{"assessments":[],"deployments":[{"attestationHash":"3855ccdfccdc4d6f83daf75cf06260bd8c12e9aa5b0a08350d812f9642293a48","chainId":1,"contracts":[{"address":"0x693ea6727efe72836f7eaa0ac0c578471fce4076","blockNumber":26358766,"name":"MerkleDistributor","role":"distributor","txHash":"0xa13f5d733e0407cceb6189977e8c08d3e9deed48a044456cb9ae628b7218ffac"},{"address":"0xfa3b7e44738f38a22afb44701010b0b672487eb0","blockNumber":26358766,"name":"Pimd","role":"token","txHash":"0xa13f5d733e0407cceb6189977e8c08d3e9deed48a044456cb9ae628b7218ffac"},{"address":"0x784ff9a3ac5d88a30bfff6f7f2a270161fbe6000","blockNumber":26358766,"name":"PoolInitializationGuard","role":"hook","txHash":"0xa13f5d733e0407cceb6189977e8c08d3e9deed48a044456cb9ae628b7218ffac"}],"id":"0762756c-d767-4c2b-a13b-7dcf721e606d","manifestHash":"e1cd9c41fde934949b5c9bbbc1431d92cd1557aaecce181dcbe580ab816cf891","status":"live"}],"fuzz":[],"identity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"interpretation":"Records acceptance and evidence. Neither completion nor an AI assessment establishes correctness, safety, or independent review.","jobId":"07481474-17b4-4e7a-b06a-a70b1148dc87","kind":"shape:chain","nodes":[{"acceptedSubmissionHash":"82ee6d224aba4be12bcb43b7149b742bd4c29bb233665bbe1c21835f475a8e8d","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"bc5bfc8455464381f2db18badb2b55cf8bec1e535c019349a0378fa990741171","skillId":"audit-specialist","subagents":3,"tools":[]},"key":"audit_economics","kind":"code","role":"review","skillHash":"bc5bfc8455464381f2db18badb2b55cf8bec1e535c019349a0378fa990741171","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"85bc7618cacdad506e0b9efa4d9926e22a5508cfacf0405b0423be0bc4b17efc","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"bc5bfc8455464381f2db18badb2b55cf8bec1e535c019349a0378fa990741171","skillId":"audit-specialist","subagents":3,"tools":[]},"key":"audit_flow","kind":"code","role":"review","skillHash":"bc5bfc8455464381f2db18badb2b55cf8bec1e535c019349a0378fa990741171","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"784c2521c84c6e49e4d5c404b9615bdf1aaa29eb9a355e0c91e9fd4f0d797302","dependsOn":["build_contract_project","write_foundry_tests","manifest","audit_math","audit_permissions","audit_economics","audit_flow"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"b89279670f5a00f5d26286edee00c97dd158b997031350a01cafe6e0329ad227","skillId":"audit-judge","subagents":4,"tools":[]},"key":"audit_judge","kind":"code","role":"review","skillHash":"b89279670f5a00f5d26286edee00c97dd158b997031350a01cafe6e0329ad227","skillId":"audit-judge","state":"accepted"},{"acceptedSubmissionHash":"739aa908948bd5edb8dea576c8321b5790da9545d949ac8df23fddc9554ec0c1","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"bc5bfc8455464381f2db18badb2b55cf8bec1e535c019349a0378fa990741171","skillId":"audit-specialist","subagents":3,"tools":[]},"key":"audit_math","kind":"code","role":"review","skillHash":"bc5bfc8455464381f2db18badb2b55cf8bec1e535c019349a0378fa990741171","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"b93e3b4c736c3525ba4d2e052200fcce044c7233c7adfdb68db8f48e446262b6","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"bc5bfc8455464381f2db18badb2b55cf8bec1e535c019349a0378fa990741171","skillId":"audit-specialist","subagents":3,"tools":[]},"key":"audit_permissions","kind":"code","role":"review","skillHash":"bc5bfc8455464381f2db18badb2b55cf8bec1e535c019349a0378fa990741171","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"8edd0dcff2c03d6aed50815464196b708ab73d1a4b6e7e3386b679e430b5590e","dependsOn":[],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"15b04fc8f60521936b9e2b37c09a804685ec689fc98cd5b04510d986d3106a15","skillId":"build-contract-project","tools":[]},"key":"build_contract_project","kind":"code","role":"implement","skillHash":"15b04fc8f60521936b9e2b37c09a804685ec689fc98cd5b04510d986d3106a15","skillId":"build-contract-project","state":"accepted"},{"acceptedSubmissionHash":"a46bbb92ebeb04d10dc12746dc962abfdf04c71576ee43098261cc42c396d9a9","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"tools":[]},"key":"manifest","kind":"code","role":"integrate","skillHash":null,"skillId":null,"state":"accepted"},{"acceptedSubmissionHash":"a4d562ce4fb3eff6859ac11fa574c7b155d38c80bd55ab11b9aec8746daea39c","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"68506fdcd4ed07ed9dcf40cddecfe9a7d7282e399586d1d75a902eca2f5d692b","skillId":"write-foundry-tests","subagents":4,"tools":[]},"key":"write_foundry_tests","kind":"code","role":"tests","skillHash":"68506fdcd4ed07ed9dcf40cddecfe9a7d7282e399586d1d75a902eca2f5d692b","skillId":"write-foundry-tests","state":"accepted"}],"objective":"A custom token: Pimd (PIMD).\nToken name: Pimd\nToken symbol: PIMD\nToken supply: 1,000,000,000 with 18 decimals, all minted once to the deployer in the constructor.","parentJobId":null,"planHash":"316e7738c8a659887f8867544dc45eaa4340c4fb39a7547b58b45c974ab22ba8","previousHash":"ac39bf4a64c07c91156af9b100c7c6b1a91532f15f82bd3e018336329ed61692","projectId":"07481474-17b4-4e7a-b06a-a70b1148dc87","publication":{"commit":"2c2f747e42e7a8c18411700d73e1b727492bbdd6","deliveredAt":"2026-11-06T22:21:48.729Z","repoUrl":"https://github.com/identity-md-launches/launch-3086-pimd"},"receiptIdentity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"registry":"0xb6d0a187b050fa5bb0b87033a203f37becf4a775","research":[],"schema":"identitymd-work-v1","signals":[],"site":null,"snapshotHash":"20d32ce8dafc2751ed6b0ddd63bc7e27e2a831e0cb6c2356ee16ca1a3096d079","state":"completed","submissions":[{"artifacts":[],"attempt":1,"bundleHash":null,"device":"dc176559ff153c37","findings":[{"citation":"resolved","description":"DEPENDENCIES.md states the vendored files were copied unchanged and gives `sha256sum --check DEPENDENCIES.sha256` as the verification. Seven forge-std files (StdAssertions.sol, StdJson.sol, StdToml.sol, Vm.sol, console.sol, interfaces/IERC7540.sol, interfaces/IMulticall3.sol) no longer match. The manifest hashes do match upstream v1.9.7: the upstream StdAssertions.sol hashes to d4c89eec...ed9780, the value recorded in DEPENDENCIES.sha256. The local copies were changed afterwards, and the diffs against upstream are formatting only (line wrapping, as forge fmt produces). The deployed token's dependency graph is unaffected: every OpenZeppelin file passes. The only defect is that the provenance claim and the documented verification step fail. Fix: restore the upstream forge-std files, or regenerate the hashes and reword the claim.","line":10,"path":"DEPENDENCIES.md","reproduction":"From the repository root run `sha256sum --check DEPENDENCIES.sha256`. Expected: every line OK. Actual: 'WARNING: 7 computed checksums did NOT match', e.g. lib/forge-std/src/StdAssertions.sol: FAILED (local 3fbf4a02...7ce7384, recorded and upstream d4c89eec...ed9780). Diffing against the v1.9.7 archive (sha256 45157353...ee94, the value DEPENDENCIES.md quotes) shows only whitespace and line-wrapping changes, e.g. the assertApproxEqAbs(uint256,uint256,uint256,string) signature collapsed onto one line.","severity":"info","snippet":"The files were copied unchanged from these releases. OpenZeppelin files came from the release-tagged paths on `raw.githubusercontent.com/OpenZeppelin/openzeppelin-contracts/v5.1.0/`. Forge Standard Library came from the tagged archive at `https://codeload.github.com/foundry-rs/forge-std/tar.gz/refs/tags/v1.9.7`; its archive SHA-256 was `45157353ab49eab01d294565866731e599b32401757229689ee459aa26b7ee94`.","title":"Vendored forge-std files differ from v1.9.7 and fail the documented checksum verification (test-only, outside math area)"}],"hash":"739aa908948bd5edb8dea576c8321b5790da9545d949ac8df23fddc9554ec0c1","nodeId":"c5e76952-6f24-495e-aa4f-acc588f26168","outcome":"completed","summary":"I found no math defects in Pimd. The only finding is an info-level one outside my area, about the bundled test library. I wrote it, with a coverage row for each of the three entry points, to `.imd-findings.json`.\n\n**What the token is:** `src/Pimd.sol` is a plain OpenZeppelin v5.1.0 ERC20. Its constructor mints one constant, `INITIAL_SUPPLY = 1_000_000_000 * 10 ** 18` (exactly 10^27), to `msg.sender`, and there is no other custom code. I checked the bundled OpenZeppelin files against the project's recorded hashes and all of them match, so the ERC20 behaviour is unmodified upstream code.\n\n**Math Precision, Boundary and Numerical Gap passes:**\n- **Precision:** Pimd and the OpenZeppelin code it uses have no division, rounding, fees, scaling or narrowing casts, so nothing can lose precision.\n- **Overflow and underflow:** the ERC20 skips overflow checks in three places, and each is safe:\n  - Subtracting from the sender's balance comes right after a check that the balance is large enough.\n  - Adding to the receiver's balance can't overflow, because nothing can raise the supply above 10^27 after the constructor.\n  - Reducing an allowance comes right after a check that the allowance covers the amount.\n- **Boundaries:** I ran a throwaway test against these edge values; it passed and I deleted it afterwards.\n  - Moving the whole supply (10^27) succeeds, and 10^27 + 1 reverts.\n  - An unlimited allowance (the maximum value) is never reduced. One just below the maximum is reduced by exactly the amount spent.\n  - With an allowance of 5, spending 6 reverts, spending 5 leaves 0, then spending 1 reverts and spending 0 succeeds.\n  - Transfers to yourself, fuzzed over 1,024 cases, never change your balance or the supply.\n- **Supply:** the 10^27 base units match the requested 1,000,000,000 × 10^18, and `decimals()` returns 18. The supply can never change after deployment. The project's own suite (37 tests) also passes.\n- **Static analysis:** aderyn's \"Large Numeric Literal\" warning at `src/Pimd.sol:10` points at the supply constant, which is correct as written, so it is not a defect.\n\n**Coverage:** `approve`, `transfer` and `transferFrom` are all marked `holds`, plus two rows for the fixed-supply and balances-add-up checks. Nothing in my area was left unreached.\n\n**The one finding (info):** `DEPENDENCIES.md:10` says the bundled files were copied unchanged. Seven of the bundled forge-std files (the library the tests use) no longer match their recorded hashes, so running `sha256sum --check DEPENDENCIES.sha256` fails. I compared them with the upstream v1.9.7 release: the recorded hashes match upstream, and the local copies differ only in formatting. The deployed token is not affected, because only the documented provenance check fails.\n\nNo repository files were changed.","treeHash":null,"usage":{"cachedInputTokens":310723,"cost":{"source":"runtime","usdMicros":473529},"inputTokens":21,"model":"claude-opus-5-5","outputTokens":6495,"runtime":"claude","turns":11,"wallClockMs":92663}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"c7b1db4d25939bd5","findings":[{"citation":"resolved","description":"Merged from audit_flow (low), audit_permissions (info) and audit_math (info); all three report the same root cause and I reproduced it. DEPENDENCIES.md states every vendored file was copied unchanged from its pinned release and tells the reader to confirm this with `sha256sum --check DEPENDENCIES.sha256`. On the committed tree that command reports 7 of 36 files FAILED: lib/forge-std/src/StdAssertions.sol, StdJson.sol, StdToml.sol, Vm.sol, console.sol, interfaces/IERC7540.sol and interfaces/IMulticall3.sol. The recorded hashes are the upstream v1.9.7 hashes (I fetched upstream Vm.sol and StdAssertions.sol from raw.githubusercontent.com: their SHA-256 are 9068805b... and d4c89eec..., exactly the recorded values). The in-tree copies differ from upstream only in whitespace: stripping all whitespace from both yields identical bytes, consistent with `forge fmt` having been run over lib/ after the manifest was written. The deployed token is unaffected: the five OpenZeppelin v5.1.0 files that Pimd compiles against all pass, and I confirmed ERC20.sol is byte-identical to upstream. Impact is limited to a false provenance claim and a failing documented verification step for test-only infrastructure; nothing on chain changes. Fix: re-record the seven hashes from the tree (and note that lib/forge-std was reformatted), or restore the upstream byte-exact files and exclude lib/ from forge fmt.","line":10,"path":"DEPENDENCIES.md","reproduction":"From the repository root run `sha256sum --check DEPENDENCIES.sha256`. Expected (per DEPENDENCIES.md line 10-15): every line OK. Actual: 29 OK, 7 FAILED (the seven forge-std files above) and `sha256sum: WARNING: 7 computed checksums did NOT match`. Example: DEPENDENCIES.sha256 line 18 records 9068805b59ac1d0ea03a8fa1f15ae49c094e0c6c852a2500e0dd112f264b2cb1 for lib/forge-std/src/Vm.sol; `sha256sum lib/forge-std/src/Vm.sol` gives a1b1c82924aecf0f38b53192fd1e801cccc1e1fd2ecd6b2301e4f4c4ab102a15. `cmp <(tr -d ' \\t\\n\\r' < upstream/Vm.sol) <(tr -d ' \\t\\n\\r' < lib/forge-std/src/Vm.sol)` reports no difference, so the drift is formatting only.","severity":"low","snippet":"The files were copied unchanged from these releases. OpenZeppelin files came from the release-tagged paths on `raw.githubusercontent.com/OpenZeppelin/openzeppelin-contracts/v5.1.0/`. Forge Standard Library came from the tagged archive at `https://codeload.github.com/foundry-rs/forge-std/tar.gz/refs/tags/v1.9.7`; its archive SHA-256 was `45157353ab49eab01d294565866731e599b32401757229689ee459aa26b7ee94`.","title":"DEPENDENCIES.sha256 fails its own documented verification: seven vendored forge-std files were reformatted after their hashes were recorded"}],"hash":"784c2521c84c6e49e4d5c404b9615bdf1aaa29eb9a355e0c91e9fd4f0d797302","nodeId":"87533139-e25a-42d1-a442-398356a4e799","outcome":"completed","summary":"The review is complete and the findings file is written.\n\n**Outcome.** The Pimd token is a plain, unmodified OpenZeppelin v5.1.0 ERC20 with a parameterless constructor that mints a constant supply once to the deployer. I found no defect in the token. One low finding is kept, merged from the three specialists who reported the same thing.\n\n**Finding kept (merged, low).** DEPENDENCIES.md claims every vendored file was copied unchanged and names a checksum command to verify it. Running that command on the tree fails on seven forge-std files. I confirmed the recorded hashes are the upstream v1.9.7 values, and the in-tree files differ from upstream only by whitespace, so the drift is a reformatting after the hashes were recorded. The OpenZeppelin files the token compiles against all pass, and ERC20.sol is byte-identical to upstream. The impact is a false provenance claim on test-only code, so the severity is low with no proof file needed. The three reports from audit_flow, audit_permissions and audit_math shared one root cause and became one finding.\n\n**What I verified myself.**\n- All three entry points hold: approve, transfer and transferFrom follow the stock OpenZeppelin paths with zero-address, balance and allowance checks, and no fee, hook or external call.\n- The ABI exposes no mint, burn, owner, pause or blacklist function, so the protected supply and privilege tests pass by construction.\n- The compiled runtime contains no DELEGATECALL, CALLCODE or SELFDESTRUCT in its reachable instruction stream and is well under the size limit.\n- The manifest matches the code: empty constructor arguments, total supply of 10^27, lowercase addresses, and a 4-character contract name.\n- The project's own 54 tests pass, and the aderyn large-literal note is the constant supply, not a defect.\n\n**No files were changed** apart from the required .imd-findings.json, which holds the one finding and a six-row coverage record.","treeHash":null,"usage":{"cachedInputTokens":316405,"cost":{"source":"runtime","usdMicros":1248607},"inputTokens":226,"model":"claude-fable-5-1","outputTokens":5880,"runtime":"claude","turns":8,"wallClockMs":107174}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"60ffae3cc413a0c6","findings":[],"hash":"82ee6d224aba4be12bcb43b7149b742bd4c29bb233665bbe1c21835f475a8e8d","nodeId":"96903b79-b6dc-44f3-bc58-534c8bf05256","outcome":"completed","summary":"The review is complete with no defects found. The findings file is written and the tree is clean apart from it.\n\n**Result:** `.imd-findings.json` holds an empty findings list and seven coverage rows, one for each of the three entry points plus the invariants and launch flows I checked.\n\n**What was reviewed.** The token at `src/Pimd.sol` is a 16-line contract: it inherits OpenZeppelin ERC-20 and mints one billion tokens with 18 decimals to the deployer in the constructor. The five vendored OpenZeppelin files match their pinned v5.1.0 hashes, so the transfer, approval and allowance logic is the unmodified library. The compiled ABI exposes only approve, transfer and transferFrom as state changers, with no owner, mint, burn, pause, blacklist or upgrade selector.\n\n**Checks against the three guides.**\n- **Economic Security:** no external dependencies, oracles or callbacks exist. There is no fee, burn, rebase or exemption list, so the factory, pool manager and distributor flows move exactly the stated amount. A scratch probe reproducing Uniswap v4's sync/settle balance-delta accounting credited the seed and a round-trip trade in full.\n- **Invariant:** total supply equals the manifest's 10^27 and the only mint is the constructor. Transfer to the zero address reverts, so no path reduces supply. An independent eight-actor fuzz over random transfers and delegated transfers kept the sum of balances equal to supply in all 1024 runs, matching the project's own stateful invariant.\n- **Flow Gap:** the token makes no external calls, so no seam exists between execution, periphery and intent. The reachable-opcode scan from the protected floor found no DELEGATECALL, CALLCODE or SELFDESTRUCT.\n\n**Static-analysis leads.** Slither reported nothing. Aderyn's large-literal note at line 10 is the supply constant, which evaluates to exactly the manifest supply and is not a defect.\n\n**Notes outside my area.** Seven forge-std files fail the repository's hash list on this Windows checkout, while git reports the tree clean, so this is line-ending normalization rather than a changed file. Those files are test-only and not in the deployed bytecode. Standard ERC-20 approval front-running applies and is documented in the README. Neither is reported as a finding.\n\n**Verification run.** All 37 project tests passed with the README's fuzz seed, and my five scratch tests passed before I removed them along with the build artifacts.","treeHash":null,"usage":{"cachedInputTokens":614102,"cost":{"source":"runtime","usdMicros":2286965},"inputTokens":290,"model":"claude-fable-5-1","outputTokens":11326,"runtime":"claude","turns":25,"wallClockMs":173188}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"63274cc86a9400de","findings":[{"citation":"resolved","description":"Periphery/provenance. DEPENDENCIES.md states every vendored file was copied unchanged and tells the verifier to confirm this with `sha256sum --check DEPENDENCIES.sha256` (DEPENDENCIES.md:15). Running that command from the repository root reports 7 forge-std files as FAILED: lib/forge-std/src/StdAssertions.sol, StdJson.sol, StdToml.sol, Vm.sol, console.sol, interfaces/IERC7540.sol and interfaces/IMulticall3.sol. I fetched the upstream v1.9.7 copies and diffed: the recorded hashes are the upstream ones, and the in-tree files differ from upstream only by whitespace/line wrapping (they were reformatted by forge fmt after the hashes were recorded; the token-independent content is identical once whitespace is stripped). The five OpenZeppelin v5.1.0 files that the token actually compiles against are byte-identical to upstream and pass the check, so the deployed token is unaffected. Impact: the repository's own integrity claim is false and its documented verification step fails, which blocks or misleads anyone following the README/DEPENDENCIES.md procedure. Fix: either re-record the seven hashes from the files as they are in the tree, or restore the upstream byte-exact forge-std files (and keep forge fmt from touching lib/). Test-only dependency; no runtime or launch impact.","line":10,"path":"DEPENDENCIES.md","reproduction":"From the repository root run `sha256sum --check DEPENDENCIES.sha256` (or `shasum -a 256 -c DEPENDENCIES.sha256` on macOS). Expected per DEPENDENCIES.md: every line OK. Actual: 29 OK and 7 FAILED (lib/forge-std/src/StdAssertions.sol, StdJson.sol, StdToml.sol, Vm.sol, console.sol, interfaces/IERC7540.sol, interfaces/IMulticall3.sol), exit status 1. Confirming cause: `diff <(curl -s https://raw.githubusercontent.com/foundry-rs/forge-std/v1.9.7/src/Vm.sol) lib/forge-std/src/Vm.sol` shows only line-wrapping differences; stripping all whitespace from both yields identical SHA-256.","severity":"low","snippet":"The files were copied unchanged from these releases. OpenZeppelin files came from the release-tagged paths on `raw.githubusercontent.com/OpenZeppelin/openzeppelin-contracts/v5.1.0/`. Forge Standard Library came from the tagged archive at `https://codeload.github.com/foundry-rs/forge-std/tar.gz/refs/tags/v1.9.7`; its archive SHA-256 was `45157353ab49eab01d294565866731e599b32401757229689ee459aa26b7ee94`.","title":"DEPENDENCIES.sha256 does not match the vendored forge-std files; the documented provenance check fails on 7 files"}],"hash":"85bc7618cacdad506e0b9efa4d9926e22a5508cfacf0405b0423be0bc4b17efc","nodeId":"997ab8d6-4837-4788-8e4b-5d178a1601aa","outcome":"completed","summary":"Review complete. The findings file is written at the repository root, and the scratch test directory has been removed so no tracked file changed.\n\n**Outcome:** the control-flow area (Execution Trace, Periphery, First Principles) is clean for the token itself. One low-severity provenance defect is reported.\n\n**What I checked**\n\n- **Execution trace of all three entry points** through the vendored OpenZeppelin v5.1.0 base: zero-address sentinels, allowance spent before transfer with full unwind on revert, self-transfer, unlimited allowance, insufficient balance and allowance. All revert paths leave state untouched. No external calls, hooks, receive or fallback exist.\n- **Constructor and launch shape:** a single mint of exactly 10^27 units to the immediate creator. A scratch Foundry test deployed the raw creation code by CREATE2 from an etched factory address, confirmed the supply landed on the factory and not on the origin, then moved the 10/80/10 split by both transfer and transferFrom and round-tripped a trader balance. Every flow moved the exact amount and total supply never changed.\n- **Periphery:** the five OpenZeppelin files the token compiles against are byte-identical to upstream v5.1.0. Context uses plain msg.sender. Runtime bytecode was scanned: no reachable DELEGATECALL, CALLCODE or SELFDESTRUCT, and no CALL-family opcodes at all.\n- **Static-analysis lead:** aderyn's large-literal note is a compile-time constant equal to the manifest supply. Not a defect.\n- **Existing suite:** 37 tests plus the two invariants pass with the README's seed, and `forge fmt --check` is clean.\n\n**Finding (low):** DEPENDENCIES.md says every vendored file was copied unchanged and tells the verifier to run the SHA-256 check. That check fails on seven forge-std files. I diffed them against upstream v1.9.7: the differences are whitespace-only reformatting, so the hashes were recorded before a formatter touched them. Test-only dependency, no runtime or launch impact, but the documented integrity step is broken and should be fixed by re-recording the hashes or restoring byte-exact files.\n\n**Coverage:** ten rows written, covering the three listed entry points, the constructor, three invariants, the vendored base, the provenance check, and the static-analysis lead. Nothing was left unreached. No critical or high finding exists, so no proof test was attached.","treeHash":null,"usage":{"cachedInputTokens":560163,"cost":{"source":"runtime","usdMicros":2453914},"inputTokens":258,"model":"claude-fable-5-1","outputTokens":16147,"runtime":"claude","turns":22,"wallClockMs":224136}},{"artifacts":[],"attempt":1,"bundleHash":"c6bfdb5e4b0973a3f3f71439f8e659ebae2d2d1012b3f9c426844f06256578cc","device":"edf1925726a58c54","findings":[],"hash":"8edd0dcff2c03d6aed50815464196b708ab73d1a4b6e7e3386b679e430b5590e","nodeId":"99c6456c-41c7-4377-8834-e4340852bc40","outcome":"completed","summary":"Implemented Pimd (PIMD): 1 billion tokens, 18 decimals, minted once to the deployer. Dependencies are vendored; deployment and operational responsibilities are documented.\n\nPassed `forge build`, seeded `forge test` (36 unit/fuzz tests plus two invariants), and `forge fmt --check`.\n\nAn additional fully empty-environment check stopped before compilation with Foundry’s error: `could not detect user home directory`.","treeHash":"e379ce37b59b305c1346313e36139e895041308f","usage":{"cachedInputTokens":537600,"cost":{"source":"estimated","usdMicros":1970830},"inputTokens":55788,"model":"gpt-6-astra","outputTokens":17507,"runtime":"codex","turns":5,"wallClockMs":443907}},{"artifacts":[],"attempt":1,"bundleHash":"ecf2d2e808842410c2429c749166868881b39ee0ca8e9d12bba70636a6de8028","device":"8576036969b9332c","findings":[],"hash":"a46bbb92ebeb04d10dc12746dc962abfdf04c71576ee43098261cc42c396d9a9","nodeId":"fb1c2a0c-0f35-4e56-8262-eae7a71f3b7d","outcome":"completed","summary":"Created [launch.json](/home/imd/.identitymd-2/work/07481474-17b4-4e7a-b06a-a70b1148dc87/fb1c2a0c-0f35-4e56-8262-eae7a71f3b7d/launch.json) matching the accepted Pimd constructor, exact supply, pool settings, and verbatim economics.\n\n`forge build` succeeded; all 37 tests passed with the supplied fuzz seed. Only `launch.json` is changed outside permitted scratch artifacts.","treeHash":"3474288aa751bb143256a4c529b2bef9310ca598","usage":{"cachedInputTokens":241024,"cost":{"source":"estimated","usdMicros":743744},"inputTokens":35762,"model":"gpt-6-astra","outputTokens":2902,"runtime":"codex","turns":3,"wallClockMs":78633}},{"artifacts":[],"attempt":1,"bundleHash":"d84a3ea87f3461c4d74696a516bb7335764e7f2a7479f7bd15dc6948fe774fdf","device":"ba7dd2832066bc23","findings":[],"hash":"a4d562ce4fb3eff6859ac11fa574c7b155d38c80bd55ab11b9aec8746daea39c","nodeId":"079c896f-eef8-4c7a-8601-b7e1dd4d0873","outcome":"completed","summary":"Added 17 tests covering failure paths, allowance boundaries, caller authorization, and transfer properties. Expanded invariants to ten randomized actions.\n\nVerified offline with the required seed:\n- `forge build` passed.\n- `forge test` passed: 54 tests, 32,768 invariant calls, no failures.\n\nOnly `test/` changed. No implementation defects found.","treeHash":"6dd56c514f760548479f5106eb597d8a529c5b15","usage":{"cachedInputTokens":817408,"cost":{"source":"estimated","usdMicros":2351878},"inputTokens":81602,"model":"gpt-6-astra","outputTokens":14369,"runtime":"codex","turns":5,"wallClockMs":395202}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"aa333626543c4dee","findings":[{"citation":"resolved","description":"DEPENDENCIES.md states every vendored file was copied unchanged and tells the reader to confirm that with `sha256sum --check DEPENDENCIES.sha256`. Running that command on the committed tree reports seven forge-std files as FAILED: lib/forge-std/src/StdAssertions.sol, StdJson.sol, StdToml.sol, Vm.sol, console.sol, interfaces/IERC7540.sol and interfaces/IMulticall3.sol. I downloaded the upstream v1.9.7 archive (its SHA-256 matches the one quoted in DEPENDENCIES.md) and compared: the seven files differ from upstream only in whitespace, consistent with `forge fmt` having been run over lib/ after the hashes were recorded. Nothing in the deployed token is affected: the five OpenZeppelin v5.1.0 files that make up Pimd's dependency graph are byte-identical to upstream (verified against raw.githubusercontent.com), and forge-std is test infrastructure only. The defect is that the provenance claim and the checksum manifest the project ships for independent verification are false for the tree as committed, so a reviewer following the README's instructions gets a failure instead of the promised confirmation. Fix: either re-record the seven hashes in DEPENDENCIES.sha256 and note that lib/forge-std was reformatted, or restore the upstream bytes (and exclude lib/ from forge fmt).","line":10,"path":"DEPENDENCIES.md","reproduction":"From the repository root run `sha256sum --check DEPENDENCIES.sha256`. Expected (per DEPENDENCIES.md): every line OK. Actual: 7 lines FAILED (lib/forge-std/src/StdAssertions.sol, StdJson.sol, StdToml.sol, Vm.sol, console.sol, interfaces/IERC7540.sol, interfaces/IMulticall3.sol) and the warning `7 computed checksums did NOT match`. Example: DEPENDENCIES.sha256 line 18 records 9068805b59ac1d0ea03a8fa1f15ae49c094e0c6c852a2500e0dd112f264b2cb1 for lib/forge-std/src/Vm.sol, but `sha256sum lib/forge-std/src/Vm.sol` on the committed file gives a1b1c82924aecf0f38b53192fd1e801cccc1e1fd2ecd6b2301e4f4c4ab102a15. Stripping all whitespace from the committed file and from upstream v1.9.7 src/Vm.sol gives identical content, so the drift is formatting only.","severity":"info","snippet":"The files were copied unchanged from these releases. OpenZeppelin files came from the release-tagged paths on `raw.githubusercontent.com/OpenZeppelin/openzeppelin-contracts/v5.1.0/`. Forge Standard Library came from the tagged archive at `https://codeload.github.com/foundry-rs/forge-std/tar.gz/refs/tags/v1.9.7`; its archive SHA-256 was `45157353ab49eab01d294565866731e599b32401757229689ee459aa26b7ee94`.","title":"DEPENDENCIES.sha256 fails its own verification command for seven forge-std files (test-only, whitespace-only drift)"}],"hash":"b93e3b4c736c3525ba4d2e052200fcce044c7233c7adfdb68db8f48e446262b6","nodeId":"715b31ce-5953-40a7-8e9e-5bf05a49892c","outcome":"completed","summary":"The review is complete and `.imd-findings.json` is written at the repository root. No tracked file was changed.\n\n**Outcome:** the Pimd token has no permission defects. It is a 16-line contract that inherits OpenZeppelin v5.1.0 ERC20 unchanged and mints the full supply once to its deployer. There is no owner, minter, pauser, blacklist, initializer, proxy or external call anywhere in the deployed code.\n\n**What I checked in my area (Access Control, Trust Gap, Asymmetry):**\n- The compiled ABI exposes exactly three state-changing functions: approve, transfer and transferFrom. Every one writes only the caller's own allowance or balance. The deployer or factory cannot pull a holder's tokens without an allowance.\n- The five vendored OpenZeppelin files are byte-identical to upstream v5.1.0, confirmed by download and comparison, so the inherited guards are the audited ones.\n- The constructor is the only mint and has no arguments. The internal mint and burn paths are unreachable after construction, so supply cannot grow.\n- Paired surfaces were diffed: transfer against transferFrom, approve against the allowance spend, and the zero-address branches. The only asymmetry is the documented OpenZeppelin v5 behavior of not emitting Approval on transferFrom.\n- The runtime bytecode contains no CALL, DELEGATECALL, CALLCODE, CREATE, STATICCALL or SELFDESTRUCT.\n- The existing suite passes with the README's seed. All 37 tests including the two stateful invariants succeeded.\n\n**One info-level finding, outside my area:** the shipped checksum file does not verify. Running the command DEPENDENCIES.md prescribes reports seven forge-std files as failed. I compared them against the upstream v1.9.7 archive and the differences are whitespace only, so the test library is functionally unchanged and the deployed token is unaffected. The fix is to re-record those seven hashes or restore the upstream bytes.\n\n**Coverage record:** all three listed entry points are marked `holds`, with four additional invariant rows (single mint to deployer, no privileged surface, no forbidden opcodes, exact launch flows) also `holds`, and one provenance row pointing at the finding. Nothing was left unreached. Both static-analysis leads were examined: Slither reported nothing, and aderyn's large-numeric-literal note is a compile-time constant that evaluates to the expected 10^27.","treeHash":null,"usage":{"cachedInputTokens":627746,"cost":{"source":"runtime","usdMicros":2601092},"inputTokens":258,"model":"claude-fable-5-1","outputTokens":12200,"runtime":"claude","turns":25,"wallClockMs":309631}}],"verification":[{"checks":[{"durationMs":1745,"exitCode":0,"name":"build","output":"Compiling 27 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.59s\nCompiler run successful!\n","passed":true},{"durationMs":5378,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 36 tests for test/Pimd.t.sol:PimdTest\n[PASS] testFuzz_approveAnyAmount(uint256) (runs: 1024, μ: 88608, ~: 88907)\n[PASS] testFuzz_selfTransferPreservesSupply(uint256) (runs: 1024, μ: 55077, ~: 54815)\nLogs:\n  Bound result 31938\n\n[PASS] testFuzz_transferAboveBalanceAlwaysReverts(uint256,uint256) (runs: 1024, μ: 126877, ~: 127778)\nLogs:\n  Bound result 15825\n  Bound result 21091\n\n[PASS] testFuzz_transferConservesSupply(address,uint256) (runs: 1024, μ: 92909, ~: 93210)\nLogs:\n  Bound result 843695338003650479630635524\n\n[PASS] testFuzz_transferFromAboveAllowanceAlwaysReverts(uint256,uint256) (runs: 1024, μ: 122825, ~: 123397)\nLogs:\n  Bound result 775066955496286685914257657\n  Bound result 974366410500687673081376033\n\n[PASS] testFuzz_transferFromAboveBalanceRestoresAllowance(uint256,uint256) (runs: 1024, μ: 195935, ~: 196623)\nLogs:\n  Bound result 5744181202451665414432\n  Bound result 845756197024612646098828749\n\n[PASS] testFuzz_transferFromAccounting(uint256,uint256) (runs: 1024, μ: 165176, ~: 168048)\nLogs:\n  Bound result 2\n\n[PASS] test_allowancesAreIsolatedByOwnerAndSpender() (gas: 204289)\n[PASS] test_approvalCanBeReplacedAndRevoked() (gas: 173722)\n[PASS] test_approveEmitsEventAndDoesNotMoveTokens() (gas: 88734)\n[PASS] test_approveZeroOwnerReverts() (gas: 33120)\n[PASS] test_approveZeroSpenderReverts() (gas: 37552)\n[PASS] test_constructorEmitsExactlyOneMintEvent() (gas: 9748)\n[PASS] test_create2DeploymentMintsOnlyToTheFactory() (gas: 297464)\n[PASS] test_deployerCannotSpendAnotherHoldersTokensWithoutApproval() (gas: 160134)\n[PASS] test_launchDistributionAndSubsequentTransfersAreExact() (gas: 636202)\n[PASS] test_metadataAndInitialSupply() (gas: 107606)\n[PASS] test_nativeCurrencyAndUnknownCallsRevert() (gas: 64755)\n[PASS] test_noMintBurnAdminOrUpgradeEntryPoints() (gas: 1381212)\n[PASS] test_selfTransferFromConsumesAllowanceWithoutMovingBalance() (gas: 103312)\n[PASS] test_selfTransferPreservesBalance() (gas: 51410)\n[PASS] test_transferEntireSupply() (gas: 161710)\n[PASS] test_transferFromCanExhaustAllowance() (gas: 161874)\n[PASS] test_transferFromInfiniteApprovalDoesNotDecreaseAllowance() (gas: 207163)\n[PASS] test_transferFromInsufficientAllowanceRevertsWithoutChangingState() (gas: 115818)\n[PASS] test_transferFromInsufficientBalanceRestoresAllowance() (gas: 188856)\n[PASS] test_transferFromSpendsFiniteAllowanceAndEmitsTransfer() (gas: 172634)\n[PASS] test_transferFromToZeroRestoresAllowance() (gas: 114189)\n[PASS] test_transferFromWithoutApprovalReverts() (gas: 57866)\n[PASS] test_transferFromZeroCallerReverts() (gas: 33123)\n[PASS] test_transferFromZeroSourceRevertsEvenForZeroAmount() (gas: 55025)\n[PASS] test_transferMovesExactAmountAndEmitsEvent() (gas: 91529)\n[PASS] test_transferOverBalanceRevertsWithoutChangingState() (gas: 120092)\n[PASS] test_transferToZeroRevertsEvenForZeroAmount() (gas: 71882)\n[PASS] test_zeroTransferFromEmptyAccountEmitsEvent() (gas: 73389)\n[PASS] test_zeroTransferFromNeedsNoAllowance() (gas: 81468)\nSuite result: ok. 36 passed; 0 failed; 0 skipped; finished in 139.03ms (572.76ms CPU time)\n\nRan 1 test for test/Pimd.invariant.t.sol:PimdInvariantTest\n[PASS]\nPimdInvariantTest invariants:\n[PASS] invariant_balancesAndAllowancesMatchTheModel\n[PASS] invariant_supplyIsFixedAndEveryTokenIsAccountedFor\n PimdInvariantTest invariants (runs: 256, calls: 16384, reverts: 0)\n\n╭-------------+-----------+-------+---------+----------╮\n| Contract    | Selector  | Calls | Reverts | Discards |\n+======================================================+\n| PimdHandler | approve   | 4089  | 0       | 0        |\n|-------------+-----------+-------+---------+----------|\n| PimdHandler | move      | 4202  | 0       | 0        |\n|-------------+-----------+-------+---------+----------|\n| PimdHandler | overspend | 4063  | 0       | 0        |\n|-------------+-----------+-------+---------+----------|\n| PimdHandler | spend     | 4030  | 0       | 0        |\n╰-------------+-----------+-------+---------+----------╯\n\nLogs:\n  Bound result 0\n  Bound result 0\n  Bound result 50000000000000000000\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 40000000000000000000\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 4\n  Bound result 1\n  Bound result 0\n  Bound result 3\n  Bound result 10000000000000000000\n  Bound result 11\n  Bound result 40000000000000000000\n  Bound result 0\n  Bound result 7\n  Bound result 2\n  Bound result 5\n  Bound result 0\n  Bound result 0\n  Bound result 54\n  Bound result 4414\n  Bound result 1000000000\n  Bound result 0\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 5.21s (5.21s CPU time)\n\nRan 2 test suites in 5.21s (5.35s CPU time): 37 tests passed, 0 failed, 0 skipped (37 total tests)\n","passed":true},{"durationMs":49,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"Pimd.approve(address,uint256)\",\"Pimd.transfer(address,uint256)\",\"Pimd.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"DEPENDENCIES.md\":18,\"DEPENDENCIES.sha256\":36,\"README.md\":67,\"SECURITY_REVIEW.md\":22,\"foundry.toml\":19,\"remappings.txt\":2,\"src/Pimd.sol\":16,\"test/Pimd.invariant.t.sol\":112,\"test/Pimd.t.sol\":461},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true},{"durationMs":639,"exitCode":0,"name":"slither","output":"slither: no results at low impact or above","passed":true},{"durationMs":319,"exitCode":0,"name":"aderyn","output":"[low] large-numeric-literal at src/Pimd.sol:10: Large Numeric Literal","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"8edd0dcff2c03d6aed50815464196b708ab73d1a4b6e7e3386b679e430b5590e","verifiedTreeHash":"e379ce37b59b305c1346313e36139e895041308f","verifierVersion":"0.1.0+18543036"},{"checks":[{"durationMs":1316,"exitCode":0,"name":"build","output":"Compiling 27 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.22s\nCompiler run successful!\n","passed":true},{"durationMs":4444,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 36 tests for test/Pimd.t.sol:PimdTest\n[PASS] testFuzz_approveAnyAmount(uint256) (runs: 1024, μ: 88608, ~: 88907)\n[PASS] testFuzz_selfTransferPreservesSupply(uint256) (runs: 1024, μ: 55077, ~: 54815)\nLogs:\n  Bound result 20000000000000000000\n\n[PASS] testFuzz_transferAboveBalanceAlwaysReverts(uint256,uint256) (runs: 1024, μ: 126877, ~: 127778)\nLogs:\n  Bound result 172108436016635536\n  Bound result 21702810420798129017491496570\n\n[PASS] testFuzz_transferConservesSupply(address,uint256) (runs: 1024, μ: 92909, ~: 93210)\nLogs:\n  Bound result 1\n\n[PASS] testFuzz_transferFromAboveAllowanceAlwaysReverts(uint256,uint256) (runs: 1024, μ: 122825, ~: 123397)\nLogs:\n  Bound result 5744181202451665414432\n  Bound result 845756197024612646098828749\n\n[PASS] testFuzz_transferFromAboveBalanceRestoresAllowance(uint256,uint256) (runs: 1024, μ: 195935, ~: 196623)\nLogs:\n  Bound result 15825\n  Bound result 21091\n\n[PASS] testFuzz_transferFromAccounting(uint256,uint256) (runs: 1024, μ: 165176, ~: 168048)\nLogs:\n  Bound result 79060671825586412700725\n\n[PASS] test_allowancesAreIsolatedByOwnerAndSpender() (gas: 204289)\n[PASS] test_approvalCanBeReplacedAndRevoked() (gas: 173722)\n[PASS] test_approveEmitsEventAndDoesNotMoveTokens() (gas: 88734)\n[PASS] test_approveZeroOwnerReverts() (gas: 33120)\n[PASS] test_approveZeroSpenderReverts() (gas: 37552)\n[PASS] test_constructorEmitsExactlyOneMintEvent() (gas: 9748)\n[PASS] test_create2DeploymentMintsOnlyToTheFactory() (gas: 297464)\n[PASS] test_deployerCannotSpendAnotherHoldersTokensWithoutApproval() (gas: 160134)\n[PASS] test_launchDistributionAndSubsequentTransfersAreExact() (gas: 636202)\n[PASS] test_metadataAndInitialSupply() (gas: 107606)\n[PASS] test_nativeCurrencyAndUnknownCallsRevert() (gas: 64755)\n[PASS] test_noMintBurnAdminOrUpgradeEntryPoints() (gas: 1381212)\n[PASS] test_selfTransferFromConsumesAllowanceWithoutMovingBalance() (gas: 103312)\n[PASS] test_selfTransferPreservesBalance() (gas: 51410)\n[PASS] test_transferEntireSupply() (gas: 161710)\n[PASS] test_transferFromCanExhaustAllowance() (gas: 161874)\n[PASS] test_transferFromInfiniteApprovalDoesNotDecreaseAllowance() (gas: 207163)\n[PASS] test_transferFromInsufficientAllowanceRevertsWithoutChangingState() (gas: 115818)\n[PASS] test_transferFromInsufficientBalanceRestoresAllowance() (gas: 188856)\n[PASS] test_transferFromSpendsFiniteAllowanceAndEmitsTransfer() (gas: 172634)\n[PASS] test_transferFromToZeroRestoresAllowance() (gas: 114189)\n[PASS] test_transferFromWithoutApprovalReverts() (gas: 57866)\n[PASS] test_transferFromZeroCallerReverts() (gas: 33123)\n[PASS] test_transferFromZeroSourceRevertsEvenForZeroAmount() (gas: 55025)\n[PASS] test_transferMovesExactAmountAndEmitsEvent() (gas: 91529)\n[PASS] test_transferOverBalanceRevertsWithoutChangingState() (gas: 120092)\n[PASS] test_transferToZeroRevertsEvenForZeroAmount() (gas: 71882)\n[PASS] test_zeroTransferFromEmptyAccountEmitsEvent() (gas: 73389)\n[PASS] test_zeroTransferFromNeedsNoAllowance() (gas: 81468)\nSuite result: ok. 36 passed; 0 failed; 0 skipped; finished in 46.75ms (325.19ms CPU time)\n\nRan 1 test for test/Pimd.invariant.t.sol:PimdInvariantTest\n[PASS]\nPimdInvariantTest invariants:\n[PASS] invariant_balancesAndAllowancesMatchTheModel\n[PASS] invariant_supplyIsFixedAndEveryTokenIsAccountedFor\n PimdInvariantTest invariants (runs: 256, calls: 16384, reverts: 0)\n\n╭-------------+-----------+-------+---------+----------╮\n| Contract    | Selector  | Calls | Reverts | Discards |\n+======================================================+\n| PimdHandler | approve   | 4089  | 0       | 0        |\n|-------------+-----------+-------+---------+----------|\n| PimdHandler | move      | 4202  | 0       | 0        |\n|-------------+-----------+-------+---------+----------|\n| PimdHandler | overspend | 4063  | 0       | 0        |\n|-------------+-----------+-------+---------+----------|\n| PimdHandler | spend     | 4030  | 0       | 0        |\n╰-------------+-----------+-------+---------+----------╯\n\nLogs:\n  Bound result 0\n  Bound result 0\n  Bound result 50000000000000000000\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 40000000000000000000\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 4\n  Bound result 1\n  Bound result 0\n  Bound result 3\n  Bound result 10000000000000000000\n  Bound result 11\n  Bound result 40000000000000000000\n  Bound result 0\n  Bound result 7\n  Bound result 2\n  Bound result 5\n  Bound result 0\n  Bound result 0\n  Bound result 54\n  Bound result 4414\n  Bound result 1000000000\n  Bound result 0\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 4.33s (4.33s CPU time)\n\nRan 2 test suites in 4.34s (4.38s CPU time): 37 tests passed, 0 failed, 0 skipped (37 total tests)\n","passed":true},{"durationMs":35,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"Pimd.approve(address,uint256)\",\"Pimd.transfer(address,uint256)\",\"Pimd.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"DEPENDENCIES.md\":18,\"DEPENDENCIES.sha256\":36,\"README.md\":67,\"SECURITY_REVIEW.md\":22,\"foundry.toml\":19,\"launch.json\":20,\"remappings.txt\":2,\"src/Pimd.sol\":16,\"test/Pimd.invariant.t.sol\":112,\"test/Pimd.t.sol\":461},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"a46bbb92ebeb04d10dc12746dc962abfdf04c71576ee43098261cc42c396d9a9","verifiedTreeHash":"3474288aa751bb143256a4c529b2bef9310ca598","verifierVersion":"0.1.0+18543036"},{"checks":[{"durationMs":1747,"exitCode":0,"name":"build","output":"Compiling 28 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.63s\nCompiler run successful!\n","passed":true},{"durationMs":7915,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 17 tests for test/Pimd.properties.t.sol:PimdPropertiesTest\n[PASS] testFuzz_approvalReplacementIsIdempotentAndIsolated(uint256,uint256) (runs: 1024, μ: 464731, ~: 465768)\n[PASS] testFuzz_failedSpendCanBeRetriedAfterFunding(uint256,uint256) (runs: 1024, μ: 392966, ~: 393366)\nLogs:\n  Bound result 775066955496286685914257657\n  Bound result 974366410500687673081376033\n\n[PASS] testFuzz_returningTokensDoesNotRestoreSpentAllowance(uint256,uint256) (runs: 1024, μ: 454416, ~: 455239)\nLogs:\n  Bound result 172108436016635536\n  Bound result 132673708197532826\n\n[PASS] testFuzz_selfTransfersCannotBypassBalance(uint256,uint256) (runs: 1024, μ: 277819, ~: 278585)\nLogs:\n  Bound result 172108436016635536\n  Bound result 21702810420798129017491496570\n\n[PASS] testFuzz_splitDelegatedTransfersEqualSingleTransfer(uint256,uint256,uint256) (runs: 1024, μ: 439070, ~: 441005)\nLogs:\n  Bound result 12720\n  Bound result 18\n  Bound result 18836\n\n[PASS] testFuzz_zeroRecipientFailurePreservesApproval(uint256,uint256) (runs: 1024, μ: 176091, ~: 176112)\nLogs:\n  Bound result 115792089237316195423570985008687907853269984665640564039457584007913129636073\n\n[PASS] test_allowanceSurvivesEmptyingAndRefillingBalance() (gas: 446394)\n[PASS] test_directTransfersDoNotConsumeAllowance() (gas: 343989)\n[PASS] test_infiniteApprovalCanBeReducedThenRevoked() (gas: 488165)\n[PASS] test_maximumFiniteAllowanceIsNotInfinite() (gas: 298145)\n[PASS] test_maximumTransferAmountsRevertWithoutOverflow() (gas: 214292)\n[PASS] test_oneWeiApprovalCanBeSpentOnlyOnce() (gas: 298766)\n[PASS] test_spenderAuthorityUsesCallerNotOriginOrRecipient() (gas: 371115)\n[PASS] test_tokenContractReceivingTokensDoesNotBurnThem() (gas: 240642)\n[PASS] test_transferFromByOwnerStillRequiresApproval() (gas: 316396)\n[PASS] test_zeroApprovalToZeroSpenderIsInvalid() (gas: 116034)\n[PASS] test_zeroTransferFromToZeroStillRejectsWithInfiniteApproval() (gas: 169332)\nSuite result: ok. 17 passed; 0 failed; 0 skipped; finished in 131.98ms (770.78ms CPU time)\n\nRan 36 tests for test/Pimd.t.sol:PimdTest\n[PASS] testFuzz_approveAnyAmount(uint256) (runs: 1024, μ: 88570, ~: 88907)\n[PASS] testFuzz_selfTransferPreservesSupply(uint256) (runs: 1024, μ: 55079, ~: 54815)\nLogs:\n  Bound result 50000000000000000000\n\n[PASS] testFuzz_transferAboveBalanceAlwaysReverts(uint256,uint256) (runs: 1024, μ: 126928, ~: 127778)\nLogs:\n  Bound result 19040\n  Bound result 5000000000000000000\n\n[PASS] testFuzz_transferConservesSupply(address,uint256) (runs: 1024, μ: 92892, ~: 93210)\nLogs:\n  Bound result 5000000000000000001\n\n[PASS] testFuzz_transferFromAboveAllowanceAlwaysReverts(uint256,uint256) (runs: 1024, μ: 122892, ~: 123399)\nLogs:\n  Bound result 15825\n  Bound result 21091\n\n[PASS] testFuzz_transferFromAboveBalanceRestoresAllowance(uint256,uint256) (runs: 1024, μ: 196010, ~: 196623)\nLogs:\n  Bound result 15825\n  Bound result 21091\n\n[PASS] testFuzz_transferFromAccounting(uint256,uint256) (runs: 1024, μ: 165250, ~: 168048)\nLogs:\n  Bound result 132673582097900972\n\n[PASS] test_allowancesAreIsolatedByOwnerAndSpender() (gas: 204289)\n[PASS] test_approvalCanBeReplacedAndRevoked() (gas: 173722)\n[PASS] test_approveEmitsEventAndDoesNotMoveTokens() (gas: 88734)\n[PASS] test_approveZeroOwnerReverts() (gas: 33120)\n[PASS] test_approveZeroSpenderReverts() (gas: 37552)\n[PASS] test_constructorEmitsExactlyOneMintEvent() (gas: 9748)\n[PASS] test_create2DeploymentMintsOnlyToTheFactory() (gas: 297464)\n[PASS] test_deployerCannotSpendAnotherHoldersTokensWithoutApproval() (gas: 160134)\n[PASS] test_launchDistributionAndSubsequentTransfersAreExact() (gas: 636202)\n[PASS] test_metadataAndInitialSupply() (gas: 107606)\n[PASS] test_nativeCurrencyAndUnknownCallsRevert() (gas: 64755)\n[PASS] test_noMintBurnAdminOrUpgradeEntryPoints() (gas: 1381212)\n[PASS] test_selfTransferFromConsumesAllowanceWithoutMovingBalance() (gas: 103312)\n[PASS] test_selfTransferPreservesBalance() (gas: 51410)\n[PASS] test_transferEntireSupply() (gas: 161710)\n[PASS] test_transferFromCanExhaustAllowance() (gas: 161874)\n[PASS] test_transferFromInfiniteApprovalDoesNotDecreaseAllowance() (gas: 207163)\n[PASS] test_transferFromInsufficientAllowanceRevertsWithoutChangingState() (gas: 115818)\n[PASS] test_transferFromInsufficientBalanceRestoresAllowance() (gas: 188856)\n[PASS] test_transferFromSpendsFiniteAllowanceAndEmitsTransfer() (gas: 172634)\n[PASS] test_transferFromToZeroRestoresAllowance() (gas: 114189)\n[PASS] test_transferFromWithoutApprovalReverts() (gas: 57866)\n[PASS] test_transferFromZeroCallerReverts() (gas: 33123)\n[PASS] test_transferFromZeroSourceRevertsEvenForZeroAmount() (gas: 55025)\n[PASS] test_transferMovesExactAmountAndEmitsEvent() (gas: 91529)\n[PASS] test_transferOverBalanceRevertsWithoutChangingState() (gas: 120092)\n[PASS] test_transferToZeroRevertsEvenForZeroAmount() (gas: 71882)\n[PASS] test_zeroTransferFromEmptyAccountEmitsEvent() (gas: 73389)\n[PASS] test_zeroTransferFromNeedsNoAllowance() (gas: 81468)\nSuite result: ok. 36 passed; 0 failed; 0 skipped; finished in 132.06ms (816.04ms CPU time)\n\nRan 1 test for test/Pimd.invariant.t.sol:PimdInvariantTest\n[PASS]\nPimdInvariantTest invariants:\n[PASS] invariant_balancesAndAllowancesMatchTheModel\n[PASS] invariant_supplyIsFixedAndEveryTokenIsAccountedFor\n PimdInvariantTest invariants (runs: 256, calls: 32768, reverts: 0)\n\n╭-------------+---------------------+-------+---------+----------╮\n| Contract    | Selector            | Calls | Reverts | Discards |\n+================================================================+\n| PimdHandler | approve             | 3204  | 0       | 0        |\n|-------------+---------------------+-------+---------+----------|\n| PimdHandler | approveAndSpend     | 3369  | 0       | 0        |\n|-------------+---------------------+-------+---------+----------|\n| PimdHandler | move                | 3260  | 0       | 0        |\n|-------------+---------------------+-------+---------+----------|\n| PimdHandler | overspend           | 3372  | 0       | 0        |\n|-------------+---------------------+-------+---------+----------|\n| PimdHandler | rejectOverAllowance | 3311  | 0       | 0        |\n|-------------+---------------------+-------+---------+----------|\n| PimdHandler | rejectOverBalance   | 3312  | 0       | 0        |\n|-------------+---------------------+-------+---------+----------|\n| PimdHandler | rejectZeroRecipient | 3284  | 0       | 0        |\n|-------------+---------------------+-------+---------+----------|\n| PimdHandler | revokeAndReject     | 3210  | 0       | 0        |\n|-------------+---------------------+-------+---------+----------|\n| PimdHandler | roundTrip           | 3248  | 0       | 0        |\n|-------------+---------------------+-------+---------+----------|\n| PimdHandler | spend               | 3198  | 0       | 0        |\n╰-------------+---------------------+-------+---------+----------╯\n\nLogs:\n  Bound result 250000000000000000000000000\n  Bound result 250000000000000000000000000\n  Bound result 250000000000000000000000000\n  Bound result 10\n  Bound result 376\n  Bound result 0\n  Bound result 189785733629472109259173138\n  Bound result 3799\n  Bound result 42222403386\n  Bound result 30000000000000000000\n  Bound result 115792089237316195423570985008687907853269984665640124253723954535846092876458\n  Bound result 208206569969985713309903910\n  Bound result 474\n  Bound result 115792089237316195423570985008687907853269984665640124253723954535846092877836\n  Bound result 7952\n  Bound result 221396782218495277957002281\n  Bound result 41793430030014286690096090\n  Bound result 289201887163544863680452143744875744851554495407788458722667909097190\n  Bound result 11\n  Bound result 39143620159947534419337854\n  Bound result 429691682027962473778885792\n  Bound result 11923\n  Bound result 194737490978459061180597526\n  Bound result 5\n  Bound result 20000000000000000000\n  Bound result 295290128752180913317574622\n  Bound result 230\n  Bound result 115792089237316195423570985008687907853269984665640268749328831826999812069799\n  Bound result 7\n  Bound result 6000000000000000000\n  Bound result 1\n  Bound result 4045\n  Bound result 115792089237316195423570985008687907853269984665640419543852706716759410449555\n  Bound result 255\n  Bound result 201077378260319165967377434\n  Bound result 10039\n  Bound result 69740860435694518547\n  Bound result 74967743050744472277416334\n  Bound result 0\n  Bound result 4991\n  Bound result 10992\n  Bound result 65934479382646468636178478\n  Bound result 136856976623886045821769992\n  Bound result 3032\n  Bound result 0\n  Bound result 67\n  Bound result 14\n  Bound result 243166129956081444792645\n  Bound result 115792089237316195423570985008687907853269984665640344576109655972287133032354\n  Bound result 0\n  Bound result 123000000000000000000\n  Bound result 115792089237316195423570985008687907853269984665640564039457584007913129639935\n  Bound result 115792089237316195423570985008687907853269984665640344576109655972287133036675\n  Bound result 242\n  Bound result 5000000000000000001\n  Bound result 220079219571480359595365387\n  Bound result 115792089237316195423570985008687907853269984665640343960238012527553534274558\n  Bound result 115792089237316195423570985008687907853269984665640344576111655972287133032340\n  Bound result 6\n  Bound result 45121569270245063529380119\n  Bound result 12\n  Bound result 3395723174\n  Bound result 5\n  Bound result 115792089237316195423570985008687907853269984665640272002841424037548390482229\n  Bound result 4\n  Bound result 52689061015878059370189893\n  Bound result 5178\n  Bound result 0\n  Bound result 0\n  Bound result 2354\n  Bound result 194015676540341056561192484\n  Bound result 3214\n  Bound result 229854818714801310410179947\n  Bound result 8312\n  Bound result 10000000000000000001\n  Bound result 9\n  Bound result 123000000000000000000\n  Bound result 81555506292936983318951146\n  Bound result 7000000000000000000\n  Bound result 2\n  Bound result 220079219571480362991088553\n  Bound result 13\n  Bound result 10547\n  Bound result 31500464869835094349613945\n  Bound result 157281238313360308837911383\n  Bound result 115792089237316195423570985008687907853269984665640343960238012527550138558126\n  Bound result 4877\n  Bound result 12\n  Bound result 8427\n  Bound result 8\n  Bound result 30000000000000000000\n  Bound result 166774291912157566626434445\n  Bound result 245883686179254891695352337\n  Bound result 15\n  Bound result 10000000000000000000\n  Bound result 115792089237316195423570985008687907853269984665640177185946100369983512121807\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 7.79s (7.78s CPU time)\n\nRan 3 test suites in 7.80s (8.05s CPU time): 54 tests passed, 0 failed, 0 skipped (54 total tests)\n","passed":true},{"durationMs":52,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"Pimd.approve(address,uint256)\",\"Pimd.transfer(address,uint256)\",\"Pimd.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"DEPENDENCIES.md\":18,\"DEPENDENCIES.sha256\":36,\"README.md\":67,\"SECURITY_REVIEW.md\":22,\"foundry.toml\":19,\"remappings.txt\":2,\"src/Pimd.sol\":16,\"test/Pimd.invariant.t.sol\":242,\"test/Pimd.properties.t.sol\":355,\"test/Pimd.t.sol\":461,\"test/README.md\":66},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"a4d562ce4fb3eff6859ac11fa574c7b155d38c80bd55ab11b9aec8746daea39c","verifiedTreeHash":"6dd56c514f760548479f5106eb597d8a529c5b15","verifierVersion":"0.1.0+18543036"}]}