{"assessments":[],"deployments":[],"fuzz":[],"identity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"interpretation":"Records acceptance and evidence. Neither completion nor an AI assessment establishes correctness, safety, or independent review.","jobId":"d6a320ef-6cb3-4053-a083-e428afba3b36","kind":"shape:chain","nodes":[{"acceptedSubmissionHash":"8819e8350dd10ab6d366e62c925a27edbd396ea3b71a42b12c41392f52273673","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_economics","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"85715916bf6402503d625f3b6793d1b24b1363949ed89128a49bb38581390830","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_flow","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"16facd0187baa3e75a45bcf0795e734174e5f393caab5b77955b05ff11527540","dependsOn":["build_contract_project","write_foundry_tests","manifest","audit_math","audit_permissions","audit_economics","audit_flow"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"af3aa01159bbf354f621cafa5c0006f6169e0938a8b015be508b7377dbf165bc","skillId":"audit-judge","tools":[]},"key":"audit_judge","kind":"code","role":"review","skillHash":"af3aa01159bbf354f621cafa5c0006f6169e0938a8b015be508b7377dbf165bc","skillId":"audit-judge","state":"accepted"},{"acceptedSubmissionHash":"8eceaf2125e884974ff864c4d204b985434378dc0469fc9ec3480d8304b70467","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_math","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"aa837ef1928cfb76bacc15bfe043ad7afe809f3b6583c8216eedd7e8c6f4c595","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_permissions","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"09b125ef277e5b27cfce1934fe6e5fe546426e6f8d9cca31220336e7cccc6ad3","dependsOn":[],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"d59561da3b378461b7c749f6bd5084477d44993aa94972ddea90f542535751df","skillId":"build-contract-project","tools":[]},"key":"build_contract_project","kind":"code","role":"implement","skillHash":"d59561da3b378461b7c749f6bd5084477d44993aa94972ddea90f542535751df","skillId":"build-contract-project","state":"accepted"},{"acceptedSubmissionHash":"d764e7af62738d4cc83fdc56c13539a1cdacb9c27ef54dfc98892068a43801fb","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"tools":[]},"key":"manifest","kind":"code","role":"integrate","skillHash":null,"skillId":null,"state":"accepted"},{"acceptedSubmissionHash":"da6369bd9c2a6e42a4658af70e0ace0bec31f7f2cf3d88ea9123c9d12eb961cc","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"4c76766b00591dfe982fe85d3de589fdb2f810e5137c301155d1c5e36a1d3b23","skillId":"write-foundry-tests","tools":[]},"key":"write_foundry_tests","kind":"code","role":"tests","skillHash":"4c76766b00591dfe982fe85d3de589fdb2f810e5137c301155d1c5e36a1d3b23","skillId":"write-foundry-tests","state":"accepted"}],"objective":"A custom token: Sooth Protocol (SOOTH).\nToken name: Sooth Protocol\nToken symbol: SOOTH\nToken supply: 1,000,000,000 with 18 decimals, all minted once to the deployer in the constructor.","parentJobId":null,"planHash":"a0db692b424a266da78ee523c7751d094f7730b096ec4a51b915443e2a3d3279","previousHash":"0000000000000000000000000000000000000000000000000000000000000000","projectId":"d6a320ef-6cb3-4053-a083-e428afba3b36","publication":{"commit":null,"deliveredAt":null,"repoUrl":"https://github.com/identity-md-launches/launch-2386-sooth-protocol"},"receiptIdentity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"registry":"0xb6d0a187b050fa5bb0b87033a203f37becf4a775","research":[],"schema":"identitymd-work-v1","signals":[{"agentId":"51027","feedbackHash":"61c862df140d6ae4d8e9c36832b67133d230cbd62c04e41d2bc37a260c70e257","nodeKey":"audit_economics","submissionHash":"8819e8350dd10ab6d366e62c925a27edbd396ea3b71a42b12c41392f52273673","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52678","feedbackHash":"91389a401c604640db67ccb37a1a78ff4f34d76cade7a6e7d9f4f93202ffcd47","nodeKey":"audit_flow","submissionHash":"85715916bf6402503d625f3b6793d1b24b1363949ed89128a49bb38581390830","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52290","feedbackHash":"437dfaf5e3b42a8f49f89d2b0d1947e608515c33ee2b848c280c5504eb17ba66","nodeKey":"audit_judge","submissionHash":"16facd0187baa3e75a45bcf0795e734174e5f393caab5b77955b05ff11527540","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51534","feedbackHash":"ffca633fc621a2e55c920ef4d64926853d0676708d91d018ea8b361ff34d16cb","nodeKey":"audit_math","submissionHash":"8eceaf2125e884974ff864c4d204b985434378dc0469fc9ec3480d8304b70467","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51163","feedbackHash":"9ccdcf7959f4d4a9b05a58ab57f6eeb3859f42fffcd174f3dc2d4ebc9f380469","nodeKey":"audit_permissions","submissionHash":"aa837ef1928cfb76bacc15bfe043ad7afe809f3b6583c8216eedd7e8c6f4c595","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52147","feedbackHash":"ebb6a1399d2601abb2e34c25dbcb35c8ae9ea9454ad7ab6b7c93ae0823b8458f","nodeKey":"build_contract_project","submissionHash":"09b125ef277e5b27cfce1934fe6e5fe546426e6f8d9cca31220336e7cccc6ad3","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"51598","feedbackHash":"13f77b28ee68754049cfec8e27d03bae1df38d4f1b4f67dbcde0c03a20155327","nodeKey":"manifest","submissionHash":"d764e7af62738d4cc83fdc56c13539a1cdacb9c27ef54dfc98892068a43801fb","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"51186","feedbackHash":"1017675e6187cac7e28a986a2d542d388614b2e9228b0fef492806bc34ff3b00","nodeKey":"write_foundry_tests","submissionHash":"da6369bd9c2a6e42a4658af70e0ace0bec31f7f2cf3d88ea9123c9d12eb961cc","tag1":"verification:checks","tag2":"acceptance-v2","value":1}],"site":null,"snapshotHash":"c3c24f4d23c93b77a50bbd320dfd756b9df2c0c008e691425548e8d0a427fc6f","state":"completed","submissions":[{"artifacts":[],"attempt":1,"bundleHash":"98ce14edabe5f7d881d6af28657279ea8000e91205ac0b6859aa16a472213f75","device":"c04c741787c1223a","findings":[],"hash":"09b125ef277e5b27cfce1934fe6e5fe546426e6f8d9cca31220336e7cccc6ad3","nodeId":"2331217e-e00f-4758-86c4-46e07baf8ebc","outcome":"completed","summary":"Implemented Sooth Protocol (SOOTH): 1 billion tokens with 18 decimals, minted once to the deployer. No additional minting or administrative powers.\n\nDependencies are vendored; deployment parameters, assumptions, and operational responsibilities are documented in `README.md`.\n\nVerified with Solidity 0.8.26:\n\n- `forge build` passed\n- `forge test` passed: 31 tests using the supplied fuzz seed\n- `forge fmt --check` passed\n\nProtected launch integration checks remain for the independent verifier.","treeHash":"81398cbcd78286b7da4eaf73eda6e2d69a961039","usage":{"cachedInputTokens":461952,"inputTokens":51254,"model":"gpt-6-astra","outputTokens":15238,"runtime":"codex","turns":5,"wallClockMs":421508}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"60c045240bb09c33","findings":[{"citation":"resolved","description":"DEPENDENCIES.md states that every vendored file is an unmodified upstream source and gives `sha256sum -c DEPENDENCIES.sha256` (line 15) as the way to verify it. On the committed tree (HEAD dd327cd, clean) that command reports FAILED for six forge-std files: lib/forge-std/src/StdAssertions.sol, StdJson.sol, StdToml.sol, Vm.sol, console.sol and interfaces/IMulticall3.sol. I reproduced this and then fetched the six files from forge-std commit 3b20d60d14b343ee4f908cb8079495c07f5e8981: the upstream Vm.sol hashes to 37cdc22402df6c218ca65502e7fa2a24a3ce5b796eaaee330ad84fb9578bc73c, which is exactly what DEPENDENCIES.sha256 records, while the committed copy hashes to 9ef7ee8c9a0a4fb18b830e85ce5cd31a56b97781e126ad1e7801389c49b0f408. Stripping all whitespace from each upstream/committed pair makes them byte-identical for all six files, so the drift is forge-fmt line-wrapping only and no library logic changed. The only dependency the token compiles against, OpenZeppelin v5.2.0 ERC20.sol at commit acd4ff74de833399287ed6b31b4debf6b2b35527, is byte-identical to upstream (c322867b0b30f6d5f791e5ab9af5e3f5ff1c8c127906748f6725e592a5f40719), so SoothToken's bytecode and behaviour are unaffected. Impact: the project's own provenance claim is false as shipped and the documented integrity step hard-fails, so a verifier following DEPENDENCIES.md cannot use it to distinguish this harmless reformat from real tampering of the assertion library the test suite relies on. Three specialists (permissions, flow, economics) reported this same root cause; it is one finding. Fix, author's choice: re-copy the six files byte-for-byte from the pinned commit (and keep `forge fmt` off lib/), or regenerate DEPENDENCIES.sha256 from the committed tree and change 'unmodified upstream sources' to say the forge-std copies are forge-fmt reformatted.","line":10,"path":"DEPENDENCIES.md","reproduction":"State: the committed tree at HEAD dd327cd with `git status` clean. Input: from the repository root run `sha256sum -c DEPENDENCIES.sha256 | grep -v ': OK$'`. Expected (DEPENDENCIES.md lines 10-16): no output, every line OK. Actual: 'lib/forge-std/src/StdAssertions.sol: FAILED', 'lib/forge-std/src/StdJson.sol: FAILED', 'lib/forge-std/src/StdToml.sol: FAILED', 'lib/forge-std/src/Vm.sol: FAILED', 'lib/forge-std/src/console.sol: FAILED', 'lib/forge-std/src/interfaces/IMulticall3.sol: FAILED', 'sha256sum: WARNING: 6 computed checksums did NOT match'. Cross-check: `sha256sum lib/forge-std/src/Vm.sol` prints 9ef7ee8c9a0a4fb18b830e85ce5cd31a56b97781e126ad1e7801389c49b0f408; DEPENDENCIES.sha256 line 17 records 37cdc22402df6c218ca65502e7fa2a24a3ce5b796eaaee330ad84fb9578bc73c, which is the hash of https://raw.githubusercontent.com/foundry-rs/forge-std/3b20d60d14b343ee4f908cb8079495c07f5e8981/src/Vm.sol. `cmp <(tr -d ' \\t\\n\\r' < upstream/Vm.sol) <(tr -d ' \\t\\n\\r' < lib/forge-std/src/Vm.sol)` reports identical for each of the six files.","severity":"low","snippet":"OpenZeppelin includes `ERC20.sol`, `IERC20.sol`, `IERC20Metadata.sol`, `Context.sol`, and `draft-IERC6093.sol`. Forge Standard Library includes its `src/` directory for test utilities only. The copied files are unmodified upstream sources. Remappings are explicit in `foundry.toml`.","title":"Documented provenance check fails: six vendored forge-std files do not match DEPENDENCIES.sha256 (merged from audit_permissions, audit_flow, audit_economics)"}],"hash":"16facd0187baa3e75a45bcf0795e734174e5f393caab5b77955b05ff11527540","nodeId":"c8b74bc4-e626-4257-a8e1-9ecf2772bcfe","outcome":"completed","summary":"The review is complete and `.imd-findings.json` is written. The working tree is otherwise unchanged.\n\n**Outcome.** The token is a plain, unmodified OpenZeppelin v5.2.0 ERC-20 with a zero-argument constructor that mints the full supply once to the deployer. I found no defect in the contract itself. One low finding is kept.\n\n**Specialist findings.** Three specialists (permissions, flow, economics) each reported the same root cause, so I merged them into one low finding:\n\n- The documented integrity check `sha256sum -c DEPENDENCIES.sha256` fails for six forge-std files. I reproduced the failure on the clean tree, then fetched the six files from the pinned upstream commit. The recorded hashes are the genuine upstream hashes. The committed copies differ from upstream only in whitespace, and the OpenZeppelin ERC20 the token compiles against is byte-identical to upstream. So the provenance claim in `DEPENDENCIES.md` is false as shipped, but the token's bytecode is unaffected.\n\n**My own pass.** Build and all 48 project tests pass with the README's seed, and `forge fmt --check` passes. The compiled ABI exposes only approve, transfer and transferFrom as state-changing functions. I traced each through the vendored ERC20 and recorded them as holding. The creation code is 2645 bytes and the runtime 1753 bytes, with no DELEGATECALL, CALLCODE or SELFDESTRUCT, and no address-bit requirement, so the factory's CREATE2 deployment works with the manifest's empty argument list. The manifest uses only schema keys with correct types and matching name, symbol, decimals and supply. The paired currency address on chain 4663 answers with the IMD symbol. The aderyn \"large numeric literal\" lead is the supply constant, which equals the manifest's total supply exactly, so it is not a defect.\n\n**What is next.** The author's only open item is the forge-std checksum drift: either restore the six files byte-for-byte or regenerate the hash manifest and reword the \"unmodified\" claim.","treeHash":null,"usage":{"cachedInputTokens":320734,"inputTokens":162,"model":"claude-fable-5-1","outputTokens":8599,"runtime":"claude","turns":17,"wallClockMs":144301}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"96eeb8eb2acdbbf1","findings":[{"citation":"resolved","description":"DEPENDENCIES.md states that every vendored file is an unmodified upstream source and tells the verifier to confirm that with `sha256sum -c DEPENDENCIES.sha256`. On the committed tree (HEAD f648ce3, `git status` clean) that command reports 6 FAILED entries: lib/forge-std/src/StdAssertions.sol, StdJson.sol, StdToml.sol, Vm.sol, console.sol and interfaces/IMulticall3.sol. The digests recorded in DEPENDENCIES.sha256 are the genuine upstream digests at forge-std commit 3b20d60d14b343ee4f908cb8079495c07f5e8981 (I fetched those files and they hash to the recorded values), so it is the committed copies that were altered after the manifest was generated. Diffing them against upstream shows the changes are whitespace-only (forge fmt re-wrapped long signatures; stripping all whitespace makes each pair identical), so no test-library logic changed and the token's bytecode is unaffected. The five OpenZeppelin files that the token actually compiles against are byte-identical to upstream commit acd4ff74de833399287ed6b31b4debf6b2b35527. Impact: the repository's own provenance claim is false and its documented integrity step fails, so a verifier following DEPENDENCIES.md gets a hard failure and cannot distinguish this harmless reformat from a real tampering of the assertion library the test suite relies on. Minimal fix (author's choice): either restore the six files byte-for-byte from the pinned commit and keep `forge fmt` away from lib/ (an `[fmt] ignore` entry is a config change, so the simpler route is re-copying the files), or regenerate DEPENDENCIES.sha256 and drop the 'unmodified upstream sources' sentence so the manifest describes the tree that is actually shipped.","line":10,"path":"DEPENDENCIES.md","reproduction":"State: the committed tree at HEAD f648ce3 with nothing modified. Input: run from the repository root `sha256sum -c DEPENDENCIES.sha256 | grep -v ': OK$'`. Expected (per DEPENDENCIES.md line 10-16): every line OK, exit status 0. Actual: 'lib/forge-std/src/StdAssertions.sol: FAILED', 'lib/forge-std/src/StdJson.sol: FAILED', 'lib/forge-std/src/StdToml.sol: FAILED', 'lib/forge-std/src/Vm.sol: FAILED', 'lib/forge-std/src/console.sol: FAILED', 'lib/forge-std/src/interfaces/IMulticall3.sol: FAILED', 'sha256sum: WARNING: 6 computed checksums did NOT match', exit status 1. Cross-check: `sha256sum lib/forge-std/src/Vm.sol` gives 9ef7ee8c9a0a4fb18b830e85ce5cd31a56b97781e126ad1e7801389c49b0f408 while DEPENDENCIES.sha256 line 17 and upstream 3b20d60d both give 37cdc22402df6c218ca65502e7fa2a24a3ce5b796eaaee330ad84fb9578bc73c; `diff <(curl -sL https://raw.githubusercontent.com/foundry-rs/forge-std/3b20d60d14b343ee4f908cb8079495c07f5e8981/src/Vm.sol) lib/forge-std/src/Vm.sol` shows only line-wrapping changes.","severity":"low","snippet":"OpenZeppelin includes `ERC20.sol`, `IERC20.sol`, `IERC20Metadata.sol`, `Context.sol`, and `draft-IERC6093.sol`. Forge Standard Library includes its `src/` directory for test utilities only. The copied files are unmodified upstream sources. Remappings are explicit in `foundry.toml`.","title":"Vendored forge-std is not the pinned upstream bytes: the documented integrity check `sha256sum -c DEPENDENCIES.sha256` fails on the committed tree"}],"hash":"85715916bf6402503d625f3b6793d1b24b1363949ed89128a49bb38581390830","nodeId":"978f9200-28a3-4bdd-9f88-46982b163b84","outcome":"completed","summary":"The review is complete. The findings file is written at the repository root and no project files were changed.\n\n**Outcome.** The token is a 17-line plain OpenZeppelin v5.2.0 ERC-20 with one constructor mint and no roles, hooks, or overrides. I found no defect in the three state-changing entry points. The one finding is a low-severity provenance issue in the vendored test library.\n\n**What I checked, from the Execution Trace, Periphery and First Principles guides:**\n- Traced approve, transfer and transferFrom through the vendored ERC20 into `_update`, `_approve` and `_spendAllowance`. Every revert path leaves balances and allowances untouched, amounts are delivered exactly, and the unchecked arithmetic is bounded by the fixed 10^27 supply.\n- Verified the constructor mints the whole supply once to msg.sender, which is the factory under CREATE2 deployment, not the transaction origin. The compiled ABI exposes only the three listed mutators plus views, so there is no mint, burn, pause, blacklist, initializer, receive or fallback.\n- Ran the project's 31 unit, fuzz and invariant tests with the documented seed, and the formatter check. All pass.\n- Wrote and ran a scratch test mirroring the protected floor's reachable-opcode scan and the launch flows. No DELEGATECALL, CALLCODE or SELFDESTRUCT is reachable, and the flows move exact amounts. The scratch test was removed afterwards.\n- Fetched the pinned upstream commits over the network and compared hashes. All five OpenZeppelin files the token compiles against are byte-identical to upstream.\n\n**The finding.** Six vendored forge-std files differ from the pinned commit and from the repository's own hash manifest, so the integrity command documented in `DEPENDENCIES.md` fails on the committed tree. The diffs are whitespace-only reformatting, so no test logic changed and the token bytecode is unaffected, but the claim that the copies are unmodified is false and a verifier following the instructions gets a hard failure.\n\n**Coverage record.** All three entry points are marked holds, with additional rows for the constructor mint, fixed supply, launch flow exactness, forbidden opcodes, library provenance and metadata. Nothing in the assigned area was left unreached.\n\n**Leads not promoted.** The standard ERC-20 approve race and tokens sent to the contract address are documented in the README and are inherent to the requested design, so neither is reported.","treeHash":null,"usage":{"cachedInputTokens":818095,"inputTokens":322,"model":"claude-fable-5-1","outputTokens":19206,"runtime":"claude","turns":31,"wallClockMs":262286}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"61b4050710026370","findings":[{"citation":"resolved","description":"DEPENDENCIES.md states that every vendored file is an unmodified upstream source and tells the reader to verify this with `sha256sum -c DEPENDENCIES.sha256` (DEPENDENCIES.md:15). Running that command on the committed tree fails for six forge-std files (lib/forge-std/src/StdAssertions.sol, StdJson.sol, StdToml.sol, Vm.sol, console.sol, interfaces/IMulticall3.sol). DEPENDENCIES.sha256 records the true upstream v1.9.6 hashes (for example line 17 records 37cdc224... for Vm.sol, which is exactly the hash of the file at forge-std commit 3b20d60d), but the files in lib/ were reformatted with `forge fmt` after the hashes were taken (the vendored copy of each file is byte-identical to the upstream file after `forge fmt`). The token's own dependency, OpenZeppelin ERC20.sol at v5.2.0, does match both the recorded and upstream hash (c322867b...), so SoothToken's bytecode is unaffected; the mismatch is test-only tooling. Impact: the project's advertised provenance check is false as shipped, so a reviewer or the verifier following the README cannot use it to confirm the vendored tree, and a later real tampering of lib/ would be indistinguishable from this formatting drift. This is outside the economics area but is reported because it is a concrete, reproducible defect in the deliverable. Fix: either re-vendor the six files byte-for-byte from the pinned commit (and exclude lib/ from `forge fmt`), or regenerate DEPENDENCIES.sha256 from the tree as committed and amend the 'unmodified upstream sources' sentence to say the forge-std files are formatted.","line":10,"path":"DEPENDENCIES.md","reproduction":"From the repository root run `sha256sum -c DEPENDENCIES.sha256` (or `shasum -a 256 -c DEPENDENCIES.sha256` on macOS). Expected: every line reports OK, as DEPENDENCIES.md:15 promises. Actual: six lines report FAILED: lib/forge-std/src/StdAssertions.sol, lib/forge-std/src/StdJson.sol, lib/forge-std/src/StdToml.sol, lib/forge-std/src/Vm.sol, lib/forge-std/src/console.sol, lib/forge-std/src/interfaces/IMulticall3.sol, and the tool prints 'WARNING: 6 computed checksums did NOT match'. Concretely, `shasum -a 256 lib/forge-std/src/Vm.sol` prints 9ef7ee8c9a0a4fb18b830e85ce5cd31a56b97781e126ad1e7801389c49b0f408 while DEPENDENCIES.sha256:17 records 37cdc22402df6c218ca65502e7fa2a24a3ce5b796eaaee330ad84fb9578bc73c. Downloading src/Vm.sol from forge-std commit 3b20d60d14b343ee4f908cb8079495c07f5e8981 gives the recorded 37cdc224... hash; running `forge fmt` on that download makes it byte-identical to lib/forge-std/src/Vm.sol (verified with diff for all six files). `git diff HEAD -- lib` is empty, so this is the committed state, not local drift.","severity":"low","snippet":"OpenZeppelin includes `ERC20.sol`, `IERC20.sol`, `IERC20Metadata.sol`, `Context.sol`, and `draft-IERC6093.sol`. Forge Standard Library includes its `src/` directory for test utilities only. The copied files are unmodified upstream sources. Remappings are explicit in `foundry.toml`.","title":"Documented dependency integrity check fails: six vendored forge-std files do not match the recorded SHA-256 hashes"}],"hash":"8819e8350dd10ab6d366e62c925a27edbd396ea3b71a42b12c41392f52273673","nodeId":"82f39902-cfe2-4ea3-9d12-dffd1b43ab23","outcome":"completed","summary":"The review is complete and `.imd-findings.json` is written. The tree is otherwise untouched: the scratch tests were removed and `git status` shows only the findings file.\n\n**Outcome: the token holds in the economics area.** `SoothToken` is a two-line wrapper over OpenZeppelin ERC20 v5.2.0, and the vendored `ERC20.sol` matches the upstream hash at the pinned commit byte for byte. I checked it against the Economic Security, Invariant and Flow Gap guides and found no defect in the token itself.\n\nWhat I verified, with reproductions run locally:\n- **Conservation invariant.** Sum of balances equals totalSupply equals 10^27 permanently. The constructor is the only mint; there is no burn, admin, receive, fallback, DELEGATECALL, CALLCODE or SELFDESTRUCT in reachable runtime code. I re-ran the project's fuzz and invariant suites under the documented seed and a scratch opcode scan matching the protected test's method. All pass.\n- **Launch flows.** Factory to distributor, distributor to claimant, factory to pool-manager pull via approve plus transferFrom, trader buy and sell, and remainder forward each move exactly the requested amount, so the protected floor's swarm, seed and swap checks cannot come up short.\n- **Economic dependencies.** None exist. No oracles, no callbacks, no fee formulas, no sentinel addresses, no payable path. The approve race is standard and documented in the README.\n- **Entry points.** All three listed entry points are marked `holds`, with reasons, plus invariant and flow rows.\n\n**One low finding, outside my area but concrete.** DEPENDENCIES.md claims all vendored files are unmodified upstream sources and instructs the reader to verify with the recorded SHA-256 list. That check fails for six forge-std files. The recorded hashes are the true upstream v1.9.6 hashes, but the committed copies were run through `forge fmt` afterward. I confirmed each vendored file is byte-identical to the upstream file after formatting, so the difference is cosmetic and test-only, and the token's bytecode is unaffected. The documented provenance check is nonetheless false as shipped. No proof test is attached since the severity is low.\n\n**Not reached.** There is no launch.json in the tree, which the README says the launch service writes later, so the manifest row is marked `unreached` with the values it must carry.","treeHash":null,"usage":{"cachedInputTokens":725352,"inputTokens":354,"model":"claude-fable-5-1","outputTokens":13707,"runtime":"claude","turns":17,"wallClockMs":205326}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"739094f0e08668ee","findings":[],"hash":"8eceaf2125e884974ff864c4d204b985434378dc0469fc9ec3480d8304b70467","nodeId":"378d4dc6-7d85-442a-86f6-23c8d47cb504","outcome":"completed","summary":"I found no math, precision or boundary defects in SoothToken, so `.imd-findings.json` holds an empty findings list and a coverage row for each of the three entry points, all marked `holds`.\n\n**Why there's nothing to report:**\n- `src/SoothToken.sol` is plain OpenZeppelin ERC20 v5.2.0. Its only addition is a constructor that mints `INITIAL_SUPPLY = 1_000_000_000 * 10 ** 18` (1e27) to `msg.sender`. That number is right for 18 decimals and far below the uint256 limit. The supply is fixed, so the unchecked add in `_update` cannot overflow.\n- Every unchecked subtraction in OZ's `_update` and `_spendAllowance` is preceded by a balance or allowance check. I traced the edge cases and each behaves correctly: zero transfers, sending to yourself, sending the exact balance, balance + 1 (reverts), an allowance exactly equal to the amount, the maximum \"infinite\" allowance (left untouched, as the standard intends), and the zero address.\n- Nothing rounds, takes a fee, burns or rebases. No path mints after the constructor and no role holds special powers. The aderyn \"large numeric literal\" warning is about formatting only.\n- The OpenZeppelin files match the hashes in `DEPENDENCIES.sha256`. All 31 project tests pass under `forge test`.\n\n**Coverage:** besides the three entry points, I added two rows for properties I checked: the supply stays fixed, and all balances always add up to the total supply.\n\n**Not reported:**\n- Six forge-std files fail the `DEPENDENCIES.sha256` check. They are test-only, outside the math area and not in the deployed bytecode.\n- The usual ERC20 `approve` race is how the standard works, not a defect in this code.\n\nI didn't write any proof tests because there were no findings that needed one, and I changed no repository files apart from the findings file.","treeHash":null,"usage":{"cachedInputTokens":235316,"inputTokens":12,"model":"claude-opus-5-5","outputTokens":2618,"runtime":"claude","turns":6,"wallClockMs":45593}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"8af9903f4ad1eed0","findings":[{"citation":"resolved","description":"DEPENDENCIES.md line 10 states 'The copied files are unmodified upstream sources' and line 15 gives `sha256sum -c DEPENDENCIES.sha256` as the way to verify that. Six committed forge-std files (lib/forge-std/src/Vm.sol, StdAssertions.sol, StdJson.sol, StdToml.sol, console.sol, interfaces/IMulticall3.sol) do not hash to the values recorded in DEPENDENCIES.sha256, so the project's own provenance check fails. The recorded hashes are the genuine upstream forge-std v1.9.6 (commit 3b20d60d) hashes; the committed files were reformatted (line-wrapping only, forge-fmt style) after the manifest was written. I diffed each committed file against the upstream raw file at that commit: every difference is whitespace/line-wrapping, no token, statement or cheatcode differs. All five vendored OpenZeppelin v5.2.0 files match upstream exactly, so the token's runtime behaviour is unaffected; this is a trust/provenance gap in test tooling only. Fix: either restore the six files to byte-identical upstream copies, or regenerate DEPENDENCIES.sha256 from the tree and drop the 'unmodified' claim (stating they are forge-fmt reformatted).","line":17,"path":"DEPENDENCIES.sha256","reproduction":"From the repository root run `sha256sum -c DEPENDENCIES.sha256`. Expected (per DEPENDENCIES.md): every line reports OK. Actual: `lib/forge-std/src/StdAssertions.sol: FAILED`, `lib/forge-std/src/StdJson.sol: FAILED`, `lib/forge-std/src/StdToml.sol: FAILED`, `lib/forge-std/src/Vm.sol: FAILED`, `lib/forge-std/src/console.sol: FAILED`, `lib/forge-std/src/interfaces/IMulticall3.sol: FAILED`, `sha256sum: WARNING: 6 computed checksums did NOT match`. Concretely `sha256sum lib/forge-std/src/Vm.sol` gives 9ef7ee8c9a0a4fb18b830e85ce5cd31a56b97781e126ad1e7801389c49b0f408 while line 17 records 37cdc22402df6c218ca65502e7fa2a24a3ce5b796eaaee330ad84fb9578bc73c (which is the hash of the upstream file at foundry-rs/forge-std commit 3b20d60d14b343ee4f908cb8079495c07f5e8981). `git show HEAD:lib/forge-std/src/Vm.sol | sha256sum` gives the same 9ef7ee8c... so the mismatch is in the committed tree, not a local modification.","severity":"low","snippet":"37cdc22402df6c218ca65502e7fa2a24a3ce5b796eaaee330ad84fb9578bc73c  lib/forge-std/src/Vm.sol","title":"Vendored forge-std files do not match the shipped SHA-256 manifest; the documented verification command fails"}],"hash":"aa837ef1928cfb76bacc15bfe043ad7afe809f3b6583c8216eedd7e8c6f4c595","nodeId":"382e6258-33be-4411-aacb-792b9018c05a","outcome":"completed","summary":"The review is complete. The findings file is valid JSON with one finding and eight coverage rows, and the only files I created are `.imd-findings.json` and a scratch test under `test/scratch/`.\n\n**Outcome:** the token is a bare OpenZeppelin v5.2.0 ERC-20 with a single constructor mint and no roles. Within the Access Control, Trust Gap and Asymmetry guides it holds. The three state-changing entry points all behave as intended. The one defect I could substantiate is in dependency provenance, not in the token.\n\n**Finding (low):** six vendored forge-std files fail the project's own hash manifest. DEPENDENCIES.md claims the copies are unmodified upstream and tells readers to run `sha256sum -c DEPENDENCIES.sha256`. That command reports six FAILED lines. The recorded hashes are the genuine upstream v1.9.6 hashes. I fetched the upstream files and diffed them against the committed copies. Every difference is line-wrapping only, so test behaviour is unaffected and the token runtime is untouched. All five vendored OpenZeppelin files match upstream byte for byte.\n\n**What I verified for the coverage record:**\n- approve writes only the caller's own allowance and rejects a zero spender.\n- transfer debits only the caller, rejects the zero address, and has no fee, exemption, pause or blacklist branch.\n- transferFrom spends allowance before moving funds, and the deployer has no privileged pull path. A scratch test confirms the factory gets an insufficient-allowance revert when it tries to pull from another holder.\n- No owner, initializer, receive, fallback, delegatecall or selfdestruct exists. Unknown selectors and plain ETH sends revert.\n- Asymmetry and Trust Gap passes found nothing to compare. There are no admin variants, settable parameters or price formulas.\n\nThe project's 31 tests, including the invariant suite, pass with the documented fuzz seed, and `forge fmt --check` is clean. No manifest exists yet, which is expected this early. The ERC-20 approve front-running race is inherent to the standard and is documented in the README, so I left it out per the guide's do-not-report list.","treeHash":null,"usage":{"cachedInputTokens":847277,"inputTokens":482,"model":"claude-fable-5-1","outputTokens":13687,"runtime":"claude","turns":24,"wallClockMs":310596}},{"artifacts":[],"attempt":1,"bundleHash":"2fb31f8ce8f33392d9bad45516c3c3829d9c2d3bd99432d84b18d672608cc26d","device":"dbf9fa8b755f8ed6","findings":[],"hash":"d764e7af62738d4cc83fdc56c13539a1cdacb9c27ef54dfc98892068a43801fb","nodeId":"9a15c5ef-289a-4bbf-909f-b29e4bbb1748","outcome":"completed","summary":"Created [launch.json](/root/.identitymd/work/d6a320ef-6cb3-4053-a083-e428afba3b36/9a15c5ef-289a-4bbf-909f-b29e4bbb1748/launch.json) matching `SoothToken`, its exact supply, empty constructor arguments, and the required pool and economics values.\n\n`forge build` succeeded. All 31 tests passed with the specified fuzz seed. Only `launch.json` changed outside permitted scratch files.","treeHash":"b7ed17f1b37881f5db11fb086996b045a44f33c4","usage":{"cachedInputTokens":176128,"inputTokens":23165,"model":"gpt-6-astra","outputTokens":2271,"runtime":"codex","turns":3,"wallClockMs":76368}},{"artifacts":[],"attempt":1,"bundleHash":"63c20a9761b4ceacbb89f4992ee2afbb511aee5280498b54739e5c693f1fd384","device":"ccf14607d159904b","findings":[],"hash":"da6369bd9c2a6e42a4658af70e0ace0bec31f7f2cf3d88ea9123c9d12eb961cc","nodeId":"8b78f441-0df8-4461-b6c0-9b062bb407e4","outcome":"completed","summary":"Added 17 tests covering failure paths, allowance boundaries, revocation, rollback/retries, and caller identity. Strengthened invariants across 32,768 randomized calls.\n\n`forge build` and full `forge test` passed offline with the required seed: **48 passed, 0 failed**.\n\nOnly files under `test/` changed. No implementation defects found.","treeHash":"3cb8a696e1e71c8c5b21bea953dc45a56e8a71c1","usage":{"cachedInputTokens":1048448,"inputTokens":71871,"model":"gpt-6-astra","outputTokens":12212,"runtime":"codex","turns":6,"wallClockMs":388805}}],"verification":[{"checks":[{"durationMs":1039,"exitCode":0,"name":"build","output":"Compiling 27 files with Solc 0.8.26\nSolc 0.8.26 finished in 974.50ms\nCompiler run successful!\n","passed":true},{"durationMs":2104,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 30 tests for test/SoothToken.t.sol:SoothTokenTest\n[PASS] testFuzz_ApprovalReplacement(uint256,uint256) (runs: 512, μ: 104003, ~: 104172)\n[PASS] testFuzz_DelegatedTransfer(uint256,uint256) (runs: 512, μ: 161861, ~: 164814)\nLogs:\n  Bound result 424186295970577306036734421\n  Bound result 353999761745762515529424701\n\n[PASS] testFuzz_RevertOverAllowance(uint256,uint256) (runs: 512, μ: 122608, ~: 122921)\nLogs:\n  Bound result 4000000000000000000\n  Bound result 1000000000000000000000000000\n\n[PASS] testFuzz_RevertOverspend(uint256,uint256) (runs: 512, μ: 126718, ~: 127158)\nLogs:\n  Bound result 14\n  Bound result 2119293654\n\n[PASS] testFuzz_TransferConservesSupply(address,uint256) (runs: 512, μ: 92905, ~: 93275)\nLogs:\n  Bound result 0\n\n[PASS] test_ApprovalCanBeReplacedAndRevoked() (gas: 161768)\n[PASS] test_ApprovalsAreScopedToOwnerAndSpender() (gas: 204279)\n[PASS] test_ApproveEmitsEventAndDoesNotMoveTokens() (gas: 88809)\n[PASS] test_ConstructorEmitsExactlyOneMintEvent() (gas: 9611)\n[PASS] test_FactoryReceivesWholeSupplyAndCanDistributeExactly() (gas: 664089)\n[PASS] test_InfiniteAllowanceIsNotConsumed() (gas: 139392)\n[PASS] test_MetadataAndInitialSupply() (gas: 107693)\n[PASS] test_NoMintBurnAdminOrUpgradeEntryPoints() (gas: 1288440)\n[PASS] test_RevertApproveZeroSpender() (gas: 61863)\n[PASS] test_RevertTransferAboveBalance() (gas: 67670)\n[PASS] test_RevertTransferFromOverAllowancePreservesState() (gas: 115704)\n[PASS] test_RevertTransferFromOverBalanceRollsBackAllowance() (gas: 126221)\n[PASS] test_RevertTransferFromToZeroRollsBackAllowance() (gas: 114201)\n[PASS] test_RevertTransferFromZeroSenderEvenForZeroAmount() (gas: 35387)\n[PASS] test_RevertTransferMaxUint() (gas: 55022)\n[PASS] test_RevertTransferToZeroAddress() (gas: 47678)\n[PASS] test_RevertUnapprovedTransferFromEvenByDeployer() (gas: 109626)\n[PASS] test_RevertZeroTransferToZeroAddress() (gas: 30391)\n[PASS] test_SelfTransferPreservesBalance() (gas: 51420)\n[PASS] test_TransferDeliversExactAmountAndEmitsEvent() (gas: 91506)\n[PASS] test_TransferFromConsumesFiniteAllowanceAndEmitsTransfer() (gas: 231708)\n[PASS] test_TransferFromToSelfConsumesAllowanceWithoutChangingBalance() (gas: 103316)\n[PASS] test_TransferWholeSupply() (gas: 75808)\n[PASS] test_ZeroTransferFromEmptyAccountEmitsEvent() (gas: 63034)\n[PASS] test_ZeroTransferFromNeedsNoAllowance() (gas: 78785)\nSuite result: ok. 30 passed; 0 failed; 0 skipped; finished in 17.81ms (89.22ms CPU time)\n\nRan 1 test for test/SoothToken.invariant.t.sol:SoothTokenInvariantTest\n[PASS]\nSoothTokenInvariantTest invariants:\n[PASS] invariant_AllowancesMatchExplicitApprovalsAndSuccessfulSpending\n[PASS] invariant_SupplyIsFixedAndBalancesAreConserved\n SoothTokenInvariantTest invariants (runs: 128, calls: 8192, reverts: 0)\n\n╭--------------+--------------+-------+---------+----------╮\n| Contract     | Selector     | Calls | Reverts | Discards |\n+==========================================================+\n| TokenHandler | approve      | 2695  | 0       | 0        |\n|--------------+--------------+-------+---------+----------|\n| TokenHandler | transfer     | 2812  | 0       | 0        |\n|--------------+--------------+-------+---------+----------|\n| TokenHandler | transferFrom | 2685  | 0       | 0        |\n╰--------------+--------------+-------+---------+----------╯\n\nLogs:\n  Bound result 1000000000000000000000000000\n  Bound result 3231\n  Bound result 1000000000000000000000000001\n  Bound result 164795313786015943224110678\n  Bound result 42000000000000000000\n  Bound result 12\n  Bound result 12\n  Bound result 42648\n  Bound result 233219643349566420295588977\n  Bound result 14\n  Bound result 2234\n  Bound result 5662\n  Bound result 1000000000\n  Bound result 429\n  Bound result 763\n  Bound result 2851\n  Bound result 374115984756598905417443127\n  Bound result 5000000000000000000\n  Bound result 18\n  Bound result 3\n  Bound result 4348\n  Bound result 10000000000000000000\n  Bound result 1000000000000000000\n  Bound result 5338\n  Bound result 1230\n  Bound result 310\n  Bound result 13\n  Bound result 970\n  Bound result 1000000000\n  Bound result 809664665464300146584236017\n  Bound result 6731\n  Bound result 176064262135086950402812561\n  Bound result 2105882\n  Bound result 4\n  Bound result 5000000000000000000\n  Bound result 2616\n  Bound result 8\n  Bound result 4000000000000000000\n  Bound result 609101647618738426419274507\n  Bound result 1000000000000000000000000000\n  Bound result 5000000000000000000\n  Bound result 42000000000000000000\n  Bound result 5970\n  Bound result 719206527\n  Bound result 5852\n  Bound result 30000000000000000000\n  Bound result 273549063705722030417996995\n  Bound result 2025\n  Bound result 1596\n  Bound result 4106\n  Bound result 5121\n  Bound result 385\n  Bound result 10000000000000000000\n  Bound result 3880\n  Bound result 1415017528161152\n  Bound result 6882\n  Bound result 540589005208837703030392047\n  Bound result 726289623289711435274425653\n  Bound result 2\n  Bound result 12\n  Bound result 627137442936187097153363133\n  Bound result 1000000000000000000000000001\n  Bound result 763600052\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 2.03s (2.03s CPU time)\n\nRan 2 test suites in 2.03s (2.05s CPU time): 31 tests passed, 0 failed, 0 skipped (31 total tests)\n","passed":true},{"durationMs":34,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"SoothToken.approve(address,uint256)\",\"SoothToken.transfer(address,uint256)\",\"SoothToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"DEPENDENCIES.md\":18,\"DEPENDENCIES.sha256\":32,\"README.md\":63,\"foundry.toml\":22,\"src/SoothToken.sol\":17,\"test/SoothToken.invariant.t.sol\":130,\"test/SoothToken.t.sol\":366,\"test/helpers/TokenFactory.sol\":15},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true},{"durationMs":368,"exitCode":0,"name":"slither","output":"slither: no results at low impact or above","passed":true},{"durationMs":227,"exitCode":0,"name":"aderyn","output":"[low] large-numeric-literal at src/SoothToken.sol:11: Large Numeric Literal","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"09b125ef277e5b27cfce1934fe6e5fe546426e6f8d9cca31220336e7cccc6ad3","verifiedTreeHash":"81398cbcd78286b7da4eaf73eda6e2d69a961039","verifierVersion":"0.1.0+560ab6a2"},{"checks":[{"durationMs":2965,"exitCode":0,"name":"build","output":"Compiling 27 files with Solc 0.8.26\nSolc 0.8.26 finished in 2.79s\nCompiler run successful!\n","passed":true},{"durationMs":4348,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 30 tests for test/SoothToken.t.sol:SoothTokenTest\n[PASS] testFuzz_ApprovalReplacement(uint256,uint256) (runs: 512, μ: 104003, ~: 104172)\n[PASS] testFuzz_DelegatedTransfer(uint256,uint256) (runs: 512, μ: 161861, ~: 164814)\nLogs:\n  Bound result 6\n  Bound result 3\n\n[PASS] testFuzz_RevertOverAllowance(uint256,uint256) (runs: 512, μ: 122608, ~: 122921)\nLogs:\n  Bound result 6\n  Bound result 808\n\n[PASS] testFuzz_RevertOverspend(uint256,uint256) (runs: 512, μ: 126718, ~: 127158)\nLogs:\n  Bound result 1000000000000000000000000000\n  Bound result 5\n\n[PASS] testFuzz_TransferConservesSupply(address,uint256) (runs: 512, μ: 92905, ~: 93275)\nLogs:\n  Bound result 600796600788855622117407759\n\n[PASS] test_ApprovalCanBeReplacedAndRevoked() (gas: 161768)\n[PASS] test_ApprovalsAreScopedToOwnerAndSpender() (gas: 204279)\n[PASS] test_ApproveEmitsEventAndDoesNotMoveTokens() (gas: 88809)\n[PASS] test_ConstructorEmitsExactlyOneMintEvent() (gas: 9611)\n[PASS] test_FactoryReceivesWholeSupplyAndCanDistributeExactly() (gas: 664089)\n[PASS] test_InfiniteAllowanceIsNotConsumed() (gas: 139392)\n[PASS] test_MetadataAndInitialSupply() (gas: 107693)\n[PASS] test_NoMintBurnAdminOrUpgradeEntryPoints() (gas: 1288440)\n[PASS] test_RevertApproveZeroSpender() (gas: 61863)\n[PASS] test_RevertTransferAboveBalance() (gas: 67670)\n[PASS] test_RevertTransferFromOverAllowancePreservesState() (gas: 115704)\n[PASS] test_RevertTransferFromOverBalanceRollsBackAllowance() (gas: 126221)\n[PASS] test_RevertTransferFromToZeroRollsBackAllowance() (gas: 114201)\n[PASS] test_RevertTransferFromZeroSenderEvenForZeroAmount() (gas: 35387)\n[PASS] test_RevertTransferMaxUint() (gas: 55022)\n[PASS] test_RevertTransferToZeroAddress() (gas: 47678)\n[PASS] test_RevertUnapprovedTransferFromEvenByDeployer() (gas: 109626)\n[PASS] test_RevertZeroTransferToZeroAddress() (gas: 30391)\n[PASS] test_SelfTransferPreservesBalance() (gas: 51420)\n[PASS] test_TransferDeliversExactAmountAndEmitsEvent() (gas: 91506)\n[PASS] test_TransferFromConsumesFiniteAllowanceAndEmitsTransfer() (gas: 231708)\n[PASS] test_TransferFromToSelfConsumesAllowanceWithoutChangingBalance() (gas: 103316)\n[PASS] test_TransferWholeSupply() (gas: 75808)\n[PASS] test_ZeroTransferFromEmptyAccountEmitsEvent() (gas: 63034)\n[PASS] test_ZeroTransferFromNeedsNoAllowance() (gas: 78785)\nSuite result: ok. 30 passed; 0 failed; 0 skipped; finished in 33.01ms (165.03ms CPU time)\n\nRan 1 test for test/SoothToken.invariant.t.sol:SoothTokenInvariantTest\n[PASS]\nSoothTokenInvariantTest invariants:\n[PASS] invariant_AllowancesMatchExplicitApprovalsAndSuccessfulSpending\n[PASS] invariant_SupplyIsFixedAndBalancesAreConserved\n SoothTokenInvariantTest invariants (runs: 128, calls: 8192, reverts: 0)\n\n╭--------------+--------------+-------+---------+----------╮\n| Contract     | Selector     | Calls | Reverts | Discards |\n+==========================================================+\n| TokenHandler | approve      | 2695  | 0       | 0        |\n|--------------+--------------+-------+---------+----------|\n| TokenHandler | transfer     | 2812  | 0       | 0        |\n|--------------+--------------+-------+---------+----------|\n| TokenHandler | transferFrom | 2685  | 0       | 0        |\n╰--------------+--------------+-------+---------+----------╯\n\nLogs:\n  Bound result 1000000000000000000000000000\n  Bound result 3231\n  Bound result 1000000000000000000000000001\n  Bound result 164795313786015943224110678\n  Bound result 42000000000000000000\n  Bound result 12\n  Bound result 12\n  Bound result 42648\n  Bound result 233219643349566420295588977\n  Bound result 14\n  Bound result 2234\n  Bound result 5662\n  Bound result 1000000000\n  Bound result 429\n  Bound result 763\n  Bound result 2851\n  Bound result 374115984756598905417443127\n  Bound result 5000000000000000000\n  Bound result 18\n  Bound result 3\n  Bound result 4348\n  Bound result 10000000000000000000\n  Bound result 1000000000000000000\n  Bound result 5338\n  Bound result 1230\n  Bound result 310\n  Bound result 13\n  Bound result 970\n  Bound result 1000000000\n  Bound result 809664665464300146584236017\n  Bound result 6731\n  Bound result 176064262135086950402812561\n  Bound result 2105882\n  Bound result 4\n  Bound result 5000000000000000000\n  Bound result 2616\n  Bound result 8\n  Bound result 4000000000000000000\n  Bound result 609101647618738426419274507\n  Bound result 1000000000000000000000000000\n  Bound result 5000000000000000000\n  Bound result 42000000000000000000\n  Bound result 5970\n  Bound result 719206527\n  Bound result 5852\n  Bound result 30000000000000000000\n  Bound result 273549063705722030417996995\n  Bound result 2025\n  Bound result 1596\n  Bound result 4106\n  Bound result 5121\n  Bound result 385\n  Bound result 10000000000000000000\n  Bound result 3880\n  Bound result 1415017528161152\n  Bound result 6882\n  Bound result 540589005208837703030392047\n  Bound result 726289623289711435274425653\n  Bound result 2\n  Bound result 12\n  Bound result 627137442936187097153363133\n  Bound result 1000000000000000000000000001\n  Bound result 763600052\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 4.17s (4.17s CPU time)\n\nRan 2 test suites in 4.18s (4.21s CPU time): 31 tests passed, 0 failed, 0 skipped (31 total tests)\n","passed":true},{"durationMs":89,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"SoothToken.approve(address,uint256)\",\"SoothToken.transfer(address,uint256)\",\"SoothToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"DEPENDENCIES.md\":18,\"DEPENDENCIES.sha256\":32,\"README.md\":63,\"foundry.toml\":22,\"launch.json\":24,\"src/SoothToken.sol\":17,\"test/SoothToken.invariant.t.sol\":130,\"test/SoothToken.t.sol\":366,\"test/helpers/TokenFactory.sol\":15},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"d764e7af62738d4cc83fdc56c13539a1cdacb9c27ef54dfc98892068a43801fb","verifiedTreeHash":"b7ed17f1b37881f5db11fb086996b045a44f33c4","verifierVersion":"0.1.0+560ab6a2"},{"checks":[{"durationMs":1466,"exitCode":0,"name":"build","output":"Compiling 28 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.40s\nCompiler run successful!\n","passed":true},{"durationMs":8633,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 16 tests for test/SoothToken.EdgeCases.t.sol:SoothTokenEdgeCasesTest\n[PASS] testFuzz_FailedSpendCanBeRetriedAfterFundingWithoutReapproval(uint256,uint256,bool) (runs: 1000, μ: 400840, ~: 401167)\nLogs:\n  Bound result 22006366\n  Bound result 297806512587202097939370164\n\n[PASS] testFuzz_InvalidRecipientDoesNotConsumeApprovalAndValidRetrySucceeds(uint256,uint256) (runs: 1000, μ: 313294, ~: 313772)\nLogs:\n  Bound result 12293\n  Bound result 21892\n\n[PASS] testFuzz_ReturningTokensDoesNotRestoreSpentAllowance(uint256) (runs: 1000, μ: 335680, ~: 335112)\nLogs:\n  Bound result 10000000000000000000\n\n[PASS] testFuzz_SplitSpendingEqualsSingleSpending(uint256,uint256,uint256) (runs: 1000, μ: 407287, ~: 412126)\nLogs:\n  Bound result 15996774849731367189405044209108068832\n  Bound result 1807239496064716863368\n  Bound result 184986895366058853831\n\n[PASS] test_ApprovedTransactionOriginDoesNotAuthorizeAnotherCaller() (gas: 232034)\n[PASS] test_HolderUsingTransferFromNeedsTheirOwnAllowance() (gas: 336097)\n[PASS] test_LargestFiniteAllowanceIsConsumedAcrossRepeatedSpending() (gas: 263297)\n[PASS] test_OneWeiCanRoundTripThroughDirectAndDelegatedTransfers() (gas: 300271)\n[PASS] test_OwnerSpenderAndRecipientMayAllBeTheSameAccount() (gas: 217444)\n[PASS] test_RevokingUnlimitedApprovalBlocksFurtherNonzeroSpending() (gas: 247992)\n[PASS] test_SelfTransferStillRequiresSufficientBalance() (gas: 245327)\n[PASS] test_SeparateDeploymentsHaveIndependentSupplyBalancesAndAllowances() (gas: 553784)\n[PASS] test_UnlimitedAllowanceDoesNotPermitMaxUintTransfer() (gas: 164764)\n[PASS] test_UnlimitedApprovalCanBeReplacedByOneWeiThenExhausted() (gas: 324576)\n[PASS] test_ZeroDelegatedTransferEmitsEventWithoutConsumingFiniteAllowance() (gas: 172935)\n[PASS] test_ZeroDelegatedTransferToZeroStillReverts() (gas: 159641)\nSuite result: ok. 16 passed; 0 failed; 0 skipped; finished in 82.94ms (320.90ms CPU time)\n\nRan 30 tests for test/SoothToken.t.sol:SoothTokenTest\n[PASS] testFuzz_ApprovalReplacement(uint256,uint256) (runs: 512, μ: 104035, ~: 104184)\n[PASS] testFuzz_DelegatedTransfer(uint256,uint256) (runs: 512, μ: 162252, ~: 164820)\nLogs:\n  Bound result 814168209238989777261361350\n  Bound result 509774465672907139033961103\n\n[PASS] testFuzz_RevertOverAllowance(uint256,uint256) (runs: 512, μ: 122696, ~: 122937)\nLogs:\n  Bound result 424186295970577306036734421\n  Bound result 585687489454507608527545715139341777920646906196556240777621\n\n[PASS] testFuzz_RevertOverspend(uint256,uint256) (runs: 512, μ: 126798, ~: 127170)\nLogs:\n  Bound result 424186295970577306036734421\n  Bound result 585687489454507608527545715139341777920646906196556240777621\n\n[PASS] testFuzz_TransferConservesSupply(address,uint256) (runs: 512, μ: 92977, ~: 93275)\nLogs:\n  Bound result 22705\n\n[PASS] test_ApprovalCanBeReplacedAndRevoked() (gas: 161768)\n[PASS] test_ApprovalsAreScopedToOwnerAndSpender() (gas: 204279)\n[PASS] test_ApproveEmitsEventAndDoesNotMoveTokens() (gas: 88809)\n[PASS] test_ConstructorEmitsExactlyOneMintEvent() (gas: 9611)\n[PASS] test_FactoryReceivesWholeSupplyAndCanDistributeExactly() (gas: 664089)\n[PASS] test_InfiniteAllowanceIsNotConsumed() (gas: 139392)\n[PASS] test_MetadataAndInitialSupply() (gas: 107693)\n[PASS] test_NoMintBurnAdminOrUpgradeEntryPoints() (gas: 1288440)\n[PASS] test_RevertApproveZeroSpender() (gas: 61863)\n[PASS] test_RevertTransferAboveBalance() (gas: 67670)\n[PASS] test_RevertTransferFromOverAllowancePreservesState() (gas: 115704)\n[PASS] test_RevertTransferFromOverBalanceRollsBackAllowance() (gas: 126221)\n[PASS] test_RevertTransferFromToZeroRollsBackAllowance() (gas: 114201)\n[PASS] test_RevertTransferFromZeroSenderEvenForZeroAmount() (gas: 35387)\n[PASS] test_RevertTransferMaxUint() (gas: 55022)\n[PASS] test_RevertTransferToZeroAddress() (gas: 47678)\n[PASS] test_RevertUnapprovedTransferFromEvenByDeployer() (gas: 109626)\n[PASS] test_RevertZeroTransferToZeroAddress() (gas: 30391)\n[PASS] test_SelfTransferPreservesBalance() (gas: 51420)\n[PASS] test_TransferDeliversExactAmountAndEmitsEvent() (gas: 91506)\n[PASS] test_TransferFromConsumesFiniteAllowanceAndEmitsTransfer() (gas: 231708)\n[PASS] test_TransferFromToSelfConsumesAllowanceWithoutChangingBalance() (gas: 103316)\n[PASS] test_TransferWholeSupply() (gas: 75808)\n[PASS] test_ZeroTransferFromEmptyAccountEmitsEvent() (gas: 63034)\n[PASS] test_ZeroTransferFromNeedsNoAllowance() (gas: 78785)\nSuite result: ok. 30 passed; 0 failed; 0 skipped; finished in 82.98ms (379.39ms CPU time)\n\nRan 2 tests for test/SoothToken.invariant.t.sol:SoothTokenInvariantTest\n[PASS]\nSoothTokenInvariantTest invariants:\n[PASS] invariant_AllowancesMatchExplicitApprovalsAndSuccessfulSpending\n[PASS] invariant_SupplyIsFixedAndBalancesAreConserved\n SoothTokenInvariantTest invariants (runs: 256, calls: 32768, reverts: 0)\n\n╭--------------+----------------------+-------+---------+----------╮\n| Contract     | Selector             | Calls | Reverts | Discards |\n+==================================================================+\n| TokenHandler | approve              | 7985  | 0       | 0        |\n|--------------+----------------------+-------+---------+----------|\n| TokenHandler | rejectInvalidAddress | 8256  | 0       | 0        |\n|--------------+----------------------+-------+---------+----------|\n| TokenHandler | transfer             | 8285  | 0       | 0        |\n|--------------+----------------------+-------+---------+----------|\n| TokenHandler | transferFrom         | 8242  | 0       | 0        |\n╰--------------+----------------------+-------+---------+----------╯\n\nLogs:\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 2126\n  Bound result 3\n  Bound result 5\n  Bound result 1006\n  Bound result 0\n  Bound result 0\n  Bound result 7999\n  Bound result 6373\n  Bound result 362216414677621700357410299\n  Bound result 1000000000\n  Bound result 173509479232\n  Bound result 0\n  Bound result 0\n  Bound result 6\n  Bound result 4\n  Bound result 5089\n  Bound result 4\n  Bound result 999999999999999766038731703\n  Bound result 52605901120\n  Bound result 5\n  Bound result 0\n  Bound result 34\n  Bound result 3878\n  Bound result 3\n  Bound result 3717\n\n[PASS] test_HandlerExercisesSpendingRevocationAndRecovery() (gas: 2255454)\nLogs:\n  Bound result 20\n  Bound result 20\n\nSuite result: ok. 2 passed; 0 failed; 0 skipped; finished in 8.55s (8.55s CPU time)\n\nRan 3 test suites in 8.55s (8.71s CPU time): 48 tests passed, 0 failed, 0 skipped (48 total tests)\n","passed":true},{"durationMs":44,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"SoothToken.approve(address,uint256)\",\"SoothToken.transfer(address,uint256)\",\"SoothToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"DEPENDENCIES.md\":18,\"DEPENDENCIES.sha256\":32,\"README.md\":63,\"foundry.toml\":22,\"src/SoothToken.sol\":17,\"test/SoothToken.EdgeCases.t.sol\":285,\"test/SoothToken.invariant.t.sol\":221,\"test/SoothToken.t.sol\":366,\"test/helpers/TokenFactory.sol\":15},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"da6369bd9c2a6e42a4658af70e0ace0bec31f7f2cf3d88ea9123c9d12eb961cc","verifiedTreeHash":"3cb8a696e1e71c8c5b21bea953dc45a56e8a71c1","verifierVersion":"0.1.0+560ab6a2"}]}