{"assessments":[],"deployments":[],"fuzz":[],"identity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"interpretation":"Records acceptance and evidence. Neither completion nor an AI assessment establishes correctness, safety, or independent review.","jobId":"325af891-d8fe-4ccd-a362-7210c74c0bfc","kind":"shape:chain","nodes":[{"acceptedSubmissionHash":"4f7c398375d7ed949256cf81f725ed1f8a8e9cf4f7a1b99bd2c897055fa43ff8","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"bc5bfc8455464381f2db18badb2b55cf8bec1e535c019349a0378fa990741171","skillId":"audit-specialist","subagents":3,"tools":[]},"key":"audit_economics","kind":"code","role":"review","skillHash":"bc5bfc8455464381f2db18badb2b55cf8bec1e535c019349a0378fa990741171","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"75a212dd6179450a30fde20704871e55643179c546d16ad06ff493ca61e3a18a","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"bc5bfc8455464381f2db18badb2b55cf8bec1e535c019349a0378fa990741171","skillId":"audit-specialist","subagents":3,"tools":[]},"key":"audit_flow","kind":"code","role":"review","skillHash":"bc5bfc8455464381f2db18badb2b55cf8bec1e535c019349a0378fa990741171","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"2d1118914c2d5f9e34f687d51b0df3377962708b2973dfbd29eb4e89f9cf3c86","dependsOn":["build_contract_project","write_foundry_tests","manifest","audit_math","audit_permissions","audit_economics","audit_flow"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"b89279670f5a00f5d26286edee00c97dd158b997031350a01cafe6e0329ad227","skillId":"audit-judge","subagents":4,"tools":[]},"key":"audit_judge","kind":"code","role":"review","skillHash":"b89279670f5a00f5d26286edee00c97dd158b997031350a01cafe6e0329ad227","skillId":"audit-judge","state":"accepted"},{"acceptedSubmissionHash":"d54a89da3a9a51ab1d857a032024f1dce0b75523fc190b8b5baa15e63ad2d69d","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"bc5bfc8455464381f2db18badb2b55cf8bec1e535c019349a0378fa990741171","skillId":"audit-specialist","subagents":3,"tools":[]},"key":"audit_math","kind":"code","role":"review","skillHash":"bc5bfc8455464381f2db18badb2b55cf8bec1e535c019349a0378fa990741171","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"4a1cf77e9b6f2f40f992748bec40f88ad983f4b3cada43f0f1967470ff619282","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"bc5bfc8455464381f2db18badb2b55cf8bec1e535c019349a0378fa990741171","skillId":"audit-specialist","subagents":3,"tools":[]},"key":"audit_permissions","kind":"code","role":"review","skillHash":"bc5bfc8455464381f2db18badb2b55cf8bec1e535c019349a0378fa990741171","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"cc926a135e86ba06ae7b3c52fddfc6e88888fd9824089d9857565e7d3860fe74","dependsOn":[],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"15b04fc8f60521936b9e2b37c09a804685ec689fc98cd5b04510d986d3106a15","skillId":"build-contract-project","tools":[]},"key":"build_contract_project","kind":"code","role":"implement","skillHash":"15b04fc8f60521936b9e2b37c09a804685ec689fc98cd5b04510d986d3106a15","skillId":"build-contract-project","state":"accepted"},{"acceptedSubmissionHash":"685938f404468ac7c6ddd2bc03f28df801219c6b4409bb0166684cbd7de2a221","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"tools":[]},"key":"manifest","kind":"code","role":"integrate","skillHash":null,"skillId":null,"state":"accepted"},{"acceptedSubmissionHash":"90bd3fe5826300b469d3458d7c08d9375a7e58be80dfe6954435dcf6a313acef","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"606842ccca0e7c5d3017a54684625438eab9b351eb51dcf0cf88c43d1ea41464","skillId":"write-foundry-tests","subagents":4,"tools":[]},"key":"write_foundry_tests","kind":"code","role":"tests","skillHash":"606842ccca0e7c5d3017a54684625438eab9b351eb51dcf0cf88c43d1ea41464","skillId":"write-foundry-tests","state":"accepted"}],"objective":"A custom token: PLEA (PLEA).\nToken name: PLEA\nToken symbol: PLEA\nToken supply: 1,000,000,000 with 18 decimals, all minted once to the deployer in the constructor.","parentJobId":null,"planHash":"0653397327dbbbda4ebee38ccb2f4abee228f630dae38e43dc5fe25847a04304","previousHash":"0000000000000000000000000000000000000000000000000000000000000000","projectId":"325af891-d8fe-4ccd-a362-7210c74c0bfc","publication":{"commit":null,"deliveredAt":null,"repoUrl":"https://github.com/identity-md-launches/launch-2740-plea"},"receiptIdentity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"registry":"0xb6d0a187b050fa5bb0b87033a203f37becf4a775","research":[],"schema":"identitymd-work-v1","signals":[{"agentId":"52686","feedbackHash":"01ac3276702b40d13d67791e8fd9b4b8c1c96cb35822a1b080fd5330976b3bb1","nodeKey":"audit_economics","submissionHash":"4f7c398375d7ed949256cf81f725ed1f8a8e9cf4f7a1b99bd2c897055fa43ff8","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51876","feedbackHash":"5d53ba619b261ae2bdcd3c58d3d877e481ed54eabadb7b9673ae6c281b670b0e","nodeKey":"audit_flow","submissionHash":"75a212dd6179450a30fde20704871e55643179c546d16ad06ff493ca61e3a18a","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51468","feedbackHash":"f7aba97400112c95a8fac04debf678e86803fdd1e26efe3a6cb1be621b1ae8db","nodeKey":"audit_judge","submissionHash":"2d1118914c2d5f9e34f687d51b0df3377962708b2973dfbd29eb4e89f9cf3c86","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52200","feedbackHash":"9f176188cfc5475b2521aa046caa86978362c3d789871e6b1122bfd4475f9623","nodeKey":"audit_math","submissionHash":"d54a89da3a9a51ab1d857a032024f1dce0b75523fc190b8b5baa15e63ad2d69d","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52287","feedbackHash":"2421f5fb09d5c83a4efbe987a8f884b81a63957eb49a3837fced96413b4d9662","nodeKey":"audit_permissions","submissionHash":"4a1cf77e9b6f2f40f992748bec40f88ad983f4b3cada43f0f1967470ff619282","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51454","feedbackHash":"8078dd21ea7782e3ff515ab9c51500ac144d40e033ce081a3aa3079399a77109","nodeKey":"build_contract_project","submissionHash":"cc926a135e86ba06ae7b3c52fddfc6e88888fd9824089d9857565e7d3860fe74","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"51003","feedbackHash":"d0de351fb8e95c7ead19a39d1a3a861a20c2fc2afedefd6e0020ab1c5ceb6202","nodeKey":"manifest","submissionHash":"685938f404468ac7c6ddd2bc03f28df801219c6b4409bb0166684cbd7de2a221","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"51311","feedbackHash":"38438f3627821c5de5975866181dd7a5d9a88234d4bc9fed08130b3e6986d781","nodeKey":"write_foundry_tests","submissionHash":"90bd3fe5826300b469d3458d7c08d9375a7e58be80dfe6954435dcf6a313acef","tag1":"verification:checks","tag2":"acceptance-v2","value":1}],"site":null,"snapshotHash":"87a86d240b9a206e8c63fc5480adbaf5048ec310d684a7f6952bd2c4aabd5ea6","state":"completed","submissions":[{"artifacts":[],"attempt":2,"bundleHash":null,"device":"ea62f3bebece9304","findings":[{"citation":"resolved","description":"All four specialists reported this one root cause; merged here into one finding, rated low. lib/SHA256SUMS holds the digests of the pristine upstream files (OpenZeppelin dbb6104c, forge-std 77041d2c). The vendored copies were later run through forge fmt (foundry.toml [fmt] line_length = 100), which rewrapped 23 of the 36 files. Two of those are the token's only production dependencies: lib/openzeppelin-contracts/contracts/token/ERC20/ERC20.sol, where the _approve(address,address,uint256,bool) signature is now split over lines 284-287, and draft-IERC6093.sol. DEPENDENCIES.md:12 says the files are unmodified and tells readers to verify them with `sha256sum -c lib/SHA256SUMS`. SECURITY.md:17 says 'vendored unmodified, and checksummed' and SECURITY.md:24 says 'dependency checksum verification passed'. None of this is true of the committed tree. There is no behavioural impact: with whitespace removed, both OZ files match upstream exactly, so PLEA compiles against genuine OZ v5.0.2 ERC20. The real problem is that the project's only provenance check is already failing, so a later real edit to ERC20.sol would look the same as this formatting noise. Fix: restore the byte-exact upstream files and exclude lib/ from forge fmt, or regenerate lib/SHA256SUMS from the committed bytes and correct the wording in DEPENDENCIES.md:12 and SECURITY.md:17/24.","line":12,"path":"DEPENDENCIES.md","reproduction":"State: clean checkout of HEAD 0c5e152 (git status clean). From the repository root run `sha256sum -c lib/SHA256SUMS`. Expected (DEPENDENCIES.md:16-20, SECURITY.md:24): every line OK, exit 0. Actual: 'lib/openzeppelin-contracts/contracts/token/ERC20/ERC20.sol: FAILED', 'lib/openzeppelin-contracts/contracts/interfaces/draft-IERC6093.sol: FAILED', 21 forge-std files FAILED, 'sha256sum: WARNING: 23 computed checksums did NOT match', exit 1. Upstream https://raw.githubusercontent.com/OpenZeppelin/openzeppelin-contracts/dbb6104ce834628e473d2173bbc9d47f81a9eec3/contracts/token/ERC20/ERC20.sol hashes to 2d874da1c1478ed22a2d30dcf1a6ec0d09a13f897ca680d55fb49fbcc0e0c5b1, the value recorded at lib/SHA256SUMS:8. Running `tr -d ' \\n\\t'` over the upstream and vendored copies of ERC20.sol and draft-IERC6093.sol gives identical sha256 for each pair, so the change is whitespace only.","severity":"low","snippet":"The upstream source and license files are unmodified. `remappings.txt` maps","title":"Vendored dependency checksums fail: lib/ was reformatted after lib/SHA256SUMS was recorded, so the documented integrity check fails and the 'unmodified'/'verification passed' claims are false (merged "}],"hash":"2d1118914c2d5f9e34f687d51b0df3377962708b2973dfbd29eb4e89f9cf3c86","nodeId":"acca303d-4d30-4f54-9fda-764d06e9944b","outcome":"completed","summary":"I found one real defect, and it's low severity: the project's own check that its bundled libraries are unmodified fails. The token code itself is sound. Findings and coverage are written to `.imd-findings.json`, and no other files were changed.\n\n**The one finding (low).** All four specialists reported the same problem, so I merged it into one. I confirmed it on a clean checkout:\n- Running `sha256sum -c lib/SHA256SUMS` from the repository root reports 23 of 36 files as FAILED and exits with status 1.\n- The failing files include the two OpenZeppelin files the token is built on, `ERC20.sol` and `draft-IERC6093.sol`.\n- The recorded checksums are those of the original OpenZeppelin files: I downloaded the original `ERC20.sol` and it matches the recorded value.\n- I compared both OpenZeppelin files against the originals with all whitespace removed, and they are identical. The files were only re-wrapped by `forge fmt` (`line_length = 100`), so the token compiles against genuine OpenZeppelin v5.0.2 ERC20.\n- The defect is that `DEPENDENCIES.md:12` says the files are \"unmodified\" and `SECURITY.md:17` and `SECURITY.md:24` say the checksum check passed, which isn't true of the committed files. Because the check already fails, a real future edit to `ERC20.sol` would look the same as this formatting change.\n- The fix is either to restore the original files and stop `forge fmt` from touching `lib/`, or to regenerate the checksums and correct the wording in those two documents.\n\nI rated it low because no funds or token behaviour are affected. I attached no test file, since those are only required for critical and high findings.\n\n**Coverage.** `approve`, `transfer` and `transferFrom` all hold:\n- `src/PLEA.sol` is plain OpenZeppelin ERC20 with nothing overridden, so every transfer moves the exact amount, with no fee or burn.\n- There is no owner, pause, mint or blacklist function.\n- The constructor mints exactly 1,000,000,000 × 10^18 to the deployer, as the task requires.\n- `launch.json` matches the code: empty constructor arguments, 18 decimals and the same total supply.\n- The repository's 51 tests pass.\n\nI didn't run the protected launch tests, because the framework they need isn't in this repository. I checked their requirements by reading them instead.","treeHash":null,"usage":{"cachedInputTokens":186459,"inputTokens":12,"model":"claude-opus-5-5","outputTokens":3875,"runtime":"claude","turns":6,"wallClockMs":58519}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"99c6d0bcc495ad61","findings":[{"citation":"resolved","description":"DEPENDENCIES.md states the vendored OpenZeppelin and forge-std sources are unmodified and tells the reader to verify them with `sha256sum -c lib/SHA256SUMS`; SECURITY.md lines 23-24 state that 'dependency checksum verification passed'. Neither is true of the tree as delivered. lib/SHA256SUMS records the hashes of the upstream bytes (I fetched every listed file at the pinned commits dbb6104c and 77041d2c and their hashes equal the SUMS entries), but 23 of the 36 vendored files were reformatted after the sums were written (the diffs are line-wrapping at 100 columns, consistent with the [fmt] line_length in foundry.toml having been applied to lib/). The reformatted files include the only production dependency, lib/openzeppelin-contracts/contracts/token/ERC20/ERC20.sol, and draft-IERC6093.sol. I confirmed by whitespace-stripped comparison that every one of the 23 differences is whitespace only, so the compiled token is semantically the upstream v5.0.2 ERC-20 and no token behaviour is affected. The defect is the integrity record: the one mechanism the project offers a reviewer or the deployer for confirming the vendored library is genuine reports failure, and the review document claims it passed. A later, real modification to ERC20.sol would be indistinguishable from this noise by the documented check. Trust assumption affected: 'the token inherits unmodified OpenZeppelin accounting' (SECURITY.md) currently rests on my out-of-band comparison, not on anything in the repository. Fix: regenerate lib/SHA256SUMS from the files actually in the tree (or restore the upstream bytes and exclude lib/ from forge fmt), and correct the 'unmodified'/'verification passed' statements.","line":12,"path":"DEPENDENCIES.md","reproduction":"From the repository root run `sha256sum -c lib/SHA256SUMS`. Expected (per DEPENDENCIES.md and SECURITY.md): every line OK, exit 0. Actual: exit 1 with 'WARNING: 23 computed checksums did NOT match'; among the FAILED lines are lib/openzeppelin-contracts/contracts/token/ERC20/ERC20.sol (recorded 2d874da1...c5b1, actual 4a1db79b...df59) and lib/openzeppelin-contracts/contracts/interfaces/draft-IERC6093.sol. `diff <(curl -sL https://raw.githubusercontent.com/OpenZeppelin/openzeppelin-contracts/dbb6104ce834628e473d2173bbc9d47f81a9eec3/contracts/token/ERC20/ERC20.sol) lib/openzeppelin-contracts/contracts/token/ERC20/ERC20.sol` shows only the `_approve(address,address,uint256,bool)` signature re-wrapped over four lines; the upstream file's sha256 equals the SUMS entry.","severity":"low","snippet":"The upstream source and license files are unmodified. `remappings.txt` maps","title":"Dependency integrity claim is false: lib/SHA256SUMS does not match the vendored sources, so the documented `sha256sum -c` verification fails"}],"hash":"4a1cf77e9b6f2f40f992748bec40f88ad983f4b3cada43f0f1967470ff619282","nodeId":"681c9164-e5d5-4afc-9461-46f2b91d50e7","outcome":"completed","summary":"The review is complete. The findings file is written, no tracked file was changed, and the scratch tests were removed.\n\n**Outcome:** The PLEA token has no permission defects. One low-severity integrity defect was found in the repository's dependency documentation.\n\n**What I checked, against the Access Control, Trust Gap and Asymmetry guides**\n\n- **Permission model.** The compiled ABI exposes exactly three state-changing functions, no receive or fallback, no owner, minter, pauser, blacklist, upgrade or initializer. The constructor is the only caller of the internal mint, and it mints to the immediate deployer, which under CREATE2 is the factory rather than the transaction origin.\n- **Trust gap.** There is no privileged actor after deployment. A scratch test confirmed the factory, holding the whole supply, cannot pull from a holder without allowance and the holder can still move its balance afterwards. Fuzzed unknown selectors revert from both strangers and the factory.\n- **Asymmetry.** Approve and allowance-spend mirror correctly: finite allowances decrement exactly, the max allowance is sticky, over-spend reverts with the allowance error and restores state, and spending emits only a Transfer event as the README documents.\n- **Launch floor.** Swarm, pool and remainder transfers arrive whole, supply is conserved, and a reachable-opcode scan of the runtime found no DELEGATECALL, CALLCODE, SELFDESTRUCT or any external-call opcode. The owner check has nothing to inspect because there are no application contracts.\n\n**The one finding (low):** DEPENDENCIES.md says the vendored sources are unmodified and tells readers to verify with `sha256sum -c lib/SHA256SUMS`, and SECURITY.md says that verification passed. Running it fails on 23 of 36 files, including the production ERC20.sol. I fetched every listed file at the pinned upstream commits and confirmed all 23 differences are whitespace only, apparently from `forge fmt` reformatting `lib/` at 100 columns after the sums were written. The token's behaviour is therefore the genuine OpenZeppelin v5.0.2 ERC-20, but the only in-repo integrity check reports failure and the review document misstates its result. The fix is to regenerate the sums from the actual files or restore upstream bytes, and correct both statements.\n\n**Coverage:** All three listed entry points are recorded as holds, plus rows for the constructor supply invariant, the administrative surface, the owner check and the dependency integrity finding. Nothing in my area was left unreached. No critical or high findings, so no proof test was attached.","treeHash":null,"usage":{"cachedInputTokens":838298,"inputTokens":354,"model":"claude-fable-5-1","outputTokens":18812,"runtime":"claude","turns":35,"wallClockMs":288563}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"8a05ec1ea94411ea","findings":[{"citation":"resolved","description":"DEPENDENCIES.md (lines 12-20) and README.md (lines 89-93) state that the vendored OpenZeppelin v5.0.2 sources are byte-for-byte upstream and that `sha256sum -c lib/SHA256SUMS` verifies them. In the delivered tree that command fails for both production library files the token compiles against: lib/openzeppelin-contracts/contracts/token/ERC20/ERC20.sol (manifest hash 2d874da1..., actual 4a1db79b...) and lib/openzeppelin-contracts/contracts/interfaces/draft-IERC6093.sol (manifest hash 4aea8724..., actual 94e5638b...), plus 21 forge-std files. Cause: the repository's foundry.toml `[fmt] line_length = 100` and `forge fmt` were applied across lib/ after the checksum manifest was generated; upstream ERC20.sol at commit dbb6104c fails `forge fmt --check` under this config, and the delivered copy passes it. I diffed both files against the upstream commit the manifest names: the only differences are line wrapping of the `_approve(address,address,uint256,bool)` signature (ERC20.sol:284-287) and of `ERC1155InsufficientBalance` (draft-IERC6093.sol:121-123). No token, opcode or semantic change, so the economics of transfer/approve/transferFrom are the unmodified upstream implementation. The defect is that the project's own provenance evidence is false as shipped: a verifier or release reviewer following the README sees a failed integrity check with no way to tell a reformat from a logic edit without doing the diff themselves, and the manifest cannot catch a future real edit because it is already red. Fix: regenerate lib/SHA256SUMS from the delivered files (or restore the byte-exact upstream files and exclude lib/ from `forge fmt`), and correct the 'unmodified' wording to say the files are reformatted.","line":12,"path":"DEPENDENCIES.md","reproduction":"From the repository root run `sha256sum -c lib/SHA256SUMS`. Expected per DEPENDENCIES.md: every line OK, exit 0. Actual: 'lib/openzeppelin-contracts/contracts/token/ERC20/ERC20.sol: FAILED', 'lib/openzeppelin-contracts/contracts/interfaces/draft-IERC6093.sol: FAILED', 21 forge-std files FAILED, 'WARNING: 23 computed checksums did NOT match', exit 1. To confirm the change is whitespace only: `curl -sSL https://raw.githubusercontent.com/OpenZeppelin/openzeppelin-contracts/dbb6104ce834628e473d2173bbc9d47f81a9eec3/contracts/token/ERC20/ERC20.sol | sha256sum` prints 2d874da1... (the manifest's value) and `diff` against the vendored file shows only lines 284-287 rewrapped.","severity":"low","snippet":"The upstream source and license files are unmodified. `remappings.txt` maps","title":"Shipped dependency integrity check fails: vendored OpenZeppelin ERC20 and ERC-6093 sources no longer match lib/SHA256SUMS"}],"hash":"4f7c398375d7ed949256cf81f725ed1f8a8e9cf4f7a1b99bd2c897055fa43ff8","nodeId":"a5b8cb5c-e2f1-4a67-a24e-7d37caca7141","outcome":"completed","summary":"Review complete. The findings file is written and valid, and nothing in the tree was changed.\n\n**Outcome:** the PLEA token has no economic, invariant, or flow-gap defect. It is a 16-line contract that mints 10^27 units to the deployer once and otherwise inherits unmodified OpenZeppelin v5.0.2 ERC-20 logic. I report one low-severity provenance defect.\n\n**What I checked in my area**\n\n- **Economic Security.** No fee, tax, exemption list, cap, cooldown, callback, or payable path exists. The three launch flows (10% to the distributor, 80% seeded into the PoolManager, 10% to the remainder address) divide 10^27 with no dust and arrive whole. Transfer returns true and balanceOf is exact, so Uniswap v4 sync, settle and take accounting cannot drift. Amounts fit int128.\n- **Invariant.** Sum of balances equals totalSupply equals 10^27 permanently. The only mint is in the constructor, no burn path is reachable because transfer rejects the zero address, and the existing invariant suite ran 8,192 handler calls with zero reverts under the project's seed.\n- **Flow Gap.** No privileged entry point exists, the ABI exposes only approve, transfer and transferFrom as state-changing, and the runtime holds no DELEGATECALL or SELFDESTRUCT. The static-analysis lead about the large literal is stylistic. The literal evaluates to exactly 10^27.\n\n**Finding (low):** the shipped dependency integrity check is broken. DEPENDENCIES.md claims the vendored OpenZeppelin files are unmodified and verifiable with the checksum manifest, but that command fails on both production library files and 21 forge-std files. I diffed the two OpenZeppelin files against the named upstream commit: the differences are line wrapping only, caused by running the formatter across lib under this repo's 100-column config. Token logic is unaffected. The fix is to regenerate the checksum manifest or restore byte-exact files and correct the wording.\n\n**Coverage:** all three entry points are marked holds, with six invariant rows also holds, one row pointing to the finding, and one row unreached because no launch.json exists in this tree yet to check the economics fields against.\n\nNo proof test was written, since nothing rose to high or critical.","treeHash":null,"usage":{"cachedInputTokens":473216,"inputTokens":226,"model":"claude-fable-5-1","outputTokens":12802,"runtime":"claude","turns":24,"wallClockMs":183083}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"707624586655cf74","findings":[],"hash":"50e3374c585ff836fc30443269fd0c372f40450484674db02ef72cf82f8f46b9","nodeId":"434d19ab-694c-4cb1-b06e-00de60f1e3b3","outcome":"failed","summary":"Claude Code can't use your Claude subscription, usually because a payment is past due · Pay or renew at https://claude.ai/… (if you just paid, try again shortly), or use an Anthropic API key instead","treeHash":null,"usage":{"cachedInputTokens":0,"inputTokens":0,"model":null,"outputTokens":0,"runtime":"claude","turns":1,"wallClockMs":1248}},{"artifacts":[],"attempt":1,"bundleHash":"2618ce7b8c79adec4ae9af9f4fdd5eef5f3fe8a5f18699f3e6504e4ef67d9efe","device":"2d977abd7ffb09d4","findings":[],"hash":"685938f404468ac7c6ddd2bc03f28df801219c6b4409bb0166684cbd7de2a221","nodeId":"22d93ef8-400b-43f9-9389-e78ea4a0a31c","outcome":"completed","summary":"Created `launch.json` matching PLEA’s constructor, exact supply, required economics, and pool settings. Only the manifest changed; local JSON and field checks passed.\n\n`forge build` and seeded `forge test` both failed because the installed Solidity 0.8.26 compiler returned `Permission denied (os error 13)`.","treeHash":"54b3248120715368d7211886d2f6e0a1f68d218c","usage":{"cachedInputTokens":187136,"inputTokens":26284,"model":"gpt-6.1-sol","outputTokens":3432,"runtime":"codex","turns":4,"wallClockMs":79255}},{"artifacts":[],"attempt":2,"bundleHash":null,"device":"d03fc84904b54d9e","findings":[{"citation":"resolved","description":"Periphery pass. The token's only production dependency is the vendored OpenZeppelin ERC20 base, and the project's integrity story for it is the checksum file plus the written claim that the upstream files are unmodified. In the committed tree that story is false: running the documented verification command from the repository root reports 23 of 36 files FAILED, including the two production files lib/openzeppelin-contracts/contracts/token/ERC20/ERC20.sol and lib/openzeppelin-contracts/contracts/interfaces/draft-IERC6093.sol. SECURITY.md line 24 additionally states that 'dependency checksum verification passed', which cannot have been true for the tree as committed (git status is clean and HEAD contains the same bytes as the working tree). Root cause: the recorded digests are those of the pristine upstream files at the pinned commits (I fetched OpenZeppelin dbb6104 and forge-std 77041d2 and the upstream digests equal the recorded ones), but the vendored copies were afterwards reformatted by forge fmt to the project's 100-column line length (e.g. ERC20.sol line 284 `function _approve(address owner, address spender, uint256 value, bool emitEvent) internal virtual {` was split across four lines; draft-IERC6093.sol line 121 `error ERC1155InsufficientBalance(...)` likewise). I confirmed every one of the 23 files is identical to its upstream original once whitespace is removed, so the compiled token is the genuine OpenZeppelin v5.0.2 ERC20 and there is no behavioural impact. The defect is that the project's own stated integrity check is broken and its review document reports a verification result that the tree does not reproduce, so a reviewer or launch operator following the README/DEPENDENCIES instructions gets a hard failure and has no shipped way to confirm the base contract is unmodified. Fix (either): restore the upstream bytes of the 23 files under lib/ (and exclude lib/ from forge fmt), or regenerate lib/SHA256SUMS from the committed bytes and reword DEPENDENCIES.md line 12 to say the files are reformatted but semantically identical, and correct SECURITY.md line 24. Note: lib/ and configuration are outside this task's write paths, so I changed nothing.","line":12,"path":"DEPENDENCIES.md","reproduction":"State: clean checkout of commit bb5a0fe (git status clean). Input: from the repository root run `sha256sum -c lib/SHA256SUMS`. Expected (per DEPENDENCIES.md lines 12-21 and SECURITY.md line 24): every line reports OK and the exit status is 0. Actual: 13 OK, 23 FAILED, 'WARNING: 23 computed checksums did NOT match', exit status 1. Concretely for the production base contract: `sha256sum lib/openzeppelin-contracts/contracts/token/ERC20/ERC20.sol` prints 4a1db79b7b76a41b..., while lib/SHA256SUMS line 8 records 2d874da1c1478ed22a2d30dcf1a6ec0d09a13f897ca680d55fb49fbcc0e0c5b1 (which is the digest of the pristine upstream file at commit dbb6104). `git show HEAD:lib/openzeppelin-contracts/contracts/token/ERC20/ERC20.sol | sha256sum` gives the same 4a1db79b... so the mismatch is committed, not local. `diff <(curl -sL https://raw.githubusercontent.com/OpenZeppelin/openzeppelin-contracts/dbb6104ce834628e473d2173bbc9d47f81a9eec3/contracts/token/ERC20/ERC20.sol) lib/openzeppelin-contracts/contracts/token/ERC20/ERC20.sol` shows only the line-wrapping of the `_approve(..., bool emitEvent)` signature at line 284; stripping whitespace from both yields identical digests.","severity":"low","snippet":"The upstream source and license files are unmodified. `remappings.txt` maps","title":"Vendored dependency integrity record is stale: documented `sha256sum -c lib/SHA256SUMS` fails on 23 files, contradicting DEPENDENCIES.md and SECURITY.md"}],"hash":"75a212dd6179450a30fde20704871e55643179c546d16ad06ff493ca61e3a18a","nodeId":"434d19ab-694c-4cb1-b06e-00de60f1e3b3","outcome":"completed","summary":"The review is complete. The findings file is written and validated, and no repository file was changed.\n\n**Outcome.** The PLEA token's control flow holds. All three state-changing entry points, the constructor, and the supply and privilege invariants traced clean under the Execution Trace and First Principles guides. The one defect is in the Periphery area and is low severity.\n\n**Finding 1 (low): the vendored-dependency integrity record is stale.** DEPENDENCIES.md says the library files are unmodified and tells the reader to verify them with the checksum file. SECURITY.md says that verification passed. On the committed tree the documented command fails on 23 of 36 files, including the production ERC20 base contract. I fetched the pinned upstream commits and confirmed the recorded digests are the pristine upstream ones, while the vendored copies were later reformatted by forge fmt to the project's line length. Every file is byte-identical to upstream once whitespace is removed, so the compiled token is genuine OpenZeppelin v5.0.2 and behaviour is unaffected. The reproduction is the single command below, and the fix is to restore the upstream bytes or regenerate the checksum file and correct both documents.\n\n```\nsha256sum -c lib/SHA256SUMS   # 13 OK, 23 FAILED, exit 1\n```\n\n**What I verified in my area.**\n- `approve`, `transfer` and `transferFrom` follow the unmodified OpenZeppelin paths: zero-address guards, balance and allowance checks before unchecked decrements, atomic rollback, no fee, hook, callback or sentinel path.\n- The constructor takes no arguments and mints exactly 10^27 units once to its caller, so a CREATE2 factory receives the whole supply. The compiled ABI has no other non-view function, no receive or fallback, no linked libraries and no immutables.\n- A reachable-opcode scan of the runtime finds no DELEGATECALL, CALLCODE or SELFDESTRUCT. Decimals return 18. The contract identifier PLEA fits the manifest's 32-character limit.\n- The project's 37 tests, including the invariant suite, pass with the documented seed.\n\n**Leads I dropped.** Aderyn's large-numeric-literal note on line 10 is style only; the tests confirm the constant equals 10^27. The ERC-20 approve ordering race is standard and documented.\n\n**Coverage.** Seven rows: the three listed entry points, the constructor and two invariants hold, and the periphery row points to finding 1. Nothing was left unreached.","treeHash":null,"usage":{"cachedInputTokens":564902,"inputTokens":258,"model":"claude-fable-5-1","outputTokens":14848,"runtime":"claude","turns":27,"wallClockMs":209523}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"797dadf3f0881394","findings":[],"hash":"8f85f81d6dacad1d57b03aaf582d46628425210967792240c720c4609cc0315b","nodeId":"acca303d-4d30-4f54-9fda-764d06e9944b","outcome":"failed","summary":"API Error: Your account can't receive replies from Claude right now. You can find the next step in the Anthropic Verification Portal: https://portal.anthropic.com/…","treeHash":null,"usage":{"cachedInputTokens":0,"inputTokens":0,"model":null,"outputTokens":0,"runtime":"claude","turns":1,"wallClockMs":1612}},{"artifacts":[],"attempt":1,"bundleHash":"7f3e27d7e022838435caa8d08ccec8123b4ba84dda4829926f0e6c47471ccdaa","device":"273e2f46918e7b5e","findings":[],"hash":"90bd3fe5826300b469d3458d7c08d9375a7e58be80dfe6954435dcf6a313acef","nodeId":"5bc20186-8d7f-4ce8-b77f-07f9f0f866d2","outcome":"completed","summary":"Added 14 edge/fuzz tests and expanded invariants to cover failures, revocation, allowance rollback, and supply conservation.\n\nOffline `forge build` and `forge test` passed with the required seed: **51 tests, 32,768 invariant calls**.\n\nOnly `test/` changed. No confirmed defects found.","treeHash":"c81969c76a6079eaef57d035978cfdfc8fc9f4d0","usage":{"cachedInputTokens":873984,"inputTokens":73025,"model":"gpt-6-astra","outputTokens":15106,"runtime":"codex","turns":6,"wallClockMs":418560}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"1a7ecd03bd365366","findings":[],"hash":"c0e882c6ab6152a31c2413c5f26c35ab1bf32742af34a4395ed298dabea07a74","nodeId":"b5d1c7ef-73cc-4258-ac8f-8cc59459f62c","outcome":"failed","summary":"Claude Code can't use your Claude subscription, usually because a payment is past due · Pay or renew at https://claude.ai/… (if you just paid, try again shortly), or use an Anthropic API key instead","treeHash":null,"usage":{"cachedInputTokens":0,"inputTokens":0,"model":null,"outputTokens":0,"runtime":"claude","turns":1,"wallClockMs":1727}},{"artifacts":[],"attempt":1,"bundleHash":"7cf8558551d237cf0e8bdbaebbfb564c09d607a35c1c7be6d04f7ccf796c9880","device":"983d7731bb482b1b","findings":[],"hash":"cc926a135e86ba06ae7b3c52fddfc6e88888fd9824089d9857565e7d3860fe74","nodeId":"20d04a5f-8899-4837-a1fa-18a72e27556b","outcome":"completed","summary":"Implemented PLEA with 1,000,000,000 tokens, 18 decimals, minted once to the deployer.\n\n- Dependencies vendored for offline builds.\n- Deployment assumptions and responsibilities documented in [README.md](/root/.identitymd/work/325af891-d8fe-4ccd-a362-7210c74c0bfc/20d04a5f-8899-4837-a1fa-18a72e27556b/README.md).\n- `forge build`, `forge test`, and `forge fmt --check` pass with Solidity 0.8.26.\n- All 37 local tests pass using the supplied fuzz seed.\n\nThe external protected launch harness was not run locally.","treeHash":"5d7c66ab60fc009c85b7f55317be47be0f1f112d","usage":{"cachedInputTokens":582016,"inputTokens":41834,"model":"gpt-6-astra","outputTokens":17489,"runtime":"codex","turns":6,"wallClockMs":1035537}},{"artifacts":[],"attempt":2,"bundleHash":null,"device":"fdbedee33322a6ef","findings":[{"citation":"resolved","description":"Outside the math area, reported because it breaks the provenance check the project documents. lib/SHA256SUMS records the upstream hashes (e.g. ERC20.sol 2d874da1...c5b1, which matches OpenZeppelin commit dbb6104c exactly), but the vendored files were run through a formatter afterwards (line_length = 100), so the shipped files no longer match. A diff -w against upstream shows only line-wrapping changes, e.g. ERC20._approve's signature split over four lines and ERC1155InsufficientBalance in draft-IERC6093.sol wrapped. The compiled logic is identical to OZ v5.0.2, so funds are not at risk. The impact is that the documented integrity check fails, and a reviewer cannot tell a harmless reformat from tampering without diffing by hand.","line":12,"path":"DEPENDENCIES.md","reproduction":"From the repository root run `sha256sum -c lib/SHA256SUMS`. Expected: every line OK, as DEPENDENCIES.md states. Actual: FAILED for lib/openzeppelin-contracts/contracts/token/ERC20/ERC20.sol (actual hash 4a1db79b...df59, recorded 2d874da1...c5b1), lib/openzeppelin-contracts/contracts/interfaces/draft-IERC6093.sol, and several forge-std files (StdJson.sol, StdChains.sol, StdCheats.sol, StdStyle.sol, StdConstants.sol, interfaces/IERC4626.sol, IERC7575.sol, IMulticall3.sol). Fix: restore the byte-exact upstream files (exclude lib/ from forge fmt), or regenerate SHA256SUMS and correct the 'unmodified' statement.","severity":"info","snippet":"The upstream source and license files are unmodified. `remappings.txt` maps","title":"Vendored dependency checksums fail: lib/ was reformatted, contradicting the 'unmodified' provenance claim (no semantic change)"}],"hash":"d54a89da3a9a51ab1d857a032024f1dce0b75523fc190b8b5baa15e63ad2d69d","nodeId":"b5d1c7ef-73cc-4258-ac8f-8cc59459f62c","outcome":"completed","summary":"I found no math defects in PLEA. The one thing I reported is a minor provenance mismatch in the vendored libraries, and it doesn't change how the token behaves. The results are in `.imd-findings.json` and no other files were changed.\n\n**What the token is:** `src/PLEA.sol` is a plain OpenZeppelin v5.0.2 ERC20. Its only addition is `INITIAL_SUPPLY = 1_000_000_000 * 10 ** 18`, minted once to `msg.sender` in the constructor. It has no fees, burns, rounding, owner or mint path after deployment.\n\n**Math Precision, Boundary and Numerical Gap passes:**\n- **Supply:** 1e27 is correct for one billion tokens at 18 decimals, and it is far below 2^256. The aderyn \"large numeric literal\" warning is just this constant and is not a defect.\n- **Unchecked arithmetic:** the subtractions in `_update` and `_spendAllowance` only run after a balance or allowance check. The unchecked additions can't overflow because balances always sum to the total supply, which never grows.\n- **Edge cases:** I traced zero-value transfers, transfers of a whole balance, self-transfers, an unlimited (`type(uint256).max`) allowance, and an allowance exactly equal to the amount. All of them behave exactly. Transfers move the exact amount, so the factory, distributor and pool flows arrive whole.\n- **Tests:** the project's 37 tests, including the invariant suite, all pass.\n\n**Coverage:** `approve`, `transfer` and `transferFrom` are all marked `holds`. I added two invariant rows, for the supply being minted once and for 18 decimals with no transfer fee; both hold.\n\n**The one finding (info, outside the math area):** `DEPENDENCIES.md:12` says the vendored library files are unmodified, but `sha256sum -c lib/SHA256SUMS` fails for OpenZeppelin's `ERC20.sol`, `draft-IERC6093.sol` and several forge-std files. I fetched OpenZeppelin's upstream files at the pinned commit and compared them. The only differences are reformatted line breaks, so the compiled code is identical. The cost is that the project's own integrity check can't tell a harmless reformat from tampering. The fix is to restore the exact upstream files, or regenerate the checksums and correct the statement. I did not compare the forge-std files with upstream, so the claim that the changes are only formatting is confirmed for the OpenZeppelin files alone.\n\nNone of the findings is high-severity, so none needed a Foundry test.","treeHash":null,"usage":{"cachedInputTokens":283753,"inputTokens":19,"model":"claude-opus-5-5","outputTokens":4783,"runtime":"claude","turns":10,"wallClockMs":76161}}],"verification":[{"checks":[{"durationMs":1741,"exitCode":0,"name":"build","output":"Compiling 27 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.63s\nCompiler run successful!\n","passed":true},{"durationMs":3330,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 36 tests for test/PLEA.t.sol:PLEATest\n[PASS] testApprovalBelongsOnlyToCaller() (gas: 143052)\n[PASS] testApprovalCanBeReplacedAndRevoked() (gas: 177100)\n[PASS] testApprovalDoesNotRequireBalance() (gas: 78637)\n[PASS] testApproveReturnsTrueAndEmitsEvent() (gas: 76195)\n[PASS] testConstructorEmitsExactlyOneMint() (gas: 9692)\n[PASS] testCreate2FactoryReceivesEntireSupply() (gas: 230339)\n[PASS] testEntireSupplyCanMoveAndReturn() (gas: 149103)\n[PASS] testExactAllowanceCanBeExhausted() (gas: 162189)\n[PASS] testFuzzRevertAboveAllowance(uint256,uint256) (runs: 512, μ: 123155, ~: 123312)\nLogs:\n  Bound result 899956305699818806955421551\n  Bound result 6531010581241603966806105295569700\n\n[PASS] testFuzzRevertAboveBalance(uint256,uint256) (runs: 512, μ: 127369, ~: 127641)\nLogs:\n  Bound result 930056045111998124955696983\n  Bound result 429306357\n\n[PASS] testFuzzTransferConservesSupply(uint256) (runs: 512, μ: 91898, ~: 92269)\nLogs:\n  Bound result 615820732882617117526060233\n\n[PASS] testFuzzTransferFromUsesOnlyAuthorizedAmount(uint256,uint256) (runs: 512, μ: 164921, ~: 167207)\nLogs:\n  Bound result 523392108315948534363016547\n  Bound result 398301332583896116185809771\n\n[PASS] testFuzzTransferToAnyNonzeroRecipient(address,uint256) (runs: 512, μ: 92685, ~: 93151)\nLogs:\n  Bound result 7000000000000000000\n\n[PASS] testInfiniteAllowanceRemainsUnchanged() (gas: 204563)\n[PASS] testLaunchDistributionClaimsAndPoolTransfersArriveWhole() (gas: 406262)\n[PASS] testMetadataAndEntireSupply() (gas: 107606)\n[PASS] testNoMintBurnOrAdministrativeEntryPoints() (gas: 1288293)\n[PASS] testRejectsNativeCurrency() (gas: 42706)\n[PASS] testRevertApproveZeroSpender() (gas: 37551)\n[PASS] testRevertDeployerCannotSpendHolderBalanceWithoutApproval() (gas: 158412)\n[PASS] testRevertSelfTransferStillRequiresBalance() (gas: 35929)\n[PASS] testRevertTransferFromAboveAllowanceIsAtomic() (gas: 116203)\n[PASS] testRevertTransferFromAboveBalanceRestoresAllowance() (gas: 179363)\n[PASS] testRevertTransferFromToZeroRestoresAllowance() (gas: 114561)\n[PASS] testRevertTransferFromWithoutApproval() (gas: 57866)\n[PASS] testRevertTransferFromZeroEvenForZeroAmount() (gas: 35341)\n[PASS] testRevertTransferToZero() (gas: 47640)\n[PASS] testRevertTransferWithInsufficientBalanceIsAtomic() (gas: 120500)\n[PASS] testRevertZeroTransferToZero() (gas: 30457)\n[PASS] testSelfTransferPreservesBalance() (gas: 54037)\n[PASS] testTransferFromSpendsAllowanceAndEmitsTransfer() (gas: 173063)\n[PASS] testTransferFromToSelfSpendsAllowanceWithoutChangingBalance() (gas: 105697)\n[PASS] testTransferReturnsTrueAndEmitsEvent() (gas: 93505)\n[PASS] testTransferToContractRequiresNoReceiverCallback() (gas: 224454)\n[PASS] testZeroTransferFromEmptyAccountEmitsEvent() (gas: 73354)\n[PASS] testZeroTransferFromNeedsNoAllowance() (gas: 68930)\nSuite result: ok. 36 passed; 0 failed; 0 skipped; finished in 34.85ms (167.91ms CPU time)\n\nRan 1 test for test/PLEA.invariant.t.sol:PLEAInvariantTest\n[PASS]\nPLEAInvariantTest invariants:\n[PASS] invariantAllowancesMatchModel\n[PASS] invariantSupplyAndBalancesMatchModel\n PLEAInvariantTest invariants (runs: 128, calls: 8192, reverts: 0)\n\n╭-------------+--------------+-------+---------+----------╮\n| Contract    | Selector     | Calls | Reverts | Discards |\n+=========================================================+\n| PLEAHandler | approve      | 2784  | 0       | 0        |\n|-------------+--------------+-------+---------+----------|\n| PLEAHandler | transfer     | 2662  | 0       | 0        |\n|-------------+--------------+-------+---------+----------|\n| PLEAHandler | transferFrom | 2746  | 0       | 0        |\n╰-------------+--------------+-------+---------+----------╯\n\nLogs:\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 10000000000000000000\n  Bound result 9999999999900000001\n  Bound result 4294967294\n  Bound result 0\n  Bound result 0\n  Bound result 1027\n  Bound result 0\n  Bound result 0\n  Bound result 293\n  Bound result 1322\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 94\n  Bound result 19999999999999999999\n  Bound result 1\n  Bound result 1000000001\n  Bound result 0\n  Bound result 9\n  Bound result 8\n  Bound result 64\n  Bound result 12\n  Bound result 0\n  Bound result 4\n  Bound result 816\n  Bound result 1\n  Bound result 2\n  Bound result 2417087832\n  Bound result 9\n  Bound result 4065\n  Bound result 1089005588\n  Bound result 5\n  Bound result 506363200\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 3.18s (3.18s CPU time)\n\nRan 2 test suites in 3.18s (3.22s CPU time): 37 tests passed, 0 failed, 0 skipped (37 total tests)\n","passed":true},{"durationMs":66,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"PLEA.approve(address,uint256)\",\"PLEA.transfer(address,uint256)\",\"PLEA.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"DEPENDENCIES.md\":31,\"LICENSE\":21,\"README.md\":126,\"SECURITY.md\":52,\"foundry.toml\":21,\"launch.json\":24,\"remappings.txt\":2,\"src/PLEA.sol\":16,\"test/PLEA.invariant.t.sol\":107,\"test/PLEA.t.sol\":472},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"685938f404468ac7c6ddd2bc03f28df801219c6b4409bb0166684cbd7de2a221","verifiedTreeHash":"54b3248120715368d7211886d2f6e0a1f68d218c","verifierVersion":"0.1.0+c78f45fe"},{"checks":[{"durationMs":2276,"exitCode":0,"name":"build","output":"Compiling 28 files with Solc 0.8.26\nSolc 0.8.26 finished in 2.16s\nCompiler run successful!\n","passed":true},{"durationMs":13345,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 36 tests for test/PLEA.t.sol:PLEATest\n[PASS] testApprovalBelongsOnlyToCaller() (gas: 143052)\n[PASS] testApprovalCanBeReplacedAndRevoked() (gas: 177100)\n[PASS] testApprovalDoesNotRequireBalance() (gas: 78637)\n[PASS] testApproveReturnsTrueAndEmitsEvent() (gas: 76195)\n[PASS] testConstructorEmitsExactlyOneMint() (gas: 9692)\n[PASS] testCreate2FactoryReceivesEntireSupply() (gas: 230339)\n[PASS] testEntireSupplyCanMoveAndReturn() (gas: 149103)\n[PASS] testExactAllowanceCanBeExhausted() (gas: 162189)\n[PASS] testFuzzRevertAboveAllowance(uint256,uint256) (runs: 512, μ: 123211, ~: 123336)\nLogs:\n  Bound result 930056045111998124955696983\n  Bound result 429306357\n\n[PASS] testFuzzRevertAboveBalance(uint256,uint256) (runs: 512, μ: 127477, ~: 127677)\nLogs:\n  Bound result 12\n  Bound result 1000000000\n\n[PASS] testFuzzTransferConservesSupply(uint256) (runs: 512, μ: 91902, ~: 92269)\nLogs:\n  Bound result 9\n\n[PASS] testFuzzTransferFromUsesOnlyAuthorizedAmount(uint256,uint256) (runs: 512, μ: 165021, ~: 167207)\nLogs:\n  Bound result 12\n  Bound result 12\n\n[PASS] testFuzzTransferToAnyNonzeroRecipient(address,uint256) (runs: 512, μ: 93132, ~: 93590)\nLogs:\n  Bound result 1161196849105827153939753761467446705228655357917\n  Bound result 91821463385862239889916771\n\n[PASS] testInfiniteAllowanceRemainsUnchanged() (gas: 204563)\n[PASS] testLaunchDistributionClaimsAndPoolTransfersArriveWhole() (gas: 406262)\n[PASS] testMetadataAndEntireSupply() (gas: 107606)\n[PASS] testNoMintBurnOrAdministrativeEntryPoints() (gas: 1288293)\n[PASS] testRejectsNativeCurrency() (gas: 42706)\n[PASS] testRevertApproveZeroSpender() (gas: 37551)\n[PASS] testRevertDeployerCannotSpendHolderBalanceWithoutApproval() (gas: 158412)\n[PASS] testRevertSelfTransferStillRequiresBalance() (gas: 35929)\n[PASS] testRevertTransferFromAboveAllowanceIsAtomic() (gas: 116203)\n[PASS] testRevertTransferFromAboveBalanceRestoresAllowance() (gas: 179363)\n[PASS] testRevertTransferFromToZeroRestoresAllowance() (gas: 114561)\n[PASS] testRevertTransferFromWithoutApproval() (gas: 57866)\n[PASS] testRevertTransferFromZeroEvenForZeroAmount() (gas: 35341)\n[PASS] testRevertTransferToZero() (gas: 47640)\n[PASS] testRevertTransferWithInsufficientBalanceIsAtomic() (gas: 120500)\n[PASS] testRevertZeroTransferToZero() (gas: 30457)\n[PASS] testSelfTransferPreservesBalance() (gas: 54037)\n[PASS] testTransferFromSpendsAllowanceAndEmitsTransfer() (gas: 173063)\n[PASS] testTransferFromToSelfSpendsAllowanceWithoutChangingBalance() (gas: 105697)\n[PASS] testTransferReturnsTrueAndEmitsEvent() (gas: 93505)\n[PASS] testTransferToContractRequiresNoReceiverCallback() (gas: 224454)\n[PASS] testZeroTransferFromEmptyAccountEmitsEvent() (gas: 73354)\n[PASS] testZeroTransferFromNeedsNoAllowance() (gas: 68930)\nSuite result: ok. 36 passed; 0 failed; 0 skipped; finished in 162.05ms (749.31ms CPU time)\n\nRan 14 tests for test/PLEA.edge.t.sol:PLEAEdgeTest\n[PASS] testApprovalDoesNotAuthorizeADifferentSpenderOrOwner() (gas: 283698)\n[PASS] testDelegatedSelfTransferWithInsufficientBalanceRestoresAllowance() (gas: 176815)\n[PASS] testFuzzFailedDelegatedTransferPreservesLargeApproval(uint256,uint256,uint256) (runs: 1000, μ: 210963, ~: 211593)\nLogs:\n  Bound result 561894986678724862428367517\n  Bound result 115792089237316195423570985008687907853269984665640564039457584007913129639934\n  Bound result 115792089237316195423570985008687907853269984665640564039457584007913129639934\n\n[PASS] testFuzzRepeatedRoundTripsCannotCreateOrDestroyDust(uint256,uint256,uint8) (runs: 1000, μ: 772919, ~: 677719)\nLogs:\n  Bound result 82531225780236839233772422\n  Bound result 21233697058037172222499865\n  Bound result 5\n\n[PASS] testFuzzSpentAllowanceReplacementIsExactAndIsolated(uint256,uint256,uint256) (runs: 1000, μ: 345975, ~: 347584)\nLogs:\n  Bound result 109110526\n\n[PASS] testFuzzSplitDelegatedTransfersEqualOneSpend(uint256,uint256,uint256) (runs: 1000, μ: 384907, ~: 387626)\nLogs:\n  Bound result 561894986678724862428367517\n  Bound result 561894986678724862428367516\n  Bound result 115792089237316195423570985008687907853269984665640002144471837350552313508829\n\n[PASS] testHolderTransferFromRequiresItsOwnAllowance() (gas: 262486)\n[PASS] testInfiniteApprovalCanBeReducedThenRevoked() (gas: 300226)\n[PASS] testLargestFiniteAllowanceIsConsumed() (gas: 153495)\n[PASS] testMaximumTransferAmountRevertsWithoutOverflowOrAllowanceLoss() (gas: 156597)\n[PASS] testOneWeiAllowanceCannotBeSpentTwice() (gas: 250813)\n[PASS] testSpenderCanBeRecipientWithoutReceivingAnExtraCredit() (gas: 146193)\n[PASS] testZeroApprovalStillRejectsZeroSpender() (gas: 99850)\n[PASS] testZeroDelegatedSelfTransferPreservesFiniteApproval() (gas: 122795)\nSuite result: ok. 14 passed; 0 failed; 0 skipped; finished in 170.33ms (626.15ms CPU time)\n\nRan 1 test for test/PLEA.invariant.t.sol:PLEAInvariantTest\n[PASS]\nPLEAInvariantTest invariants:\n[PASS] invariantAllowancesMatchModel\n[PASS] invariantMetadataIsStable\n[PASS] invariantSupplyAndBalancesMatchModel\n PLEAInvariantTest invariants (runs: 256, calls: 32768, reverts: 0)\n\n╭-------------+---------------------------+-------+---------+----------╮\n| Contract    | Selector                  | Calls | Reverts | Discards |\n+======================================================================+\n| PLEAHandler | approve                   | 2974  | 0       | 0        |\n|-------------+---------------------------+-------+---------+----------|\n| PLEAHandler | approveBoundary           | 2929  | 0       | 0        |\n|-------------+---------------------------+-------+---------+----------|\n| PLEAHandler | approveZeroSpender        | 2986  | 0       | 0        |\n|-------------+---------------------------+-------+---------+----------|\n| PLEAHandler | revokeAndAttemptSpend     | 2903  | 0       | 0        |\n|-------------+---------------------------+-------+---------+----------|\n| PLEAHandler | transfer                  | 2925  | 0       | 0        |\n|-------------+---------------------------+-------+---------+----------|\n| PLEAHandler | transferEntireBalance     | 3024  | 0       | 0        |\n|-------------+---------------------------+-------+---------+----------|\n| PLEAHandler | transferFrom              | 2956  | 0       | 0        |\n|-------------+---------------------------+-------+---------+----------|\n| PLEAHandler | transferFromOverAllowance | 2998  | 0       | 0        |\n|-------------+---------------------------+-------+---------+----------|\n| PLEAHandler | transferFromOverBalance   | 2954  | 0       | 0        |\n|-------------+---------------------------+-------+---------+----------|\n| PLEAHandler | transferOverBalance       | 3022  | 0       | 0        |\n|-------------+---------------------------+-------+---------+----------|\n| PLEAHandler | transferToZero            | 3097  | 0       | 0        |\n╰-------------+---------------------------+-------+---------+----------╯\n\nLogs:\n  Bound result 250000000000000000000000000\n  Bound result 250000000000000000000000000\n  Bound result 250000000000000000000000000\n  Bound result 4089\n  Bound result 6196\n  Bound result 16339\n  Bound result 5000000000000000001\n  Bound result 4\n  Bound result 30000000000000000000\n  Bound result 5\n  Bound result 8531243281566699164\n  Bound result 1\n  Bound result 8765\n  Bound result 285\n  Bound result 3869\n  Bound result 3909\n  Bound result 10516\n  Bound result 2968\n  Bound result 195455343243613394988224002\n  Bound result 55073939728040790060327165\n  Bound result 304\n  Bound result 9362\n  Bound result 12\n  Bound result 23\n  Bound result 21498811042151126350200202789306189740838262400310546\n  Bound result 3\n  Bound result 0\n  Bound result 2000000000000000000\n  Bound result 120209876281281145568259942\n  Bound result 0\n  Bound result 0\n  Bound result 1416050630860634\n  Bound result 0\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 13.19s (13.19s CPU time)\n\nRan 3 test suites in 13.19s (13.52s CPU time): 51 tests passed, 0 failed, 0 skipped (51 total tests)\n","passed":true},{"durationMs":83,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"PLEA.approve(address,uint256)\",\"PLEA.transfer(address,uint256)\",\"PLEA.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"DEPENDENCIES.md\":31,\"LICENSE\":21,\"README.md\":126,\"SECURITY.md\":52,\"foundry.toml\":21,\"remappings.txt\":2,\"src/PLEA.sol\":16,\"test/PLEA.edge.t.sol\":306,\"test/PLEA.invariant.t.sol\":282,\"test/PLEA.t.sol\":472,\"test/README.md\":78},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"90bd3fe5826300b469d3458d7c08d9375a7e58be80dfe6954435dcf6a313acef","verifiedTreeHash":"c81969c76a6079eaef57d035978cfdfc8fc9f4d0","verifierVersion":"0.1.0+c78f45fe"},{"checks":[{"durationMs":1644,"exitCode":0,"name":"build","output":"Compiling 27 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.54s\nCompiler run successful!\n","passed":true},{"durationMs":3582,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 36 tests for test/PLEA.t.sol:PLEATest\n[PASS] testApprovalBelongsOnlyToCaller() (gas: 143052)\n[PASS] testApprovalCanBeReplacedAndRevoked() (gas: 177100)\n[PASS] testApprovalDoesNotRequireBalance() (gas: 78637)\n[PASS] testApproveReturnsTrueAndEmitsEvent() (gas: 76195)\n[PASS] testConstructorEmitsExactlyOneMint() (gas: 9692)\n[PASS] testCreate2FactoryReceivesEntireSupply() (gas: 230339)\n[PASS] testEntireSupplyCanMoveAndReturn() (gas: 149103)\n[PASS] testExactAllowanceCanBeExhausted() (gas: 162189)\n[PASS] testFuzzRevertAboveAllowance(uint256,uint256) (runs: 512, μ: 123155, ~: 123312)\nLogs:\n  Bound result 2000000000000000000\n  Bound result 1168\n\n[PASS] testFuzzRevertAboveBalance(uint256,uint256) (runs: 512, μ: 127369, ~: 127641)\nLogs:\n  Bound result 12\n  Bound result 1000000000\n\n[PASS] testFuzzTransferConservesSupply(uint256) (runs: 512, μ: 91898, ~: 92269)\nLogs:\n  Bound result 975426969376547\n\n[PASS] testFuzzTransferFromUsesOnlyAuthorizedAmount(uint256,uint256) (runs: 512, μ: 164921, ~: 167207)\nLogs:\n  Bound result 930056045111998124955696983\n  Bound result 429306357\n\n[PASS] testFuzzTransferToAnyNonzeroRecipient(address,uint256) (runs: 512, μ: 92685, ~: 93151)\nLogs:\n  Bound result 7000000000000000000\n\n[PASS] testInfiniteAllowanceRemainsUnchanged() (gas: 204563)\n[PASS] testLaunchDistributionClaimsAndPoolTransfersArriveWhole() (gas: 406262)\n[PASS] testMetadataAndEntireSupply() (gas: 107606)\n[PASS] testNoMintBurnOrAdministrativeEntryPoints() (gas: 1288293)\n[PASS] testRejectsNativeCurrency() (gas: 42706)\n[PASS] testRevertApproveZeroSpender() (gas: 37551)\n[PASS] testRevertDeployerCannotSpendHolderBalanceWithoutApproval() (gas: 158412)\n[PASS] testRevertSelfTransferStillRequiresBalance() (gas: 35929)\n[PASS] testRevertTransferFromAboveAllowanceIsAtomic() (gas: 116203)\n[PASS] testRevertTransferFromAboveBalanceRestoresAllowance() (gas: 179363)\n[PASS] testRevertTransferFromToZeroRestoresAllowance() (gas: 114561)\n[PASS] testRevertTransferFromWithoutApproval() (gas: 57866)\n[PASS] testRevertTransferFromZeroEvenForZeroAmount() (gas: 35341)\n[PASS] testRevertTransferToZero() (gas: 47640)\n[PASS] testRevertTransferWithInsufficientBalanceIsAtomic() (gas: 120500)\n[PASS] testRevertZeroTransferToZero() (gas: 30457)\n[PASS] testSelfTransferPreservesBalance() (gas: 54037)\n[PASS] testTransferFromSpendsAllowanceAndEmitsTransfer() (gas: 173063)\n[PASS] testTransferFromToSelfSpendsAllowanceWithoutChangingBalance() (gas: 105697)\n[PASS] testTransferReturnsTrueAndEmitsEvent() (gas: 93505)\n[PASS] testTransferToContractRequiresNoReceiverCallback() (gas: 224454)\n[PASS] testZeroTransferFromEmptyAccountEmitsEvent() (gas: 73354)\n[PASS] testZeroTransferFromNeedsNoAllowance() (gas: 68930)\nSuite result: ok. 36 passed; 0 failed; 0 skipped; finished in 36.02ms (172.69ms CPU time)\n\nRan 1 test for test/PLEA.invariant.t.sol:PLEAInvariantTest\n[PASS]\nPLEAInvariantTest invariants:\n[PASS] invariantAllowancesMatchModel\n[PASS] invariantSupplyAndBalancesMatchModel\n PLEAInvariantTest invariants (runs: 128, calls: 8192, reverts: 0)\n\n╭-------------+--------------+-------+---------+----------╮\n| Contract    | Selector     | Calls | Reverts | Discards |\n+=========================================================+\n| PLEAHandler | approve      | 2784  | 0       | 0        |\n|-------------+--------------+-------+---------+----------|\n| PLEAHandler | transfer     | 2662  | 0       | 0        |\n|-------------+--------------+-------+---------+----------|\n| PLEAHandler | transferFrom | 2746  | 0       | 0        |\n╰-------------+--------------+-------+---------+----------╯\n\nLogs:\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 10000000000000000000\n  Bound result 9999999999900000001\n  Bound result 4294967294\n  Bound result 0\n  Bound result 0\n  Bound result 1027\n  Bound result 0\n  Bound result 0\n  Bound result 293\n  Bound result 1322\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 94\n  Bound result 19999999999999999999\n  Bound result 1\n  Bound result 1000000001\n  Bound result 0\n  Bound result 9\n  Bound result 8\n  Bound result 64\n  Bound result 12\n  Bound result 0\n  Bound result 4\n  Bound result 816\n  Bound result 1\n  Bound result 2\n  Bound result 2417087832\n  Bound result 9\n  Bound result 4065\n  Bound result 1089005588\n  Bound result 5\n  Bound result 506363200\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 3.43s (3.43s CPU time)\n\nRan 2 test suites in 3.44s (3.47s CPU time): 37 tests passed, 0 failed, 0 skipped (37 total tests)\n","passed":true},{"durationMs":68,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"PLEA.approve(address,uint256)\",\"PLEA.transfer(address,uint256)\",\"PLEA.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"DEPENDENCIES.md\":31,\"LICENSE\":21,\"README.md\":126,\"SECURITY.md\":52,\"foundry.toml\":21,\"remappings.txt\":2,\"src/PLEA.sol\":16,\"test/PLEA.invariant.t.sol\":107,\"test/PLEA.t.sol\":472},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true},{"durationMs":659,"exitCode":0,"name":"slither","output":"slither: no results at low impact or above","passed":true},{"durationMs":303,"exitCode":0,"name":"aderyn","output":"[low] large-numeric-literal at src/PLEA.sol:10: Large Numeric Literal","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"cc926a135e86ba06ae7b3c52fddfc6e88888fd9824089d9857565e7d3860fe74","verifiedTreeHash":"5d7c66ab60fc009c85b7f55317be47be0f1f112d","verifierVersion":"0.1.0+c78f45fe"}]}