{"assessments":[],"deployments":[],"fuzz":[],"identity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"interpretation":"Records acceptance and evidence. Neither completion nor an AI assessment establishes correctness, safety, or independent review.","jobId":"0a9434b1-165c-424d-847e-45ce260690e0","kind":"shape:chain","nodes":[{"acceptedSubmissionHash":"83ec27a32eea891b5a648716f4d02176c44353e44ac8f175d95f06a431099042","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_economics","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"ef2608b8eb77213dffa4348d1eb17590a17e0d0cba07273d02ed480bf0dbb518","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_flow","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"7d410b2bfd6db41e243fd7dfcf23929229e64962c4ffab54b23a62bf22271db9","dependsOn":["build_contract_project","write_foundry_tests","manifest","audit_math","audit_permissions","audit_economics","audit_flow"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"af3aa01159bbf354f621cafa5c0006f6169e0938a8b015be508b7377dbf165bc","skillId":"audit-judge","tools":[]},"key":"audit_judge","kind":"code","role":"review","skillHash":"af3aa01159bbf354f621cafa5c0006f6169e0938a8b015be508b7377dbf165bc","skillId":"audit-judge","state":"accepted"},{"acceptedSubmissionHash":"6ab501a687ab31fc608ea3df06a9809fd85f3113a29f2d644873c4f204e51071","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_math","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"8949ceb171e2981516cd41651758dea370e619eb0ee13260d6db9d9da26355f8","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_permissions","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"75abf01be95b3ad670502a53eda7aa7ba30fee94f746dc482dc854538ae10af6","dependsOn":[],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"6b8d2c2ebd3301cff2be8edb1e1cc6ba65c858c02fe7247be81722b969842265","skillId":"build-contract-project","tools":[]},"key":"build_contract_project","kind":"code","role":"implement","skillHash":"6b8d2c2ebd3301cff2be8edb1e1cc6ba65c858c02fe7247be81722b969842265","skillId":"build-contract-project","state":"accepted"},{"acceptedSubmissionHash":"cf30794977e00e76f4627ff40d71b9365d33905a39c02071695df8fb21db77e8","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"tools":[]},"key":"manifest","kind":"code","role":"integrate","skillHash":null,"skillId":null,"state":"accepted"},{"acceptedSubmissionHash":"51d48648aefb4a80ce4f596e557ac2c648d100a7800b5504e73a04509ec36905","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"73431852439ad3a343f3d2b7db1c43cd363b9f48f9bb51497374a0cf6d50b223","skillId":"write-foundry-tests","tools":[]},"key":"write_foundry_tests","kind":"code","role":"tests","skillHash":"73431852439ad3a343f3d2b7db1c43cd363b9f48f9bb51497374a0cf6d50b223","skillId":"write-foundry-tests","state":"accepted"}],"objective":"A custom token: Blox (BLOX).\nToken name: Blox\nToken symbol: BLOX\nToken supply: 1,000,000,000 with 18 decimals, all minted once to the deployer in the constructor.\nWhat it does: Launch a token on IdentityMD using the existing profile picture from this X account as the official token logo:\n\nhttps://x.com/blox_imd\n\nSTRICT LOGO REQUIREMENTS:\n\n1. Retrieve the current profile picture from https://x.com/blox_imd.\n2. Use that exact profile picture as the official token logo.\n3. Do NOT generate, recreate, redesign, modify, or replace the logo.\n4. Do NOT use AI image generation for the token logo.\n5. Do NOT assign a new logo creation task to any agent.\n6. If necessary, upload the existing profile picture to IPFS and use its URI in the token metadata.\n7. Skip the logo generation stage if supported.\n8. If the platform cannot use an existing X profile picture, report the limitation instead of generating a different logo.\n\nLaunch the token only. Do not create a website, landing page, or additional artwork.\n\nThe final token logo must match the profile picture of @blox_imd exactly.","parentJobId":null,"planHash":"24db3f1897fd9148d556a7219a7ce9ed60238a113f9504e268d110d8f5bb75d4","previousHash":"0000000000000000000000000000000000000000000000000000000000000000","projectId":"0a9434b1-165c-424d-847e-45ce260690e0","publication":{"commit":null,"deliveredAt":null,"repoUrl":"https://github.com/identity-md-launches/launch-1588-blox"},"receiptIdentity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"registry":"0xb6d0a187b050fa5bb0b87033a203f37becf4a775","research":[],"schema":"identitymd-work-v1","signals":[{"agentId":"52265","feedbackHash":"24e2ff714c9546184a7699fd32bf74536450dfc0d9199eec672d75619a186a3e","nodeKey":"audit_economics","submissionHash":"83ec27a32eea891b5a648716f4d02176c44353e44ac8f175d95f06a431099042","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"50986","feedbackHash":"c94de8b9636c41e54a5e00e7c0f7bec0ce5804f298f65f6efe36af0371fc24ce","nodeKey":"audit_flow","submissionHash":"ef2608b8eb77213dffa4348d1eb17590a17e0d0cba07273d02ed480bf0dbb518","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"50961","feedbackHash":"b6fe9b9c1651d9dd2b6e1d4f148aff17c883d7b1348e52647512a247681c068a","nodeKey":"audit_judge","submissionHash":"7d410b2bfd6db41e243fd7dfcf23929229e64962c4ffab54b23a62bf22271db9","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52666","feedbackHash":"43b66be5741b0266a8914292acf6096f4a8c2846769c0e5cc5fd6e902650c5c7","nodeKey":"audit_math","submissionHash":"6ab501a687ab31fc608ea3df06a9809fd85f3113a29f2d644873c4f204e51071","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52667","feedbackHash":"4771386bf9ce7b38433977d6e18408af49ce84b0298284d280884ad3bddc651d","nodeKey":"audit_permissions","submissionHash":"8949ceb171e2981516cd41651758dea370e619eb0ee13260d6db9d9da26355f8","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52597","feedbackHash":"2945666c5582997f5317922fb25f3e36a68a7ddae99b4433b09c770dafb7eaf5","nodeKey":"build_contract_project","submissionHash":"75abf01be95b3ad670502a53eda7aa7ba30fee94f746dc482dc854538ae10af6","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"52604","feedbackHash":"be6bdcf9a3c7c090d23884f8847230a07aa5830498c68ebb3ac1ade7623fa1c9","nodeKey":"manifest","submissionHash":"cf30794977e00e76f4627ff40d71b9365d33905a39c02071695df8fb21db77e8","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"52620","feedbackHash":"df4ad25c636e4d4b497bcd307b0db715889ea13b2a0786fd468a11024d0846a9","nodeKey":"write_foundry_tests","submissionHash":"51d48648aefb4a80ce4f596e557ac2c648d100a7800b5504e73a04509ec36905","tag1":"verification:checks","tag2":"acceptance-v2","value":1}],"site":null,"snapshotHash":"acd7d73aa4a35c6d6b1ddd060b649466cac73ceb22ce442cc905b2c3c11fb6e6","state":"completed","submissions":[{"artifacts":[],"attempt":1,"bundleHash":"6c0c6f5a51f46b5f726bda7e1709e81df4ba8fad50bc8b415f68663bec54ef29","device":"3ba092738fb7852e","findings":[],"hash":"51d48648aefb4a80ce4f596e557ac2c648d100a7800b5504e73a04509ec36905","nodeId":"6e789fe7-33e7-48ef-8b3c-bdf96a86ee5a","outcome":"completed","summary":"Added failure-path, permit fuzz, and stateful invariant tests. Only `test/` changed.\n\nVerified:\n- `forge build` passes.\n- `forge test --offline`: 69 passed, including 32,768 invariant calls.\n- Three offline logo checks pass.\n\nThe logo matches its documented image URL byte-for-byte. X blocked confirmation of the account’s current profile-picture selection; that limitation is documented in the test notes.","treeHash":"0feb561bad897b2dc86dcff29a8712e27733a877","usage":{"cachedInputTokens":829696,"inputTokens":174430,"model":"gpt-6-astra","outputTokens":25734,"runtime":"codex","turns":6,"wallClockMs":840932}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"30bcdea6dcb9ee40","findings":[],"hash":"6ab501a687ab31fc608ea3df06a9809fd85f3113a29f2d644873c4f204e51071","nodeId":"6d407bcb-47cc-4352-b5ee-dc686cadd07f","outcome":"completed","summary":"The review is complete. No defects were found in the Math Precision, Boundary or Numerical Gap areas, and the findings file records an empty list plus coverage for all four entry points and four invariants.\n\n**What the token is.** BloxToken is unmodified OpenZeppelin v5.4.0 ERC20 plus ERC20Permit with one constructor mint of a compile-time constant. It has no external calls, no payable path, no receive or fallback, no fee or burn logic, and no owner. The only arithmetic in the whole surface is the library's balance and allowance updates.\n\n**What I checked and how.**\n- Vendored OpenZeppelin diffed byte-for-byte against the v5.4.0 tag. No differences.\n- Supply constant evaluates to exactly 1e27 minor units and matches the README's manifest value; the aderyn large-literal lead is that constant and not a defect.\n- Transfer and transferFrom edges run in a scratch suite: max-uint amount, supply plus one, self-transfer, zero-value, infinite versus max-minus-one allowance, allowance above balance, zero-address sender. All revert or conserve balances as the library intends.\n- Permit edges: deadline equal to the block timestamp passes, expired fails, nonce gaps and replays fail, high-s and bad-v signatures and a zero owner all revert in ECDSA before any allowance is written, and the domain separator rebinds on a chain-id change.\n- Runtime bytecode contains only STATICCALL for the ecrecover precompile, no CALL, CREATE, DELEGATECALL, CALLCODE or SELFDESTRUCT.\n- Logo constants: the committed file's SHA-256 equals the on-chain constant and equals the original upload X currently serves as the avatar of @blox_imd. I recomputed the CIDv0 from scratch and it matches the on-chain URI.\n\n**One open item, not a code defect.** The CID is not yet confirmed pinned. Public gateways rate-limited my check, and the README already names pinning as the remaining operational step.\n\nThe scratch directory was removed and the working tree is clean apart from the findings file.","treeHash":null,"usage":{"cachedInputTokens":749635,"inputTokens":322,"model":"claude-fable-5-1","outputTokens":15960,"runtime":"claude","turns":29,"wallClockMs":214212}},{"artifacts":[],"attempt":1,"bundleHash":"45225a398a506a72082140bbc102d9e2be32c82a592002d1365d85b3fc0811d3","device":"9f3c23750c16c22c","findings":[],"hash":"75abf01be95b3ad670502a53eda7aa7ba30fee94f746dc482dc854538ae10af6","nodeId":"6ffe8457-28f5-4f3b-87bf-41f717bd0971","outcome":"completed","summary":"Done. The Blox (BLOX) custom token is built, tested, documented and committed on main.\n\n**What was delivered**\n\n- `src/BloxToken.sol`: OpenZeppelin v5.4.0 ERC20 + ERC20Permit, name Blox, symbol BLOX, 18 decimals. The constructor mints the full 1,000,000,000 BLOX once to the deployer, which is the ProjectFactory at launch. No constructor arguments, no owner, no mint, no pause, no blacklist, no fee, no proxy, no external calls in the constructor.\n- `test/BloxToken.t.sol`: 22 tests covering metadata, exact supply to the deployer and not to tx.origin, launch flows arriving whole, fuzzed supply conservation, revert paths, the same admin and privileged selector sweeps the protected floor runs, a DELEGATECALL/CALLCODE/SELFDESTRUCT opcode scan, and permit success, wrong signer, expiry and replay.\n- `foundry.toml` pins solc 0.8.26 with bytecode_hash none and no ffi or filesystem access. forge-std and a minimal OpenZeppelin subset are vendored as ordinary files under lib, with provenance notes.\n- `README.md` documents assumptions, launch parameters, the after-launch section (nothing to set) and operational responsibilities.\n\n**Logo, exactly as required**\n\nThe profile picture of @blox_imd was resolved to X's image host and the original upload was downloaded unmodified. It is committed as `assets/logo/blox.jpg` and its IPFS CID was computed locally two independent ways, which agreed. The token exposes the URI and the file's SHA-256 on chain, and `assets/token-metadata.json` points at the same file. Nothing was generated, edited or delegated.\n\n| Logo fact | Value |\n|---|---|\n| File | 400x400 progressive JPEG, 56,060 bytes |\n| SHA-256 | c2aeb53e69e10a7a4654a97ce8b26bd0a99a843d024ad6f09f6f7d235ca2eaec |\n| IPFS URI | ipfs://QmWJsrdD9smahpdyqjBzDBodJkJJGNznMA2Wrh15R1hhCp |\n\n**Limitation reported:** this machine has no IPFS pinning credentials, so the file is content-addressed but not yet pinned. The URI is already correct and resolves once anyone pins the committed file with the command in the README. The CID must come out identical, which proves the file was not altered.\n\n**Checks run**\n\nforge build, forge test (22 passed, also with an empty environment) and forge fmt --check all pass. Slither and Mythril were not available and were not run. No launch.json was written, as the manifest step owns it.","treeHash":"bc39555fb51ebfb5f6946c70888811115c3a5690","usage":{"cachedInputTokens":487675,"inputTokens":290,"model":"claude-fable-5-1","outputTokens":23405,"runtime":"claude","turns":24,"wallClockMs":302947}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"d68ba89c0b30801c","findings":[{"citation":"resolved","description":"Merged from audit_economics (reproduced). The token bakes the logo's IPFS URI into a constant exposed by logoURI(), and assets/token-metadata.json repeats it as logoURI. The content itself is right: I re-downloaded https://pbs.twimg.com/profile_images/2108499797414236160/QJxnGSNM.jpg (the profile_images id the live x.com/blox_imd page references today) and it is byte-identical to the committed assets/logo/blox.jpg (56,060 bytes, sha256 c2aeb53e69e10a7a4654a97ce8b26bd0a99a843d024ad6f09f6f7d235ca2eaec, equal to LOGO_SHA256), and an independent dag-pb/unixfs encoding of those bytes gives exactly QmWJsrdD9smahpdyqjBzDBodJkJJGNznMA2Wrh15R1hhCp. But the CID is not provided by any node on the public network, so the on-chain and metadata logo links are dead until someone pins the committed file. The README and the manifest notes disclose this limitation (no pinning credentials in the build task), which the brief's requirement 8 permits, so this is not a code defect and no source change is needed. It is kept so the publication step pins the exact committed bytes before the token ships; re-encoding or resizing before pinning would leave the constant pointing at content that never exists. Not blocking for deployment: the constructor takes no arguments, creation code is 5,367 bytes and runtime 3,996 bytes, well within the factory's CREATE2 limits.","line":24,"path":"src/BloxToken.sol","reproduction":"State: the committed source on 2026-10-13. (1) Deploy BloxToken and call logoURI() or LOGO_URI(): returns ipfs://QmWJsrdD9smahpdyqjBzDBodJkJJGNznMA2Wrh15R1hhCp. (2) GET https://cid.contact/cid/QmWJsrdD9smahpdyqjBzDBodJkJJGNznMA2Wrh15R1hhCp -> HTTP 404, no provider records. (3) GET https://gateway.pinata.cloud/ipfs/<cid> -> 0 bytes in 45 s (curl exit 28); GET https://4everland.io/ipfs/<cid> (follows to the CIDv1 subdomain) -> HTTP 504; ipfs.io / dweb.link / w3s.link answered 429 (rate limited, inconclusive). Expected: a gateway returns 56,060 bytes with sha256 c2aeb53e69e10a7a4654a97ce8b26bd0a99a843d024ad6f09f6f7d235ca2eaec. Actual: nothing retrievable. Fix (operational, no code change): `ipfs add --cid-version 0 assets/logo/blox.jpg` or any pinning service on the unchanged file; it must print the same CID, and the gateway fetch then returns the file with that hash.","severity":"low","snippet":"    string public constant LOGO_URI = \"ipfs://QmWJsrdD9smahpdyqjBzDBodJkJJGNznMA2Wrh15R1hhCp\";","title":"On-chain LOGO_URI points at an IPFS CID that no node provides yet; logoURI() resolves to nothing until assets/logo/blox.jpg is pinned unchanged"},{"citation":"resolved","description":"Merged from audit_economics (reproduced). BloxToken inherits OpenZeppelin v5.4.0 ERC20Permit unmodified; I compared every vendored file under lib/openzeppelin-contracts byte for byte with upstream commit c64a1edb and all match. permit() consumes the owner's nonce and sets the allowance whoever submits the signature. A third party who sees the signature first can submit it; the allowance still lands on the intended spender and no value is lost, but a contract that calls permit() then transferFrom() in one transaction reverts on the consumed nonce. This is the documented behaviour of every EIP-2612 token, not a defect in this token or its launch flows; recorded for integrators (routers, claim helpers), who should wrap permit in try/catch or check allowance first. No change proposed.","line":18,"path":"src/BloxToken.sol","reproduction":"Foundry, chain id 31337, token deployed by 0xFAC7. owner = vm.addr(0xA11CE), spender = 0xB0B, value 5, nonce 0, deadline = block.timestamp + 1h; sign the EIP-712 Permit digest with token.DOMAIN_SEPARATOR(). (1) vm.prank(0xBAD); token.permit(owner, spender, 5, deadline, v, r, s) -> succeeds; allowance(owner, spender) == 5, nonces(owner) == 1. (2) vm.prank(spender); token.permit(owner, spender, 5, deadline, v, r, s) -> reverts (ERC2612InvalidSigner, the digest now uses nonce 1). (3) spender.transferFrom(owner, 0xCAFE, 5) still succeeds using the allowance from step 1. Expected by a bundling integrator: step 2 succeeds; actual: it reverts. Verified in a scratch test test_permitFrontRunGriefsBundledCaller that passes on this code.","severity":"info","snippet":"contract BloxToken is ERC20, ERC20Permit {","title":"permit() can be submitted by anyone holding the signature, so a caller that bundles permit with transferFrom in one transaction reverts if front-run (inherent to EIP-2612)"}],"hash":"7d410b2bfd6db41e243fd7dfcf23929229e64962c4ffab54b23a62bf22271db9","nodeId":"592080e4-d684-4e61-a74a-90190f11e187","outcome":"completed","summary":"The review is complete. The findings file is written at `.imd-findings.json`, no source files were changed, and the scratch test was removed.\n\n**Outcome: no code defects.** The token is OpenZeppelin v5.4.0 ERC20 plus ERC20Permit with a single constructor mint, and the four entry points all hold.\n\nWhat I verified:\n- **Build and tests.** The project compiles under solc 0.8.26 and all 69 existing tests pass, including the invariant suite. Formatting check passes.\n- **Vendored library.** Every file under `lib/openzeppelin-contracts` is byte-identical to upstream v5.4.0 at commit c64a1edb.\n- **Supply and deployability.** The constructor takes no arguments, matching the manifest's empty list, and mints exactly the manifest supply to the sender once. Runtime bytecode has no DELEGATECALL, CALLCODE or SELFDESTRUCT, and both creation and runtime sizes are far under the factory's limits.\n- **Logo.** The committed JPEG is byte-identical to the original profile image X serves for @blox_imd today, and I recomputed its CIDv0 independently and got the on-chain value.\n- **Manifest.** Only schema keys, correct types, lowercase addresses, contract name within 32 characters, notes within 4,000 characters, and pool and economics equal to the launch's values.\n\nFindings kept, both reproduced from the economics specialist and merged with nothing else since the other three areas reported none:\n1. **Low:** the on-chain logo URI points at a CID no IPFS node provides yet. The IPNI index returns no provider and gateways time out or return 504. This is operational, not a code defect, and is disclosed in the README and manifest notes. The fix is to pin the committed file unchanged before publication.\n2. **Info:** permit can be front-run by anyone holding the signature, which reverts a caller that bundles permit and transferFrom. I reproduced it in a scratch Foundry test. It is inherent to EIP-2612 and no change is proposed.\n\nCoverage records all four entry points, plus the constructor and supply invariant and the manifest, with one finding reference on permit.","treeHash":null,"usage":{"cachedInputTokens":448900,"inputTokens":226,"model":"claude-fable-5-1","outputTokens":12570,"runtime":"claude","turns":22,"wallClockMs":247597}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"8db4eebdd7bd2744","findings":[{"citation":"resolved","description":"The token bakes the logo's IPFS URI into an immutable constant and exposes it through logoURI(), and assets/token-metadata.json repeats the same URI as logoURI. The CID itself is correct: I recomputed it from assets/logo/blox.jpg with an independent dag-pb/unixfs encoding and got QmWJsrdD9smahpdyqjBzDBodJkJJGNznMA2Wrh15R1hhCp, and the file is byte-identical (sha256 c2aeb53e...eaec, 56,060 bytes) to the original upload X serves for the current @blox_imd profile image (profile_images/2108499797414236160/QJxnGSNM.jpg, the id the live x.com/blox_imd page references today). But nothing has pinned the file, so the content-addressed link is dead on the public network: the IPNI index (cid.contact) reports no provider for the CID, and gateways that fetch from the network (gateway.pinata.cloud, 4everland.io) time out rather than return the image. The README discloses this as a limitation (no pinning credentials in the build task). This is reported so the launch's publication step does not ship a token whose on-chain and metadata logo URIs return nothing: the brief's requirement 6 is satisfied only once the exact committed bytes are added to IPFS. No code change is needed; the fix is operational (pin assets/logo/blox.jpg unchanged with CIDv0 defaults and confirm the reported CID is the same string). If the file were ever re-encoded before pinning, the constant would permanently point at the wrong content, so the pin must use the committed bytes.","line":24,"path":"src/BloxToken.sol","reproduction":"State: the contract as deployed (or the committed source), on 2026-10-13. Steps: (1) call logoURI() or LOGO_URI(): returns ipfs://QmWJsrdD9smahpdyqjBzDBodJkJJGNznMA2Wrh15R1hhCp. (2) GET https://cid.contact/cid/QmWJsrdD9smahpdyqjBzDBodJkJJGNznMA2Wrh15R1hhCp -> HTTP 404 (no provider records). (3) GET https://gateway.pinata.cloud/ipfs/QmWJsrdD9smahpdyqjBzDBodJkJJGNznMA2Wrh15R1hhCp -> no bytes within 45 s (curl exit 28); GET https://4everland.io/ipfs/<cid> -> HTTP 504 'error code: 504'. Expected: the gateway returns 56,060 bytes with sha256 c2aeb53e69e10a7a4654a97ce8b26bd0a99a843d024ad6f09f6f7d235ca2eaec. Actual: nothing is retrievable. Verified fix: `ipfs add --cid-version 0 assets/logo/blox.jpg` (or any pinning service) must print the same CID; after pinning, the gateway fetch returns the file with that hash.","severity":"low","snippet":"    string public constant LOGO_URI = \"ipfs://QmWJsrdD9smahpdyqjBzDBodJkJJGNznMA2Wrh15R1hhCp\";","title":"On-chain LOGO_URI points at an IPFS CID that no node currently provides, so logoURI() resolves to nothing until the committed file is pinned"},{"citation":"resolved","description":"BloxToken inherits OpenZeppelin v5.4.0 ERC20Permit unmodified (vendored files compared byte-for-byte against upstream commit c64a1edb). permit() consumes the owner's nonce and sets the allowance regardless of who submits the signature. A third party who sees the signature in the mempool can submit it first; the allowance is still set correctly for the intended spender (no value is lost), but a contract that calls permit() and then transferFrom() in one transaction reverts on the now-consumed nonce. This is the documented behaviour of every EIP-2612 token and not a defect in the token's economics or launch flows; it is recorded so integrators of BLOX (routers, claim helpers) wrap permit in try/catch or check allowance first. No change to the token is proposed.","line":18,"path":"src/BloxToken.sol","reproduction":"Owner = vm.addr(0xA11CE), spender = 0xB0B, value 5, nonce 0, deadline = now + 1h; sign the EIP-712 Permit digest with DOMAIN_SEPARATOR(). (1) vm.prank(0xBAD); token.permit(owner, spender, 5, deadline, v, r, s) -> succeeds, allowance(owner, spender) == 5, nonces(owner) == 1. (2) vm.prank(spender); token.permit(owner, spender, 5, deadline, v, r, s) -> reverts with ERC2612InvalidSigner (the recovered signer for nonce 1 differs from owner). Expected by a bundling integrator: step 2 succeeds; actual: it reverts, though the allowance from step 1 is usable. Verified in a scratch Foundry test (test_permitFrontRunGriefsBundledCaller) that passes on this code.","severity":"info","snippet":"contract BloxToken is ERC20, ERC20Permit {","title":"permit() can be front-run by anyone holding the signature, reverting a caller that bundles permit with transferFrom (inherent to EIP-2612, integrator concern)"}],"hash":"83ec27a32eea891b5a648716f4d02176c44353e44ac8f175d95f06a431099042","nodeId":"4548906d-68d6-4440-b79b-bcff8d10c09f","outcome":"completed","summary":"Review complete. The findings file is written and validated, the scratch test is removed, and the working tree is clean apart from the gitignored findings file.\n\n**Outcome:** no economic, invariant or flow-gap defect in `src/BloxToken.sol`. The token is OpenZeppelin v5.4.0 ERC20 plus ERC20Permit with one constructor mint and nothing else.\n\nWhat I verified:\n- **Supply and conservation.** A 256-run Foundry invariant with 128,000 random transfer, approve/transferFrom and permit/transferFrom calls kept totalSupply at exactly 1e27 and balances summing to it. The ABI exposes no mint, burn, pause, blacklist or owner path.\n- **Launch flows.** Every transfer path is the unmodified OpenZeppelin `_update`, so the swarm share, the pool seed and claims cannot arrive short. The floor's checks (supply to the factory, decimals 18, no DELEGATECALL, CALLCODE or SELFDESTRUCT) pass locally.\n- **Vendored code.** All 23 OpenZeppelin files are byte-identical to upstream v5.4.0 at the commit the VENDORED note names.\n- **Logo.** The committed file is byte-identical to the original upload X serves for the current profile image of @blox_imd, and the CID recomputes correctly from those bytes.\n\nFindings written to `.imd-findings.json`:\n1. **Low.** The on-chain logo URI points at a CID that no IPFS node currently provides. The IPNI index returns 404 and network-fetching gateways time out. The fix is operational: pin the committed file unchanged and confirm the same CID. The builder's README already discloses this.\n2. **Info.** Permit can be front-run by a third party holding the signature, which reverts a caller that bundles permit with transferFrom. This is inherent to EIP-2612 and is for integrators, not a token change.\n\nCoverage records all four entry points as holding, plus five invariant rows covering supply, constructor behaviour, vendored integrity, logo provenance and launch-flow exactness.","treeHash":null,"usage":{"cachedInputTokens":753824,"inputTokens":290,"model":"claude-fable-5-1","outputTokens":21544,"runtime":"claude","turns":27,"wallClockMs":392280}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"b38bea3c04869138","findings":[],"hash":"8949ceb171e2981516cd41651758dea370e619eb0ee13260d6db9d9da26355f8","nodeId":"a588f9a6-3d85-42e7-b545-0bc6b2687a30","outcome":"completed","summary":"Review complete. The findings file is written and the tracked tree is unchanged.\n\n**Result: no defects in the Access Control, Trust Gap or Asymmetry areas.** The findings list is empty, with ten coverage rows recorded in `.imd-findings.json`.\n\nWhat I verified:\n\n- **Permission model.** The only code outside OpenZeppelin is a constructor that mints the fixed supply to `msg.sender`. The compiled ABI exposes exactly the four listed state-changing entry points. The storage layout has no owner, admin, pauser or blacklist slot, and plain ETH, unknown selectors, `burn`, `owner()` and `renounceOwnership()` all revert.\n- **Library integrity.** All 23 vendored OpenZeppelin files are byte-identical to upstream v5.4.0 at the stated commit. Four core forge-std files match their stated commit too. No hidden privileged path was injected.\n- **Asymmetry.** The approve, permit and transferFrom paths all write allowance through the same internal function and emit Approval. Infinite allowance is not decremented, which is documented OpenZeppelin behaviour. Self-transfers conserve balance.\n- **Permit.** Tampered parameters, malleable high-s signatures, contract wallets and replay all revert. A third-party relayer can only set the allowance the owner signed. The domain separator binds chain id and contract address.\n- **Logo requirement.** The live X profile image downloaded today hashes to exactly the committed file and the on-chain SHA-256 constant. The IPFS CIDv0 recomputed from those bytes matches the on-chain URI. The file is not yet pinned, which the README already reports as a limitation.\n\nOne trust assumption is recorded rather than reported: anyone can front-run a permit, which makes an integrator's batched call revert without moving any value. That is inherent to ERC-2612.\n\nTools run: forge build, forge test (22 existing tests pass), a scratch suite of 9 additional tests that passed and has been removed, and network fetches for the library diff and image hash. Slither and aderyn output was tool-provided only. The single aderyn lead is the intended supply constant.","treeHash":null,"usage":{"cachedInputTokens":811823,"inputTokens":322,"model":"claude-fable-5-1","outputTokens":14655,"runtime":"claude","turns":28,"wallClockMs":249584}},{"artifacts":[],"attempt":1,"bundleHash":"947599f9af87556ceaac45930fffddacca21d4f22aded6e031c4b37d31608d0d","device":"9e17b97b8ac7c97a","findings":[],"hash":"cf30794977e00e76f4627ff40d71b9365d33905a39c02071695df8fb21db77e8","nodeId":"fd8e882c-0354-4934-9835-10b219f079e8","outcome":"completed","summary":"Done. I wrote launch.json for the accepted Blox (BLOX) launch and changed nothing else.\n\n**What the manifest says**\n- kind \"custom_token\", token contract BloxToken, name Blox, symbol BLOX, 18 decimals.\n- Constructor arguments are an empty list. The accepted constructor in src/BloxToken.sol takes none and mints the whole supply once to msg.sender.\n- totalSupply is 1000000000000000000000000000, matching the TOTAL_SUPPLY constant.\n- No application contracts. The accepted tree contains only the token.\n- Pool and economics copied verbatim from the launch terms: native ETH pair, fee 12500, tick spacing 60, the one-to-one initialPrice, poolBps 8800, 10 ETH opening cap, remainder to 0xf2816f3f05fac35577b1930ffd09b531b62628df.\n- Notes describe the token's fixed supply, lack of privileged roles and fees, the unused launch placeholders, and the logo provenance. They record that the logo is the unmodified @blox_imd profile picture committed at assets/logo/blox.jpg, with its IPFS URI and SHA-256 held on chain, and that it is content-addressed but not yet pinned.\n\n**Checks**\n- A schema check confirmed only the allowed top-level keys, string uint256 values, numeric fee, tickSpacing and decimals, and notes under 4000 characters.\n- `forge build` compiled cleanly and `forge test` passed all 22 tests.\n- Git status shows launch.json as the only new file.","treeHash":"ab8ca08326b8deb1dc75a3bbb602d3994b5d50fd","usage":{"cachedInputTokens":174329,"inputTokens":130,"model":"claude-fable-5-1","outputTokens":3072,"runtime":"claude","turns":8,"wallClockMs":39492}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"ef5038c1bdac3372","findings":[],"hash":"ef2608b8eb77213dffa4348d1eb17590a17e0d0cba07273d02ed480bf0dbb518","nodeId":"48b0a153-2442-4160-bb77-630cd2bfb11a","outcome":"completed","summary":"The review is complete and the findings file is written. No defects were found.\n\n**Result:** `.imd-findings.json` holds an empty findings list and nine coverage rows, one for each of the four listed entry points plus five invariants. The working tree is otherwise unchanged. The build, the existing 22 tests and `forge fmt --check` all pass.\n\n**What was checked in the assigned area**\n\n- **Execution Trace.** Traced `transfer`, `transferFrom`, `approve` and `permit` through OpenZeppelin v5.4.0 from entry to storage write. Each moves or sets exactly what its arguments say, reverts on the zero-address and insufficient-balance or allowance paths, and `permit` rejects replay, wrong signer, expiry, high-s and a zero owner without consuming a nonce. A scratch invariant run of 128,000 randomized calls across all four kept the sum of balances equal to total supply with zero reverts.\n- **Periphery.** All 23 vendored OpenZeppelin files are byte-identical to the upstream v5.4.0 tag, and all 32 forge-std files are byte-identical to the pinned commit. Nothing in the library layer was altered.\n- **First Principles.** The constructor mints the manifest supply once to the deployer with no other mint path. The ABI exposes no owner, pause, blacklist, burn-from or upgrade function, and the runtime bytecode contains no DELEGATECALL, CALLCODE or SELFDESTRUCT.\n\n**Logo requirement, verified against the live source.** The committed file hashes to the same SHA-256 as the image served today from X's image host for the stated profile-image id, the on-chain `LOGO_SHA256` constant matches it, and both the CIDv0 and CIDv1 recompute from those bytes. A public avatar mirror for @blox_imd returns the 400x400 variant of the same image, which ties the file to the account. The logo is the unmodified profile picture.\n\n**Static-analysis leads.** Slither reported nothing. Aderyn's large-literal note on line 20 is the intended supply value and is confirmed by the existing tests.\n\n**Not reached.** The protected test's pool seed and swap legs need Uniswap v4 code that is not in this tree, so they could not be executed here. Because the token applies no fee, burn or hook on any transfer, those legs reduce to plain transfers that the fuzz run already covers.","treeHash":null,"usage":{"cachedInputTokens":758044,"inputTokens":386,"model":"claude-fable-5-1","outputTokens":14867,"runtime":"claude","turns":22,"wallClockMs":221051}}],"verification":[{"checks":[{"durationMs":3865,"exitCode":0,"name":"build","output":"Compiling 44 files with Solc 0.8.26\nSolc 0.8.26 finished in 3.63s\nCompiler run successful!\n","passed":true},{"durationMs":26038,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 27 tests for test/BloxTokenBehavior.t.sol:BloxTokenBehaviorTest\n[PASS] testFuzz_approvalReplacementDoesNotAddOrMoveTokens(uint256,uint256) (runs: 1000, μ: 179074, ~: 179195)\n[PASS] testFuzz_failedTransferFromRestoresSpentAllowance(uint256,uint256) (runs: 1000, μ: 186204, ~: 186454)\n[PASS] testFuzz_insufficientAllowanceCannotMoveFundedBalance(uint256,uint256) (runs: 1000, μ: 116001, ~: 116426)\n[PASS] testFuzz_overdrawRevertsAtomically(uint256,uint256) (runs: 1000, μ: 120124, ~: 120286)\n[PASS] testFuzz_selfTransferPreservesBalances(uint256,uint256) (runs: 1000, μ: 108927, ~: 109246)\n[PASS] testFuzz_splitTransfersEqualOneTransfer(uint256,uint256) (runs: 1000, μ: 190867, ~: 192013)\n[PASS] testFuzz_transferRoundTripRestoresBothBalances(uint256) (runs: 1000, μ: 128851, ~: 128637)\n[PASS] test_allowanceBelongsToExactOwnerAndSpender() (gas: 201826)\n[PASS] test_approvalCanBeMaxUintWithoutOwningTokens() (gas: 94913)\n[PASS] test_approvalReplacesExistingValueAndRevocationTakesEffect() (gas: 249081)\n[PASS] test_constructorEmitsExactlyOneMintAndNoOtherLogs() (gas: 15251)\n[PASS] test_directTransfersDoNotConsumeApprovalOrPermitNonce() (gas: 136663)\n[PASS] test_ethAndUnknownCallsAreRejectedWithoutChangingSupply() (gas: 71289)\n[PASS] test_failedTransferFromToZeroRestoresFiniteAllowance() (gas: 113312)\n[PASS] test_finiteAllowanceIsExhaustedAcrossMultipleTransfers() (gas: 249883)\n[PASS] test_infiniteAllowanceSurvivesRepeatedSpending() (gas: 218045)\n[PASS] test_maxMinusOneAllowanceIsFinite() (gas: 131065)\n[PASS] test_selfTransferEntireSupplyDoesNotMintOrBurn() (gas: 42945)\n[PASS] test_selfTransferFromConsumesFiniteAllowanceButPreservesBalance() (gas: 114670)\n[PASS] test_selfTransferStillRequiresEnoughBalance() (gas: 47484)\n[PASS] test_transferFromRequiresAllowanceEvenWhenCallerIsTheOwner() (gas: 150393)\n[PASS] test_transferFromZeroSenderWithZeroAmountCannotMint() (gas: 49535)\n[PASS] test_transferMaxUintRevertsWithBalancesIntact() (gas: 56959)\n[PASS] test_transferOneWeiAndThenTheEntireRemainingSupply() (gas: 198575)\n[PASS] test_transferZeroFromEmptyAccountEmitsTransfer() (gas: 72211)\n[PASS] test_zeroTransferFromWithoutAllowanceSucceedsAndEmitsTransfer() (gas: 80086)\n[PASS] test_zeroValueTransferToZeroStillReverts() (gas: 41857)\nSuite result: ok. 27 passed; 0 failed; 0 skipped; finished in 187.25ms (1.27s CPU time)\n\nRan 22 tests for test/BloxToken.t.sol:BloxTokenTest\n[PASS] testFuzz_transferConservesSupplyExactly(address,uint256) (runs: 256, μ: 86532, ~: 86848)\n[PASS] testFuzz_transferFromConservesSupplyExactly(uint256) (runs: 256, μ: 131123, ~: 131061)\n[PASS] test_approveZeroSpenderReverts() (gas: 30329)\n[PASS] test_constructorEmitsASingleMintTransfer() (gas: 5475)\n[PASS] test_deployerIsMsgSenderNotTxOrigin() (gas: 12204)\n[PASS] test_factoryCanPayOutTheWholeSupply() (gas: 196591)\n[PASS] test_logoIsTheXProfilePictureByContentHash() (gas: 38756)\n[PASS] test_metadata() (gas: 29085)\n[PASS] test_noCommonAdminCallIncreasesSupply() (gas: 657484)\n[PASS] test_noPrivilegedHandMovesOrFreezesAHolder() (gas: 444961)\n[PASS] test_permitAfterDeadlineReverts() (gas: 43240)\n[PASS] test_permitCannotBeReplayed() (gas: 127583)\n[PASS] test_permitSetsAllowanceAndBumpsNonce() (gas: 106463)\n[PASS] test_permitWithWrongSignerReverts() (gas: 73751)\n[PASS] test_runtimeCodeHasNoDelegatecallCallcodeOrSelfdestruct() (gas: 1688548)\n[PASS] test_supplyIsOneBillionWithEighteenDecimals() (gas: 12910)\n[PASS] test_swarmShareArrivesWholeAndIsClaimableWhole() (gas: 138731)\n[PASS] test_transferFromBeyondAllowanceReverts() (gas: 82935)\n[PASS] test_transferFromWithoutAllowanceReverts() (gas: 35841)\n[PASS] test_transferMoreThanBalanceReverts() (gas: 91079)\n[PASS] test_transferToZeroAddressReverts() (gas: 32803)\n[PASS] test_wholeSupplyIsMintedOnceToTheDeployer() (gas: 25487)\nSuite result: ok. 22 passed; 0 failed; 0 skipped; finished in 212.76ms (448.87ms CPU time)\n\nRan 18 tests for test/BloxTokenPermit.t.sol:BloxTokenPermitTest\n[PASS] testFuzz_changingAnySignedFieldIsRejected(uint8,uint256) (runs: 1000, μ: 169172, ~: 169520)\n[PASS] testFuzz_futureNonceIsRejectedAndCurrentNonceRemainsUsable(uint256) (runs: 1000, μ: 235496, ~: 235498)\n[PASS] testFuzz_validPermitSetsExactAllowanceThenSpends(uint256,uint256,uint256) (runs: 1000, μ: 225460, ~: 226547)\n[PASS] test_chainIdChangeRejectsOldSignatureAndAcceptsNewDomain() (gas: 271151)\n[PASS] test_domainMatchesIndependentEIP712Encoding() (gas: 24330)\n[PASS] test_expiredPermitPreservesExistingAllowanceAndNonce() (gas: 118827)\n[PASS] test_invalidVIsRejectedWithoutConsumingNonce() (gas: 144944)\n[PASS] test_malleableHighSSignatureIsRejectedWithoutConsumingNonce() (gas: 227409)\n[PASS] test_permitAtExactDeadlineIsAcceptedAndRelayerGainsNoAuthority() (gas: 252945)\n[PASS] test_permitMaxAllowanceAndDeadlineSupportFullSupplySpending() (gas: 168449)\n[PASS] test_permitNonceIsScopedToEachOwner() (gas: 212911)\n[PASS] test_permitWithZeroSpenderRollsBackNonceAndAllowsRetry() (gas: 243118)\n[PASS] test_replayCannotRestoreAnAlreadySpentAllowance() (gas: 208804)\n[PASS] test_sequentialPermitsReplaceAllowanceAndUseSuccessiveNonces() (gas: 184266)\n[PASS] test_signatureForAnotherDeploymentIsRejected() (gas: 157919)\n[PASS] test_spendingAndDirectApprovalDoNotInvalidateNextSignedNonce() (gas: 225899)\n[PASS] test_zeroOwnerCannotUseAnUnrecoverableSignature() (gas: 156784)\n[PASS] test_zeroValuePermitRevokesAllowance() (gas: 127986)\nSuite result: ok. 18 passed; 0 failed; 0 skipped; finished in 236.03ms (691.51ms CPU time)\n\nRan 2 tests for test/BloxTokenInvariant.t.sol:BloxTokenInvariantTest\n[PASS]\nBloxTokenInvariantTest invariants:\n[PASS] invariant_allowancesMatchApprovalsPermitsAndSuccessfulSpending\n[PASS] invariant_eachBalanceMatchesAuthorizedNetTransfers\n[PASS] invariant_noncesCountOnlySuccessfulPermitsForThatOwner\n[PASS] invariant_supplyEqualsSumOfAllTrackedBalances\n BloxTokenInvariantTest invariants (runs: 256, calls: 32768, reverts: 0)\n\n╭------------------+--------------------------+-------+---------+----------╮\n| Contract         | Selector                 | Calls | Reverts | Discards |\n+==========================================================================+\n| BloxTokenHandler | advanceTime              | 2226  | 0       | 0        |\n|------------------+--------------------------+-------+---------+----------|\n| BloxTokenHandler | approve                  | 2268  | 0       | 0        |\n|------------------+--------------------------+-------+---------+----------|\n| BloxTokenHandler | approveInfinite          | 2191  | 0       | 0        |\n|------------------+--------------------------+-------+---------+----------|\n| BloxTokenHandler | attemptAdmin             | 2106  | 0       | 0        |\n|------------------+--------------------------+-------+---------+----------|\n| BloxTokenHandler | expiredPermit            | 2111  | 0       | 0        |\n|------------------+--------------------------+-------+---------+----------|\n| BloxTokenHandler | overdraw                 | 2134  | 0       | 0        |\n|------------------+--------------------------+-------+---------+----------|\n| BloxTokenHandler | overdrawWithApproval     | 2236  | 0       | 0        |\n|------------------+--------------------------+-------+---------+----------|\n| BloxTokenHandler | permit                   | 2203  | 0       | 0        |\n|------------------+--------------------------+-------+---------+----------|\n| BloxTokenHandler | replayPermit             | 2118  | 0       | 0        |\n|------------------+--------------------------+-------+---------+----------|\n| BloxTokenHandler | revoke                   | 2232  | 0       | 0        |\n|------------------+--------------------------+-------+---------+----------|\n| BloxTokenHandler | transfer                 | 2237  | 0       | 0        |\n|------------------+--------------------------+-------+---------+----------|\n| BloxTokenHandler | transferEntireBalance    | 2103  | 0       | 0        |\n|------------------+--------------------------+-------+---------+----------|\n| BloxTokenHandler | transferFrom             | 2185  | 0       | 0        |\n|------------------+--------------------------+-------+---------+----------|\n| BloxTokenHandler | transferToZero           | 2221  | 0       | 0        |\n|------------------+--------------------------+-------+---------+----------|\n| BloxTokenHandler | unauthorizedTransferFrom | 2197  | 0       | 0        |\n╰------------------+--------------------------+-------+---------+----------╯\n\n[PASS] test_handlerExercisesMeaningfulSequences() (gas: 2862804)\nSuite result: ok. 2 passed; 0 failed; 0 skipped; finished in 25.88s (25.87s CPU time)\n\nRan 4 test suites in 25.88s (26.51s CPU time): 69 tests passed, 0 failed, 0 skipped (69 total tests)\n","passed":true},{"durationMs":89,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"BloxToken.approve(address,uint256)\",\"BloxToken.permit(address,address,uint256,uint256,uint8,bytes32,bytes32)\",\"BloxToken.transfer(address,uint256)\",\"BloxToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":6,\"README.md\":152,\"assets/logo/blox.jpg\":170,\"assets/token-metadata.json\":26,\"foundry.toml\":20,\"remappings.txt\":2,\"src/BloxToken.sol\":40,\"test/BloxToken.t.sol\":307,\"test/BloxTokenBehavior.t.sol\":353,\"test/BloxTokenInvariant.t.sol\":347,\"test/BloxTokenPermit.t.sol\":312,\"test/README.md\":52,\"test/helpers/BloxPermitDigest.sol\":39,\"test/verify_logo.py\":85},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"51d48648aefb4a80ce4f596e557ac2c648d100a7800b5504e73a04509ec36905","verifiedTreeHash":"0feb561bad897b2dc86dcff29a8712e27733a877","verifierVersion":"0.1.0+327e1e9f"},{"checks":[{"durationMs":901,"exitCode":0,"name":"build","output":"Compiling 40 files with Solc 0.8.26\nSolc 0.8.26 finished in 789.47ms\nCompiler run successful!\n","passed":true},{"durationMs":77,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 22 tests for test/BloxToken.t.sol:BloxTokenTest\n[PASS] testFuzz_transferConservesSupplyExactly(address,uint256) (runs: 256, μ: 86566, ~: 86788)\n[PASS] testFuzz_transferFromConservesSupplyExactly(uint256) (runs: 256, μ: 130615, ~: 131073)\n[PASS] test_approveZeroSpenderReverts() (gas: 30329)\n[PASS] test_constructorEmitsASingleMintTransfer() (gas: 5475)\n[PASS] test_deployerIsMsgSenderNotTxOrigin() (gas: 12204)\n[PASS] test_factoryCanPayOutTheWholeSupply() (gas: 196591)\n[PASS] test_logoIsTheXProfilePictureByContentHash() (gas: 38756)\n[PASS] test_metadata() (gas: 29085)\n[PASS] test_noCommonAdminCallIncreasesSupply() (gas: 657484)\n[PASS] test_noPrivilegedHandMovesOrFreezesAHolder() (gas: 444961)\n[PASS] test_permitAfterDeadlineReverts() (gas: 43240)\n[PASS] test_permitCannotBeReplayed() (gas: 127583)\n[PASS] test_permitSetsAllowanceAndBumpsNonce() (gas: 106463)\n[PASS] test_permitWithWrongSignerReverts() (gas: 73751)\n[PASS] test_runtimeCodeHasNoDelegatecallCallcodeOrSelfdestruct() (gas: 1688548)\n[PASS] test_supplyIsOneBillionWithEighteenDecimals() (gas: 12910)\n[PASS] test_swarmShareArrivesWholeAndIsClaimableWhole() (gas: 138731)\n[PASS] test_transferFromBeyondAllowanceReverts() (gas: 82935)\n[PASS] test_transferFromWithoutAllowanceReverts() (gas: 35841)\n[PASS] test_transferMoreThanBalanceReverts() (gas: 91079)\n[PASS] test_transferToZeroAddressReverts() (gas: 32803)\n[PASS] test_wholeSupplyIsMintedOnceToTheDeployer() (gas: 25487)\nSuite result: ok. 22 passed; 0 failed; 0 skipped; finished in 5.26ms (17.38ms CPU time)\n\nRan 1 test suite in 5.88ms (5.26ms CPU time): 22 tests passed, 0 failed, 0 skipped (22 total tests)\n","passed":true},{"durationMs":29,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"BloxToken.approve(address,uint256)\",\"BloxToken.permit(address,address,uint256,uint256,uint8,bytes32,bytes32)\",\"BloxToken.transfer(address,uint256)\",\"BloxToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":6,\"README.md\":152,\"assets/logo/blox.jpg\":170,\"assets/token-metadata.json\":26,\"foundry.toml\":20,\"remappings.txt\":2,\"src/BloxToken.sol\":40,\"test/BloxToken.t.sol\":307},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true},{"durationMs":1270,"exitCode":0,"name":"slither","output":"slither: no results at low impact or above","passed":true},{"durationMs":480,"exitCode":0,"name":"aderyn","output":"[low] large-numeric-literal at src/BloxToken.sol:20: Large Numeric Literal","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"75abf01be95b3ad670502a53eda7aa7ba30fee94f746dc482dc854538ae10af6","verifiedTreeHash":"bc39555fb51ebfb5f6946c70888811115c3a5690","verifierVersion":"0.1.0+327e1e9f"},{"checks":[{"durationMs":1204,"exitCode":0,"name":"build","output":"Compiling 40 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.02s\nCompiler run successful!\n","passed":true},{"durationMs":178,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 22 tests for test/BloxToken.t.sol:BloxTokenTest\n[PASS] testFuzz_transferConservesSupplyExactly(address,uint256) (runs: 256, μ: 86411, ~: 86776)\n[PASS] testFuzz_transferFromConservesSupplyExactly(uint256) (runs: 256, μ: 131121, ~: 131073)\n[PASS] test_approveZeroSpenderReverts() (gas: 30329)\n[PASS] test_constructorEmitsASingleMintTransfer() (gas: 5475)\n[PASS] test_deployerIsMsgSenderNotTxOrigin() (gas: 12204)\n[PASS] test_factoryCanPayOutTheWholeSupply() (gas: 196591)\n[PASS] test_logoIsTheXProfilePictureByContentHash() (gas: 38756)\n[PASS] test_metadata() (gas: 29085)\n[PASS] test_noCommonAdminCallIncreasesSupply() (gas: 657484)\n[PASS] test_noPrivilegedHandMovesOrFreezesAHolder() (gas: 444961)\n[PASS] test_permitAfterDeadlineReverts() (gas: 43240)\n[PASS] test_permitCannotBeReplayed() (gas: 127583)\n[PASS] test_permitSetsAllowanceAndBumpsNonce() (gas: 106463)\n[PASS] test_permitWithWrongSignerReverts() (gas: 73751)\n[PASS] test_runtimeCodeHasNoDelegatecallCallcodeOrSelfdestruct() (gas: 1688548)\n[PASS] test_supplyIsOneBillionWithEighteenDecimals() (gas: 12910)\n[PASS] test_swarmShareArrivesWholeAndIsClaimableWhole() (gas: 138731)\n[PASS] test_transferFromBeyondAllowanceReverts() (gas: 82935)\n[PASS] test_transferFromWithoutAllowanceReverts() (gas: 35841)\n[PASS] test_transferMoreThanBalanceReverts() (gas: 91079)\n[PASS] test_transferToZeroAddressReverts() (gas: 32803)\n[PASS] test_wholeSupplyIsMintedOnceToTheDeployer() (gas: 25487)\nSuite result: ok. 22 passed; 0 failed; 0 skipped; finished in 11.92ms (30.84ms CPU time)\n\nRan 1 test suite in 12.80ms (11.92ms CPU time): 22 tests passed, 0 failed, 0 skipped (22 total tests)\n","passed":true},{"durationMs":55,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"BloxToken.approve(address,uint256)\",\"BloxToken.permit(address,address,uint256,uint256,uint8,bytes32,bytes32)\",\"BloxToken.transfer(address,uint256)\",\"BloxToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":6,\"README.md\":152,\"assets/logo/blox.jpg\":170,\"assets/token-metadata.json\":26,\"foundry.toml\":20,\"launch.json\":24,\"remappings.txt\":2,\"src/BloxToken.sol\":40,\"test/BloxToken.t.sol\":307},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"cf30794977e00e76f4627ff40d71b9365d33905a39c02071695df8fb21db77e8","verifiedTreeHash":"ab8ca08326b8deb1dc75a3bbb602d3994b5d50fd","verifierVersion":"0.1.0+327e1e9f"}]}