{"assessments":[],"deployments":[],"fuzz":[],"identity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"interpretation":"Records acceptance and evidence. Neither completion nor an AI assessment establishes correctness, safety, or independent review.","jobId":"bcfcae94-645d-4378-b77f-ddfdbfd85c59","kind":"shape:chain","nodes":[{"acceptedSubmissionHash":"d7884eca112ad8af65d5172c9be256648c4f8e207e09563e60d7d86d1b52429a","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_economics","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"dbf5c39185193a950b6fe0175e0e9160a2919c494dcb9b0e5d5ab4b45bce0b4c","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_flow","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"5b9496d15ae703d8141c28c817edd4f399710ffee8879b539a98a54395c080fe","dependsOn":["build_contract_project","write_foundry_tests","manifest","audit_math","audit_permissions","audit_economics","audit_flow"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"af3aa01159bbf354f621cafa5c0006f6169e0938a8b015be508b7377dbf165bc","skillId":"audit-judge","tools":[]},"key":"audit_judge","kind":"code","role":"review","skillHash":"af3aa01159bbf354f621cafa5c0006f6169e0938a8b015be508b7377dbf165bc","skillId":"audit-judge","state":"accepted"},{"acceptedSubmissionHash":"8924ffbc75aea0f9bc3946c93bd7ab979d350dc9143f7fbe0f0df1d67f795e65","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_math","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"06a57f041e515959720293a4f851aaa3bf37c0c51f196482dc5be48fa99521ef","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_permissions","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"8f1442565e9d980064a6d6c36c1b1c1557827f2802fba63c69ae661c91e4dae2","dependsOn":[],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"d59561da3b378461b7c749f6bd5084477d44993aa94972ddea90f542535751df","skillId":"build-contract-project","tools":[]},"key":"build_contract_project","kind":"code","role":"implement","skillHash":"d59561da3b378461b7c749f6bd5084477d44993aa94972ddea90f542535751df","skillId":"build-contract-project","state":"accepted"},{"acceptedSubmissionHash":"abfd7b25fd4b279bbb01081804cbb8669d55a7b12f552022e7e997692f4242dd","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"tools":[]},"key":"manifest","kind":"code","role":"integrate","skillHash":null,"skillId":null,"state":"accepted"},{"acceptedSubmissionHash":"50ac9959a429242b954f42f6d6f4cec12ecf692d2e368df051bc762b1f73e6e7","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"4c76766b00591dfe982fe85d3de589fdb2f810e5137c301155d1c5e36a1d3b23","skillId":"write-foundry-tests","tools":[]},"key":"write_foundry_tests","kind":"code","role":"tests","skillHash":"4c76766b00591dfe982fe85d3de589fdb2f810e5137c301155d1c5e36a1d3b23","skillId":"write-foundry-tests","state":"accepted"}],"objective":"A custom token: Super IMD (SIMD).\nToken name: Super IMD\nToken symbol: SIMD\nToken supply: 1,000,000,000 with 18 decimals, all minted once to the deployer in the constructor.","parentJobId":null,"planHash":"e9e36504bc33215817e404b4b2c1141dff7b3d3249f18d6f730891cd5c008210","previousHash":"0000000000000000000000000000000000000000000000000000000000000000","projectId":"bcfcae94-645d-4378-b77f-ddfdbfd85c59","publication":{"commit":null,"deliveredAt":null,"repoUrl":"https://github.com/identity-md-launches/launch-2118-super-imd"},"receiptIdentity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"registry":"0xb6d0a187b050fa5bb0b87033a203f37becf4a775","research":[],"schema":"identitymd-work-v1","signals":[{"agentId":"52701","feedbackHash":"25e8018da79e9ac9b26f7b01ffe5b7e1ac822574b0fadf79243fb1284c4f5db1","nodeKey":"audit_economics","submissionHash":"d7884eca112ad8af65d5172c9be256648c4f8e207e09563e60d7d86d1b52429a","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"50959","feedbackHash":"5b8545ff0145a05d918d1c1d50b973d6143dfec5d607603b7b9d8bd0bde651cb","nodeKey":"audit_flow","submissionHash":"dbf5c39185193a950b6fe0175e0e9160a2919c494dcb9b0e5d5ab4b45bce0b4c","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"54229","feedbackHash":"295765e39a8e771ebf772236df8bdc4f61d5bdcfc233f9a977de790a2e276c4e","nodeKey":"audit_judge","submissionHash":"5b9496d15ae703d8141c28c817edd4f399710ffee8879b539a98a54395c080fe","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52482","feedbackHash":"f485d179875623fea1a3281662d60aac2c3666125d43be8d58b583cab617d30a","nodeKey":"audit_math","submissionHash":"8924ffbc75aea0f9bc3946c93bd7ab979d350dc9143f7fbe0f0df1d67f795e65","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51291","feedbackHash":"8385f0722766bbec039c176190aa339b9c20288bb6339792074e8025c1fa6267","nodeKey":"audit_permissions","submissionHash":"06a57f041e515959720293a4f851aaa3bf37c0c51f196482dc5be48fa99521ef","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52391","feedbackHash":"db39b2f03c43d172bdf4ece793b46f14d59a306b8a9a68109abcc1c07e1817ce","nodeKey":"build_contract_project","submissionHash":"8f1442565e9d980064a6d6c36c1b1c1557827f2802fba63c69ae661c91e4dae2","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"51066","feedbackHash":"364a3067e920540619429121d15813ab7f83e42f1244195cc125d076c09cf738","nodeKey":"manifest","submissionHash":"abfd7b25fd4b279bbb01081804cbb8669d55a7b12f552022e7e997692f4242dd","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"51301","feedbackHash":"2583b28c9efeb2d2fc74a391ba5c7a404d239dc1b344dee689105ae984007b9f","nodeKey":"write_foundry_tests","submissionHash":"50ac9959a429242b954f42f6d6f4cec12ecf692d2e368df051bc762b1f73e6e7","tag1":"verification:checks","tag2":"acceptance-v2","value":1}],"site":null,"snapshotHash":"849199aaa902674b20fc440dc1d31f1609a5c9982d804235f9643e4c7540169f","state":"completed","submissions":[{"artifacts":[],"attempt":1,"bundleHash":null,"device":"bd7adba3a8045853","findings":[],"hash":"06a57f041e515959720293a4f851aaa3bf37c0c51f196482dc5be48fa99521ef","nodeId":"9a8cce00-1c5c-42c3-8a91-13075bd632b0","outcome":"completed","summary":"The review is complete. No defects were found in the assigned area, and the findings file records that with a full coverage record.\n\n**Result:** `.imd-findings.json` holds an empty findings list and eight coverage rows, one per listed entry point plus the constructor, launch flows, vendored dependencies and paired-function symmetry. The working tree is otherwise unchanged. The scratch tests were removed.\n\n**What was checked**\n\n- **Access control.** The compiled ABI exposes only `approve`, `permit`, `transfer` and `transferFrom` as state-changing functions. There is no owner, mint, pause, blocklist, receive or fallback, and the runtime contains no DELEGATECALL, CALLCODE or SELFDESTRUCT. Each function writes only the caller's own balance or allowance row. The deployer, the most trusted address, cannot pull from or freeze another holder.\n- **Trust gap.** The constructor takes no arguments, mints 1e27 once to its deployer and assigns no role. With no fee or exemption logic, every launch flow moves exactly its amount, so the factory, distributor, pool manager and traders are all treated alike. Supply and decimals match the manifest values in the README.\n- **Dependency integrity.** The vendored OpenZeppelin contracts and forge-std sources were diffed byte-for-byte against the upstream v5.4.0 and v1.9.7 release tarballs. No file differs, so the ERC20, ERC20Permit, ECDSA, EIP712 and Nonces code is the audited upstream code.\n- **Asymmetry.** `approve` and `permit` share the same internal write and event. `transfer` and `transferFrom` share the same balance update. The mint path uses the same update with a zero sender. No branch skips validation or writes a slot its pair does not.\n- **Edge cases run in a scratch suite.** High-s permit variants, a zero-address owner, cross-chain replay, third-party relaying, ETH sent to the token, unknown selectors, and exact allowance consumption all behaved as intended. The project's own 38 tests also pass, including the invariant suite.\n\n**Noted but not reported as defects.** Permit relaying by a third party and the un-decremented infinite allowance are standard ERC-2612 and OpenZeppelin behaviours, already documented in the README. The aderyn large-literal lead on line 28 is a style note. The supply constant evaluates correctly to 1e27.","treeHash":null,"usage":{"cachedInputTokens":564118,"inputTokens":226,"model":"claude-fable-5-1","outputTokens":11255,"runtime":"claude","turns":21,"wallClockMs":183612}},{"artifacts":[],"attempt":1,"bundleHash":"c8a26936848ad2b616ff11ea245c00492079182d1f9a23211ca46e6f21a9e340","device":"f0ca4c17025726f8","findings":[],"hash":"50ac9959a429242b954f42f6d6f4cec12ecf692d2e368df051bc762b1f73e6e7","nodeId":"8cca255a-65e7-4d6a-ab44-0646ad8b278d","outcome":"completed","summary":"Completed changes only under `test/`.\n\n- Added 33 tests covering boundary values, failure rollback, allowances, and permit signatures.\n- Expanded to six invariants across 16,384 randomized calls.\n- Offline `forge build` and `forge test` pass with the supplied seed: **71 passed, 0 failed**.\n\nNo implementation defects were found.","treeHash":"d4c733330d87b5ab6dcde573f45606fda8f785b3","usage":{"cachedInputTokens":1134464,"inputTokens":92207,"model":"gpt-6-astra","outputTokens":21980,"runtime":"codex","turns":6,"wallClockMs":541203}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"0ef0dfae5a05e4be","findings":[],"hash":"5b9496d15ae703d8141c28c817edd4f399710ffee8879b539a98a54395c080fe","nodeId":"a5ec07b7-82ed-4484-9939-5171933ed09c","outcome":"completed","summary":"The review is complete. The findings file holds an empty list and a full coverage record, and the working tree is otherwise untouched.\n\n**Outcome:** no defects found in the SuperIMD token. The one specialist finding, from the flow area, was reproduced and dropped as not a defect.\n\n**What I checked**\n\n- **The code is a bare OpenZeppelin v5.4.0 ERC20 plus ERC20Permit** with a no-argument constructor that mints the whole 1e27 supply to the deployer. There is no owner, mint, pause, blocklist, fee, hook or override beyond `decimals()`.\n- **The vendored OpenZeppelin library is byte-identical to upstream v5.4.0.** I diffed it against a fresh clone, so the inherited `approve`, `permit`, `transfer` and `transferFrom` behave exactly as the audited upstream.\n- **Deployability holds.** Zero constructor parameters match the manifest's empty constructorArgs, the constructor makes no external call, and creation and runtime sizes are far under the protocol limits. The runtime contains no DELEGATECALL, CALLCODE or SELFDESTRUCT.\n- **The manifest matches the source.** Name, symbol, decimals and totalSupply in launch.json agree with the constants in the contract, and addresses are lowercase strings in the schema's shape.\n- **The project's own suite passes.** Build with solc 0.8.26 and all 71 tests passed, including the invariant and permit suites. The protected launch tests cannot run here because their Uniswap v4 harness is not in this tree, but a fee-free token with no exemptions satisfies every assertion in them by inspection.\n\n**The dropped specialist finding.** The flow specialist reported that a stranger can submit a holder's signed permit first, causing the intended relayer's identical submission to revert. I reproduced this in a scratch test and it behaves exactly as described. The allowance still ends at the signed value and the nonce advances once, so nothing is lost and no state is wrong. That is the documented ERC-2612 property, and the mitigation belongs to integrators, so it does not reopen the author's work.\n\n**Coverage:** all four entry points are marked holds, with four additional rows for the fixed-supply, deployability, unmodified-dependency and test-suite invariants.","treeHash":null,"usage":{"cachedInputTokens":380831,"inputTokens":258,"model":"claude-fable-5-1","outputTokens":6272,"runtime":"claude","turns":9,"wallClockMs":305987}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"e8e860c7f2306473","findings":[],"hash":"8924ffbc75aea0f9bc3946c93bd7ab979d350dc9143f7fbe0f0df1d67f795e65","nodeId":"05bc2a28-8acb-4e26-8aa6-5fe1fc98be02","outcome":"completed","summary":"Review complete. The Math Precision, Boundary and Numerical Gap pass over Super IMD (SIMD) found no defects, and `.imd-findings.json` holds an empty findings list with a nine-row coverage record (all four listed entry points plus five invariants, every row `holds`).\n\n**What I checked**\n\n- **Math precision.** The only arithmetic in `src/SuperIMD.sol` is the supply constant on line 28. It compiles to exactly 1e27 minor units, which matches the README and the manifest value, and sits far below the uint256 ceiling. The aderyn \"large numeric literal\" lead is therefore not a defect. All balance and allowance math is OpenZeppelin's, whose unchecked blocks are bounded by a total supply that can never grow after the constructor.\n- **Boundary.** The token makes no external calls, has no payable, receive or fallback path, and decodes no bytes. I exercised the edges from the guide in a scratch Foundry suite: zero and max amounts, self-transfer of the whole balance, transferFrom from the zero address, infinite versus max-minus-one allowances, permit at the exact deadline and one second past it, high-s and v in {0,1} signatures, wrong nonce, zero owner or spender, max value with max deadline, and a chain-id change. Every case either succeeds with the exact amount or reverts with the expected OpenZeppelin error. Nonces are not consumed on a reverted permit.\n- **Numerical gap.** There are no divisions, fees or scaled formulas, so no precision-by-invariant seam exists. The supply-conservation invariant held under fuzzing, including self-transfers and dust, and the project's own invariant suite ran clean.\n- **Dependency integrity.** Every vendored OpenZeppelin file in the inheritance chain compares byte-identical to the upstream v5.4.0 tag, so the audited behaviour is the published library's.\n\n**Observations, not defects**\n\n- `permit` can be front-run by anyone relaying the same signature, which makes a bundled second call revert. This is inherent to ERC-2612 and the allowance still lands as signed.\n- Tokens sent to the token contract itself are unrecoverable, as the README already states.\n\nThe scratch tests were deleted and the working tree is unchanged apart from the findings file. Existing test suites still pass with the verifier's fuzz seed.","treeHash":null,"usage":{"cachedInputTokens":706625,"inputTokens":290,"model":"claude-fable-5-1","outputTokens":14625,"runtime":"claude","turns":26,"wallClockMs":202799}},{"artifacts":[],"attempt":1,"bundleHash":"ca49dff279fafed757eb0c3d444e1541c5c5dad5e36cf1c37261a696a3733666","device":"743b05d8a235188d","findings":[],"hash":"8f1442565e9d980064a6d6c36c1b1c1557827f2802fba63c69ae661c91e4dae2","nodeId":"72cdf175-648e-47e3-93a5-1f4fad18d31c","outcome":"completed","summary":"The work is complete and committed.\n\n**Delivered: Super IMD (SIMD)**, a fixed-supply ERC-20 in a root-level Foundry project.\n\n- `src/SuperIMD.sol` is the token. The contract name is `SuperIMD`, with `name()` \"Super IMD\", `symbol()` \"SIMD\", 18 decimals, and a total supply of 1e27 minor units minted once to `msg.sender` in a zero-argument constructor. It inherits OpenZeppelin v5.4.0 ERC20 and ERC20Permit only. There is no owner, mint, pause, blocklist, fee or upgrade path, so no transfer rule can interfere with the factory's payout, the distributor's claims, or pool swaps.\n- `foundry.toml` pins solc 0.8.26, sets `bytecode_hash = \"none\"` and `cbor_metadata = false`, and disables ffi and filesystem access. The built artifact has no constructor inputs, no link references and no metadata tail.\n- Dependencies are vendored as plain files under `lib/` (forge-std v1.9.7 source and OpenZeppelin's `contracts/` directory). No submodules, no `.git` directories inside `lib/`.\n- `script/Deploy.s.sol` is a local helper only. Its `deploy()` function is called directly by a test, and `run()` reads nothing from the environment.\n- `README.md` documents the assumptions, the launch's deployment parameters, the \"After launch\" section (nothing to configure), operational responsibilities for the requester, the IdentityMD deployer and holders, and the security checklist items that were applied.\n\n**Checks run from a clean build**\n\n| Check | Result |\n|-------|--------|\n| `forge build` | passes |\n| `forge test` with the verifier's fuzz seed | 38 tests pass, 0 fail |\n| `forge fmt --check` | passes |\n\nTests cover metadata, the one-time mint to whichever address deploys, exact transfers and failure cases, allowances including infinite allowance, permit success, replay, expiry and wrong-signer failure, absence of every mint and privileged selector the protected floor probes, a bytecode scan for DELEGATECALL, CALLCODE and SELFDESTRUCT, the launch payout flows against a CREATE2 factory stand-in, and two invariants for supply conservation. Tests read no environment variables and pass in any order.\n\nSlither and Mythril are not installed on this machine and did not run; the README says so. The commit includes only the project paths, not the harness dotfiles or `.claude/`.","treeHash":"09382c2d924a63a6ac78d072e2926c1e97a6d9df","usage":{"cachedInputTokens":910207,"inputTokens":482,"model":"claude-fable-5-1","outputTokens":23690,"runtime":"claude","turns":26,"wallClockMs":301163}},{"artifacts":[],"attempt":1,"bundleHash":"ff7268ec0c93ffee9d5f22de29a75f869f5c71257d07e843c4264422c920f24a","device":"a9158e223bd79f25","findings":[],"hash":"abfd7b25fd4b279bbb01081804cbb8669d55a7b12f552022e7e997692f4242dd","nodeId":"3e2fc78e-a2bc-4f8f-99fd-5395056b538a","outcome":"completed","summary":"Created [launch.json](/home/imd-worker/.identitymd/work/bcfcae94-645d-4378-b77f-ddfdbfd85c59/3e2fc78e-a2bc-4f8f-99fd-5395056b538a/launch.json) matching SuperIMD’s constructor, supply, and exact pool/economics values.\n\n`forge build` succeeded; all 38 repository tests passed with the supplied fuzz seed. Only `launch.json` is changed for submission.","treeHash":"d3c181511461c7fa11deca28063bd8a7df65acdd","usage":{"cachedInputTokens":192768,"inputTokens":28139,"model":"gpt-6-astra","outputTokens":2318,"runtime":"codex","turns":3,"wallClockMs":64850}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"aac006f7fc669006","findings":[],"hash":"d7884eca112ad8af65d5172c9be256648c4f8e207e09563e60d7d86d1b52429a","nodeId":"d3fb0cce-8aa6-4771-8eba-d7d96db3246b","outcome":"completed","summary":"I found no defects in `SuperIMD` in the economics area (the Economic Security, Invariant and Flow Gap guides), so `.imd-findings.json` has an empty findings list and one coverage row for each of the four entry points.\n\n**What was checked**\n- **Source:** `src/SuperIMD.sol` is a plain OpenZeppelin ERC-20 with permit. There are no constructor arguments, and `decimals()` returns 18. The constructor mints 1,000,000,000 × 10¹⁸ (1e27, matching the brief) to `msg.sender`, which is the factory.\n- **No extra powers:** there is no owner, mint, burn, pause, fee, hook or change to the transfer logic. Nothing can add supply after deployment, and no privileged party can move or freeze anyone's balance.\n- **Libraries:** the vendored OpenZeppelin `contracts/` folder is identical to the official v5.4.0 release; I compared it file by file against a fresh copy. So the transfer, allowance, permit and signature code is the audited upstream code.\n- **Economic Security:** the token has no fee, rebasing, blocklist or pause, and no external calls. Any contract that counts on receiving the amount sent gets exactly that amount. It does not depend on any outside contract or price feed, and there is no fee formula to push to an extreme.\n- **Invariant:** the sum of all balances always equals the total supply, which stays at 1e27, because nothing mints after the constructor. A failed transfer or `transferFrom` changes nothing. Permit nonces are used once and checked against a deadline, and the signature domain is rebuilt if the chain id changes.\n- **Flow Gap:** the launch payouts (10% to the distributor, 80% to seed the pool through the PoolManager, the rest to `remainderTo`), claims and trades all move exactly the stated amount. No combination of call sequence and outside contract leads to an outcome the launch doesn't intend.\n- **Tests:** the repo's 38 tests pass, including the invariant suite. The protected launch-flow tests could not be run here: they need floor files and settings that are not in this tree.\n\n**Coverage record:** `approve`, `permit`, `transfer` and `transferFrom` are all marked `holds`. I added three more rows for checks I ran: supply conservation, mint-to-factory with 18 decimals, and the launch flows arriving in full.\n\n**Leads I didn't report as findings**\n- The aderyn \"large numeric literal\" note at line 28 is just the supply constant and is not a defect.\n- The standard ERC-20 approve race and permit front-running are known traits of the standard, not defects in this code.\n- Tokens sent to the token's own address are stuck; that's by design and already in the README.\n\nI changed no repository files. The only file written is `.imd-findings.json`; the upstream copy I compared against is in `/tmp`.","treeHash":null,"usage":{"cachedInputTokens":355711,"inputTokens":16,"model":"claude-opus-5-5","outputTokens":4558,"runtime":"claude","turns":8,"wallClockMs":81515}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"468e82a89b9bfe18","findings":[{"citation":"resolved","description":"SuperIMD inherits OpenZeppelin v5.4.0 ERC20Permit unchanged. permit() is callable by anyone holding a valid signature: the first submission consumes the owner's nonce and sets the allowance; any later submission of the same (owner, spender, value, deadline, v, r, s) recovers a different signer (the nonce is now 1) and reverts with ERC2612InvalidSigner. A mempool observer can therefore copy a signed permit out of a pending transaction and submit it first. The allowance still ends up exactly as the owner signed it, so no funds move and no state is wrong; but a contract that does `token.permit(...); token.transferFrom(...)` in one call reverts entirely and the user's action fails. This is the documented ERC-2612 property, not a defect in this contract, and the brief did not ask for permit at all. Reported so the author can (a) state in the README that integrators must call permit inside try/catch or check allowance first, or (b) drop ERC20Permit if an unrequested entry point is unwanted. No code change in the token is required; OpenZeppelin's own guidance is that the mitigation belongs to the caller.","line":17,"path":"src/SuperIMD.sol","reproduction":"State: token deployed; owner O (key k) holds nothing special. 1) O signs Permit(owner=O, spender=S, value=1e18, nonce=0, deadline=now+1h) over DOMAIN_SEPARATOR(). 2) Stranger X calls token.permit(O, S, 1e18, deadline, v, r, s) -> succeeds, allowance(O,S) == 1e18, nonces(O) == 1. 3) S (the intended relayer) calls token.permit(O, S, 1e18, deadline, v, r, s) with the same bytes -> reverts (ERC2612InvalidSigner: recovered address != O because the struct hash now uses nonce 1). Expected by S: permit succeeds and its bundled transferFrom runs; actual: the whole transaction reverts. Verified locally in a scratch Foundry test (test_permitFrontRunRevertsSecondSubmitter) that was removed afterwards; the two calls above are the complete sequence.","severity":"info","snippet":"contract SuperIMD is ERC20, ERC20Permit {","title":"ERC-2612 permit can be front-run by a stranger, reverting the intended relayer's transaction (inherent to permit; integrators must wrap permit in try/catch)"}],"hash":"dbf5c39185193a950b6fe0175e0e9160a2919c494dcb9b0e5d5ab4b45bce0b4c","nodeId":"36c840b5-21da-45b0-98c7-a218125c3e36","outcome":"completed","summary":"Review complete. The findings file is written and the tree is otherwise unchanged.\n\n**Outcome:** no defects in the token. `src/SuperIMD.sol` is a 40-line wrapper over unmodified OpenZeppelin v5.4.0 `ERC20` and `ERC20Permit`, with one constructor mint of exactly 1e27 to `msg.sender` and no other state-changing code of its own. All four verifier-listed entry points hold.\n\n**What I checked, per the three assigned guides**\n\n- **Execution Trace:** traced `approve`, `transfer`, `transferFrom` and `permit` from calldata to storage. Zero-address receiver and spender revert with typed errors, balances and allowances are checked before writes, infinite allowance is never decremented, and the nonce is consumed before signature recovery in `permit`. No partial state, no stale reads, no sentinel paths.\n- **Periphery:** diffed every vendored OpenZeppelin file the token pulls in against the local 5.7.0 mirror. Only version headers, import order, comments and later-version additions differ, so the library is genuine 5.4.0 with no local edits. ECDSA rejects high-s and bad v; EIP-712 name fits a ShortString so the constructor cannot revert.\n- **First Principles:** the brief's assumptions (fixed supply, mint once to deployer, no owner, no fee) all hold. `_mint`/`_update` are never exposed, there is no owner or admin surface, runtime bytecode is 4,139 bytes with no DELEGATECALL, CALLCODE or SELFDESTRUCT, and the launch flows (factory → distributor → claimant, pool round trip) move exact amounts.\n\n**Static analysis leads:** Slither reported nothing. The aderyn \"large numeric literal\" at line 28 evaluates to exactly 1e27, confirmed by the existing tests, so it is not a finding.\n\n**One info-level finding recorded:** the inherent ERC-2612 property that anyone who sees a signed permit in the mempool can submit it first, making the intended relayer's bundled call revert. Allowance still lands exactly as signed and no funds move. I reproduced it locally with a scratch test (since deleted) and noted that the mitigation belongs to integrators, or the author may drop `ERC20Permit` since the brief never asked for it.\n\n**Coverage record:** 8 rows, all four ABI entry points plus the constructor, the supply invariant, the vendored library and the deploy script. None unreached.","treeHash":null,"usage":{"cachedInputTokens":811091,"inputTokens":290,"model":"claude-fable-5-1","outputTokens":11710,"runtime":"claude","turns":20,"wallClockMs":187740}}],"verification":[{"checks":[{"durationMs":1868,"exitCode":0,"name":"build","output":"Compiling 47 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.80s\nCompiler run successful!\n","passed":true},{"durationMs":8896,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 7 tests for test/LaunchFlow.t.sol:LaunchFlowTest\n[PASS] test_create2AddressIsPredictableFromCreationCode() (gas: 43289)\n[PASS] test_factoryCannotPayMoreThanTheSupply() (gas: 50076)\n[PASS] test_fullPayoutSplitsSupplyExactly() (gas: 230550)\n[PASS] test_poolRoundTripMovesExactAmounts() (gas: 187248)\n[PASS] test_supplyCannotGrowAfterLaunch() (gas: 38311)\n[PASS] test_supplyIsMintedToTheFactoryOnly() (gas: 33499)\n[PASS] test_swarmShareArrivesWholeAndIsClaimableWhole() (gas: 159771)\nSuite result: ok. 7 passed; 0 failed; 0 skipped; finished in 74.57ms (1.03ms CPU time)\n\nRan 16 tests for test/SuperIMD.permit.t.sol:SuperIMDPermitTest\n[PASS] testFuzz_changingSignedFieldsCannotAuthorize(uint256,uint8) (runs: 1000, μ: 407444, ~: 407851)\nLogs:\n  Bound result 2\n\n[PASS] testFuzz_permitAuthorizesOnlySpenderAndExactAmount(uint256,uint256) (runs: 1000, μ: 354214, ~: 356131)\nLogs:\n  Bound result 0\n\n[PASS] test_chainChangeRebuildsDomainAndRejectsOldSignature() (gas: 390732)\n[PASS] test_domainIntrospectionDescribesSignedData() (gas: 25891)\n[PASS] test_expiredPermitPreservesNonceAndExistingApproval() (gas: 334758)\n[PASS] test_futureNonceCannotSkipAuthorizationSequence() (gas: 402861)\n[PASS] test_invalidVAndEmptySignatureDoNotConsumeNonce() (gas: 519838)\n[PASS] test_malleatedHighSSignatureIsRejected() (gas: 349774)\n[PASS] test_ordinaryApprovalAndTransferDoNotConsumePermitNonce() (gas: 235222)\n[PASS] test_permitAtExactDeadlineEmitsApproval() (gas: 187228)\n[PASS] test_permitCanRevokeInfiniteApproval() (gas: 356758)\n[PASS] test_replayCannotRestoreSpentAllowance() (gas: 220933)\n[PASS] test_signatureCannotBeReplayedOnAnotherDeployment() (gas: 400363)\n[PASS] test_wrongSignerPreservesNonceAndExistingApproval() (gas: 177695)\n[PASS] test_zeroOwnerCannotBeAuthorizedByMalformedSignature() (gas: 193101)\n[PASS] test_zeroSpenderRevertsAndRollsBackNonce() (gas: 367960)\nSuite result: ok. 16 passed; 0 failed; 0 skipped; finished in 74.55ms (152.77ms CPU time)\n\nRan 30 tests for test/SuperIMD.t.sol:SuperIMDTest\n[PASS] testFuzz_transferAboveBalanceReverts(uint256,uint256) (runs: 1000, μ: 99869, ~: 100273)\nLogs:\n  Bound result 15\n  Bound result 10000\n\n[PASS] testFuzz_transferConservesSupply(address,uint256) (runs: 1000, μ: 98243, ~: 98366)\nLogs:\n  Bound result 377950217309917699919192680704361675403603495342\n  Bound result 389008144071170924148354737\n\n[PASS] testFuzz_transferFromWithinAllowance(uint256,uint256) (runs: 1000, μ: 157091, ~: 159081)\nLogs:\n  Bound result 1000000\n  Bound result 999901\n\n[PASS] test_approveRevertsForZeroSpender() (gas: 32973)\n[PASS] test_approveSetsAllowanceAndEmits() (gas: 68147)\n[PASS] test_constructorEmitsSingleMintTransfer() (gas: 26622)\n[PASS] test_constructorMintsToWhoeverDeploys() (gas: 196386)\n[PASS] test_constructorMintsWholeSupplyToDeployer() (gas: 42088)\n[PASS] test_deployScriptFunctionDeploysTheToken() (gas: 2463354)\n[PASS] test_domainSeparatorBindsChainAndAddress() (gas: 8941)\n[PASS] test_metadata() (gas: 59229)\n[PASS] test_noMintOrAdminEntryPointExists() (gas: 601029)\n[PASS] test_noPrivilegedCallMovesOrFreezesAHolder() (gas: 455016)\n[PASS] test_permitCannotBeReplayed() (gas: 134723)\n[PASS] test_permitGrantsAllowance() (gas: 121658)\n[PASS] test_permitRevertsForWrongSigner() (gas: 84520)\n[PASS] test_permitRevertsWhenExpired() (gas: 49922)\n[PASS] test_runtimeHasNoDelegatecallCallcodeOrSelfdestruct() (gas: 5277455)\n[PASS] test_supportsIERC20Interface() (gas: 21052)\n[PASS] test_transferFromInfiniteAllowanceIsNotDecremented() (gas: 123340)\n[PASS] test_transferFromRevertsAboveAllowance() (gas: 87999)\n[PASS] test_transferFromRevertsWhenOwnerLacksBalance() (gas: 91620)\n[PASS] test_transferFromRevertsWithoutAllowance() (gas: 40387)\n[PASS] test_transferFromSpendsAllowance() (gas: 153968)\n[PASS] test_transferMovesExactAmount() (gas: 96057)\n[PASS] test_transferOfWholeSupplyThenNothingLeft() (gas: 113180)\n[PASS] test_transferRevertsOnInsufficientBalance() (gas: 37862)\n[PASS] test_transferRevertsToZeroAddress() (gas: 32877)\n[PASS] test_transferToSelfKeepsBalance() (gas: 43449)\n[PASS] test_transferZeroAmountSucceeds() (gas: 47744)\nSuite result: ok. 30 passed; 0 failed; 0 skipped; finished in 74.54ms (236.89ms CPU time)\n\nRan 17 tests for test/SuperIMD.edges.t.sol:SuperIMDEdgeTest\n[PASS] testFuzz_approveReplacesRatherThanAdds(uint256,uint256) (runs: 1000, μ: 204172, ~: 204285)\n[PASS] testFuzz_insufficientAllowanceLeavesStateUnchanged(uint256,uint256) (runs: 1000, μ: 133461, ~: 133833)\nLogs:\n  Bound result 804867714838946673119779453\n  Bound result 863923033788831927987055266\n\n[PASS] testFuzz_insufficientBalanceRollsBackAllowance(uint256,uint256,uint256) (runs: 1000, μ: 210925, ~: 211228)\nLogs:\n  Bound result 2319\n  Bound result 5000000000000000000\n  Bound result 115792089237316195423570985008687907853269984665640564039452584007913129639951\n\n[PASS] testFuzz_invalidReceiverRollsBackAllowance(uint256,uint256) (runs: 1000, μ: 132086, ~: 132422)\nLogs:\n  Bound result 15\n  Bound result 10000\n\n[PASS] testFuzz_roundTripRestoresBalances(uint256) (runs: 1000, μ: 123670, ~: 123501)\nLogs:\n  Bound result 17011\n\n[PASS] testFuzz_splittingTransferDoesNotChangeAmountReceived(uint256,uint256) (runs: 1000, μ: 198034, ~: 199386)\nLogs:\n  Bound result 243249975261\n  Bound result 67372116713\n\n[PASS] test_approvalIsScopedToBothOwnerAndSpender() (gas: 273556)\n[PASS] test_exhaustedAllowanceCannotBeSpentAgain() (gas: 170203)\n[PASS] test_maxMinusOneAllowanceIsFinite() (gas: 136989)\n[PASS] test_maxUintTransferRevertsWithoutMovingTokens() (gas: 65438)\n[PASS] test_oneWeiTransferIsExact() (gas: 91544)\n[PASS] test_ownerCallingTransferFromMustApproveItself() (gas: 166887)\n[PASS] test_revocationStopsPreviouslyApprovedSpender() (gas: 199829)\n[PASS] test_selfTransferStillRequiresSufficientBalance() (gas: 89062)\n[PASS] test_transferFromToOwnerConsumesAllowanceWithoutMovingBalance() (gas: 128853)\n[PASS] test_zeroAmountsDoNotBypassInvalidReceiverOrSpenderChecks() (gas: 99784)\n[PASS] test_zeroTransfersEmitEvenWithoutBalanceOrAllowance() (gas: 137449)\nSuite result: ok. 17 passed; 0 failed; 0 skipped; finished in 74.57ms (431.01ms CPU time)\n\nRan 1 test for test/SuperIMD.invariant.t.sol:SuperIMDInvariantTest\n[PASS]\nSuperIMDInvariantTest invariants:\n[PASS] invariant_allowancesMatchApprovalsPermitsAndSpending\n[PASS] invariant_balancesSumToSupply\n[PASS] invariant_eachBalanceMatchesAuthorizedTransfers\n[PASS] invariant_onlySuccessfulPermitsConsumeNonces\n[PASS] invariant_totalSupplyIsConstant\n[PASS] invariant_zeroAddressNeverHoldsTokens\n SuperIMDInvariantTest invariants (runs: 256, calls: 16384, reverts: 0)\n\n╭--------------+----------------------------------+-------+---------+----------╮\n| Contract     | Selector                         | Calls | Reverts | Discards |\n+==============================================================================+\n| TokenHandler | approve                          | 1726  | 0       | 0        |\n|--------------+----------------------------------+-------+---------+----------|\n| TokenHandler | permit                           | 1844  | 0       | 0        |\n|--------------+----------------------------------+-------+---------+----------|\n| TokenHandler | rejectTransferAboveBalance       | 1840  | 0       | 0        |\n|--------------+----------------------------------+-------+---------+----------|\n| TokenHandler | rejectTransferFromAboveAllowance | 1844  | 0       | 0        |\n|--------------+----------------------------------+-------+---------+----------|\n| TokenHandler | rejectTransferFromAboveBalance   | 1821  | 0       | 0        |\n|--------------+----------------------------------+-------+---------+----------|\n| TokenHandler | rejectZeroReceiver               | 1859  | 0       | 0        |\n|--------------+----------------------------------+-------+---------+----------|\n| TokenHandler | rejectZeroSpender                | 1798  | 0       | 0        |\n|--------------+----------------------------------+-------+---------+----------|\n| TokenHandler | transfer                         | 1838  | 0       | 0        |\n|--------------+----------------------------------+-------+---------+----------|\n| TokenHandler | transferFrom                     | 1814  | 0       | 0        |\n╰--------------+----------------------------------+-------+---------+----------╯\n\nLogs:\n  Bound result 166666666666666666666666667\n  Bound result 166666666666666666666666667\n  Bound result 166666666666666666666666667\n  Bound result 166666666666666666666666667\n  Bound result 166666666666666666666666667\n  Bound result 782730039206205329214808828\n  Bound result 115792089237316195423570985008687907853269984665640397372790917341246462973292\n  Bound result 115792089237316195423570985008687907853269984665640397372790917341246462973310\n  Bound result 3\n  Bound result 115792089237316195423570985008687907853269984665640397372790917341246462978688\n  Bound result 6099\n  Bound result 65557263510622589601368831999956341799100627913\n  Bound result 115792089237316195423570985008687907853269984665640397372790917341246462973283\n  Bound result 249330526039968799641123173452670317895737160237467003014487\n  Bound result 8208\n  Bound result 115792089237316195423570985008687907853269984665640397372790917341246462983270\n  Bound result 679770114076198426957360827\n  Bound result 1305\n  Bound result 192911112194979\n  Bound result 8567\n  Bound result 165033881274979347965358315113167978494804820648704\n  Bound result 276589204752902105913551485852512\n  Bound result 115792089237316195423570985008687907853269984665640397372790917341246462973364\n  Bound result 684831254781382325029624772\n  Bound result 283643508220295739459853619127590588\n  Bound result 947\n  Bound result 115792089237316195423570985008687907853269984665640230706124250674580622357545\n  Bound result 10191\n  Bound result 115792089237316195423570985008687907853269984665640397372790917341246462981930\n  Bound result 904382605163141518161494337\n  Bound result 8297\n  Bound result 115792089237316195423570985008687907853269984665640397372790917341246462983156\n  Bound result 115792089237316195423570985008687907853269984665640397372790917341246462980550\n  Bound result 593460050705813683842631739\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 8.82s (8.81s CPU time)\n\nRan 5 test suites in 8.82s (9.11s CPU time): 71 tests passed, 0 failed, 0 skipped (71 total tests)\n","passed":true},{"durationMs":38,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"SuperIMD.approve(address,uint256)\",\"SuperIMD.permit(address,address,uint256,uint256,uint8,bytes32,bytes32)\",\"SuperIMD.transfer(address,uint256)\",\"SuperIMD.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":11,\"README.md\":119,\"foundry.toml\":35,\"remappings.txt\":2,\"script/Deploy.s.sol\":25,\"src/SuperIMD.sol\":40,\"test/LaunchFlow.t.sol\":111,\"test/README.md\":39,\"test/SuperIMD.edges.t.sol\":240,\"test/SuperIMD.invariant.t.sol\":260,\"test/SuperIMD.permit.t.sol\":278,\"test/SuperIMD.t.sol\":390,\"test/helpers/SIMDPermitSigning.sol\":60},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"50ac9959a429242b954f42f6d6f4cec12ecf692d2e368df051bc762b1f73e6e7","verifiedTreeHash":"d4c733330d87b5ab6dcde573f45606fda8f785b3","verifierVersion":"0.1.0+c3fba9eb"},{"checks":[{"durationMs":1330,"exitCode":0,"name":"build","output":"Compiling 44 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.25s\nCompiler run successful!\n","passed":true},{"durationMs":270,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 7 tests for test/LaunchFlow.t.sol:LaunchFlowTest\n[PASS] test_create2AddressIsPredictableFromCreationCode() (gas: 43289)\n[PASS] test_factoryCannotPayMoreThanTheSupply() (gas: 50076)\n[PASS] test_fullPayoutSplitsSupplyExactly() (gas: 230550)\n[PASS] test_poolRoundTripMovesExactAmounts() (gas: 187248)\n[PASS] test_supplyCannotGrowAfterLaunch() (gas: 38311)\n[PASS] test_supplyIsMintedToTheFactoryOnly() (gas: 33499)\n[PASS] test_swarmShareArrivesWholeAndIsClaimableWhole() (gas: 159771)\nSuite result: ok. 7 passed; 0 failed; 0 skipped; finished in 1.22ms (1.13ms CPU time)\n\nRan 30 tests for test/SuperIMD.t.sol:SuperIMDTest\n[PASS] testFuzz_transferAboveBalanceReverts(uint256,uint256) (runs: 256, μ: 99826, ~: 100278)\nLogs:\n  Bound result 999999999999999999999999996\n  Bound result 999999999999999999999999998\n\n[PASS] testFuzz_transferConservesSupply(address,uint256) (runs: 256, μ: 97648, ~: 97923)\nLogs:\n  Bound result 4202047189\n\n[PASS] testFuzz_transferFromWithinAllowance(uint256,uint256) (runs: 256, μ: 157146, ~: 159093)\nLogs:\n  Bound result 1002\n  Bound result 976\n\n[PASS] test_approveRevertsForZeroSpender() (gas: 32973)\n[PASS] test_approveSetsAllowanceAndEmits() (gas: 68147)\n[PASS] test_constructorEmitsSingleMintTransfer() (gas: 22256)\n[PASS] test_constructorMintsToWhoeverDeploys() (gas: 196386)\n[PASS] test_constructorMintsWholeSupplyToDeployer() (gas: 42088)\n[PASS] test_deployScriptFunctionDeploysTheToken() (gas: 2463184)\n[PASS] test_domainSeparatorBindsChainAndAddress() (gas: 8941)\n[PASS] test_metadata() (gas: 58889)\n[PASS] test_noMintOrAdminEntryPointExists() (gas: 601029)\n[PASS] test_noPrivilegedCallMovesOrFreezesAHolder() (gas: 455016)\n[PASS] test_permitCannotBeReplayed() (gas: 134723)\n[PASS] test_permitGrantsAllowance() (gas: 121658)\n[PASS] test_permitRevertsForWrongSigner() (gas: 84520)\n[PASS] test_permitRevertsWhenExpired() (gas: 49922)\n[PASS] test_runtimeHasNoDelegatecallCallcodeOrSelfdestruct() (gas: 5277455)\n[PASS] test_supportsIERC20Interface() (gas: 21052)\n[PASS] test_transferFromInfiniteAllowanceIsNotDecremented() (gas: 123340)\n[PASS] test_transferFromRevertsAboveAllowance() (gas: 87999)\n[PASS] test_transferFromRevertsWhenOwnerLacksBalance() (gas: 91620)\n[PASS] test_transferFromRevertsWithoutAllowance() (gas: 40387)\n[PASS] test_transferFromSpendsAllowance() (gas: 153968)\n[PASS] test_transferMovesExactAmount() (gas: 96057)\n[PASS] test_transferOfWholeSupplyThenNothingLeft() (gas: 113180)\n[PASS] test_transferRevertsOnInsufficientBalance() (gas: 37862)\n[PASS] test_transferRevertsToZeroAddress() (gas: 32877)\n[PASS] test_transferToSelfKeepsBalance() (gas: 43449)\n[PASS] test_transferZeroAmountSucceeds() (gas: 47744)\nSuite result: ok. 30 passed; 0 failed; 0 skipped; finished in 13.67ms (36.80ms CPU time)\n\nRan 1 test for test/SuperIMD.invariant.t.sol:SuperIMDInvariantTest\n[PASS]\nSuperIMDInvariantTest invariants:\n[PASS] invariant_balancesSumToSupply\n[PASS] invariant_totalSupplyIsConstant\n SuperIMDInvariantTest invariants (runs: 64, calls: 2048, reverts: 0)\n\n╭--------------+--------------+-------+---------+----------╮\n| Contract     | Selector     | Calls | Reverts | Discards |\n+==========================================================+\n| TokenHandler | approve      | 709   | 0       | 0        |\n|--------------+--------------+-------+---------+----------|\n| TokenHandler | transfer     | 667   | 0       | 0        |\n|--------------+--------------+-------+---------+----------|\n| TokenHandler | transferFrom | 672   | 0       | 0        |\n╰--------------+--------------+-------+---------+----------╯\n\nLogs:\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 4000000000000000000\n  Bound result 4706\n  Bound result 0\n  Bound result 0\n  Bound result 2000000000000000000\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 1118017265410807042\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 179.66ms (178.10ms CPU time)\n\nRan 3 test suites in 181.15ms (194.55ms CPU time): 38 tests passed, 0 failed, 0 skipped (38 total tests)\n","passed":true},{"durationMs":38,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"SuperIMD.approve(address,uint256)\",\"SuperIMD.permit(address,address,uint256,uint256,uint8,bytes32,bytes32)\",\"SuperIMD.transfer(address,uint256)\",\"SuperIMD.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":11,\"README.md\":119,\"foundry.toml\":35,\"remappings.txt\":2,\"script/Deploy.s.sol\":25,\"src/SuperIMD.sol\":40,\"test/LaunchFlow.t.sol\":111,\"test/SuperIMD.invariant.t.sol\":80,\"test/SuperIMD.t.sol\":381},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true},{"durationMs":1551,"exitCode":0,"name":"slither","output":"slither: no results at low impact or above","passed":true},{"durationMs":426,"exitCode":0,"name":"aderyn","output":"[low] large-numeric-literal at src/SuperIMD.sol:28: Large Numeric Literal","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"8f1442565e9d980064a6d6c36c1b1c1557827f2802fba63c69ae661c91e4dae2","verifiedTreeHash":"09382c2d924a63a6ac78d072e2926c1e97a6d9df","verifierVersion":"0.1.0+c3fba9eb"},{"checks":[{"durationMs":2259,"exitCode":0,"name":"build","output":"Compiling 44 files with Solc 0.8.26\nSolc 0.8.26 finished in 2.14s\nCompiler run successful!\n","passed":true},{"durationMs":355,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 7 tests for test/LaunchFlow.t.sol:LaunchFlowTest\n[PASS] test_create2AddressIsPredictableFromCreationCode() (gas: 43289)\n[PASS] test_factoryCannotPayMoreThanTheSupply() (gas: 50076)\n[PASS] test_fullPayoutSplitsSupplyExactly() (gas: 230550)\n[PASS] test_poolRoundTripMovesExactAmounts() (gas: 187248)\n[PASS] test_supplyCannotGrowAfterLaunch() (gas: 38311)\n[PASS] test_supplyIsMintedToTheFactoryOnly() (gas: 33499)\n[PASS] test_swarmShareArrivesWholeAndIsClaimableWhole() (gas: 159771)\nSuite result: ok. 7 passed; 0 failed; 0 skipped; finished in 1.97ms (2.37ms CPU time)\n\nRan 30 tests for test/SuperIMD.t.sol:SuperIMDTest\n[PASS] testFuzz_transferAboveBalanceReverts(uint256,uint256) (runs: 256, μ: 99826, ~: 100278)\nLogs:\n  Bound result 99850821\n  Bound result 154725171674256866438584295\n\n[PASS] testFuzz_transferConservesSupply(address,uint256) (runs: 256, μ: 97648, ~: 97923)\nLogs:\n  Bound result 4202047189\n\n[PASS] testFuzz_transferFromWithinAllowance(uint256,uint256) (runs: 256, μ: 157146, ~: 159093)\nLogs:\n  Bound result 2552616620\n  Bound result 22351\n\n[PASS] test_approveRevertsForZeroSpender() (gas: 32973)\n[PASS] test_approveSetsAllowanceAndEmits() (gas: 68147)\n[PASS] test_constructorEmitsSingleMintTransfer() (gas: 22256)\n[PASS] test_constructorMintsToWhoeverDeploys() (gas: 196386)\n[PASS] test_constructorMintsWholeSupplyToDeployer() (gas: 42088)\n[PASS] test_deployScriptFunctionDeploysTheToken() (gas: 2463184)\n[PASS] test_domainSeparatorBindsChainAndAddress() (gas: 8941)\n[PASS] test_metadata() (gas: 58889)\n[PASS] test_noMintOrAdminEntryPointExists() (gas: 601029)\n[PASS] test_noPrivilegedCallMovesOrFreezesAHolder() (gas: 455016)\n[PASS] test_permitCannotBeReplayed() (gas: 134723)\n[PASS] test_permitGrantsAllowance() (gas: 121658)\n[PASS] test_permitRevertsForWrongSigner() (gas: 84520)\n[PASS] test_permitRevertsWhenExpired() (gas: 49922)\n[PASS] test_runtimeHasNoDelegatecallCallcodeOrSelfdestruct() (gas: 5277455)\n[PASS] test_supportsIERC20Interface() (gas: 21052)\n[PASS] test_transferFromInfiniteAllowanceIsNotDecremented() (gas: 123340)\n[PASS] test_transferFromRevertsAboveAllowance() (gas: 87999)\n[PASS] test_transferFromRevertsWhenOwnerLacksBalance() (gas: 91620)\n[PASS] test_transferFromRevertsWithoutAllowance() (gas: 40387)\n[PASS] test_transferFromSpendsAllowance() (gas: 153968)\n[PASS] test_transferMovesExactAmount() (gas: 96057)\n[PASS] test_transferOfWholeSupplyThenNothingLeft() (gas: 113180)\n[PASS] test_transferRevertsOnInsufficientBalance() (gas: 37862)\n[PASS] test_transferRevertsToZeroAddress() (gas: 32877)\n[PASS] test_transferToSelfKeepsBalance() (gas: 43449)\n[PASS] test_transferZeroAmountSucceeds() (gas: 47744)\nSuite result: ok. 30 passed; 0 failed; 0 skipped; finished in 20.49ms (91.55ms CPU time)\n\nRan 1 test for test/SuperIMD.invariant.t.sol:SuperIMDInvariantTest\n[PASS]\nSuperIMDInvariantTest invariants:\n[PASS] invariant_balancesSumToSupply\n[PASS] invariant_totalSupplyIsConstant\n SuperIMDInvariantTest invariants (runs: 64, calls: 2048, reverts: 0)\n\n╭--------------+--------------+-------+---------+----------╮\n| Contract     | Selector     | Calls | Reverts | Discards |\n+==========================================================+\n| TokenHandler | approve      | 709   | 0       | 0        |\n|--------------+--------------+-------+---------+----------|\n| TokenHandler | transfer     | 667   | 0       | 0        |\n|--------------+--------------+-------+---------+----------|\n| TokenHandler | transferFrom | 672   | 0       | 0        |\n╰--------------+--------------+-------+---------+----------╯\n\nLogs:\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 4000000000000000000\n  Bound result 4706\n  Bound result 0\n  Bound result 0\n  Bound result 2000000000000000000\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 1118017265410807042\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 211.98ms (209.49ms CPU time)\n\nRan 3 test suites in 213.78ms (234.44ms CPU time): 38 tests passed, 0 failed, 0 skipped (38 total tests)\n","passed":true},{"durationMs":77,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"SuperIMD.approve(address,uint256)\",\"SuperIMD.permit(address,address,uint256,uint256,uint8,bytes32,bytes32)\",\"SuperIMD.transfer(address,uint256)\",\"SuperIMD.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":11,\"README.md\":119,\"foundry.toml\":35,\"launch.json\":24,\"remappings.txt\":2,\"script/Deploy.s.sol\":25,\"src/SuperIMD.sol\":40,\"test/LaunchFlow.t.sol\":111,\"test/SuperIMD.invariant.t.sol\":80,\"test/SuperIMD.t.sol\":381},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"abfd7b25fd4b279bbb01081804cbb8669d55a7b12f552022e7e997692f4242dd","verifiedTreeHash":"d3c181511461c7fa11deca28063bd8a7df65acdd","verifierVersion":"0.1.0+c3fba9eb"}]}