{"assessments":[],"deployments":[],"fuzz":[],"identity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"interpretation":"Records acceptance and evidence. Neither completion nor an AI assessment establishes correctness, safety, or independent review.","jobId":"1a4cb016-25dd-4d2c-9780-d5476ae46a57","kind":"shape:chain","nodes":[{"acceptedSubmissionHash":"de0d8cd7f4d40b75b3434fad625cd25203382061cc21fca8e8598b8b8c693dab","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_economics","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"7ab7bd21ce08c04190253f8c4ef9b48710bde7a9aa41ef2a5b810efbbd7a38ce","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_flow","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"0dc3640c2b888a655bcfb7e7a6714e27d2466fc887bf7b6aab2baf6254f35f59","dependsOn":["build_contract_project","write_foundry_tests","manifest","audit_math","audit_permissions","audit_economics","audit_flow"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"af3aa01159bbf354f621cafa5c0006f6169e0938a8b015be508b7377dbf165bc","skillId":"audit-judge","tools":[]},"key":"audit_judge","kind":"code","role":"review","skillHash":"af3aa01159bbf354f621cafa5c0006f6169e0938a8b015be508b7377dbf165bc","skillId":"audit-judge","state":"accepted"},{"acceptedSubmissionHash":"c4d22a644eda8f52dd1637160f5a84c99227b8fa44edae28d9f568681f4c3ad0","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_math","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"c8d2e827ae5c7d1f76e6382d6b0e6ed7f43c21f408a1b49ddefbe06c0a180736","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_permissions","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"4ec6f043ae5a54a65088d145755ca23d0416c2fdbaa843940364eb30d12df5a6","dependsOn":[],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"6b8d2c2ebd3301cff2be8edb1e1cc6ba65c858c02fe7247be81722b969842265","skillId":"build-contract-project","tools":[]},"key":"build_contract_project","kind":"code","role":"implement","skillHash":"6b8d2c2ebd3301cff2be8edb1e1cc6ba65c858c02fe7247be81722b969842265","skillId":"build-contract-project","state":"accepted"},{"acceptedSubmissionHash":"21b10aa59707a44c7be3f8e95ce420c6d41b0db23674978149ece7d504fa8401","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"tools":[]},"key":"manifest","kind":"code","role":"integrate","skillHash":null,"skillId":null,"state":"accepted"},{"acceptedSubmissionHash":"fd6c8192e0a52fde4e198f2281ef709dc2e97c1384068472357117967f24070e","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"73431852439ad3a343f3d2b7db1c43cd363b9f48f9bb51497374a0cf6d50b223","skillId":"write-foundry-tests","tools":[]},"key":"write_foundry_tests","kind":"code","role":"tests","skillHash":"73431852439ad3a343f3d2b7db1c43cd363b9f48f9bb51497374a0cf6d50b223","skillId":"write-foundry-tests","state":"accepted"}],"objective":"A custom token: Coinbase (COINBASE).\nToken name: Coinbase\nToken symbol: COINBASE\nToken supply: 1,000,000,000 with 18 decimals, all minted once to the deployer in the constructor.","parentJobId":null,"planHash":"1a07b98ec9f916bd6ef3371c05deb53ea103ca1eaaf15f932811dc8125a2f4b1","previousHash":"0000000000000000000000000000000000000000000000000000000000000000","projectId":"1a4cb016-25dd-4d2c-9780-d5476ae46a57","publication":{"commit":null,"deliveredAt":null,"repoUrl":"https://github.com/identity-md-launches/launch-1441-coinbase"},"receiptIdentity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"registry":"0xb6d0a187b050fa5bb0b87033a203f37becf4a775","research":[],"schema":"identitymd-work-v1","signals":[{"agentId":"52165","feedbackHash":"70908da98945d1fc7194c7a9e5729738f0038286243e734ff436ca25dc6885f9","nodeKey":"audit_economics","submissionHash":"de0d8cd7f4d40b75b3434fad625cd25203382061cc21fca8e8598b8b8c693dab","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51021","feedbackHash":"5312346ae30638d8b4f29e41421f81f34b822c7bf587aabf775dfd1a47088e36","nodeKey":"audit_flow","submissionHash":"7ab7bd21ce08c04190253f8c4ef9b48710bde7a9aa41ef2a5b810efbbd7a38ce","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52660","feedbackHash":"36dc365519028ee8960c71c73d0e1d18854e1562dbd96c3bd512a2bc4152e93f","nodeKey":"audit_judge","submissionHash":"0dc3640c2b888a655bcfb7e7a6714e27d2466fc887bf7b6aab2baf6254f35f59","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51081","feedbackHash":"965a8b31b620543322609489be67cf66c5bc44c89887bac454683e80185b2f21","nodeKey":"audit_math","submissionHash":"c4d22a644eda8f52dd1637160f5a84c99227b8fa44edae28d9f568681f4c3ad0","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52207","feedbackHash":"eb857c21d6d0625292eadb39301b6a79fc9e0263f97f62f85d88924554254bec","nodeKey":"audit_permissions","submissionHash":"c8d2e827ae5c7d1f76e6382d6b0e6ed7f43c21f408a1b49ddefbe06c0a180736","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51491","feedbackHash":"ccc083457af98262e5757c222cad49cdd92963171db7396c745472a916bfca3e","nodeKey":"build_contract_project","submissionHash":"4ec6f043ae5a54a65088d145755ca23d0416c2fdbaa843940364eb30d12df5a6","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"51419","feedbackHash":"69f556df7a3d45c228597f311440f9395e08510f86acc9fd55d41bcd127c6e09","nodeKey":"manifest","submissionHash":"21b10aa59707a44c7be3f8e95ce420c6d41b0db23674978149ece7d504fa8401","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"50977","feedbackHash":"bccb7fd714fc34fc5057b4f85ae5b6bb59e8c9f9e52704d803d7b797157ac46b","nodeKey":"write_foundry_tests","submissionHash":"fd6c8192e0a52fde4e198f2281ef709dc2e97c1384068472357117967f24070e","tag1":"verification:checks","tag2":"acceptance-v2","value":1}],"site":null,"snapshotHash":"f25ffb77d40613f282ff73f40aefa674957eaf633c65096bbe628ac4384d454d","state":"completed","submissions":[{"artifacts":[],"attempt":1,"bundleHash":null,"device":"1ec9f666356a7ad7","findings":[{"citation":"resolved","description":"Merged from audit_flow (low) and audit_math (info); same root cause. README.md line 116 states that dependencies.json records SHA-256 hashes for every vendored dependency file, so an offline verifier can check the vendored libraries. For 7 of the 30 forge-std entries the recorded hash is not the hash of the file in lib/forge-std: src/StdAssertions.sol (line 26), src/StdJson.sol (32), src/StdToml.sol (36), src/Vm.sol (39), src/console.sol (40), src/interfaces/IERC7540.sol (48), src/interfaces/IMulticall3.sol (50). Reproduced by me: the recorded hashes are those of the pristine files at forge-std commit 77041d2ce690e692d6e03cc812b57d1ddaa4d505 (fetched from GitHub), and the vendored copies differ from upstream only in line wrapping (forge fmt, line_length 120). A regex token-level comparison, comments stripped, gives identical token streams for all seven (4280, 1709, 1709, 8463, 13379, 276 and 334 tokens respectively), so no code semantics changed. All six OpenZeppelin v5.4.0 files are byte-identical to upstream commit c64a1edb67b6e3f4a15cca8909c9482ad33a02b0 and match their recorded hashes, so the production token src/CoinbaseToken.sol and the ERC20 it inherits are unaffected; forge-std is used only by tests. Impact: the stated integrity record is false for part of the test-only dependency, so an offline reviewer following the README gets 7 mismatches and cannot tell this benign reformat from a tampered helper without re-deriving the diff. No funds or launch flow are affected. Fix: either restore the 7 pristine upstream files to lib/forge-std/src, or recompute the 7 hashes from the files as vendored (e.g. StdAssertions.sol -> 3fbf4a025b4fc94eaca4c38c1f3dacb37bee10f12ee81994cfaf365ac1ce7384).","line":26,"path":"dependencies.json","reproduction":"State: the committed tree at HEAD 84dd279. Input: from the repository root run `python3 -I -c \"import json,hashlib; [print(f, hashlib.sha256(open(d['path']+'/'+f,'rb').read()).hexdigest()==h) for d in json.load(open('dependencies.json')) for f,h in d['sha256'].items()]\"`. Expected: True for all 36 entries. Actual: False for src/StdAssertions.sol (actual sha256 3fbf4a025b4fc94eaca4c38c1f3dacb37bee10f12ee81994cfaf365ac1ce7384 vs recorded d4c89eec70d267dec6188461fbc74d3dc8c47e518d176a23417533a232ed9780), src/StdJson.sol, src/StdToml.sol, src/Vm.sol, src/console.sol, src/interfaces/IERC7540.sol and src/interfaces/IMulticall3.sol; True for the other 29 and for all 6 OpenZeppelin files. Cross-check: `curl -sSL https://raw.githubusercontent.com/foundry-rs/forge-std/77041d2ce690e692d6e03cc812b57d1ddaa4d505/src/StdAssertions.sol | sha256sum` prints the recorded d4c89eec..., and `diff` of that file against lib/forge-std/src/StdAssertions.sol shows only line-wrapping changes.","severity":"low","snippet":"      \"src/StdAssertions.sol\": \"d4c89eec70d267dec6188461fbc74d3dc8c47e518d176a23417533a232ed9780\",","title":"dependencies.json records SHA-256 hashes that do not match 7 vendored forge-std files (whitespace-only reformat; test-only dependency)"}],"hash":"0dc3640c2b888a655bcfb7e7a6714e27d2466fc887bf7b6aab2baf6254f35f59","nodeId":"2b73ae75-3af1-4602-b4cf-ba1975f634b2","outcome":"completed","summary":"The review is complete. The findings file is valid JSON, and the working tree is clean apart from the findings file itself (build output is gitignored).\n\n**Outcome.** The token is a plain, pristine OpenZeppelin v5.4.0 ERC-20 with no added logic, and I found no defect in it. One low finding survives from the specialists, merged from two duplicate reports.\n\n**What I verified**\n- Build and the project's full suite pass: 48 tests across unit, fuzz and invariant files, with no reverts in 24,576 invariant handler calls.\n- All six vendored OpenZeppelin files are byte-identical to upstream commit c64a1edb at v5.4.0 and match their recorded hashes, so the production dependency is sound.\n- The compiled runtime contains no DELEGATECALL, CALLCODE, SELFDESTRUCT or any external call opcode. Creation code is 2642 bytes and runtime 1753 bytes, far under the deployment limits.\n- The constructor takes no arguments and mints exactly 10^27 units to msg.sender, so the factory's CREATE2 deployment credits the factory with the manifest's supply.\n- The manifest in launch.json uses only schema keys, with correct types, lowercase addresses, an empty constructorArgs matching the constructor, and a totalSupply equal to what is minted.\n\n**Specialist findings**\n- audit_flow (low) and audit_math (info) both reported the same root cause: seven forge-std files under lib/forge-std/src do not match the SHA-256 hashes in dependencies.json. I reproduced it, fetched the pinned upstream commit, and confirmed by a comment-stripped token-level comparison that every one of the seven differs only in line wrapping. Kept as one low finding, since the README's integrity claim is false for a test-only dependency but nothing in the production token or launch flows is affected.\n- audit_permissions, audit_economics and the test writer reported nothing, and my own pass agrees.\n\n**Coverage.** All three entry points (approve, transfer, transferFrom) hold, with the constructor, the fixed-supply and exact-flow invariants, the opcode restriction and the manifest also recorded as holding. The provenance row points at the one finding. No proof test was written because nothing reached high or critical severity.","treeHash":null,"usage":{"cachedInputTokens":633061,"inputTokens":354,"model":"claude-fable-5-1","outputTokens":10122,"runtime":"claude","turns":12,"wallClockMs":160335}},{"artifacts":[],"attempt":1,"bundleHash":"bc8031cad6c566fde3833cbb7e977ce03b0f13e1eb95cbac282938b49f4a8593","device":"fea57d3e9d0ca7bf","findings":[],"hash":"21b10aa59707a44c7be3f8e95ce420c6d41b0db23674978149ece7d504fa8401","nodeId":"de9b243e-ca21-4c5c-a743-5d5a16d3f6f6","outcome":"completed","summary":"Done. I wrote launch.json for the Coinbase (COINBASE) custom token launch and it is the only file changed.\n\n**What the manifest says**\n- Kind is custom_token, token contract is CoinbaseToken with name Coinbase, symbol COINBASE, 18 decimals.\n- constructorArgs is empty, matching the compiled ABI, whose constructor takes no inputs.\n- totalSupply is 1000000000000000000000000000, the exact amount the constructor mints to msg.sender.\n- contracts is empty because the accepted tree has no application contracts.\n- pool and economics are copied verbatim from the launch reference: native ETH pairing, fee 12500, tick spacing 60, the one-to-one provenance price, and the requester's economics object.\n- notes describe only the token present in the tree and stay well under the length limit.\n\n**Checks run**\n- A script confirmed the manifest's keys, supply, pool and economics match the schema and the job's values.\n- `forge build` compiled cleanly and `forge test` passed all 31 tests.\n- `git status` shows launch.json as the only new file. No configuration, lib, or workflow files were touched.","treeHash":"17329b2b0b36213b2bf5a1e91b7e9226635a3144","usage":{"cachedInputTokens":216693,"inputTokens":162,"model":"claude-fable-5-1","outputTokens":2929,"runtime":"claude","turns":9,"wallClockMs":1269124}},{"artifacts":[],"attempt":1,"bundleHash":"c13fc6645532a69ba6f3566447486770d9674ce95b3a09ddf13830d7853b6875","device":"e5ed95d8889ee194","findings":[],"hash":"4ec6f043ae5a54a65088d145755ca23d0416c2fdbaa843940364eb30d12df5a6","nodeId":"38dfdb97-eb86-4bf7-ba65-a3b1e0c0ad0f","outcome":"completed","summary":"Implemented [CoinbaseToken.sol](/home/ubuntu/.identitymd/work/1a4cb016-25dd-4d2c-9780-d5476ae46a57/38dfdb97-eb86-4bf7-ba65-a3b1e0c0ad0f/src/CoinbaseToken.sol): Coinbase (`COINBASE`), 18 decimals, exactly 1,000,000,000 tokens minted once to the deployer.\n\nAdded vendored dependencies, deployment documentation, and success/failure tests.\n\nAll local checks pass with Solidity 0.8.26:\n\n- `forge build`\n- `forge test`: 30 unit/fuzz tests and two invariants\n- `forge fmt --check`\n\nOffline build and tests also pass with an empty environment.","treeHash":"fe3a6b40c6f239eeeb4ba3745cd8b93550588d20","usage":{"cachedInputTokens":417280,"inputTokens":57582,"model":"gpt-6-astra","outputTokens":14491,"runtime":"codex","turns":5,"wallClockMs":406152}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"72ae9b5bbd1a54b6","findings":[{"citation":"resolved","description":"Periphery / provenance. README.md (line 116) states that dependencies.json \"records pinned upstream commits and SHA-256 hashes for every vendored dependency file\" so a reviewer can verify the vendored libraries offline. For 7 of the 30 forge-std files the recorded hash is not the hash of the file in lib/: src/StdAssertions.sol (line 26), src/StdJson.sol (32), src/StdToml.sol (36), src/Vm.sol (39), src/console.sol (40), src/interfaces/IERC7540.sol (48), src/interfaces/IMulticall3.sol (50). The recorded hashes are those of the pristine files at forge-std commit 77041d2ce690e692d6e03cc812b57d1ddaa4d505 (verified by fetching that commit), while the files in the tree were reformatted afterwards (forge fmt with line_length 120: only whitespace differs, the token stream is identical). All 6 OpenZeppelin files and the other 23 forge-std files match both their recorded hash and upstream. Impact: the stated integrity record is false for part of the test-only dependency, so an offline verifier following the README gets 7 mismatches and cannot distinguish this benign reformat from a tampered helper without re-deriving the diff. The production token (src/CoinbaseToken.sol and the OpenZeppelin ERC20 it inherits) is not affected; the OpenZeppelin v5.4.0 sources are byte-identical to upstream commit c64a1edb67b6e3f4a15cca8909c9482ad33a02b0. Fix: either restore the 7 pristine upstream files to lib/forge-std/src (then every recorded hash matches), or recompute the 7 hashes from the files as vendored.","line":26,"path":"dependencies.json","reproduction":"State: the committed tree at HEAD. Input: from the repository root run `python3 -I -c \"import json,hashlib; [print(f, hashlib.sha256(open(d['path']+'/'+f,'rb').read()).hexdigest()==h) for d in json.load(open('dependencies.json')) for f,h in d['sha256'].items()]\"`. Expected: True for every entry. Actual: False for src/StdAssertions.sol (actual sha256 3fbf4a025b4fc94eaca4c38c1f3dacb37bee10f12ee81994cfaf365ac1ce7384 vs recorded d4c89eec...), src/StdJson.sol (61bbf9b3... vs 0211b47e...), src/StdToml.sol (187d2f0c... vs de3fb35a...), src/Vm.sol (a1b1c829... vs 9068805b...), src/console.sol (a2e632dc... vs 896c5a5a...), src/interfaces/IERC7540.sol (3ae3eec9... vs c6a7854c...), src/interfaces/IMulticall3.sol (1b63ca78... vs 6620d9c5...). Cross-check: `curl -sSL https://raw.githubusercontent.com/foundry-rs/forge-std/77041d2ce690e692d6e03cc812b57d1ddaa4d505/src/StdAssertions.sol | sha256sum` prints the recorded d4c89eec... and `diff` against lib/forge-std/src/StdAssertions.sol shows only line-wrapping changes.","severity":"low","snippet":"      \"src/StdAssertions.sol\": \"d4c89eec70d267dec6188461fbc74d3dc8c47e518d176a23417533a232ed9780\",","title":"dependencies.json records SHA-256 hashes that do not match 7 vendored forge-std files"}],"hash":"7ab7bd21ce08c04190253f8c4ef9b48710bde7a9aa41ef2a5b810efbbd7a38ce","nodeId":"b5f522f2-79ea-4c48-931b-dbe5cf16e090","outcome":"completed","summary":"The findings file is in place at the repository root, excluded from git by the harness's own exclude rule, and the working tree is otherwise untouched. Review complete.\n\n## Result\n\nThe token is a plain OpenZeppelin v5.4.0 ERC-20 with a fixed one-billion supply minted once to the deployer. I found no defect in the token itself. One low-severity provenance defect in the vendored test dependency is recorded in `.imd-findings.json`, together with a coverage row for every listed entry point.\n\n**What I checked, in my area (Execution Trace, Periphery, First Principles):**\n\n- **Execution trace.** Each of approve, transfer and transferFrom was traced through the inherited OpenZeppelin code to its guards and state writes. Zero-address sentinels revert, insufficient balance or allowance reverts, exact amounts move, the maximum allowance is treated as unlimited, and there is no fee, hook, callback, external call or partial-update window. Factory, distributor and PoolManager flows therefore move exactly what they say, which is what the protected launch harness requires.\n- **Periphery.** All six vendored OpenZeppelin files are byte-identical to upstream commit c64a1edb and match their recorded hashes. There is no submodule and no untracked file under lib. The compiled ABI exposes only the ERC-20 surface plus the supply constant. Runtime and creation bytecode contain no DELEGATECALL, CALLCODE, SELFDESTRUCT or any CALL-family or CREATE opcode.\n- **First principles.** The constructor takes no arguments, is non-payable, makes no external calls and mints a compile-time constant equal to the manifest supply at 18 decimals to msg.sender, which under CREATE2 from the factory is the factory. Nothing can grow the supply or move a holder's balance without that holder's approval after deployment.\n- **Build and tests.** The project compiles with Solidity 0.8.26, all 31 existing tests including 4 fuzz properties and 2 invariants pass, and formatting is clean.\n\n**The one finding (low).** dependencies.json claims a SHA-256 hash for every vendored file, but 7 forge-std files were reformatted after vendoring and no longer match. The recorded hashes are those of the pristine pinned commit, and the differences are whitespace only. This is a false integrity record for a test-only dependency, not a token defect. The fix is to restore the 7 pristine files or recompute their hashes.\n\n**Not covered.** No launch.json exists yet, so there was no manifest to check. The protected harness itself depends on v4-core and launch helpers that are not in this tree, so I verified the token against its assertions by reading rather than by running it. Outside my area, I note for the judge that the token name and symbol reuse the Coinbase brand, which is a branding and legal question rather than a code defect, so I did not record it as a finding.","treeHash":null,"usage":{"cachedInputTokens":1517533,"inputTokens":578,"model":"claude-fable-5-1","outputTokens":17284,"runtime":"claude","turns":30,"wallClockMs":329738}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"2c968e88904ec22b","findings":[{"citation":"resolved","description":"README.md states that dependencies.json 'records pinned upstream commits and SHA-256 hashes for every vendored dependency file'. The six OpenZeppelin files match their recorded hashes exactly, but seven forge-std files under lib/forge-std/src do not: StdAssertions.sol, StdJson.sol, StdToml.sol, Vm.sol, console.sol, interfaces/IERC7540.sol and interfaces/IMulticall3.sol. Diffing each against the pinned upstream commit 77041d2ce690e692d6e03cc812b57d1ddaa4d505 shows only line-wrapping differences (the files were run through forge fmt with this repo's 120-column setting); after stripping all whitespace the local and upstream contents hash identically, so no code semantics changed. forge-std is a test-only dependency, so this has no effect on the production token or its bytecode. It is reported so the provenance record is accurate: either restore the upstream bytes or re-record the hashes. Outside the assigned math area; no impact on funds.","line":26,"path":"dependencies.json","reproduction":"From the repository root run `sha256sum lib/forge-std/src/StdAssertions.sol`. Expected (per dependencies.json line 26): d4c89eec70d267dec6188461fbc74d3dc8c47e518d176a23417533a232ed9780. Actual: 3fbf4a025b4fc94eaca4c38c1f3dacb37bee10f12ee81994cfaf365ac1ce7384. The same mismatch holds for StdJson.sol, StdToml.sol, Vm.sol, console.sol, interfaces/IERC7540.sol and interfaces/IMulticall3.sol. `diff` against the raw file at the pinned commit shows only wrapped/unwrapped function signatures; `tr -d ' \\n\\t' | sha256sum` on both sides is identical.","severity":"info","snippet":"      \"src/StdAssertions.sol\": \"d4c89eec70d267dec6188461fbc74d3dc8c47e518d176a23417533a232ed9780\",","title":"dependencies.json SHA-256 hashes do not match seven vendored forge-std files (whitespace-only reformatting, test-only dependency)"}],"hash":"c4d22a644eda8f52dd1637160f5a84c99227b8fa44edae28d9f568681f4c3ad0","nodeId":"66e1686e-491b-4d50-b1a9-61c0c7bc1701","outcome":"completed","summary":"The review is complete. The findings file is at the repository root and the git exclusion of it and the scratch folder is the harness's own setup.\n\n**Result: no math, boundary or numerical-gap defect in the token.** The contract in `src/CoinbaseToken.sol` is an unmodified OpenZeppelin v5.4.0 ERC-20 with a single constructor mint, and the six vendored OpenZeppelin files hash exactly to their pinned upstream versions. There is no division, scaling, casting, fee, hook or payable path anywhere in it, so the Math Precision guide's failure modes have nothing to attach to.\n\nWhat I verified, with the existing suite plus a scratch test of my own that runs eight cases including a 512-run fuzz:\n\n- **Supply scale.** The literal flagged by aderyn evaluates to exactly 10^27, which is one billion whole tokens at 18 decimals. The lead is closed.\n- **Transfer boundaries.** One wei, the full balance, balance plus one, the maximum uint256, zero from an empty account, a self-transfer of the whole supply, and a transfer to the token's own address all behave exactly as the standard specifies. The sum of balances stays at 10^27 under fuzzing.\n- **Allowance boundaries.** An allowance spent exactly to zero, one unit over, the maximum value treated as unlimited, maximum minus one treated as finite, and a revert on insufficient balance that rolls back the allowance decrement all hold.\n- **Zero-address paths.** Transfers to zero, approvals of a zero spender and transfers from zero revert on both the zero-value and nonzero-value paths.\n- **Launch flows.** The ten percent and eighty-eight percent shares of 10^27 divide exactly, and with no transfer hook every launch transfer delivers the full amount.\n\n**One informational note is recorded.** Seven vendored forge-std files do not match the SHA-256 hashes in `dependencies.json`. I diffed each against the pinned upstream commit and the only change is line wrapping from the repository's formatter. After stripping whitespace, local and upstream contents are identical, and forge-std is test-only, so there is no effect on the token. The author should either restore the upstream bytes or re-record the hashes so the provenance claim in the README is accurate.\n\nThe coverage record answers all three listed entry points as holding, plus three invariant rows. No finding carries a proof file, since nothing rose to high or critical.","treeHash":null,"usage":{"cachedInputTokens":738881,"inputTokens":354,"model":"claude-fable-5-1","outputTokens":14114,"runtime":"claude","turns":23,"wallClockMs":207522}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"f009de0ce52c7b3a","findings":[],"hash":"c8d2e827ae5c7d1f76e6382d6b0e6ed7f43c21f408a1b49ddefbe06c0a180736","nodeId":"714350ce-9490-4263-957c-1930dcc08288","outcome":"completed","summary":"The review is complete. The findings file is written with an empty findings list and six coverage rows, and the working tree holds no other changes.\n\n**Result: no defects in the assigned area.** The token at src/CoinbaseToken.sol is a plain OpenZeppelin v5.4.0 ERC-20 whose constructor mints the whole supply once to the deployer. The vendored library files match the SHA-256 hashes pinned in the dependency record. The compiled ABI exposes exactly the three listed state-changing entry points plus the standard view functions, with no owner, minter, pauser, initializer, proxy, delegatecall or receive path.\n\nWhat I checked against the three guides:\n\n- **Access Control.** The only guards are the holder's own `msg.sender` and the allowance row it granted. A stranger's approve cannot touch another holder's allowance, and a one-wei delegated transfer by that stranger reverts. The factory holds no power over holders after paying out. Fourteen admin-style selectors revert from both the factory and a stranger. The CREATE2 factory, not the EOA driving it, receives the supply.\n- **Asymmetry.** The transfer and delegated-transfer pair move identical amounts, both reject the zero receiver, and a fuzzed round trip over 512 runs restores balances exactly. The maximum allowance is not decremented, and a zero-value delegated transfer without allowance moves nothing. Storage writers and readers for balances, allowances and supply are symmetric.\n- **Trust Gap.** There is no setter, fee, price, hook or callback, so no seam exists where a permitted actor extracts value. The standard ERC-20 approve race is the only residual, it is inherent to the standard and documented in the README, so I did not report it.\n\nThe protected launch harness expectations also hold on this code: supply is fixed, the deployer receives it, runtime has no DELEGATECALL, CALLCODE or SELFDESTRUCT, and the existing 31 unit, fuzz and invariant tests pass. The aderyn large-literal lead is a style note about the supply constant and has no defect behind it. The scratch test used for verification was removed, leaving only the findings file as new content.","treeHash":null,"usage":{"cachedInputTokens":530718,"inputTokens":226,"model":"claude-fable-5-1","outputTokens":8393,"runtime":"claude","turns":21,"wallClockMs":150187}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"e12f98dda6acc55f","findings":[],"hash":"de0d8cd7f4d40b75b3434fad625cd25203382061cc21fca8e8598b8b8c693dab","nodeId":"462416f0-b80f-4bb1-b24b-87b37a9cb505","outcome":"completed","summary":"The findings file is in place at the repository root (git excludes it by design, as it does the `.imd/` inputs), the scratch tests are removed, and no tracked file changed.\n\n**Result: no defects found.** `.imd-findings.json` holds an empty findings list and seven coverage rows, all `holds`.\n\n**What I checked, against the Economic Security, Invariant and Flow Gap guides:**\n\n- **Supply conservation.** The only mint is in the constructor and equals 10^27 (1 billion times 10^18). There is no public mint, burn, or `_update` override, and transfers to the zero address revert, so the supply can neither grow nor shrink. The stateful invariant suite and my own scratch probe confirm this.\n- **Constructor and recipient.** No parameters, nonpayable, mints everything to `msg.sender`. A CREATE2 deployment from a factory credits the factory and not its caller. Decimals are the OpenZeppelin default of 18. The identifier `CoinbaseToken` is 13 characters.\n- **Launch flows.** No tax, exemption list, blacklist, or pause exists, so the swarm, pool, and remainder legs move exactly what they say. The 10/88/2 split of 10^27 produces exact integers with no rounding dust. A trader can send tokens into and out of the pool manager address at face value.\n- **Entry points.** `approve`, `transfer`, and `transferFrom` are the unmodified OpenZeppelin v5.4.0 implementations. A zero-address sender through `transferFrom` reverts on every path, so no route reaches a mint. The max-uint allowance stays infinite as documented.\n- **Dependency integrity.** All five vendored OpenZeppelin files are byte-identical to upstream commit c64a1edb, verified by SHA-256 against both `dependencies.json` and the fetched upstream source. No submodules exist. The build compiles cleanly and all 31 existing tests pass.\n- **Privileged surface and opcodes.** The ABI exposes only ERC-20 functions plus one constant view. No owner or role storage exists. No DELEGATECALL, CALLCODE, or SELFDESTRUCT appears in the sources or runtime.\n\n**Static analysis leads.** Slither reported nothing. Aderyn's large-numeric-literal note on line 10 is a style remark on `1_000_000_000 * 10 ** 18`, which evaluates to exactly 10^27. It is not a defect.\n\n**Not covered.** The real Uniswap v4 seed and swap run only in the protected launch harness, which needs environment variables and v4-core sources this tree does not carry. I traced the token's side of those flows by hand and with plain transfers. The ERC-20 approve front-running race is inherent to the standard, is documented in the README, and is not reported as a defect.","treeHash":null,"usage":{"cachedInputTokens":717315,"inputTokens":290,"model":"claude-fable-5-1","outputTokens":11449,"runtime":"claude","turns":27,"wallClockMs":193611}},{"artifacts":[],"attempt":1,"bundleHash":"a858fa52c4a3add561bb1560d0bb8a2a274cbdb5be8830a934abc5628f3bfedb","device":"77cba07fd04368e3","findings":[],"hash":"fd6c8192e0a52fde4e198f2281ef709dc2e97c1384068472357117967f24070e","nodeId":"a1d8d202-d482-4502-b331-d0ba6f0ecfd9","outcome":"completed","summary":"Added 17 unit/fuzz tests covering failure paths and boundary values, and strengthened invariants with independent balance and allowance tracking.\n\nValidation passed: `forge build` and offline `forge test`—48 reported tests, including 24,576 randomized calls.\n\nOnly `test/` changed. No confirmed defects found.","treeHash":"a9abdcf72f29947cf4e29d8decb47837f52801ac","usage":{"cachedInputTokens":850688,"inputTokens":77110,"model":"gpt-6-astra","outputTokens":14665,"runtime":"codex","turns":6,"wallClockMs":447457}}],"verification":[{"checks":[{"durationMs":1220,"exitCode":0,"name":"build","output":"Compiling 27 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.11s\nCompiler run successful!\n","passed":true},{"durationMs":846,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 30 tests for test/CoinbaseToken.t.sol:CoinbaseTokenTest\n[PASS] testFuzz_RevertWhenTransferExceedsSupply(uint256) (runs: 512, μ: 69183, ~: 69500)\nLogs:\n  Bound result 158845390860319058034086801757227445296658771498690638954349\n\n[PASS] testFuzz_TransferConservesSupply(address,uint256) (runs: 512, μ: 111111, ~: 111240)\nLogs:\n  Bound result 637798513\n\n[PASS] testFuzz_TransferFromRespectsBalanceAndAllowance(uint256,uint256) (runs: 512, μ: 159456, ~: 161997)\nLogs:\n  Bound result 242\n\n[PASS] testFuzz_UnapprovedSpenderCannotMoveFunds(address,uint256) (runs: 512, μ: 127086, ~: 126906)\nLogs:\n  Bound result 691967599186138718877658867\n\n[PASS] test_ApproveEmitsEventAndReplacesAllowance() (gas: 119489)\n[PASS] test_ApproveWithoutBalance() (gas: 78309)\n[PASS] test_ConstructorEmitsExactlyOneMint() (gas: 9762)\n[PASS] test_Create2CreditsFactoryAndNotItsCaller() (gas: 299733)\n[PASS] test_FactoryDistributionClaimsAndPoolTransfersAreExact() (gas: 658171)\n[PASS] test_MaximumAllowanceIsNotDecremented() (gas: 139392)\n[PASS] test_MetadataAndInitialSupply() (gas: 107650)\n[PASS] test_NoMintBurnOrAdministrativeEntryPoints() (gas: 758763)\n[PASS] test_RejectsNativeETH() (gas: 42630)\n[PASS] test_RevertWhenApprovingZeroAddress() (gas: 37610)\n[PASS] test_RevertWhenOwnerUsesTransferFromWithoutSelfApproval() (gas: 55204)\n[PASS] test_RevertWhenTransferExceedsBalance() (gas: 67771)\n[PASS] test_RevertWhenTransferFromExceedsAllowance() (gas: 115672)\n[PASS] test_RevertWhenTransferFromExceedsBalanceRestoresAllowance() (gas: 178472)\n[PASS] test_RevertWhenTransferFromToZeroAddressRestoresAllowance() (gas: 114201)\n[PASS] test_RevertWhenTransferToZeroAddressEvenForZeroAmount() (gas: 82417)\n[PASS] test_RevertWhenUnapprovedCallerSpendsAnotherSpendersAllowance() (gas: 115803)\n[PASS] test_RevokedAllowanceCannotBeSpent() (gas: 143895)\n[PASS] test_RuntimeHasNoDangerousOpcodesOrLinkedLibraries() (gas: 797139)\n[PASS] test_SelfTransferPreservesBalance() (gas: 51519)\n[PASS] test_TransferEntireSupplyEmitsEvent() (gas: 88682)\n[PASS] test_TransferFromSpendsAllowanceAndEmitsTransfer() (gas: 224940)\n[PASS] test_TransferFromToSelfStillConsumesAllowance() (gas: 103349)\n[PASS] test_TransferToContractNeedsNoReceiverHook() (gas: 298942)\n[PASS] test_ZeroTransferFromEmptyAccountEmitsEvent() (gas: 73431)\n[PASS] test_ZeroTransferFromNeedsNoAllowance() (gas: 78730)\nSuite result: ok. 30 passed; 0 failed; 0 skipped; finished in 16.76ms (67.90ms CPU time)\n\nRan 1 test for test/CoinbaseToken.invariant.t.sol:CoinbaseTokenInvariantTest\n[PASS]\nCoinbaseTokenInvariantTest invariants:\n[PASS] invariant_MetadataStaysFixed\n[PASS] invariant_TotalSupplyAndAggregateBalancesStayFixed\n CoinbaseTokenInvariantTest invariants (runs: 128, calls: 8192, reverts: 0)\n\n╭----------------------+------------------+-------+---------+----------╮\n| Contract             | Selector         | Calls | Reverts | Discards |\n+======================================================================+\n| CoinbaseTokenHandler | approve          | 2057  | 0       | 0        |\n|----------------------+------------------+-------+---------+----------|\n| CoinbaseTokenHandler | rejectedTransfer | 1979  | 0       | 0        |\n|----------------------+------------------+-------+---------+----------|\n| CoinbaseTokenHandler | transfer         | 2066  | 0       | 0        |\n|----------------------+------------------+-------+---------+----------|\n| CoinbaseTokenHandler | transferFrom     | 2090  | 0       | 0        |\n╰----------------------+------------------+-------+---------+----------╯\n\nLogs:\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 283020605275025852017499694\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 22152\n  Bound result 0\n  Bound result 2957397981\n  Bound result 0\n  Bound result 0\n  Bound result 6\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 40000000000000000000\n  Bound result 3229\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 12\n  Bound result 8\n  Bound result 40000000000000000000\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 19999999999999993532\n  Bound result 0\n  Bound result 6\n  Bound result 28142141643098\n  Bound result 2\n  Bound result 3164330225851\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 768.45ms (766.80ms CPU time)\n\nRan 2 test suites in 769.84ms (785.22ms CPU time): 31 tests passed, 0 failed, 0 skipped (31 total tests)\n","passed":true},{"durationMs":24,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"CoinbaseToken.approve(address,uint256)\",\"CoinbaseToken.transfer(address,uint256)\",\"CoinbaseToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":3,\"README.md\":132,\"dependencies.json\":54,\"foundry.toml\":22,\"launch.json\":24,\"remappings.txt\":2,\"src/CoinbaseToken.sol\":16,\"test/CoinbaseToken.invariant.t.sol\":110,\"test/CoinbaseToken.t.sol\":412},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"21b10aa59707a44c7be3f8e95ce420c6d41b0db23674978149ece7d504fa8401","verifiedTreeHash":"17329b2b0b36213b2bf5a1e91b7e9226635a3144","verifierVersion":"0.1.0+fb8278c5"},{"checks":[{"durationMs":1238,"exitCode":0,"name":"build","output":"Compiling 27 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.13s\nCompiler run successful!\n","passed":true},{"durationMs":857,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 30 tests for test/CoinbaseToken.t.sol:CoinbaseTokenTest\n[PASS] testFuzz_RevertWhenTransferExceedsSupply(uint256) (runs: 512, μ: 69183, ~: 69500)\nLogs:\n  Bound result 1000000000000000000000000001\n\n[PASS] testFuzz_TransferConservesSupply(address,uint256) (runs: 512, μ: 110846, ~: 111240)\nLogs:\n  Bound result 1777\n\n[PASS] testFuzz_TransferFromRespectsBalanceAndAllowance(uint256,uint256) (runs: 512, μ: 159727, ~: 161997)\nLogs:\n  Bound result 88\n\n[PASS] testFuzz_UnapprovedSpenderCannotMoveFunds(address,uint256) (runs: 512, μ: 127131, ~: 126954)\nLogs:\n  Bound result 1092\n\n[PASS] test_ApproveEmitsEventAndReplacesAllowance() (gas: 119489)\n[PASS] test_ApproveWithoutBalance() (gas: 78309)\n[PASS] test_ConstructorEmitsExactlyOneMint() (gas: 9762)\n[PASS] test_Create2CreditsFactoryAndNotItsCaller() (gas: 299733)\n[PASS] test_FactoryDistributionClaimsAndPoolTransfersAreExact() (gas: 658171)\n[PASS] test_MaximumAllowanceIsNotDecremented() (gas: 139392)\n[PASS] test_MetadataAndInitialSupply() (gas: 107650)\n[PASS] test_NoMintBurnOrAdministrativeEntryPoints() (gas: 758763)\n[PASS] test_RejectsNativeETH() (gas: 42630)\n[PASS] test_RevertWhenApprovingZeroAddress() (gas: 37610)\n[PASS] test_RevertWhenOwnerUsesTransferFromWithoutSelfApproval() (gas: 55204)\n[PASS] test_RevertWhenTransferExceedsBalance() (gas: 67771)\n[PASS] test_RevertWhenTransferFromExceedsAllowance() (gas: 115672)\n[PASS] test_RevertWhenTransferFromExceedsBalanceRestoresAllowance() (gas: 178472)\n[PASS] test_RevertWhenTransferFromToZeroAddressRestoresAllowance() (gas: 114201)\n[PASS] test_RevertWhenTransferToZeroAddressEvenForZeroAmount() (gas: 82417)\n[PASS] test_RevertWhenUnapprovedCallerSpendsAnotherSpendersAllowance() (gas: 115803)\n[PASS] test_RevokedAllowanceCannotBeSpent() (gas: 143895)\n[PASS] test_RuntimeHasNoDangerousOpcodesOrLinkedLibraries() (gas: 797139)\n[PASS] test_SelfTransferPreservesBalance() (gas: 51519)\n[PASS] test_TransferEntireSupplyEmitsEvent() (gas: 88682)\n[PASS] test_TransferFromSpendsAllowanceAndEmitsTransfer() (gas: 224940)\n[PASS] test_TransferFromToSelfStillConsumesAllowance() (gas: 103349)\n[PASS] test_TransferToContractNeedsNoReceiverHook() (gas: 298942)\n[PASS] test_ZeroTransferFromEmptyAccountEmitsEvent() (gas: 73431)\n[PASS] test_ZeroTransferFromNeedsNoAllowance() (gas: 78730)\nSuite result: ok. 30 passed; 0 failed; 0 skipped; finished in 16.42ms (61.96ms CPU time)\n\nRan 1 test for test/CoinbaseToken.invariant.t.sol:CoinbaseTokenInvariantTest\n[PASS]\nCoinbaseTokenInvariantTest invariants:\n[PASS] invariant_MetadataStaysFixed\n[PASS] invariant_TotalSupplyAndAggregateBalancesStayFixed\n CoinbaseTokenInvariantTest invariants (runs: 128, calls: 8192, reverts: 0)\n\n╭----------------------+------------------+-------+---------+----------╮\n| Contract             | Selector         | Calls | Reverts | Discards |\n+======================================================================+\n| CoinbaseTokenHandler | approve          | 2052  | 0       | 0        |\n|----------------------+------------------+-------+---------+----------|\n| CoinbaseTokenHandler | rejectedTransfer | 2048  | 0       | 0        |\n|----------------------+------------------+-------+---------+----------|\n| CoinbaseTokenHandler | transfer         | 2050  | 0       | 0        |\n|----------------------+------------------+-------+---------+----------|\n| CoinbaseTokenHandler | transferFrom     | 2042  | 0       | 0        |\n╰----------------------+------------------+-------+---------+----------╯\n\nLogs:\n  Bound result 6\n  Bound result 0\n  Bound result 1992\n  Bound result 5\n  Bound result 0\n  Bound result 0\n  Bound result 25\n  Bound result 4\n  Bound result 1\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 7665\n  Bound result 0\n  Bound result 0\n  Bound result 467\n  Bound result 0\n  Bound result 147\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 5\n  Bound result 0\n  Bound result 0\n  Bound result 1521\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 772.54ms (770.80ms CPU time)\n\nRan 2 test suites in 773.80ms (788.96ms CPU time): 31 tests passed, 0 failed, 0 skipped (31 total tests)\n","passed":true},{"durationMs":42,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"CoinbaseToken.approve(address,uint256)\",\"CoinbaseToken.transfer(address,uint256)\",\"CoinbaseToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":3,\"README.md\":132,\"dependencies.json\":54,\"foundry.toml\":22,\"remappings.txt\":2,\"src/CoinbaseToken.sol\":16,\"test/CoinbaseToken.invariant.t.sol\":110,\"test/CoinbaseToken.t.sol\":412},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true},{"durationMs":458,"exitCode":0,"name":"slither","output":"slither: no results at low impact or above","passed":true},{"durationMs":194,"exitCode":0,"name":"aderyn","output":"[low] large-numeric-literal at src/CoinbaseToken.sol:10: Large Numeric Literal","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"4ec6f043ae5a54a65088d145755ca23d0416c2fdbaa843940364eb30d12df5a6","verifiedTreeHash":"fe3a6b40c6f239eeeb4ba3745cd8b93550588d20","verifierVersion":"0.1.0+fb8278c5"},{"checks":[{"durationMs":1419,"exitCode":0,"name":"build","output":"Compiling 28 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.32s\nCompiler run successful!\n","passed":true},{"durationMs":6999,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 30 tests for test/CoinbaseToken.t.sol:CoinbaseTokenTest\n[PASS] testFuzz_RevertWhenTransferExceedsSupply(uint256) (runs: 1000, μ: 69141, ~: 69500)\nLogs:\n  Bound result 115792089237316195423570985008687907853269984665639564039457584032807131510301\n\n[PASS] testFuzz_TransferConservesSupply(address,uint256) (runs: 1000, μ: 111499, ~: 111664)\nLogs:\n  Bound result 611956300426036342431674480428518766212380647982\n  Bound result 999939434407272288728376669\n\n[PASS] testFuzz_TransferFromRespectsBalanceAndAllowance(uint256,uint256) (runs: 1000, μ: 159934, ~: 161997)\nLogs:\n  Bound result 348540419809855687702816297\n\n[PASS] testFuzz_UnapprovedSpenderCannotMoveFunds(address,uint256) (runs: 1000, μ: 127614, ~: 127492)\nLogs:\n  Bound result 22333\n  Bound result 96\n\n[PASS] test_ApproveEmitsEventAndReplacesAllowance() (gas: 119489)\n[PASS] test_ApproveWithoutBalance() (gas: 78309)\n[PASS] test_ConstructorEmitsExactlyOneMint() (gas: 9762)\n[PASS] test_Create2CreditsFactoryAndNotItsCaller() (gas: 299733)\n[PASS] test_FactoryDistributionClaimsAndPoolTransfersAreExact() (gas: 658171)\n[PASS] test_MaximumAllowanceIsNotDecremented() (gas: 139392)\n[PASS] test_MetadataAndInitialSupply() (gas: 107650)\n[PASS] test_NoMintBurnOrAdministrativeEntryPoints() (gas: 758763)\n[PASS] test_RejectsNativeETH() (gas: 42630)\n[PASS] test_RevertWhenApprovingZeroAddress() (gas: 37610)\n[PASS] test_RevertWhenOwnerUsesTransferFromWithoutSelfApproval() (gas: 55204)\n[PASS] test_RevertWhenTransferExceedsBalance() (gas: 67771)\n[PASS] test_RevertWhenTransferFromExceedsAllowance() (gas: 115672)\n[PASS] test_RevertWhenTransferFromExceedsBalanceRestoresAllowance() (gas: 178472)\n[PASS] test_RevertWhenTransferFromToZeroAddressRestoresAllowance() (gas: 114201)\n[PASS] test_RevertWhenTransferToZeroAddressEvenForZeroAmount() (gas: 82417)\n[PASS] test_RevertWhenUnapprovedCallerSpendsAnotherSpendersAllowance() (gas: 115803)\n[PASS] test_RevokedAllowanceCannotBeSpent() (gas: 143895)\n[PASS] test_RuntimeHasNoDangerousOpcodesOrLinkedLibraries() (gas: 797139)\n[PASS] test_SelfTransferPreservesBalance() (gas: 51519)\n[PASS] test_TransferEntireSupplyEmitsEvent() (gas: 88682)\n[PASS] test_TransferFromSpendsAllowanceAndEmitsTransfer() (gas: 224940)\n[PASS] test_TransferFromToSelfStillConsumesAllowance() (gas: 103349)\n[PASS] test_TransferToContractNeedsNoReceiverHook() (gas: 298942)\n[PASS] test_ZeroTransferFromEmptyAccountEmitsEvent() (gas: 73431)\n[PASS] test_ZeroTransferFromNeedsNoAllowance() (gas: 78730)\nSuite result: ok. 30 passed; 0 failed; 0 skipped; finished in 88.91ms (345.14ms CPU time)\n\nRan 17 tests for test/CoinbaseToken.allowance.t.sol:CoinbaseTokenAllowanceTest\n[PASS] testFuzz_AllowancesAreIsolatedByBothOwnerAndSpender(uint256,uint256,uint256,uint256) (runs: 1000, μ: 389180, ~: 391846)\nLogs:\n  Bound result 60566331169335413\n\n[PASS] testFuzz_DelegatedTransferInPartsEqualsOneTransfer(uint256,uint256,uint256) (runs: 1000, μ: 369351, ~: 370211)\nLogs:\n  Bound result 3\n  Bound result 339508153423222886969692274\n  Bound result 418953397262051719569741968557869382109849517007561673472049\n\n[PASS] testFuzz_DirectTransferRoundTripPreservesApprovals(uint256,uint256) (runs: 1000, μ: 263313, ~: 263888)\nLogs:\n  Bound result 211502438666529729176187332\n\n[PASS] testFuzz_FailedSpendCanBeRetriedAfterFunding(uint256,uint256,bool) (runs: 1000, μ: 345422, ~: 345736)\nLogs:\n  Bound result 396709796614368158168872960\n  Bound result 603290203385862790913585173\n\n[PASS] testFuzz_LoweringAllowanceImmediatelyInvalidatesThePreviousGrant(uint256,uint256) (runs: 1000, μ: 273451, ~: 274902)\nLogs:\n  Bound result 11890131939686\n  Bound result 10831312866156\n\n[PASS] testFuzz_TransferFromZeroCannotMint(uint256) (runs: 1000, μ: 90874, ~: 90831)\n[PASS] test_InfiniteAllowanceCanBeReplacedAndRevokedAfterUse() (gas: 371299)\n[PASS] test_MaximumFiniteAllowanceIsSpentRatherThanTreatedAsInfinite() (gas: 232013)\n[PASS] test_MaximumTransferAmountFailsWithoutConsumingInfiniteApproval() (gas: 156642)\n[PASS] test_OneWeiCanMakeARoundTrip() (gas: 143074)\n[PASS] test_OwnerSpenderAndRecipientCanAllBeTheSameAccount() (gas: 211185)\n[PASS] test_RefundDoesNotRestoreAnExhaustedAllowance() (gas: 216275)\n[PASS] test_RemainingAllowanceSurvivesAnEmptyBalanceAndRefill() (gas: 379735)\n[PASS] test_TransferFromZeroCannotMintAtBoundaryAmounts() (gas: 267720)\n[PASS] test_ZeroDelegatedTransferEmitsEventAndPreservesFiniteAllowance() (gas: 139564)\n[PASS] test_ZeroSpenderIsInvalidForBothZeroAndMaximumApproval() (gas: 72633)\n[PASS] test_ZeroTransferFromToZeroAddressStillReverts() (gas: 74709)\nSuite result: ok. 17 passed; 0 failed; 0 skipped; finished in 88.96ms (511.75ms CPU time)\n\nRan 1 test for test/CoinbaseToken.invariant.t.sol:CoinbaseTokenInvariantTest\n[PASS]\nCoinbaseTokenInvariantTest invariants:\n[PASS] invariant_EveryBalanceAndAllowanceMatchesTheLedger\n[PASS] invariant_MetadataStaysFixed\n[PASS] invariant_TotalSupplyAndAggregateBalancesStayFixed\n CoinbaseTokenInvariantTest invariants (runs: 256, calls: 24576, reverts: 0)\n\n╭----------------------+-------------------------------+-------+---------+----------╮\n| Contract             | Selector                      | Calls | Reverts | Discards |\n+===================================================================================+\n| CoinbaseTokenHandler | approve                       | 2474  | 0       | 0        |\n|----------------------+-------------------------------+-------+---------+----------|\n| CoinbaseTokenHandler | approveMaximum                | 2516  | 0       | 0        |\n|----------------------+-------------------------------+-------+---------+----------|\n| CoinbaseTokenHandler | rejectedTransfer              | 2520  | 0       | 0        |\n|----------------------+-------------------------------+-------+---------+----------|\n| CoinbaseTokenHandler | rejectedTransferFromAllowance | 2460  | 0       | 0        |\n|----------------------+-------------------------------+-------+---------+----------|\n| CoinbaseTokenHandler | rejectedTransferFromBalance   | 2440  | 0       | 0        |\n|----------------------+-------------------------------+-------+---------+----------|\n| CoinbaseTokenHandler | rejectedZeroAddress           | 2484  | 0       | 0        |\n|----------------------+-------------------------------+-------+---------+----------|\n| CoinbaseTokenHandler | revoke                        | 2404  | 0       | 0        |\n|----------------------+-------------------------------+-------+---------+----------|\n| CoinbaseTokenHandler | transfer                      | 2404  | 0       | 0        |\n|----------------------+-------------------------------+-------+---------+----------|\n| CoinbaseTokenHandler | transferFrom                  | 2428  | 0       | 0        |\n|----------------------+-------------------------------+-------+---------+----------|\n| CoinbaseTokenHandler | transferFullBalance           | 2446  | 0       | 0        |\n╰----------------------+-------------------------------+-------+---------+----------╯\n\nLogs:\n  Bound result 24576\n  Bound result 249526478465\n  Bound result 6084\n  Bound result 250000000000000249526478462\n  Bound result 461\n  Bound result 1\n  Bound result 115792089237316195423570985008687907853269984665640314039457584007776588086604\n  Bound result 6191544\n  Bound result 7\n  Bound result 9\n  Bound result 3878960842181727743180841\n  Bound result 250000000000000249526478001\n  Bound result 115792089237316195423570985008687907853269984665640564039457584007913129639935\n  Bound result 250000000000000000000000009\n  Bound result 0\n  Bound result 1000000000000000000000000000\n  Bound result 249999999999999750473546111\n  Bound result 8\n  Bound result 503\n  Bound result 499999999999999999999975901\n  Bound result 3553836896419771597080128315989210399169811717011875656807073628211209\n  Bound result 0\n  Bound result 88\n  Bound result 611\n  Bound result 4594636\n  Bound result 3015\n  Bound result 1497\n  Bound result 1554\n  Bound result 209723698371250952426923008\n  Bound result 7\n  Bound result 6\n  Bound result 40276301628748798046623518\n  Bound result 393976582171363100466081503\n  Bound result 356023417828637149060371876\n  Bound result 5997\n  Bound result 356023417828637149060371876\n  Bound result 242\n  Bound result 3\n  Bound result 483\n  Bound result 356023417828637149060371393\n  Bound result 0\n  Bound result 115792089237316195423570985008687907853269984665640314039457584008162656095273\n  Bound result 8702\n  Bound result 9973\n  Bound result 266\n  Bound result 40000000000000000000\n  Bound result 7955\n  Bound result 0\n  Bound result 356023417828637149060380102\n  Bound result 750000000000000249526452903\n  Bound result 1000000000000000000000000000\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 6.92s (6.92s CPU time)\n\nRan 3 test suites in 6.92s (7.10s CPU time): 48 tests passed, 0 failed, 0 skipped (48 total tests)\n","passed":true},{"durationMs":35,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"CoinbaseToken.approve(address,uint256)\",\"CoinbaseToken.transfer(address,uint256)\",\"CoinbaseToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":3,\"README.md\":132,\"dependencies.json\":54,\"foundry.toml\":22,\"remappings.txt\":2,\"src/CoinbaseToken.sol\":16,\"test/CoinbaseToken.allowance.t.sol\":310,\"test/CoinbaseToken.invariant.t.sol\":251,\"test/CoinbaseToken.t.sol\":414},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"fd6c8192e0a52fde4e198f2281ef709dc2e97c1384068472357117967f24070e","verifiedTreeHash":"a9abdcf72f29947cf4e29d8decb47837f52801ac","verifierVersion":"0.1.0+fb8278c5"}]}