# Audit report

> SkinsStampSale: lets players buy Courier Skins (ERC721-C, 0x19716dAaDE3F2979aAA4f69cc04e2A5c00e7D23e on Robinhood Chain) with $STAMP. The skins contract only accepts ETH, so this contract pays each skin’s ETH price from an owner-funded float, takes the buyer’s $STAMP (permit or approval) to the treasury, mints, and transfers the skins to the buyer in the same transaction. Owner can set the $STAMP price, pause, set the treasury and withdraw the float. Please check the float can’t be drained except by real purchases, that buyers can’t get skins without paying, the permit handling, re-entrancy, and that transfers pass OpenSea’s transfer validator. Source: contracts/src/SkinsStampSale.sol, tests in contracts/test/SkinsStampSale.t.sol.

| | |
|---|---|
| Repository | https://github.com/AdamNakamoto/courierworld.git |
| Commit | `d11a6b102a30e7d130fca4bf45db628f1ae81590` |
| Job | `1cb3a064-ca38-4c22-954d-7a748cd4fb23` |
| Judged | 2026-10-12 13:41 UTC |
| Findings | 5 low · 2 info |

Four agents audited the code as it is at `d11a6b1`, each in one area (math, permissions, economics, control flow),
and a judge reproduced, merged and ranked what they found, then read the code once more itself. Nothing in the repository was changed or deployed.

## Findings

### 1. Low: buy()/buyWithPermit() charge the live stampPrice with no buyer-side bound: a reprice mined before a pending buy pulls the new price from any standing allowance

`contracts/src/SkinsStampSale.sol:85`

```
        uint256 stampCost = stampPrice * quantity;
```

_buy charges `stampPrice * quantity` as read from storage at execution time, and the buyer passes only `quantity`: no maxStampCost, no expected price, no deadline. The owner reprices while the sale is open (AUDIT.md section 11: 'if $STAMP moves a lot, the owner changes it'; web/chain.js exposes setStampPrice in the admin panel), so a routine setStampPrice can land between a buyer seeing a quote and their buy executing. Any buyer whose allowance exceeds the quoted cost (a wallet 'approve max', an allowance left over from an earlier larger approval; the project's own test_NotEnoughStampOrAllowance and test_CourierSkinsRulesStillApply use type(uint256).max) is then charged the new price silently, up to their whole $STAMP balance. The permit path does not protect a buyer who also has a leftover allowance: the stale-value permit fails, the catch swallows it, and _buy proceeds on the old allowance at the new price (reproduced: test_A2 in the scratch suite, 1000e18 taken against a permit signed for 150e18, nonce not consumed). The web client approves exactly the quoted cost, which limits exposure to users who approved more, but the contract itself offers no bound. This is a race between an honest owner action and an unprivileged buyer, not a permission bypass, hence low. Fix that keeps the design: add a `uint256 maxStampCost` argument to buy and buyWithPermit and revert in _buy when `stampCost > maxStampCost`; the web client already knows the quoted price it displayed. (Merged from audit_math, audit_economics, audit_permissions and audit_flow, who all reported this at line 85/70.)

**Reproduction**

State: sale open, stampPrice = 150e18, alice holds 10_000e18 $STAMP and has called stamp.approve(sale, type(uint256).max). Alice sees a quote of 300e18 for 2 skins and submits sale.buy(2). The owner's setStampPrice(1000e18) is mined first. Expected: the buy reverts or alice pays at most 300e18. Actual: sale.buy(2) succeeds, stamp.balanceOf(alice) == 8_000e18 and stamp.balanceOf(treasury) == 2000e18. Reproduced in test/scratch/Repro.t.sol test_A_BuyChargesLivePriceAgainstOpenAllowance and test_A2_PermitPathWithOpenApprovalChargesNewPrice; the attached proof fails with 'buyer was charged more than the price they saw: 2000000000000000000000 > 300000000000000000000'.

**Proof**: a Foundry test that fails on this code and passes once it is fixed.

```solidity
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.26;

import {Test} from "forge-std/Test.sol";
import {CourierSkins} from "src/CourierSkins.sol";
import {StampToken} from "src/StampToken.sol";
import {SkinsStampSale} from "src/SkinsStampSale.sol";

/// Owners may move their own skins; anyone else is refused (like OpenSea's strict registry).
contract OwnersOnlyValidator {
    error UnauthorizedTransfer();

    function validateTransfer(address caller, address from, address, uint256) external pure {
        if (caller != from) revert UnauthorizedTransfer();
    }
}

/// Finding: `buy(quantity)` charges `stampPrice * quantity` as read at execution time and the buyer passes no
/// bound, so a buyer with a standing allowance above the quoted cost is charged whatever `setStampPrice` set
/// before their transaction was mined.
///
/// The buy is sent through a raw call to `buy(uint256)` so the test compiles whatever shape the fix takes
/// (a `maxStampCost` argument on a new `buy`, or a replaced signature). It passes once a buy mined after a
/// reprice either reverts or charges no more than the buyer saw (300e18 for two skins at 150e18).
contract ProofNoMaxCostTest is Test {
    CourierSkins skins;
    StampToken stamp;
    SkinsStampSale sale;

    address owner = makeAddr("owner");
    address treasury = makeAddr("treasury");
    address minter = makeAddr("minter");
    address alice = makeAddr("alice");

    uint256 constant ETH_PRICE = 0.004 ether;
    uint256 constant STAMP_PRICE = 150e18;

    function setUp() public {
        skins = new CourierSkins(owner, treasury, ETH_PRICE, bytes32(0), address(new OwnersOnlyValidator()), "");
        vm.prank(owner);
        skins.setSaleOpen(true);
        stamp = new StampToken(owner, address(0), 0);
        vm.prank(owner);
        stamp.setMinter(minter);
        vm.prank(minter);
        stamp.mint(alice, 10_000e18);
        sale = new SkinsStampSale(owner, address(skins), address(stamp), treasury, STAMP_PRICE);
        vm.prank(owner);
        sale.setOpen(true);
        vm.deal(address(sale), 0.1 ether);
    }

    function test_BuyMinedAfterRepriceNeverChargesMoreThanQuoted() public {
        // Alice saw 150e18 per skin and gave the sale an open approval (a wallet "approve max").
        vm.prank(alice);
        stamp.approve(address(sale), type(uint256).max);
        uint256 quoted = 2 * STAMP_PRICE;

        // The owner's reprice lands first.
        vm.prank(owner);
        sale.setStampPrice(1000e18);

        vm.prank(alice);
        (bool ok,) = address(sale).call(abi.encodeWithSignature("buy(uint256)", 2));

        uint256 paid = 10_000e18 - stamp.balanceOf(alice);
        if (ok) {
            assertLe(paid, quoted, "buyer was charged more than the price they saw");
        } else {
            assertEq(paid, 0, "a refused buy must take no $STAMP");
        }
    }
}
```

### 2. Low: buyWithPermit() recomputes the permit value from live stampPrice, so any repricing (up or down) voids the signed permit and the swallowed error surfaces as an unrelated allowance error

`contracts/src/SkinsStampSale.sol:77`

```
        try IERC20Permit(address(stamp)).permit(msg.sender, address(this), stampPrice * quantity, deadline, v, r, s) {} catch {}
```

The permit `value` is not a parameter; it is derived as `stampPrice * quantity` at execution. The buyer signed over `oldPrice * quantity` (web/chain.js signs `s.skins.stamp.price * n` read earlier, with a 600 s deadline). If stampPrice changed between signing and mining, ECDSA recovers a different address, ERC2612InvalidSigner is caught by the blanket catch, no allowance is set, and safeTransferFrom reverts ERC20InsufficientAllowance(sale, 0, newCost). This happens even when the price was cut and the signed value would cover the new cost, so a buyer who authorised more than enough is refused, and the signature can never be reused for that price. The blanket catch, meant only for a front-run permit (allowance then already in place), also hides ERC2612ExpiredSignature and the value mismatch, pointing the buyer at an approval problem that does not exist. Nothing is lost (atomic revert, nonce not consumed), so this is a robustness and diagnosability defect: every permit-path buy in flight at a repricing fails. Fix: take `uint256 value` as a parameter, pass it to permit, and require `stampCost <= value` (which also gives the permit path the cost bound missing from buy, see the stampPrice finding); only swallow the permit failure when `stamp.allowance(msg.sender, address(this)) >= stampCost` afterwards, otherwise re-throw. (Merged from audit_math permit finding, audit_economics catch-all finding and audit_flow case 2.)

**Reproduction**

State: stampPrice = 150e18. Alice signs a permit for 300e18 (2 skins), deadline now+1h, and submits buyWithPermit(2, deadline, v, r, s). The owner's setStampPrice(100e18) is mined first. Expected: the buy succeeds at 200e18 (within what alice authorised). Actual: permit is called with value 200e18, the recovered signer differs, the error is swallowed, and the call reverts ERC20InsufficientAllowance(sale, 0, 200e18); alice holds 0 skins and stamp.nonces(alice) is still 0. Reproduced in test/scratch/Repro.t.sol test_B_PermitVoidedByPriceCut; the 1-wei-raise variant (setStampPrice(151e18), revert ERC20InsufficientAllowance(sale, 0, 151e18) instead of a permit error) in test_B2_PermitForOldPriceSurfacesAsAllowanceError.

### 3. Low: withdrawToken() only speaks ERC-20: a Courier Skin (or any ERC-721) a holder sends to the sale is permanently stuck

`contracts/src/SkinsStampSale.sol:125`

```
        IERC20(token).safeTransfer(to, amount);
```

The function is documented as 'Return tokens sent here by mistake', but it calls the ERC-20 transfer(address,uint256) selector through SafeERC20. CourierSkins has no such function and no fallback, so the call reverts with empty data and SafeERC20 bubbles it. The most likely asset to land here by mistake is a Courier Skin itself: the sale is the `from` of every $STAMP-bought skin, so it appears in holders' transfer histories, CourierSkins.transferFrom (unlike safeTransferFrom) performs no receiver check, and the transfer validator allows any holder to move their own skin (caller == from). _buy only ever transfers the ids it minted in the same call, the sale never approves anyone, and it has no onERC721Received, so no path moves the token again; CourierSkins' validator also blocks any third party from moving it. Impact: loss of a 0.004 ETH-priced (and after reveal possibly rare) skin for the sender; owner-side recovery is impossible rather than merely unimplemented. Fix: add an owner-only `withdrawSkin(uint256 tokenId, address to)` calling `skins.transferFrom(address(this), to, tokenId)` (caller == from, which the registry already allows for the hand-over), or make withdrawToken ERC-721-aware. (Merged from all four specialists.)

**Reproduction**

State: bob owns skin #1 (minted for 0.004 ether). Bob calls skins.transferFrom(bob, address(sale), 1): succeeds, skins.ownerOf(1) == sale. Owner calls sale.withdrawToken(address(skins), bob, 1). Expected: skin #1 returns to bob. Actual: the call reverts (empty revert data from the missing ERC-20 selector) and skins.ownerOf(1) stays the sale; no function on the sale can move it. Reproduced in test/scratch/Repro.t.sol test_C_SkinSentToSaleIsStuck; the attached proof fails with 'no owner function can move a skin out of the sale'.

**Proof**: a Foundry test that fails on this code and passes once it is fixed.

```solidity
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.26;

import {Test} from "forge-std/Test.sol";
import {CourierSkins} from "src/CourierSkins.sol";
import {StampToken} from "src/StampToken.sol";
import {SkinsStampSale} from "src/SkinsStampSale.sol";

/// Owners may move their own skins; anyone else is refused (like OpenSea's strict registry).
contract OwnersOnlyValidator {
    error UnauthorizedTransfer();

    function validateTransfer(address caller, address from, address, uint256) external pure {
        if (caller != from) revert UnauthorizedTransfer();
    }
}

/// Finding: a Courier Skin a holder moves to the sale with `transferFrom` (allowed: caller == from, and the
/// unsafe variant has no receiver check) can never leave. `withdrawToken` calls the ERC-20 `transfer` selector,
/// which CourierSkins lacks, and nothing else in the sale moves an id it did not just mint.
///
/// The recovery is attempted through the plausible owner-only shapes of a fix (an ERC-721-aware
/// `withdrawToken`, or a new `withdrawSkin` / `withdrawNFT` / `rescueERC721`), so the test passes with any of
/// them and fails as long as the skin stays on the sale.
contract ProofStuckSkinTest is Test {
    CourierSkins skins;
    StampToken stamp;
    SkinsStampSale sale;

    address owner = makeAddr("owner");
    address treasury = makeAddr("treasury");
    address bob = makeAddr("bob");

    uint256 constant ETH_PRICE = 0.004 ether;

    function setUp() public {
        skins = new CourierSkins(owner, treasury, ETH_PRICE, bytes32(0), address(new OwnersOnlyValidator()), "");
        vm.prank(owner);
        skins.setSaleOpen(true);
        stamp = new StampToken(owner, address(0), 0);
        sale = new SkinsStampSale(owner, address(skins), address(stamp), treasury, 150e18);
        vm.prank(owner);
        sale.setOpen(true);
    }

    function _try(bytes memory data) internal returns (bool ok) {
        vm.prank(owner);
        (ok,) = address(sale).call(data);
    }

    function test_OwnerCanReturnASkinSentToTheSale() public {
        vm.deal(bob, 1 ether);
        vm.prank(bob);
        skins.mint{value: ETH_PRICE}(1);
        vm.prank(bob);
        skins.transferFrom(bob, address(sale), 1);
        assertEq(skins.ownerOf(1), address(sale));

        bool moved = _try(abi.encodeWithSignature("withdrawToken(address,address,uint256)", address(skins), bob, 1))
            || _try(abi.encodeWithSignature("withdrawSkin(uint256,address)", 1, bob))
            || _try(abi.encodeWithSignature("withdrawSkin(address,uint256)", bob, 1))
            || _try(abi.encodeWithSignature("withdrawNFT(address,address,uint256)", address(skins), bob, 1))
            || _try(abi.encodeWithSignature("withdrawERC721(address,address,uint256)", address(skins), bob, 1))
            || _try(abi.encodeWithSignature("rescueERC721(address,address,uint256)", address(skins), bob, 1));

        assertTrue(moved, "no owner function can move a skin out of the sale");
        assertEq(skins.ownerOf(1), bob, "the skin is stuck on the sale");
    }
}
```

### 4. Low: renounceOwnership is inherited unguarded: one owner call strands the ETH float and freezes price, pause and treasury forever

`contracts/src/SkinsStampSale.sol:27`

```
contract SkinsStampSale is Ownable2Step, ReentrancyGuard {
```

Ownable2Step makes transferOwnership two-step but leaves Ownable.renounceOwnership a single irreversible call. After it, withdrawEth, setStampPrice, setOpen and setTreasury all revert OwnableUnauthorizedAccount, so the float (0.04 ETH at the launch.env setting, plus any top-ups, which anyone can send through receive()) can only ever leave through purchases, the sale can never be paused or repriced if $STAMP moves, and once Courier Skins' sale is closed for good at reveal (setSaleOpen reverts AlreadyRevealed) any remaining float is locked permanently. CourierSkins in the same repository overrides renounceOwnership with a NotFinished guard for exactly this reason, and AUDIT.md describes a launch policy of renouncing every owner, which makes an accidental renounce of the sale plausible; the sale has no guard. Owner-only trigger (self-inflicted), hence low. Fix: `function renounceOwnership() public override onlyOwner { if (address(this).balance != 0 || open) revert ...; super.renounceOwnership(); }`, mirroring CourierSkins, or document that the sale must never be renounced. (Merged from audit_math, audit_permissions and audit_flow.)

**Reproduction**

State: sale open and holding 0.1 ETH float. Owner calls sale.renounceOwnership(). Expected: refused while the float is non-zero (as CourierSkins refuses before it is finished). Actual: owner() becomes address(0); owner's withdrawEth(owner, 0.1 ether) and setOpen(false) both revert OwnableUnauthorizedAccount(owner), and the 0.1 ETH stays in the contract. Reproduced in test/scratch/Repro.t.sol test_D_RenounceStrandsFloat; the attached proof fails with 'renounce went through with 0.1 ether in the float'.

**Proof**: a Foundry test that fails on this code and passes once it is fixed.

```solidity
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.26;

import {Test} from "forge-std/Test.sol";
import {CourierSkins} from "src/CourierSkins.sol";
import {StampToken} from "src/StampToken.sol";
import {SkinsStampSale} from "src/SkinsStampSale.sol";

/// Owners may move their own skins; anyone else is refused (like OpenSea's strict registry).
contract OwnersOnlyValidator {
    error UnauthorizedTransfer();

    function validateTransfer(address caller, address from, address, uint256) external pure {
        if (caller != from) revert UnauthorizedTransfer();
    }
}

/// Finding: `renounceOwnership` is inherited unguarded from Ownable2Step. One call while the float holds ETH
/// strands it (only `withdrawEth`, owner-only, takes ETH out other than a purchase) and freezes the price, the
/// pause switch and the treasury for good. CourierSkins in the same repository guards its renounce; the sale
/// does not. Passes once a renounce with ETH in the float (or with the sale open) is refused.
contract ProofRenounceTest is Test {
    CourierSkins skins;
    StampToken stamp;
    SkinsStampSale sale;

    address owner = makeAddr("owner");
    address treasury = makeAddr("treasury");

    function setUp() public {
        skins = new CourierSkins(owner, treasury, 0.004 ether, bytes32(0), address(new OwnersOnlyValidator()), "");
        stamp = new StampToken(owner, address(0), 0);
        sale = new SkinsStampSale(owner, address(skins), address(stamp), treasury, 150e18);
        vm.prank(owner);
        sale.setOpen(true);
        vm.deal(address(sale), 0.1 ether);
    }

    function test_RenounceIsRefusedWhileTheFloatHoldsEth() public {
        vm.prank(owner);
        (bool ok,) = address(sale).call(abi.encodeWithSignature("renounceOwnership()"));
        assertFalse(ok, "renounce went through with 0.1 ether in the float");
        assertEq(sale.owner(), owner);
        // The float is still reachable.
        vm.prank(owner);
        sale.withdrawEth(payable(owner), 0.1 ether);
        assertEq(owner.balance, 0.1 ether);
    }
}
```

### 5. Low: The only test of the live OpenSea registry reports PASS when run without a fork, and silently stops testing once the Courier Skins sale closes

`contracts/test/SkinsStampSale.t.sol:290`

```
        if (block.chainid != 4663) return;
```

test_Fork_BuyWithStampOnTheLiveContracts is the only test exercising the real StrictAuthorizedTransferSecurityRegistry (0xA000027A9B2802E1ddf7000061001e5c005A0000); the unit suite substitutes OwnersOnlyValidator, a local approximation. AUDIT.md section 11 cites this test as the evidence that the sale-to-buyer hand-over passes OpenSea's registry, one of the brief's explicit questions. Off-fork the test returns early and Foundry counts it as passed (gas: 167), so a plain `forge test` shows 16/16 green whether or not the live registry was ever checked, and the second early return (`!SKINS.saleOpen()`) turns it off for good once the ETH sale closes, still reporting PASS. For the record, this reviewer ran the test with `--fork-url https://robinhood.drpc.org` and it genuinely passes (gas: 636687): the sale's transferFrom(sale, buyer, id) with caller == from is accepted by the live registry and the buyer can move the skin on. Fix: replace the first return with `vm.skip(true)` (reported as skipped), and assert rather than return on saleOpen so a closed sale is visible; keep a fork run in the pre-deploy checklist. (Merged from all four specialists.)

**Reproduction**

Run `forge test --match-contract SkinsStampSaleForkTest` without --fork-url. Expected: the test is reported as skipped. Actual on this tree: `[PASS] test_Fork_BuyWithStampOnTheLiveContracts() (gas: 167)` with no assertion executed. With `--fork-url https://robinhood.drpc.org` the same test runs for real and passes (gas: 636687).

### 6. Info: Untested edges in test/SkinsStampSale.t.sol

`contracts/test/SkinsStampSale.t.sol:39`

```
contract SkinsStampSaleTest is Test {
```

Edges the suite never exercises, each with the input that would exercise it. Items marked 'verified' were run in test/scratch/Repro.t.sol and behave correctly; they are listed so the suite can pin them. (1) setStampPrice landing between an approval and a buy with a standing allowance: overcharge, see the stampPrice finding. (2) buyWithPermit after setStampPrice, up or down: reverts with an allowance error, see the permit finding. (3) A garbage or expired permit with an existing allowance: approve(sale, 150e18) then buyWithPermit(1, 0, 0, 0, 0) still buys (verified). (4) The 999 cap reached through the sale: totalMinted = 995 then buy(5) reverts CourierSkins.SoldOut with no $STAMP taken, buy(4) then succeeds (verified). (5) Re-entry attempted through buyWithPermit, and the refusal reason: test_NoReentry only asserts `refused`, which is also true for NeedsTopUp or Closed; the caught selector is ReentrancyGuardReentrantCall (verified). (6) withdrawEth(amount > balance) reverts Errors.InsufficientBalance(balance, amount) in Address.sendValue (verified). (7) A contract buyer: works, since the hand-over is plain transferFrom with no receiver hook (verified). (8) buyer == treasury: works, $STAMP moves from the buyer to itself (verified). (9) A Courier Skin sent to the sale: stuck, see the withdrawToken finding. (10) Ownable2Step handover of the sale and renounceOwnership: see the renounce finding. (Merged from audit_math and audit_economics.)

**Reproduction**

Add the listed calls; e.g. for (5) change GreedyTreasury.receive to `try sale.buyWithPermit(1, 0, 0, 0, 0) {} catch (bytes memory e) { err = e; }` and assert `bytes4(err) == ReentrancyGuard.ReentrancyGuardReentrantCall.selector`; for (4) mint 995 with ETH, then expect CourierSkins.SoldOut on sale.buy(5) and assert stamp.balanceOf(alice) unchanged.

### 7. Info: Trust assumptions: owner powers over the $STAMP price, the float and the treasury, and the independent Courier Skins ETH price (by design, documented for the record)

`contracts/src/SkinsStampSale.sol:98`

```
    function setStampPrice(uint256 stampPrice_) external onlyOwner {
```

Not defects; the powers the brief asks for, stated with their reach, and the brief's questions answered. Verified clean: ETH leaves the contract only via skins.mint{value: skins.price() * quantity} at line 89 (to the immutable Courier Skins contract, which forwards it to its treasury) and via withdrawEth (owner only); $STAMP is pulled before the mint and the whole buy is atomic, so no skin is handed over unpaid and no $STAMP is kept without a skin (a failed mint takes no $STAMP: test_CourierSkinsRulesStillApply, and SoldOut verified in the scratch suite); nonReentrant covers both buy entry points, the only mid-flow callback (ETH to the Courier Skins treasury) is refused with ReentrancyGuardReentrantCall, and mints use _mint while the hand-over uses transferFrom, so no receiver hooks run; the validator is called as a view with caller == from, accepted by the live registry (fork test run by this reviewer). Trust: (1) setStampPrice is unrelated to the pool price of $STAMP (accepted in AUDIT.md section 11). At the launch.env parameters (START_MCAP_USD 3000 for 21M $STAMP, SKINS_STAMP_PRICE 150e18) one skin costs about 0.02 USD in $STAMP against 0.004 ETH, so until the owner reprices or pauses, any buyer takes skins at a small fraction of the ETH price; the ETH only moves to the Courier Skins treasury (the same operator), so the operator's loss is the discount, not the float. setStampPrice(1) gives skins away for 1 wei each. (2) The Courier Skins owner (the same wallet at deploy) controls skins.price(): raising it makes the float pay more per skin at the same stampPrice, and setting skins.treasury to the sale would make the float self-replenishing (unlimited $STAMP sales at zero ETH cost). (3) setTreasury redirects all future $STAMP; withdrawEth can empty the float at any time, which makes pending buys revert NeedsTopUp with no loss; setOpen(false) pauses buys only. (4) Third-party top-ups through receive() are donations only the owner can take back. (5) A Courier Skins treasury that reverts on receive, or a rule change in OpenSea's registry, blocks every buy (no loss). (Merged from audit_math, audit_economics and audit_flow.)

**Reproduction**

State: sale open, float 0.1 ETH, skins.price() 0.004 ETH. Owner calls setStampPrice(1); bob approves 10 wei and calls buy(10). Expected (by design): 10 skins to bob for 10 wei of $STAMP, 0.04 ETH from the float to the Courier Skins treasury, float 0.06 ETH (reproduced: test/scratch/Repro.t.sol test_T_FloatOnlyLeavesViaMint). Any non-owner calling setStampPrice/setOpen/setTreasury/withdrawEth/withdrawToken reverts OwnableUnauthorizedAccount (test_OwnerOnly).

---

Judge's submission `0a8e56fba50860797864ff831e4e08f68ed104b9888db1afcd2625e4e889a507`, accepted on the IdentityMD network. Acceptance means the report met the job's checks;
it is not a guarantee that the code has no other defects.