{"assessments":[],"deployments":[],"fuzz":[],"identity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"interpretation":"Records acceptance and evidence. Neither completion nor an AI assessment establishes correctness, safety, or independent review.","jobId":"f4e36b37-5c2c-40fa-912d-d99dd6180c35","kind":"shape:chain","nodes":[{"acceptedSubmissionHash":"6a4480b6575ed5f6643c2825a071a2a14fffcdc0923dd805e86283e0fdd7ddfd","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_economics","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"c78551068cb84a0c0316a12402622a68a087185c0760091491e95d276a8b6df1","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_flow","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"9dc33482dd02b4586f91f030fb67cf65cf47d2dcb476f74ab1687adc71d52d65","dependsOn":["build_contract_project","write_foundry_tests","manifest","audit_math","audit_permissions","audit_economics","audit_flow"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"af3aa01159bbf354f621cafa5c0006f6169e0938a8b015be508b7377dbf165bc","skillId":"audit-judge","tools":[]},"key":"audit_judge","kind":"code","role":"review","skillHash":"af3aa01159bbf354f621cafa5c0006f6169e0938a8b015be508b7377dbf165bc","skillId":"audit-judge","state":"accepted"},{"acceptedSubmissionHash":"a151b3cb02703a5983818dbf9fe46d4609e2bd36c1d5aa1925970e330ce98551","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_math","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"9f929e85d6eccff1bfb73b6e705ff1554584aa46c22da4de00467b07d69f1f98","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_permissions","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"ecefed79844eef1fed1e18b6e81cfe216cae0c33705cbc77aeac6d1767738c20","dependsOn":[],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"d59561da3b378461b7c749f6bd5084477d44993aa94972ddea90f542535751df","skillId":"build-contract-project","tools":[]},"key":"build_contract_project","kind":"code","role":"implement","skillHash":"d59561da3b378461b7c749f6bd5084477d44993aa94972ddea90f542535751df","skillId":"build-contract-project","state":"accepted"},{"acceptedSubmissionHash":"a14ea702f47a355f93f683e00eb72b52b5ff26afe766f0356b1f03f81a5fed7e","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"tools":[]},"key":"manifest","kind":"code","role":"integrate","skillHash":null,"skillId":null,"state":"accepted"},{"acceptedSubmissionHash":"7d1dcb075c8ac21a6bf5c72b2cc4253cd6d5ad6cef3e3296168d5f9375cac857","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"4c76766b00591dfe982fe85d3de589fdb2f810e5137c301155d1c5e36a1d3b23","skillId":"write-foundry-tests","tools":[]},"key":"write_foundry_tests","kind":"code","role":"tests","skillHash":"4c76766b00591dfe982fe85d3de589fdb2f810e5137c301155d1c5e36a1d3b23","skillId":"write-foundry-tests","state":"accepted"}],"objective":"A custom token: Cabal Coin (CABAL).\nToken name: Cabal Coin\nToken symbol: CABAL\nToken supply: 1,000,000,000 with 18 decimals, all minted once to the deployer in the constructor.","parentJobId":null,"planHash":"37d558cc2723110ce49cf671e19215970afa2863e6d1cbefe3e9f3b26adb047c","previousHash":"0000000000000000000000000000000000000000000000000000000000000000","projectId":"f4e36b37-5c2c-40fa-912d-d99dd6180c35","publication":{"commit":null,"deliveredAt":null,"repoUrl":"https://github.com/identity-md-launches/launch-2208-cabal-coin"},"receiptIdentity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"registry":"0xb6d0a187b050fa5bb0b87033a203f37becf4a775","research":[],"schema":"identitymd-work-v1","signals":[{"agentId":"51506","feedbackHash":"20d97885de873bc10a1a1a5f33c66b7f1a93746ecf0de560a31747413989e1b6","nodeKey":"audit_economics","submissionHash":"6a4480b6575ed5f6643c2825a071a2a14fffcdc0923dd805e86283e0fdd7ddfd","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"54231","feedbackHash":"44a0709bc883ec17406ad73121ad7941be7bc80b955ba8b98c0e976cb7dbb07c","nodeKey":"audit_flow","submissionHash":"c78551068cb84a0c0316a12402622a68a087185c0760091491e95d276a8b6df1","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52266","feedbackHash":"b659a20981bacfd742733a12487c1d5d5c2ab2007a8b18d295da2b769a869a79","nodeKey":"audit_judge","submissionHash":"9dc33482dd02b4586f91f030fb67cf65cf47d2dcb476f74ab1687adc71d52d65","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52608","feedbackHash":"073b5baca16489b432131cff0b8e5e2c840dfa639f4cb8982af2836ada249b99","nodeKey":"audit_math","submissionHash":"a151b3cb02703a5983818dbf9fe46d4609e2bd36c1d5aa1925970e330ce98551","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52707","feedbackHash":"bd253d6006abc29bf3e707bace1252b693f40f336915b358707f8ebca08c949a","nodeKey":"audit_permissions","submissionHash":"9f929e85d6eccff1bfb73b6e705ff1554584aa46c22da4de00467b07d69f1f98","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52206","feedbackHash":"2adbefe7b6a7928e617e1b3326bc74fcc152c8081f683f8892231895c8b065f4","nodeKey":"build_contract_project","submissionHash":"ecefed79844eef1fed1e18b6e81cfe216cae0c33705cbc77aeac6d1767738c20","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"51873","feedbackHash":"6ee653b46dde69ee30192753f0be7ddebe79976dba820ccf65b561c21b66d53a","nodeKey":"manifest","submissionHash":"a14ea702f47a355f93f683e00eb72b52b5ff26afe766f0356b1f03f81a5fed7e","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"51879","feedbackHash":"eb6a267f9be37e23777e26962ca226ed77263819236db16e13e883d18bc2ba67","nodeKey":"write_foundry_tests","submissionHash":"7d1dcb075c8ac21a6bf5c72b2cc4253cd6d5ad6cef3e3296168d5f9375cac857","tag1":"verification:checks","tag2":"acceptance-v2","value":1}],"site":null,"snapshotHash":"09e132b041de86f6d72ef9aef3523009d8cc5a53818f8ed6aad876b039ffaa0d","state":"completed","submissions":[{"artifacts":[],"attempt":1,"bundleHash":null,"device":"7236faf97e42979a","findings":[{"citation":"resolved","description":"DEPENDENCIES.md (line 8) states 'All vendored files are unmodified upstream files' and tells the reader to verify the snapshot with `sha256sum -c DEPENDENCIES.sha256`; README.md (line 51) states 'Every vendored file also passed its recorded SHA-256 checksum'. In the committed tree that command reports 7 FAILED entries: lib/forge-std/src/StdJson.sol, interfaces/IMulticall3.sol, console.sol, Vm.sol, interfaces/IERC7540.sol, StdAssertions.sol and StdToml.sol. The recorded hashes are upstream forge-std v1.9.7's (e.g. upstream Vm.sol at commit 77041d2 hashes to 9068805b...), but the files in the tree were reformatted (multi-line function signatures collapsed onto one line, a `forge fmt` pass over lib/), so the working file hashes differ (Vm.sol in the tree is a1b1c829...; the git blob is the same, so this is committed state, not a local change). The differences are whitespace-only and affect only the test-only library, so there is no effect on CabalCoin's bytecode or on any launch flow; the vendored OpenZeppelin ERC20, IERC20, IERC20Metadata, Context and draft-IERC6093 files were diffed against upstream v5.0.2 (commit dbb6104) and are byte-identical. The defect is that the project's own provenance claim is false and its documented verification step fails, which a reviewer or the deployer following the README will hit. This is outside the assigned economics area and is reported because it is concrete and reproducible; it is not a security defect in the token.","line":23,"path":"DEPENDENCIES.sha256","reproduction":"From the repository root run `sha256sum -c DEPENDENCIES.sha256`. Expected (per DEPENDENCIES.md and README.md): every line reports OK. Actual: `lib/forge-std/src/StdJson.sol: FAILED`, `lib/forge-std/src/interfaces/IMulticall3.sol: FAILED`, `lib/forge-std/src/console.sol: FAILED`, `lib/forge-std/src/Vm.sol: FAILED`, `lib/forge-std/src/interfaces/IERC7540.sol: FAILED`, `lib/forge-std/src/StdAssertions.sol: FAILED`, `lib/forge-std/src/StdToml.sol: FAILED`, `sha256sum: WARNING: 7 computed checksums did NOT match`. `sha256sum lib/forge-std/src/Vm.sol` prints a1b1c82924aecf0f38b53192fd1e801cccc1e1fd2ecd6b2301e4f4c4ab102a15, not the recorded 9068805b.... Fix: either restore the seven files to their upstream bytes or regenerate DEPENDENCIES.sha256 from the tree and amend the 'unmodified upstream files' sentence to say they were reformatted.","severity":"low","snippet":"9068805b59ac1d0ea03a8fa1f15ae49c094e0c6c852a2500e0dd112f264b2cb1  lib/forge-std/src/Vm.sol","title":"Recorded dependency checksums do not match the vendored forge-std files, so the documented provenance check fails"}],"hash":"6a4480b6575ed5f6643c2825a071a2a14fffcdc0923dd805e86283e0fdd7ddfd","nodeId":"c12c7c09-99df-4586-a771-48690ac5065b","outcome":"completed","summary":"The review is complete and the findings file is written. The only files in the working tree beyond the committed state are `.imd-findings.json` and the scratch test under `test/scratch/`, neither of which is submitted work.\n\n**Result: the token's economics hold. One low-severity provenance defect was found outside the assigned area.**\n\n**What I checked in the assigned area**\n\n- **Economic Security.** CabalCoin is upstream OpenZeppelin v5.0.2 ERC20 with a single constructor mint, confirmed byte-identical to upstream. It makes no external calls, has no fee, burn, hook, rebase, pause or blacklist, and no sentinel branches. A scratch fuzz modelling the pool manager's sync, transfer, settle accounting and a router-style allowance pull showed the received amount equals the requested amount in every run. All launch flows move exactly what they say.\n- **Invariant.** Sum of balances equals total supply equals 1e27, permanently. `_mint` runs only in the constructor, `_burn` is unreachable, and `_update` is the sole balance writer. The constant `1_000_000_000 * 10 ** 18` evaluates exactly to 1e27, which answers the aderyn large-literal lead. Supply cannot grow and no privileged entry point exists.\n- **Flow Gap.** No execution-times-periphery seam exists because the token never calls out and has no transfer-time branching. Under CREATE2 from the factory, the constructor's `msg.sender` is the factory, so the whole supply lands where the launch expects it.\n\n**Finding reported (low)**\n\nThe repository's documented provenance check fails. Running `sha256sum -c DEPENDENCIES.sha256` reports seven forge-std files as FAILED, because the recorded hashes are upstream's while the committed files were reformatted by a `forge fmt` pass. The differences are whitespace only and touch the test-only library, so token bytecode and launch flows are unaffected. The claim in DEPENDENCIES.md that all vendored files are unmodified, and the README's claim that every checksum passed, are both false in this tree.\n\n**Coverage**\n\nAll three ABI entry points are recorded as `holds`, along with three invariant and flow rows. One row is `unreached`: the economics fields of launch.json, since no manifest exists yet at this stage.\n\n**Not carried forward**\n\nThe ERC-20 approve front-running property and tokens sent to the token contract itself are standard behaviour already documented in the README and have no extractable value, so they are not reported.","treeHash":null,"usage":{"cachedInputTokens":719753,"inputTokens":290,"model":"claude-fable-5-1","outputTokens":14565,"runtime":"claude","turns":26,"wallClockMs":275446}},{"artifacts":[],"attempt":1,"bundleHash":"732542662033315668a573045578a189901b29423af0704c7162552c15fb187e","device":"4faf975f1178e1f8","findings":[],"hash":"7d1dcb075c8ac21a6bf5c72b2cc4253cd6d5ad6cef3e3296168d5f9375cac857","nodeId":"f7460533-794b-41ae-b856-8cc732d2b07d","outcome":"completed","summary":"I wrote two new test files for Cabal Coin (CABAL). The full suite, now 54 tests, passes under `forge test` with the verifier's fuzz seed. I found no defects, so there is no `.imd-findings.json`.\n\n**What the contract is:** a plain OpenZeppelin ERC-20 that mints exactly 10^27 (one billion with 18 decimals) to whoever deploys it. It has no owner, no mint or burn, no pause, and no fee on transfer. The 34 tests already in `test/` were left alone; one of them already checks that the supply is minted only to the deployer through a factory-style deployment.\n\n**New in `test/CabalCoinAdversarialInvariant.t.sol`:**\n- A random-sequence test that also drives the failure paths:\n  - transfers and `transferFrom` above the balance or allowance;\n  - sending to the zero address;\n  - `transferFrom` out of the zero address;\n  - approving the zero address as spender.\n- Amounts are picked from the edges: zero, exactly the balance or allowance, one more than that, the full supply, and the maximum value.\n- Each call is checked against a separate record of what every balance and allowance should be. A call that succeeds must move exactly that amount. A call that fails must revert with the exact OpenZeppelin error and change no balance or allowance.\n- The six actors include the deployer and the token's own address, to confirm neither gains any power.\n- The invariants checked after every call: balances and allowances match the record; actor balances add up to the supply; the total supply never changes; the zero address never holds tokens or gains an allowance. It is set to 256 runs at depth 64 inside the file and ran 16,384 calls with no unexpected reverts.\n\n**New in `test/CabalCoinEdges.t.sol`** (19 tests):\n- An exact balance or allowance succeeds and one more reverts; sending the maximum value or the supply plus one reverts.\n- An allowance of the maximum minus one counts down normally, while the maximum itself is never used up.\n- The allowance is checked before the balance; the owner still needs to approve themselves to use `transferFrom` on their own tokens.\n- Contracts can act as a spender or a holder; ETH and unknown or truncated calls are rejected.\n- Each deployment mints only to its own deployer.\n- Fuzz tests at 1,000 runs cover approvals, chained transfers, spenders with an unlimited allowance, and strangers trying to move someone else's tokens.\n- One test records the usual ERC-20 risk when an approval is changed: a spender who sees the change coming can spend both the old and the new amount. This is how every ERC-20 behaves, so it is documented rather than reported as a defect.\n\n**Not committed:** the commit failed because this machine has no git user name or email set (\"Author identity unknown\"), and I didn't change the git settings. The two files are staged in the working tree under `test/`, with nothing changed outside it.","treeHash":"552a42114233a2960a0d731f7d7e4bd47d5854a2","usage":{"cachedInputTokens":446005,"inputTokens":22,"model":"claude-opus-5-5","outputTokens":13211,"runtime":"claude","turns":12,"wallClockMs":164189}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"644eb561f6d70a85","findings":[{"citation":"resolved","description":"Merged from four specialist reports (audit_economics, audit_math, audit_flow, audit_permissions), all with the same root cause. DEPENDENCIES.md line 8 states every vendored file is an unmodified upstream file and line 10 tells the reader to verify this with `sha256sum -c DEPENDENCIES.sha256`; README.md line 51 records that every vendored file passed its recorded checksum. In the committed tree (HEAD 6daae02, clean working tree) the check fails for 7 of 36 files, all under lib/forge-std/src: StdJson.sol, StdToml.sol, StdAssertions.sol, Vm.sol, console.sol, interfaces/IMulticall3.sol, interfaces/IERC7540.sol. I reproduced it and confirmed the cause: the hash recorded on DEPENDENCIES.sha256 line 23 for Vm.sol (9068805b...) is exactly the hash of upstream forge-std src/Vm.sol at the pinned commit 77041d2ce690e692d6e03cc812b57d1ddaa4d505, while the tree's copy hashes to a1b1c829...; after stripping all whitespace the two files hash identically, so the drift is a reformat (forge fmt over lib/) and not a content change. The five OpenZeppelin v5.0.2 files that CabalCoin compiles against (ERC20.sol, IERC20.sol, IERC20Metadata.sol, Context.sol, draft-IERC6093.sol) are byte-identical to upstream commit dbb6104c, so the token's bytecode and every launch flow are unaffected, and forge build plus all 54 tests pass. Impact is limited to a false integrity statement: a reviewer or the launch operator following the documented procedure gets 7 FAILED lines and cannot, from the repository alone, tell a benign reformat from a tampered test dependency. Severity low: no funds, supply, or transfer behavior is involved. Fix: restore the seven files to their upstream bytes (or regenerate DEPENDENCIES.sha256 from the tree and drop the 'unmodified upstream' wording), correct README.md line 51, and exclude lib/ from forge fmt so a later formatting pass does not reintroduce the drift.","line":8,"path":"DEPENDENCIES.md","reproduction":"State: repository at HEAD 6daae02 with a clean working tree. Input: from the repository root run `sha256sum -c DEPENDENCIES.sha256`. Expected (per DEPENDENCIES.md line 10 and README.md line 51): 36 lines ending ': OK'. Actual: 29 ': OK' and `lib/forge-std/src/StdJson.sol: FAILED`, `lib/forge-std/src/interfaces/IMulticall3.sol: FAILED`, `lib/forge-std/src/console.sol: FAILED`, `lib/forge-std/src/Vm.sol: FAILED`, `lib/forge-std/src/interfaces/IERC7540.sol: FAILED`, `lib/forge-std/src/StdAssertions.sol: FAILED`, `lib/forge-std/src/StdToml.sol: FAILED`, then `sha256sum: WARNING: 7 computed checksums did NOT match`. Cross-check: `sha256sum lib/forge-std/src/Vm.sol` prints a1b1c82924aecf0f38b53192fd1e801cccc1e1fd2ecd6b2301e4f4c4ab102a15; DEPENDENCIES.sha256 line 23 records 9068805b59ac1d0ea03a8fa1f15ae49c094e0c6c852a2500e0dd112f264b2cb1; `curl -s https://raw.githubusercontent.com/foundry-rs/forge-std/77041d2ce690e692d6e03cc812b57d1ddaa4d505/src/Vm.sol | sha256sum` prints 9068805b..., matching the record; `tr -d ' \\n\\t'` applied to both files gives identical hashes, so the diff is whitespace only. The five vendored OpenZeppelin files hash identically to upstream dbb6104ce834628e473d2173bbc9d47f81a9eec3.","severity":"low","snippet":"OpenZeppelin includes only ERC20 and its transitive imports, plus its MIT license. forge-std includes its Solidity source tree and MIT/Apache-2.0 licenses and is used only by tests. All vendored files are unmodified upstream files.","title":"Seven vendored forge-std files were reformatted after their SHA-256 checksums were recorded, so the documented provenance check fails and the 'unmodified upstream files' claim is false"}],"hash":"9dc33482dd02b4586f91f030fb67cf65cf47d2dcb476f74ab1687adc71d52d65","nodeId":"cfeec13d-e9d6-498c-a9c9-7f3d948cd45c","outcome":"completed","summary":"The review is complete and written to `.imd-findings.json`. No tracked files were changed.\n\n**Outcome.** The token is clean. The only defect that survives is the one all four specialists reported, merged into a single low finding.\n\n- **Kept, merged (low):** the seven forge-std files under `lib/` were reformatted after their checksums were recorded. I reproduced it: `sha256sum -c DEPENDENCIES.sha256` reports 7 FAILED, the recorded Vm.sol hash matches upstream commit 77041d2 exactly, and the tree copy differs from upstream only in whitespace. The four specialist reports share this root cause, so they are one finding. Severity stays low: it is a false provenance claim in DEPENDENCIES.md and README.md, not a behavioral defect.\n- **Not affected:** the five OpenZeppelin v5.0.2 files the token compiles against are byte-identical to upstream commit dbb6104. The build passes and all 54 local tests pass with the README's seed.\n\n**My own pass on the code.** CabalCoin is a 17-line stock OpenZeppelin ERC20 with a no-argument constructor that mints 10^27 units once to msg.sender. All three entry points hold: approve, transfer and transferFrom are the unmodified upstream implementations with no override, no tax, burn, pause, blacklist, mint, owner, delegatecall or selfdestruct surface. The runtime is well under the size limit. The manifest matches the contract: empty constructorArgs, totalSupply equal to the INITIAL_SUPPLY constant, decimals 18, a 9-character contract name, lowercase addresses, and the correct types per field. The two static-analysis lines (slither clean, aderyn's large-numeric-literal note on the supply constant) do not indicate a defect.\n\n**Coverage record:** three entry points marked holds, plus two invariant rows for the constructor mint and the absence of any privileged surface.","treeHash":null,"usage":{"cachedInputTokens":370520,"inputTokens":194,"model":"claude-fable-5-1","outputTokens":7277,"runtime":"claude","turns":15,"wallClockMs":109423}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"2293d6b19e81ef1a","findings":[{"citation":"resolved","description":"DEPENDENCIES.md line 8 states every vendored file is an unmodified upstream file, line 10 tells the reader to verify this with `sha256sum -c DEPENDENCIES.sha256`, and README.md line 51 records that 'Every vendored file also passed its recorded SHA-256 checksum.' In the tree as committed (HEAD a3c6cc1, clean working tree) that verification fails for 7 of the 36 listed files, all under lib/forge-std/src: StdJson.sol, StdToml.sol, StdAssertions.sol, Vm.sol, console.sol, interfaces/IMulticall3.sol and interfaces/IERC7540.sol. The 29 other files, including all six OpenZeppelin files that the production token compiles against, pass. I fetched the seven files at the pinned forge-std commit 77041d2ce690e692d6e03cc812b57d1ddaa4d505: the recorded hashes in DEPENDENCIES.sha256 are the hashes of the genuine upstream bytes, so the hashes are right and the tree is what changed. Comparing after stripping all whitespace, each of the seven differs from upstream only in line wrapping (long function signatures and an assembly staticcall collapsed onto one line, in forge-fmt style). No token, statement or constant differs, so the test library behaves identically and nothing in src/ is affected; the production ERC20 sources (lib/openzeppelin-contracts) are byte-identical to OpenZeppelin v5.0.2 at dbb6104c. The defect is a false integrity statement: a reviewer or the launch operator following the documented procedure gets 7 FAILED and cannot distinguish this benign reformat from a tampered Vm.sol or StdAssertions.sol without redoing the upstream comparison. Fix: either restore the seven files to their upstream bytes (so the documented check and the 'unmodified' claim hold) or regenerate DEPENDENCIES.sha256 from the tree and drop the 'unmodified upstream' wording; and correct README.md line 51, which records a verification result the committed tree does not reproduce.","line":8,"path":"DEPENDENCIES.md","reproduction":"State: repository at HEAD a3c6cc1 with a clean working tree. Input: from the repository root run `sha256sum -c DEPENDENCIES.sha256`. Expected (per DEPENDENCIES.md line 10 and README.md line 51): every line ': OK', exit status 0. Actual: 29 ': OK', and `lib/forge-std/src/StdJson.sol: FAILED`, `lib/forge-std/src/interfaces/IMulticall3.sol: FAILED`, `lib/forge-std/src/console.sol: FAILED`, `lib/forge-std/src/Vm.sol: FAILED`, `lib/forge-std/src/interfaces/IERC7540.sol: FAILED`, `lib/forge-std/src/StdAssertions.sol: FAILED`, `lib/forge-std/src/StdToml.sol: FAILED`, 'WARNING: 7 computed checksums did NOT match', exit status 1. Cross-check: `sha256sum` of upstream forge-std src/StdJson.sol at commit 77041d2c is 0211b47e93dbeb6a7de6112470a77137038ed73b79b015847f013e49fcd7511f, exactly the value recorded on line 1 of DEPENDENCIES.sha256, while the file in lib/ is 40 bytes shorter (9663 vs 9703 bytes); `diff` shows only re-wrapped lines. Note: the OpenZeppelin files that CabalCoin inherits from all pass and are byte-identical to upstream v5.0.2, so this finding does not touch deployed behavior.","severity":"low","snippet":"OpenZeppelin includes only ERC20 and its transitive imports, plus its MIT license. forge-std includes its Solidity source tree and MIT/Apache-2.0 licenses and is used only by tests. All vendored files are unmodified upstream files.","title":"Vendored forge-std files do not match the recorded SHA-256 checksums or upstream bytes, contradicting the 'unmodified upstream files' and 'passed its recorded checksum' claims"}],"hash":"9f929e85d6eccff1bfb73b6e705ff1554584aa46c22da4de00467b07d69f1f98","nodeId":"ca5788ff-79cb-4d86-ba26-60e8b8747c02","outcome":"completed","summary":"The review is complete and the report is written to `.imd-findings.json`, which validates as JSON with one finding and nine coverage rows. No tracked file was changed.\n\n**Outcome:** CabalCoin's permission model is clean. The token is a bare OpenZeppelin v5.0.2 ERC20 with a single constructor mint to the deployer, and I found no access-control, trust-gap or asymmetry defect in it.\n\n**What I verified**\n\n- **Access control.** The compiled ABI exposes exactly the nine standard ERC20 selectors plus the supply constant. There is no owner, minter, pauser, initializer, receive or fallback. The runtime bytecode contains no CALL, DELEGATECALL, CALLCODE, CREATE or SELFDESTRUCT. All three state-changing entry points act only on the caller's own balance or allowance.\n- **Trust gap.** The token has no fee, price formula, settable recipient or caller-class branch, so no seam between access, economics and asymmetry exists inside it. The one trust assumption is that the immediate deployer, the factory, receives the whole supply. The README documents this.\n- **Asymmetry.** Every paired surface in the inherited ERC20 mirrors upstream exactly. The vendored OpenZeppelin files are byte-identical to the pinned upstream commit, so the inherited logic is not tampered.\n- **Checks run.** Build, the full 34-test suite with the README's seed, and the fmt check all pass. The protected floor tests were read but need the verifier's harness, so they were not executed.\n\n**One low finding.** The documented provenance check fails. Running the checksum command from DEPENDENCIES.md reports seven forge-std files as FAILED. The recorded hashes are those of genuine upstream bytes, and the files in the tree differ from upstream only in line wrapping, so test behaviour is unchanged and the production token is unaffected. The defect is that the \"unmodified upstream files\" statement and the README's recorded checksum pass are false for the committed tree. The fix is to restore the upstream bytes or regenerate the checksum file and correct the wording.\n\n**Not covered.** No static-analysis lead needed reproduction beyond the aderyn note on the large numeric literal, which is a correctly valued constant and not a defect.","treeHash":null,"usage":{"cachedInputTokens":637426,"inputTokens":258,"model":"claude-fable-5-1","outputTokens":14989,"runtime":"claude","turns":25,"wallClockMs":235267}},{"artifacts":[],"attempt":1,"bundleHash":"0102d7e8bdf3f5aac619a035de0904055fd82d0588760dde86d9f3245be3a06f","device":"42a6bb6aa496cd6b","findings":[],"hash":"a14ea702f47a355f93f683e00eb72b52b5ff26afe766f0356b1f03f81a5fed7e","nodeId":"e2a15a39-d5da-419d-becb-d809a3edd693","outcome":"completed","summary":"Done. `launch.json` is written and committed as the only change.\n\n**What the manifest says**\n\n- **Token** is the accepted contract `CabalCoin` in `src/CabalCoin.sol`: name \"Cabal Coin\", symbol \"CABAL\", 18 decimals, an empty constructorArgs list because its constructor takes no parameters, and totalSupply of exactly what the constructor mints to msg.sender, 10^27 minor units.\n- **Contracts** is an empty list. The accepted tree contains the token only, with no application contracts.\n- **Pool** uses the IMD pair address, fee 12500, tickSpacing 60 and the one-to-one sqrtPriceX96 provenance value from the launch reference.\n- **Economics** is the requester's object copied verbatim.\n- **Notes** describe the fixed supply, the absence of privileged functions, and that no exemptions are needed for the factory, distributor or pool manager flows. The notes are well under the character limit.\n\n**Checks**\n\n- A structural check confirmed only schema keys are present, all uint256 and address fields are strings, numeric fields are numbers, and economics matches the required object byte for byte.\n- `forge build` succeeded and `forge test` with the verifier's fuzz seed passed all 34 tests, including the invariant suite.\n- Git status shows the commit touched only `launch.json`.","treeHash":"a88fddb0031b58fff4f137a6e6de2743e774f1ce","usage":{"cachedInputTokens":229553,"inputTokens":162,"model":"claude-fable-5-1","outputTokens":3259,"runtime":"claude","turns":10,"wallClockMs":60407}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"3c9b660ee1938912","findings":[{"citation":"resolved","description":"DEPENDENCIES.md says all vendored files are unmodified upstream files and gives `sha256sum -c DEPENDENCIES.sha256` as the way to check that. Running it fails for 7 forge-std files: StdJson.sol, interfaces/IMulticall3.sol, console.sol, Vm.sol, interfaces/IERC7540.sol, StdAssertions.sol and StdToml.sol. Every OpenZeppelin file (the only dependency compiled into CabalCoin) passes, so the deployed bytecode and token math are not affected. forge-std is used only by the tests, so the problem is the provenance claim for the test harness. Either the checksum file is wrong or the vendored files differ from the pinned commit 77041d2c.","line":8,"path":"DEPENDENCIES.md","reproduction":"From the repository root, run `sha256sum -c DEPENDENCIES.sha256`. Expected: every line OK. Actual: 'WARNING: 7 computed checksums did NOT match', with lib/forge-std/src/StdJson.sol FAILED (listed hash 0211b47e...), lib/forge-std/src/console.sol FAILED, lib/forge-std/src/Vm.sol FAILED, and four more. Fix: regenerate DEPENDENCIES.sha256 from the files at forge-std commit 77041d2ce690e692d6e03cc812b57d1ddaa4d505, or re-vendor those 7 files from that commit.","severity":"info","snippet":"Verify the source snapshot from the repository root with `sha256sum -c DEPENDENCIES.sha256`.","title":"DEPENDENCIES.sha256 does not verify 7 vendored forge-std files, contradicting DEPENDENCIES.md (test-only, outside math area)"}],"hash":"a151b3cb02703a5983818dbf9fe46d4609e2bd36c1d5aa1925970e330ce98551","nodeId":"f2f2dd68-71e4-4613-a693-ec760125d81f","outcome":"completed","summary":"I found no math defects in Cabal Coin; the only finding is one info-level item outside my area. The findings and coverage are in `.imd-findings.json`. No other files were changed.\n\n**What I reviewed:** `src/CabalCoin.sol` is a standard OpenZeppelin v5.0.2 ERC20. Its only addition is a constant supply, `1_000_000_000 * 10 ** 18` (1e27), minted once to the deployer in the constructor. The vendored OpenZeppelin files match their listed checksums. All 34 existing tests pass, including the fuzz, invariant and launch tests.\n\n**Math Precision guide:** the code has no division, scaling, cast, fee, shift or bitmask. The only unchecked arithmetic is in OpenZeppelin's `_update` and `_spendAllowance`, and a checked comparison guards it first: the balance or allowance must be at least the amount, which is the most a transfer can move. The supply, 1e27, is far below 2^256, and `decimals()` is 18, matching the supply's scale.\n\n**Boundary guide:** the token makes no external calls and has no payable functions or byte-decoding. I checked the edge inputs:\n- A zero-amount transfer, or a transfer to yourself, leaves balances unchanged.\n- A transfer to address zero reverts, and so does an approval from or to address zero.\n- An allowance of `type(uint256).max` is treated as unlimited and never decreases. That is OpenZeppelin's documented behaviour.\n- A transfer of the whole supply works.\n\n**Numerical Gap guide:** there is no rounding or conditional fast path, so there is nothing for these combined checks to apply to. The supply can never change, and launch transfers to the factory, distributor and pool manager arrive in full.\n\n**Coverage:** `approve`, `transfer` and `transferFrom` are each marked `holds`, plus three invariant rows: fixed supply, decimals and exact launch flows.\n\n**Finding (info):** `sha256sum -c DEPENDENCIES.sha256` fails for 7 forge-std files (`StdJson.sol`, `console.sol`, `Vm.sol` and four others). `DEPENDENCIES.md` says every vendored file is an unmodified upstream copy, so either the checksum file or those files are wrong. forge-std is only used by the tests, so the deployed token is not affected.\n\nThe aderyn \"large numeric literal\" warning is harmless: the literal is exactly the supply the brief asks for. Slither reported nothing.","treeHash":null,"usage":{"cachedInputTokens":247109,"inputTokens":14,"model":"claude-opus-5-5","outputTokens":4273,"runtime":"claude","turns":7,"wallClockMs":54663}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"a0f92fec784312b7","findings":[{"citation":"resolved","description":"DEPENDENCIES.md (line 8) states 'All vendored files are unmodified upstream files' and tells reviewers to verify with `sha256sum -c DEPENDENCIES.sha256`; README.md line 51 records that every vendored file passed its checksum. In the committed tree this is false: 7 forge-std files (src/StdJson.sol, src/StdToml.sol, src/StdAssertions.sol, src/Vm.sol, src/console.sol, src/interfaces/IMulticall3.sol, src/interfaces/IERC7540.sol) do not match their recorded hashes. I fetched the same seven files from upstream foundry-rs/forge-std at the recorded commit 77041d2ce690e692d6e03cc812b57d1ddaa4d505: the upstream bytes DO match the recorded hashes, so the hashes were computed on the pristine files and the tree copies were changed afterwards. The diff is whitespace-only (long signatures reflowed onto one line, i.e. `forge fmt` was run over lib/ because foundry.toml has no [fmt] ignore for lib/**), and the whitespace-stripped content is byte-identical to upstream, so there is no behavioral change: the files are test-only, the token's runtime bytecode is unaffected, and all 34 tests pass. Impact is on provenance: a deployer or reviewer following DEPENDENCIES.md gets 7 FAILED lines and cannot, from the repository alone, distinguish a benign reformat from a tampered test dependency; the two documents assert a verification result that the tree does not reproduce. OpenZeppelin files (the only dependency compiled into the token) all pass. Fix: restore the seven files to their upstream bytes (or regenerate DEPENDENCIES.sha256 and change the 'unmodified upstream files' wording), and exclude lib/ from `forge fmt` so the next formatting pass does not reintroduce the drift.","line":51,"path":"README.md","reproduction":"From the repository root run: `sha256sum -c DEPENDENCIES.sha256`. Expected (per README.md:51 and DEPENDENCIES.md:8): 36 lines of OK. Actual: 29 OK and 7 FAILED (lib/forge-std/src/StdJson.sol, StdToml.sol, StdAssertions.sol, Vm.sol, console.sol, interfaces/IMulticall3.sol, interfaces/IERC7540.sol), exit status 1, 'WARNING: 7 computed checksums did NOT match'. Confirming the cause: `sha256sum lib/forge-std/src/Vm.sol` gives a1b1c829...; DEPENDENCIES.sha256 records 9068805b... for that path; `curl https://raw.githubusercontent.com/foundry-rs/forge-std/77041d2ce690e692d6e03cc812b57d1ddaa4d505/src/Vm.sol | sha256sum` gives 9068805b... (matches the record). `diff` between upstream and tree shows only line-wrapping changes; `tr -d ' \\n\\t'` on both files yields identical hashes for all seven.","severity":"low","snippet":"Recorded local verification: `forge build` passed with Solidity 0.8.26; `forge test` passed all 34 tests with the seed above, including 2,048 fuzz cases and 8,192 invariant calls with zero reverts; `forge fmt --check` passed. Every vendored file also passed its recorded SHA-256 checksum.","title":"Vendored forge-std files were reformatted after vendoring: 7 of 36 recorded SHA-256 checksums fail, contradicting DEPENDENCIES.md and the README's recorded verification"}],"hash":"c78551068cb84a0c0316a12402622a68a087185c0760091491e95d276a8b6df1","nodeId":"3c01a43e-accc-4299-803c-18cac374fa6e","outcome":"completed","summary":"Review complete. The findings file is written and the scratch tests are removed.\n\n**Outcome:** the Cabal Coin token has no defect in its control flow. The only substantiated finding is a provenance and documentation inaccuracy, reported at low severity.\n\n**What I checked** (Execution Trace, Periphery, First Principles guides, plus the Senior Auditor's Mindset):\n\n- **Token source.** `src/CabalCoin.sol` is 17 lines over unmodified OpenZeppelin v5.0.2 ERC20. The constructor mints exactly 10^27 units once to the immediate deployer. There are no admin functions, no fallback or receive, no external calls and no forbidden opcodes.\n- **Entry points.** Traced approve, transfer and transferFrom through Context, `_approve`, `_spendAllowance`, `_transfer` and `_update`. Zero-address sentinels revert on every path. Infinite allowance behaves as documented. Reverts are atomic. Self-transfers net to zero. The deployer cannot move another holder's balance.\n- **Launch floor.** Transfers deliver exact amounts, so the swarm share, claims, seed and both swap directions move what they say. Nothing in the token needs exemptions. The protected test's privileged-call and opcode scans both pass against this code.\n- **Verification.** Build, all 34 project tests with the documented seed, and `forge fmt --check` pass. Four extra scratch tests I wrote confirming the edge traces also passed, then were deleted.\n\n**Finding 1, low.** Seven vendored forge-std files fail their recorded SHA-256 checksums, contradicting the \"unmodified upstream files\" statement in DEPENDENCIES.md and the recorded verification on README.md line 51. I fetched the same files from upstream at the recorded commit. The upstream bytes match the recorded hashes. The tree copies differ only by whitespace, so the formatter was run over `lib/`. No behavioral impact: these are test-only files and OpenZeppelin, the only dependency compiled into the token, is intact. The fix is to restore the upstream bytes or regenerate the checksums, and exclude `lib/` from formatting.\n\n**Coverage.** All three listed entry points are marked `holds`, plus three invariant rows: constructor mint, supply immutability and privileged calls, and dependency integrity, the last pointing at finding 1. Nothing in my area was left unreached.","treeHash":null,"usage":{"cachedInputTokens":506413,"inputTokens":226,"model":"claude-fable-5-1","outputTokens":14014,"runtime":"claude","turns":26,"wallClockMs":294192}},{"artifacts":[],"attempt":1,"bundleHash":"1667877ed144a8fbea67b45614a657fa26c77e98f476b4c278d151e78801bc20","device":"cf3b0a0c089b1430","findings":[],"hash":"ecefed79844eef1fed1e18b6e81cfe216cae0c33705cbc77aeac6d1767738c20","nodeId":"3d9b7e3d-d4e5-416b-8311-b4e77359fa07","outcome":"completed","summary":"Implemented Cabal Coin (CABAL) with 18 decimals and exactly 1 billion tokens minted once to the deployer. Dependencies are vendored, and deployment responsibilities are documented in `README.md`.\n\nVerified with Solidity 0.8.26:\n\n- `forge build` passed.\n- `forge test` passed all 34 local tests using the supplied seed.\n- `forge fmt --check` passed.\n\nThe full launch integration remains for the external protected verifier.","treeHash":"0b9a896f5ed4ca8a930fcd534608bd8690b6089f","usage":{"cachedInputTokens":485888,"inputTokens":55172,"model":"gpt-6-astra","outputTokens":14083,"runtime":"codex","turns":5,"wallClockMs":312239}}],"verification":[{"checks":[{"durationMs":1704,"exitCode":0,"name":"build","output":"Compiling 30 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.63s\nCompiler run successful!\n","passed":true},{"durationMs":7996,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 31 tests for test/CabalCoin.t.sol:CabalCoinTest\n[PASS] testFuzz_transferAboveBalanceAlwaysReverts(uint256,uint256) (runs: 512, μ: 126982, ~: 127222)\nLogs:\n  Bound result 5405\n  Bound result 40000000000000000000\n\n[PASS] testFuzz_transferConservesSupply(address,uint256) (runs: 512, μ: 92954, ~: 93196)\nLogs:\n  Bound result 2\n\n[PASS] testFuzz_transferFromAboveAllowanceIsAtomic(uint256,uint256) (runs: 512, μ: 133173, ~: 133865)\nLogs:\n  Bound result 95\n  Bound result 21995\n\n[PASS] testFuzz_transferFromConservesSupplyAndSpendsAllowance(uint256,uint256) (runs: 512, μ: 161334, ~: 163565)\nLogs:\n  Bound result 3694\n\n[PASS] test_adminMintAndBurnCallsAreUnavailable() (gas: 1041059)\n[PASS] test_approvalCanBeReplacedAndRevoked() (gas: 173072)\n[PASS] test_approvalDoesNotRequireCurrentBalance() (gas: 78370)\n[PASS] test_approveEmitsEventAndDoesNotMoveTokens() (gas: 103763)\n[PASS] test_approveZeroSpenderReverts() (gas: 37596)\n[PASS] test_constructorEmitsSingleMintToDeployer() (gas: 9599)\n[PASS] test_deployerCannotMoveHolderTokensWithoutApproval() (gas: 157858)\n[PASS] test_metadataAndInitialSupply() (gas: 107650)\n[PASS] test_runtimeHasNoForbiddenOpcodesAndFitsDeploymentLimit() (gas: 786676)\n[PASS] test_selfTransferPreservesBalance() (gas: 53916)\n[PASS] test_selfTransferStillRequiresBalance() (gas: 35952)\n[PASS] test_spenderCannotUseSomeoneElsesApproval() (gas: 103080)\n[PASS] test_transferAboveBalanceRevertsWithoutChanges() (gas: 130518)\n[PASS] test_transferEmitsEventAndDeliversExactAmount() (gas: 93551)\n[PASS] test_transferEntireSupply() (gas: 161709)\n[PASS] test_transferFromAboveAllowanceRevertsWithoutChanges() (gas: 115686)\n[PASS] test_transferFromAboveBalanceRestoresAllowance() (gas: 188730)\n[PASS] test_transferFromPreservesInfiniteAllowance() (gas: 149676)\n[PASS] test_transferFromSpendsFiniteAllowanceAndEmitsTransfer() (gas: 237517)\n[PASS] test_transferFromToSelfConsumesAllowanceWithoutChangingBalance() (gas: 117831)\n[PASS] test_transferFromToZeroRestoresAllowance() (gas: 124515)\n[PASS] test_transferFromWithoutApprovalReverts() (gas: 57777)\n[PASS] test_transferFromZeroCannotMint() (gas: 82188)\n[PASS] test_transferToZeroReverts() (gas: 47663)\n[PASS] test_zeroTransferFromEmptyAccountEmitsEvent() (gas: 73378)\n[PASS] test_zeroTransferFromNeedsNoAllowance() (gas: 81512)\n[PASS] test_zeroTransferToZeroAlsoReverts() (gas: 30456)\nSuite result: ok. 31 passed; 0 failed; 0 skipped; finished in 32.87ms (131.75ms CPU time)\n\nRan 2 tests for test/CabalCoinLaunch.t.sol:CabalCoinLaunchTest\n[PASS] test_create2MintsEverythingToFactory() (gas: 49547)\n[PASS] test_launchAllocationClaimAndPoolTransfersAreExact() (gas: 448435)\nSuite result: ok. 2 passed; 0 failed; 0 skipped; finished in 33.03ms (469.91µs CPU time)\n\nRan 19 tests for test/CabalCoinEdges.t.sol:CabalCoinEdgesTest\n[PASS] testFuzz_approveStoresAnyValue(address,address,uint256) (runs: 1000, μ: 78418, ~: 78645)\nLogs:\n  Bound result 1\n  Bound result 1\n\n[PASS] testFuzz_strangerCannotMoveOthersTokens(address,uint256) (runs: 1000, μ: 47417, ~: 47235)\nLogs:\n  Bound result 599290590\n\n[PASS] testFuzz_transferFromAboveBalanceWithInfiniteAllowanceReverts(uint256,uint256) (runs: 1000, μ: 172020, ~: 172614)\nLogs:\n  Bound result 18249\n  Bound result 1712\n\n[PASS] testFuzz_twoHopTransferConserves(uint256,uint256) (runs: 1000, μ: 180837, ~: 182619)\nLogs:\n  Bound result 18249\n  Bound result 1712\n\n[PASS] test_allowanceCheckedBeforeBalance() (gas: 40418)\n[PASS] test_allowanceOfMaxMinusOneIsFiniteAndDecrements() (gas: 124016)\n[PASS] test_approvalsAreIndependentPerPair() (gas: 214996)\n[PASS] test_contractHolderCanSendAndReceive() (gas: 343285)\n[PASS] test_contractSpenderPullsExactlyAndCannotExceed() (gas: 448170)\n[PASS] test_eachDeploymentMintsOnlyToItsOwnDeployer() (gas: 55348)\n[PASS] test_frontRunnableApprovalChangeIsStandardErc20() (gas: 215129)\n[PASS] test_noEtherAccepted() (gas: 74391)\n[PASS] test_selfApprovalStillRequiredForOwnTransferFrom() (gas: 156343)\n[PASS] test_supplyIsExactlyTenToTheTwentySeven() (gas: 26473)\n[PASS] test_transferExactlyBalanceSucceedsOneMoreReverts() (gas: 153053)\n[PASS] test_transferFromExactAllowanceSucceedsThenOneMoreReverts() (gas: 154656)\n[PASS] test_transferMaxUintReverts() (gas: 42436)\n[PASS] test_transferSupplyPlusOneReverts() (gas: 35428)\n[PASS] test_unknownSelectorAndShortCalldataRevert() (gas: 59938)\nSuite result: ok. 19 passed; 0 failed; 0 skipped; finished in 33.06ms (130.26ms CPU time)\n\nRan 1 test for test/CabalCoinInvariant.t.sol:CabalCoinInvariantTest\n[PASS] invariant_supplyBalancesAndAllowancesMatchModel() (runs: 128, calls: 8192, reverts: 0)\n\n╭------------------+--------------+-------+---------+----------╮\n| Contract         | Selector     | Calls | Reverts | Discards |\n+==============================================================+\n| CabalCoinHandler | approve      | 2734  | 0       | 0        |\n|------------------+--------------+-------+---------+----------|\n| CabalCoinHandler | transfer     | 2759  | 0       | 0        |\n|------------------+--------------+-------+---------+----------|\n| CabalCoinHandler | transferFrom | 2699  | 0       | 0        |\n╰------------------+--------------+-------+---------+----------╯\n\nLogs:\n  Bound result 0\n  Bound result 12\n  Bound result 0\n  Bound result 6\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 3\n  Bound result 6\n  Bound result 0\n  Bound result 0\n  Bound result 3\n  Bound result 0\n  Bound result 0\n  Bound result 3\n  Bound result 6\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 991072934499070386997736568\n  Bound result 57\n  Bound result 8\n  Bound result 26\n  Bound result 4373\n  Bound result 7\n  Bound result 0\n  Bound result 4\n  Bound result 0\n  Bound result 13\n  Bound result 225\n  Bound result 0\n  Bound result 4207\n  Bound result 0\n  Bound result 27\n  Bound result 196\n  Bound result 0\n  Bound result 3\n  Bound result 1\n  Bound result 3\n  Bound result 1\n  Bound result 8\n  Bound result 4\n  Bound result 0\n  Bound result 0\n  Bound result 4\n  Bound result 1\n  Bound result 0\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 2.02s (2.01s CPU time)\n\nRan 1 test for test/CabalCoinAdversarialInvariant.t.sol:CabalCoinAdversarialInvariantTest\n[PASS]\nCabalCoinAdversarialInvariantTest invariants:\n[PASS] invariant_balancesAndAllowancesMatchModel\n[PASS] invariant_supplyIsFixed\n[PASS] invariant_zeroAddressNeverGainsAllowance\n CabalCoinAdversarialInvariantTest invariants (runs: 256, calls: 16384, reverts: 0)\n\n╭-----------------------------+--------------------+-------+---------+----------╮\n| Contract                    | Selector           | Calls | Reverts | Discards |\n+===============================================================================+\n| CabalCoinAdversarialHandler | approve            | 2369  | 0       | 0        |\n|-----------------------------+--------------------+-------+---------+----------|\n| CabalCoinAdversarialHandler | approveZeroSpender | 2454  | 0       | 0        |\n|-----------------------------+--------------------+-------+---------+----------|\n| CabalCoinAdversarialHandler | transfer           | 2312  | 0       | 0        |\n|-----------------------------+--------------------+-------+---------+----------|\n| CabalCoinAdversarialHandler | transferFrom       | 2296  | 0       | 0        |\n|-----------------------------+--------------------+-------+---------+----------|\n| CabalCoinAdversarialHandler | transferFromToZero | 2360  | 0       | 0        |\n|-----------------------------+--------------------+-------+---------+----------|\n| CabalCoinAdversarialHandler | transferFromZero   | 2315  | 0       | 0        |\n|-----------------------------+--------------------+-------+---------+----------|\n| CabalCoinAdversarialHandler | transferToZero     | 2278  | 0       | 0        |\n╰-----------------------------+--------------------+-------+---------+----------╯\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 7.91s (7.91s CPU time)\n\nRan 5 test suites in 7.91s (10.03s CPU time): 54 tests passed, 0 failed, 0 skipped (54 total tests)\n","passed":true},{"durationMs":43,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"CabalCoin.approve(address,uint256)\",\"CabalCoin.transfer(address,uint256)\",\"CabalCoin.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"DEPENDENCIES.md\":10,\"DEPENDENCIES.sha256\":36,\"LICENSE\":21,\"README.md\":67,\"foundry.toml\":19,\"remappings.txt\":2,\"src/CabalCoin.sol\":17,\"test/CabalCoin.t.sol\":370,\"test/CabalCoinAdversarialInvariant.t.sol\":254,\"test/CabalCoinEdges.t.sol\":229,\"test/CabalCoinInvariant.t.sol\":98,\"test/CabalCoinLaunch.t.sol\":91},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"7d1dcb075c8ac21a6bf5c72b2cc4253cd6d5ad6cef3e3296168d5f9375cac857","verifiedTreeHash":"552a42114233a2960a0d731f7d7e4bd47d5854a2","verifierVersion":"0.1.0+a6ee6548"},{"checks":[{"durationMs":1134,"exitCode":0,"name":"build","output":"Compiling 28 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.07s\nCompiler run successful!\n","passed":true},{"durationMs":2041,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 2 tests for test/CabalCoinLaunch.t.sol:CabalCoinLaunchTest\n[PASS] test_create2MintsEverythingToFactory() (gas: 49547)\n[PASS] test_launchAllocationClaimAndPoolTransfersAreExact() (gas: 448435)\nSuite result: ok. 2 passed; 0 failed; 0 skipped; finished in 943.46µs (327.31µs CPU time)\n\nRan 31 tests for test/CabalCoin.t.sol:CabalCoinTest\n[PASS] testFuzz_transferAboveBalanceAlwaysReverts(uint256,uint256) (runs: 512, μ: 127019, ~: 127198)\nLogs:\n  Bound result 517440283\n  Bound result 60\n\n[PASS] testFuzz_transferConservesSupply(address,uint256) (runs: 512, μ: 92842, ~: 93184)\nLogs:\n  Bound result 24589713064395219\n\n[PASS] testFuzz_transferFromAboveAllowanceIsAtomic(uint256,uint256) (runs: 512, μ: 133192, ~: 133865)\nLogs:\n  Bound result 999999999999999999999999997\n  Bound result 1\n\n[PASS] testFuzz_transferFromConservesSupplyAndSpendsAllowance(uint256,uint256) (runs: 512, μ: 161478, ~: 163565)\nLogs:\n  Bound result 50552\n\n[PASS] test_adminMintAndBurnCallsAreUnavailable() (gas: 1041059)\n[PASS] test_approvalCanBeReplacedAndRevoked() (gas: 173072)\n[PASS] test_approvalDoesNotRequireCurrentBalance() (gas: 78370)\n[PASS] test_approveEmitsEventAndDoesNotMoveTokens() (gas: 103763)\n[PASS] test_approveZeroSpenderReverts() (gas: 37596)\n[PASS] test_constructorEmitsSingleMintToDeployer() (gas: 9599)\n[PASS] test_deployerCannotMoveHolderTokensWithoutApproval() (gas: 157858)\n[PASS] test_metadataAndInitialSupply() (gas: 107650)\n[PASS] test_runtimeHasNoForbiddenOpcodesAndFitsDeploymentLimit() (gas: 786676)\n[PASS] test_selfTransferPreservesBalance() (gas: 53916)\n[PASS] test_selfTransferStillRequiresBalance() (gas: 35952)\n[PASS] test_spenderCannotUseSomeoneElsesApproval() (gas: 103080)\n[PASS] test_transferAboveBalanceRevertsWithoutChanges() (gas: 130518)\n[PASS] test_transferEmitsEventAndDeliversExactAmount() (gas: 93551)\n[PASS] test_transferEntireSupply() (gas: 161709)\n[PASS] test_transferFromAboveAllowanceRevertsWithoutChanges() (gas: 115686)\n[PASS] test_transferFromAboveBalanceRestoresAllowance() (gas: 188730)\n[PASS] test_transferFromPreservesInfiniteAllowance() (gas: 149676)\n[PASS] test_transferFromSpendsFiniteAllowanceAndEmitsTransfer() (gas: 237517)\n[PASS] test_transferFromToSelfConsumesAllowanceWithoutChangingBalance() (gas: 117831)\n[PASS] test_transferFromToZeroRestoresAllowance() (gas: 124515)\n[PASS] test_transferFromWithoutApprovalReverts() (gas: 57777)\n[PASS] test_transferFromZeroCannotMint() (gas: 82188)\n[PASS] test_transferToZeroReverts() (gas: 47663)\n[PASS] test_zeroTransferFromEmptyAccountEmitsEvent() (gas: 73378)\n[PASS] test_zeroTransferFromNeedsNoAllowance() (gas: 81512)\n[PASS] test_zeroTransferToZeroAlsoReverts() (gas: 30456)\nSuite result: ok. 31 passed; 0 failed; 0 skipped; finished in 20.62ms (69.36ms CPU time)\n\nRan 1 test for test/CabalCoinInvariant.t.sol:CabalCoinInvariantTest\n[PASS] invariant_supplyBalancesAndAllowancesMatchModel() (runs: 128, calls: 8192, reverts: 0)\n\n╭------------------+--------------+-------+---------+----------╮\n| Contract         | Selector     | Calls | Reverts | Discards |\n+==============================================================+\n| CabalCoinHandler | approve      | 2734  | 0       | 0        |\n|------------------+--------------+-------+---------+----------|\n| CabalCoinHandler | transfer     | 2759  | 0       | 0        |\n|------------------+--------------+-------+---------+----------|\n| CabalCoinHandler | transferFrom | 2699  | 0       | 0        |\n╰------------------+--------------+-------+---------+----------╯\n\nLogs:\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 1\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 991072934499070386997736568\n  Bound result 57\n  Bound result 5\n  Bound result 0\n  Bound result 4124\n  Bound result 3\n  Bound result 96\n  Bound result 4\n  Bound result 143\n  Bound result 60\n  Bound result 225\n  Bound result 1000000000\n  Bound result 1\n  Bound result 0\n  Bound result 127\n  Bound result 0\n  Bound result 1\n  Bound result 0\n  Bound result 1\n  Bound result 71\n  Bound result 27\n  Bound result 1\n  Bound result 1007\n  Bound result 18\n  Bound result 550070624\n  Bound result 0\n  Bound result 8\n  Bound result 5\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 1.97s (1.97s CPU time)\n\nRan 3 test suites in 1.97s (1.99s CPU time): 34 tests passed, 0 failed, 0 skipped (34 total tests)\n","passed":true},{"durationMs":34,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"CabalCoin.approve(address,uint256)\",\"CabalCoin.transfer(address,uint256)\",\"CabalCoin.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"DEPENDENCIES.md\":10,\"DEPENDENCIES.sha256\":36,\"LICENSE\":21,\"README.md\":67,\"foundry.toml\":19,\"launch.json\":24,\"remappings.txt\":2,\"src/CabalCoin.sol\":17,\"test/CabalCoin.t.sol\":370,\"test/CabalCoinInvariant.t.sol\":98,\"test/CabalCoinLaunch.t.sol\":91},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"a14ea702f47a355f93f683e00eb72b52b5ff26afe766f0356b1f03f81a5fed7e","verifiedTreeHash":"a88fddb0031b58fff4f137a6e6de2743e774f1ce","verifierVersion":"0.1.0+a6ee6548"},{"checks":[{"durationMs":1360,"exitCode":0,"name":"build","output":"Compiling 28 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.28s\nCompiler run successful!\n","passed":true},{"durationMs":2102,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 2 tests for test/CabalCoinLaunch.t.sol:CabalCoinLaunchTest\n[PASS] test_create2MintsEverythingToFactory() (gas: 49547)\n[PASS] test_launchAllocationClaimAndPoolTransfersAreExact() (gas: 448435)\nSuite result: ok. 2 passed; 0 failed; 0 skipped; finished in 819.63µs (203.58µs CPU time)\n\nRan 31 tests for test/CabalCoin.t.sol:CabalCoinTest\n[PASS] testFuzz_transferAboveBalanceAlwaysReverts(uint256,uint256) (runs: 512, μ: 127019, ~: 127198)\nLogs:\n  Bound result 517440283\n  Bound result 60\n\n[PASS] testFuzz_transferConservesSupply(address,uint256) (runs: 512, μ: 92842, ~: 93184)\nLogs:\n  Bound result 14866577118746134465091413\n\n[PASS] testFuzz_transferFromAboveAllowanceIsAtomic(uint256,uint256) (runs: 512, μ: 133192, ~: 133865)\nLogs:\n  Bound result 999999999999999999999999997\n  Bound result 1\n\n[PASS] testFuzz_transferFromConservesSupplyAndSpendsAllowance(uint256,uint256) (runs: 512, μ: 161478, ~: 163565)\nLogs:\n  Bound result 1320374617\n\n[PASS] test_adminMintAndBurnCallsAreUnavailable() (gas: 1041059)\n[PASS] test_approvalCanBeReplacedAndRevoked() (gas: 173072)\n[PASS] test_approvalDoesNotRequireCurrentBalance() (gas: 78370)\n[PASS] test_approveEmitsEventAndDoesNotMoveTokens() (gas: 103763)\n[PASS] test_approveZeroSpenderReverts() (gas: 37596)\n[PASS] test_constructorEmitsSingleMintToDeployer() (gas: 9599)\n[PASS] test_deployerCannotMoveHolderTokensWithoutApproval() (gas: 157858)\n[PASS] test_metadataAndInitialSupply() (gas: 107650)\n[PASS] test_runtimeHasNoForbiddenOpcodesAndFitsDeploymentLimit() (gas: 786676)\n[PASS] test_selfTransferPreservesBalance() (gas: 53916)\n[PASS] test_selfTransferStillRequiresBalance() (gas: 35952)\n[PASS] test_spenderCannotUseSomeoneElsesApproval() (gas: 103080)\n[PASS] test_transferAboveBalanceRevertsWithoutChanges() (gas: 130518)\n[PASS] test_transferEmitsEventAndDeliversExactAmount() (gas: 93551)\n[PASS] test_transferEntireSupply() (gas: 161709)\n[PASS] test_transferFromAboveAllowanceRevertsWithoutChanges() (gas: 115686)\n[PASS] test_transferFromAboveBalanceRestoresAllowance() (gas: 188730)\n[PASS] test_transferFromPreservesInfiniteAllowance() (gas: 149676)\n[PASS] test_transferFromSpendsFiniteAllowanceAndEmitsTransfer() (gas: 237517)\n[PASS] test_transferFromToSelfConsumesAllowanceWithoutChangingBalance() (gas: 117831)\n[PASS] test_transferFromToZeroRestoresAllowance() (gas: 124515)\n[PASS] test_transferFromWithoutApprovalReverts() (gas: 57777)\n[PASS] test_transferFromZeroCannotMint() (gas: 82188)\n[PASS] test_transferToZeroReverts() (gas: 47663)\n[PASS] test_zeroTransferFromEmptyAccountEmitsEvent() (gas: 73378)\n[PASS] test_zeroTransferFromNeedsNoAllowance() (gas: 81512)\n[PASS] test_zeroTransferToZeroAlsoReverts() (gas: 30456)\nSuite result: ok. 31 passed; 0 failed; 0 skipped; finished in 27.67ms (90.12ms CPU time)\n\nRan 1 test for test/CabalCoinInvariant.t.sol:CabalCoinInvariantTest\n[PASS] invariant_supplyBalancesAndAllowancesMatchModel() (runs: 128, calls: 8192, reverts: 0)\n\n╭------------------+--------------+-------+---------+----------╮\n| Contract         | Selector     | Calls | Reverts | Discards |\n+==============================================================+\n| CabalCoinHandler | approve      | 2734  | 0       | 0        |\n|------------------+--------------+-------+---------+----------|\n| CabalCoinHandler | transfer     | 2759  | 0       | 0        |\n|------------------+--------------+-------+---------+----------|\n| CabalCoinHandler | transferFrom | 2699  | 0       | 0        |\n╰------------------+--------------+-------+---------+----------╯\n\nLogs:\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 1\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 991072934499070386997736568\n  Bound result 57\n  Bound result 5\n  Bound result 0\n  Bound result 4124\n  Bound result 3\n  Bound result 96\n  Bound result 4\n  Bound result 143\n  Bound result 60\n  Bound result 225\n  Bound result 1000000000\n  Bound result 1\n  Bound result 0\n  Bound result 127\n  Bound result 0\n  Bound result 1\n  Bound result 0\n  Bound result 1\n  Bound result 71\n  Bound result 27\n  Bound result 1\n  Bound result 1007\n  Bound result 18\n  Bound result 550070624\n  Bound result 0\n  Bound result 8\n  Bound result 5\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 2.01s (2.01s CPU time)\n\nRan 3 test suites in 2.01s (2.03s CPU time): 34 tests passed, 0 failed, 0 skipped (34 total tests)\n","passed":true},{"durationMs":35,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"CabalCoin.approve(address,uint256)\",\"CabalCoin.transfer(address,uint256)\",\"CabalCoin.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"DEPENDENCIES.md\":10,\"DEPENDENCIES.sha256\":36,\"LICENSE\":21,\"README.md\":67,\"foundry.toml\":19,\"remappings.txt\":2,\"src/CabalCoin.sol\":17,\"test/CabalCoin.t.sol\":370,\"test/CabalCoinInvariant.t.sol\":98,\"test/CabalCoinLaunch.t.sol\":91},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true},{"durationMs":462,"exitCode":0,"name":"slither","output":"slither: no results at low impact or above","passed":true},{"durationMs":214,"exitCode":0,"name":"aderyn","output":"[low] large-numeric-literal at src/CabalCoin.sol:12: Large Numeric Literal","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"ecefed79844eef1fed1e18b6e81cfe216cae0c33705cbc77aeac6d1767738c20","verifiedTreeHash":"0b9a896f5ed4ca8a930fcd534608bd8690b6089f","verifierVersion":"0.1.0+a6ee6548"}]}