{"assessments":[],"deployments":[{"attestationHash":"32f7752f65bdfe9512d363325253d97ba27d61fa0a6cd13f1f4f4b6ceee58b20","chainId":1,"contracts":[{"address":"0xb576219955a39f962ddde286a6773258489e12ef","blockNumber":26214028,"name":"MerkleDistributor","role":"distributor","txHash":"0x26e108752659bc66e5a861d8201b7f49d049ad575c3731e464df5798455c0017"},{"address":"0x72146197e33147812379bf053e41e9cfd3ccffe4","blockNumber":26214028,"name":"NightShiftImd","role":"token","txHash":"0x26e108752659bc66e5a861d8201b7f49d049ad575c3731e464df5798455c0017"},{"address":"0x784ff9a3ac5d88a30bfff6f7f2a270161fbe6000","blockNumber":26214028,"name":"PoolInitializationGuard","role":"hook","txHash":"0x26e108752659bc66e5a861d8201b7f49d049ad575c3731e464df5798455c0017"}],"id":"14a67be9-a44e-4c57-b4c5-6f5ca36ba68e","manifestHash":"fb9f3a9ed062a38efe1ec9090ac2e9e29f6954d56ab03df26a45939f93f511fb","status":"live"}],"fuzz":[],"identity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"interpretation":"Records acceptance and evidence. Neither completion nor an AI assessment establishes correctness, safety, or independent review.","jobId":"829ae433-fac6-4381-b500-87ff765f3cf0","kind":"shape:chain","nodes":[{"acceptedSubmissionHash":"3787e0bf2a2bb716c24f14cafc0558d52d568f0c57c76b86aaed16316fe76458","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_economics","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"7a39d9df096461fb8a54627c77e5c62f4ad0780644b699417ec805aa77255c0a","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_flow","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"db33afdd0f711a8bddf8e33ccc131267754d39ee5bf52f0a84770ca90e646b80","dependsOn":["build_contract_project","write_foundry_tests","manifest","audit_math","audit_permissions","audit_economics","audit_flow"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"af3aa01159bbf354f621cafa5c0006f6169e0938a8b015be508b7377dbf165bc","skillId":"audit-judge","tools":[]},"key":"audit_judge","kind":"code","role":"review","skillHash":"af3aa01159bbf354f621cafa5c0006f6169e0938a8b015be508b7377dbf165bc","skillId":"audit-judge","state":"accepted"},{"acceptedSubmissionHash":"ea25b4b25c7cf697d475fd5c05fff387e06f9292575acb165f000592c74b1f46","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_math","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"c840c981a837a08bbb4a3bf8ada1bf40cd1feacef5a02e9901b374ff7d5dd5a8","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_permissions","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"5f220f53e365b9e2979fa25e4ebc365322642b0053eaa2b0601b091e983f5276","dependsOn":[],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"d59561da3b378461b7c749f6bd5084477d44993aa94972ddea90f542535751df","skillId":"build-contract-project","tools":[]},"key":"build_contract_project","kind":"code","role":"implement","skillHash":"d59561da3b378461b7c749f6bd5084477d44993aa94972ddea90f542535751df","skillId":"build-contract-project","state":"accepted"},{"acceptedSubmissionHash":"66b1b9c333e52ed5e0b8303443e3cf83b28f2170b97dffe74ee8d33d5e155244","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"tools":[]},"key":"manifest","kind":"code","role":"integrate","skillHash":null,"skillId":null,"state":"accepted"},{"acceptedSubmissionHash":"463040b449b43b3fac3b30075598a554585a7b75310cb12d9b7a49c610fecaef","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"4c76766b00591dfe982fe85d3de589fdb2f810e5137c301155d1c5e36a1d3b23","skillId":"write-foundry-tests","tools":[]},"key":"write_foundry_tests","kind":"code","role":"tests","skillHash":"4c76766b00591dfe982fe85d3de589fdb2f810e5137c301155d1c5e36a1d3b23","skillId":"write-foundry-tests","state":"accepted"}],"objective":"A custom token: NightShiftImd (SHIFT).\nToken name: NightShiftImd\nToken symbol: SHIFT\nToken supply: 1,000,000,000 with 18 decimals, all minted once to the deployer in the constructor.","parentJobId":null,"planHash":"866353dfed00f128245f7675437855774e861be0e84a951a83755dceeffa7960","previousHash":"c12536b9c36284e8451ae4d2c6f51b5ad3f5fd8adf11bbb724d1b1791a12155c","projectId":"829ae433-fac6-4381-b500-87ff765f3cf0","publication":{"commit":"bd4a74b5f6fb81f0f4729eaafb2ae0eb33b8525b","deliveredAt":"2026-10-17T18:19:18.935Z","repoUrl":"https://github.com/identity-md-launches/launch-2106-nightshiftimd"},"receiptIdentity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"registry":"0xb6d0a187b050fa5bb0b87033a203f37becf4a775","research":[],"schema":"identitymd-work-v1","signals":[],"site":null,"snapshotHash":"ca8ce97659e25e10ab023785c29ca23b30144596f9fb53d5df158235403e0bf7","state":"completed","submissions":[{"artifacts":[],"attempt":1,"bundleHash":null,"device":"c9743cd9807c4c3a","findings":[{"citation":"resolved","description":"DEPENDENCIES.json records a sha256 for every vendored file and README.md line 131 states 'Upstream source files are unmodified'. For the six OpenZeppelin files this is true: each matches its recorded hash. For forge-std v1.9.7 (commit 77041d2c) seven of the vendored files do not match their recorded hash: src/StdAssertions.sol, src/StdJson.sol, src/StdToml.sol, src/Vm.sol, src/console.sol, src/interfaces/IERC7540.sol and src/interfaces/IMulticall3.sol. The recorded hashes are the true upstream hashes (fetching the files at that commit from github reproduces them exactly), so the copies in this tree are what changed. The change is whitespace-only: multi-line function headers were joined onto one line, as `forge fmt` does, and a whitespace-stripped comparison shows every file identical to upstream. forge-std is a test-only dependency; src/NightShiftImd.sol imports only the OpenZeppelin files, which are intact, so token behaviour, bytecode and the launch economics are unaffected. The defect is a provenance record that fails its own check: a verifier that validates the tree against DEPENDENCIES.json, as the README invites, rejects it, and the README's unmodified claim is false for these files. Fix: either restore the seven files byte-for-byte from the pinned commit (and exclude lib/ from `forge fmt`), or regenerate the seven sha256 entries and drop the 'unmodified' wording.","line":59,"path":"DEPENDENCIES.json","reproduction":"From the repository root run, for each entry in DEPENDENCIES.json, sha256sum on the recorded path and compare to the recorded sha256. Expected: all 36 files match. Actual: 29 match, and these 7 do not: lib/forge-std/src/StdAssertions.sol (recorded d4c89eec..., tree differs), StdJson.sol (0211b47e...), StdToml.sol (de3fb35a...), Vm.sol (9068805b...), console.sol (896c5a5a...), interfaces/IERC7540.sol (c6a7854c...), interfaces/IMulticall3.sol (6620d9c5...). Cross-check: `curl https://raw.githubusercontent.com/foundry-rs/forge-std/77041d2ce690e692d6e03cc812b57d1ddaa4d505/src/StdAssertions.sol | sha256sum` prints d4c89eec70d267de..., the recorded value, and `diff` of that download against the vendored file shows only line-wrapping changes (e.g. upstream line 480-484 `function assertApproxEqAbs(uint256 left, uint256 right, uint256 maxDelta, string memory err)\\n internal\\n pure\\n virtual\\n {` is one line in the tree). `tr -d ' \\n\\t'` on both copies then sha256sum gives equal digests for all seven files.","severity":"info","snippet":"        \"path\": \"lib/forge-std/src/StdAssertions.sol\",\n        \"sha256\": \"d4c89eec70d267dec6188461fbc74d3dc8c47e518d176a23417533a232ed9780\"","title":"DEPENDENCIES.json hashes and README 'unmodified' claim do not match seven vendored forge-std files (whitespace-only reformatting)"}],"hash":"3787e0bf2a2bb716c24f14cafc0558d52d568f0c57c76b86aaed16316fe76458","nodeId":"2d112259-adf6-4679-be20-58dbf16da835","outcome":"completed","summary":"The review is complete and `.imd-findings.json` is written at the repository root. The tree is otherwise unchanged (the findings file is gitignored, and the scratch test was removed).\n\n**Outcome: the token holds across the Economic Security, Invariant and Flow Gap guides.** No defect in the token or its launch economics was found. One info-level provenance discrepancy is reported.\n\n**What I checked**\n\n- `src/NightShiftImd.sol` is a 17-line fixed-supply OpenZeppelin v5.4.0 ERC-20. The six vendored OpenZeppelin files match their recorded upstream hashes byte for byte.\n- Constructor mints exactly 10^27 base units to msg.sender with no arguments, no value, no address dependency, and no external call. The CREATE2 prediction the factory relies on therefore holds.\n- The ABI exposes only approve, transfer, transferFrom and views. There is no mint, burn, owner, pause, blacklist, fallback or receive path, and the runtime has no DELEGATECALL, CALLCODE or SELFDESTRUCT.\n- All three entry points were traced through OpenZeppelin's `_update`, `_approve` and `_spendAllowance`. Conservation of supply, zero-address sentinels, self-approval, zero-sender transferFrom, max-allowance behaviour and failed-transfer atomicity all behave as the standard requires.\n- Launch flows were probed with a v4-style settle (transferFrom pull) and take (transfer push) round trip. Every amount arrives whole, so the distributor, seed, claim and swap flows the protected harness checks cannot arrive short or revert.\n- The repository's 39 tests pass with the verifier seed, including the 256x64 invariant suite, and `forge fmt --check` is clean.\n\n**The one finding (info)**\n\nSeven vendored forge-std files do not match the sha256 values in DEPENDENCIES.json, and the README states upstream files are unmodified. Fetching the pinned commit from GitHub reproduces the recorded hashes exactly, so the tree copies are what changed. The difference is whitespace only, consistent with `forge fmt` having rewrapped function headers. forge-std is test-only, so the token's bytecode and economics are unaffected. The fix is to restore those files byte for byte or regenerate the seven hashes.\n\n**Coverage record**\n\nAll three listed entry points are marked `holds`, plus five invariant and economics rows, and one `finding` row for provenance. Nothing was left unreached.","treeHash":null,"usage":{"cachedInputTokens":744297,"inputTokens":290,"model":"claude-fable-5-1","outputTokens":14566,"runtime":"claude","turns":29,"wallClockMs":211324}},{"artifacts":[],"attempt":1,"bundleHash":"4a4ea0c8510498f75685b7f75daa2d507458642cd68081d16124167b1cbaf90b","device":"41ff1f83c6e68e78","findings":[],"hash":"463040b449b43b3fac3b30075598a554585a7b75310cb12d9b7a49c610fecaef","nodeId":"ca33d886-a368-4ce4-b8c0-201db8056340","outcome":"completed","summary":"Added 12 failure-path and fuzz tests covering allowance limits, revocation, competing spenders, and rollback. Strengthened invariants with 32,768 randomized calls and post-sequence transferability checks.\n\n`forge build` and `forge test` pass offline with the supplied seed: 51 passed, 0 failed.\n\nOnly `test/` changed. No implementation defects found.","treeHash":"ad5e37522acbf1c86396a01e2c71cc0a9c73de38","usage":{"cachedInputTokens":986496,"inputTokens":76280,"model":"gpt-6-astra","outputTokens":10911,"runtime":"codex","turns":5,"wallClockMs":295564}},{"artifacts":[],"attempt":2,"bundleHash":"a79e79277bdc4d2c6264e1c012bac2c1b47d31b0263f5a57aed75a6b90c9f6c3","device":"32c599587cbbcbf3","findings":[],"hash":"5f220f53e365b9e2979fa25e4ebc365322642b0053eaa2b0601b091e983f5276","nodeId":"a21856d4-9d19-41b3-a474-183b6a5ac9cf","outcome":"completed","summary":"Implemented NightShiftImd (SHIFT): 1,000,000,000 tokens with 18 decimals, minted once to the deployer. No administrative or additional minting powers.\n\nDependencies are vendored for offline builds. Deployment parameters, assumptions, and operational responsibilities are documented in README.md.\n\nVerified with Solidity 0.8.26:\n\n- `forge build`, including a clean offline build\n- `forge test`: 39 passed with the supplied fuzz seed\n- `forge fmt --check`","treeHash":"fc85b48736b0802ecac2193fadb6c7f16d8f108f","usage":{"cachedInputTokens":462080,"inputTokens":49988,"model":"gpt-6-astra","outputTokens":15783,"runtime":"codex","turns":5,"wallClockMs":350470}},{"artifacts":[],"attempt":1,"bundleHash":"f48a0806424b66cab450ee2d8a0e770e892e2561b3a407172d97623b6bd03e6c","device":"24bd93bfc66ecb96","findings":[],"hash":"66b1b9c333e52ed5e0b8303443e3cf83b28f2170b97dffe74ee8d33d5e155244","nodeId":"8212bde8-c87e-44e6-b4d2-a7f74e321f89","outcome":"completed","summary":"Created `launch.json` matching the accepted NightShiftImd contract, exact supply, pool settings, and economics. Constructor arguments and application contracts are empty.\n\n`forge build` succeeded; all 39 local tests passed with the required fuzz seed. Only `launch.json` is included in the submission changes.","treeHash":"340a70896f6a70ade621514180b8b31b437bdbd9","usage":{"cachedInputTokens":249472,"inputTokens":40800,"model":"gpt-6-astra","outputTokens":2638,"runtime":"codex","turns":4,"wallClockMs":95389}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"ea62f3bebece9304","findings":[],"hash":"7a39d9df096461fb8a54627c77e5c62f4ad0780644b699417ec805aa77255c0a","nodeId":"76738c96-f613-40b5-8ccc-e9dcbad1d9f9","outcome":"completed","summary":"I found no defects in NightShiftImd, so `.imd-findings.json` holds an empty findings list and a coverage row for every entry point.\n\n**What I looked at:** `src/NightShiftImd.sol` is a plain OpenZeppelin v5.4.0 `ERC20`. Its constructor mints exactly 1,000,000,000 × 10^18 tokens to `msg.sender`, and it has no overrides, owner roles, mint or burn functions, hooks or low-level calls. The vendored copies of `ERC20.sol`, `Context.sol` and `draft-IERC6093.sol` match the SHA-256 hashes pinned in `DEPENDENCIES.json`, so the library code hasn't been changed. All 39 existing tests pass, including the launch tests for the factory, distributor and pool flows.\n\n**Execution Trace:**\n- `approve` sets the allowance and emits `Approval`. It rejects the zero address as owner or spender.\n- `transferFrom` checks the allowance and lowers it before moving tokens. An unlimited allowance is never lowered.\n- `transfer` and `transferFrom` move exactly the amount asked for, with no fee, burn or callback. They revert on a zero address or a short balance.\n- No call goes out to another contract, so there is no reentry path.\n\n**Periphery:** tokens moving from the factory to the distributor, into the pool and out to traders arrive in full. Decimals are 18, which matches the stated supply.\n\n**First Principles:** the supply can never change after deployment, and no one has privileged power over holders' balances.\n\n**Leads I dropped:**\n- Aderyn's \"large numeric literal\" warning at line 12 points at the supply constant, which is the correct value. It's a style note, not a bug.\n- The standard ERC-20 risk where a spender can use the old allowance just before an `approve` call changes it is part of the standard. It's not specific to this code.\n\n**Coverage:** `approve`, `transfer` and `transferFrom` are all marked `holds`, plus one extra row confirming the fixed supply. Nothing was left unreached.","treeHash":null,"usage":{"cachedInputTokens":180705,"inputTokens":10,"model":"claude-opus-5-5","outputTokens":1949,"runtime":"claude","turns":5,"wallClockMs":49147}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"bdd9b74dce66953d","findings":[{"citation":"resolved","description":"README.md line 131 states 'Upstream source files are unmodified' and points at DEPENDENCIES.json as the per-file provenance record. Seven forge-std files in lib/ do not hash to the values recorded there: StdAssertions.sol, StdJson.sol, StdToml.sol, Vm.sol, console.sol, interfaces/IERC7540.sol and interfaces/IMulticall3.sol. I downloaded the pinned archive (codeload tar.gz for commit 77041d2ce690e692d6e03cc812b57d1ddaa4d505; its sha256 a387f7c2...24bc3 matches the recorded archive_sha256) and diffed: every difference is line re-wrapping of function signatures (forge fmt style). After stripping all whitespace the files are byte-identical to upstream, so there is no semantic change and no effect on the production contract. All six OpenZeppelin files (the only production dependency) match their recorded hashes exactly. This is a provenance-record inaccuracy only: a verifier following the README's hash list will see mismatches on test tooling and cannot distinguish a reformat from a tampered assertion library without doing the diff above. Not in the Access Control / Trust Gap / Asymmetry area; reported because it is concrete and reproducible. Fix: either re-vendor the seven files byte-for-byte from the pinned archive, or regenerate the sha256 entries and state in README that forge-std was reformatted.","line":59,"path":"DEPENDENCIES.json","reproduction":"From the repository root run: python3 -I -c \"import json,hashlib;[print(f['path'],hashlib.sha256(open(f['path'],'rb').read()).hexdigest()!=f['sha256']) for d in json.load(open('DEPENDENCIES.json')) for f in d['files']]\" . Expected: every line prints False. Actual: lib/forge-std/src/StdAssertions.sol prints True (tree hash 3fbf4a025b4fc94eaca4c38c1f3dacb37bee10f12ee81994cfaf365ac1ce7384 vs recorded d4c89eec70d267dec6188461fbc74d3dc8c47e518d176a23417533a232ed9780), and likewise StdJson.sol, StdToml.sol, Vm.sol, console.sol, interfaces/IERC7540.sol, interfaces/IMulticall3.sol. All lib/openzeppelin-contracts entries print False.","severity":"info","snippet":"        \"path\": \"lib/forge-std/src/StdAssertions.sol\",\n        \"sha256\": \"d4c89eec70d267dec6188461fbc74d3dc8c47e518d176a23417533a232ed9780\"","title":"DEPENDENCIES.json records forge-std file hashes that do not match the vendored tree (whitespace-only reformat of 7 test-library files)"}],"hash":"c840c981a837a08bbb4a3bf8ada1bf40cd1feacef5a02e9901b374ff7d5dd5a8","nodeId":"06c9a53c-b706-42a9-a7ca-7845e2979604","outcome":"completed","summary":"The review is complete and `.imd-findings.json` is written. The working tree is clean apart from that file.\n\n**Outcome.** No access-control, trust-gap or asymmetry defect exists in `src/NightShiftImd.sol`. The token is a 17-line OpenZeppelin v5.4.0 ERC-20 with one constructor mint to `msg.sender`, and nothing else. I report one info-level provenance note and ten coverage rows, all `holds`.\n\n**What I verified in my area**\n\n- **Permission map.** The compiled ABI exposes exactly the nine standard ERC-20 and metadata selectors plus the supply constant. There is no owner, minter, pauser, blacklist, upgrade, permit, initializer, `receive` or `fallback`.\n- **Each entry point.** `approve` only writes the caller's own allowance row. `transfer` always debits the caller. `transferFrom` is gated by `_spendAllowance` for any non-zero value and rejects a zero sender. The deployer and the factory have no path over another holder's balance.\n- **Asymmetry pairs.** Both allowance writers assign and reject a zero spender. Both transfer paths share the same internal validation and balance writes. Mint and burn are internal and unreachable after construction.\n- **Trust-gap seams.** With no privileged actor, no settable parameter and no price or fee formula, none of the guide's seams exist in this contract.\n- **Base library integrity.** All six vendored OpenZeppelin files hash to the values recorded in `DEPENDENCIES.json`, and the base has no sender override, assembly, delegatecall or selfdestruct.\n- **Evidence.** The project's 39 tests pass with the verifier seed. A scratch test with five adversarial probes against the deployer, a stranger, an over-spending spender and unknown selectors also passed, and was deleted afterward.\n\n**The one note reported (info).** Seven forge-std files under `lib/` do not match the hashes recorded in `DEPENDENCIES.json`, although the README states upstream files are unmodified. I downloaded the pinned archive, whose hash does match, and diffed: every difference is whitespace reflow, and the files are byte-identical once whitespace is stripped. This affects test tooling only and has no bearing on the token, so it is recorded for provenance accuracy rather than as a security defect.\n\n**Not covered.** Nothing in the assigned area was left unreached. The static-analysis lead about a large numeric literal is the supply constant and is not a defect.","treeHash":null,"usage":{"cachedInputTokens":806164,"inputTokens":322,"model":"claude-fable-5-1","outputTokens":13650,"runtime":"claude","turns":28,"wallClockMs":231889}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"107def308610130e","findings":[],"hash":"d276a1bb5eb9c7c862db54714ec3ec68e39f471d96aabd500c7a421e5c857f58","nodeId":"a21856d4-9d19-41b3-a474-183b6a5ac9cf","outcome":"failed","summary":"Author identity unknown\n\n*** Please tell me who you are.\n\nRun\n\n  git config --global user.email \"you@example.com\"\n  git config --global user.name \"Your Name\"\n\nto set your account's default identity.\nOmit --global to set the identity only in this repository.\n\nfatal: unable to auto-detect email address (got 'imd@imd-task.(none)')\n","treeHash":null,"usage":{"cachedInputTokens":0,"inputTokens":0,"model":null,"outputTokens":0,"runtime":"codex","turns":0,"wallClockMs":460}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"df74f6c887684f20","findings":[{"citation":"resolved","description":"Merged from audit_permissions, audit_economics and audit_math, which all reported the same root cause. README.md line 131 states 'Upstream source files are unmodified' and points at DEPENDENCIES.json as the per-file provenance record. I recomputed sha256 for all 36 recorded paths: the 6 OpenZeppelin files and 23 forge-std files match; 7 forge-std files do not: lib/forge-std/src/StdAssertions.sol, StdJson.sol, StdToml.sol, Vm.sol, console.sol, interfaces/IERC7540.sol, interfaces/IMulticall3.sol. I downloaded each of the seven from raw.githubusercontent.com at the pinned commit 77041d2ce690e692d6e03cc812b57d1ddaa4d505: the upstream sha256 equals the recorded value in every case, so the tree copies are what changed. With all whitespace stripped (tr -d ' \\n\\t\\r') the tree copy and the upstream copy hash identically for all seven, and a plain diff shows only multi-line function signatures joined onto one line (forge fmt style), e.g. IMulticall3.aggregate. I also downloaded the five OpenZeppelin v5.4.0 sources at commit c64a1edb67b6e3f4a15cca8909c9482ad33a02b0 and cmp shows them byte-identical to the vendored files, so the production contract's only dependency is verified intact. Impact: provenance record fails its own check and the README claim is false for test tooling; no effect on src/NightShiftImd.sol, its bytecode or the launch. Fix: restore the seven files byte-for-byte from the pinned archive (and exclude lib/ from forge fmt), or regenerate the seven sha256 entries and drop the 'unmodified' wording for forge-std.","line":59,"path":"DEPENDENCIES.json","reproduction":"From the repository root run: python3 -I -c \"import json,hashlib; d=json.load(open('DEPENDENCIES.json')); [print(f['path']) for dep in d for f in dep['files'] if hashlib.sha256(open(f['path'],'rb').read()).hexdigest()!=f['sha256']]\". Expected: no output. Actual: seven paths printed, lib/forge-std/src/StdAssertions.sol, StdJson.sol, StdToml.sol, Vm.sol, console.sol, interfaces/IERC7540.sol, interfaces/IMulticall3.sol. Cross-check: curl -sSL https://raw.githubusercontent.com/foundry-rs/forge-std/77041d2ce690e692d6e03cc812b57d1ddaa4d505/src/interfaces/IMulticall3.sol | sha256sum prints 6620d9c5ea2e2291..., the recorded value; diff of that download against lib/forge-std/src/interfaces/IMulticall3.sol shows only lines 30-33 (the four-line aggregate(...) signature) collapsed onto one line; tr -d ' \\n\\t\\r' on both then sha256sum gives equal digests. No OpenZeppelin file mismatches.","severity":"info","snippet":"        \"path\": \"lib/forge-std/src/StdAssertions.sol\",\n        \"sha256\": \"d4c89eec70d267dec6188461fbc74d3dc8c47e518d176a23417533a232ed9780\"","title":"Seven vendored forge-std files do not match the sha256 values DEPENDENCIES.json records and README calls unmodified (whitespace-only reformat, test tooling only)"}],"hash":"db33afdd0f711a8bddf8e33ccc131267754d39ee5bf52f0a84770ca90e646b80","nodeId":"94f1ae2c-5bc0-4c8c-bcb3-45ba6ed5b332","outcome":"completed","summary":"The review is complete and the report is written to `.imd-findings.json`.\n\n**Outcome: the token is clean.** The only kept finding is informational, and it merges three specialist reports of the same root cause.\n\nWhat I verified against the code:\n\n- **Entry points.** All three state-changing functions are unmodified OpenZeppelin v5.4.0 ERC20. I traced each through `_transfer`, `_update` and `_spendAllowance` for zero-address, balance and allowance reverts and exact accounting. All three hold.\n- **Production dependency integrity.** I downloaded the five OpenZeppelin sources at the pinned commit and compared them byte-for-byte with the vendored files. They are identical, so the inherited code is the audited upstream code.\n- **Supply and deployability.** The parameterless constructor mints exactly 10^27 base units once to msg.sender. Creation and runtime bytecode are far under the protocol limits, and CREATE2 at any salt works. The manifest matches the constructor, supply, decimals and schema rules.\n- **Tests and tooling.** The build, all 51 project tests under the verifier seed, and the formatting check pass. Slither reported nothing, and the aderyn large-literal note is the supply constant, not a defect.\n\nSpecialist findings settled:\n\n- **Kept, merged, info.** Three specialists reported that seven forge-std files hash differently from the values in DEPENDENCIES.json, contradicting the README's \"unmodified\" claim. I reproduced it: the recorded hashes equal upstream, and the tree copies differ only by whitespace, with the function signatures re-joined onto one line. Test tooling only, no effect on the token.\n- **Nothing dropped**, since no specialist reported anything else.\n\nMy own pass found no additional defects. One stale sentence remains in README.md line 71, which says the project supplies no launch.json even though the manifest step has since added one. I noted it in the coverage record rather than as a finding.\n\nThe coverage record answers all three listed entry points as `holds`, plus rows for the constructor, the no-admin invariant, the manifest and dependency integrity. No proofs were needed, since nothing reached high severity, and no tracked file was changed.","treeHash":null,"usage":{"cachedInputTokens":440302,"inputTokens":226,"model":"claude-fable-5-1","outputTokens":10762,"runtime":"claude","turns":21,"wallClockMs":173817}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"723b11f958c65250","findings":[{"citation":"resolved","description":"DEPENDENCIES.json records per-file sha256 values for the vendored forge-std v1.9.7 (commit 77041d2ce690e692d6e03cc812b57d1ddaa4d505) and the README states the upstream files are unmodified. For seven files under lib/forge-std/src the on-disk content does not hash to the recorded value: StdAssertions.sol, StdJson.sol, StdToml.sol, Vm.sol, console.sol, interfaces/IERC7540.sol and interfaces/IMulticall3.sol. The recorded hashes do match the upstream files at that commit; the local copies differ only by line wrapping (a formatter re-joined multi-line function signatures), so they are semantically identical. All six OpenZeppelin files match their recorded hashes exactly, so the production contract's only dependency is verified. This affects only the test toolchain and the accuracy of the provenance record; it has no effect on the token's bytecode or behaviour. Reported for the record so the provenance claim can be made true (re-vendor the upstream bytes or re-record the hashes); it is not a blocking defect and opens no revision on its own.","line":131,"path":"README.md","reproduction":"From the repository root run: python3 -I -c \"import json,hashlib; d=json.load(open('DEPENDENCIES.json')); [print(f['path']) for dep in d for f in dep['files'] if hashlib.sha256(open(f['path'],'rb').read()).hexdigest()!=f['sha256']]\". Expected: no output (every vendored file matches its recorded hash, as the README states). Actual: seven lib/forge-std/src paths are printed. Example: lib/forge-std/src/interfaces/IMulticall3.sol has recorded and upstream sha256 prefix 6620d9c5ea2e2291 (2185 bytes) but local sha256 prefix 1b63ca78b27d9893 (2161 bytes); `diff` against the upstream file shows only the four-line `aggregate(...)` signature collapsed onto one line. No OpenZeppelin file mismatches.","severity":"info","snippet":"hashes and individual source hashes. Upstream source files are unmodified:","title":"Seven vendored forge-std files do not match the hashes DEPENDENCIES.json and the README claim for them (formatting-only drift, test library only)"}],"hash":"ea25b4b25c7cf697d475fd5c05fff387e06f9292575acb165f000592c74b1f46","nodeId":"76626d7c-5dbd-40ed-99de-e8a7206778d7","outcome":"completed","summary":"The review is complete and `.imd-findings.json` holds the result. The only tracked change is the findings file itself, which the task asks for.\n\n**Outcome:** no math, boundary or numerical-gap defect in the token. One info-level provenance note, which opens no revision.\n\n**What I checked, against the three guides:**\n- **Math Precision.** The token has one arithmetic expression, the compile-time constant for the supply. It evaluates to exactly 1e27, matching the manifest string, so the aderyn large-literal lead is a non-issue. The inherited OpenZeppelin `_update` uses unchecked blocks, but each is bounded by the checked balance guard before it and by the fixed supply, which is far below the overflow range.\n- **Boundary.** The token makes no external calls, has no payable function, `receive` or `fallback`, and decodes no bytes. ETH sends revert. The only sentinel branches are the zero-address guards, and both sides behave as documented.\n- **Numerical Gap.** Balance conservation holds under the project's invariant suite and a scratch fuzz I wrote. Allowance edges hold: unlimited allowance never decrements, one below unlimited decrements exactly, an allowance equal to the amount spends to zero, one below reverts with no state change, and a `transferFrom` from the zero address reverts before any mint could occur.\n\n**Coverage record:** all three listed entry points (`approve`, `transfer`, `transferFrom`) are marked `holds`, plus rows for the constructor mint, the supply-conservation invariant, the boundary surface, and the launch flows.\n\n**Info finding:** seven vendored forge-std files differ from the hashes recorded in `DEPENDENCIES.json` and the README's claim that upstream files are unmodified. The differences are line-wrapping only, the recorded hashes match upstream, and all six OpenZeppelin files verify exactly, so the production bytecode is unaffected.\n\n**Verification run:** `forge build` succeeded and the project's 39 tests passed with the pinned fuzz seed. My scratch tests under `test/scratch/` passed on every boundary case and were removed afterwards.","treeHash":null,"usage":{"cachedInputTokens":637111,"inputTokens":290,"model":"claude-fable-5-1","outputTokens":14033,"runtime":"claude","turns":26,"wallClockMs":242299}}],"verification":[{"checks":[{"durationMs":1658,"exitCode":0,"name":"build","output":"Compiling 29 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.58s\nCompiler run successful!\n","passed":true},{"durationMs":8916,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 2 tests for test/NightShiftImdLaunch.t.sol:NightShiftImdLaunchTest\n[PASS] testFuzz_create2MintsEntireSupplyToFactory(bytes32) (runs: 1024, μ: 302965, ~: 303067)\nLogs:\n  computeCreate2Address is deprecated. Please use vm.computeCreate2Address instead.\n\n[PASS] test_factoryDistributionClaimAndPoolTransfersArriveWhole() (gas: 648878)\nSuite result: ok. 2 passed; 0 failed; 0 skipped; finished in 130.10ms (131.03ms CPU time)\n\nRan 36 tests for test/NightShiftImd.t.sol:NightShiftImdTest\n[PASS] testFuzz_selfTransferPreservesSupply(uint256) (runs: 1024, μ: 55100, ~: 54828)\nLogs:\n  Bound result 1000000000000000000000000000\n\n[PASS] testFuzz_transferAboveBalanceReverts(uint256,uint256) (runs: 1024, μ: 127430, ~: 127637)\nLogs:\n  Bound result 2\n  Bound result 99183458496841887866057300136621753947611507029880791945625673901116320538228\n\n[PASS] testFuzz_transferFromHonorsAllowance(uint256,uint256) (runs: 1024, μ: 161711, ~: 164035)\nLogs:\n  Bound result 2\n\n[PASS] testFuzz_transferFromRejectsInsufficientAllowance(uint256,uint256) (runs: 1024, μ: 123417, ~: 123792)\nLogs:\n  Bound result 293559543276069694172804946\n  Bound result 706440456723930305841898351\n\n[PASS] testFuzz_transfersConserveSupply(uint256,address) (runs: 1024, μ: 92899, ~: 93199)\nLogs:\n  Bound result 232240252764136045029379777\n\n[PASS] test_approvalDoesNotRequireCurrentBalance() (gas: 184796)\n[PASS] test_approvalIsSpecificToHolderAndSpender() (gas: 176268)\n[PASS] test_approveCanReplaceAndRevokeAllowance() (gas: 170129)\n[PASS] test_approveEmitsEventWithoutMovingTokens() (gas: 88721)\n[PASS] test_approveZeroSpenderRevertsIncludingZeroAmount() (gas: 61906)\n[PASS] test_constructorEmitsExactlyOneMintToDeployer() (gas: 31233)\n[PASS] test_deployerCannotSpendAnotherHoldersTokens() (gas: 158499)\n[PASS] test_maximumAllowanceCannotBypassBalanceCheck() (gas: 98503)\n[PASS] test_metadataAndInitialSupply() (gas: 107649)\n[PASS] test_noMintBurnOrAdministrativeEntrypoints() (gas: 948079)\n[PASS] test_rejectsNativeEther() (gas: 42618)\n[PASS] test_runtimeHasNoForbiddenOpcodes() (gas: 787350)\n[PASS] test_selfTransferPreservesBalanceAndEmitsEvent() (gas: 53969)\n[PASS] test_selfTransferStillRequiresBalance() (gas: 35931)\n[PASS] test_transferAboveBalanceRevertsWithoutChanges() (gas: 67704)\n[PASS] test_transferDeliversExactAmountAndEmitsEvent() (gas: 91527)\n[PASS] test_transferEntireSupply() (gas: 86039)\n[PASS] test_transferFromAboveAllowanceRevertsWithoutChanges() (gas: 116079)\n[PASS] test_transferFromAboveBalanceRestoresAllowance() (gas: 136906)\n[PASS] test_transferFromCanExhaustAllowance() (gas: 162253)\n[PASS] test_transferFromDeliversExactAmountAndSpendsAllowance() (gas: 172977)\n[PASS] test_transferFromMaximumAllowanceRemainsUnchanged() (gas: 204635)\n[PASS] test_transferFromRequiresAllowanceEvenForHolder() (gas: 35795)\n[PASS] test_transferFromToSameHolderConsumesAllowanceOnly() (gas: 110053)\n[PASS] test_transferFromToZeroRevertsAndRestoresAllowance() (gas: 114631)\n[PASS] test_transferFromZeroCannotMint() (gas: 55343)\n[PASS] test_transferMaximumUintReverts() (gas: 42416)\n[PASS] test_transferToContractDoesNotCallRecipient() (gas: 170187)\n[PASS] test_transferToZeroRevertsIncludingZeroAmount() (gas: 82373)\n[PASS] test_zeroTransferFromEmptyAccountEmitsEvent() (gas: 73323)\n[PASS] test_zeroTransferFromNeedsNoAllowance() (gas: 81516)\nSuite result: ok. 36 passed; 0 failed; 0 skipped; finished in 135.01ms (289.28ms CPU time)\n\nRan 12 tests for test/NightShiftImdAllowance.t.sol:NightShiftImdAllowanceTest\n[PASS] testFuzz_competingSpendersCannotSpendTheSameBalance(uint256,uint256) (runs: 1024, μ: 507493, ~: 506951)\nLogs:\n  Bound result 5126713792638\n  Bound result 3727983061889\n\n[PASS] testFuzz_directTransferDoesNotChangeAnyApproval(uint256,uint256) (runs: 1024, μ: 465382, ~: 466064)\nLogs:\n  Bound result 491908187378450346701374405\n\n[PASS] testFuzz_failedSpendCanSucceedAfterFunding(uint256,uint256,uint256) (runs: 1024, μ: 363099, ~: 363829)\nLogs:\n  Bound result 277840322754\n  Bound result 999999999999999722293175910\n  Bound result 999999999999999722293175912\n\n[PASS] testFuzz_invalidRecipientDoesNotConsumeAuthorization(uint256,uint256) (runs: 1024, μ: 303287, ~: 304317)\nLogs:\n  Bound result 2\n  Bound result 99183458496841887866057300136621753947611507029880791945625673901116320538228\n\n[PASS] testFuzz_refundingTokensDoesNotRestoreSpentAllowance(uint256,uint256) (runs: 1024, μ: 408905, ~: 409837)\nLogs:\n  Bound result 1175\n  Bound result 648\n\n[PASS] testFuzz_splitDelegatedTransfersEqualSingleTransfer(uint256,uint256,uint256,bool) (runs: 1024, μ: 460312, ~: 480174)\nLogs:\n  Bound result 159858757093080667869358195\n  Bound result 88955916708909677820693936\n  Bound result 1786218779655474537627348108898727852814219167741272389\n\n[PASS] test_maxMinusOneAllowanceIsFinite() (gas: 280852)\n[PASS] test_oneBaseUnitCanBeApprovedSpentAndReturned() (gas: 328265)\n[PASS] test_selfApprovalDoesNotAuthorizeAnotherCaller() (gas: 322498)\n[PASS] test_spenderCannotPassItsAuthorityToAnotherSpender() (gas: 335138)\n[PASS] test_unlimitedApprovalCanBeReducedAndRevokedAfterSpending() (gas: 467725)\n[PASS] test_zeroTransferFromStillRejectsZeroEndpoints() (gas: 112468)\nSuite result: ok. 12 passed; 0 failed; 0 skipped; finished in 135.34ms (801.34ms CPU time)\n\nRan 1 test for test/NightShiftImdInvariant.t.sol:NightShiftImdInvariantTest\n[PASS]\nNightShiftImdInvariantTest invariants:\n[PASS] invariant_balancesAndAllowancesMatchIndependentLedger\n[PASS] invariant_supplyIsFixedAndFullyAccountedFor\n NightShiftImdInvariantTest invariants (runs: 256, calls: 32768, reverts: 0)\n\n╭--------------+-----------------------+-------+---------+----------╮\n| Contract     | Selector              | Calls | Reverts | Discards |\n+===================================================================+\n| TokenHandler | approve               | 4704  | 0       | 0        |\n|--------------+-----------------------+-------+---------+----------|\n| TokenHandler | revokeAndAttemptSpend | 4643  | 0       | 0        |\n|--------------+-----------------------+-------+---------+----------|\n| TokenHandler | roundTrip             | 4706  | 0       | 0        |\n|--------------+-----------------------+-------+---------+----------|\n| TokenHandler | spendAboveBalance     | 4635  | 0       | 0        |\n|--------------+-----------------------+-------+---------+----------|\n| TokenHandler | transfer              | 4707  | 0       | 0        |\n|--------------+-----------------------+-------+---------+----------|\n| TokenHandler | transferFrom          | 4690  | 0       | 0        |\n|--------------+-----------------------+-------+---------+----------|\n| TokenHandler | transferFullBalance   | 4683  | 0       | 0        |\n╰--------------+-----------------------+-------+---------+----------╯\n\nLogs:\n  Bound result 250000000000000000000000000\n  Bound result 250000000000000000000000000\n  Bound result 250000000000000000000000000\n  Bound result 115792089237316195423570985008687907853269984665640064039457584007985967098391\n  Bound result 115792089237316195423570985008687907853269984665640064039458584007913129639935\n  Bound result 5935\n  Bound result 0\n  Bound result 5358\n  Bound result 0\n  Bound result 59418981409106896215919573758198889796698145317350\n  Bound result 0\n  Bound result 1000000000000000000\n  Bound result 1056351393470885244284641740726\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 5107\n  Bound result 0\n  Bound result 0\n  Bound result 4658952193461429723917790\n  Bound result 12\n  Bound result 115792089237316195423570985008687907853269984665639564039457584007913129649736\n  Bound result 24576\n  Bound result 115792089237316195423570985008687907853269984665640564039457584007913129639934\n  Bound result 0\n  Bound result 0\n  Bound result 5501583115656854250862947509803\n  Bound result 10000000000000000000\n  Bound result 0\n  Bound result 73357027\n  Bound result 8815\n  Bound result 0\n  Bound result 0\n  Bound result 115792089237316195423570985008687907853269984665640564039457584007913129639932\n  Bound result 1\n  Bound result 0\n  Bound result 96\n  Bound result 5\n  Bound result 0\n  Bound result 95\n  Bound result 2\n  Bound result 15\n  Bound result 117735466637252445026280804\n  Bound result 2\n  Bound result 4392\n  Bound result 13\n  Bound result 242\n  Bound result 0\n  Bound result 0\n  Bound result 9556\n  Bound result 2930\n  Bound result 2\n  Bound result 0\n  Bound result 8928\n  Bound result 9\n  Bound result 0\n  Bound result 0\n  Bound result 0\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 8.81s (8.80s CPU time)\n\nRan 4 test suites in 8.81s (9.21s CPU time): 51 tests passed, 0 failed, 0 skipped (51 total tests)\n","passed":true},{"durationMs":42,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"NightShiftImd.approve(address,uint256)\",\"NightShiftImd.transfer(address,uint256)\",\"NightShiftImd.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"DEPENDENCIES.json\":164,\"README.md\":138,\"foundry.toml\":21,\"remappings.txt\":2,\"src/NightShiftImd.sol\":17,\"test/NightShiftImd.t.sol\":427,\"test/NightShiftImdAllowance.t.sol\":283,\"test/NightShiftImdInvariant.t.sol\":225,\"test/NightShiftImdLaunch.t.sol\":68},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"463040b449b43b3fac3b30075598a554585a7b75310cb12d9b7a49c610fecaef","verifiedTreeHash":"ad5e37522acbf1c86396a01e2c71cc0a9c73de38","verifierVersion":"0.1.0+c3fba9eb"},{"checks":[{"durationMs":1300,"exitCode":0,"name":"build","output":"Compiling 28 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.23s\nCompiler run successful!\n","passed":true},{"durationMs":4947,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 2 tests for test/NightShiftImdLaunch.t.sol:NightShiftImdLaunchTest\n[PASS] testFuzz_create2MintsEntireSupplyToFactory(bytes32) (runs: 1024, μ: 302959, ~: 303067)\nLogs:\n  computeCreate2Address is deprecated. Please use vm.computeCreate2Address instead.\n\n[PASS] test_factoryDistributionClaimAndPoolTransfersArriveWhole() (gas: 648878)\nSuite result: ok. 2 passed; 0 failed; 0 skipped; finished in 37.31ms (37.95ms CPU time)\n\nRan 36 tests for test/NightShiftImd.t.sol:NightShiftImdTest\n[PASS] testFuzz_selfTransferPreservesSupply(uint256) (runs: 1024, μ: 55093, ~: 54828)\nLogs:\n  Bound result 32165278664713196874095072\n\n[PASS] testFuzz_transferAboveBalanceReverts(uint256,uint256) (runs: 1024, μ: 127376, ~: 127613)\nLogs:\n  Bound result 2\n  Bound result 99183458496841887866057300136621753947611507029880791945625673901116320538228\n\n[PASS] testFuzz_transferFromHonorsAllowance(uint256,uint256) (runs: 1024, μ: 161624, ~: 164035)\nLogs:\n  Bound result 6162833429818276587\n\n[PASS] testFuzz_transferFromRejectsInsufficientAllowance(uint256,uint256) (runs: 1024, μ: 123392, ~: 123792)\nLogs:\n  Bound result 5206\n  Bound result 999999999999999999999995038\n\n[PASS] testFuzz_transfersConserveSupply(uint256,address) (runs: 1024, μ: 92896, ~: 93199)\nLogs:\n  Bound result 232240252764136045029379777\n\n[PASS] test_approvalDoesNotRequireCurrentBalance() (gas: 184796)\n[PASS] test_approvalIsSpecificToHolderAndSpender() (gas: 176268)\n[PASS] test_approveCanReplaceAndRevokeAllowance() (gas: 170129)\n[PASS] test_approveEmitsEventWithoutMovingTokens() (gas: 88721)\n[PASS] test_approveZeroSpenderRevertsIncludingZeroAmount() (gas: 61906)\n[PASS] test_constructorEmitsExactlyOneMintToDeployer() (gas: 31233)\n[PASS] test_deployerCannotSpendAnotherHoldersTokens() (gas: 158499)\n[PASS] test_maximumAllowanceCannotBypassBalanceCheck() (gas: 98503)\n[PASS] test_metadataAndInitialSupply() (gas: 107649)\n[PASS] test_noMintBurnOrAdministrativeEntrypoints() (gas: 948079)\n[PASS] test_rejectsNativeEther() (gas: 42618)\n[PASS] test_runtimeHasNoForbiddenOpcodes() (gas: 787350)\n[PASS] test_selfTransferPreservesBalanceAndEmitsEvent() (gas: 53969)\n[PASS] test_selfTransferStillRequiresBalance() (gas: 35931)\n[PASS] test_transferAboveBalanceRevertsWithoutChanges() (gas: 67704)\n[PASS] test_transferDeliversExactAmountAndEmitsEvent() (gas: 91527)\n[PASS] test_transferEntireSupply() (gas: 86039)\n[PASS] test_transferFromAboveAllowanceRevertsWithoutChanges() (gas: 116079)\n[PASS] test_transferFromAboveBalanceRestoresAllowance() (gas: 136906)\n[PASS] test_transferFromCanExhaustAllowance() (gas: 162253)\n[PASS] test_transferFromDeliversExactAmountAndSpendsAllowance() (gas: 172977)\n[PASS] test_transferFromMaximumAllowanceRemainsUnchanged() (gas: 204635)\n[PASS] test_transferFromRequiresAllowanceEvenForHolder() (gas: 35795)\n[PASS] test_transferFromToSameHolderConsumesAllowanceOnly() (gas: 110053)\n[PASS] test_transferFromToZeroRevertsAndRestoresAllowance() (gas: 114631)\n[PASS] test_transferFromZeroCannotMint() (gas: 55343)\n[PASS] test_transferMaximumUintReverts() (gas: 42416)\n[PASS] test_transferToContractDoesNotCallRecipient() (gas: 170187)\n[PASS] test_transferToZeroRevertsIncludingZeroAmount() (gas: 82373)\n[PASS] test_zeroTransferFromEmptyAccountEmitsEvent() (gas: 73323)\n[PASS] test_zeroTransferFromNeedsNoAllowance() (gas: 81516)\nSuite result: ok. 36 passed; 0 failed; 0 skipped; finished in 39.29ms (184.61ms CPU time)\n\nRan 1 test for test/NightShiftImdInvariant.t.sol:NightShiftImdInvariantTest\n[PASS]\nNightShiftImdInvariantTest invariants:\n[PASS] invariant_balancesAndAllowancesMatchIndependentLedger\n[PASS] invariant_supplyIsFixedAndFullyAccountedFor\n NightShiftImdInvariantTest invariants (runs: 256, calls: 16384, reverts: 0)\n\n╭--------------+--------------+-------+---------+----------╮\n| Contract     | Selector     | Calls | Reverts | Discards |\n+==========================================================+\n| TokenHandler | approve      | 5458  | 0       | 0        |\n|--------------+--------------+-------+---------+----------|\n| TokenHandler | transfer     | 5517  | 0       | 0        |\n|--------------+--------------+-------+---------+----------|\n| TokenHandler | transferFrom | 5409  | 0       | 0        |\n╰--------------+--------------+-------+---------+----------╯\n\nLogs:\n  Bound result 0\n  Bound result 4864\n  Bound result 20000000000000000000\n  Bound result 731350124350059647698841009\n  Bound result 70403327004260960\n  Bound result 999999999999999999999999999\n  Bound result 0\n  Bound result 71261344342322311180932460\n  Bound result 0\n  Bound result 1000000000\n  Bound result 0\n  Bound result 6000000000000000000\n  Bound result 0\n  Bound result 10\n  Bound result 6312143628694150867681679\n  Bound result 607953894488280775778890305\n  Bound result 22\n  Bound result 2473\n  Bound result 96\n  Bound result 0\n  Bound result 31\n  Bound result 6239\n  Bound result 0\n  Bound result 41923462425126752188212197\n  Bound result 3944\n  Bound result 242\n  Bound result 3501\n  Bound result 2110234840\n  Bound result 242\n  Bound result 6\n  Bound result 0\n  Bound result 542835147178424161364600064\n  Bound result 4703\n  Bound result 12\n  Bound result 4000000000000000000\n  Bound result 0\n  Bound result 3503\n  Bound result 3041954472\n  Bound result 902715580230438172375199442\n  Bound result 3419\n  Bound result 3\n  Bound result 8672597481175278798\n  Bound result 457164838821575838635399901\n  Bound result 1979161024454966378\n  Bound result 156041227749949206843570226\n  Bound result 4204\n  Bound result 2\n  Bound result 10\n  Bound result 8\n  Bound result 3034880395341883242\n  Bound result 5348\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 4.86s (4.86s CPU time)\n\nRan 3 test suites in 4.86s (4.94s CPU time): 39 tests passed, 0 failed, 0 skipped (39 total tests)\n","passed":true},{"durationMs":33,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"NightShiftImd.approve(address,uint256)\",\"NightShiftImd.transfer(address,uint256)\",\"NightShiftImd.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"DEPENDENCIES.json\":164,\"README.md\":138,\"foundry.toml\":21,\"remappings.txt\":2,\"src/NightShiftImd.sol\":17,\"test/NightShiftImd.t.sol\":427,\"test/NightShiftImdInvariant.t.sol\":125,\"test/NightShiftImdLaunch.t.sol\":68},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true},{"durationMs":478,"exitCode":0,"name":"slither","output":"slither: no results at low impact or above","passed":true},{"durationMs":212,"exitCode":0,"name":"aderyn","output":"[low] large-numeric-literal at src/NightShiftImd.sol:12: Large Numeric Literal","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"5f220f53e365b9e2979fa25e4ebc365322642b0053eaa2b0601b091e983f5276","verifiedTreeHash":"fc85b48736b0802ecac2193fadb6c7f16d8f108f","verifierVersion":"0.1.0+c3fba9eb"},{"checks":[{"durationMs":2145,"exitCode":0,"name":"build","output":"Compiling 28 files with Solc 0.8.26\nSolc 0.8.26 finished in 2.02s\nCompiler run successful!\n","passed":true},{"durationMs":6450,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 36 tests for test/NightShiftImd.t.sol:NightShiftImdTest\n[PASS] testFuzz_selfTransferPreservesSupply(uint256) (runs: 1024, μ: 55093, ~: 54828)\nLogs:\n  Bound result 599601902881855536130749698\n\n[PASS] testFuzz_transferAboveBalanceReverts(uint256,uint256) (runs: 1024, μ: 127376, ~: 127613)\nLogs:\n  Bound result 1132051206099981665501\n  Bound result 6162833429818276587\n\n[PASS] testFuzz_transferFromHonorsAllowance(uint256,uint256) (runs: 1024, μ: 161624, ~: 164035)\nLogs:\n  Bound result 0\n\n[PASS] testFuzz_transferFromRejectsInsufficientAllowance(uint256,uint256) (runs: 1024, μ: 123392, ~: 123792)\nLogs:\n  Bound result 115742812678\n  Bound result 7982306429853273\n\n[PASS] testFuzz_transfersConserveSupply(uint256,address) (runs: 1024, μ: 92896, ~: 93199)\nLogs:\n  Bound result 232240252764136045029379777\n\n[PASS] test_approvalDoesNotRequireCurrentBalance() (gas: 184796)\n[PASS] test_approvalIsSpecificToHolderAndSpender() (gas: 176268)\n[PASS] test_approveCanReplaceAndRevokeAllowance() (gas: 170129)\n[PASS] test_approveEmitsEventWithoutMovingTokens() (gas: 88721)\n[PASS] test_approveZeroSpenderRevertsIncludingZeroAmount() (gas: 61906)\n[PASS] test_constructorEmitsExactlyOneMintToDeployer() (gas: 31233)\n[PASS] test_deployerCannotSpendAnotherHoldersTokens() (gas: 158499)\n[PASS] test_maximumAllowanceCannotBypassBalanceCheck() (gas: 98503)\n[PASS] test_metadataAndInitialSupply() (gas: 107649)\n[PASS] test_noMintBurnOrAdministrativeEntrypoints() (gas: 948079)\n[PASS] test_rejectsNativeEther() (gas: 42618)\n[PASS] test_runtimeHasNoForbiddenOpcodes() (gas: 787350)\n[PASS] test_selfTransferPreservesBalanceAndEmitsEvent() (gas: 53969)\n[PASS] test_selfTransferStillRequiresBalance() (gas: 35931)\n[PASS] test_transferAboveBalanceRevertsWithoutChanges() (gas: 67704)\n[PASS] test_transferDeliversExactAmountAndEmitsEvent() (gas: 91527)\n[PASS] test_transferEntireSupply() (gas: 86039)\n[PASS] test_transferFromAboveAllowanceRevertsWithoutChanges() (gas: 116079)\n[PASS] test_transferFromAboveBalanceRestoresAllowance() (gas: 136906)\n[PASS] test_transferFromCanExhaustAllowance() (gas: 162253)\n[PASS] test_transferFromDeliversExactAmountAndSpendsAllowance() (gas: 172977)\n[PASS] test_transferFromMaximumAllowanceRemainsUnchanged() (gas: 204635)\n[PASS] test_transferFromRequiresAllowanceEvenForHolder() (gas: 35795)\n[PASS] test_transferFromToSameHolderConsumesAllowanceOnly() (gas: 110053)\n[PASS] test_transferFromToZeroRevertsAndRestoresAllowance() (gas: 114631)\n[PASS] test_transferFromZeroCannotMint() (gas: 55343)\n[PASS] test_transferMaximumUintReverts() (gas: 42416)\n[PASS] test_transferToContractDoesNotCallRecipient() (gas: 170187)\n[PASS] test_transferToZeroRevertsIncludingZeroAmount() (gas: 82373)\n[PASS] test_zeroTransferFromEmptyAccountEmitsEvent() (gas: 73323)\n[PASS] test_zeroTransferFromNeedsNoAllowance() (gas: 81516)\nSuite result: ok. 36 passed; 0 failed; 0 skipped; finished in 69.42ms (341.93ms CPU time)\n\nRan 2 tests for test/NightShiftImdLaunch.t.sol:NightShiftImdLaunchTest\n[PASS] testFuzz_create2MintsEntireSupplyToFactory(bytes32) (runs: 1024, μ: 302959, ~: 303067)\nLogs:\n  computeCreate2Address is deprecated. Please use vm.computeCreate2Address instead.\n\n[PASS] test_factoryDistributionClaimAndPoolTransfersArriveWhole() (gas: 648878)\nSuite result: ok. 2 passed; 0 failed; 0 skipped; finished in 72.94ms (74.17ms CPU time)\n\nRan 1 test for test/NightShiftImdInvariant.t.sol:NightShiftImdInvariantTest\n[PASS]\nNightShiftImdInvariantTest invariants:\n[PASS] invariant_balancesAndAllowancesMatchIndependentLedger\n[PASS] invariant_supplyIsFixedAndFullyAccountedFor\n NightShiftImdInvariantTest invariants (runs: 256, calls: 16384, reverts: 0)\n\n╭--------------+--------------+-------+---------+----------╮\n| Contract     | Selector     | Calls | Reverts | Discards |\n+==========================================================+\n| TokenHandler | approve      | 5458  | 0       | 0        |\n|--------------+--------------+-------+---------+----------|\n| TokenHandler | transfer     | 5517  | 0       | 0        |\n|--------------+--------------+-------+---------+----------|\n| TokenHandler | transferFrom | 5409  | 0       | 0        |\n╰--------------+--------------+-------+---------+----------╯\n\nLogs:\n  Bound result 0\n  Bound result 4864\n  Bound result 20000000000000000000\n  Bound result 731350124350059647698841009\n  Bound result 70403327004260960\n  Bound result 999999999999999999999999999\n  Bound result 0\n  Bound result 71261344342322311180932460\n  Bound result 0\n  Bound result 1000000000\n  Bound result 0\n  Bound result 6000000000000000000\n  Bound result 0\n  Bound result 10\n  Bound result 6312143628694150867681679\n  Bound result 607953894488280775778890305\n  Bound result 22\n  Bound result 2473\n  Bound result 96\n  Bound result 0\n  Bound result 31\n  Bound result 6239\n  Bound result 0\n  Bound result 41923462425126752188212197\n  Bound result 3944\n  Bound result 242\n  Bound result 3501\n  Bound result 2110234840\n  Bound result 242\n  Bound result 6\n  Bound result 0\n  Bound result 542835147178424161364600064\n  Bound result 4703\n  Bound result 12\n  Bound result 4000000000000000000\n  Bound result 0\n  Bound result 3510\n  Bound result 3041954472\n  Bound result 902715580230438172375199442\n  Bound result 3419\n  Bound result 3\n  Bound result 8672597481175278798\n  Bound result 542835147178424161364596658\n  Bound result 1979161024454966378\n  Bound result 156041227749949206843570226\n  Bound result 7\n  Bound result 2\n  Bound result 10\n  Bound result 8\n  Bound result 1055272196977155740\n  Bound result 0\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 6.32s (6.31s CPU time)\n\nRan 3 test suites in 6.32s (6.46s CPU time): 39 tests passed, 0 failed, 0 skipped (39 total tests)\n","passed":true},{"durationMs":62,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"NightShiftImd.approve(address,uint256)\",\"NightShiftImd.transfer(address,uint256)\",\"NightShiftImd.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"DEPENDENCIES.json\":164,\"README.md\":138,\"foundry.toml\":21,\"launch.json\":24,\"remappings.txt\":2,\"src/NightShiftImd.sol\":17,\"test/NightShiftImd.t.sol\":427,\"test/NightShiftImdInvariant.t.sol\":125,\"test/NightShiftImdLaunch.t.sol\":68},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"66b1b9c333e52ed5e0b8303443e3cf83b28f2170b97dffe74ee8d33d5e155244","verifiedTreeHash":"340a70896f6a70ade621514180b8b31b437bdbd9","verifierVersion":"0.1.0+c3fba9eb"}]}