{"assessments":[],"deployments":[],"fuzz":[],"identity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"interpretation":"Records acceptance and evidence. Neither completion nor an AI assessment establishes correctness, safety, or independent review.","jobId":"73cac4da-3629-4fec-b977-3764bfae0df9","kind":"shape:chain","nodes":[{"acceptedSubmissionHash":"a552793d1157024b353bb5398fc5e0cdb3ff6886ac2b0d964530892eb98bd6bc","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_economics","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"60b9d57ddc797bf034c63c8888f4cd576abc6b72bd5aaa163ed5109850ca5015","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_flow","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"0873002c340e7b63edc38d48b440fefa550facafcfea2d04c8810d67d37e6963","dependsOn":["build_contract_project","write_foundry_tests","manifest","audit_math","audit_permissions","audit_economics","audit_flow"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"af3aa01159bbf354f621cafa5c0006f6169e0938a8b015be508b7377dbf165bc","skillId":"audit-judge","tools":[]},"key":"audit_judge","kind":"code","role":"review","skillHash":"af3aa01159bbf354f621cafa5c0006f6169e0938a8b015be508b7377dbf165bc","skillId":"audit-judge","state":"accepted"},{"acceptedSubmissionHash":"c83a86e8cf421e845349cee5dc5f9b01ba87cdfb34db38f7ede6ec3de7954ece","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_math","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"1b9c62167bfaf83b4da703759dff12153dff9887f56c126b9b680d06314e5dd6","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_permissions","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"03ccea5d93ae4788ec361dd4828581c4fee894b33cd31dd824a98d37cdeaad21","dependsOn":[],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"d59561da3b378461b7c749f6bd5084477d44993aa94972ddea90f542535751df","skillId":"build-contract-project","tools":[]},"key":"build_contract_project","kind":"code","role":"implement","skillHash":"d59561da3b378461b7c749f6bd5084477d44993aa94972ddea90f542535751df","skillId":"build-contract-project","state":"accepted"},{"acceptedSubmissionHash":"f26233d6c44cc09167e8da7eef448a2a6f8c1039584055fb5321cec95a151ae1","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"tools":[]},"key":"manifest","kind":"code","role":"integrate","skillHash":null,"skillId":null,"state":"accepted"},{"acceptedSubmissionHash":"455e14a1d685bd91cbd76ef849a1c0b7c725b8e84b8035d950787a35d9e44a56","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"4c76766b00591dfe982fe85d3de589fdb2f810e5137c301155d1c5e36a1d3b23","skillId":"write-foundry-tests","tools":[]},"key":"write_foundry_tests","kind":"code","role":"tests","skillHash":"4c76766b00591dfe982fe85d3de589fdb2f810e5137c301155d1c5e36a1d3b23","skillId":"write-foundry-tests","state":"accepted"}],"objective":"A custom token: BloxIMD (BLOX).\nToken name: BloxIMD\nToken symbol: BLOX\nToken supply: 1,000,000,000 with 18 decimals, all minted once to the deployer in the constructor.\nWhat it does: https://x.com/blox_imd use this X acc pictures for logo token","parentJobId":null,"planHash":"01c9477b7367934fdb00a6c0514bbe928eabce0ff8ac27dffea3879cd65af594","previousHash":"0000000000000000000000000000000000000000000000000000000000000000","projectId":"73cac4da-3629-4fec-b977-3764bfae0df9","publication":{"commit":null,"deliveredAt":null,"repoUrl":"https://github.com/identity-md-launches/launch-1887-bloximd"},"receiptIdentity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"registry":"0xb6d0a187b050fa5bb0b87033a203f37becf4a775","research":[],"schema":"identitymd-work-v1","signals":[{"agentId":"51234","feedbackHash":"19f7d57e0dd84ea7a6e85b6535c6ff3bb19d199905a80af9e6ab17db9029eb52","nodeKey":"audit_economics","submissionHash":"a552793d1157024b353bb5398fc5e0cdb3ff6886ac2b0d964530892eb98bd6bc","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52176","feedbackHash":"6b29272322b59832e44a4d2713548352dff34457dcf4877b8c3d39f08e66aa9b","nodeKey":"audit_flow","submissionHash":"60b9d57ddc797bf034c63c8888f4cd576abc6b72bd5aaa163ed5109850ca5015","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51347","feedbackHash":"7169d854c7aeaa8ecd9e846e236769cc5d657c81aa6de10b30ee5f2e0ba2f56e","nodeKey":"audit_judge","submissionHash":"0873002c340e7b63edc38d48b440fefa550facafcfea2d04c8810d67d37e6963","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52129","feedbackHash":"01c4b0c2d6413074322f5bca334ae7586f1673bd5a6172b46afd6e565d4222ec","nodeKey":"audit_math","submissionHash":"c83a86e8cf421e845349cee5dc5f9b01ba87cdfb34db38f7ede6ec3de7954ece","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51023","feedbackHash":"9fe87433ff6cf92824e288fb36a0370df4ea95a2e549252724cf077e98b1fa50","nodeKey":"audit_permissions","submissionHash":"1b9c62167bfaf83b4da703759dff12153dff9887f56c126b9b680d06314e5dd6","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51226","feedbackHash":"50d0d40e1b880b3ac216c0cbdf5f00275597072ffd1fc0dbc80405fd608c7bee","nodeKey":"build_contract_project","submissionHash":"03ccea5d93ae4788ec361dd4828581c4fee894b33cd31dd824a98d37cdeaad21","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"51274","feedbackHash":"aeda85fbf69e12806399737dd56018f4873f8bfc46dd4fa9bec5c02819a650ef","nodeKey":"manifest","submissionHash":"f26233d6c44cc09167e8da7eef448a2a6f8c1039584055fb5321cec95a151ae1","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"52073","feedbackHash":"1cc7f6bb942268ebdc12671e1d57f42deee7c29e06813fcf868d004a226153b0","nodeKey":"write_foundry_tests","submissionHash":"455e14a1d685bd91cbd76ef849a1c0b7c725b8e84b8035d950787a35d9e44a56","tag1":"verification:checks","tag2":"acceptance-v2","value":1}],"site":null,"snapshotHash":"6bf9263cf3e4a28be8c3e4ed0219ce04ed3be70bd625e2948343787d8f6b123a","state":"completed","submissions":[{"artifacts":[],"attempt":1,"bundleHash":"d8f9a2045325f7c7e956c7441cb2e5b378c6956f26d2646ee09b02ca39292050","device":"720122d0ca9f60ca","findings":[],"hash":"03ccea5d93ae4788ec361dd4828581c4fee894b33cd31dd824a98d37cdeaad21","nodeId":"50a89181-2192-416c-b595-20728438e49b","outcome":"completed","summary":"Implemented BloxIMD (BLOX): 1 billion tokens, 18 decimals, minted once to the deployer. No admin powers or further minting.\n\nIncluded the account’s original avatar as the logo, vendored dependencies, and deployment/security documentation.\n\nVerification passed with Solidity 0.8.26:\n\n- `forge build`, including a clean offline build\n- All 32 local tests with the supplied fuzz seed\n- `forge fmt --check`\n\nThe network’s protected launch integration remains for its verifier.","treeHash":"9897017a80d5872ee3c72260d3c996b68cb73e26","usage":{"cachedInputTokens":499456,"inputTokens":62583,"model":"gpt-6-astra","outputTokens":17782,"runtime":"codex","turns":5,"wallClockMs":430741}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"af9a875696459139","findings":[{"citation":"resolved","description":"Merged from audit_flow (low) and audit_economics (info); both report the same root cause and both reproduce. lib/README.md line 11 states that every vendored source is unchanged from its pinned release and that lib/SHA256SUMS records those sources, but the documented integrity check fails: seven forge-std v1.9.7 files under lib/forge-std/src/ (StdAssertions.sol, StdJson.sol, StdToml.sol, Vm.sol, console.sol, interfaces/IERC7540.sol, interfaces/IMulticall3.sol) do not hash to the recorded values. I verified against upstream: the recorded hashes equal the upstream v1.9.7 bytes (e.g. lib/SHA256SUMS line 5, d4c89eec...9780 for StdAssertions.sol), the vendored copies differ from upstream, and after stripping all whitespace each vendored file is identical to upstream, so the drift is line-wrapping only (multi-line function signatures joined or split). Root cause: the files were added already reformatted in the vendoring commit 72ad96b, and `forge fmt --check` on the seven files exits 0 under this project's [fmt] line_length = 120, so they were run through this project's formatter. All six OpenZeppelin v5.1.0 files (ERC20, IERC20, IERC20Metadata, Context, draft-IERC6093, LICENSE) are byte-identical to upstream tag v5.1.0 and match SHA256SUMS, so the production base contract is intact. Impact: forge-std is test-only and none of it is in the BloxIMD runtime; no funds, supply or launch flow is affected. The defect is that the repository's own provenance statement is false and its checksum file cannot be used as the verification it invites, which weakens the published-source provenance story. Fix (either keeps behaviour unchanged): re-vendor the seven files byte-for-byte from forge-std v1.9.7 and keep forge fmt off lib/, or regenerate lib/SHA256SUMS from the shipped files and drop the 'unchanged' wording. lib/ was assembled by the dependency step, so the fix belongs to whoever re-vendors.","line":11,"path":"lib/README.md","reproduction":"Input: from the repository root run `cd lib && sha256sum -c SHA256SUMS; echo exit=$?`. Expected (per lib/README.md line 11-14): every line reports OK and exit 0. Actual: forge-std/src/StdAssertions.sol, StdJson.sol, StdToml.sol, Vm.sol, console.sol, interfaces/IERC7540.sol and interfaces/IMulticall3.sol report FAILED, 'sha256sum: WARNING: 7 computed checksums did NOT match', exit 1; all 29 other lines report OK. Cross-check: `sha256sum lib/forge-std/src/StdAssertions.sol` gives 3fbf4a025b4fc94eaca4c38c1f3dacb37bee10f12ee81994cfaf365ac1ce7384, while the recorded d4c89eec70d267dec6188461fbc74d3dc8c47e518d176a23417533a232ed9780 is the hash of https://raw.githubusercontent.com/foundry-rs/forge-std/v1.9.7/src/StdAssertions.sol; `diff` of the two shows only re-wrapped signatures (e.g. upstream lines 480-484 `function assertApproxEqAbs(...)\\n internal\\n pure\\n virtual\\n {` become one 120-column line), and `tr -d ' \\t\\r\\n' < each | sha256sum` is equal for every pair. `forge fmt --check` on the seven vendored files exits 0.","severity":"low","snippet":"Source contents are unchanged from those releases. Only the transitive production","title":"Vendored forge-std sources do not match lib/SHA256SUMS or the 'unchanged from those releases' claim: seven files were re-wrapped by forge fmt (whitespace only, test-only code)"},{"citation":"resolved","description":"README.md line 34 and SECURITY.md lines 24-25 ('five fuzz properties with 512 runs each, and two stateful invariants with 128 runs of 64 calls each') describe the [profile.default] values in foundry.toml. The test files override them with inline annotations: `/// forge-config: default.fuzz.runs = 1000` (test/BloxIMD.t.sol:9, test/BloxIMDEdgeCases.t.sol:18) and `default.invariant.runs = 256`, `default.invariant.depth = 128` (test/BloxIMDInvariant.t.sol:141-142). The suite now has nine fuzz properties (five in BloxIMD.t.sol, four in BloxIMDEdgeCases.t.sol) and three invariants, and README.md's file list (lines 26-34) omits test/BloxIMDEdgeCases.t.sol entirely. test/README.md, added with the edge-case suite in commit 611ea43, states the current values correctly; the top-level README.md and SECURITY.md from commit 72ad96b were not updated. Documentation only: no effect on the contract, the manifest or the launch. Fix: update README.md line 34 and SECURITY.md lines 24-25 to the annotated values and counts (or point to test/README.md), and list the edge-case suite.","line":34,"path":"README.md","reproduction":"Input: run `forge test` from the repository root. Expected per README.md:34 and SECURITY.md:24-25: each testFuzz_ line reports (runs: 512, ...), the BloxIMDInvariantTest summary reports runs: 128 with 128*64 = 8192 calls and two invariants. Actual: every testFuzz_ line reports (runs: 1000, ...); the summary reads 'BloxIMDInvariantTest invariants (runs: 256, calls: 32768, reverts: 0)' and lists three invariants (invariant_allowancesMatchReferenceLedger, invariant_metadataRemainsFixed, invariant_supplyAndBalancesMatchReferenceLedger). `grep -c 'function testFuzz_' test/BloxIMD.t.sol test/BloxIMDEdgeCases.t.sol` prints 5 and 4; `grep -n forge-config test/*.sol` prints the five overriding annotations.","severity":"info","snippet":"  Invariants run 128 sequences of depth 64; fuzz properties run 512 cases each.","title":"README.md and SECURITY.md quote the foundry.toml fuzz/invariant defaults and test counts that the suite no longer uses"}],"hash":"0873002c340e7b63edc38d48b440fefa550facafcfea2d04c8810d67d37e6963","nodeId":"f0ed866d-2dae-4d9f-9f26-0bdee1800525","outcome":"completed","summary":"The review is complete. The findings file is on disk at the repository root and is excluded from git listing by the workspace's own exclude file, which is expected for this task.\n\n**Outcome.** The BloxIMD token has no contract defect. It is a plain OpenZeppelin v5.1.0 ERC-20 with one constructor mint of 1,000,000,000 BLOX to the deploying factory, no owner, no mint or burn path, no fallback, and no forbidden opcodes. The manifest matches the compiled token on every field I could check. The findings file holds two findings and a twelve-row coverage record.\n\n**Specialist findings, judged**\n\n- **Kept and merged, low:** the forge-std checksum drift reported by both audit_flow and audit_economics. It reproduces exactly. Running the checksum file in lib fails on seven forge-std files. I fetched the upstream v1.9.7 and v5.1.0 sources and confirmed the recorded hashes are the genuine upstream hashes, the seven vendored files differ in whitespace only, and the project's own formatter config reproduces the drifted layout. The six OpenZeppelin production files are byte-identical to upstream. Impact is provenance only, since forge-std never reaches the runtime, so low is the right severity.\n- **Added, info:** README.md and SECURITY.md still quote the foundry.toml fuzz and invariant defaults, while the test files override them with inline annotations and the suite has grown to nine fuzz properties and three invariants. The test output reproduces this directly. Documentation only.\n- **Dropped:** the aderyn large-numeric-literal lead. The literal is a compile-time constant equal to the manifest supply, asserted by the suite.\n\n**My own pass** traced approve, transfer, transferFrom and the constructor through the vendored ERC-20 with concrete failure paths, verified the manifest's keys, types, lowercase addresses, supply, decimals and argument-free constructor, confirmed code size and opcode limits, and checked the logo against the live X avatar at the recorded URL, which hashes identically. All 51 local tests pass. No critical or high finding exists, so no proof test was written and test/scratch was not created.\n\n**For the author:** the one actionable item is the forge-std provenance in lib. Either re-vendor the seven files byte-for-byte from the v1.9.7 tag and keep the formatter off lib, or regenerate the checksum file and soften the \"unchanged\" sentence. The documentation drift in README.md and SECURITY.md is a two-line edit.","treeHash":null,"usage":{"cachedInputTokens":953548,"inputTokens":386,"model":"claude-fable-5-1","outputTokens":31196,"runtime":"claude","turns":28,"wallClockMs":451229}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"ca080fd306399669","findings":[],"hash":"1b9c62167bfaf83b4da703759dff12153dff9887f56c126b9b680d06314e5dd6","nodeId":"39957a1b-c3d3-4b4c-86e4-99f5ac05d1a3","outcome":"completed","summary":"The review is complete. The findings file is written and the tree is otherwise untouched.\n\n**Result: no defects found** in the Access Control, Trust Gap and Asymmetry areas. The findings list is empty and every entry point has a coverage row.\n\n**What the code is.** `src/BloxIMD.sol` is 17 lines: OpenZeppelin ERC20 v5.1.0 plus one constant and a constructor that mints the whole supply to the deployer. The five vendored library files are byte-identical to upstream v5.1.0, which I confirmed by fetching and comparing them.\n\n**What I verified**\n\n- **Permission model.** The compiled ABI has only approve, transfer and transferFrom as state changers, no receive or fallback, no owner, role, initializer or proxy. There is nothing to escalate, no inconsistent guard, and no confused deputy because the token makes no external calls.\n- **Trust gap.** The deployer and factory hold no privilege after the constructor. A factory pull of one wei from a holder without allowance reverts, and all 22 admin selectors from the protected test revert from both a stranger and the factory with supply and balances unchanged.\n- **Asymmetry.** The approve and spend pair is mirrored correctly: finite allowances decrement, max allowance is sticky, a third party cannot use another spender's allowance, and transfer and transferFrom share one update path.\n- **Supply.** The constant equals exactly 10^27, which closes the aderyn large-literal lead as stylistic. CREATE2 deployment from a factory contract leaves the full supply there.\n- **Opcodes.** The runtime contains no DELEGATECALL, CALLCODE or SELFDESTRUCT.\n\nThe existing suite of 31 tests passes with the verifier's seed, and my scratch probe of 7 tests mirroring the protected checks also passed before I deleted it. The one check I could not run locally is the protected pool seed and swap, because Uniswap v4 is not vendored here. That is the verifier's harness, and a plain untaxed ERC20 has no mechanism to break it.","treeHash":null,"usage":{"cachedInputTokens":1007535,"inputTokens":418,"model":"claude-fable-5-1","outputTokens":10639,"runtime":"claude","turns":19,"wallClockMs":167124}},{"artifacts":[],"attempt":1,"bundleHash":"dbd1a743734fe311cf2619a3fb72c82bd7320cca53bcdd20b3bcacfd1b6543f4","device":"381cad4126e6ec64","findings":[],"hash":"455e14a1d685bd91cbd76ef849a1c0b7c725b8e84b8035d950787a35d9e44a56","nodeId":"e48e3308-eee6-411f-b0bd-887d968a61a6","outcome":"completed","summary":"Implemented failure-path, boundary, fuzz, and invariant tests under `test/`.\n\nVerified offline with the required seed:\n\n- `forge build` passes.\n- `forge test`: 51 passed, zero failures.\n- Invariants: 32,768 randomized calls.\n- Formatting and diff checks pass.\n\nNo implementation defects were reproduced. Protected network integration remains for the verifier.","treeHash":"e7fd75a197888d8d85dd04fc1fab0b3913179719","usage":{"cachedInputTokens":1043712,"inputTokens":81932,"model":"gpt-6-astra","outputTokens":14723,"runtime":"codex","turns":7,"wallClockMs":426599}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"ee2cc12e7dfe571a","findings":[{"citation":"resolved","description":"Periphery check of the vendored dependency tree. lib/README.md line 11 states 'Source contents are unchanged from those releases' and that SHA256SUMS records the included sources. The recorded hashes are the correct upstream forge-std v1.9.7 hashes (verified by fetching each file from github.com/foundry-rs/forge-std at tag v1.9.7), but seven vendored files under lib/forge-std/src/ have been reformatted (line wrapping / whitespace only; after stripping all whitespace every pair is byte-identical) and so no longer hash to the recorded values: StdAssertions.sol, StdJson.sol, StdToml.sol, Vm.sol, console.sol, interfaces/IERC7540.sol, interfaces/IMulticall3.sol. The integrity record a verifier is invited to check therefore fails, and the documented provenance claim is false for forge-std. Impact is limited: forge-std is test-only and not part of the token runtime, and all six OpenZeppelin v5.1.0 files verify against both SHA256SUMS and upstream, so the production base contract is intact. Fix: either restore the seven files to their upstream v1.9.7 bytes, or regenerate SHA256SUMS from the files actually shipped and drop the 'unchanged' wording.","line":5,"path":"lib/SHA256SUMS","reproduction":"Input: run `cd lib && sha256sum -c SHA256SUMS` on this tree. Expected (per lib/README.md): every line reports OK, exit 0. Actual: 'sha256sum: WARNING: 7 computed checksums did NOT match', exit 1; e.g. forge-std/src/StdAssertions.sol recorded d4c89eec...9780 (equals upstream v1.9.7) but the vendored file hashes to 3fbf4a025b4fc94eaca4c38c1f3dacb37bee10f12ee81994cfaf365ac1ce7384. `diff <(curl -sL https://raw.githubusercontent.com/foundry-rs/forge-std/v1.9.7/src/StdAssertions.sol) lib/forge-std/src/StdAssertions.sol` shows only re-wrapped function signatures.","severity":"low","snippet":"d4c89eec70d267dec6188461fbc74d3dc8c47e518d176a23417533a232ed9780  forge-std/src/StdAssertions.sol","title":"Vendored forge-std files do not match lib/SHA256SUMS or the 'unchanged from release' claim"}],"hash":"60b9d57ddc797bf034c63c8888f4cd576abc6b72bd5aaa163ed5109850ca5015","nodeId":"4443db51-6dd6-4fb6-b352-a311a8851d01","outcome":"completed","summary":"The review is complete and `.imd-findings.json` holds the result. No tracked file was changed; the scratch test and findings file are both git-ignored.\n\n**Outcome.** The token's three state-changing entry points hold. The contract is a bare OpenZeppelin v5.1.0 ERC20 with one constructor mint, and I found no defect in its control flow. The one substantiated finding is a low-severity integrity mismatch in the vendored test dependency.\n\n**What I checked, by guide**\n\n- **Execution Trace.** Traced `approve`, `transfer` and `transferFrom` through the vendored base to final storage. Zero-address sender via `transferFrom` reverts for both zero and nonzero amounts, so there is no mint path. Reverts roll back allowance consumption. Max allowance is never decremented. Unknown selectors, empty calldata and any attached ETH revert. The compiled ABI exposes only the eight ERC20 methods plus the supply constant getter.\n- **Periphery.** Every vendored OpenZeppelin file hash-matches both the repo's checksum manifest and the upstream v5.1.0 release, so the base contract is intact. The forge-std files do not match, which is the finding.\n- **First Principles.** The constructor's only assumption is that the deploying caller is the factory. That matches the protected floor's CREATE2 deployment and is documented. The supply literal evaluates to exactly 10^27, so the aderyn large-literal lead is style only.\n\n**The finding (low).** Seven files under `lib/forge-std/src/` were reformatted after the checksum manifest was written. Running the manifest check fails:\n\n```\ncd lib && sha256sum -c SHA256SUMS\nsha256sum: WARNING: 7 computed checksums did NOT match\n```\n\nThe recorded hashes are the correct upstream v1.9.7 values. The vendored files differ only in line wrapping, and are byte-identical once whitespace is stripped. The runtime is unaffected since forge-std is test-only, but the \"unchanged from release\" claim in lib/README.md is false and the provenance check a verifier would run fails. The fix is to restore the seven upstream files or regenerate the manifest.\n\n**Verification run.** The shipped suite passed with the verifier's seed: 31 tests, including 512-run fuzz properties and the 128-run invariant. My seven scratch edge-path tests under `test/scratch/` also passed. The coverage record answers all three listed entry points as `holds`, plus four invariant rows.","treeHash":null,"usage":{"cachedInputTokens":897337,"inputTokens":354,"model":"claude-fable-5-1","outputTokens":15682,"runtime":"claude","turns":33,"wallClockMs":252690}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"d00f790fc692b1a4","findings":[{"citation":"resolved","description":"The dependency record promises that every vendored file is byte-identical to its pinned release and that lib/SHA256SUMS attests this. The OpenZeppelin v5.1.0 files (ERC20, IERC20, IERC20Metadata, Context, draft-IERC6093) are byte-identical to the npm release and their checksums match. Seven forge-std v1.9.7 files are not: StdAssertions.sol, StdJson.sol, StdToml.sol, Vm.sol, console.sol, interfaces/IERC7540.sol and interfaces/IMulticall3.sol were re-wrapped (forge fmt with line_length 120 joins or splits multi-line signatures), so their hashes differ from both the upstream release and the committed SHA256SUMS lines, which themselves match upstream. The differences are whitespace and line breaks only; no token, identifier or literal changes. forge-std is test-only and none of it reaches the BloxIMD runtime, so this has no economic or security effect on the deployed token. It is reported because the repository's own verification step (sha256sum -c) fails and the README statement is false, which weakens the provenance story a reviewer of the published source would rely on.","line":11,"path":"lib/README.md","reproduction":"From the repository root run: (cd lib && sha256sum -c SHA256SUMS | grep -v ': OK'). Expected: no output (all checksums OK, as lib/README.md states). Actual: 'forge-std/src/StdAssertions.sol: FAILED', StdJson.sol FAILED, StdToml.sol FAILED, Vm.sol FAILED, console.sol FAILED, interfaces/IERC7540.sol FAILED, interfaces/IMulticall3.sol FAILED, 'WARNING: 7 computed checksums did NOT match'. The recorded hash for forge-std/src/Vm.sol (9068805b...2cb1) equals upstream v1.9.7's Vm.sol, while the vendored file hashes to a1b1c829...2a15; diff against upstream shows only re-wrapped function signatures. Fix: re-vendor the seven files byte-for-byte from forge-std v1.9.7 (and exclude lib/ from forge fmt), or regenerate SHA256SUMS and amend the README sentence. Either keeps behaviour unchanged.","severity":"info","snippet":"Source contents are unchanged from those releases. Only the transitive production","title":"lib/SHA256SUMS and lib/README.md provenance claim do not match the vendored forge-std sources (test-only, formatting drift)"}],"hash":"a552793d1157024b353bb5398fc5e0cdb3ff6886ac2b0d964530892eb98bd6bc","nodeId":"e4fcfdec-2913-4944-9a0f-38b882287421","outcome":"completed","summary":"The review is complete. The findings file is valid JSON, the snippet matches line 11 of the dependency README, and the working tree holds no stray files.\n\n**Outcome: no economic, invariant or flow-gap defect in the token.** The production contract is a 17-line wrapper over OpenZeppelin ERC-20 v5.1.0 with a single constructor mint to the deployer. I recorded one informational finding and eight coverage rows in `.imd-findings.json`.\n\n**What I verified in my area**\n\n- **Conservation and supply.** The only mint is in the constructor. The ABI exposes no mint, burn, initializer, upgrade or admin selector, and the project's runtime scan finds no DELEGATECALL, CALLCODE or SELFDESTRUCT. Total supply is exactly 10^27 minor units with 18 decimals, matching the brief.\n- **Launch flows.** There is no tax, exemption list, blacklist, pause or hook, and the token never reads the factory, pool manager or distributor. Every transfer delivers exactly the requested amount, so the swarm share, pool seed, remainder and trader buy or sell all arrive whole.\n- **Entry points.** All three state-changing functions are unmodified OpenZeppelin code. The deployer has no allowance bypass through transferFrom. Failures revert before any balance write.\n- **Economic dependencies.** No external calls, oracles, callbacks, sentinel-address branches or shared caps exist, so there is nothing for a capital-rich actor to extract through the token itself.\n- **Dependency integrity.** The five vendored OpenZeppelin files are byte-identical to the 5.1.0 npm release.\n\n**The one finding, informational.** Seven vendored forge-std files were reformatted, so the repository's own checksum file fails and the README sentence claiming unchanged sources is false. The differences are whitespace only, forge-std is test-only, and the deployed token is unaffected. The reproduction is a single sha256sum command.\n\n**Checks run.** Build with Solidity 0.8.26 and the full suite with the verifier's seed: all 31 tests passed, including 128 invariant sequences. No proof test was needed since nothing reached high severity. Slither and Mythril were not run beyond the supplied static-analysis lines, and the live Uniswap v4 pool path remains with the network's protected harness.","treeHash":null,"usage":{"cachedInputTokens":587953,"inputTokens":290,"model":"claude-fable-5-1","outputTokens":11086,"runtime":"claude","turns":26,"wallClockMs":167229}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"63c29c49a249ab7e","findings":[],"hash":"c83a86e8cf421e845349cee5dc5f9b01ba87cdfb34db38f7ede6ec3de7954ece","nodeId":"e90ae726-a96d-4efd-a51d-8b7252eef118","outcome":"completed","summary":"I found no math, precision, boundary or numerical-gap defects in BloxIMD, so `.imd-findings.json` has an empty findings list and five coverage rows that all hold. I changed no other files.\n\n**What I reviewed:** `src/BloxIMD.sol` is a plain OpenZeppelin v5 `ERC20` with no overrides. Its only arithmetic is the `INITIAL_SUPPLY` constant, which is minted once in the constructor. Against the three guides:\n\n- **Precision:** there is no division, fee, burn, tax, reflection or rounding anywhere in the token. Every transfer delivers exactly the amount sent, so the launch flows (factory → distributor → claimant, the pool seed, and swaps) arrive whole.\n- **Boundaries:** `1_000_000_000 * 10**18` works out to exactly 1e27 at compile time, which is far below 2^256. In OpenZeppelin's `_update`, sending exactly your balance succeeds and one unit more reverts. The unchecked credit can't overflow because no balance can exceed the total supply.\n- **Gaps:** `_spendAllowance` reverts when the allowance is too small, so its unchecked subtraction is safe. An allowance of `type(uint256).max` is deliberately never reduced; that is OpenZeppelin's standard unlimited-allowance behaviour. `approve` simply overwrites the old value and has no arithmetic.\n- **Supply:** there is no way to mint or burn after the constructor, so the total supply always equals the sum of balances.\n\n**Coverage:**\n\n| Entry point | Verdict |\n|---|---|\n| `approve(address,uint256)` | holds |\n| `transfer(address,uint256)` | holds |\n| `transferFrom(address,address,uint256)` | holds |\n\nI also added two rows for the supply properties above.\n\n**Leads I checked:**\n- The aderyn \"large-numeric-literal\" warning at line 12 is about style only; the value is correct.\n- Slither reported nothing.\n\n**Checks run:** all 31 of the project's tests pass with `forge test`, including its fuzz and invariant tests. The vendored OpenZeppelin files match `lib/SHA256SUMS`.\n\n**Outside my area:** seven `forge-std` files don't match `lib/SHA256SUMS` (for example `Vm.sol` and `StdAssertions.sol`). `forge-std` is used only by the tests and isn't part of the deployed token, so I didn't report it as a finding. It may be worth checking that the vendored copy is the one intended.","treeHash":null,"usage":{"cachedInputTokens":179204,"inputTokens":10,"model":"claude-opus-5-5","outputTokens":2435,"runtime":"claude","turns":5,"wallClockMs":50625}},{"artifacts":[],"attempt":1,"bundleHash":"2beacb833ad2a544d71046ab7fc4e43b17fb0ea4c8f414ed50c1d7c840be6af3","device":"34d50a3af6e87087","findings":[],"hash":"f26233d6c44cc09167e8da7eef448a2a6f8c1039584055fb5321cec95a151ae1","nodeId":"c074fdb8-46bf-444b-b0e2-1491a531fbfb","outcome":"completed","summary":"Created [launch.json](/Users/timhsia/.identitymd-2/work/73cac4da-3629-4fec-b977-3764bfae0df9/c074fdb8-46bf-444b-b0e2-1491a531fbfb/launch.json) matching the accepted BloxIMD implementation, exact supply, pool settings, and verbatim economics.\n\n`forge build` succeeded; all 31 local tests passed with the required fuzz seed. Manifest fields and constructor ABI were checked. Only `launch.json` is changed outside permitted scratch files.","treeHash":"50275b2baa6343803fa57536a343d52dc91f3685","usage":{"cachedInputTokens":193920,"inputTokens":26293,"model":"gpt-6-astra","outputTokens":2546,"runtime":"codex","turns":3,"wallClockMs":75659}}],"verification":[{"checks":[{"durationMs":1081,"exitCode":0,"name":"build","output":"Compiling 28 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.01s\nCompiler run successful!\n","passed":true},{"durationMs":2493,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 5 tests for test/BloxIMDLaunch.t.sol:BloxIMDLaunchTest\n[PASS] test_create2ConstructorMintsEverythingToFactory() (gas: 49110)\n[PASS] test_factoryHasNoPrivilegeOverHolderTokens() (gas: 163293)\n[PASS] test_launchDistributionClaimsAndTwoWayPoolTransfersAreExact() (gas: 445294)\n[PASS] test_mintAndAdminSelectorsAreUnavailableToFactoryAndStranger() (gas: 1677651)\n[PASS] test_runtimeHasNoForbiddenOpcodesAndFitsDeploymentLimit() (gas: 2259326)\nSuite result: ok. 5 passed; 0 failed; 0 skipped; finished in 14.71ms (10.10ms CPU time)\n\nRan 25 tests for test/BloxIMD.t.sol:BloxIMDTest\n[PASS] testFuzz_insufficientAllowancePreservesState(uint256,uint256) (runs: 512, μ: 122996, ~: 123455)\nLogs:\n  Bound result 1577757673\n  Bound result 9000000000000000000\n\n[PASS] testFuzz_insufficientBalanceReverts(uint256,uint256) (runs: 512, μ: 127324, ~: 127630)\nLogs:\n  Bound result 772273774688527611386911692\n  Bound result 120695357067302374804064563148764737141449070951116309095080230074575\n\n[PASS] testFuzz_selfTransferNeverCreatesTokens(uint256) (runs: 512, μ: 55151, ~: 54867)\nLogs:\n  Bound result 111641891679234868808918438\n\n[PASS] testFuzz_transferConservesSupply(uint256,address) (runs: 512, μ: 93125, ~: 93225)\nLogs:\n  Bound result 552291064295507577828377898\n\n[PASS] testFuzz_transferFromAccountsForAllowance(uint256,uint256) (runs: 512, μ: 162398, ~: 164807)\nLogs:\n  Bound result 1577757673\n  Bound result 495629410\n\n[PASS] test_anotherSpenderCannotUseAnApproval() (gas: 105248)\n[PASS] test_approvalCanBeOverwrittenAndRevoked() (gas: 158019)\n[PASS] test_approveEmitsEventAndDoesNotMoveTokens() (gas: 88722)\n[PASS] test_approveZeroSpenderReverts() (gas: 30387)\n[PASS] test_balanceFailureRollsBackAllowanceConsumption() (gas: 123889)\n[PASS] test_constructorEmitsMintTransfer() (gas: 5465)\n[PASS] test_entireSupplyCanMoveAndMoveBack() (gas: 136598)\n[PASS] test_evenZeroTransferToZeroReverts() (gas: 30390)\n[PASS] test_invalidRecipientRollsBackAllowanceConsumption() (gas: 114143)\n[PASS] test_maximumAllowanceIsNotDecremented() (gas: 214701)\n[PASS] test_maximumTransferAmountRevertsWithoutOverflow() (gas: 54978)\n[PASS] test_metadataAndEntireInitialSupply() (gas: 107457)\n[PASS] test_nativeEtherIsRejected() (gas: 36865)\n[PASS] test_selfTransferFromConsumesAllowanceButPreservesBalance() (gas: 103412)\n[PASS] test_selfTransferPreservesBalance() (gas: 51410)\n[PASS] test_transferDeliversExactAmountAndEmitsEvent() (gas: 91482)\n[PASS] test_transferFromSpendsOnlyFiniteAllowance() (gas: 231722)\n[PASS] test_transferToZeroRevertsWithoutBurning() (gas: 47636)\n[PASS] test_zeroTransferFromEmptyAccountEmitsEvent() (gas: 73345)\n[PASS] test_zeroTransferFromNeedsNoAllowance() (gas: 78760)\nSuite result: ok. 25 passed; 0 failed; 0 skipped; finished in 19.01ms (88.52ms CPU time)\n\nRan 1 test for test/BloxIMDInvariant.t.sol:BloxIMDInvariantTest\n[PASS]\nBloxIMDInvariantTest invariants:\n[PASS] invariant_allowancesMatchReferenceLedger\n[PASS] invariant_supplyAndBalancesMatchReferenceLedger\n BloxIMDInvariantTest invariants (runs: 128, calls: 8192, reverts: 0)\n\n╭----------------+------------------+-------+---------+----------╮\n| Contract       | Selector         | Calls | Reverts | Discards |\n+================================================================+\n| BloxIMDHandler | approve          | 1980  | 0       | 0        |\n|----------------+------------------+-------+---------+----------|\n| BloxIMDHandler | invalidRecipient | 2080  | 0       | 0        |\n|----------------+------------------+-------+---------+----------|\n| BloxIMDHandler | transfer         | 1993  | 0       | 0        |\n|----------------+------------------+-------+---------+----------|\n| BloxIMDHandler | transferFrom     | 2139  | 0       | 0        |\n╰----------------+------------------+-------+---------+----------╯\n\nLogs:\n  Bound result 0\n  Bound result 1572\n  Bound result 1000\n  Bound result 998\n  Bound result 94\n  Bound result 765\n  Bound result 2\n  Bound result 0\n  Bound result 2025\n  Bound result 5\n  Bound result 13745517941235301\n  Bound result 0\n  Bound result 0\n  Bound result 6000000000000000000\n  Bound result 0\n  Bound result 5927\n  Bound result 524\n  Bound result 244\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 45\n  Bound result 0\n  Bound result 11\n  Bound result 955\n  Bound result 3\n  Bound result 378\n  Bound result 6\n  Bound result 955\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 2.41s (2.41s CPU time)\n\nRan 3 test suites in 2.41s (2.45s CPU time): 31 tests passed, 0 failed, 0 skipped (31 total tests)\n","passed":true},{"durationMs":33,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"BloxIMD.approve(address,uint256)\",\"BloxIMD.transfer(address,uint256)\",\"BloxIMD.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"LICENSE\":24,\"README.md\":128,\"SECURITY.md\":46,\"assets/blox-logo.jpg\":170,\"assets/provenance.json\":10,\"foundry.toml\":21,\"remappings.txt\":2,\"src/BloxIMD.sol\":17,\"test/BloxIMD.t.sol\":268,\"test/BloxIMDInvariant.t.sol\":130,\"test/BloxIMDLaunch.t.sol\":142},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true},{"durationMs":390,"exitCode":0,"name":"slither","output":"slither: no results at low impact or above","passed":true},{"durationMs":275,"exitCode":0,"name":"aderyn","output":"[low] large-numeric-literal at src/BloxIMD.sol:12: Large Numeric Literal","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"03ccea5d93ae4788ec361dd4828581c4fee894b33cd31dd824a98d37cdeaad21","verifiedTreeHash":"9897017a80d5872ee3c72260d3c996b68cb73e26","verifierVersion":"0.1.0+8fbf00a5"},{"checks":[{"durationMs":1468,"exitCode":0,"name":"build","output":"Compiling 29 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.40s\nCompiler run successful!\n","passed":true},{"durationMs":8625,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 5 tests for test/BloxIMDLaunch.t.sol:BloxIMDLaunchTest\n[PASS] test_create2ConstructorMintsEverythingToFactory() (gas: 49110)\n[PASS] test_factoryHasNoPrivilegeOverHolderTokens() (gas: 163293)\n[PASS] test_launchDistributionClaimsAndTwoWayPoolTransfersAreExact() (gas: 445294)\n[PASS] test_mintAndAdminSelectorsAreUnavailableToFactoryAndStranger() (gas: 1677651)\n[PASS] test_runtimeHasNoForbiddenOpcodesAndFitsDeploymentLimit() (gas: 2259326)\nSuite result: ok. 5 passed; 0 failed; 0 skipped; finished in 66.15ms (8.95ms CPU time)\n\nRan 25 tests for test/BloxIMD.t.sol:BloxIMDTest\n[PASS] testFuzz_insufficientAllowancePreservesState(uint256,uint256) (runs: 1000, μ: 123014, ~: 123461)\nLogs:\n  Bound result 20000000000000000000000000\n  Bound result 999999999999999999999999999\n\n[PASS] testFuzz_insufficientBalanceReverts(uint256,uint256) (runs: 1000, μ: 127409, ~: 127690)\nLogs:\n  Bound result 20000000000000000000000000\n  Bound result 115792089237316195423570985008687907853269984665640544039457584007913129639934\n\n[PASS] testFuzz_selfTransferNeverCreatesTokens(uint256) (runs: 1000, μ: 55127, ~: 54861)\nLogs:\n  Bound result 10\n\n[PASS] testFuzz_transferConservesSupply(uint256,address) (runs: 1000, μ: 90440, ~: 91026)\nLogs:\n  Bound result 979795014522783690546615058\n\n[PASS] testFuzz_transferFromAccountsForAllowance(uint256,uint256) (runs: 1000, μ: 162793, ~: 164811)\nLogs:\n  Bound result 20000000000000000000000000\n  Bound result 19999999999999999999999999\n\n[PASS] test_anotherSpenderCannotUseAnApproval() (gas: 105248)\n[PASS] test_approvalCanBeOverwrittenAndRevoked() (gas: 158019)\n[PASS] test_approveEmitsEventAndDoesNotMoveTokens() (gas: 88722)\n[PASS] test_approveZeroSpenderReverts() (gas: 30387)\n[PASS] test_balanceFailureRollsBackAllowanceConsumption() (gas: 123889)\n[PASS] test_constructorEmitsMintTransfer() (gas: 5465)\n[PASS] test_entireSupplyCanMoveAndMoveBack() (gas: 136598)\n[PASS] test_evenZeroTransferToZeroReverts() (gas: 30390)\n[PASS] test_invalidRecipientRollsBackAllowanceConsumption() (gas: 114143)\n[PASS] test_maximumAllowanceIsNotDecremented() (gas: 214701)\n[PASS] test_maximumTransferAmountRevertsWithoutOverflow() (gas: 54978)\n[PASS] test_metadataAndEntireInitialSupply() (gas: 107457)\n[PASS] test_nativeEtherIsRejected() (gas: 36865)\n[PASS] test_selfTransferFromConsumesAllowanceButPreservesBalance() (gas: 103412)\n[PASS] test_selfTransferPreservesBalance() (gas: 51410)\n[PASS] test_transferDeliversExactAmountAndEmitsEvent() (gas: 91482)\n[PASS] test_transferFromSpendsOnlyFiniteAllowance() (gas: 231722)\n[PASS] test_transferToZeroRevertsWithoutBurning() (gas: 47636)\n[PASS] test_zeroTransferFromEmptyAccountEmitsEvent() (gas: 73345)\n[PASS] test_zeroTransferFromNeedsNoAllowance() (gas: 78760)\nSuite result: ok. 25 passed; 0 failed; 0 skipped; finished in 70.22ms (311.80ms CPU time)\n\nRan 19 tests for test/BloxIMDEdgeCases.t.sol:BloxIMDEdgeCasesTest\n[PASS] testFuzz_approvalReplacementIsIdempotentAndDoesNotMoveBalances(uint256,uint256) (runs: 1000, μ: 232175, ~: 232246)\n[PASS] testFuzz_delegatedRoundTripPreservesSupply(uint256,bool) (runs: 1000, μ: 295048, ~: 295531)\nLogs:\n  Bound result 100000000000000000000000000\n\n[PASS] testFuzz_delegatedTransfersHandleAliasedAccounts(uint256,uint8,bool) (runs: 1000, μ: 236903, ~: 222327)\nLogs:\n  Bound result 752084593879055179782327278\n\n[PASS] testFuzz_failedDelegatedSpendSucceedsAfterFunding(uint256,uint256) (runs: 1000, μ: 335448, ~: 335758)\nLogs:\n  Bound result 127\n  Bound result 1000000000000000000000000000\n\n[PASS] test_allowanceCannotBeBorrowedFromAnotherOwner() (gas: 253896)\n[PASS] test_batchFailureRollsBackEarlierTransferAndAllowanceSpend() (gas: 482890)\n[PASS] test_delegatedSelfTransferStillChecksBalance() (gas: 176832)\n[PASS] test_exhaustedAllowanceCannotBeReused() (gas: 170635)\n[PASS] test_holderNeedsSelfApprovalForTransferFrom() (gas: 248327)\n[PASS] test_infiniteApprovalCanBeReducedAndRevoked() (gas: 346018)\n[PASS] test_largestFiniteApprovalDecreasesOnEverySpend() (gas: 210806)\n[PASS] test_nonpayableEntryPointsRejectEtherWithoutChangingState() (gas: 299259)\n[PASS] test_oneMinorUnitCanMoveAndReturnWithoutRounding() (gas: 143103)\n[PASS] test_uint256MaxSpendFailsEvenWithInfiniteApproval() (gas: 129400)\n[PASS] test_zeroApprovalToZeroSpenderStillReverts() (gas: 110453)\n[PASS] test_zeroDelegatedTransferToZeroAddressRevertsWithInfiniteApproval() (gas: 122139)\n[PASS] test_zeroDelegatedTransfersEmitEventsWithoutConsumingAnyApproval() (gas: 466514)\n[PASS] test_zeroRecipientFailureCanBeRetriedWithoutApprovingAgain() (gas: 196480)\n[PASS] test_zeroSourceCannotBeUsedToMintThroughTransferFrom() (gas: 259939)\nSuite result: ok. 19 passed; 0 failed; 0 skipped; finished in 70.23ms (277.94ms CPU time)\n\nRan 2 tests for test/BloxIMDInvariant.t.sol:BloxIMDInvariantTest\n[PASS]\nBloxIMDInvariantTest invariants:\n[PASS] invariant_allowancesMatchReferenceLedger\n[PASS] invariant_metadataRemainsFixed\n[PASS] invariant_supplyAndBalancesMatchReferenceLedger\n BloxIMDInvariantTest invariants (runs: 256, calls: 32768, reverts: 0)\n\n╭----------------+---------------------+-------+---------+----------╮\n| Contract       | Selector            | Calls | Reverts | Discards |\n+===================================================================+\n| BloxIMDHandler | approvalBoundary    | 4703  | 0       | 0        |\n|----------------+---------------------+-------+---------+----------|\n| BloxIMDHandler | approve             | 4888  | 0       | 0        |\n|----------------+---------------------+-------+---------+----------|\n| BloxIMDHandler | insufficientBalance | 4547  | 0       | 0        |\n|----------------+---------------------+-------+---------+----------|\n| BloxIMDHandler | invalidRecipient    | 4618  | 0       | 0        |\n|----------------+---------------------+-------+---------+----------|\n| BloxIMDHandler | invalidSpender      | 4734  | 0       | 0        |\n|----------------+---------------------+-------+---------+----------|\n| BloxIMDHandler | transfer            | 4553  | 0       | 0        |\n|----------------+---------------------+-------+---------+----------|\n| BloxIMDHandler | transferFrom        | 4725  | 0       | 0        |\n╰----------------+---------------------+-------+---------+----------╯\n\nLogs:\n  Bound result 0\n  Bound result 139037163\n  Bound result 1147\n  Bound result 8623\n  Bound result 0\n  Bound result 151\n\n[PASS] test_handlerExercisesAllowanceTransitionsAndFailures() (gas: 1565151)\nSuite result: ok. 2 passed; 0 failed; 0 skipped; finished in 8.55s (8.55s CPU time)\n\nRan 4 test suites in 8.55s (8.75s CPU time): 51 tests passed, 0 failed, 0 skipped (51 total tests)\n","passed":true},{"durationMs":35,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"BloxIMD.approve(address,uint256)\",\"BloxIMD.transfer(address,uint256)\",\"BloxIMD.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"LICENSE\":24,\"README.md\":128,\"SECURITY.md\":46,\"assets/blox-logo.jpg\":170,\"assets/provenance.json\":10,\"foundry.toml\":21,\"remappings.txt\":2,\"src/BloxIMD.sol\":17,\"test/BloxIMD.t.sol\":269,\"test/BloxIMDEdgeCases.t.sol\":344,\"test/BloxIMDInvariant.t.sol\":223,\"test/BloxIMDLaunch.t.sol\":142,\"test/README.md\":48},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"455e14a1d685bd91cbd76ef849a1c0b7c725b8e84b8035d950787a35d9e44a56","verifiedTreeHash":"e7fd75a197888d8d85dd04fc1fab0b3913179719","verifierVersion":"0.1.0+8fbf00a5"},{"checks":[{"durationMs":1197,"exitCode":0,"name":"build","output":"Compiling 28 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.12s\nCompiler run successful!\n","passed":true},{"durationMs":2568,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 5 tests for test/BloxIMDLaunch.t.sol:BloxIMDLaunchTest\n[PASS] test_create2ConstructorMintsEverythingToFactory() (gas: 49110)\n[PASS] test_factoryHasNoPrivilegeOverHolderTokens() (gas: 163293)\n[PASS] test_launchDistributionClaimsAndTwoWayPoolTransfersAreExact() (gas: 445294)\n[PASS] test_mintAndAdminSelectorsAreUnavailableToFactoryAndStranger() (gas: 1677651)\n[PASS] test_runtimeHasNoForbiddenOpcodesAndFitsDeploymentLimit() (gas: 2259326)\nSuite result: ok. 5 passed; 0 failed; 0 skipped; finished in 15.36ms (8.38ms CPU time)\n\nRan 25 tests for test/BloxIMD.t.sol:BloxIMDTest\n[PASS] testFuzz_insufficientAllowancePreservesState(uint256,uint256) (runs: 512, μ: 122996, ~: 123455)\nLogs:\n  Bound result 557\n  Bound result 2503\n\n[PASS] testFuzz_insufficientBalanceReverts(uint256,uint256) (runs: 512, μ: 127324, ~: 127630)\nLogs:\n  Bound result 772273774688527611386911692\n  Bound result 120695357067302374804064563148764737141449070951116309095080230074575\n\n[PASS] testFuzz_selfTransferNeverCreatesTokens(uint256) (runs: 512, μ: 55151, ~: 54867)\nLogs:\n  Bound result 12960\n\n[PASS] testFuzz_transferConservesSupply(uint256,address) (runs: 512, μ: 93125, ~: 93225)\nLogs:\n  Bound result 169231007988070738364018827\n\n[PASS] testFuzz_transferFromAccountsForAllowance(uint256,uint256) (runs: 512, μ: 162398, ~: 164807)\nLogs:\n  Bound result 1577757673\n  Bound result 495629410\n\n[PASS] test_anotherSpenderCannotUseAnApproval() (gas: 105248)\n[PASS] test_approvalCanBeOverwrittenAndRevoked() (gas: 158019)\n[PASS] test_approveEmitsEventAndDoesNotMoveTokens() (gas: 88722)\n[PASS] test_approveZeroSpenderReverts() (gas: 30387)\n[PASS] test_balanceFailureRollsBackAllowanceConsumption() (gas: 123889)\n[PASS] test_constructorEmitsMintTransfer() (gas: 5465)\n[PASS] test_entireSupplyCanMoveAndMoveBack() (gas: 136598)\n[PASS] test_evenZeroTransferToZeroReverts() (gas: 30390)\n[PASS] test_invalidRecipientRollsBackAllowanceConsumption() (gas: 114143)\n[PASS] test_maximumAllowanceIsNotDecremented() (gas: 214701)\n[PASS] test_maximumTransferAmountRevertsWithoutOverflow() (gas: 54978)\n[PASS] test_metadataAndEntireInitialSupply() (gas: 107457)\n[PASS] test_nativeEtherIsRejected() (gas: 36865)\n[PASS] test_selfTransferFromConsumesAllowanceButPreservesBalance() (gas: 103412)\n[PASS] test_selfTransferPreservesBalance() (gas: 51410)\n[PASS] test_transferDeliversExactAmountAndEmitsEvent() (gas: 91482)\n[PASS] test_transferFromSpendsOnlyFiniteAllowance() (gas: 231722)\n[PASS] test_transferToZeroRevertsWithoutBurning() (gas: 47636)\n[PASS] test_zeroTransferFromEmptyAccountEmitsEvent() (gas: 73345)\n[PASS] test_zeroTransferFromNeedsNoAllowance() (gas: 78760)\nSuite result: ok. 25 passed; 0 failed; 0 skipped; finished in 17.57ms (88.87ms CPU time)\n\nRan 1 test for test/BloxIMDInvariant.t.sol:BloxIMDInvariantTest\n[PASS]\nBloxIMDInvariantTest invariants:\n[PASS] invariant_allowancesMatchReferenceLedger\n[PASS] invariant_supplyAndBalancesMatchReferenceLedger\n BloxIMDInvariantTest invariants (runs: 128, calls: 8192, reverts: 0)\n\n╭----------------+------------------+-------+---------+----------╮\n| Contract       | Selector         | Calls | Reverts | Discards |\n+================================================================+\n| BloxIMDHandler | approve          | 1980  | 0       | 0        |\n|----------------+------------------+-------+---------+----------|\n| BloxIMDHandler | invalidRecipient | 2080  | 0       | 0        |\n|----------------+------------------+-------+---------+----------|\n| BloxIMDHandler | transfer         | 1993  | 0       | 0        |\n|----------------+------------------+-------+---------+----------|\n| BloxIMDHandler | transferFrom     | 2139  | 0       | 0        |\n╰----------------+------------------+-------+---------+----------╯\n\nLogs:\n  Bound result 0\n  Bound result 1572\n  Bound result 1000\n  Bound result 998\n  Bound result 94\n  Bound result 765\n  Bound result 2\n  Bound result 0\n  Bound result 2025\n  Bound result 5\n  Bound result 13745517941235301\n  Bound result 0\n  Bound result 0\n  Bound result 6000000000000000000\n  Bound result 0\n  Bound result 5927\n  Bound result 524\n  Bound result 244\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 45\n  Bound result 0\n  Bound result 11\n  Bound result 955\n  Bound result 3\n  Bound result 378\n  Bound result 6\n  Bound result 955\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 2.49s (2.49s CPU time)\n\nRan 3 test suites in 2.49s (2.52s CPU time): 31 tests passed, 0 failed, 0 skipped (31 total tests)\n","passed":true},{"durationMs":41,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"BloxIMD.approve(address,uint256)\",\"BloxIMD.transfer(address,uint256)\",\"BloxIMD.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"LICENSE\":24,\"README.md\":128,\"SECURITY.md\":46,\"assets/blox-logo.jpg\":170,\"assets/provenance.json\":10,\"foundry.toml\":21,\"launch.json\":20,\"remappings.txt\":2,\"src/BloxIMD.sol\":17,\"test/BloxIMD.t.sol\":268,\"test/BloxIMDInvariant.t.sol\":130,\"test/BloxIMDLaunch.t.sol\":142},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"f26233d6c44cc09167e8da7eef448a2a6f8c1039584055fb5321cec95a151ae1","verifiedTreeHash":"50275b2baa6343803fa57536a343d52dc91f3685","verifierVersion":"0.1.0+8fbf00a5"}]}