{"assessments":[],"deployments":[],"fuzz":[],"identity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"interpretation":"Records acceptance and evidence. Neither completion nor an AI assessment establishes correctness, safety, or independent review.","jobId":"4279e50e-7129-464c-8920-5c409543110b","kind":"shape:chain","nodes":[{"acceptedSubmissionHash":"ba496c55c37518e3769e8a9f8c1022403aa057af240ddbfbf0ce603bf22c149d","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_economics","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"ed81e4e5131eb0a8a7b5284e0e8293fec3d6b95f957e11cb9c3de9bc4a7fc971","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_flow","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"3136a939cb4f0adf76d7daf2ef0c8710fc8656daadbcd03fa5fd850d8ffb4284","dependsOn":["build_contract_project","write_foundry_tests","manifest","audit_math","audit_permissions","audit_economics","audit_flow"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"af3aa01159bbf354f621cafa5c0006f6169e0938a8b015be508b7377dbf165bc","skillId":"audit-judge","tools":[]},"key":"audit_judge","kind":"code","role":"review","skillHash":"af3aa01159bbf354f621cafa5c0006f6169e0938a8b015be508b7377dbf165bc","skillId":"audit-judge","state":"accepted"},{"acceptedSubmissionHash":"0f36c260e4583d8563312c9d22c1fe743dfe4d4abd1755c56a2e2b566238096f","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_math","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"fe8416d7de723da6f90030ea1bcb2a30dcdd291f8f2199bdda0eb7bf57648516","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_permissions","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"1bb93c2591db7cd20971db3f35cbfb525e35b4776eb66b3034af87e63fd3e579","dependsOn":[],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"d59561da3b378461b7c749f6bd5084477d44993aa94972ddea90f542535751df","skillId":"build-contract-project","tools":[]},"key":"build_contract_project","kind":"code","role":"implement","skillHash":"d59561da3b378461b7c749f6bd5084477d44993aa94972ddea90f542535751df","skillId":"build-contract-project","state":"accepted"},{"acceptedSubmissionHash":"2a9308a458ee67b35a28eeab02d2959f8316a577eb590e6e7a91a386650c21e6","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"tools":[]},"key":"manifest","kind":"code","role":"integrate","skillHash":null,"skillId":null,"state":"accepted"},{"acceptedSubmissionHash":"4e4f18a0d917f65d1c23089c7357c13ad387c29105156736d76c2a05530bdcec","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"4c76766b00591dfe982fe85d3de589fdb2f810e5137c301155d1c5e36a1d3b23","skillId":"write-foundry-tests","tools":[]},"key":"write_foundry_tests","kind":"code","role":"tests","skillHash":"4c76766b00591dfe982fe85d3de589fdb2f810e5137c301155d1c5e36a1d3b23","skillId":"write-foundry-tests","state":"accepted"}],"objective":"A custom token: curb (CURB).\nToken name: curb\nToken symbol: CURB\nToken supply: 1,000,000,000 with 18 decimals, all minted once to the deployer in the constructor.\nWhat it does: Curb","parentJobId":null,"planHash":"4a36467560102b832b2345fa34207b1e88a6e6cb30a01fe9fb88f8c54e4ad894","previousHash":"0000000000000000000000000000000000000000000000000000000000000000","projectId":"4279e50e-7129-464c-8920-5c409543110b","publication":{"commit":null,"deliveredAt":null,"repoUrl":"https://github.com/identity-md-launches/launch-2256-curb"},"receiptIdentity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"registry":"0xb6d0a187b050fa5bb0b87033a203f37becf4a775","research":[],"schema":"identitymd-work-v1","signals":[{"agentId":"52253","feedbackHash":"b6fb89474ee0d52920747f59cdde44e983e19506b2bf4e7925b11fd6a20b8990","nodeKey":"audit_economics","submissionHash":"ba496c55c37518e3769e8a9f8c1022403aa057af240ddbfbf0ce603bf22c149d","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52166","feedbackHash":"7e5c93e7a9619391bdf45cd43149062a6054172fece9e560e028ffb265c8a665","nodeKey":"audit_flow","submissionHash":"ed81e4e5131eb0a8a7b5284e0e8293fec3d6b95f957e11cb9c3de9bc4a7fc971","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51169","feedbackHash":"b1f54e8d7e1b5b95ce353fd3aa2b198f843bac91aa9ee3cb6155a7e5e1a76f69","nodeKey":"audit_judge","submissionHash":"3136a939cb4f0adf76d7daf2ef0c8710fc8656daadbcd03fa5fd850d8ffb4284","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52149","feedbackHash":"2a0e3f17fa38fdf3b5adaedc48b1fb5835e73557cea19ad33f2a239615c4d7a9","nodeKey":"audit_math","submissionHash":"0f36c260e4583d8563312c9d22c1fe743dfe4d4abd1755c56a2e2b566238096f","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51041","feedbackHash":"612eafb81e31fdefc3623ecf7f3f13023567251263918dbcdde4620eac04be94","nodeKey":"audit_permissions","submissionHash":"fe8416d7de723da6f90030ea1bcb2a30dcdd291f8f2199bdda0eb7bf57648516","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52131","feedbackHash":"0b7c802509ff3456c4bcb4ea5caad8f9a5dcfac5a86509aab34ad79d6b0dd7be","nodeKey":"build_contract_project","submissionHash":"1bb93c2591db7cd20971db3f35cbfb525e35b4776eb66b3034af87e63fd3e579","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"51533","feedbackHash":"ef81997e136cc3679b681ea24a1cc0e6310d1e9271dc448b2e16b18bf0539fc3","nodeKey":"manifest","submissionHash":"2a9308a458ee67b35a28eeab02d2959f8316a577eb590e6e7a91a386650c21e6","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"51729","feedbackHash":"b378c6c7811e5583208488bbe31306b0b055532353344a038b1a6e99c5e20320","nodeKey":"write_foundry_tests","submissionHash":"4e4f18a0d917f65d1c23089c7357c13ad387c29105156736d76c2a05530bdcec","tag1":"verification:checks","tag2":"acceptance-v2","value":1}],"site":null,"snapshotHash":"8ac0c57669fa2390b2cdeb593822927ae8f57cbb0f2790a131852b7a50435a0e","state":"completed","submissions":[{"artifacts":[],"attempt":1,"bundleHash":null,"device":"af1843f371022d4a","findings":[],"hash":"0f36c260e4583d8563312c9d22c1fe743dfe4d4abd1755c56a2e2b566238096f","nodeId":"7e993d95-5087-4564-8d8f-c10e8410cce5","outcome":"completed","summary":"The review is complete. The findings file is in place with an empty findings list and nine coverage rows, and the working tree is unchanged apart from it.\n\n**Result: no defects found in the math, boundary or numerical-gap areas.**\n\nThe token in `src/CurbToken.sol` is a 25-line wrapper over OpenZeppelin v5.1.0 `ERC20` plus `ERC20Burnable`, with no owner, no fee logic and no arithmetic of its own beyond the supply constant. I verified the vendored OpenZeppelin files match the upstream 5.1.0 text, including the `Context` base returning plain `msg.sender`.\n\nWhat I checked against the three guides:\n\n- **Math Precision.** The contract has no division, rate multiplication, fixed-point scale, downcast or oracle input. The only arithmetic is the constant `1_000_000_000 * 10 ** 18`, which folds to exactly 1e27 and matches the README and manifest supply. The aderyn \"large numeric literal\" lead is a style lint, not a defect.\n- **Boundary.** There are no external calls, no payable functions, no sentinel-address branches, no `bytes` decoding, and no `receive` or `fallback`. ETH sent with or without calldata reverts. Zero amounts, self-transfers, `type(uint256).max` amounts, max and max-minus-one allowances, zero-address sender, spender and receiver, and burning the whole supply all behave as the ERC-20 standard requires.\n- **Numerical Gap.** The unchecked subtractions in `_update` and `_spendAllowance` are each preceded by a strict `<` revert, so sum-of-balances equals total supply and supply only decreases. A 2,000-run multi-actor fuzz over transfer, approve, transferFrom and burnFrom confirmed exact allowance and balance arithmetic. The 10/50/40 launch split of 1e27 has zero remainder and arrives whole to the wei.\n\nAll five ABI entry points are marked `holds`, plus four invariant rows covering the constructor mint, supply conservation, launch-flow exactness and decimals. The existing suite of nineteen tests and `forge fmt --check` also pass. The scratch tests I wrote under `test/scratch/` were run and then removed, so nothing outside the findings file was left in the tree.","treeHash":null,"usage":{"cachedInputTokens":710996,"inputTokens":322,"model":"claude-fable-5-1","outputTokens":11371,"runtime":"claude","turns":19,"wallClockMs":182081}},{"artifacts":[],"attempt":1,"bundleHash":"1e38708790b27e7a4d7b9899e71291dff22f3d34ff45c7f48b711b70822db490","device":"de319b702da6aa2e","findings":[],"hash":"1bb93c2591db7cd20971db3f35cbfb525e35b4776eb66b3034af87e63fd3e579","nodeId":"bc4aa81c-30a8-4e91-a094-b94d0e63eaed","outcome":"completed","summary":"I built the curb (CURB) token and committed it as `41e7e23`. `forge build`, `forge test` (19 tests, run with the verifier's fuzz seed) and `forge fmt --check` all pass with solc 0.8.26.\n\n**The token** (`src/CurbToken.sol`, `contract CurbToken`):\n- It's a standard ERC-20 built on OpenZeppelin v5.1.0. `name()` returns \"curb\", `symbol()` returns \"CURB\", and it has 18 decimals.\n- The constructor mints all 1,000,000,000 tokens once to the deployer (the launch factory). It takes no constructor arguments.\n- **How I read \"Curb\":** the brief says only \"Curb\", so I took it to mean the supply can be curbed but never grown. Holders can `burn` their own tokens, or use `burnFrom` up to an allowance the holder gave. Burning only ever lowers the total supply. If \"Curb\" meant something else, this is the part to change.\n- There's no owner, minting, pause, blacklist or transfer fee. So the transfers to the distributor and the pool, claims and trades all move exactly the amount sent, and the deployer can't touch anyone's balance.\n\n**Tests** (`test/CurbToken.t.sol`):\n- **Success cases:** name, symbol and decimals; the supply going to the deployer; transfers and approved transfers; burns; the launch transfers arriving whole.\n- **Failure cases:** sending more than the balance, sending to the zero address, spending beyond or without an allowance, and burning more than the balance.\n- **Other checks:** the deployer can't burn a holder's tokens, the common admin and mint calls don't exist, and the built code contains none of the opcodes the launch refuses.\n- **Fuzz tests:** total supply is conserved across transfers, burning only lowers it, and overspending always reverts.\n\n**Setup and docs:**\n- `foundry.toml` pins solc 0.8.26 and sets `bytecode_hash = \"none\"`.\n- forge-std v1.9.7 and OpenZeppelin are copied into `lib/` as plain files, with no submodules, so the build needs no network.\n- `README.md` covers the assumptions, deployment parameters and who is responsible for what. Its \"After launch\" section is empty because there's nothing to configure.\n- There's no deploy script and no `launch.json`, since the factory and the manifest step handle those.\n\n**Things to know:**\n- The provided protected tests import files the verifier supplies (`floor/OwnerChecks.sol`, `src/LaunchLiquidity.sol`, Uniswap v4-core), which aren't in this repo. So I couldn't run those tests here. I checked the token against what they test instead.\n- Git had no author set on this machine, so I made the commit as luigidelllebigocche with your account email. Change the author if you'd rather it be something else.\n- Passing tests isn't an audit. An independent review should still happen before release.","treeHash":"b3bfb0c8d33d9400e1c9e9b25f88ca8789c951ab","usage":{"cachedInputTokens":415206,"inputTokens":20,"model":"claude-opus-5-5","outputTokens":11351,"runtime":"claude","turns":16,"wallClockMs":124291}},{"artifacts":[],"attempt":1,"bundleHash":"d76ae21f481ba92c5b542040a104fb7deb2a37d679b15a473aaee7c121712f5d","device":"9eee291846dcb046","findings":[],"hash":"2a9308a458ee67b35a28eeab02d2959f8316a577eb590e6e7a91a386650c21e6","nodeId":"2d0c4b02-14ef-41db-9094-713cd308d848","outcome":"completed","summary":"Created `launch.json` matching `CurbToken`’s zero-argument constructor, exact supply, and required pool and economics values. Only `launch.json` changed.\n\n`forge build` succeeded. All 19 tests passed with the supplied fuzz seed. Manifest fields and constructor ABI checks passed.","treeHash":"4bf886e97d458f0a5f05a23c0e572c0528b37d67","usage":{"cachedInputTokens":120832,"inputTokens":33297,"model":"gpt-6.1-sol","outputTokens":1234,"runtime":"codex","turns":2,"wallClockMs":38406}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"87804e27e9c9f85a","findings":[],"hash":"3136a939cb4f0adf76d7daf2ef0c8710fc8656daadbcd03fa5fd850d8ffb4284","nodeId":"03362541-8b9f-4357-83e7-3d9f21b1e4bc","outcome":"completed","summary":"The review is complete and the findings file is written with an empty list and a full coverage record.\n\n**Outcome:** no defects found. The four specialists and the test writer reported nothing, and nothing I checked produced a reproducible defect.\n\n**What I verified**\n- The token in `src/CurbToken.sol` is a 24-line wrapper over OpenZeppelin ERC20 and ERC20Burnable with a zero-argument constructor that mints the whole supply to the deployer.\n- The six vendored OpenZeppelin files the token depends on are byte-identical to upstream v5.1.0, so the library behaviour is the published one.\n- The project's own 51 tests pass, including the invariant suite.\n- A scratch test I wrote and then removed deployed the token through CREATE2 from a deployer contract and confirmed the supply and deployer balance match the manifest, the swarm flow arrives whole, the deployer cannot pull or burn a holder's balance without allowance, the ten common mint and admin selectors all revert, the contract rejects ETH, and the runtime contains no DELEGATECALL, CALLCODE or SELFDESTRUCT.\n- Compiled sizes are well under the limits, and the ABI exposes only the five listed entry points plus view functions.\n- The manifest uses only schema keys, lowercase addresses, the exact supply string, an empty constructor argument list matching the constructor, and notes under the length cap.\n\n**Static analysis leads:** Slither reported nothing. Aderyn's large-numeric-literal note on line 19 is a style remark about a correct compile-time constant and is not a defect.\n\n**Coverage:** all five entry points are marked as holding, with four extra rows for the supply, no-growth, opcode and size invariants and the aderyn lead.","treeHash":null,"usage":{"cachedInputTokens":359166,"inputTokens":194,"model":"claude-fable-5-1","outputTokens":8265,"runtime":"claude","turns":19,"wallClockMs":128028}},{"artifacts":[],"attempt":1,"bundleHash":"92c83edfcf31fce8f3b77301310fea86739f093d5ebe7e5e8255071868402ba1","device":"b312209aac1edeae","findings":[],"hash":"4e4f18a0d917f65d1c23089c7357c13ad387c29105156736d76c2a05530bdcec","nodeId":"73a9d6e9-6c28-4741-ab1d-dee8c4b78be7","outcome":"completed","summary":"Added failure-path and boundary tests, seven fuzz properties, and three stateful invariants covering balances, burns, and allowances.\n\nOffline `forge build` and `forge test` pass with the required seed: **51 tests passed**, including 32,768 invariant handler calls.\n\nOnly `test/` changed. No defects found in these checks.","treeHash":"adc1d0f3e01086a866b9b6727eb7600beaf68d95","usage":{"cachedInputTokens":1003392,"inputTokens":65728,"model":"gpt-6-astra","outputTokens":18179,"runtime":"codex","turns":7,"wallClockMs":412406}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"7591760a616c6429","findings":[],"hash":"ba496c55c37518e3769e8a9f8c1022403aa057af240ddbfbf0ce603bf22c149d","nodeId":"f6a33f05-45b3-4b20-92c7-5c258e6a6fa8","outcome":"completed","summary":"The review is complete. The findings file holds an empty list and a full coverage record, and the working tree is clean apart from that file.\n\n**Result: no defects in the Economic Security, Invariant or Flow Gap areas.** The CURB token is a 24-line wrapper over OpenZeppelin v5.1.0 ERC20 plus ERC20Burnable, with no owner, no mint path after the constructor, no fees, no external calls and no callbacks.\n\nWhat I verified:\n\n- **Supply and conservation.** The constructor mints exactly 1e27 units to the deployer. A fuzz over random sequences of transfer, transferFrom, burn and burnFrom kept sum-of-balances equal to totalSupply and totalSupply at or below the initial supply on every run.\n- **Launch flow exactness.** Factory to distributor to claimants, and factory to pool to trader and back, all moved exactly the requested amounts with supply unchanged. The protected floor's swarm, seed and swap checks have nothing in this token to trip on.\n- **Privilege.** The deployer with no allowance cannot burnFrom or transferFrom a holder. Allowance semantics match OpenZeppelin exactly, including the infinite-allowance case.\n- **Boundaries.** Zero-value and self transfers succeed, whole-balance transfer and burn succeed, transfer and approve to the zero address revert, raw ETH sent to the token reverts.\n- **Dependency integrity.** All six vendored OpenZeppelin files the token inherits are byte-identical to the upstream v5.1.0 tag.\n- **ABI surface.** The compiled ABI exposes only the five listed state-changing functions, no receive, fallback or payable function.\n- **Static-analysis lead.** The aderyn large-numeric-literal note is style only. The literal evaluates to the manifest supply.\n\nTwo design points are trust assumptions rather than defects, and the README already states both. The brief says only \"Curb\", and the builder read it as holder-initiated burns, so burn and burnFrom exist. The standard ERC-20 approve race applies, and OpenZeppelin v5 ships no increaseAllowance helpers.\n\nCoverage: all five entry points are marked holds, plus five rows for the invariants and integrity checks above. Nothing was left unreached. The scratch test I used was removed since no finding needed a proof.","treeHash":null,"usage":{"cachedInputTokens":582451,"inputTokens":258,"model":"claude-fable-5-1","outputTokens":15181,"runtime":"claude","turns":26,"wallClockMs":192704}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"7f1dec5ffcbde1d8","findings":[],"hash":"ed81e4e5131eb0a8a7b5284e0e8293fec3d6b95f957e11cb9c3de9bc4a7fc971","nodeId":"b086129e-0a1d-461d-9786-aa765c9eb2f6","outcome":"completed","summary":"The review is complete and the result is clean: no defects found in CurbToken. The findings file holds an empty findings list and a coverage row for every entry point, plus the invariants and periphery I checked.\n\n**What I reviewed**\n\n- `src/CurbToken.sol` is a 24-line wrapper over OpenZeppelin 5.1.0 ERC20 and ERC20Burnable with no overrides. The constructor mints exactly one billion tokens with 18 decimals to the deployer and no other supply-increasing path exists in the compiled ABI.\n- **Execution Trace:** traced approve, transfer, transferFrom, burn and burnFrom through `_update`, `_transfer`, `_approve` and `_spendAllowance`. Every value-moving path either reverts or moves exactly the requested amount. Infinite allowances are untouched, finite ones are reduced exactly.\n- **Periphery:** read the vendored ERC20, ERC20Burnable and Context sources in full. The unchecked blocks are guarded by prior checks, and git shows the library tree unchanged from the accepted commit.\n- **First Principles:** the only assumption the token makes is that the deployer is the factory, which the launch guarantees. No receive, fallback, owner, pause, blacklist, initializer or upgrade path exists. The runtime contains no DELEGATECALL, CALLCODE or SELFDESTRUCT.\n\n**How I checked it**\n\n- The author's 19 tests pass, including fuzz runs and the opcode scan.\n- I wrote a scratch suite that replayed the protected floor's checks locally: the ten admin signatures from an attacker and the factory, the twelve privileged signatures from the factory, a factory transferFrom against a holder, the whole-arrival of the ten percent swarm share and its claim, ETH rejection and burnFrom allowance accounting. All seven passed. The scratch file was removed afterwards, and the working tree is clean apart from the findings file.\n- The aderyn large-numeric-literal lead is a style note only. The literal evaluates to 1e27, which equals the manifest supply.\n\n**Coverage record:** all five listed entry points are marked holds, with five additional rows for the supply, conservation, runtime, periphery and manifest invariants. No launch.json exists yet, so the manifest row records what it must contain when written: an empty constructorArgs list and the exact supply.","treeHash":null,"usage":{"cachedInputTokens":516153,"inputTokens":258,"model":"claude-fable-5-1","outputTokens":10019,"runtime":"claude","turns":22,"wallClockMs":136450}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"3bed38612db34f32","findings":[],"hash":"fe8416d7de723da6f90030ea1bcb2a30dcdd291f8f2199bdda0eb7bf57648516","nodeId":"868f6d4a-ece5-435e-b027-e58846f9c3db","outcome":"completed","summary":"The review is complete and the findings file is written. No defects found.\n\n**Result:** `.imd-findings.json` holds an empty findings list and ten coverage rows, all `holds`, one for each of the five listed entry points plus the constructor, the access-control surface, the trust-gap seams, the asymmetry pairs, and the aderyn lead.\n\n**What I checked, in the assigned area:**\n- **Access control.** The compiled ABI has exactly five state-changing functions, all inherited from OpenZeppelin v5.1.0, and no owner, role, initializer, upgrade path, `receive` or `fallback`. `_msgSender` is plain `msg.sender`, so no forwarder can impersonate a holder. The deployer, which is the factory under CREATE2, has no power beyond its own balance: `burnFrom` and `transferFrom` from it against a holder revert without allowance.\n- **Trust gap.** There is no privileged actor, setter, fee recipient or paired pricing formula, so no seam exists where a permitted caller can extract value or treat one caller class differently from another.\n- **Asymmetry.** `burn` and `burnFrom` are exact mirrors of the constructor mint through the same `_update`, and `burnFrom` spends allowance through the same `_spendAllowance` as `transferFrom`, including the infinite-allowance case. Storage is only OpenZeppelin's balances, allowances, supply, name and symbol, each written and read symmetrically.\n- **Launch floor.** Supply is minted once to `msg.sender` as 1e27 units with 18 decimals, matching the brief. Transfers have no fee or caller-class branch, so the distributor, pool seed, claim and swap flows move exactly what they request. The runtime has no DELEGATECALL, CALLCODE or SELFDESTRUCT.\n\n**Evidence run:** the project's 19 tests pass, and six scratch probes under `test/scratch/` mirroring the protected floor's privileged-call and supply-growth checks pass. The aderyn large-numeric-literal lead is a style note on a compile-time constant that equals the manifest supply, not a defect.\n\n**Not reached:** the protected `Token.protected.t.sol` itself cannot run here because it imports Uniswap v4-core, which is not vendored. Its token-side assertions were reproduced in the scratch probes instead. No application contracts exist, so the owners floor has nothing to check.","treeHash":null,"usage":{"cachedInputTokens":645984,"inputTokens":354,"model":"claude-fable-5-1","outputTokens":10482,"runtime":"claude","turns":19,"wallClockMs":158674}}],"verification":[{"checks":[{"durationMs":692,"exitCode":0,"name":"build","output":"Compiling 27 files with Solc 0.8.26\nSolc 0.8.26 finished in 629.76ms\nCompiler run successful!\n","passed":true},{"durationMs":81,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 19 tests for test/CurbToken.t.sol:CurbTokenTest\n[PASS] testFuzz_burnOnlyLowersSupply(uint256) (runs: 256, μ: 61885, ~: 61835)\nLogs:\n  Bound result 786324448171825911562711169\n\n[PASS] testFuzz_overspendReverts(uint256,uint256) (runs: 256, μ: 92838, ~: 92908)\nLogs:\n  Bound result 3\n  Bound result 509396733871486856784024655\n\n[PASS] testFuzz_transferConservesSupply(uint256,uint256) (runs: 256, μ: 177788, ~: 179043)\nLogs:\n  Bound result 3\n  Bound result 0\n\n[PASS] test_burnFromNeedsAllowance() (gas: 206061)\n[PASS] test_burnRevertsBeyondBalance() (gas: 85265)\n[PASS] test_constructorEmitsMintFromZero() (gas: 5794)\n[PASS] test_holderBurnsOwnTokens() (gas: 112964)\n[PASS] test_infiniteAllowanceIsNotDecreased() (gas: 115841)\n[PASS] test_launchFlowsMoveExactAmounts() (gas: 290554)\n[PASS] test_metadata() (gas: 40341)\n[PASS] test_noMintOrAdminEntryPoints() (gas: 202444)\n[PASS] test_runtimeHasNoDelegatecallOrSelfdestruct() (gas: 901061)\n[PASS] test_transferFromRevertsBeyondAllowance() (gas: 80716)\n[PASS] test_transferFromUsesAllowance() (gas: 131992)\n[PASS] test_transferFromWithoutApprovalReverts() (gas: 33393)\n[PASS] test_transferMovesExactAmount() (gas: 89171)\n[PASS] test_transferRevertsOnInsufficientBalance() (gas: 85721)\n[PASS] test_transferToZeroAddressReverts() (gas: 30796)\n[PASS] test_wholeSupplyMintedToDeployer() (gas: 31562)\nSuite result: ok. 19 passed; 0 failed; 0 skipped; finished in 7.03ms (22.46ms CPU time)\n\nRan 1 test suite in 7.74ms (7.03ms CPU time): 19 tests passed, 0 failed, 0 skipped (19 total tests)\n","passed":true},{"durationMs":29,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"CurbToken.approve(address,uint256)\",\"CurbToken.burn(uint256)\",\"CurbToken.burnFrom(address,uint256)\",\"CurbToken.transfer(address,uint256)\",\"CurbToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":3,\"README.md\":60,\"foundry.toml\":14,\"remappings.txt\":2,\"src/CurbToken.sol\":24,\"test/CurbToken.t.sol\":244},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true},{"durationMs":403,"exitCode":0,"name":"slither","output":"slither: no results at low impact or above","passed":true},{"durationMs":297,"exitCode":0,"name":"aderyn","output":"[low] large-numeric-literal at src/CurbToken.sol:19: Large Numeric Literal","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"1bb93c2591db7cd20971db3f35cbfb525e35b4776eb66b3034af87e63fd3e579","verifiedTreeHash":"b3bfb0c8d33d9400e1c9e9b25f88ca8789c951ab","verifierVersion":"0.1.0+6a374fcd"},{"checks":[{"durationMs":1689,"exitCode":0,"name":"build","output":"Compiling 27 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.44s\nCompiler run successful!\n","passed":true},{"durationMs":226,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 19 tests for test/CurbToken.t.sol:CurbTokenTest\n[PASS] testFuzz_burnOnlyLowersSupply(uint256) (runs: 256, μ: 61885, ~: 61835)\nLogs:\n  Bound result 17687\n\n[PASS] testFuzz_overspendReverts(uint256,uint256) (runs: 256, μ: 92838, ~: 92908)\nLogs:\n  Bound result 75506791488\n  Bound result 722412941418666517755012967\n\n[PASS] testFuzz_transferConservesSupply(uint256,uint256) (runs: 256, μ: 177788, ~: 179043)\nLogs:\n  Bound result 75506791488\n  Bound result 13362431365\n\n[PASS] test_burnFromNeedsAllowance() (gas: 206061)\n[PASS] test_burnRevertsBeyondBalance() (gas: 85265)\n[PASS] test_constructorEmitsMintFromZero() (gas: 5794)\n[PASS] test_holderBurnsOwnTokens() (gas: 112964)\n[PASS] test_infiniteAllowanceIsNotDecreased() (gas: 115841)\n[PASS] test_launchFlowsMoveExactAmounts() (gas: 290554)\n[PASS] test_metadata() (gas: 40341)\n[PASS] test_noMintOrAdminEntryPoints() (gas: 202444)\n[PASS] test_runtimeHasNoDelegatecallOrSelfdestruct() (gas: 901061)\n[PASS] test_transferFromRevertsBeyondAllowance() (gas: 80716)\n[PASS] test_transferFromUsesAllowance() (gas: 131992)\n[PASS] test_transferFromWithoutApprovalReverts() (gas: 33393)\n[PASS] test_transferMovesExactAmount() (gas: 89171)\n[PASS] test_transferRevertsOnInsufficientBalance() (gas: 85721)\n[PASS] test_transferToZeroAddressReverts() (gas: 30796)\n[PASS] test_wholeSupplyMintedToDeployer() (gas: 31562)\nSuite result: ok. 19 passed; 0 failed; 0 skipped; finished in 54.06ms (129.56ms CPU time)\n\nRan 1 test suite in 61.73ms (54.06ms CPU time): 19 tests passed, 0 failed, 0 skipped (19 total tests)\n","passed":true},{"durationMs":90,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"CurbToken.approve(address,uint256)\",\"CurbToken.burn(uint256)\",\"CurbToken.burnFrom(address,uint256)\",\"CurbToken.transfer(address,uint256)\",\"CurbToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":3,\"README.md\":60,\"foundry.toml\":14,\"launch.json\":24,\"remappings.txt\":2,\"src/CurbToken.sol\":24,\"test/CurbToken.t.sol\":244},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"2a9308a458ee67b35a28eeab02d2959f8316a577eb590e6e7a91a386650c21e6","verifiedTreeHash":"4bf886e97d458f0a5f05a23c0e572c0528b37d67","verifierVersion":"0.1.0+6a374fcd"},{"checks":[{"durationMs":1538,"exitCode":0,"name":"build","output":"Compiling 31 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.47s\nCompiler run successful!\n","passed":true},{"durationMs":11660,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 7 tests for test/CurbTokenProperties.t.sol:CurbTokenPropertiesTest\n[PASS] testFuzz_approvalOverwritesRatherThanAddsAndIsIsolated(uint256,uint256) (runs: 1000, μ: 269925, ~: 270449)\n[PASS] testFuzz_delegatedTransfersHandleAliasedParticipants(uint8,uint8,uint8,uint256,bool) (runs: 1000, μ: 286941, ~: 288383)\nLogs:\n  Bound result 1000000000000000000000\n\n[PASS] testFuzz_insufficientAllowancePreservesAllState(uint256,uint256,uint256) (runs: 1000, μ: 245275, ~: 246535)\nLogs:\n  Bound result 3798799365081428951834\n  Bound result 758972984701354146202\n  Bound result 3039826465037041965270\n\n[PASS] testFuzz_insufficientBalanceRollsBackDelegatedAllowance(uint256,uint256) (runs: 1000, μ: 253784, ~: 254351)\nLogs:\n  Bound result 147754875255710441\n  Bound result 16718564295332732672275579691838583955675008905359963491035\n\n[PASS] testFuzz_splitBurnEqualsSingleBurn(uint256,uint256) (runs: 1000, μ: 238981, ~: 240261)\nLogs:\n  Bound result 1\n  Bound result 1\n\n[PASS] testFuzz_transferAndBurnCannotExceedTheirSharedAllowance(uint256,uint256,uint256) (runs: 1000, μ: 339567, ~: 344323)\nLogs:\n  Bound result 638212885\n  Bound result 1813\n  Bound result 1171\n\n[PASS] testFuzz_transferRoundTripRestoresBalancesAndPreservesApproval(uint256,uint256,uint256) (runs: 1000, μ: 332703, ~: 333812)\nLogs:\n  Bound result 638212885\n  Bound result 1813\n\nSuite result: ok. 7 passed; 0 failed; 0 skipped; finished in 101.70ms (694.56ms CPU time)\n\nRan 23 tests for test/CurbTokenEdgeCases.t.sol:CurbTokenEdgeCasesTest\n[PASS] test_approvalCannotBeUsedByAnotherSpenderOrForAnotherOwner() (gas: 308631)\n[PASS] test_approvalReplacementAndRevocationEmitExactValues() (gas: 207755)\n[PASS] test_contractDeployerReceivesSupplyAndDeploymentsAreIndependent() (gas: 330257)\n[PASS] test_delegatedSelfTransferConsumesAllowanceWithoutChangingBalances() (gas: 187859)\n[PASS] test_entireSupplyCanBeBurnedOnlyOnce() (gas: 194777)\n[PASS] test_entireSupplyCanBeBurnedThroughExactApproval() (gas: 167772)\n[PASS] test_failedDelegatedCallsPreserveInfiniteAllowance() (gas: 229423)\n[PASS] test_failedDelegatedCallsRestoreFiniteAllowance() (gas: 235565)\n[PASS] test_holderBurnDoesNotConsumeApprovalAndRefillingAllowsLaterSpend() (gas: 365238)\n[PASS] test_holderNeedsSelfApprovalForDelegatedEntryPoints() (gas: 299590)\n[PASS] test_infiniteAllowanceSurvivesTransfersBurnsAndZeroAmounts() (gas: 256345)\n[PASS] test_invalidDelegatedRecipientRestoresSpentAllowance() (gas: 165828)\n[PASS] test_maximumAmountsRevertWithoutOverflowOrStateChanges() (gas: 212321)\n[PASS] test_maximumFiniteAllowanceIsSpentByBothTransferAndBurn() (gas: 211769)\n[PASS] test_oneWeiAndEntireSupplyCanRoundTrip() (gas: 264660)\n[PASS] test_revokingInfiniteApprovalStopsTransfersAndBurns() (gas: 237181)\n[PASS] test_selfTransferPreservesBalanceButStillChecksFunds() (gas: 149213)\n[PASS] test_transferAndBurnShareOneAllowanceBudget() (gas: 326482)\n[PASS] test_zeroBurnsFromEmptyHolderEmitEventsWithoutChangingSupply() (gas: 109548)\n[PASS] test_zeroRecipientRevertsEvenForZeroAmount() (gas: 82695)\n[PASS] test_zeroSourceCannotBeTransferredOrBurnedEvenForZeroAmount() (gas: 92889)\n[PASS] test_zeroSpenderCannotBeApprovedEvenForZeroAmount() (gas: 108157)\n[PASS] test_zeroTransfersFromEmptyHolderSucceedAndEmitEvents() (gas: 127063)\nSuite result: ok. 23 passed; 0 failed; 0 skipped; finished in 101.84ms (6.59ms CPU time)\n\nRan 19 tests for test/CurbToken.t.sol:CurbTokenTest\n[PASS] testFuzz_burnOnlyLowersSupply(uint256) (runs: 256, μ: 61895, ~: 61835)\nLogs:\n  Bound result 17687\n\n[PASS] testFuzz_overspendReverts(uint256,uint256) (runs: 256, μ: 92760, ~: 92908)\nLogs:\n  Bound result 658395645775505000326050518\n  Bound result 1\n\n[PASS] testFuzz_transferConservesSupply(uint256,uint256) (runs: 256, μ: 177937, ~: 179043)\nLogs:\n  Bound result 3\n  Bound result 0\n\n[PASS] test_burnFromNeedsAllowance() (gas: 206061)\n[PASS] test_burnRevertsBeyondBalance() (gas: 85265)\n[PASS] test_constructorEmitsMintFromZero() (gas: 5794)\n[PASS] test_holderBurnsOwnTokens() (gas: 112964)\n[PASS] test_infiniteAllowanceIsNotDecreased() (gas: 115841)\n[PASS] test_launchFlowsMoveExactAmounts() (gas: 290554)\n[PASS] test_metadata() (gas: 40341)\n[PASS] test_noMintOrAdminEntryPoints() (gas: 202444)\n[PASS] test_runtimeHasNoDelegatecallOrSelfdestruct() (gas: 901061)\n[PASS] test_transferFromRevertsBeyondAllowance() (gas: 80716)\n[PASS] test_transferFromUsesAllowance() (gas: 131992)\n[PASS] test_transferFromWithoutApprovalReverts() (gas: 33393)\n[PASS] test_transferMovesExactAmount() (gas: 89171)\n[PASS] test_transferRevertsOnInsufficientBalance() (gas: 85721)\n[PASS] test_transferToZeroAddressReverts() (gas: 30796)\n[PASS] test_wholeSupplyMintedToDeployer() (gas: 31562)\nSuite result: ok. 19 passed; 0 failed; 0 skipped; finished in 102.06ms (122.26ms CPU time)\n\nRan 2 tests for test/CurbTokenInvariant.t.sol:CurbTokenInvariantTest\n[PASS]\nCurbTokenInvariantTest invariants:\n[PASS] invariant_allowancesMatchAuthorizationsAndSpending\n[PASS] invariant_balancesSumToLiveSupplyAndBurnsExplainEveryMissingToken\n[PASS] invariant_eachHolderOwnsExactlyTheTokensTheyReceivedLessSpendingAndBurns\n CurbTokenInvariantTest invariants (runs: 256, calls: 32768, reverts: 0)\n\n╭------------------+-----------------------+-------+---------+----------╮\n| Contract         | Selector              | Calls | Reverts | Discards |\n+=======================================================================+\n| CurbTokenHandler | approve               | 3612  | 0       | 0        |\n|------------------+-----------------------+-------+---------+----------|\n| CurbTokenHandler | burn                  | 3687  | 0       | 0        |\n|------------------+-----------------------+-------+---------+----------|\n| CurbTokenHandler | burnFrom              | 3784  | 0       | 0        |\n|------------------+-----------------------+-------+---------+----------|\n| CurbTokenHandler | rejectOverdraw        | 3662  | 0       | 0        |\n|------------------+-----------------------+-------+---------+----------|\n| CurbTokenHandler | rejectUnapprovedSpend | 3622  | 0       | 0        |\n|------------------+-----------------------+-------+---------+----------|\n| CurbTokenHandler | rejectZeroRecipient   | 3682  | 0       | 0        |\n|------------------+-----------------------+-------+---------+----------|\n| CurbTokenHandler | revoke                | 3604  | 0       | 0        |\n|------------------+-----------------------+-------+---------+----------|\n| CurbTokenHandler | transfer              | 3579  | 0       | 0        |\n|------------------+-----------------------+-------+---------+----------|\n| CurbTokenHandler | transferFrom          | 3536  | 0       | 0        |\n╰------------------+-----------------------+-------+---------+----------╯\n\nLogs:\n  Bound result 100000000000000000000000002\n  Bound result 100000000000000000000000002\n  Bound result 100000000000000000000000002\n  Bound result 100000000000000000000000002\n  Bound result 100000000000000000000000002\n  Bound result 0\n  Bound result 599290588\n  Bound result 659918\n  Bound result 0\n  Bound result 837\n  Bound result 115792089237316195423570985008687907853269984665640364039457584007913728930619\n  Bound result 100422272951927642943664867\n  Bound result 60592133222612355286111054\n  Bound result 0\n  Bound result 220561768\n  Bound result 11000000000000000000\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 11460\n  Bound result 3533\n  Bound result 0\n  Bound result 123000000000000000000\n  Bound result 10375\n  Bound result 11530\n  Bound result 5442\n  Bound result 0\n  Bound result 2000000000000000000\n  Bound result 3000000000000000000\n  Bound result 6039621\n  Bound result 106201177435619580651085342195198429\n  Bound result 199999998000000000000003537\n  Bound result 0\n  Bound result 20924511398470\n  Bound result 0\n  Bound result 0\n  Bound result 96562989847788219033240266\n  Bound result 30\n  Bound result 40000000000000000000\n  Bound result 254\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 8904\n  Bound result 0\n  Bound result 0\n  Bound result 10\n  Bound result 0\n  Bound result 31008556069612645326\n  Bound result 0\n  Bound result 0\n  Bound result 45176852701122547274406\n  Bound result 95\n  Bound result 0\n  Bound result 1000000000000000000\n  Bound result 60000000000000000000\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 422303960483712556310190\n  Bound result 115792089237316195423570985008687907853269984665640364039459584007913135690986\n  Bound result 133\n  Bound result 10391\n  Bound result 3124842406\n  Bound result 11670\n  Bound result 0\n  Bound result 421\n  Bound result 199999968991443933890923985\n  Bound result 1000000000000000000\n  Bound result 344\n  Bound result 0\n  Bound result 136178931041081447495474272\n  Bound result 205\n  Bound result 87613459091836275537441531969277689074994145124917\n  Bound result 108407836922944004625904010\n  Bound result 999999999999999999999999998\n  Bound result 0\n  Bound result 0\n  Bound result 9213190820537462426433242\n  Bound result 62730873538606833062937776840331212234970496748876027241521478061797641337660\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 1\n  Bound result 3514649358\n  Bound result 0\n  Bound result 115792089237316195423570985008687907853269984665640429186228020083207433585416\n  Bound result 0\n  Bound result 0\n  Bound result 52932097430463380440899996\n  Bound result 49004231507304429700722964\n  Bound result 115792089237316195423570985008687907853269984665640364039459584007915971408293\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 2835717307\n  Bound result 115792089237316195423570985008687907853269984665640367943876540848463022344852\n  Bound result 0\n  Bound result 1166668\n  Bound result 1\n  Bound result 115792089237316195423570985008687907853269984665640530664719834793809662155500\n  Bound result 0\n  Bound result 0\n  Bound result 3000000000000000000\n  Bound result 115792089237316195423570985008687907853269984665640364039459584007913135698427\n\n[PASS] test_handlerExercisesSuccessfulAndRejectedActionsWithValue() (gas: 1668152)\nLogs:\n  Bound result 100000000000000000000000002\n  Bound result 100000000000000000000000002\n  Bound result 100000000000000000000000002\n  Bound result 100000000000000000000000002\n  Bound result 100000000000000000000000002\n  Bound result 100\n  Bound result 102\n  Bound result 40\n  Bound result 30\n  Bound result 10\n  Bound result 1\n  Bound result 115792089237316195423570985008687907853269984665640564039457584007913129639935\n  Bound result 1\n  Bound result 1\n\nSuite result: ok. 2 passed; 0 failed; 0 skipped; finished in 11.57s (11.57s CPU time)\n\nRan 4 test suites in 11.57s (11.88s CPU time): 51 tests passed, 0 failed, 0 skipped (51 total tests)\n","passed":true},{"durationMs":41,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"CurbToken.approve(address,uint256)\",\"CurbToken.burn(uint256)\",\"CurbToken.burnFrom(address,uint256)\",\"CurbToken.transfer(address,uint256)\",\"CurbToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":3,\"README.md\":60,\"foundry.toml\":14,\"remappings.txt\":2,\"src/CurbToken.sol\":24,\"test/CurbToken.t.sol\":244,\"test/CurbTokenEdgeCases.t.sol\":422,\"test/CurbTokenInvariant.t.sol\":110,\"test/CurbTokenProperties.t.sol\":198,\"test/handlers/CurbTokenHandler.sol\":173},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"4e4f18a0d917f65d1c23089c7357c13ad387c29105156736d76c2a05530bdcec","verifiedTreeHash":"adc1d0f3e01086a866b9b6727eb7600beaf68d95","verifierVersion":"0.1.0+6a374fcd"}]}