{"assessments":[],"deployments":[],"fuzz":[],"identity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"interpretation":"Records acceptance and evidence. Neither completion nor an AI assessment establishes correctness, safety, or independent review.","jobId":"c20621a0-a75d-4d50-b940-13921b8f488b","kind":"shape:chain","nodes":[{"acceptedSubmissionHash":"55a79c1886150ba3494929f0b3e08a45fc3c9a6e1c766747f9ef59b497659b00","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_economics","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"74173371b49e4b0e5bae18541f7a5b5001db02bd8ccfbe7f50c760eac8c4bcdf","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_flow","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"cf575089b7d00ce7fbf49b42ca6ccecd9baa73974a7349f26c7f0e495a484ebb","dependsOn":["build_contract_project","write_foundry_tests","manifest","audit_math","audit_permissions","audit_economics","audit_flow"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"af3aa01159bbf354f621cafa5c0006f6169e0938a8b015be508b7377dbf165bc","skillId":"audit-judge","tools":[]},"key":"audit_judge","kind":"code","role":"review","skillHash":"af3aa01159bbf354f621cafa5c0006f6169e0938a8b015be508b7377dbf165bc","skillId":"audit-judge","state":"accepted"},{"acceptedSubmissionHash":"dbd56367c883cd290d342fd41062d7e5540327cbca8b6548825f7174d39bc767","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_math","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"2c77f5897e94a46ae78a990997f9f2e55f28ab39d8784bf34bce846707fb7ccf","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_permissions","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"2c12e137a769e335ba922d3287adf83f09eddc59aedf4209853db5020a6e6b71","dependsOn":[],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"d59561da3b378461b7c749f6bd5084477d44993aa94972ddea90f542535751df","skillId":"build-contract-project","tools":[]},"key":"build_contract_project","kind":"code","role":"implement","skillHash":"d59561da3b378461b7c749f6bd5084477d44993aa94972ddea90f542535751df","skillId":"build-contract-project","state":"accepted"},{"acceptedSubmissionHash":"0b1ae1f433ac511bfeae0544f5fc5d43faa28de0ec292799551e18bf98defb88","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"tools":[]},"key":"manifest","kind":"code","role":"integrate","skillHash":null,"skillId":null,"state":"accepted"},{"acceptedSubmissionHash":"62c968733a32dfffb14bcf8422c93c9a39556bd11ec2dacc3a647a6a0c1572fd","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"4c76766b00591dfe982fe85d3de589fdb2f810e5137c301155d1c5e36a1d3b23","skillId":"write-foundry-tests","tools":[]},"key":"write_foundry_tests","kind":"code","role":"tests","skillHash":"4c76766b00591dfe982fe85d3de589fdb2f810e5137c301155d1c5e36a1d3b23","skillId":"write-foundry-tests","state":"accepted"}],"objective":"A custom token: Company.md (COMD).\nToken name: Company.md\nToken symbol: COMD\nToken supply: 1,000,000,000 with 18 decimals, all minted once to the deployer in the constructor.","parentJobId":null,"planHash":"c98565af6de128969e4a35aa45a02e6e3e5f141c0572045b7c17491f2f78d698","previousHash":"0000000000000000000000000000000000000000000000000000000000000000","projectId":"c20621a0-a75d-4d50-b940-13921b8f488b","publication":{"commit":null,"deliveredAt":null,"repoUrl":"https://github.com/identity-md-launches/launch-1888-company-md"},"receiptIdentity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"registry":"0xb6d0a187b050fa5bb0b87033a203f37becf4a775","research":[],"schema":"identitymd-work-v1","signals":[{"agentId":"51250","feedbackHash":"efec534b7837c69cc038c4ad21186b935511e084b12f76e6c124758c643119c7","nodeKey":"audit_economics","submissionHash":"55a79c1886150ba3494929f0b3e08a45fc3c9a6e1c766747f9ef59b497659b00","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51084","feedbackHash":"89bb9ac785590382bee2d42b0d4499f962fc9587d01c3749974a4f8298e18e7e","nodeKey":"audit_flow","submissionHash":"74173371b49e4b0e5bae18541f7a5b5001db02bd8ccfbe7f50c760eac8c4bcdf","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51352","feedbackHash":"72803b8e2dc001858281be72867cfbc9b2250dd035c1bfadefd24c1db03a6285","nodeKey":"audit_judge","submissionHash":"cf575089b7d00ce7fbf49b42ca6ccecd9baa73974a7349f26c7f0e495a484ebb","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52252","feedbackHash":"6b55a54bdf1bf2520626d362acac46932f1412704144ae193d17ad603c5f5074","nodeKey":"audit_math","submissionHash":"dbd56367c883cd290d342fd41062d7e5540327cbca8b6548825f7174d39bc767","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52178","feedbackHash":"167d633cc9ea3a820d1b032e894bdfafd5d1bd4cd4fc0572814b53fead0f1e41","nodeKey":"audit_permissions","submissionHash":"2c77f5897e94a46ae78a990997f9f2e55f28ab39d8784bf34bce846707fb7ccf","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51156","feedbackHash":"c5b63add70d672671b7ccf6df23eb159e51e5d8117d233482b2d16e70c2f178f","nodeKey":"build_contract_project","submissionHash":"2c12e137a769e335ba922d3287adf83f09eddc59aedf4209853db5020a6e6b71","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"51026","feedbackHash":"3c16239e05ab75c8cf3ea9a01fe2aeecc8c9afd5e168a7e16fa25fe0e966aee9","nodeKey":"manifest","submissionHash":"0b1ae1f433ac511bfeae0544f5fc5d43faa28de0ec292799551e18bf98defb88","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"52087","feedbackHash":"8e225cc35bae910014e1f2e34ab3b9eb8d6196da71a9d4d6a24f435b37725280","nodeKey":"write_foundry_tests","submissionHash":"62c968733a32dfffb14bcf8422c93c9a39556bd11ec2dacc3a647a6a0c1572fd","tag1":"verification:checks","tag2":"acceptance-v2","value":1}],"site":null,"snapshotHash":"d39f4f269110f625f2551ae33a6e608cfdb57ee6fc94b785e4897adeed39c077","state":"completed","submissions":[{"artifacts":[],"attempt":1,"bundleHash":"8959dedb18916ba40002af31d367cfbfd80ee390d63fcfb2aa5d853ed9c7a9b7","device":"56b13350bba65fd7","findings":[],"hash":"0b1ae1f433ac511bfeae0544f5fc5d43faa28de0ec292799551e18bf98defb88","nodeId":"46d5b181-fa74-4c7d-a295-b39fab0fbbfb","outcome":"completed","summary":"Done. I wrote and committed `launch.json` as the only change.\n\n**What the manifest describes.** The accepted tree holds one contract, `CompanyToken`, whose constructor takes no arguments and mints the full supply once to msg.sender. The manifest records it with an empty constructorArgs list, 18 decimals, and a totalSupply of 10^27 minor units, matching the compiled ABI and the supply constant. There are no application contracts, so the contracts list is empty.\n\n**Fixed launch fields.** The pool object uses the IMD pair address, fee 12500, tick spacing 60 and the one-to-one provenance price. The economics object is copied verbatim from the job. Notes run 854 characters and only describe the token actually present.\n\n**Checks run:**\n\n- A JSON check confirmed only the schema's six top-level keys, the verbatim economics, and the supply value.\n- `forge build` compiled cleanly and the constructor ABI shows zero inputs.\n- `forge test` with the verifier's fuzz seed passed all 34 tests.\n\nGit status is clean apart from the new commit containing launch.json. The protected tests need the launch harness and environment variables, so they could not be executed locally.","treeHash":"e6922f591c2080e7c2b0535d5c479cdf7e34ad8f","usage":{"cachedInputTokens":260820,"inputTokens":162,"model":"claude-fable-5-1","outputTokens":3033,"runtime":"claude","turns":11,"wallClockMs":129726}},{"artifacts":[],"attempt":1,"bundleHash":"9153cff17d0363c816ccac4b9248cbc9d8c8de84c3f7eec259e11820a8438afd","device":"1ccda5cdb3f24f3e","findings":[],"hash":"2c12e137a769e335ba922d3287adf83f09eddc59aedf4209853db5020a6e6b71","nodeId":"b4b430de-d53f-4a34-b4d4-aedd551a5179","outcome":"completed","summary":"Implemented Company.md (COMD): 1 billion tokens, 18 decimals, minted once to the deployer, with no admin or later minting powers.\n\nAdded offline-ready dependencies, deployment documentation, and success/failure tests.\n\nPassed:\n- `forge build` with Solidity 0.8.26\n- `forge test`: 34 tests, including fuzz and invariant checks using the requested seed\n- `forge fmt --check`\n\nThe separate protected launch harness was not run locally.","treeHash":"fa7e7d94916c32e26c6538e0b19c83b47affdcdb","usage":{"cachedInputTokens":288768,"inputTokens":45475,"model":"gpt-6-astra","outputTokens":12720,"runtime":"codex","turns":5,"wallClockMs":317742}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"f768e94767a9dde3","findings":[{"citation":"resolved","description":"lib/forge-std/VENDORED.md states the src/ tree is byte-for-byte upstream v1.9.7 and that lib/forge-std/SHA256SUMS records those bytes; README.md line 57 presents these checksums as part of the build's provenance. Seven of the vendored files do not hash to the recorded values: src/Vm.sol, src/console.sol, src/StdJson.sol, src/StdToml.sol, src/StdAssertions.sol, src/interfaces/IMulticall3.sol and src/interfaces/IERC7540.sol. Comparing each against upstream v1.9.7 shows the differences are whitespace only (long function signatures were re-wrapped, consistent with a `forge fmt` pass that touched lib/), so the test library is semantically unchanged and no production code is affected. The OpenZeppelin SHA256SUMS verify cleanly. This is a documentation and provenance defect, not a token defect: a reviewer who runs the verification the repository invites gets FAILED for the forge-std set and cannot confirm the test dependency without an out-of-band diff. Fix: either restore the seven files to their upstream bytes, or regenerate SHA256SUMS and reword VENDORED.md to say the files were reformatted.","line":3,"path":"lib/forge-std/VENDORED.md","reproduction":"State: the committed tree at HEAD (7a88e9a). Run `cd lib/forge-std && sha256sum -c SHA256SUMS`. Expected (per VENDORED.md and README.md line 57): every line reports OK. Actual: 7 lines report FAILED (src/StdJson.sol, src/interfaces/IMulticall3.sol, src/console.sol, src/Vm.sol, src/interfaces/IERC7540.sol, src/StdAssertions.sol, src/StdToml.sol) and sha256sum exits 1; e.g. src/Vm.sol hashes to a1b1c829...02a15 while SHA256SUMS records 9068805b...2cb1 (which is what upstream v1.9.7 src/Vm.sol hashes to). `diff <(tr -d ' \\n\\t' < upstream/src/Vm.sol) <(tr -d ' \\n\\t' < lib/forge-std/src/Vm.sol)` is empty, confirming whitespace-only change. `cd lib/openzeppelin-contracts && sha256sum -c SHA256SUMS` passes for all 6 lines.","severity":"info","snippet":"Unmodified `src/`, `LICENSE-APACHE`, and `LICENSE-MIT` from https://github.com/foundry-rs/forge-std/tree/v1.9.7 (tag `v1.9.7`). Test-only dependency; no submodule or package installation is required.","title":"Vendored forge-std files do not match their recorded SHA-256 checksums or the 'Unmodified' provenance claim"}],"hash":"2c77f5897e94a46ae78a990997f9f2e55f28ab39d8784bf34bce846707fb7ccf","nodeId":"9b5e83c9-9c05-42d6-974b-ee4497ec300d","outcome":"completed","summary":"The review is complete and `.imd-findings.json` is written. No tracked file was changed, and the scratch test was removed.\n\n**Result: no Access Control, Trust Gap or Asymmetry defect in the token.** `src/CompanyToken.sol` is a 17-line fixed-supply wrapper over an unmodified OpenZeppelin v5.4.0 ERC-20, with the vendored files verified against their recorded checksums. The compiled ABI exposes exactly three state-changing functions and no receive or fallback.\n\nWhat I traced for each entry point and the invariants around them:\n\n- **approve**: owner is `msg.sender` through a plain Context with no forwarder. Zero spender reverts. Allowance is isolated per owner and spender pair.\n- **transfer**: sender is `msg.sender`. Zero recipient and insufficient balance revert atomically. There is no fee, exemption or admin branch, so launch flows arrive whole.\n- **transferFrom**: gated on the allowance of `msg.sender` for the source account. Infinite allowance is untouched, finite is decremented. A zero source address cannot mint even at value zero.\n- **Constructor and roles**: no arguments, no owner, no minter. The whole supply of 10^27 units goes to the deployer, which is the factory under the launch. The deployer has exactly a holder's rights afterwards.\n- **Bytecode**: no DELEGATECALL, CALLCODE, SELFDESTRUCT or any CALL opcode in the runtime. A 1,000-run fuzz over arbitrary selectors, payloads and callers never changed supply, balances or ETH balance.\n\nThe project's own 34 tests pass under the documented seed, including the stateful invariant suite.\n\n**One info-level finding** is recorded. Seven vendored forge-std files do not match the checksums in `lib/forge-std/SHA256SUMS`, contradicting the \"Unmodified\" claim in its VENDORED.md and the provenance statement in the README. Diffing against upstream v1.9.7 shows the differences are whitespace only, consistent with a formatter pass. It is test-only with no runtime impact. The reproduction is the failing `sha256sum -c` command.\n\nThe coverage record has 11 rows: all three listed entry points hold, plus rows for the constructor, the absent receive and fallback, the no-privileged-role and supply-conservation invariants, the protected launch-flow and decimals checks, the Owners floor, and the provenance finding. Nothing in the assigned area was left unreached.","treeHash":null,"usage":{"cachedInputTokens":847031,"inputTokens":290,"model":"claude-fable-5-1","outputTokens":17548,"runtime":"claude","turns":30,"wallClockMs":251801}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"0cf632e317dfab7a","findings":[],"hash":"55a79c1886150ba3494929f0b3e08a45fc3c9a6e1c766747f9ef59b497659b00","nodeId":"4395a929-a13c-4ac1-8420-1d3614149c00","outcome":"completed","summary":"The review is complete. The findings file holds an empty findings list and a full coverage record, and no tracked file was changed.\n\n**Result: no defects substantiated** in the economic security, invariant, or flow-gap areas for Company.md (COMD).\n\n**What I checked**\n\n- **Source and dependency.** CompanyToken.sol is a 17-line contract: a constant and a constructor that mints 1e27 units to msg.sender over unmodified OpenZeppelin ERC20. The five vendored OpenZeppelin files match the repository's SHA256SUMS and are byte-identical to upstream tag v5.4.0, which I fetched and diffed.\n- **Economic Security guide.** No external dependencies, oracles, callbacks, fees, rebases, blocklists or sentinel-address branches exist. Transfer to the zero address and approval of a zero spender revert. Balance delta equals the amount sent on both the push and pull paths, which is what the Uniswap v4 PoolManager's settle logic relies on. The 10/80/10 launch split of 1e27 divides with no dust.\n- **Invariant guide.** The sum of balances equals totalSupply equals 1e27 with no writer to totalSupply after construction. There is no burn, mint, or override of the update hook. The existing 256x64 stateful invariant and the fuzz tests conserve the sum, and I confirmed this with a scratch fuzz over the whole supply range.\n- **Flow Gap guide.** There are no periphery calls, hooks or multi-step flows inside the token, so no seam exists to exploit. The launch flows (factory to distributor, claim, seed, buy, sell) move exactly what they say because no transfer rule exists to exempt.\n- **Entry points and privilege.** The compiled ABI exposes only approve, transfer and transferFrom as writers plus views. The runtime has no DELEGATECALL, CALLCODE or SELFDESTRUCT and no owner or admin path.\n- **Static analysis leads.** Slither reported nothing. Aderyn's large-numeric-literal note on line 10 is style only; the literal is exactly 1e27.\n\n**Commands run**\n\n```\nforge build                      -> compiled, no warnings\nforge test (README seed)         -> 34 passed, 0 failed\nforge test --match-path test/scratch/EconomicsScratch.t.sol -> 3 passed (then removed)\nsha256sum -c SHA256SUMS; diff -r against upstream v5.4.0 -> identical\n```\n\n**Not executed.** The protected launch tests under .imd/reads/protected need v4-core, the LaunchLiquidity helper and the launch environment variables, none of which are in this tree, so I did not run the real seed-and-swap harness. The coverage row for the launch flow says so explicitly.","treeHash":null,"usage":{"cachedInputTokens":795338,"inputTokens":386,"model":"claude-fable-5-1","outputTokens":8651,"runtime":"claude","turns":13,"wallClockMs":141794}},{"artifacts":[],"attempt":1,"bundleHash":"1df91a09ca5816700b79718c785c59aa437d13341181953254138d7042065797","device":"553a378efc6a19cb","findings":[],"hash":"62c968733a32dfffb14bcf8422c93c9a39556bd11ec2dacc3a647a6a0c1572fd","nodeId":"61cb1883-5f5d-44a2-a6f8-44266c4ac0af","outcome":"completed","summary":"Added 17 unit/fuzz tests and expanded invariants to cover rejected calls, allowance transitions, and independent balance accounting.\n\n`forge build` and `forge test` pass offline with the supplied seed: 9,000 fuzz cases and 16,384 invariant calls.\n\nChanges are confined to `test/`. No contract defects found.","treeHash":"8a837731f37a5c61e0de1210e1e2521836539256","usage":{"cachedInputTokens":643072,"inputTokens":78068,"model":"gpt-6-astra","outputTokens":11257,"runtime":"codex","turns":5,"wallClockMs":331094}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"7c0191a32541eb74","findings":[{"citation":"resolved","description":"README.md line 57 and lib/forge-std/VENDORED.md state that the Forge standard library is vendored unmodified with SHA-256 checksums recording the upstream bytes. Running the checksum file against the tree fails for 7 of 30 files (src/StdJson.sol, src/interfaces/IMulticall3.sol, src/console.sol, src/Vm.sol, src/interfaces/IERC7540.sol, src/StdAssertions.sol, src/StdToml.sol). I downloaded the upstream v1.9.7 archive (its SHA-256 45157353ab49... matches the one VENDORED.md records) and diffed the seven files: every difference is a whitespace-only reflow of a multi-line function signature onto one line, consistent with `forge fmt` having been run over lib/. No code, constant or logic differs, so test behaviour is unaffected and the production contract (src/CompanyToken.sol) does not import forge-std at all. The five OpenZeppelin v5.4.0 files, by contrast, are byte-identical to upstream (verified against raw.githubusercontent.com). This is a provenance/documentation defect only: a reviewer following the README's own verification instruction gets a FAILED result, which undermines the integrity claim the README makes. Fix: either restore the seven upstream files byte-for-byte (and exclude lib/ from `forge fmt`), or regenerate SHA256SUMS from the tree and reword VENDORED.md to say the files were reformatted. Note the submission rules forbid touching lib/ in this task, so the author needs a build-task write budget that includes lib/forge-std/ to repair it.","line":3,"path":"lib/forge-std/VENDORED.md","reproduction":"From the repository root run `cd lib/forge-std && sha256sum -c SHA256SUMS`. Expected (per VENDORED.md and README.md): all 30 lines report OK. Actual: 23 OK and 7 FAILED (src/StdJson.sol, src/interfaces/IMulticall3.sol, src/console.sol, src/Vm.sol, src/interfaces/IERC7540.sol, src/StdAssertions.sol, src/StdToml.sol); `sha256sum` exits 1 with 'WARNING: 7 computed checksums did NOT match'. Downloading https://github.com/foundry-rs/forge-std/archive/refs/tags/v1.9.7.tar.gz and running `diff` on each of the seven files shows only line-wrapping differences, e.g. src/Vm.sol line 827 upstream splits `function getDeployment(string calldata contractName, uint64 chainId)` over four lines while the vendored copy has it on one line.","severity":"info","snippet":"Unmodified `src/`, `LICENSE-APACHE`, and `LICENSE-MIT` from https://github.com/foundry-rs/forge-std/tree/v1.9.7 (tag `v1.9.7`). Test-only dependency; no submodule or package installation is required.","title":"Vendored forge-std is not byte-identical to v1.9.7 as VENDORED.md and SHA256SUMS claim (7 files reformatted; test-only, no behaviour change)"}],"hash":"74173371b49e4b0e5bae18541f7a5b5001db02bd8ccfbe7f50c760eac8c4bcdf","nodeId":"054dd0e8-fa0b-411c-bf06-dd9cb6dddc9e","outcome":"completed","summary":"The review is complete and the findings file is written and validated.\n\n**Outcome:** the production contract has no defects I could substantiate. The only reportable item is an informational provenance defect in the test-only forge-std vendoring.\n\n**What I checked, in my area (Execution Trace, Periphery, First Principles):**\n- Traced the constructor and all three state-changing entry points through the inherited OpenZeppelin code with concrete values. The supply is minted once to the constructor's caller, which is the factory under the launch. Transfers deliver exact amounts, self-transfers net zero, the zero address is rejected everywhere, and no path mints, burns, pauses, freezes or seizes.\n- Verified all five vendored OpenZeppelin files are byte-identical to the upstream v5.4.0 tag. The ERC20 implementation is unmodified and the token overrides nothing.\n- Scanned creation and runtime bytecode independently. No CALL, STATICCALL, CREATE, DELEGATECALL, CALLCODE, SELFDESTRUCT or transient-storage opcodes exist, and the runtime is well under the EIP-170 limit.\n- Built and ran the project's 34 tests with the README's seed, plus the invariant run and `forge fmt --check`. All pass. A scratch test under `test/scratch/` exercising nested-constructor deployment, self-spender allowances, router-style pull flows, max-uint inputs and unknown selectors also passes.\n- Checked the two static-analysis leads. The aderyn large-literal note is the intended 10^27 supply, confirmed equal by the existing tests. Slither reported nothing.\n\n**The one finding (info):** `lib/forge-std/VENDORED.md` claims the library is unmodified from v1.9.7 and the README says its checksums verify, but `sha256sum -c SHA256SUMS` fails for 7 of 30 files. I downloaded the upstream archive and diffed them. Every difference is a whitespace-only reflow of function signatures, so test behaviour is unchanged. Repairing it needs a write budget that includes `lib/`, which this task does not have.\n\n**Coverage:** all three listed entry points are marked `holds`, with six additional rows for the constructor, supply conservation, launch-flow exactness, bytecode restrictions, and both vendored libraries. The unverified items outside my reach are launch-side: the manifest, pool economics and the chain id named in the README are not in this tree and could not be checked.","treeHash":null,"usage":{"cachedInputTokens":630816,"inputTokens":258,"model":"claude-fable-5-1","outputTokens":18230,"runtime":"claude","turns":25,"wallClockMs":267698}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"8f08088e7a7f557f","findings":[{"citation":"resolved","description":"Merged from audit_permissions and audit_flow (same root cause). lib/forge-std/VENDORED.md says src/ is unmodified upstream v1.9.7 and that SHA256SUMS records those bytes; README.md line 57 presents these checksums as part of the build provenance. Seven files (src/StdJson.sol, src/interfaces/IMulticall3.sol, src/console.sol, src/Vm.sol, src/interfaces/IERC7540.sol, src/StdAssertions.sol, src/StdToml.sol) do not hash to the recorded values. I downloaded the upstream v1.9.7 archive (its SHA-256 45157353ab49eab01d294565866731e599b32401757229689ee459aa26b7ee94 matches the one VENDORED.md records) and compared each of the seven: every byte difference disappears when whitespace is stripped, so the change is a reformat (consistent with forge fmt having run over lib/) and the library is semantically unchanged. The production contract src/CompanyToken.sol imports only OpenZeppelin, whose five vendored files I verified byte-identical to upstream v5.4.0 and whose SHA256SUMS pass. Impact: a reviewer who runs the verification the repository invites gets FAILED for forge-std and cannot confirm the test dependency without an out-of-band diff; no token behaviour is affected. Fix: restore the seven files to upstream bytes (and keep lib/ out of forge fmt), or regenerate lib/forge-std/SHA256SUMS and reword VENDORED.md to say the files were reformatted. Note lib/ is outside the write budget of audit tasks, so the repair needs a build task that may touch lib/forge-std/.","line":3,"path":"lib/forge-std/VENDORED.md","reproduction":"State: the committed tree at HEAD (c18e910). Run `cd lib/forge-std && sha256sum -c SHA256SUMS`. Expected per VENDORED.md line 3 and README.md line 57: every line OK, exit 0. Actual: 23 OK, 7 FAILED (src/StdJson.sol, src/interfaces/IMulticall3.sol, src/console.sol, src/Vm.sol, src/interfaces/IERC7540.sol, src/StdAssertions.sol, src/StdToml.sol), `WARNING: 7 computed checksums did NOT match`, exit 1. Cross-check: download https://github.com/foundry-rs/forge-std/archive/refs/tags/v1.9.7.tar.gz (sha256 45157353ab49...7ee94), extract, and for each of the seven files `cmp` reports a byte difference while `diff <(tr -d \" \\n\\t\" < upstream/FILE) <(tr -d \" \\n\\t\" < lib/forge-std/FILE)` is empty. By contrast `cd lib/openzeppelin-contracts && sha256sum -c SHA256SUMS` reports 6 OK.","severity":"info","snippet":"Unmodified `src/`, `LICENSE-APACHE`, and `LICENSE-MIT` from https://github.com/foundry-rs/forge-std/tree/v1.9.7 (tag `v1.9.7`). Test-only dependency; no submodule or package installation is required.","title":"Vendored forge-std does not match its recorded SHA-256 checksums or the Unmodified claim (7 files reformatted, whitespace only; test-only dependency)"},{"citation":"resolved","description":"README.md line 28 ends with the claim that this repository does not supply a `launch.json`, yet launch.json exists at the root of the committed tree (kind custom_token, contract CompanyToken, constructorArgs [], totalSupply 1000000000000000000000000000). The manifest itself is consistent with the code: the compiled constructor takes no inputs, INITIAL_SUPPLY equals the manifest totalSupply, name/symbol/decimals match, the contract identifier is 12 characters, addresses are lowercase, fee/tickSpacing/decimals are numbers and uint256 fields are strings. The defect is only that the README describes the tree inaccurately, which can mislead a reviewer about what the launch will deploy from. Fix: update the sentence to say the manifest is supplied in launch.json (written by the manifest step) and that the repository does not broadcast transactions.","line":28,"path":"README.md","reproduction":"State: committed tree at HEAD (c18e910). Run `ls launch.json && sed -n 28p README.md`. Expected: the README sentence and the tree agree. Actual: `launch.json` is listed and line 28 reads that the repository does not supply a `launch.json`.","severity":"info","snippet":"When the launch factory deploys this token, the factory receives the entire supply. Neither the transaction origin nor any requester wallet receives tokens directly from the constructor. The factory is then responsible for distribution. There are no application contracts, reserved allocations, or token-side distribution logic in this project. The separate launch process supplies its manifest and performs deployment; this repository does not broadcast transactions or supply a `launch.json`.","title":"README states the repository does not supply a launch.json, but launch.json is committed at the repository root"}],"hash":"cf575089b7d00ce7fbf49b42ca6ccecd9baa73974a7349f26c7f0e495a484ebb","nodeId":"280818d2-6565-4e2a-b06f-6b644cc01526","outcome":"completed","summary":"The review is complete and `.imd-findings.json` holds the result.\n\n**Outcome:** the token itself is clean. `CompanyToken` is a 17-line wrapper over the unmodified OpenZeppelin v5.4.0 ERC-20, with a no-argument constructor that mints the full supply to the deployer. I verified the five vendored OpenZeppelin files byte for byte against upstream, ran the project's 51 tests (all pass, with the README's seed), and ran my own launch-floor simulation: CREATE2 deployment from a factory, exact factory-to-distributor-to-claimant and pool-to-trader flows, allowance semantics, 14 admin and mint selectors reverting, native value rejected, no forbidden opcodes, and sizes well under the creation and runtime limits. All three entry points are recorded as `holds`, with three extra invariant rows.\n\n**Findings kept, both info:**\n- **Vendored forge-std provenance mismatch.** The two specialist reports were the same root cause and are merged into one finding. I reproduced it: 7 of 30 files fail `sha256sum -c`, and a diff against the upstream v1.9.7 archive (whose hash matches the one recorded) shows whitespace-only reformatting. Test-only, no token impact.\n- **README contradicts the tree.** Line 28 says the repository does not supply a `launch.json`, but one is committed. The manifest itself agrees with the code and ABI.\n\n**Dropped:** the aderyn large-numeric-literal line is a style note on a compile-time constant and not a defect. Slither reported nothing. No critical or high finding exists, so no proof file was attached, and the scratch test directory was removed.","treeHash":null,"usage":{"cachedInputTokens":890016,"inputTokens":258,"model":"claude-fable-5-1","outputTokens":13677,"runtime":"claude","turns":30,"wallClockMs":210688}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"c0fc4ea4f50e3380","findings":[],"hash":"dbd56367c883cd290d342fd41062d7e5540327cbca8b6548825f7174d39bc767","nodeId":"2988b59b-fe2c-4b76-935c-10e558212de2","outcome":"completed","summary":"The review is complete. The findings file is written and valid, the scratch tests are removed, and the only untracked artifact in the tree is the findings file itself.\n\n**Result: no defects found in the Math Precision, Boundary and Numerical Gap area.** The file `.imd-findings.json` holds an empty findings list and eight coverage rows, all `holds`.\n\n**What the token is.** One contract, `src/CompanyToken.sol`, inheriting the unmodified OpenZeppelin v5.4.0 ERC-20. Its only custom code is a supply constant and a constructor that mints that constant to the deployer. There is no fee, burn, mint, owner, callback, payable path, external call or bytes decoding anywhere.\n\n**What I checked, with evidence:**\n- **Supply constant.** The literal evaluates at compile time to exactly 10^27, below 2^90. Both the project tests and my scratch probe assert that value. The aderyn \"large numeric literal\" lead is style only.\n- **Transfer arithmetic.** OpenZeppelin checks balance before the unchecked subtraction and bounds the unchecked addition by total supply. I probed a max-uint transfer, 1 wei, zero amount from an empty account, and a self-transfer of the whole balance. All behave exactly.\n- **Allowance arithmetic.** Allowance is checked before the unchecked decrement. Max is the infinite sentinel and max minus one stays finite. A balance failure after the allowance is spent reverts atomically, so the allowance is restored.\n- **Launch split.** Ten and eighty percent of 10^27 are 10^26 and 8·10^26 with zero remainder, and the bps multiplication cannot overflow. Transfers deliver the full amount, so the protected swarm, seed and swap flows receive exactly what they send.\n- **Conservation invariant.** With no rounding or division anywhere, the sum of balances equals total supply by construction. The project's stateful invariant suite and my fuzz over arbitrary splits both hold.\n- **Boundary enumeration.** No external call sites, no payable functions, no bytes inputs. The only sentinel branches are OpenZeppelin's zero-address reverts. Native value and unknown selectors revert.\n- **Dependency integrity.** All five vendored OpenZeppelin files match the recorded checksums and are byte-identical to upstream tag v5.4.0 fetched from GitHub.\n\n**Test runs.** The build succeeds and all 34 project tests pass with the README's fuzz seed. The formatter check passes. My nine scratch probes passed and were deleted afterwards.\n\n**Not reached.** Nothing in the assigned area was left unexamined. Pool price derivation from the opening cap happens in the deployer, outside this repository, so I did not audit it. With 18 decimals and a 10^27 supply, any plausible cap lands well inside Uniswap v4's sqrt-price range in either currency order.","treeHash":null,"usage":{"cachedInputTokens":711307,"inputTokens":354,"model":"claude-fable-5-1","outputTokens":10713,"runtime":"claude","turns":18,"wallClockMs":145343}}],"verification":[{"checks":[{"durationMs":1063,"exitCode":0,"name":"build","output":"Compiling 27 files with Solc 0.8.26\nSolc 0.8.26 finished in 994.71ms\nCompiler run successful!\n","passed":true},{"durationMs":1428,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 33 tests for test/CompanyToken.t.sol:CompanyTokenTest\n[PASS] testFuzz_transferAboveAllowanceReverts(uint256,uint256) (runs: 1000, μ: 133254, ~: 133858)\nLogs:\n  Bound result 482395917619350362601004015\n  Bound result 2190529624120367484655561\n\n[PASS] testFuzz_transferAboveBalanceReverts(uint256,uint256) (runs: 1000, μ: 126858, ~: 127167)\nLogs:\n  Bound result 772378573210856374948234645\n  Bound result 954212050234098376078755441001252436111\n\n[PASS] testFuzz_transferFromConsumesFiniteAllowance(uint256,uint256) (runs: 1000, μ: 162961, ~: 164847)\nLogs:\n  Bound result 482395731975468684187343834\n  Bound result 2190529624120367484655561\n\n[PASS] testFuzz_transfersConserveSupply(uint256,uint256) (runs: 1000, μ: 152004, ~: 152660)\nLogs:\n  Bound result 12000000000000000000\n  Bound result 12734\n\n[PASS] test_approvalCanBeReplacedAndRevoked() (gas: 185779)\n[PASS] test_approvalEmitsEventAndDoesNotMoveTokens() (gas: 88765)\n[PASS] test_approvalsAreIsolatedByOwnerAndSpender() (gas: 216795)\n[PASS] test_approveZeroSpenderReverts() (gas: 37618)\n[PASS] test_constructorEmitsExactlyOneMintEvent() (gas: 9740)\n[PASS] test_create2DeploymentMintsToFactoryInsteadOfTransactionOrigin() (gas: 296105)\n[PASS] test_deployerCannotSpendHolderBalanceWithoutApproval() (gas: 158005)\n[PASS] test_directDeploymentMintsToTheDeployingAccount() (gas: 28222)\n[PASS] test_infiniteAllowanceIsNotDecremented() (gas: 149678)\n[PASS] test_launchDistributionAndSubsequentTransfersArriveWhole() (gas: 639809)\n[PASS] test_metadataAndEntireInitialSupply() (gas: 107693)\n[PASS] test_noMintBurnOrAdministrativeEntryPoints() (gas: 762747)\n[PASS] test_rejectsNativeCurrency() (gas: 42685)\n[PASS] test_runtimeHasNoForbiddenOpcodesAndFitsDeploymentLimit() (gas: 1039951)\n[PASS] test_selfTransferPreservesBalance() (gas: 51410)\n[PASS] test_selfTransferStillRequiresSufficientBalance() (gas: 42887)\n[PASS] test_transferBeyondBalanceRevertsWithoutChangingBalances() (gas: 65292)\n[PASS] test_transferEmitsEventAndMovesExactAmount() (gas: 91495)\n[PASS] test_transferEntireSupplyAndReturnIt() (gas: 159422)\n[PASS] test_transferFromBeyondAllowanceRevertsAtomically() (gas: 115704)\n[PASS] test_transferFromBeyondBalanceRestoresAllowance() (gas: 188823)\n[PASS] test_transferFromRequiresAllowanceEvenForTheOwner() (gas: 35773)\n[PASS] test_transferFromSelfSpendsAllowanceWithoutChangingBalance() (gas: 103293)\n[PASS] test_transferFromSpendsAllowanceAndEmitsTransfer() (gas: 231741)\n[PASS] test_transferFromToZeroRestoresAllowance() (gas: 114192)\n[PASS] test_transferFromZeroAddressCannotMintEvenZeroAmount() (gas: 57144)\n[PASS] test_transferFromZeroAmountNeedsNoPositiveAllowance() (gas: 78763)\n[PASS] test_transferToZeroRevertsIncludingZeroAmount() (gas: 71992)\n[PASS] test_zeroTransferFromEmptyAccountEmitsEvent() (gas: 73389)\nSuite result: ok. 33 passed; 0 failed; 0 skipped; finished in 30.99ms (128.28ms CPU time)\n\nRan 1 test for test/CompanyToken.invariant.t.sol:CompanyTokenInvariantTest\n[PASS] invariant_supplyAndBalancesRemainConserved() (runs: 256, calls: 16384, reverts: 0)\n\n╭---------------------+--------------+-------+---------+----------╮\n| Contract            | Selector     | Calls | Reverts | Discards |\n+=================================================================+\n| CompanyTokenHandler | approve      | 5459  | 0       | 0        |\n|---------------------+--------------+-------+---------+----------|\n| CompanyTokenHandler | transfer     | 5334  | 0       | 0        |\n|---------------------+--------------+-------+---------+----------|\n| CompanyTokenHandler | transferFrom | 5591  | 0       | 0        |\n╰---------------------+--------------+-------+---------+----------╯\n\nLogs:\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 2000000000000000000\n  Bound result 7174\n  Bound result 560434211798701081\n  Bound result 0\n  Bound result 95\n  Bound result 0\n  Bound result 3690\n  Bound result 0\n  Bound result 13\n  Bound result 2010\n  Bound result 910\n  Bound result 1439565788201302622\n  Bound result 242\n  Bound result 0\n  Bound result 10\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 6\n  Bound result 0\n  Bound result 143575294\n  Bound result 12\n  Bound result 0\n  Bound result 0\n  Bound result 122198989\n  Bound result 0\n  Bound result 3\n  Bound result 622\n  Bound result 1673\n  Bound result 1439565788179926409\n  Bound result 71\n  Bound result 0\n  Bound result 3\n  Bound result 12098692\n  Bound result 3000000000000000000\n  Bound result 7236736\n  Bound result 973543\n  Bound result 0\n  Bound result 9405441\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 10000000000000000000\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 1.35s (1.35s CPU time)\n\nRan 2 test suites in 1.35s (1.38s CPU time): 34 tests passed, 0 failed, 0 skipped (34 total tests)\n","passed":true},{"durationMs":32,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"CompanyToken.approve(address,uint256)\",\"CompanyToken.transfer(address,uint256)\",\"CompanyToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"README.md\":69,\"foundry.toml\":18,\"launch.json\":24,\"remappings.txt\":2,\"src/CompanyToken.sol\":17,\"test/CompanyToken.invariant.t.sol\":87,\"test/CompanyToken.t.sol\":423},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"0b1ae1f433ac511bfeae0544f5fc5d43faa28de0ec292799551e18bf98defb88","verifiedTreeHash":"e6922f591c2080e7c2b0535d5c479cdf7e34ad8f","verifierVersion":"0.1.0+8fbf00a5"},{"checks":[{"durationMs":1423,"exitCode":0,"name":"build","output":"Compiling 27 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.31s\nCompiler run successful!\n","passed":true},{"durationMs":1897,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 33 tests for test/CompanyToken.t.sol:CompanyTokenTest\n[PASS] testFuzz_transferAboveAllowanceReverts(uint256,uint256) (runs: 1000, μ: 133254, ~: 133858)\nLogs:\n  Bound result 127\n  Bound result 1\n\n[PASS] testFuzz_transferAboveBalanceReverts(uint256,uint256) (runs: 1000, μ: 126858, ~: 127167)\nLogs:\n  Bound result 482395731975468684187343834\n  Bound result 2190529624120367484655561\n\n[PASS] testFuzz_transferFromConsumesFiniteAllowance(uint256,uint256) (runs: 1000, μ: 162961, ~: 164847)\nLogs:\n  Bound result 12000000000000000000\n  Bound result 12734\n\n[PASS] testFuzz_transfersConserveSupply(uint256,uint256) (runs: 1000, μ: 152004, ~: 152660)\nLogs:\n  Bound result 20628214175477911937633893\n  Bound result 2362258869744175879663316\n\n[PASS] test_approvalCanBeReplacedAndRevoked() (gas: 185779)\n[PASS] test_approvalEmitsEventAndDoesNotMoveTokens() (gas: 88765)\n[PASS] test_approvalsAreIsolatedByOwnerAndSpender() (gas: 216795)\n[PASS] test_approveZeroSpenderReverts() (gas: 37618)\n[PASS] test_constructorEmitsExactlyOneMintEvent() (gas: 9740)\n[PASS] test_create2DeploymentMintsToFactoryInsteadOfTransactionOrigin() (gas: 296105)\n[PASS] test_deployerCannotSpendHolderBalanceWithoutApproval() (gas: 158005)\n[PASS] test_directDeploymentMintsToTheDeployingAccount() (gas: 28222)\n[PASS] test_infiniteAllowanceIsNotDecremented() (gas: 149678)\n[PASS] test_launchDistributionAndSubsequentTransfersArriveWhole() (gas: 639809)\n[PASS] test_metadataAndEntireInitialSupply() (gas: 107693)\n[PASS] test_noMintBurnOrAdministrativeEntryPoints() (gas: 762747)\n[PASS] test_rejectsNativeCurrency() (gas: 42685)\n[PASS] test_runtimeHasNoForbiddenOpcodesAndFitsDeploymentLimit() (gas: 1039951)\n[PASS] test_selfTransferPreservesBalance() (gas: 51410)\n[PASS] test_selfTransferStillRequiresSufficientBalance() (gas: 42887)\n[PASS] test_transferBeyondBalanceRevertsWithoutChangingBalances() (gas: 65292)\n[PASS] test_transferEmitsEventAndMovesExactAmount() (gas: 91495)\n[PASS] test_transferEntireSupplyAndReturnIt() (gas: 159422)\n[PASS] test_transferFromBeyondAllowanceRevertsAtomically() (gas: 115704)\n[PASS] test_transferFromBeyondBalanceRestoresAllowance() (gas: 188823)\n[PASS] test_transferFromRequiresAllowanceEvenForTheOwner() (gas: 35773)\n[PASS] test_transferFromSelfSpendsAllowanceWithoutChangingBalance() (gas: 103293)\n[PASS] test_transferFromSpendsAllowanceAndEmitsTransfer() (gas: 231741)\n[PASS] test_transferFromToZeroRestoresAllowance() (gas: 114192)\n[PASS] test_transferFromZeroAddressCannotMintEvenZeroAmount() (gas: 57144)\n[PASS] test_transferFromZeroAmountNeedsNoPositiveAllowance() (gas: 78763)\n[PASS] test_transferToZeroRevertsIncludingZeroAmount() (gas: 71992)\n[PASS] test_zeroTransferFromEmptyAccountEmitsEvent() (gas: 73389)\nSuite result: ok. 33 passed; 0 failed; 0 skipped; finished in 37.09ms (153.10ms CPU time)\n\nRan 1 test for test/CompanyToken.invariant.t.sol:CompanyTokenInvariantTest\n[PASS] invariant_supplyAndBalancesRemainConserved() (runs: 256, calls: 16384, reverts: 0)\n\n╭---------------------+--------------+-------+---------+----------╮\n| Contract            | Selector     | Calls | Reverts | Discards |\n+=================================================================+\n| CompanyTokenHandler | approve      | 5459  | 0       | 0        |\n|---------------------+--------------+-------+---------+----------|\n| CompanyTokenHandler | transfer     | 5334  | 0       | 0        |\n|---------------------+--------------+-------+---------+----------|\n| CompanyTokenHandler | transferFrom | 5591  | 0       | 0        |\n╰---------------------+--------------+-------+---------+----------╯\n\nLogs:\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 2000000000000000000\n  Bound result 7174\n  Bound result 560434211798701081\n  Bound result 0\n  Bound result 95\n  Bound result 0\n  Bound result 3690\n  Bound result 0\n  Bound result 13\n  Bound result 2010\n  Bound result 910\n  Bound result 1439565788201302622\n  Bound result 242\n  Bound result 0\n  Bound result 10\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 6\n  Bound result 0\n  Bound result 143575294\n  Bound result 12\n  Bound result 0\n  Bound result 0\n  Bound result 122198989\n  Bound result 0\n  Bound result 3\n  Bound result 622\n  Bound result 1645\n  Bound result 1439565788179926409\n  Bound result 0\n  Bound result 0\n  Bound result 3\n  Bound result 17683017\n  Bound result 3000000000000000000\n  Bound result 83\n  Bound result 3169864\n  Bound result 2492\n  Bound result 9405441\n  Bound result 0\n  Bound result 17\n  Bound result 129\n  Bound result 10000000000000000000\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 1.79s (1.78s CPU time)\n\nRan 2 test suites in 1.79s (1.82s CPU time): 34 tests passed, 0 failed, 0 skipped (34 total tests)\n","passed":true},{"durationMs":66,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"CompanyToken.approve(address,uint256)\",\"CompanyToken.transfer(address,uint256)\",\"CompanyToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"README.md\":69,\"foundry.toml\":18,\"remappings.txt\":2,\"src/CompanyToken.sol\":17,\"test/CompanyToken.invariant.t.sol\":87,\"test/CompanyToken.t.sol\":423},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true},{"durationMs":603,"exitCode":0,"name":"slither","output":"slither: no results at low impact or above","passed":true},{"durationMs":293,"exitCode":0,"name":"aderyn","output":"[low] large-numeric-literal at src/CompanyToken.sol:10: Large Numeric Literal","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"2c12e137a769e335ba922d3287adf83f09eddc59aedf4209853db5020a6e6b71","verifiedTreeHash":"fa7e7d94916c32e26c6538e0b19c83b47affdcdb","verifierVersion":"0.1.0+8fbf00a5"},{"checks":[{"durationMs":1331,"exitCode":0,"name":"build","output":"Compiling 28 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.26s\nCompiler run successful!\n","passed":true},{"durationMs":5206,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 17 tests for test/CompanyToken.boundaries.t.sol:CompanyTokenBoundaryTest\n[PASS] testFuzz_allowancesAboveSupplyRemainFinite(uint256,uint256) (runs: 1000, μ: 165638, ~: 165757)\nLogs:\n  Bound result 115792089237316195423570985008687907853269984665639564039457584007913129658509\n  Bound result 18427\n\n[PASS] testFuzz_approvalReplacementIsIdempotent(uint256,uint256) (runs: 1000, μ: 185556, ~: 185623)\n[PASS] testFuzz_delegatedSelfTransferConsumesOnlyAllowance(uint256,uint256) (runs: 1000, μ: 137790, ~: 138526)\nLogs:\n  Bound result 3229645957451447679020628217405123869389081572\n  Bound result 680958220078916324734650773\n\n[PASS] testFuzz_failedBalanceCheckPreservesAllowanceAndLaterSpendWorks(uint256,uint256,bool) (runs: 1000, μ: 301867, ~: 303887)\nLogs:\n  Bound result 977877134547939618614237624\n  Bound result 115792089237316195423570985008687907853269984665639591451250465460780795390429\n\n[PASS] testFuzz_splitDelegatedSpendsEqualOneSpend(uint256,uint256) (runs: 1000, μ: 248859, ~: 249563)\nLogs:\n  Bound result 725489213035287438213584237\n  Bound result 611498375233273734537932850\n\n[PASS] test_approvalFromAnotherOwnerDoesNotAuthorizeSpendingThisOwnersTokens() (gas: 183437)\n[PASS] test_directTransfersLeaveExistingAllowancesUntouched() (gas: 259023)\n[PASS] test_maximumMinusOneIsFiniteAndSwitchingAllowanceModesTakesEffect() (gas: 344988)\n[PASS] test_maximumTransferAmountFailsWithBalanceErrorAndPreservesUnlimitedAllowance() (gas: 184079)\n[PASS] test_multipleSpendersCannotSpendMoreThanTheOwnersBalance() (gas: 408508)\n[PASS] test_oneBaseUnitRoundTripExhaustsAllowance() (gas: 239467)\n[PASS] test_ownerCanUseTransferFromWithExplicitSelfApproval() (gas: 167756)\n[PASS] test_returningTokensDoesNotRestoreSpentAllowance() (gas: 228856)\n[PASS] test_unlimitedApprovalCanBeRevokedAfterUse() (gas: 198046)\n[PASS] test_zeroDelegatedTransferEmitsEventWithoutChangingFiniteAllowance() (gas: 139671)\n[PASS] test_zeroDelegatedTransferToZeroAddressStillReverts() (gas: 262796)\n[PASS] test_zeroSpenderRejectedForZeroAndMaximumApprovals() (gas: 72836)\nSuite result: ok. 17 passed; 0 failed; 0 skipped; finished in 61.15ms (302.74ms CPU time)\n\nRan 33 tests for test/CompanyToken.t.sol:CompanyTokenTest\n[PASS] testFuzz_transferAboveAllowanceReverts(uint256,uint256) (runs: 1000, μ: 133317, ~: 133870)\nLogs:\n  Bound result 482395917619350362601004015\n  Bound result 2190529624120367484655561\n\n[PASS] testFuzz_transferAboveBalanceReverts(uint256,uint256) (runs: 1000, μ: 126767, ~: 127211)\nLogs:\n  Bound result 927871747394697559752179863\n  Bound result 115792089237316195423570985008687907853269984665639636167710189310353377460070\n\n[PASS] testFuzz_transferFromConsumesFiniteAllowance(uint256,uint256) (runs: 1000, μ: 162838, ~: 164847)\nLogs:\n  Bound result 9\n  Bound result 4\n\n[PASS] testFuzz_transfersConserveSupply(uint256,uint256) (runs: 1000, μ: 151889, ~: 152660)\nLogs:\n  Bound result 9\n  Bound result 4\n\n[PASS] test_approvalCanBeReplacedAndRevoked() (gas: 185779)\n[PASS] test_approvalEmitsEventAndDoesNotMoveTokens() (gas: 88765)\n[PASS] test_approvalsAreIsolatedByOwnerAndSpender() (gas: 216795)\n[PASS] test_approveZeroSpenderReverts() (gas: 37618)\n[PASS] test_constructorEmitsExactlyOneMintEvent() (gas: 9740)\n[PASS] test_create2DeploymentMintsToFactoryInsteadOfTransactionOrigin() (gas: 296105)\n[PASS] test_deployerCannotSpendHolderBalanceWithoutApproval() (gas: 158005)\n[PASS] test_directDeploymentMintsToTheDeployingAccount() (gas: 28222)\n[PASS] test_infiniteAllowanceIsNotDecremented() (gas: 149678)\n[PASS] test_launchDistributionAndSubsequentTransfersArriveWhole() (gas: 639809)\n[PASS] test_metadataAndEntireInitialSupply() (gas: 107693)\n[PASS] test_noMintBurnOrAdministrativeEntryPoints() (gas: 762747)\n[PASS] test_rejectsNativeCurrency() (gas: 42685)\n[PASS] test_runtimeHasNoForbiddenOpcodesAndFitsDeploymentLimit() (gas: 1039951)\n[PASS] test_selfTransferPreservesBalance() (gas: 51410)\n[PASS] test_selfTransferStillRequiresSufficientBalance() (gas: 42887)\n[PASS] test_transferBeyondBalanceRevertsWithoutChangingBalances() (gas: 65292)\n[PASS] test_transferEmitsEventAndMovesExactAmount() (gas: 91495)\n[PASS] test_transferEntireSupplyAndReturnIt() (gas: 159422)\n[PASS] test_transferFromBeyondAllowanceRevertsAtomically() (gas: 115704)\n[PASS] test_transferFromBeyondBalanceRestoresAllowance() (gas: 188823)\n[PASS] test_transferFromRequiresAllowanceEvenForTheOwner() (gas: 35773)\n[PASS] test_transferFromSelfSpendsAllowanceWithoutChangingBalance() (gas: 103293)\n[PASS] test_transferFromSpendsAllowanceAndEmitsTransfer() (gas: 231741)\n[PASS] test_transferFromToZeroRestoresAllowance() (gas: 114192)\n[PASS] test_transferFromZeroAddressCannotMintEvenZeroAmount() (gas: 57144)\n[PASS] test_transferFromZeroAmountNeedsNoPositiveAllowance() (gas: 78763)\n[PASS] test_transferToZeroRevertsIncludingZeroAmount() (gas: 71992)\n[PASS] test_zeroTransferFromEmptyAccountEmitsEvent() (gas: 73389)\nSuite result: ok. 33 passed; 0 failed; 0 skipped; finished in 61.18ms (253.58ms CPU time)\n\nRan 1 test for test/CompanyToken.invariant.t.sol:CompanyTokenInvariantTest\n[PASS]\nCompanyTokenInvariantTest invariants:\n[PASS] invariant_allBalancesAndAllowancesMatchActionHistory\n[PASS] invariant_supplyAndBalancesRemainConserved\n CompanyTokenInvariantTest invariants (runs: 256, calls: 16384, reverts: 0)\n\n╭---------------------+---------------------------------+-------+---------+----------╮\n| Contract            | Selector                        | Calls | Reverts | Discards |\n+====================================================================================+\n| CompanyTokenHandler | approve                         | 1654  | 0       | 0        |\n|---------------------+---------------------------------+-------+---------+----------|\n| CompanyTokenHandler | approveBoundary                 | 1674  | 0       | 0        |\n|---------------------+---------------------------------+-------+---------+----------|\n| CompanyTokenHandler | rejectTransferFromOverAllowance | 1678  | 0       | 0        |\n|---------------------+---------------------------------+-------+---------+----------|\n| CompanyTokenHandler | rejectTransferFromOverBalance   | 1694  | 0       | 0        |\n|---------------------+---------------------------------+-------+---------+----------|\n| CompanyTokenHandler | rejectTransferOverBalance       | 1608  | 0       | 0        |\n|---------------------+---------------------------------+-------+---------+----------|\n| CompanyTokenHandler | rejectZeroRecipient             | 1615  | 0       | 0        |\n|---------------------+---------------------------------+-------+---------+----------|\n| CompanyTokenHandler | rejectZeroSpender               | 1608  | 0       | 0        |\n|---------------------+---------------------------------+-------+---------+----------|\n| CompanyTokenHandler | revokeAndRejectSpend            | 1603  | 0       | 0        |\n|---------------------+---------------------------------+-------+---------+----------|\n| CompanyTokenHandler | transfer                        | 1584  | 0       | 0        |\n|---------------------+---------------------------------+-------+---------+----------|\n| CompanyTokenHandler | transferFrom                    | 1666  | 0       | 0        |\n╰---------------------+---------------------------------+-------+---------+----------╯\n\nLogs:\n  Bound result 0\n  Bound result 1224\n  Bound result 115792089237316195423570985008687907853269984665640564039457584007913129639934\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 9613\n  Bound result 2\n  Bound result 10923\n  Bound result 1000000000000000000000000003\n  Bound result 115792089237316195423570985008687907853269984665640564039457584007913129639933\n  Bound result 115792089237316195423570985008687907853269984665640564039457584007913129639935\n  Bound result 439211577143376728988117752\n  Bound result 357585585822981581117522882\n  Bound result 115792089237316195423570985008687907853269984665640564039457584007913129639934\n  Bound result 115792089237316195423570985008687907853269984665640206453871761026332012122744\n  Bound result 657\n  Bound result 11146\n  Bound result 115792089237316195423570985008687907853269984665640206454054093745838167942217\n  Bound result 115792089237316195423570985008687907853269984665640124827880440631184141522426\n  Bound result 0\n  Bound result 74405426578411525092308526575\n  Bound result 1778602030861408289802190424026891\n  Bound result 0\n  Bound result 5903\n  Bound result 1986\n  Bound result 115792089237316195423570985008687907853269984665640360836620550366223235284227\n  Bound result 2220569784619208272858946264241206\n  Bound result 1481\n  Bound result 0\n  Bound result 115792089237316195423570985008687907853269984665640206453871761026332012122330\n  Bound result 6361\n  Bound result 115792089237316195423570985008687907853269984665640206453871761026332012117870\n  Bound result 3456\n  Bound result 11000000000000000000\n  Bound result 0\n  Bound result 9\n  Bound result 1980\n  Bound result 0\n  Bound result 244\n  Bound result 255\n  Bound result 187188651865433240422588001\n  Bound result 5014\n  Bound result 2127691036664347200398106062\n  Bound result 13\n  Bound result 5802\n  Bound result 115792089237316195423570985008687907853269984665640564039457584007913129639935\n  Bound result 0\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 5.12s (5.12s CPU time)\n\nRan 3 test suites in 5.13s (5.25s CPU time): 51 tests passed, 0 failed, 0 skipped (51 total tests)\n","passed":true},{"durationMs":30,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"CompanyToken.approve(address,uint256)\",\"CompanyToken.transfer(address,uint256)\",\"CompanyToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"README.md\":69,\"foundry.toml\":18,\"remappings.txt\":2,\"src/CompanyToken.sol\":17,\"test/CompanyToken.boundaries.t.sol\":297,\"test/CompanyToken.invariant.t.sol\":217,\"test/CompanyToken.t.sol\":423},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"62c968733a32dfffb14bcf8422c93c9a39556bd11ec2dacc3a647a6a0c1572fd","verifiedTreeHash":"8a837731f37a5c61e0de1210e1e2521836539256","verifierVersion":"0.1.0+8fbf00a5"}]}