{"assessments":[],"deployments":[],"fuzz":[],"identity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"interpretation":"Records acceptance and evidence. Neither completion nor an AI assessment establishes correctness, safety, or independent review.","jobId":"530d88b3-23b5-4a6b-aa0c-86b76123c9df","kind":"shape:chain","nodes":[{"acceptedSubmissionHash":"a829827756262ad1d4780d232709586366ae5000471a766558fa33c9cefef9fb","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_economics","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"7a62c672b52749d14793b0aa7408dca3bb7041c24a53169369bd346a0e44571a","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_flow","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"e8daeaa638844f9182179e766b68f1b74c784a057e250051e14b608c98884c1b","dependsOn":["build_contract_project","write_foundry_tests","manifest","audit_math","audit_permissions","audit_economics","audit_flow"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"af3aa01159bbf354f621cafa5c0006f6169e0938a8b015be508b7377dbf165bc","skillId":"audit-judge","tools":[]},"key":"audit_judge","kind":"code","role":"review","skillHash":"af3aa01159bbf354f621cafa5c0006f6169e0938a8b015be508b7377dbf165bc","skillId":"audit-judge","state":"accepted"},{"acceptedSubmissionHash":"1834c59a10e769e3c849e0b8c066ac3897afc4880193d4a097286c8dc0e06bea","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_math","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"69ae7c9c322a4cf3aea06ba2f3578498ee93110f497649757f7ac3887d95115d","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_permissions","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"e524132b24d209f54cd84027c26033c4cb7cdbceb433219c9c29ed100a5320d0","dependsOn":[],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"6b8d2c2ebd3301cff2be8edb1e1cc6ba65c858c02fe7247be81722b969842265","skillId":"build-contract-project","tools":[]},"key":"build_contract_project","kind":"code","role":"implement","skillHash":"6b8d2c2ebd3301cff2be8edb1e1cc6ba65c858c02fe7247be81722b969842265","skillId":"build-contract-project","state":"accepted"},{"acceptedSubmissionHash":"09ce196302c247db29addc18e5c5c50b98ad382d5918ac2d7dde7e64264bc92e","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"tools":[]},"key":"manifest","kind":"code","role":"integrate","skillHash":null,"skillId":null,"state":"accepted"},{"acceptedSubmissionHash":"fb5a24daed24ec8a8dcb96acfecb81ae280c1d41108d72b20e30657fd559aa80","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"73431852439ad3a343f3d2b7db1c43cd363b9f48f9bb51497374a0cf6d50b223","skillId":"write-foundry-tests","tools":[]},"key":"write_foundry_tests","kind":"code","role":"tests","skillHash":"73431852439ad3a343f3d2b7db1c43cd363b9f48f9bb51497374a0cf6d50b223","skillId":"write-foundry-tests","state":"accepted"}],"objective":"A custom token: Inference Backed Endogenous Financial Re (INFER).\nToken name: Inference Backed Endogenous Financial Re\nToken symbol: INFER\nToken supply: 1,000,000,000 with 18 decimals, all minted once to the deployer in the constructor.","parentJobId":null,"planHash":"6bfef758845160a3b4c090deaed19968541e928c37ffb6ef2e518732e5178398","previousHash":"0000000000000000000000000000000000000000000000000000000000000000","projectId":"530d88b3-23b5-4a6b-aa0c-86b76123c9df","publication":{"commit":null,"deliveredAt":null,"repoUrl":"https://github.com/identity-md-launches/launch-1286-inference-backed-endogenous-financial-re"},"receiptIdentity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"registry":"0xb6d0a187b050fa5bb0b87033a203f37becf4a775","research":[],"schema":"identitymd-work-v1","signals":[{"agentId":"51450","feedbackHash":"dfb62b2a266a3343bc50fb919da6275d4e6d079df0a7d6c0c64cfbed84657408","nodeKey":"audit_economics","submissionHash":"a829827756262ad1d4780d232709586366ae5000471a766558fa33c9cefef9fb","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"50966","feedbackHash":"241ea6a6628a8b6e56b47d25814b8ca1b0bd22e5ad623fbbc7e70c90cda70b24","nodeKey":"audit_flow","submissionHash":"7a62c672b52749d14793b0aa7408dca3bb7041c24a53169369bd346a0e44571a","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52152","feedbackHash":"78ef9333aa3d55f683ea7d29bf77d726492e6120c4349c234db206499f003213","nodeKey":"audit_judge","submissionHash":"e8daeaa638844f9182179e766b68f1b74c784a057e250051e14b608c98884c1b","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52124","feedbackHash":"36106b51d11a182769f588054556d56cc6152f0a0f3adf9e26df34e7b4e4b04e","nodeKey":"audit_math","submissionHash":"1834c59a10e769e3c849e0b8c066ac3897afc4880193d4a097286c8dc0e06bea","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51243","feedbackHash":"05a5fbe08aa3c8c0a7bc8f43c5dd36681075b8152e535cb6c0314c4d3440eb49","nodeKey":"audit_permissions","submissionHash":"69ae7c9c322a4cf3aea06ba2f3578498ee93110f497649757f7ac3887d95115d","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"50963","feedbackHash":"2705246c930851bc839e4b5012db435a9c2f8296287556e1dc03385c54ddaa08","nodeKey":"build_contract_project","submissionHash":"e524132b24d209f54cd84027c26033c4cb7cdbceb433219c9c29ed100a5320d0","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"51560","feedbackHash":"40ecbfe738c799d879920865a88fb65574d1280bc6771601eb3c8b2ba5d06978","nodeKey":"manifest","submissionHash":"09ce196302c247db29addc18e5c5c50b98ad382d5918ac2d7dde7e64264bc92e","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"51726","feedbackHash":"cb9bdeb128a0cb5a570529a014b61b4fa9237910a658c7e9529f048ee384a30a","nodeKey":"write_foundry_tests","submissionHash":"fb5a24daed24ec8a8dcb96acfecb81ae280c1d41108d72b20e30657fd559aa80","tag1":"verification:checks","tag2":"acceptance-v2","value":1}],"site":null,"snapshotHash":"52953717243970fea79328208e0cffc820aa6562c940c1356943fd0c205995c3","state":"completed","submissions":[{"artifacts":[],"attempt":1,"bundleHash":"7fa1a88c4ff58993623474d1b986917de3a2b597523c5a805e129baaa5ce6c14","device":"282a1c2062280fd9","findings":[],"hash":"09ce196302c247db29addc18e5c5c50b98ad382d5918ac2d7dde7e64264bc92e","nodeId":"11bd39cd-a672-45d9-8e20-2b0c14f45da6","outcome":"completed","summary":"Created [launch.json](/home/seat/.identitymd/work/530d88b3-23b5-4a6b-aa0c-86b76123c9df/11bd39cd-a672-45d9-8e20-2b0c14f45da6/launch.json) matching `INFERToken`, its parameterless constructor, exact supply, and required pool and economics.\n\nValidation passed: manifest checks, `forge build`, and all 30 tests. Only `launch.json` is a submission change.","treeHash":"5e1102fc10f9c442895ada5495761012cc1ed7bb","usage":{"cachedInputTokens":158848,"inputTokens":33973,"model":"gpt-6-astra","outputTokens":2143,"runtime":"codex","turns":3,"wallClockMs":72497}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"03845cacb54c3a73","findings":[{"citation":"resolved","description":"DEPENDENCIES.json exists so a verifier can confirm every vendored file byte-for-byte against upstream, and README.md line 48 states 'Vendored sources are unmodified.' For seven forge-std files that record is false: lib/forge-std/src/StdAssertions.sol, StdJson.sol, StdToml.sol, Vm.sol, console.sol, interfaces/IERC7540.sol and interfaces/IMulticall3.sol hash differently from the values recorded. I fetched the upstream archive named in the file (sha256 a387f7c2... matches the recorded archiveSha256) and diffed: every difference is whitespace/line-wrapping only (the vendored copies were run through forge fmt), so the Solidity semantics are identical and the OpenZeppelin dependency closure (the only code that reaches the deployed bytecode) matches its recorded hashes exactly. Impact: none on the token's bytecode, supply, or launch flows; forge-std is test-only. The defect is that the provenance record and README claim cannot be reproduced as written, which defeats the stated purpose of the file. Outside my assigned area (math/boundary/numerical gap); reported because it was substantiated while verifying the vendored ERC20 arithmetic. Minimal fix: either restore the seven files to their upstream bytes, or re-record their SHA-256 values and amend the README sentence to say the forge-std copies were reformatted.","line":59,"path":"DEPENDENCIES.json","reproduction":"From the repository root run: python3 -c \"import json,hashlib;[print(hashlib.sha256(open(f['path'],'rb').read()).hexdigest()==f['sha256'], f['path']) for r in json.load(open('DEPENDENCIES.json')) for f in r['files']]\". Expected: True for every line. Actual: False for lib/forge-std/src/StdAssertions.sol (actual sha256 3fbf4a025b4fc94eaca4c38c1f3dacb37bee10f12ee81994cfaf365ac1ce7384, recorded d4c89eec70d267dec6188461fbc74d3dc8c47e518d176a23417533a232ed9780), StdJson.sol, StdToml.sol, Vm.sol, console.sol, interfaces/IERC7540.sol, interfaces/IMulticall3.sol. All six OpenZeppelin entries and the remaining forge-std entries match. Downloading https://codeload.github.com/foundry-rs/forge-std/tar.gz/77041d2ce690e692d6e03cc812b57d1ddaa4d505 and running diff -w against each of the seven files shows no non-whitespace change.","severity":"info","snippet":"        \"path\": \"lib/forge-std/src/StdAssertions.sol\",\n        \"sha256\": \"d4c89eec70d267dec6188461fbc74d3dc8c47e518d176a23417533a232ed9780\"","title":"DEPENDENCIES.json records SHA-256 hashes that do not match seven vendored forge-std files (formatting-only drift)"}],"hash":"1834c59a10e769e3c849e0b8c066ac3897afc4880193d4a097286c8dc0e06bea","nodeId":"a15691a3-121b-4033-839e-7818b35345f6","outcome":"completed","summary":"The findings file is in place at the repository root, and the harness's own exclude rule keeps it out of git, which is expected. The review is complete.\n\n**Result: no defects in the assigned area.** The token is a 16-line wrapper over OpenZeppelin ERC20 v5.0.2 with no overrides, so the entire math surface is the supply constant and OZ's `_update` and `_spendAllowance` arithmetic. I traced each against the Math Precision, Boundary and Numerical Gap guides and confirmed every item with executed tests.\n\nWhat I verified, with evidence:\n\n- **Supply constant.** The literal expression compiles to exactly 10^27. That hex constant appears in both creation and runtime bytecode, and the artifact ABI reports 18 decimals. The supply divides the 10/80/10 launch split with no remainder.\n- **Transfer arithmetic.** The checked balance guard runs before the unchecked subtraction, and the unchecked addition cannot wrap because the balance sum equals the fixed supply. I exercised 1 wei, exact balance, balance plus one, max uint256, and a self-transfer of the whole supply.\n- **Allowance arithmetic.** The max-uint sentinel is never decremented, max minus one decrements correctly, and an allowance survives a transfer that reverts on balance.\n- **Boundaries.** No external calls, no payable functions, no receive or fallback, no bytes decoding. The only sentinel branch is the zero address, and both sides revert cleanly.\n- **Numerical gap seams.** There is no division, multiplication, scaling or casting anywhere in the token or its base, so no seam exists.\n- **Dependency integrity.** All six vendored OpenZeppelin files match their recorded SHA-256 hashes, and the ERC20 source matches upstream.\n\n**One informational finding, outside my area.** DEPENDENCIES.json records hashes for seven forge-std files that do not match the vendored copies, and the README states vendored sources are unmodified. I fetched the upstream archive at the recorded commit and diffed. Every difference is whitespace from a `forge fmt` pass, so the semantics are identical and nothing reaches the deployed bytecode. The record is still wrong as written, so I reported it with the exact file, line, hashes and reproduction command.\n\nThe findings file carries that one finding plus eight coverage rows: `holds` for all three entry points, and `holds` for five invariants I checked. The existing 30-test suite passes, the committed files pass the format check, and I removed my scratch tests so the tree is unchanged apart from the findings file.","treeHash":null,"usage":{"cachedInputTokens":735751,"inputTokens":354,"model":"claude-fable-5-1","outputTokens":14360,"runtime":"claude","turns":23,"wallClockMs":193911}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"76e5f9ed417094cc","findings":[{"citation":"resolved","description":"Trust-gap / provenance. DEPENDENCIES.json is the project's own record of what was vendored and is the only thing an offline verifier can check lib/ against. For forge-std v1.9.7 (commit 77041d2c), seven of the 29 recorded files have a different SHA-256 in the tree than the record states: src/StdAssertions.sol, src/StdJson.sol, src/StdToml.sol, src/Vm.sol, src/console.sol, src/interfaces/IERC7540.sol, src/interfaces/IMulticall3.sol. Diffing each against the pinned upstream archive (whose sha256 a387f7c2... does match the record) shows the differences are formatting only: multi-line function signatures collapsed onto one line, as `forge fmt` produces. No token, test or semantic content differs, and all six OpenZeppelin files (the only ones that reach deployed bytecode) match exactly. Impact is limited to provenance: README.md line 48 states 'Vendored sources are unmodified', which is false for these seven test-only files, and any reviewer or verifier recomputing the recorded hashes gets seven mismatches and must re-derive by hand that nothing material changed. Deployed bytecode is unaffected. Fix: either restore the seven files byte-for-byte from the pinned archive, or regenerate their sha256 entries and change the README sentence to say forge-std was reformatted.","line":59,"path":"DEPENDENCIES.json","reproduction":"From the repository root run: python3 -c \"import json,hashlib; d=json.load(open('DEPENDENCIES.json')); [print('BAD' if hashlib.sha256(open(f['path'],'rb').read()).hexdigest()!=f['sha256'] else 'OK', f['path']) for dep in d for f in dep['files']]\". Expected: 36 lines of OK. Actual: 29 OK and 7 BAD (the forge-std files listed above). Then `diff -w <upstream 77041d2c src/Vm.sol> lib/forge-std/src/Vm.sol` shows 50 differing lines that all vanish under whitespace-insensitive comparison, i.e. formatting only.","severity":"low","snippet":"        \"path\": \"lib/forge-std/src/StdAssertions.sol\",","title":"DEPENDENCIES.json SHA-256 records do not match seven vendored forge-std files (whitespace-only drift), contradicting README's 'Vendored sources are unmodified'"},{"citation":"resolved","description":"Asymmetry pair approve <-> transferFrom. approve overwrites the allowance unconditionally and transferFrom (line 154-157) spends against whatever value is current at execution time, so the two sides are not atomic with respect to each other. This is the behaviour the ERC-20 standard specifies and OpenZeppelin v5 deliberately removed increaseAllowance/decreaseAllowance, so it is not a defect in INFERToken and the README (lines 96-98) already discloses it with the revoke-then-set mitigation. Recorded here as a trust assumption for holders; no code change is recommended. INFERToken inherits approve unchanged (src/INFERToken.sol line 8).","line":132,"path":"lib/openzeppelin-contracts/contracts/token/ERC20/ERC20.sol","reproduction":"State: victim holds 1000e18 INFER. 1) vm.prank(victim); token.approve(spender, 100e18). 2) victim submits approve(spender, 50e18) intending to lower it; spender sees it in the mempool and first calls transferFrom(victim, spender, 100e18). 3) victim's approve(spender, 50e18) executes. 4) spender calls transferFrom(victim, spender, 50e18). Expected by the victim: at most 100e18 ever spendable. Actual: spender balance is 150e18 (confirmed with a local Foundry test, test_approveRaceSpends150).","severity":"info","snippet":"    function approve(address spender, uint256 value) public virtual returns (bool) {","title":"Standard ERC-20 approve race: a spender can front-run an allowance reduction and spend old plus new allowance"},{"citation":"resolved","description":"Asymmetry between transfer and transferFrom. transfer can only emit Transfer(msg.sender, to, v). transferFrom checks allowance via _spendAllowance (line 305-315): with currentAllowance 0 and value 0 the check `0 < 0` is false, so _approve(from, spender, 0, false) runs and _transfer(from, to, 0) emits Transfer(from, to, 0) with `from` any non-zero address the caller chooses. No balance changes, so there is no loss of funds; the consequence is that indexers, wallets and explorers see Transfer events the named holder never initiated, which is the primitive used in zero-value 'address poisoning' phishing. This is standard OpenZeppelin ERC20 behaviour (every OZ v5 token has it) and the project's own test test_ZeroTransferFromNeedsNoAllowance documents it as intended, so it is informational only. If the requester wants to close it, the only option that keeps the launch flows intact is an _update override that reverts when value == 0 and from != msg.sender and allowance is 0, which is a design decision rather than a fix.","line":156,"path":"lib/openzeppelin-contracts/contracts/token/ERC20/ERC20.sol","reproduction":"State: victim (0xA11CE) holds 1000e18 INFER, attacker (0xBAD) holds nothing and has no allowance. Call: vm.prank(attacker); token.transferFrom(victim, attacker, 0). Expected under a strict 'only an approved spender may act on a holder' reading: revert ERC20InsufficientAllowance. Actual: returns true and emits exactly one log Transfer(0xA11CE, 0xBAD, 0); allowance(victim, attacker) remains 0 and balances are unchanged (confirmed with a local Foundry test, test_zeroValueTransferFromForgesEventForAnyone).","severity":"info","snippet":"        _spendAllowance(from, spender, value);\n        _transfer(from, to, value);","title":"transferFrom with value 0 succeeds for any (from, to) pair without allowance and emits Transfer(from, to, 0), letting anyone forge zero-value Transfer events from a victim"}],"hash":"69ae7c9c322a4cf3aea06ba2f3578498ee93110f497649757f7ac3887d95115d","nodeId":"32ec609a-bd1f-4053-8a6d-517d470429c9","outcome":"completed","summary":"Review complete. The findings file is written, the snippets match the tree line for line, the scratch test is removed, and the working tree has no tracked changes.\n\n**Outcome: no exploitable defect in the assigned area.** INFERToken is a bare OpenZeppelin v5.0.2 ERC20 whose constructor mints the full supply once to msg.sender. It has no owner, roles, modifiers, initializer, proxy, external calls, or forbidden opcodes. The only state-changing entry points are approve, transfer and transferFrom, and each behaves as the standard specifies. All 30 project tests pass.\n\n**What I reported in `.imd-findings.json`:**\n\n- **Low, provenance drift.** Seven forge-std files in lib/ do not match the SHA-256 values recorded in DEPENDENCIES.json. I diffed them against the pinned upstream archive and the differences are formatting only. The six OpenZeppelin files that reach deployed bytecode match exactly. The README's statement that vendored sources are unmodified is therefore inaccurate for those test-only files.\n- **Info, approve race.** A spender can front-run an allowance reduction and spend both the old and the new allowance. This is standard ERC-20 behaviour the README already discloses, recorded as a holder trust assumption.\n- **Info, zero-value transferFrom.** Anyone can call transferFrom with value 0 on any holder and emit a Transfer event in that holder's name. No balance moves. This is standard OpenZeppelin behaviour and the project's own tests treat it as intended.\n\n**Coverage.** All three listed entry points are marked `holds`, with the two informational notes referenced. I added rows for the constructor, the permission model, trust-gap seams, asymmetry pairs, the opcode scan, dependency integrity, and the protected floor. The manifest row is `unreached` because no launch.json exists yet, which the README says is expected at this stage.\n\n**Not executed locally.** The Uniswap v4 seed and swap in the protected test need v4-core, which is not vendored here. I traced those flows by reading instead. A fee-free OpenZeppelin transfer cannot short them.","treeHash":null,"usage":{"cachedInputTokens":662038,"inputTokens":354,"model":"claude-fable-5-1","outputTokens":16019,"runtime":"claude","turns":22,"wallClockMs":255211}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"759c614fdc84ff66","findings":[{"citation":"resolved","description":"DEPENDENCIES.json records per-file SHA-256 hashes for the vendored dependencies, and README.md:48 states 'Vendored sources are unmodified.' Seven forge-std files do not match their recorded hash: src/StdAssertions.sol, src/StdJson.sol, src/StdToml.sol, src/Vm.sol, src/console.sol, src/interfaces/IERC7540.sol and src/interfaces/IMulticall3.sol. I downloaded the recorded archive (its sha256 a387f7c2...24bc3 matches the record) and diffed it against the vendored files. Every difference is whitespace or line wrapping, so it looks like `forge fmt` ran over lib/. For example, StdJson.sol:200 has `serialize(...) internal returns (string memory) {` joined onto one line. After stripping whitespace, each file matches upstream byte for byte. All six OpenZeppelin files, including ERC20.sol, match their recorded hashes, so the deployed token's code is unaffected. The only harm is that a provenance check against this record fails and the README's claim is wrong. The files are test-only, and lib/ may not be modified by workers, so the fix belongs to the author: restore the upstream bytes or update the recorded hashes and the README sentence.","line":112,"path":"DEPENDENCIES.json","reproduction":"From the repo root: `sha256sum lib/forge-std/src/Vm.sol` prints a1b1c82924aecf0f38b53192fd1e801cccc1e1fd2ecd6b2301e4f4c4ab102a15, but DEPENDENCIES.json:112 records 9068805b59ac1d0ea03a8fa1f15ae49c094e0c6c852a2500e0dd112f264b2cb1. Expected: equal. Hashing every entry in DEPENDENCIES.json gives 7 mismatches out of 36, all in forge-std. In each one, `tr -d ' \\n\\t\\r'` of the vendored file equals the same for the upstream file from the recorded archive.","severity":"info","snippet":"        \"sha256\": \"9068805b59ac1d0ea03a8fa1f15ae49c094e0c6c852a2500e0dd112f264b2cb1\"","title":"DEPENDENCIES.json provenance hashes do not match 7 vendored forge-std files (reformatted, contrary to README's 'unmodified' claim)"}],"hash":"7a62c672b52749d14793b0aa7408dca3bb7041c24a53169369bd346a0e44571a","nodeId":"20db09ac-d542-4caa-aaf0-8a2c94377c26","outcome":"completed","summary":"I found no defects in how the INFER token's transfers, approvals and supply work, and nothing that would break the launch. The one finding is informational: some test-library hash records are wrong. The review is in `.imd-findings.json`, and the working tree is unchanged.\n\n**What the token is:** `src/INFERToken.sol` is OpenZeppelin v5.0.2's standard ERC20 with nothing added. Its constructor takes no arguments and mints exactly 1,000,000,000 × 10^18 to whoever deploys it — the factory, in the launch.\n\n**Execution trace:**\n- **`transfer` and `transferFrom`** move exactly the amount asked, with no fee, burn or callback, and revert on a short balance, a zero recipient or a short allowance. So the factory's payment to the distributor, distributor claims, and Uniswap pool deposits and swaps all arrive whole.\n- **`approve`** replaces the allowance and emits `Approval`. It rejects a zero spender or zero owner.\n- **Library code:** the six OpenZeppelin files match their recorded hashes. These are the files the token compiles from.\n\n**Periphery:** besides those three entry points, the token's ABI has nothing that changes state. There is no owner, role, pause, blacklist, extra mint or upgrade path. The compiled runtime contains no `DELEGATECALL`, `CALLCODE` or `SELFDESTRUCT`. The aderyn \"large numeric literal\" warning is just the supply constant, which works out to exactly 10^27; it is not a defect.\n\n**First principles:** the supply can't grow, nobody can move or freeze a holder's balance, and the factory is an ordinary holder once the launch is done.\n\n**Finding 1 (info):** `DEPENDENCIES.json` records the wrong hashes for 7 vendored forge-std files, and the README says those files are unmodified.\n- **Repro:** `sha256sum lib/forge-std/src/Vm.sol` prints `a1b1c829…`, but `DEPENDENCIES.json:112` records `9068805b…`.\n- **Cause:** I diffed them against the recorded upstream archive. The only differences are whitespace and line wrapping, consistent with the formatter having run over `lib/`.\n- **Impact:** only a provenance check against that record fails; the files are test-only and the deployed token is unaffected.\n- **Fix (author's):** restore the upstream bytes, or update the recorded hashes and the README sentence.\n\n**Coverage:** `approve`, `transfer` and `transferFrom` are each marked `holds`. Two invariants are also marked `holds`: the supply is fixed, and no privileged hand can move a balance.\n\n**Not checked:**\n- I couldn't run the launch's protected test locally, because the pool contracts it imports aren't in this repo. My conclusion about the pool steps comes from reading the code, not from running them.\n- The 30 local tests (unit, fuzz and invariant) all pass.","treeHash":null,"usage":{"cachedInputTokens":503950,"inputTokens":22,"model":"claude-opus-5-5","outputTokens":7010,"runtime":"claude","turns":11,"wallClockMs":90809}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"f2101c240e0b52a9","findings":[{"citation":"resolved","description":"README.md states the vendored sources are unmodified and DEPENDENCIES.json records a per-file SHA-256 for every vendored file. The OpenZeppelin files match their records, but seven forge-std files do not: lib/forge-std/src/StdAssertions.sol, StdJson.sol, StdToml.sol, Vm.sol, console.sol, interfaces/IERC7540.sol and interfaces/IMulticall3.sol. Compared against the upstream forge-std v1.9.7 archive the differences are line-wrapping only (long signatures joined onto one line, as `forge fmt` does); the files are byte-identical once all whitespace is stripped, so there is no semantic change and no effect on the token's bytecode. forge-std is test-only and is not part of the deployed artifact. The defect is that the integrity record and the README claim are false for these seven files, so any provenance check that verifies DEPENDENCIES.json hashes offline will fail. Fix: either restore the seven files byte-for-byte from the recorded archive, or regenerate the seven sha256 entries and reword the README claim. Not an economic or safety defect in the token.","line":48,"path":"README.md","reproduction":"From the repository root run: python3 -I -c \"import json,hashlib; d=json.load(open('DEPENDENCIES.json')); [print(f['path']) for dep in d for f in dep['files'] if hashlib.sha256(open(f['path'],'rb').read()).hexdigest()!=f['sha256']]\". Expected: no output (every vendored file matches its recorded hash). Actual: seven paths are printed, all under lib/forge-std/src/. Example: sha256sum lib/forge-std/src/StdAssertions.sol gives 3fbf4a025b4fc94e... while DEPENDENCIES.json line 60 records d4c89eec70d267de..., which is the hash of the upstream v1.9.7 file.","severity":"info","snippet":"forge-std v1.9.7 includes its `src/` tree and MIT/Apache licenses. Vendored sources are unmodified.","title":"Seven vendored forge-std files do not match the SHA-256 values recorded in DEPENDENCIES.json (whitespace reformatting only)"}],"hash":"a829827756262ad1d4780d232709586366ae5000471a766558fa33c9cefef9fb","nodeId":"cabe800d-4460-4424-8fcd-d537afcb78ed","outcome":"completed","summary":"The review is complete and `.imd-findings.json` holds the result. No source files were changed.\n\n**Outcome:** no economic, invariant or flow defect in the token. The one substantiated item is an informational provenance discrepancy in the vendored test library.\n\n**What the token is.** `src/INFERToken.sol` is 16 lines: an unmodified OpenZeppelin v5.0.2 ERC20 whose constructor mints exactly 10^27 minor units to msg.sender and nothing else. The vendored ERC20 matches its recorded upstream hash byte for byte. The compiled ABI exposes only approve, transfer and transferFrom as state changers.\n\n**What I checked against the Economic Security, Invariant and Flow Gap guides:**\n- Every launch leg moves exactly what it says. A scratch Foundry test deployed the token via CREATE2 from a factory stand-in and ran the swarm transfer, pool pull via transferFrom, remainder transfer, a distributor claim, and a buy-then-sell round trip. All balances landed whole and the holder sum equalled supply.\n- Supply cannot grow. A fuzz over arbitrary selectors left total supply and the factory balance unchanged, and the project's own stateful invariant suite passes.\n- Allowance accounting is exact, including the max-uint256 infinite case.\n- The runtime contains no DELEGATECALL, CALLCODE, SELFDESTRUCT, CALL or CREATE, and no receive or fallback, so there are no periphery seams or reentrancy paths.\n- Constructor takes no arguments, so the manifest's constructorArgs will be an empty list and no exemptions are needed.\n- The aderyn large-literal lead is a correct value and was recorded as holding, not reported.\n\n**The one finding (info):** README.md states vendored sources are unmodified and DEPENDENCIES.json records per-file hashes, but seven forge-std files differ from their recorded hashes. Compared to the upstream v1.9.7 archive the differences are line-wrapping only and the files are identical once whitespace is stripped. forge-std is test-only, so there is no effect on deployed bytecode, but an offline hash check against DEPENDENCIES.json fails. The reproduction command is in the finding.\n\n**Coverage:** all three listed entry points are marked holds with reasons, plus five invariant rows covering the constructor, supply conservation, launch flow exactness, runtime opcodes and dependency integrity.\n\n**Not verified:** the README names Ethereum chain ID 1 as the launch chain while the paired currency is the IMD token. I could not confirm which chain IMD lives on, and chain is not a manifest or token field, so this is noted here rather than reported. The protected launch test itself could not be run locally because its v4-core and LaunchLiquidity dependencies are not in this tree.","treeHash":null,"usage":{"cachedInputTokens":899691,"inputTokens":386,"model":"claude-fable-5-1","outputTokens":15714,"runtime":"claude","turns":28,"wallClockMs":248919}},{"artifacts":[],"attempt":1,"bundleHash":"1ef325bf20af5aada1fa3f0f710483b93a21c6ec653e69859f660ef9880c91fa","device":"bfffb5246a55ee5d","findings":[],"hash":"e524132b24d209f54cd84027c26033c4cb7cdbceb433219c9c29ed100a5320d0","nodeId":"f2f06d9e-4084-4757-ad15-4117eb4b969f","outcome":"completed","summary":"Implemented INFER with the exact name, symbol, and 18 decimals. All 1,000,000,000 tokens mint once to the deployer; no later minting or administrative controls.\n\nDependencies are vendored for offline use. README documents deployment parameters, assumptions, and operational responsibilities.\n\nVerification passed:\n- `forge build`\n- `forge test`: 30 tests, including fuzz and invariant checks\n- `forge fmt --check`","treeHash":"39d989c3e84aba2c3d23d35120a3193bf2fc505f","usage":{"cachedInputTokens":359552,"inputTokens":58649,"model":"gpt-6-astra","outputTokens":13374,"runtime":"codex","turns":5,"wallClockMs":379853}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"7c748c02cd2ee98f","findings":[{"citation":"resolved","description":"Merged from four specialist reports (audit_math, audit_flow, audit_permissions, audit_economics): same root cause, one finding. DEPENDENCIES.json is the project's only offline integrity record for lib/, and README.md line 48 states 'Vendored sources are unmodified.' Seven of the 29 recorded forge-std v1.9.7 files hash differently in the tree than the record states: lib/forge-std/src/StdAssertions.sol, StdJson.sol, StdToml.sol, Vm.sol, console.sol, interfaces/IERC7540.sol and interfaces/IMulticall3.sol. I reproduced this independently: the pinned archive (commit 77041d2c) downloads with sha256 a387f7c2...b24bc3, matching the recorded archiveSha256, and the recorded per-file hashes are the upstream file hashes. Each of the seven vendored copies differs from upstream only in whitespace and line wrapping (forge fmt style): `diff -w` reports 5 to 50 changed lines per file and every file is byte-identical to upstream once whitespace is stripped. Impact: none on the deployed token. All six vendored OpenZeppelin v5.0.2 files, including ERC20.sol which is the only vendored code reaching INFERToken's bytecode, are byte-identical to the pinned archive (dbb6104c, archive sha256 4a9c0918...f385 matches the record). forge-std is test-only. The defect is that the integrity record is false as written and the README claim is wrong, so anyone running the recorded hash check offline gets seven failures and has to re-derive by hand that nothing material changed. Fix (author's, since lib/ is not a worker write path): either restore the seven files byte-for-byte from the pinned archive, or regenerate those seven sha256 entries and change the README sentence to say forge-std was reformatted.","line":60,"path":"DEPENDENCIES.json","reproduction":"From the repository root run: python3 -I -c \"import json,hashlib; d=json.load(open('DEPENDENCIES.json')); [print('BAD' if hashlib.sha256(open(f['path'],'rb').read()).hexdigest()!=f['sha256'] else 'OK', f['path']) for dep in d for f in dep['files']]\". Expected: 36 lines of OK. Actual: 29 OK and 7 BAD, all under lib/forge-std/src/. Example: sha256sum lib/forge-std/src/StdAssertions.sol prints 3fbf4a025b4fc94eaca4c38c1f3dacb37bee10f12ee81994cfaf365ac1ce7384 while DEPENDENCIES.json line 60 records d4c89eec70d267dec6188461fbc74d3dc8c47e518d176a23417533a232ed9780; sha256sum lib/forge-std/src/Vm.sol prints a1b1c82924aecf0f38b53192fd1e801cccc1e1fd2ecd6b2301e4f4c4ab102a15 while line 112 records 9068805b59ac1d0ea03a8fa1f15ae49c094e0c6c852a2500e0dd112f264b2cb1. Then download https://codeload.github.com/foundry-rs/forge-std/tar.gz/77041d2ce690e692d6e03cc812b57d1ddaa4d505 (sha256 a387f7c2a10387f889b0d18b999cfa667a5273ac11cc11e18923022eb8b24bc3, equal to the recorded archiveSha256), extract it into an empty directory, and for each of the seven files compare `tr -d ' \\n\\t\\r'` of the upstream file with the same of the vendored file: all seven are equal, and `sha256sum` of each upstream file equals the value DEPENDENCIES.json records. So the record describes upstream bytes, the tree holds reformatted bytes, and README.md line 48 ('Vendored sources are unmodified.') is false for these seven test-only files.","severity":"low","snippet":"        \"sha256\": \"d4c89eec70d267dec6188461fbc74d3dc8c47e518d176a23417533a232ed9780\"","title":"DEPENDENCIES.json SHA-256 records do not match seven vendored forge-std files (whitespace-only reformatting), so the README's 'Vendored sources are unmodified' claim and the offline provenance check b"}],"hash":"e8daeaa638844f9182179e766b68f1b74c784a057e250051e14b608c98884c1b","nodeId":"3557cf89-7ec4-4ccc-8928-58c0c357d022","outcome":"completed","summary":"The review is complete. The findings file is written at the repository root and nothing else in the tree changed.\n\n**Outcome.** The token is a bare OpenZeppelin v5.0.2 ERC20 whose parameterless constructor mints 10^27 units once to the deployer. I kept one finding, at low severity, and dropped or recorded the rest as trust assumptions.\n\n**What I verified**\n- All three entry points hold. The inherited approve, transfer and transferFrom have no override, no owner, no hook, no external call, and no mint, burn, pause or freeze path.\n- Build, all 41 project tests, and the formatter check pass.\n- The manifest in launch.json matches the code: empty constructor arguments, supply equal to the minted amount, 18 decimals, only schema keys, lowercase addresses, and bytecode far under the size limits.\n- The six vendored OpenZeppelin files, the only vendored code that reaches deployed bytecode, are byte-identical to the pinned upstream archive. I downloaded the archive and compared it directly.\n\n**The one finding kept (low).** All four specialists reported the same root cause, so I merged them. Seven forge-std files in lib/ are whitespace-reformatted relative to the hashes DEPENDENCIES.json records, and the README's claim that vendored sources are unmodified is therefore false. I reproduced it independently: the recorded archive hash matches upstream, the recorded per-file hashes are the upstream hashes, and each drifted file equals upstream once whitespace is stripped. forge-std is test-only, so deployed bytecode is unaffected. The fix belongs to the author: restore the seven files from the pinned archive, or re-record their hashes and amend the README sentence.\n\n**Dropped as non-defects.** The approve race and the zero-value transferFrom event are standard ERC-20 behaviour that the README and tests already document. I noted both in the coverage rows as trust assumptions rather than findings. One stale sentence in the README says the project does not include a launch.json, though the manifest step has since added one. I left that out of the findings as it has no effect on deployment.","treeHash":null,"usage":{"cachedInputTokens":753859,"inputTokens":386,"model":"claude-fable-5-1","outputTokens":10012,"runtime":"claude","turns":13,"wallClockMs":166513}},{"artifacts":[],"attempt":1,"bundleHash":"100f9fdc2fe4f7c73c3cc750fb4e9cb3ceec6653fb9f7fc5e34f3180e7c5db43","device":"2b4e97bb63195f54","findings":[],"hash":"fb5a24daed24ec8a8dcb96acfecb81ae280c1d41108d72b20e30657fd559aa80","nodeId":"f2e89430-2958-451d-87ce-c9613e9908da","outcome":"completed","summary":"Added 11 tests and strengthened invariants for balance conservation, allowance isolation, authorization failures, and rollback.\n\n`forge build` and `forge test` pass offline: 40 unit/fuzz tests plus 32,768 invariant handler calls.\n\nOnly `test/` changed. No implementation defects found.","treeHash":"59b783cb9d9c813cafee9d15f93f7970f705bf0e","usage":{"cachedInputTokens":473472,"inputTokens":68995,"model":"gpt-6-astra","outputTokens":9395,"runtime":"codex","turns":5,"wallClockMs":272362}}],"verification":[{"checks":[{"durationMs":1120,"exitCode":0,"name":"build","output":"Compiling 27 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.02s\nCompiler run successful!\n","passed":true},{"durationMs":611,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 29 tests for test/INFERToken.t.sol:INFERTokenTest\n[PASS] testFuzz_DelegatedTransfersRespectAllowance(uint256,uint256) (runs: 512, μ: 149216, ~: 161248)\nLogs:\n  Bound result 104192261967724352813\n\n[PASS] testFuzz_TransferAboveBalanceReverts(uint256) (runs: 512, μ: 58362, ~: 58285)\nLogs:\n  Bound result 4093169745540440579022455758166109277701537625703545\n\n[PASS] testFuzz_TransferConservesSupply(uint256) (runs: 512, μ: 187498, ~: 188098)\nLogs:\n  Bound result 754072939532161097046681090\n\n[PASS] test_ApproveEmitsEventAndReplacesAllowance() (gas: 119313)\n[PASS] test_ApproveRejectsZeroSpender() (gas: 37550)\n[PASS] test_ConstructorEmitsExactlyOneMint() (gas: 9675)\n[PASS] test_Create2FactoryReceivesSupplyAndCanDistributeExactly() (gas: 670682)\n[PASS] test_DirectDeploymentMintsToImmediateCaller() (gas: 32759)\n[PASS] test_FormerDeployerCannotSpendHolderBalanceWithoutApproval() (gas: 145725)\n[PASS] test_MaxAllowanceIsNotDecreased() (gas: 210352)\n[PASS] test_MetadataAndInitialSupply() (gas: 111826)\n[PASS] test_NoMintBurnFreezeOrUpgradeEntryPoints() (gas: 618015)\n[PASS] test_RejectsNativeCurrency() (gas: 40105)\n[PASS] test_RevocationPreventsFurtherSpending() (gas: 120702)\n[PASS] test_SelfTransferFromConsumesAllowanceWithoutChangingBalance() (gas: 103654)\n[PASS] test_SelfTransferPreservesBalance() (gas: 53948)\n[PASS] test_SelfTransferStillRequiresSufficientBalance() (gas: 35863)\n[PASS] test_TransferEmitsEventAndMovesExactAmount() (gas: 93539)\n[PASS] test_TransferEntireSupply() (gas: 75777)\n[PASS] test_TransferFromExhaustsAllowance() (gas: 162027)\n[PASS] test_TransferFromRejectsInsufficientAllowanceAndPreservesState() (gas: 116136)\n[PASS] test_TransferFromRejectsInsufficientBalanceAndRollsBackAllowance() (gas: 126573)\n[PASS] test_TransferFromRejectsZeroRecipientAndRollsBackAllowance() (gas: 104231)\n[PASS] test_TransferFromRejectsZeroSenderEvenForZeroAmount() (gas: 35385)\n[PASS] test_TransferFromSpendsFiniteAllowanceAndEmitsTransfer() (gas: 172994)\n[PASS] test_TransferRejectsInsufficientBalanceWithoutChangingState() (gas: 120402)\n[PASS] test_TransferRejectsZeroRecipientIncludingZeroAmount() (gas: 71926)\n[PASS] test_ZeroTransferFromEmptyAccountEmitsEvent() (gas: 73332)\n[PASS] test_ZeroTransferFromNeedsNoAllowance() (gas: 81490)\nSuite result: ok. 29 passed; 0 failed; 0 skipped; finished in 26.63ms (71.35ms CPU time)\n\nRan 1 test for test/INFERToken.invariant.t.sol:INFERTokenInvariantTest\n[PASS] invariant_SupplyIsFixedAndAllBalancesAreConserved() (runs: 128, calls: 8192, reverts: 0)\n\n╭--------------+--------------+-------+---------+----------╮\n| Contract     | Selector     | Calls | Reverts | Discards |\n+==========================================================+\n| TokenHandler | approve      | 2712  | 0       | 0        |\n|--------------+--------------+-------+---------+----------|\n| TokenHandler | transfer     | 2777  | 0       | 0        |\n|--------------+--------------+-------+---------+----------|\n| TokenHandler | transferFrom | 2703  | 0       | 0        |\n╰--------------+--------------+-------+---------+----------╯\n\nLogs:\n  Bound result 5307\n  Bound result 874\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 1427\n  Bound result 5827175455377526120244610\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 994172824544622473879755390\n  Bound result 257658098799143231711212107\n  Bound result 0\n  Bound result 3\n  Bound result 0\n  Bound result 227025703602570304866363685\n  Bound result 6\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 257658098799143231711212104\n  Bound result 5071\n  Bound result 0\n  Bound result 0\n  Bound result 2\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 8\n  Bound result 394\n  Bound result 8\n  Bound result 0\n  Bound result 1000000000\n  Bound result 5100144530207735052638496\n  Bound result 588623873556164288332607\n  Bound result 262\n  Bound result 1294\n  Bound result 240124517686413820777771\n  Bound result 1000000000\n  Bound result 0\n  Bound result 8\n  Bound result 0\n  Bound result 1249\n  Bound result 10905737548821645663076\n  Bound result 5\n  Bound result 0\n  Bound result 3320\n  Bound result 40\n  Bound result 695807678656299218530778\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 517.98ms (516.76ms CPU time)\n\nRan 2 test suites in 521.90ms (544.61ms CPU time): 30 tests passed, 0 failed, 0 skipped (30 total tests)\n","passed":true},{"durationMs":57,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"INFERToken.approve(address,uint256)\",\"INFERToken.transfer(address,uint256)\",\"INFERToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"DEPENDENCIES.json\":164,\"README.md\":111,\"foundry.toml\":18,\"launch.json\":24,\"remappings.txt\":2,\"src/INFERToken.sol\":16,\"test/INFERToken.invariant.t.sol\":74,\"test/INFERToken.t.sol\":385},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"09ce196302c247db29addc18e5c5c50b98ad382d5918ac2d7dde7e64264bc92e","verifiedTreeHash":"5e1102fc10f9c442895ada5495761012cc1ed7bb","verifierVersion":"0.1.0+0e08a464"},{"checks":[{"durationMs":1100,"exitCode":0,"name":"build","output":"Compiling 27 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.01s\nCompiler run successful!\n","passed":true},{"durationMs":552,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 29 tests for test/INFERToken.t.sol:INFERTokenTest\n[PASS] testFuzz_DelegatedTransfersRespectAllowance(uint256,uint256) (runs: 512, μ: 149172, ~: 161248)\nLogs:\n  Bound result 428038472658283620696087880\n\n[PASS] testFuzz_TransferAboveBalanceReverts(uint256) (runs: 512, μ: 58348, ~: 58285)\nLogs:\n  Bound result 1\n\n[PASS] testFuzz_TransferConservesSupply(uint256) (runs: 512, μ: 187622, ~: 188098)\nLogs:\n  Bound result 2780369484715\n\n[PASS] test_ApproveEmitsEventAndReplacesAllowance() (gas: 119313)\n[PASS] test_ApproveRejectsZeroSpender() (gas: 37550)\n[PASS] test_ConstructorEmitsExactlyOneMint() (gas: 9675)\n[PASS] test_Create2FactoryReceivesSupplyAndCanDistributeExactly() (gas: 670682)\n[PASS] test_DirectDeploymentMintsToImmediateCaller() (gas: 32759)\n[PASS] test_FormerDeployerCannotSpendHolderBalanceWithoutApproval() (gas: 145725)\n[PASS] test_MaxAllowanceIsNotDecreased() (gas: 210352)\n[PASS] test_MetadataAndInitialSupply() (gas: 111826)\n[PASS] test_NoMintBurnFreezeOrUpgradeEntryPoints() (gas: 618015)\n[PASS] test_RejectsNativeCurrency() (gas: 40105)\n[PASS] test_RevocationPreventsFurtherSpending() (gas: 120702)\n[PASS] test_SelfTransferFromConsumesAllowanceWithoutChangingBalance() (gas: 103654)\n[PASS] test_SelfTransferPreservesBalance() (gas: 53948)\n[PASS] test_SelfTransferStillRequiresSufficientBalance() (gas: 35863)\n[PASS] test_TransferEmitsEventAndMovesExactAmount() (gas: 93539)\n[PASS] test_TransferEntireSupply() (gas: 75777)\n[PASS] test_TransferFromExhaustsAllowance() (gas: 162027)\n[PASS] test_TransferFromRejectsInsufficientAllowanceAndPreservesState() (gas: 116136)\n[PASS] test_TransferFromRejectsInsufficientBalanceAndRollsBackAllowance() (gas: 126573)\n[PASS] test_TransferFromRejectsZeroRecipientAndRollsBackAllowance() (gas: 104231)\n[PASS] test_TransferFromRejectsZeroSenderEvenForZeroAmount() (gas: 35385)\n[PASS] test_TransferFromSpendsFiniteAllowanceAndEmitsTransfer() (gas: 172994)\n[PASS] test_TransferRejectsInsufficientBalanceWithoutChangingState() (gas: 120402)\n[PASS] test_TransferRejectsZeroRecipientIncludingZeroAmount() (gas: 71926)\n[PASS] test_ZeroTransferFromEmptyAccountEmitsEvent() (gas: 73332)\n[PASS] test_ZeroTransferFromNeedsNoAllowance() (gas: 81490)\nSuite result: ok. 29 passed; 0 failed; 0 skipped; finished in 12.76ms (37.57ms CPU time)\n\nRan 1 test for test/INFERToken.invariant.t.sol:INFERTokenInvariantTest\n[PASS] invariant_SupplyIsFixedAndAllBalancesAreConserved() (runs: 128, calls: 8192, reverts: 0)\n\n╭--------------+--------------+-------+---------+----------╮\n| Contract     | Selector     | Calls | Reverts | Discards |\n+==========================================================+\n| TokenHandler | approve      | 2748  | 0       | 0        |\n|--------------+--------------+-------+---------+----------|\n| TokenHandler | transfer     | 2692  | 0       | 0        |\n|--------------+--------------+-------+---------+----------|\n| TokenHandler | transferFrom | 2752  | 0       | 0        |\n╰--------------+--------------+-------+---------+----------╯\n\nLogs:\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 1000000000000000000000000000\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 8\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 3\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 343\n  Bound result 1256\n  Bound result 238\n  Bound result 0\n  Bound result 9\n  Bound result 4\n  Bound result 699\n  Bound result 7\n  Bound result 47\n  Bound result 284\n  Bound result 4757\n  Bound result 947155366187347968624406052\n  Bound result 4608\n  Bound result 1060\n  Bound result 264\n  Bound result 0\n  Bound result 0\n  Bound result 84\n  Bound result 805642994\n  Bound result 0\n  Bound result 6\n  Bound result 18\n  Bound result 1491\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 477.73ms (476.60ms CPU time)\n\nRan 2 test suites in 478.92ms (490.49ms CPU time): 30 tests passed, 0 failed, 0 skipped (30 total tests)\n","passed":true},{"durationMs":40,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"INFERToken.approve(address,uint256)\",\"INFERToken.transfer(address,uint256)\",\"INFERToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"DEPENDENCIES.json\":164,\"README.md\":111,\"foundry.toml\":18,\"remappings.txt\":2,\"src/INFERToken.sol\":16,\"test/INFERToken.invariant.t.sol\":74,\"test/INFERToken.t.sol\":385},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true},{"durationMs":403,"exitCode":0,"name":"slither","output":"slither: no results at low impact or above","passed":true},{"durationMs":261,"exitCode":0,"name":"aderyn","output":"[low] large-numeric-literal at src/INFERToken.sol:10: Large Numeric Literal","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"e524132b24d209f54cd84027c26033c4cb7cdbceb433219c9c29ed100a5320d0","verifiedTreeHash":"39d989c3e84aba2c3d23d35120a3193bf2fc505f","verifierVersion":"0.1.0+0e08a464"},{"checks":[{"durationMs":1356,"exitCode":0,"name":"build","output":"Compiling 28 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.26s\nCompiler run successful!\n","passed":true},{"durationMs":8533,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 11 tests for test/INFERToken.properties.t.sol:INFERTokenPropertiesTest\n[PASS] testFuzz_ApprovalSurvivesEmptyBalanceAndCanBeUsedAfterRefill(uint256,bool) (runs: 1000, μ: 373785, ~: 373827)\nLogs:\n  Bound result 10\n\n[PASS] testFuzz_ApprovalsAreScopedToOwnerAndSpender(uint256,uint256) (runs: 1000, μ: 427647, ~: 428418)\nLogs:\n  Bound result 8419146401767545288554132\n\n[PASS] testFuzz_ReplacingUnlimitedAllowanceEnforcesNewLimit(uint256) (runs: 1000, μ: 252158, ~: 252697)\nLogs:\n  Bound result 1000000000000000000\n\n[PASS] testFuzz_SplitTransfersEqualCombinedTransferAndRoundTrip(uint256,uint256) (runs: 1000, μ: 322727, ~: 324092)\nLogs:\n  Bound result 1490\n  Bound result 1243\n\n[PASS] test_AllowanceBelongsToCallerNotTransactionOrigin() (gas: 237026)\n[PASS] test_CompetingSpendersCannotSpendTheSameBalanceTwice() (gas: 264378)\n[PASS] test_MaxUintMinusOneApprovalIsFinite() (gas: 207511)\n[PASS] test_MaxUintTransferCannotWrapOrBypassBalanceCheck() (gas: 192173)\n[PASS] test_OneWeiRoundTripRestoresBalances() (gas: 151914)\n[PASS] test_RevokingUnlimitedApprovalAfterUsePreventsFurtherSpending() (gas: 203465)\n[PASS] test_TransferFromByOwnerStillRequiresSelfApproval() (gas: 200481)\nSuite result: ok. 11 passed; 0 failed; 0 skipped; finished in 66.55ms (257.93ms CPU time)\n\nRan 29 tests for test/INFERToken.t.sol:INFERTokenTest\n[PASS] testFuzz_DelegatedTransfersRespectAllowance(uint256,uint256) (runs: 512, μ: 148966, ~: 161236)\nLogs:\n  Bound result 1000000000000000000000000000\n\n[PASS] testFuzz_TransferAboveBalanceReverts(uint256) (runs: 512, μ: 58366, ~: 58285)\nLogs:\n  Bound result 386647904489662884835266094357557373871836\n\n[PASS] testFuzz_TransferConservesSupply(uint256) (runs: 512, μ: 187122, ~: 188098)\nLogs:\n  Bound result 884835266093970909469382174\n\n[PASS] test_ApproveEmitsEventAndReplacesAllowance() (gas: 119313)\n[PASS] test_ApproveRejectsZeroSpender() (gas: 37550)\n[PASS] test_ConstructorEmitsExactlyOneMint() (gas: 9675)\n[PASS] test_Create2FactoryReceivesSupplyAndCanDistributeExactly() (gas: 670682)\n[PASS] test_DirectDeploymentMintsToImmediateCaller() (gas: 32759)\n[PASS] test_FormerDeployerCannotSpendHolderBalanceWithoutApproval() (gas: 145725)\n[PASS] test_MaxAllowanceIsNotDecreased() (gas: 210352)\n[PASS] test_MetadataAndInitialSupply() (gas: 111826)\n[PASS] test_NoMintBurnFreezeOrUpgradeEntryPoints() (gas: 618015)\n[PASS] test_RejectsNativeCurrency() (gas: 40105)\n[PASS] test_RevocationPreventsFurtherSpending() (gas: 120702)\n[PASS] test_SelfTransferFromConsumesAllowanceWithoutChangingBalance() (gas: 103654)\n[PASS] test_SelfTransferPreservesBalance() (gas: 53948)\n[PASS] test_SelfTransferStillRequiresSufficientBalance() (gas: 35863)\n[PASS] test_TransferEmitsEventAndMovesExactAmount() (gas: 93539)\n[PASS] test_TransferEntireSupply() (gas: 75777)\n[PASS] test_TransferFromExhaustsAllowance() (gas: 162027)\n[PASS] test_TransferFromRejectsInsufficientAllowanceAndPreservesState() (gas: 116136)\n[PASS] test_TransferFromRejectsInsufficientBalanceAndRollsBackAllowance() (gas: 126573)\n[PASS] test_TransferFromRejectsZeroRecipientAndRollsBackAllowance() (gas: 104231)\n[PASS] test_TransferFromRejectsZeroSenderEvenForZeroAmount() (gas: 35385)\n[PASS] test_TransferFromSpendsFiniteAllowanceAndEmitsTransfer() (gas: 172994)\n[PASS] test_TransferRejectsInsufficientBalanceWithoutChangingState() (gas: 120402)\n[PASS] test_TransferRejectsZeroRecipientIncludingZeroAmount() (gas: 71926)\n[PASS] test_ZeroTransferFromEmptyAccountEmitsEvent() (gas: 73332)\n[PASS] test_ZeroTransferFromNeedsNoAllowance() (gas: 81490)\nSuite result: ok. 29 passed; 0 failed; 0 skipped; finished in 66.57ms (156.97ms CPU time)\n\nRan 1 test for test/INFERToken.invariant.t.sol:INFERTokenInvariantTest\n[PASS]\nINFERTokenInvariantTest invariants:\n[PASS] invariant_AllowancesAreIsolatedAndMatchAuthorizedSpending\n[PASS] invariant_EachActorOwnsExactlyItsExpectedBalance\n[PASS] invariant_SupplyIsFixedAndAllBalancesAreConserved\n INFERTokenInvariantTest invariants (runs: 256, calls: 32768, reverts: 0)\n\n╭--------------+----------------------------+-------+---------+----------╮\n| Contract     | Selector                   | Calls | Reverts | Discards |\n+========================================================================+\n| TokenHandler | approve                    | 4081  | 0       | 0        |\n|--------------+----------------------------+-------+---------+----------|\n| TokenHandler | rejectZeroAddresses        | 4142  | 0       | 0        |\n|--------------+----------------------------+-------+---------+----------|\n| TokenHandler | revoke                     | 4057  | 0       | 0        |\n|--------------+----------------------------+-------+---------+----------|\n| TokenHandler | transfer                   | 4015  | 0       | 0        |\n|--------------+----------------------------+-------+---------+----------|\n| TokenHandler | transferAboveBalance       | 4096  | 0       | 0        |\n|--------------+----------------------------+-------+---------+----------|\n| TokenHandler | transferFrom               | 4128  | 0       | 0        |\n|--------------+----------------------------+-------+---------+----------|\n| TokenHandler | transferFromAboveAllowance | 4153  | 0       | 0        |\n|--------------+----------------------------+-------+---------+----------|\n| TokenHandler | transferFromAboveBalance   | 4096  | 0       | 0        |\n╰--------------+----------------------------+-------+---------+----------╯\n\nLogs:\n  Bound result 0\n  Bound result 1132680853797284227506895281747564676379145864724956714293725682235707397\n  Bound result 7\n  Bound result 1\n  Bound result 0\n  Bound result 778183282049772287139244967\n  Bound result 1000000000\n  Bound result 601114697931383369310997543098699085590773395149209058326403520194\n  Bound result 10\n  Bound result 0\n  Bound result 6\n  Bound result 0\n  Bound result 6969\n  Bound result 211\n  Bound result 8\n  Bound result 2262850\n  Bound result 2\n  Bound result 7580\n  Bound result 211801473\n  Bound result 5624\n  Bound result 2\n  Bound result 2625\n  Bound result 2669\n  Bound result 8\n  Bound result 3\n  Bound result 0\n  Bound result 464\n  Bound result 6212\n  Bound result 6968\n  Bound result 43549861187402225722634379384394955441501791578426176912160970902676\n  Bound result 6969\n  Bound result 5262\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 3132\n  Bound result 8\n  Bound result 5519\n  Bound result 0\n  Bound result 4777\n  Bound result 0\n  Bound result 2055\n  Bound result 2131\n  Bound result 999999999999999999999987769\n  Bound result 0\n  Bound result 132\n  Bound result 323413861860185385721055490362536052790040579807815\n  Bound result 0\n  Bound result 2\n  Bound result 459\n  Bound result 0\n  Bound result 10\n  Bound result 6\n  Bound result 10\n  Bound result 0\n  Bound result 4000000000000000000\n  Bound result 161\n  Bound result 100\n  Bound result 8\n  Bound result 1713276529877507\n  Bound result 38224088\n  Bound result 280\n  Bound result 3\n  Bound result 0\n  Bound result 0\n  Bound result 1211\n  Bound result 28720613638235501308887923\n  Bound result 5007\n  Bound result 7\n  Bound result 4\n  Bound result 4202047188\n  Bound result 100\n  Bound result 1766\n  Bound result 349\n  Bound result 5523\n  Bound result 13\n  Bound result 4988\n  Bound result 1000000000000000000000000000\n  Bound result 994\n  Bound result 2751\n  Bound result 447301751254033913445893214690834296930546521452\n  Bound result 0\n  Bound result 4258\n  Bound result 1000000000\n  Bound result 0\n  Bound result 115792089237316195423570985008687907853269984665640564039457584007913129639933\n  Bound result 6000000000000000000\n  Bound result 1000000000000000000000000000\n  Bound result 11\n  Bound result 6359\n  Bound result 4\n  Bound result 0\n  Bound result 22560012360\n  Bound result 4169\n  Bound result 7372\n  Bound result 10\n  Bound result 3\n  Bound result 10\n  Bound result 2269819\n  Bound result 641\n  Bound result 6849\n  Bound result 836\n  Bound result 2871\n  Bound result 306\n  Bound result 235\n  Bound result 40\n  Bound result 86750974708881458966052903488200594946289985567348181342327\n  Bound result 40\n  Bound result 7447\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 8.46s (8.45s CPU time)\n\nRan 3 test suites in 8.46s (8.59s CPU time): 41 tests passed, 0 failed, 0 skipped (41 total tests)\n","passed":true},{"durationMs":32,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"INFERToken.approve(address,uint256)\",\"INFERToken.transfer(address,uint256)\",\"INFERToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"DEPENDENCIES.json\":164,\"README.md\":111,\"foundry.toml\":18,\"remappings.txt\":2,\"src/INFERToken.sol\":16,\"test/INFERToken.invariant.t.sol\":191,\"test/INFERToken.properties.t.sol\":240,\"test/INFERToken.t.sol\":385},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"fb5a24daed24ec8a8dcb96acfecb81ae280c1d41108d72b20e30657fd559aa80","verifiedTreeHash":"59b783cb9d9c813cafee9d15f93f7970f705bf0e","verifierVersion":"0.1.0+0e08a464"}]}