written. The tree is otherwise unchanged (the findings file is gitignored or untracked, and the scratch test was removed).\n\n**Outcome: no math, boundary, or numerical-gap defects in the token.** `src/UnlockToken.sol` is the unmodified OpenZeppelin ERC20 v5.0.2 plus one constant and a constructor. There is no division, scaling, fee, external call, payable path, sentinel branch, or byte decoding, so most items in the three guides have nothing to attach to. The remaining arithmetic was checked directly:\n\n- **Supply constant** evaluates to exactly 10^27, which matches the manifest value and 18 decimals, and is minted once to the factory through checked addition.\n- **Transfer and transferFrom** guard every unchecked subtraction with an explicit comparison. I exercised 1 wei, full balance, balance plus one, zero, self-transfer, full-supply moves, allowance equal to value, zero allowance, max and max-minus-one allowances, and self-transferFrom. All behaved exactly and supply was conserved.\n- **No receive or fallback**: ETH sends and unknown selectors such as mint, burn, and admin calls revert.\n- **Existing suite** of 30 tests, including 1,000-run fuzzes and the 128-by-64 invariant run, passes with the documented seed. Both static tools reported nothing above the \"large numeric literal\" style note, which is not a defect.\n\n**One info-level note outside my area.** DEPENDENCIES.md and the README say every vendored file is verified by the checksum list, but running that check on the committed tree reports seven forge-std files as mismatched. All OpenZeppelin files match, so production code is unaffected. The reproduction is the single documented command and its FAILED output.\n\n**Coverage record**: all three listed entry points marked `holds`, plus rows for the constructor and supply constant, the no-fallback boundary, and the supply-conservation invariant, each with a one-line reason.","treeHash":null,"usage":{"cachedInputTokens":717398,"inputTokens":354,"model":"claude-fable-5-1","outputTokens":12666,"runtime":"claude","turns":24,"wallClockMs":188325}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"da7ed792c3bf5b80","findings":[{"citation":"resolved","description":"DEPENDENCIES.md says every vendored file is unmodified and tells readers to check this with `sha256sum -c lib/SHA256SUMS`. That check fails for 7 forge-std files (Vm.sol, StdJson.sol, StdToml.sol, StdAssertions.sol, console.sol, interfaces/IMulticall3.sol, interfaces/IERC7540.sol). The 6 OpenZeppelin files that go into the deployed token all pass, so the token's bytecode and economics are not affected. Only the documented provenance check for test-only code is broken. This is outside the economics area and is reported only as a note.","line":23,"path":"lib/SHA256SUMS","reproduction":"From the repo root, run `sha256sum -c lib/SHA256SUMS`. Expected: every line OK, as DEPENDENCIES.md claims. Actual: 'sha256sum: WARNING: 7 computed checksums did NOT match'. For example, lib/forge-std/src/Vm.sol hashes to a1b1c82924aecf0f38b53192fd1e801cccc1e1fd2ecd6b2301e4f4c4ab102a15 against the recorded 9068805b...2cb1. Fix: regenerate SHA256SUMS from the real v1.9.7 files, or restore the files that match it.","severity":"info","snippet":"9068805b59ac1d0ea03a8fa1f15ae49c094e0c6c852a2500e0dd112f264b2cb1  lib/forge-std/src/Vm.sol","title":"lib/SHA256SUMS integrity check fails for 7 vendored forge-std files, contradicting DEPENDENCIES.md"}],"hash":"5336e2e3f953f01d4324e4e0602a101d038ec13cd1cc7158a224314c0fd50e64","nodeId":"9620c97a-bbb1-4760-a390-bd0610da65be","outcome":"completed","summary":"I found no economic defects in UNLOCK (UNLK). The findings file `.imd-findings.json` holds one info-level note, which is outside the economics area, and a full coverage record. I changed no files in the repository: the build passes and all 30 local tests pass.\n\n**Economic Security**\n- The token is `src/UnlockToken.sol`, unmodified OpenZeppelin v5.0.2 ERC-20 code. Its six OpenZeppelin files match their recorded checksums, so the deployed logic is what it claims to be.\n- Transfers have no fee, burn, rebase, blacklist, pause or callback. Every launch transfer arrives whole: factory to distributor, distributor to claimant, the pool seed, and trades in and out of the pool.\n- It takes no constructor arguments, so there are no exemptions to get wrong. There are no ERC-2612 or ERC-4626 surfaces.\n\n**Invariants**\n- **Supply:** `INITIAL_SUPPLY = 1_000_000_000 * 10 ** 18` is exactly 10^27 base units (1 billion tokens with 18 decimals). It is minted once, to whoever deploys the contract, which is the factory in a launch.\n- **No supply change:** `_mint` is only reachable from the constructor. There is no mint, burn, owner or upgrade function anyone can call later.\n- **Balances add up:** the sum of balances always equals total supply. The unchecked arithmetic is safe because a sender's balance can never exceed total supply.\n- **Allowances:** an unlimited allowance is not decreased when spent, and a reverted `transferFrom` restores the allowance.\n\n**Flow Gap**\n- Since transfers carry no logic at all, no sequence of calls can short the swarm share, the pool seed or a trade, or freeze a holder's balance.\n\n**Note (info, outside economics):** running `sha256sum -c lib/SHA256SUMS` reports 7 mismatches, all in test-only forge-std files (for example `lib/forge-std/src/Vm.sol`, line 23 of the checksum file). `DEPENDENCIES.md` says every vendored file is unmodified, so its own integrity check contradicts it. This does not affect the deployed token.\n\n**Coverage:** `approve`, `transfer` and `transferFrom` all hold. I also added rows for the supply, balance-sum and launch-flow invariants. The aderyn \"large numeric literal\" lead at line 10 is a false positive: the value is correct.\n\n**Limits:** I did not run the protected launch tests. They need the network's factory and pool contracts, which this repository doesn't include.","treeHash":null,"usage":{"cachedInputTokens":246596,"inputTokens":16,"model":"claude-opus-5-5","outputTokens":2490,"runtime":"claude","turns":9,"wallClockMs":327018}},{"artifacts":[],"attempt":1,"bundleHash":"16a9c187c7f7a595c33c48209acdca6d9073a33aef7c3cf57833939536adabe9","device":"a8f78934be011e4c","findings":[],"hash":"765ea6b47ae44f627d202bc9d28e10ce2af31a61c8b95a6bac61556659ec9511","nodeId":"fe538f31-7be1-4cb1-bc9b-05da0de3a3b7","outcome":"completed","summary":"Implemented UNLOCK (UNLK): 1,000,000,000 tokens with 18 decimals, minted once to the deployer. No later minting or administrative powers.\n\nDependencies are vendored for offline builds. Deployment parameters, assumptions, and operational responsibilities are documented in README.md.\n\nVerified with Solidity 0.8.26:\n\n- `forge build` passed.\n- `forge test` passed all 30 tests using the supplied fuzz seed.\n- `forge fmt --check` passed.","treeHash":"592964caa989cb94c83790cd607a4b7eeecfc6e3","usage":{"cachedInputTokens":360320,"inputTokens":51491,"model":"gpt-6-astra","outputTokens":11997,"runtime":"codex","turns":4,"wallClockMs":269147}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"2565f234b0a569e9","findings":[{"citation":"resolved","description":"All four specialists (audit_permissions, audit_economics, audit_math, audit_flow) reported the same root cause; merged here as one finding. DEPENDENCIES.md line 6 states forge-std v1.9.7 is vendored 'unmodified' and line 10 tells readers to verify every vendored file with `sha256sum -c lib/SHA256SUMS`. Reproduced: in the committed tree (git status clean at 390ba63) that check fails for seven forge-std files: lib/forge-std/src/StdJson.sol, StdToml.sol, Vm.sol, console.sol, StdAssertions.sol, interfaces/IMulticall3.sol and interfaces/IERC7540.sol. I fetched each of the seven from the upstream v1.9.7 tag: the upstream bytes hash to exactly the values recorded in lib/SHA256SUMS, and after stripping all whitespace the upstream and committed files hash identically, so the drift is formatting only (forge fmt re-wrapping signatures; foundry.toml has no fmt ignore for lib/, so the README's `forge fmt --check` step formats lib/). All six OpenZeppelin v5.0.2 files (ERC20, IERC20, IERC20Metadata, Context, draft-IERC6093, LICENSE) are byte-identical to upstream and pass the check, so the production token bytecode is unaffected; forge-std is test-only. Impact: the delivered provenance statement is untrue and the documented reproducible integrity check fails, so a reviewer following it cannot tell a benign reformat from tampering without redoing the upstream comparison. No security or economic impact. Severity calibrated to low: a broken written guarantee about test tooling, not a code defect. Fix (lib/ is not editable under task rules, so the documentation side): change DEPENDENCIES.md (and README.md line 40 which points to it) to say the seven files were reformatted by forge fmt, or have the owner of lib/ either restore the upstream bytes and exclude lib/ from fmt, or regenerate lib/SHA256SUMS from the committed files.","line":6,"path":"DEPENDENCIES.md","reproduction":"From the repository root run `sha256sum -c lib/SHA256SUMS`. Expected per DEPENDENCIES.md lines 6 and 10: all 36 lines OK, exit 0. Actual: 29 OK, 7 FAILED (lib/forge-std/src/StdJson.sol, lib/forge-std/src/interfaces/IMulticall3.sol, lib/forge-std/src/console.sol, lib/forge-std/src/Vm.sol, lib/forge-std/src/interfaces/IERC7540.sol, lib/forge-std/src/StdAssertions.sol, lib/forge-std/src/StdToml.sol), 'sha256sum: WARNING: 7 computed checksums did NOT match', exit 1. Cross-check: `curl -sSL https://raw.githubusercontent.com/foundry-rs/forge-std/v1.9.7/src/StdJson.sol | sha256sum` gives the value recorded in lib/SHA256SUMS, while `sha256sum lib/forge-std/src/StdJson.sol` gives 0211b47e93dbeb6a7de6112470a77137038ed73b79b015847f013e49fcd7511f; `tr -d ' \\t\\n\\r'` applied to both files yields identical sha256 for each of the seven. `cmp` of each lib/openzeppelin-contracts file against the v5.0.2 tag reports identical.","severity":"low","snippet":"- [foundry-rs/forge-std v1.9.7](https://github.com/foundry-rs/forge-std/tree/v1.9.7): 30 files, unmodified. Release archive SHA-256: `45157353ab49eab01d294565866731e599b32401757229689ee459aa26b7ee94`.","title":"Documented dependency integrity check fails: 7 vendored forge-std files differ from lib/SHA256SUMS, so the 'unmodified' claim is false (merged from all four specialists)"},{"citation":"resolved","description":"The README sentence was written before the manifest step ran. The tree now contains launch.json (kind custom_token, token UnlockToken, constructorArgs [], totalSupply 1000000000000000000000000000, pool paired with 0xd34a99bc0f67ae1bbd63c660e6d0b0dd03e263b7 fee 12500 tickSpacing 60, economics poolBps 8000 / 3500 IMD cap / remainderTo 0xd380a8b40fcea7c0a699ff0d8232a264b37a2f9f). I checked the manifest itself: only schema keys, strings for uint256 and addresses, numbers for fee/tickSpacing/decimals, lowercase addresses, contract name 11 characters, constructorArgs empty matching the parameterless constructor, totalSupply equal to what the constructor mints (verified by test: 10^27 to msg.sender). The manifest is consistent with the code; only the README sentence is stale. Documentation accuracy only, no behavioural impact. Fix: drop or reword the clause 'this repository does not contain a launch manifest'.","line":59,"path":"README.md","reproduction":"From the repository root run `grep -n 'does not contain a launch manifest' README.md` (prints line 59) and `ls launch.json` (file exists, 1837 bytes, tracked in git at 390ba63). Expected: the README describes the tree. Actual: it asserts a file is absent that is present.","severity":"info","snippet":"For the specified launch, the external factory handles the 10% swarm allocation, 80% pool allocation, and remaining 10% requester allocation. Distribution, liquidity setup, and the opening market capitalization are launch responsibilities, not token parameters. No recipient, pool, distributor, router, or oracle address is needed by this token. The separate manifest stage supplies the launch configuration; this repository does not contain a launch manifest or a broadcasting script.","title":"README states the repository contains no launch manifest, but launch.json is committed at the root"}],"hash":"98f2fad90efd7cf27079fc94d35299b63d8347e877292a4202c0b008412634c3","nodeId":"925b6a06-a066-48b5-82b5-8468265038a0","outcome":"completed","summary":"The review is complete and `.imd-findings.json` is written. The tree is otherwise untouched.\n\n**Outcome:** the token is sound. The only reproducible defects are documentation accuracy, not code.\n\n**What I verified**\n- `src/UnlockToken.sol` is an unmodified OpenZeppelin v5.0.2 ERC-20 that mints exactly 10^27 units to msg.sender in its constructor with no parameters. The five vendored OpenZeppelin files are byte-identical to the upstream tag.\n- The compiled ABI exposes only approve, transfer, transferFrom and the views. A scratch test deployed through CREATE2 from a factory contract confirmed the whole supply lands on the factory, the swarm share moves and is claimed whole, and admin-style selectors all revert. The opcode scan found no DELEGATECALL, CALLCODE or SELFDESTRUCT. Creation code is 2635 bytes.\n- The project's own 48 tests, including the stateful invariants, pass with the documented seed.\n- `launch.json` matches the code: empty constructorArgs, totalSupply equal to the minted amount, schema-only keys, lowercase addresses.\n\n**Findings kept**\n1. **Low, merged from all four specialists.** The `sha256sum -c lib/SHA256SUMS` check in `DEPENDENCIES.md` fails for seven forge-std files. I fetched the upstream v1.9.7 files: their hashes equal the recorded sums, and the whitespace-stripped content is identical, so the drift is a forge fmt re-wrap of test-only code. The \"unmodified\" claim is false but production bytecode is unaffected.\n2. **Info.** `README.md` line 59 says the repository contains no launch manifest, but `launch.json` is now committed.\n\n**Coverage:** all three entry points are marked holds with one-line reasons, plus rows for the supply invariant, deployability, and the merged specialist finding. No critical or high findings, so no proof files were attached.","treeHash":null,"usage":{"cachedInputTokens":582154,"inputTokens":354,"model":"claude-fable-5-1","outputTokens":10851,"runtime":"claude","turns":12,"wallClockMs":181959}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"fe5e46fb044c6af1","findings":[{"citation":"resolved","description":"Outside the assigned area (access control / trust gap / asymmetry) and reported for completeness only; it has no effect on the token's bytecode or behaviour. DEPENDENCIES.md states that forge-std v1.9.7 is vendored 'unmodified' and that `sha256sum -c lib/SHA256SUMS` (line 10) verifies every vendored file. In the committed tree (git status clean, all 28 forge-std sources tracked) that check fails for seven forge-std files: lib/forge-std/src/StdJson.sol, StdToml.sol, Vm.sol, console.sol, StdAssertions.sol, interfaces/IMulticall3.sol and interfaces/IERC7540.sol. lib/SHA256SUMS records the genuine upstream v1.9.7 hashes (e.g. 0211b47e... for StdJson.sol matches the upstream file), so the files were reformatted after the sums were recorded. Comparing each file to upstream v1.9.7 with all whitespace stripped gives identical token streams: the only change is that multi-line function signatures were joined onto one line (a `forge fmt` pass with a longer line length). All six OpenZeppelin v5.0.2 files are byte-identical to upstream, so the production dependency (ERC20, Context, IERC20, IERC20Metadata, draft-IERC6093) is intact. Impact: a reviewer following the documented integrity procedure gets a failure and has to re-derive by hand that the drift is cosmetic; the 'unmodified' statement in the delivered documentation is not true for forge-std. No security impact.","line":6,"path":"DEPENDENCIES.md","reproduction":"From the repository root run `sha256sum -c lib/SHA256SUMS`. Expected (per DEPENDENCIES.md lines 6 and 10): every line OK, exit 0. Actual: 'lib/forge-std/src/StdJson.sol: FAILED', 'lib/forge-std/src/interfaces/IMulticall3.sol: FAILED', 'lib/forge-std/src/console.sol: FAILED', 'lib/forge-std/src/Vm.sol: FAILED', 'lib/forge-std/src/interfaces/IERC7540.sol: FAILED', 'lib/forge-std/src/StdAssertions.sol: FAILED', 'lib/forge-std/src/StdToml.sol: FAILED', 'WARNING: 7 computed checksums did NOT match', exit 1. The six lib/openzeppelin-contracts entries all report OK. Cosmetic nature: `diff <(curl -sL https://raw.githubusercontent.com/foundry-rs/forge-std/v1.9.7/src/StdJson.sol) lib/forge-std/src/StdJson.sol` shows only lines 200-203 and 262-265 (function signatures) re-wrapped; `tr -d ' \\t\\n\\r'` on both files yields the same sha256. Fix: either restore the upstream formatting of those seven files or re-record their sums and change 'unmodified' to say they were reformatted; either way the documented check should pass.","severity":"info","snippet":"- [foundry-rs/forge-std v1.9.7](https://github.com/foundry-rs/forge-std/tree/v1.9.7): 30 files, unmodified. Release archive SHA-256: `45157353ab49eab01d294565866731e599b32401757229689ee459aa26b7ee94`.","title":"DEPENDENCIES.md integrity claim is false: 7 vendored forge-std files do not match lib/SHA256SUMS (formatter line-wrap drift, test tooling only)"}],"hash":"cefca601d67c4705977cd982edb76b93256a06901d8aa50b5a27d6853facbb08","nodeId":"568afc78-c63b-41ce-99fc-a6298f07ddb4","outcome":"completed","summary":"The review is complete and `.imd-findings.json` holds the result.\n\n**Outcome: no access-control, trust-gap or asymmetry defect in the token.** UNLK is a 17-line contract over byte-identical OpenZeppelin v5.0.2 ERC20. The constructor takes no arguments, hands out no roles, and mints the full supply once to the immediate deployer. The compiled ABI exposes exactly three state-changing functions and no receive, fallback or constructor inputs.\n\nWhat I checked in the assigned area:\n\n- **Access control.** Every writer of each storage slot is caller-scoped. Allowances are written only by the owner's own `approve` or decreased by `_spendAllowance` for the owner-spender pair. Balances move only through `_transfer`. There is no owner, initializer, minter, pauser, blacklist, upgrade path or delegatecall in the runtime bytecode. The deployer has no bypass of the allowance check.\n- **Asymmetry.** `transfer` and `transferFrom` share the same `_transfer` leg, so the only difference is the allowance spend. Revert paths roll back the allowance. Zero-address and max-value branches behave as the standard says.\n- **Trust gap.** The factory holds the whole supply after deployment by design and needs no exemption list, since there are no transfer rules. The 10/80/10 launch split, a claim and both pool directions move exact amounts with constant supply.\n- **Verification run.** The project builds on Solidity 0.8.26, all 30 tests pass with the README's fuzz seed, and `forge fmt --check` passes. Slither and aderyn reported nothing above a style note on the supply literal.\n\nOne informational item outside the area: the integrity check in DEPENDENCIES.md fails. Seven vendored forge-std files differ from the recorded sums because they were reformatted after the sums were recorded. With whitespace removed they are identical to upstream v1.9.7, and all OpenZeppelin files match byte for byte, so the deployed bytecode is unaffected. The reproduction is the documented command itself:\n\n```\nsha256sum -c lib/SHA256SUMS\n# WARNING: 7 computed checksums did NOT match (exit 1)\n```\n\nThe coverage record marks all three entry points as holding, with five invariant rows and the one finding row. No proof test was written since nothing reached high severity, and no repository file other than the findings file was changed.","treeHash":null,"usage":{"cachedInputTokens":904870,"inputTokens":322,"model":"claude-fable-5-1","outputTokens":15119,"runtime":"claude","turns":27,"wallClockMs":232624}},{"artifacts":[],"attempt":1,"bundleHash":"c9b53c2161aba937d7a1205a67c825c4b7a5ef42adf2d611a95e318776ad9182","device":"75bef36d3764a939","findings":[],"hash":"ed26197fd1742e04a904dd466c349ea129f1ef60fa35f5186f919a526f914c53","nodeId":"7fd016fd-3d85-49e2-a886-99d02c6f18fa","outcome":"completed","summary":"Added failure-path tests, five fuzz properties, and accounting invariants covering 32,768 random calls. All additions are under `test/`.\n\n- Offline `forge build` and seeded `forge test`: **48 passed, 0 failed**.\n- Slither: two informational advisories; no concrete defect found.\n- Aderyn unavailable.\n\nCommands, results, and limitations: [test report](/home/debian/.identitymd/work/76711b80-9c09-45f0-9bf5-de7154ecfc61/7fd016fd-3d85-49e2-a886-99d02c6f18fa/test/UNLOCK_TEST_REPORT.md).","treeHash":"d3b4bbf064fc6b178143cb7611b148e2e06951f6","usage":{"cachedInputTokens":771968,"inputTokens":71119,"model":"gpt-6-astra","outputTokens":15446,"runtime":"codex","turns":6,"wallClockMs":376814}}],"verification":[{"checks":[{"durationMs":1270,"exitCode":0,"name":"build","output":"Compiling 27 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.17s\nCompiler run successful!\n","passed":true},{"durationMs":797,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 29 tests for test/UnlockToken.t.sol:UnlockTokenTest\n[PASS] testFuzz_create2MintsToFactoryNotTransactionOrigin(bytes32) (runs: 1000, μ: 232940, ~: 233054)\n[PASS] testFuzz_transferAboveBalanceReverts(uint256,uint256) (runs: 1000, μ: 127541, ~: 127655)\nLogs:\n  Bound result 792595881415872824509812751\n  Bound result 22281469445514706968967\n\n[PASS] testFuzz_transferConservesSupply(uint256) (runs: 1000, μ: 169536, ~: 169876)\nLogs:\n  Bound result 195749\n\n[PASS] testFuzz_transferFromAboveAllowanceReverts(uint256,uint256) (runs: 1000, μ: 123608, ~: 123826)\nLogs:\n  Bound result 571112893312782047157\n  Bound result 999999428887108339405379096\n\n[PASS] testFuzz_transferFromAccounting(uint256,uint256) (runs: 1000, μ: 164924, ~: 165601)\nLogs:\n  Bound result 24768861\n  Bound result 8989906324542047299303823\n\n[PASS] test_approvalIsSpecificToSpender() (gas: 118240)\n[PASS] test_approvalReplacementAndRevocation() (gas: 167360)\n[PASS] test_approveEmitsEventAndDoesNotMoveTokens() (gas: 88787)\n[PASS] test_approveZeroSpenderReverts() (gas: 37574)\n[PASS] test_constructorEmitsExactlyOneMint() (gas: 9622)\n[PASS] test_factoryDistributionAndClaimMoveExactAmounts() (gas: 566583)\n[PASS] test_infiniteAllowanceIsNotDecremented() (gas: 215269)\n[PASS] test_maximumTransferRevertsWithoutOverflow() (gas: 55043)\n[PASS] test_metadataAndEntireSupplyBelongToDeployer() (gas: 107672)\n[PASS] test_noMintBurnAdminOrUpgradeEntryPoints() (gas: 819537)\n[PASS] test_runtimeHasNoDelegationOrDestructionOpcodes() (gas: 785805)\n[PASS] test_selfTransferPreservesBalance() (gas: 51409)\n[PASS] test_transferDoesNotCallRecipient() (gas: 173836)\n[PASS] test_transferEntireSupply() (gas: 161729)\n[PASS] test_transferExactAmountAndEvent() (gas: 91504)\n[PASS] test_transferFromInsufficientBalanceRollsBackAllowance() (gas: 136996)\n[PASS] test_transferFromSpendsAllowanceAndEmitsTransfer() (gas: 214960)\n[PASS] test_transferFromToSameAccountConsumesAllowanceOnly() (gas: 105674)\n[PASS] test_transferFromToZeroRollsBackAllowance() (gas: 114593)\n[PASS] test_transferFromWithoutAllowanceRevertsEvenForDeployer() (gas: 110160)\n[PASS] test_transferFromZeroSenderReverts() (gas: 42016)\n[PASS] test_transferToZeroRevertsIncludingZeroAmount() (gas: 82410)\n[PASS] test_zeroTransferFromEmptyAccountEmitsEvent() (gas: 63090)\n[PASS] test_zeroTransferFromNeedsNoAllowance() (gas: 78704)\nSuite result: ok. 29 passed; 0 failed; 0 skipped; finished in 39.78ms (193.14ms CPU time)\n\nRan 1 test for test/UnlockToken.invariant.t.sol:UnlockTokenInvariantTest\n[PASS] invariant_supplyIsFixedAndAllBalancesAreAccountedFor() (runs: 128, calls: 8192, reverts: 0)\n\n╭--------------+--------------+-------+---------+----------╮\n| Contract     | Selector     | Calls | Reverts | Discards |\n+==========================================================+\n| TokenHandler | approve      | 2663  | 0       | 0        |\n|--------------+--------------+-------+---------+----------|\n| TokenHandler | transfer     | 2749  | 0       | 0        |\n|--------------+--------------+-------+---------+----------|\n| TokenHandler | transferFrom | 2780  | 0       | 0        |\n╰--------------+--------------+-------+---------+----------╯\n\nLogs:\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 3202\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 599290590\n  Bound result 0\n  Bound result 1000000000000000000\n  Bound result 621\n  Bound result 9\n  Bound result 2572\n  Bound result 3201\n  Bound result 2031\n  Bound result 767\n  Bound result 1000000000\n  Bound result 2877\n  Bound result 5999999999857142858\n  Bound result 161\n  Bound result 401\n  Bound result 96\n  Bound result 654558170\n  Bound result 177362149\n  Bound result 127\n  Bound result 1214\n  Bound result 11\n  Bound result 4\n  Bound result 0\n  Bound result 0\n  Bound result 3617507\n  Bound result 82193205\n  Bound result 14\n  Bound result 6000000000000000000\n  Bound result 4373629\n  Bound result 0\n  Bound result 11\n  Bound result 61636800\n  Bound result 11\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 707.27ms (705.16ms CPU time)\n\nRan 2 test suites in 708.38ms (747.04ms CPU time): 30 tests passed, 0 failed, 0 skipped (30 total tests)\n","passed":true},{"durationMs":52,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"UnlockToken.approve(address,uint256)\",\"UnlockToken.transfer(address,uint256)\",\"UnlockToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":3,\"DEPENDENCIES.md\":10,\"README.md\":69,\"foundry.toml\":18,\"launch.json\":24,\"remappings.txt\":2,\"src/UnlockToken.sol\":17,\"test/UnlockToken.invariant.t.sol\":80,\"test/UnlockToken.t.sol\":389},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"449547991550b274d8152a38e319e0baf585ec462afe7bd7a2ade9682ccf602c","verifiedTreeHash":"4dedc1dc29ee417c28249c1ae1c8badf453b94ed","verifierVersion":"0.1.0+c3fba9eb"},{"checks":[{"durationMs":1759,"exitCode":0,"name":"build","output":"Compiling 27 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.65s\nCompiler run successful!\n","passed":true},{"durationMs":1062,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 29 tests for test/UnlockToken.t.sol:UnlockTokenTest\n[PASS] testFuzz_create2MintsToFactoryNotTransactionOrigin(bytes32) (runs: 1000, μ: 232940, ~: 233054)\n[PASS] testFuzz_transferAboveBalanceReverts(uint256,uint256) (runs: 1000, μ: 127541, ~: 127655)\nLogs:\n  Bound result 571112893312782047157\n  Bound result 1652187426253\n\n[PASS] testFuzz_transferConservesSupply(uint256) (runs: 1000, μ: 169536, ~: 169876)\nLogs:\n  Bound result 1939\n\n[PASS] testFuzz_transferFromAboveAllowanceReverts(uint256,uint256) (runs: 1000, μ: 123608, ~: 123826)\nLogs:\n  Bound result 314463887958205988613233854\n  Bound result 710304005674613615546827618\n\n[PASS] testFuzz_transferFromAccounting(uint256,uint256) (runs: 1000, μ: 164924, ~: 165601)\nLogs:\n  Bound result 22281469445514706968967\n  Bound result 331401294578470792595881416204225804391221\n\n[PASS] test_approvalIsSpecificToSpender() (gas: 118240)\n[PASS] test_approvalReplacementAndRevocation() (gas: 167360)\n[PASS] test_approveEmitsEventAndDoesNotMoveTokens() (gas: 88787)\n[PASS] test_approveZeroSpenderReverts() (gas: 37574)\n[PASS] test_constructorEmitsExactlyOneMint() (gas: 9622)\n[PASS] test_factoryDistributionAndClaimMoveExactAmounts() (gas: 566583)\n[PASS] test_infiniteAllowanceIsNotDecremented() (gas: 215269)\n[PASS] test_maximumTransferRevertsWithoutOverflow() (gas: 55043)\n[PASS] test_metadataAndEntireSupplyBelongToDeployer() (gas: 107672)\n[PASS] test_noMintBurnAdminOrUpgradeEntryPoints() (gas: 819537)\n[PASS] test_runtimeHasNoDelegationOrDestructionOpcodes() (gas: 785805)\n[PASS] test_selfTransferPreservesBalance() (gas: 51409)\n[PASS] test_transferDoesNotCallRecipient() (gas: 173836)\n[PASS] test_transferEntireSupply() (gas: 161729)\n[PASS] test_transferExactAmountAndEvent() (gas: 91504)\n[PASS] test_transferFromInsufficientBalanceRollsBackAllowance() (gas: 136996)\n[PASS] test_transferFromSpendsAllowanceAndEmitsTransfer() (gas: 214960)\n[PASS] test_transferFromToSameAccountConsumesAllowanceOnly() (gas: 105674)\n[PASS] test_transferFromToZeroRollsBackAllowance() (gas: 114593)\n[PASS] test_transferFromWithoutAllowanceRevertsEvenForDeployer() (gas: 110160)\n[PASS] test_transferFromZeroSenderReverts() (gas: 42016)\n[PASS] test_transferToZeroRevertsIncludingZeroAmount() (gas: 82410)\n[PASS] test_zeroTransferFromEmptyAccountEmitsEvent() (gas: 63090)\n[PASS] test_zeroTransferFromNeedsNoAllowance() (gas: 78704)\nSuite result: ok. 29 passed; 0 failed; 0 skipped; finished in 67.40ms (336.85ms CPU time)\n\nRan 1 test for test/UnlockToken.invariant.t.sol:UnlockTokenInvariantTest\n[PASS] invariant_supplyIsFixedAndAllBalancesAreAccountedFor() (runs: 128, calls: 8192, reverts: 0)\n\n╭--------------+--------------+-------+---------+----------╮\n| Contract     | Selector     | Calls | Reverts | Discards |\n+==========================================================+\n| TokenHandler | approve      | 2663  | 0       | 0        |\n|--------------+--------------+-------+---------+----------|\n| TokenHandler | transfer     | 2749  | 0       | 0        |\n|--------------+--------------+-------+---------+----------|\n| TokenHandler | transferFrom | 2780  | 0       | 0        |\n╰--------------+--------------+-------+---------+----------╯\n\nLogs:\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 3202\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 599290590\n  Bound result 0\n  Bound result 1000000000000000000\n  Bound result 621\n  Bound result 9\n  Bound result 2572\n  Bound result 3201\n  Bound result 2031\n  Bound result 767\n  Bound result 1000000000\n  Bound result 2877\n  Bound result 5999999999857142858\n  Bound result 161\n  Bound result 401\n  Bound result 96\n  Bound result 654558170\n  Bound result 177362149\n  Bound result 127\n  Bound result 1214\n  Bound result 11\n  Bound result 4\n  Bound result 0\n  Bound result 0\n  Bound result 309118396\n  Bound result 29909425\n  Bound result 14\n  Bound result 6000000000000000000\n  Bound result 331099\n  Bound result 0\n  Bound result 11\n  Bound result 1567032\n  Bound result 11\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 935.26ms (933.61ms CPU time)\n\nRan 2 test suites in 938.05ms (1.00s CPU time): 30 tests passed, 0 failed, 0 skipped (30 total tests)\n","passed":true},{"durationMs":78,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"UnlockToken.approve(address,uint256)\",\"UnlockToken.transfer(address,uint256)\",\"UnlockToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":3,\"DEPENDENCIES.md\":10,\"README.md\":69,\"foundry.toml\":18,\"remappings.txt\":2,\"src/UnlockToken.sol\":17,\"test/UnlockToken.invariant.t.sol\":80,\"test/UnlockToken.t.sol\":389},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true},{"durationMs":1268,"exitCode":0,"name":"slither","output":"slither: no results at low impact or above","passed":true},{"durationMs":398,"exitCode":0,"name":"aderyn","output":"[low] large-numeric-literal at src/UnlockToken.sol:10: Large Numeric Literal","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"765ea6b47ae44f627d202bc9d28e10ce2af31a61c8b95a6bac61556659ec9511","verifiedTreeHash":"592964caa989cb94c83790cd607a4b7eeecfc6e3","verifierVersion":"0.1.0+c3fba9eb"},{"checks":[{"durationMs":4120,"exitCode":0,"name":"build","output":"Compiling 29 files with Solc 0.8.26\nSolc 0.8.26 finished in 3.89s\nCompiler run successful!\n","passed":true},{"durationMs":19563,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 16 tests for test/UnlockToken.adversarial.t.sol:UnlockTokenAdversarialTest\n[PASS] testFuzz_failedZeroRecipientSpendPreservesFiniteAndInfiniteApprovals(uint256,bool) (runs: 1000, μ: 209402, ~: 210155)\nLogs:\n  Bound result 52575914\n\n[PASS] testFuzz_replacingApprovalChangesOnlyTheOwnersChosenSpender(uint256,uint256) (runs: 1000, μ: 297509, ~: 297578)\n[PASS] testFuzz_selfTransferStillRequiresEnoughBalance(uint256,uint256) (runs: 1000, μ: 220378, ~: 220637)\nLogs:\n  Bound result 3000000000000000000\n  Bound result 3865\n\n[PASS] testFuzz_splitDelegatedSpendingEqualsSingleSpend(uint256,uint256,uint256) (runs: 1000, μ: 359032, ~: 359926)\nLogs:\n  Bound result 300977730341707047510363638\n  Bound result 0\n  Bound result 115792089237316195423570985008687907853269984665640263061727242301243424975857\n\n[PASS] testFuzz_transferRoundTripRestoresBalancesAndLeavesApprovalsAlone(uint256) (runs: 1000, μ: 251404, ~: 251116)\nLogs:\n  Bound result 397316114596192061461007947\n\n[PASS] test_approvalBeforeFundingSurvivesFailedSpendAndWorksAfterFunding() (gas: 246066)\n[PASS] test_approvalDoesNotAuthorizeTheSameSpenderForAnotherOwner() (gas: 241726)\n[PASS] test_approveZeroSpenderRejectsZeroAndMaximum() (gas: 135179)\n[PASS] test_infiniteAllowanceCanBeRevokedAndReplacedWithFiniteAllowance() (gas: 314662)\n[PASS] test_infiniteApprovalDoesNotBypassBalanceCheckAtUint256Maximum() (gas: 131374)\n[PASS] test_maximumMinusOneAllowanceIsFinite() (gas: 153489)\n[PASS] test_oneBaseUnitCanBeTransferredAndSpentWithoutRounding() (gas: 220139)\n[PASS] test_ownerNeedsSelfAllowanceForTransferFrom() (gas: 226101)\n[PASS] test_spenderCanReceiveTokensButCannotReuseExhaustedAllowance() (gas: 170644)\n[PASS] test_spenderCannotGiveItselfAnOwnersAllowance() (gas: 174035)\n[PASS] test_zeroTransferFromToZeroRecipientStillReverts() (gas: 79083)\nSuite result: ok. 16 passed; 0 failed; 0 skipped; finished in 146.35ms (693.85ms CPU time)\n\nRan 29 tests for test/UnlockToken.t.sol:UnlockTokenTest\n[PASS] testFuzz_create2MintsToFactoryNotTransactionOrigin(bytes32) (runs: 1000, μ: 232944, ~: 233054)\n[PASS] testFuzz_transferAboveBalanceReverts(uint256,uint256) (runs: 1000, μ: 127518, ~: 127655)\nLogs:\n  Bound result 8989906324542047299303823\n  Bound result 24768861\n\n[PASS] testFuzz_transferConservesSupply(uint256) (runs: 1000, μ: 169611, ~: 169876)\nLogs:\n  Bound result 195749\n\n[PASS] testFuzz_transferFromAboveAllowanceReverts(uint256,uint256) (runs: 1000, μ: 123589, ~: 123826)\nLogs:\n  Bound result 8989906324542047299303823\n  Bound result 991010093675457952725465038\n\n[PASS] testFuzz_transferFromAccounting(uint256,uint256) (runs: 1000, μ: 164936, ~: 165613)\nLogs:\n  Bound result 24768861\n  Bound result 8989906324542047299303823\n\n[PASS] test_approvalIsSpecificToSpender() (gas: 118240)\n[PASS] test_approvalReplacementAndRevocation() (gas: 167360)\n[PASS] test_approveEmitsEventAndDoesNotMoveTokens() (gas: 88787)\n[PASS] test_approveZeroSpenderReverts() (gas: 37574)\n[PASS] test_constructorEmitsExactlyOneMint() (gas: 9622)\n[PASS] test_factoryDistributionAndClaimMoveExactAmounts() (gas: 566583)\n[PASS] test_infiniteAllowanceIsNotDecremented() (gas: 215269)\n[PASS] test_maximumTransferRevertsWithoutOverflow() (gas: 55043)\n[PASS] test_metadataAndEntireSupplyBelongToDeployer() (gas: 107672)\n[PASS] test_noMintBurnAdminOrUpgradeEntryPoints() (gas: 819537)\n[PASS] test_runtimeHasNoDelegationOrDestructionOpcodes() (gas: 785805)\n[PASS] test_selfTransferPreservesBalance() (gas: 51409)\n[PASS] test_transferDoesNotCallRecipient() (gas: 173836)\n[PASS] test_transferEntireSupply() (gas: 161729)\n[PASS] test_transferExactAmountAndEvent() (gas: 91504)\n[PASS] test_transferFromInsufficientBalanceRollsBackAllowance() (gas: 136996)\n[PASS] test_transferFromSpendsAllowanceAndEmitsTransfer() (gas: 214960)\n[PASS] test_transferFromToSameAccountConsumesAllowanceOnly() (gas: 105674)\n[PASS] test_transferFromToZeroRollsBackAllowance() (gas: 114593)\n[PASS] test_transferFromWithoutAllowanceRevertsEvenForDeployer() (gas: 110160)\n[PASS] test_transferFromZeroSenderReverts() (gas: 42016)\n[PASS] test_transferToZeroRevertsIncludingZeroAmount() (gas: 82410)\n[PASS] test_zeroTransferFromEmptyAccountEmitsEvent() (gas: 63090)\n[PASS] test_zeroTransferFromNeedsNoAllowance() (gas: 78704)\nSuite result: ok. 29 passed; 0 failed; 0 skipped; finished in 147.24ms (699.75ms CPU time)\n\nRan 1 test for test/UnlockToken.invariant.t.sol:UnlockTokenInvariantTest\n[PASS] invariant_supplyIsFixedAndAllBalancesAreAccountedFor() (runs: 128, calls: 8192, reverts: 0)\n\n╭--------------+--------------+-------+---------+----------╮\n| Contract     | Selector     | Calls | Reverts | Discards |\n+==========================================================+\n| TokenHandler | approve      | 2663  | 0       | 0        |\n|--------------+--------------+-------+---------+----------|\n| TokenHandler | transfer     | 2749  | 0       | 0        |\n|--------------+--------------+-------+---------+----------|\n| TokenHandler | transferFrom | 2780  | 0       | 0        |\n╰--------------+--------------+-------+---------+----------╯\n\nLogs:\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 448\n  Bound result 0\n  Bound result 0\n  Bound result 599290590\n  Bound result 0\n  Bound result 1000000000000000000\n  Bound result 0\n  Bound result 14\n  Bound result 0\n  Bound result 999999999999999999\n  Bound result 0\n  Bound result 837\n  Bound result 1000000000\n  Bound result 5911\n  Bound result 1468\n  Bound result 2\n  Bound result 292\n  Bound result 24576\n  Bound result 0\n  Bound result 360\n  Bound result 127\n  Bound result 4580\n  Bound result 0\n  Bound result 4\n  Bound result 1665\n  Bound result 0\n  Bound result 1000000000000001468\n  Bound result 3\n  Bound result 0\n  Bound result 8\n  Bound result 117694874931690261\n  Bound result 30\n  Bound result 14\n  Bound result 4852\n  Bound result 11\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 1.42s (1.42s CPU time)\n\nRan 2 tests for test/UnlockToken.accounting.invariant.t.sol:UnlockTokenAccountingInvariantTest\n[PASS]\nUnlockTokenAccountingInvariantTest invariants:\n[PASS] invariant_allowancesMatchOwnerInstructionsAndSuccessfulSpends\n[PASS] invariant_balancesMatchIndependentFlowsAndSupplyIsFixed\n UnlockTokenAccountingInvariantTest invariants (runs: 256, calls: 32768, reverts: 0)\n\n╭-------------------------+--------------------------+-------+---------+----------╮\n| Contract                | Selector                 | Calls | Reverts | Discards |\n+=================================================================================+\n| UnlockAccountingHandler | approve                  | 3300  | 0       | 0        |\n|-------------------------+--------------------------+-------+---------+----------|\n| UnlockAccountingHandler | delegatedOverdrawBalance | 3421  | 0       | 0        |\n|-------------------------+--------------------------+-------+---------+----------|\n| UnlockAccountingHandler | overdrawAllowance        | 3210  | 0       | 0        |\n|-------------------------+--------------------------+-------+---------+----------|\n| UnlockAccountingHandler | overdrawBalance          | 3275  | 0       | 0        |\n|-------------------------+--------------------------+-------+---------+----------|\n| UnlockAccountingHandler | rejectZeroRecipient      | 3229  | 0       | 0        |\n|-------------------------+--------------------------+-------+---------+----------|\n| UnlockAccountingHandler | rejectZeroSpender        | 3236  | 0       | 0        |\n|-------------------------+--------------------------+-------+---------+----------|\n| UnlockAccountingHandler | revokeAndAttemptSpend    | 3253  | 0       | 0        |\n|-------------------------+--------------------------+-------+---------+----------|\n| UnlockAccountingHandler | transfer                 | 3271  | 0       | 0        |\n|-------------------------+--------------------------+-------+---------+----------|\n| UnlockAccountingHandler | transferAll              | 3233  | 0       | 0        |\n|-------------------------+--------------------------+-------+---------+----------|\n| UnlockAccountingHandler | transferFrom             | 3340  | 0       | 0        |\n╰-------------------------+--------------------------+-------+---------+----------╯\n\nLogs:\n  Bound result 0\n  Bound result 0\n  Bound result 6717\n  Bound result 0\n  Bound result 0\n  Bound result 3472\n  Bound result 7770\n  Bound result 0\n  Bound result 7000000000000000000\n  Bound result 5268\n  Bound result 1500\n  Bound result 15254163722179521476429185967069771654729\n  Bound result 202366493931628129899127139\n  Bound result 0\n  Bound result 4\n  Bound result 115792089237316195423570985008687907853269984665640064039457584007913129639935\n  Bound result 0\n  Bound result 3687502447129\n  Bound result 0\n  Bound result 0\n  Bound result 5569\n  Bound result 8666\n  Bound result 0\n  Bound result 0\n  Bound result 1131\n  Bound result 6339\n  Bound result 0\n  Bound result 1067\n  Bound result 0\n  Bound result 302414126081817101125200687697936064925166900051565701812190\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 1046363171\n  Bound result 473439420367875819980072\n  Bound result 0\n  Bound result 244\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 7629\n  Bound result 997703309874176440744639542\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 2948\n  Bound result 5980\n  Bound result 3\n  Bound result 5845620458840664236209479098218666429722732380422468023958977266\n  Bound result 1312\n  Bound result 0\n  Bound result 0\n\n[PASS] test_handlerExercisesNonzeroDelegationAndExpectedRejections() (gas: 1633088)\nLogs:\n  Bound result 1\n  Bound result 3\n  Bound result 1\n  Bound result 1\n  Bound result 1\n\nSuite result: ok. 2 passed; 0 failed; 0 skipped; finished in 19.39s (19.39s CPU time)\n\nRan 4 test suites in 19.40s (21.11s CPU time): 48 tests passed, 0 failed, 0 skipped (48 total tests)\n","passed":true},{"durationMs":89,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"UnlockToken.approve(address,uint256)\",\"UnlockToken.transfer(address,uint256)\",\"UnlockToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":3,\"DEPENDENCIES.md\":10,\"README.md\":69,\"foundry.toml\":18,\"remappings.txt\":2,\"src/UnlockToken.sol\":17,\"test/UNLOCK_TEST_REPORT.md\":85,\"test/UnlockToken.accounting.invariant.t.sol\":272,\"test/UnlockToken.adversarial.t.sol\":267,\"test/UnlockToken.invariant.t.sol\":80,\"test/UnlockToken.t.sol\":389},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"ed26197fd1742e04a904dd466c349ea129f1ef60fa35f5186f919a526f914c53","verifiedTreeHash":"d3b4bbf064fc6b178143cb7611b148e2e06951f6","verifierVersion":"0.1.0+c3fba9eb"}]}