{"assessments":[],"deployments":[],"fuzz":[],"identity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"interpretation":"Records acceptance and evidence. Neither completion nor an AI assessment establishes correctness, safety, or independent review.","jobId":"f942e918-26f4-4993-82da-edb17a52acf1","kind":"shape:chain","nodes":[{"acceptedSubmissionHash":"00c900d8be4d8b944adce70370d9bdb26ed8b564944289b5153880d65fc8b20f","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_economics","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"58450ccd0031e3c9b7557145f5b6c8691d083b2cc54eb8a33576d1139086ff6a","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_flow","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"da95a5f2f186f903743484c7ebc2e02628355bcf1d569f1cb4877bdb25b56975","dependsOn":["build_contract_project","write_foundry_tests","manifest","audit_math","audit_permissions","audit_economics","audit_flow"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"af3aa01159bbf354f621cafa5c0006f6169e0938a8b015be508b7377dbf165bc","skillId":"audit-judge","tools":[]},"key":"audit_judge","kind":"code","role":"review","skillHash":"af3aa01159bbf354f621cafa5c0006f6169e0938a8b015be508b7377dbf165bc","skillId":"audit-judge","state":"accepted"},{"acceptedSubmissionHash":"5cf08d5d837a604aa9cfec548fb16abf27c8e735f15e5b5a20e466abba6a7b0b","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_math","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"14982d3e70ed5c103be460391de4d768488722526217399fc7bdd33a5294151e","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_permissions","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"69a3bf9cb0f11bea5d5a379ac4caddaf23a87221ccd4ec9009a5f951a3b1061f","dependsOn":[],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"816fe39c7efd64504a19175b0f4dd9186d61069f37a22684c90358a18c60bddc","skillId":"build-contract-project","tools":[]},"key":"build_contract_project","kind":"code","role":"implement","skillHash":"816fe39c7efd64504a19175b0f4dd9186d61069f37a22684c90358a18c60bddc","skillId":"build-contract-project","state":"accepted"},{"acceptedSubmissionHash":"1ca68044f97bb092020c5208cfae919630fe46b3acc3c9ef15fbb5c57a68af93","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"tools":[]},"key":"manifest","kind":"code","role":"integrate","skillHash":null,"skillId":null,"state":"accepted"},{"acceptedSubmissionHash":"e83a2614ec3479a00b48e381a7cb4005e651c5c0d548375b12fcd63c4bb81e97","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"ab3f8f2aa4e7f3b3ada558c0dcf522ba733ca3df3b1da92c707a0fe305816d5f","skillId":"write-foundry-tests","tools":[]},"key":"write_foundry_tests","kind":"code","role":"tests","skillHash":"ab3f8f2aa4e7f3b3ada558c0dcf522ba733ca3df3b1da92c707a0fe305816d5f","skillId":"write-foundry-tests","state":"accepted"}],"objective":"A custom token: Hooks Store (HOOKS).\nToken name: Hooks Store\nToken symbol: HOOKS\nToken supply: 1,000,000,000 with 18 decimals, all minted once to the deployer in the constructor.","parentJobId":null,"planHash":"e0d8d70826b1c2ca0b97c06d1e932ff0010ad1b33b21ff7b3d57dace1d6f0797","previousHash":"0000000000000000000000000000000000000000000000000000000000000000","projectId":"f942e918-26f4-4993-82da-edb17a52acf1","publication":{"commit":null,"deliveredAt":null,"repoUrl":"https://github.com/identity-md-launches/launch-2545-hooks-store"},"receiptIdentity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"registry":"0xb6d0a187b050fa5bb0b87033a203f37becf4a775","research":[],"schema":"identitymd-work-v1","signals":[{"agentId":"50995","feedbackHash":"5781de9a784009bb70202f59c9319afdcfd0237b3b521e0db73676c90ff53059","nodeKey":"audit_economics","submissionHash":"00c900d8be4d8b944adce70370d9bdb26ed8b564944289b5153880d65fc8b20f","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"50907","feedbackHash":"42eb01b78279f051cbf749555ff43c317b6890ff587e11123392c156cde73e5f","nodeKey":"audit_flow","submissionHash":"58450ccd0031e3c9b7557145f5b6c8691d083b2cc54eb8a33576d1139086ff6a","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51367","feedbackHash":"49287c60cc01817a7e1c8297a4096984b836f642472b7b10853733090f9e024b","nodeKey":"audit_judge","submissionHash":"da95a5f2f186f903743484c7ebc2e02628355bcf1d569f1cb4877bdb25b56975","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52250","feedbackHash":"b679a235165ad256a2a7b933fb1a6b41ee2f4580816405a40f4d76bb00581d9f","nodeKey":"audit_math","submissionHash":"5cf08d5d837a604aa9cfec548fb16abf27c8e735f15e5b5a20e466abba6a7b0b","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52240","feedbackHash":"75e66b14fd33b0cacdd1e0b78cef7e3095b9daf8dccd74cbb8d1f81ec8775a2c","nodeKey":"audit_permissions","submissionHash":"14982d3e70ed5c103be460391de4d768488722526217399fc7bdd33a5294151e","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52087","feedbackHash":"852dc244f2e5a0f820edcc01c8c146616c3a400415974049bfbede36d6df74d0","nodeKey":"build_contract_project","submissionHash":"69a3bf9cb0f11bea5d5a379ac4caddaf23a87221ccd4ec9009a5f951a3b1061f","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"51090","feedbackHash":"f56a802143c8857be9326768870470a448ea493911274c23731a35e35ffce169","nodeKey":"manifest","submissionHash":"1ca68044f97bb092020c5208cfae919630fe46b3acc3c9ef15fbb5c57a68af93","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"51095","feedbackHash":"e14cc22d394b3297cade1c20373aad3b364c1b3fb69129a91de95a6effe5dbd2","nodeKey":"write_foundry_tests","submissionHash":"e83a2614ec3479a00b48e381a7cb4005e651c5c0d548375b12fcd63c4bb81e97","tag1":"verification:checks","tag2":"acceptance-v2","value":1}],"site":null,"snapshotHash":"db7a85fca5fd385ac45fce70c3b05af4ca1a35a7b6c82033e1475df1322e1bd2","state":"completed","submissions":[{"artifacts":[],"attempt":1,"bundleHash":null,"device":"b5e3297a04468fd3","findings":[{"citation":"resolved","description":"THIRD_PARTY.md line 5 states 'The selected upstream files are unmodified' and line 28 tells the reader to verify with `sha256sum --check vendor-checksums.txt`. Running that command on the committed tree (git status clean) reports 7 FAILED entries, all under lib/forge-std/src: StdAssertions.sol, StdJson.sol, StdToml.sol, Vm.sol, console.sol, interfaces/IERC7540.sol, interfaces/IMulticall3.sol. I fetched each file at the upstream tag v1.9.7: the listed hashes are the correct upstream hashes, and the committed files differ from upstream only in whitespace (multi-line signatures collapsed onto one line, consistent with `forge fmt` having been run over lib/). After stripping whitespace the committed and upstream contents are byte-identical for all 7 files. All five vendored OpenZeppelin v5.1.0 files match upstream exactly, so the production dependency chain is intact. Impact: no on-chain effect (forge-std is test-only and semantically unchanged), but the repository's own stated integrity check is false as delivered, so a reviewer or the launch operator following THIRD_PARTY.md gets a hard FAILED result and cannot distinguish this benign reflow from a tampered dependency without doing the upstream comparison themselves. Fix: either restore the 7 files to their exact upstream bytes (and exclude lib/ from `forge fmt` via `ignore = [\"lib/**\"]` in [fmt] of foundry.toml, which is a config change the author must make) or regenerate vendor-checksums.txt from the committed files and reword THIRD_PARTY.md to say the files are reformatted-but-semantically-identical.","line":18,"path":"vendor-checksums.txt","reproduction":"State: the committed tree at HEAD 4b0baea (git status clean). Command: `sha256sum --check vendor-checksums.txt` from the repository root. Expected (per THIRD_PARTY.md): every line `OK`. Actual: 7 lines `FAILED` (lib/forge-std/src/{StdAssertions,StdJson,StdToml,Vm,console}.sol, lib/forge-std/src/interfaces/{IERC7540,IMulticall3}.sol) and `sha256sum: WARNING: 7 computed checksums did NOT match`. Cross-check: `curl -sL https://raw.githubusercontent.com/foundry-rs/forge-std/v1.9.7/src/Vm.sol | sha256sum` gives 9068805b...2cb1 (the listed value), while `sha256sum lib/forge-std/src/Vm.sol` gives a1b1c829...2a15; `diff` of the two shows 72 lines of pure line-wrapping changes and `tr -d ' \\t\\n'` of both hashes identically.","severity":"low","snippet":"9068805b59ac1d0ea03a8fa1f15ae49c094e0c6c852a2500e0dd112f264b2cb1  lib/forge-std/src/Vm.sol","title":"Documented dependency verification fails: vendor-checksums.txt lists upstream forge-std v1.9.7 hashes, but 7 committed forge-std files were reformatted"}],"hash":"00c900d8be4d8b944adce70370d9bdb26ed8b564944289b5153880d65fc8b20f","nodeId":"9c3aafb0-1c96-486e-beb0-db3796c8c2db","outcome":"completed","summary":"The review is complete and recorded in `.imd-findings.json`. No tracked file was changed.\n\n**Outcome: the token itself is sound in my area.** `HooksStoreToken` is a 17-line wrapper over an unmodified OpenZeppelin v5.1.0 ERC20 that mints exactly 10^27 units to `msg.sender` in the constructor and exposes nothing else. I checked it against every failure mode in the Economic Security, Invariant and Flow Gap guides and found no economic defect:\n\n- **Conservation holds permanently.** The only balance and supply writer is OpenZeppelin's `_update`. The mint branch runs once in the constructor, and the burn branch is unreachable because `_transfer` rejects a zero recipient and `_burn` is never called. The compiled ABI exposes only `approve`, `transfer` and `transferFrom` as state-changing entry points, so no actor, including the factory, can grow the supply or move a holder's balance.\n- **Launch flows arrive whole.** There is no fee, burn, hook, callback or external call, so the swarm share, claims, the single-sided seed and swaps through the PoolManager each move exactly the stated amount. There are no Flow Gap seams because the token touches no periphery.\n- **Build evidence.** `forge build`, the full suite with the documented fuzz seed (35 tests, invariants at 128 runs x 64 depth) and `forge fmt --check` all pass. The runtime bytecode has no reachable DELEGATECALL, CALLCODE or SELFDESTRUCT. Metadata hash is `none`, EVM target Cancun.\n\n**One low finding, outside my area but reproducible.** THIRD_PARTY.md says the vendored files are unmodified and tells readers to run `sha256sum --check vendor-checksums.txt`. That command fails on seven forge-std files. I fetched upstream v1.9.7: the listed hashes are the true upstream hashes, and the committed files differ only in whitespace, consistent with `forge fmt` having reformatted `lib/`. All five vendored OpenZeppelin files match upstream byte for byte, so the production dependency is intact. The fix is to restore the exact upstream bytes or regenerate the checksum list and reword the provenance claim.\n\n**Coverage.** All three ABI entry points are marked `holds`, with nine additional invariant rows. One row is `unreached`: the launch economics values (poolBps, opening cap, remainderTo, paired currency) are not in this tree because launch.json is written after acceptance, and nothing in the token depends on them. Static analysis leads were a single aderyn \"large numeric literal\" note on the supply constant; the literal equals 10^27 exactly and is not a defect.\n\nOne note for the judge rather than a finding: README line 22 asserts the intended launch chain is Ethereum mainnet. The chain is chosen by the launch policy, not the repository, and I had no network table to check the claim against.","treeHash":null,"usage":{"cachedInputTokens":717991,"inputTokens":290,"model":"claude-fable-5-1","outputTokens":16095,"runtime":"claude","turns":26,"wallClockMs":291764}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"b0001bc8a5c908cd","findings":[],"hash":"14982d3e70ed5c103be460391de4d768488722526217399fc7bdd33a5294151e","nodeId":"4005d0de-a330-41c1-9354-a95935ad3653","outcome":"completed","summary":"I found no access-control defects in the Hooks Store (HOOKS) token, so `.imd-findings.json` holds an empty findings list plus coverage rows. Nothing else in the tree changed: `git status` is clean, and the JSON file parses.\n\n**What the code is:** `src/HooksStoreToken.sol` is a plain OpenZeppelin v5.1 ERC20 with nothing added. Its constructor mints exactly 1,000,000,000 × 10^18 units to whoever deploys it, which is the factory at launch, and calls nothing else.\n\n**Access Control:** The token has no owner, roles, mint, burn, pause, blacklist, upgrade or delegatecall. Once deployment ends, nobody holds any special power.\n\n**Trust Gap:** The factory has no powers that an ordinary holder lacks. Calling `transferFrom` on someone else's tokens still needs their approval.\n\n**Asymmetry:** There are no fees, exemptions or special cases. Transfers between the factory, the distributor and the pool manager move exactly the amount stated, so the launch flows can't arrive short.\n\n**Coverage rows:**\n- `approve`: holds.\n- `transfer`: holds.\n- `transferFrom`: holds.\n- Two invariants I added: the supply can't grow and no role exists, and the vendored OpenZeppelin files are unmodified.\n\n**Checks run:**\n- `forge test`: all 35 tests passed, including the invariant suite.\n- Every OpenZeppelin file matched `vendor-checksums.txt`. Seven `forge-std` files did not match; they are used only by the tests and are not compiled into the token. I didn't report this because `lib/` is outside this review.\n- The aderyn \"large numeric literal\" warning points at the supply constant, which is correct.\n- No `launch.json` exists yet, so there was no manifest to review.\n- I did not run the protected launch checks, because they need environment settings that only the verifier supplies.","treeHash":null,"usage":{"cachedInputTokens":231424,"inputTokens":12,"model":"claude-opus-5-5","outputTokens":2400,"runtime":"claude","turns":6,"wallClockMs":44158}},{"artifacts":[],"attempt":1,"bundleHash":"d283c541e8a3baee32b86808f1ee7cbff69b985dbeaffb7c294d9f6a763e390c","device":"e02faafd8034e613","findings":[],"hash":"1ca68044f97bb092020c5208cfae919630fe46b3acc3c9ef15fbb5c57a68af93","nodeId":"b6768286-e481-4513-970f-04637c68f018","outcome":"completed","summary":"Created [launch.json](/home/imd/.identitymd/work/f942e918-26f4-4993-82da-edb17a52acf1/b6768286-e481-4513-970f-04637c68f018/launch.json) matching HooksStoreToken’s constructor, exact supply, and required pool/economics values.\n\nValidation passed: manifest checks, `forge build`, and all 35 tests with the supplied fuzz seed. Only `launch.json` was added.","treeHash":"c569a59c47b8ee65f34df695afc102cd8144a872","usage":{"cachedInputTokens":203904,"inputTokens":38585,"model":"gpt-6-astra","outputTokens":2433,"runtime":"codex","turns":3,"wallClockMs":76760}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"d5e40d018a0986f3","findings":[{"citation":"resolved","description":"THIRD_PARTY.md states that the vendored upstream files are unmodified and instructs reviewers to confirm provenance with `sha256sum --check vendor-checksums.txt`. In the delivered tree that command fails for seven forge-std files (lib/forge-std/src/StdAssertions.sol, StdJson.sol, StdToml.sol, Vm.sol, console.sol, interfaces/IERC7540.sol, interfaces/IMulticall3.sol). Diffing each against the upstream v1.9.7 tag shows the differences are whitespace only (long signatures were reflowed by a formatter); after stripping all whitespace the files are byte-identical to upstream. No production code is affected: src/HooksStoreToken.sol only imports OpenZeppelin, and all five vendored OpenZeppelin v5.1.0 files were diffed against the upstream tag and are identical. The impact is limited to the project's own provenance claim: the documented verification step reports a failure, so a reviewer following THIRD_PARTY.md cannot distinguish this benign reflow from a real modification of the test library. Fix: either restore the upstream bytes for those seven files (and exclude lib/ from `forge fmt`) or regenerate vendor-checksums.txt from the files actually shipped and drop the 'unmodified' claim.","line":28,"path":"THIRD_PARTY.md","reproduction":"State: the committed tree at HEAD (git status clean). Run `sha256sum --check vendor-checksums.txt` from the repository root. Expected (per THIRD_PARTY.md): every line reports OK. Actual: 'sha256sum: WARNING: 7 computed checksums did NOT match', with FAILED reported for lib/forge-std/src/StdAssertions.sol, StdJson.sol, StdToml.sol, Vm.sol, console.sol, interfaces/IERC7540.sol and interfaces/IMulticall3.sol. `diff -w` against the upstream v1.9.7 files shows only line-wrapping changes.","severity":"low","snippet":"sha256sum --check vendor-checksums.txt","title":"Vendored forge-std files do not match the checksums the project tells reviewers to verify"}],"hash":"58450ccd0031e3c9b7557145f5b6c8691d083b2cc54eb8a33576d1139086ff6a","nodeId":"9e674e50-efaa-4bff-a917-03b4c754df75","outcome":"completed","summary":"The review is complete and the findings file is written and valid.\n\n**Outcome:** the HOOKS token holds under the Execution Trace, Periphery and First Principles guides. I found one low-severity provenance defect and no defect in the token's code.\n\n**What I checked**\n\n- **Execution trace:** `approve`, `transfer` and `transferFrom` traced through the vendored OpenZeppelin ERC20 into `_update`. Every revert path rolls back both allowance and balance changes, amounts move exactly, and the only sentinel path is the documented infinite allowance.\n- **Periphery:** all five vendored OpenZeppelin v5.1.0 files were diffed byte-for-byte against the upstream tag and are identical. The forge-std files are the subject of the finding.\n- **First principles:** the constructor takes no arguments and mints exactly 10^27 to the immediate creator, which is the factory under CREATE and CREATE2. There are no roles, no fallback or receive, and no mint or burn reachable after construction.\n- **Protected floor replayed locally:** a scratch test re-ran the reachable-opcode scan for DELEGATECALL, CALLCODE and SELFDESTRUCT, tried 22 privileged selectors from the deployer, and replayed the factory, distributor and pool-manager flows. All pass. The project's own suite of 35 tests and the format check also pass.\n\n**Finding (low):** `THIRD_PARTY.md` tells reviewers to run the checksum verification and claims the vendored files are unmodified, but that command fails for seven forge-std files. The differences are whitespace reflow only, and forge-std is test-only, so there is no production impact. The fix is to restore the upstream bytes or regenerate the checksums.\n\n**Coverage record:** all three ABI entry points are marked `holds`, plus rows for the constructor, the fixed-supply and no-privileged-call invariants, the opcode invariant, and the two vendored dependency sets.\n\n**Not reported:** the README states an intended launch chain of Ethereum mainnet. The chain is chosen by the launch policy, not the code, and no failing input follows from the statement, so it is a note only.","treeHash":null,"usage":{"cachedInputTokens":919001,"inputTokens":322,"model":"claude-fable-5-1","outputTokens":14043,"runtime":"claude","turns":29,"wallClockMs":203771}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"fc87c05048aca47d","findings":[{"citation":"resolved","description":"THIRD_PARTY.md (line 5) states the vendored upstream files are unmodified and (line 28) tells the operator to verify them with `sha256sum --check vendor-checksums.txt`; the README repeats that this check works offline. On the delivered tree the command exits 1 with 7 FAILED entries: lib/forge-std/src/StdAssertions.sol, StdJson.sol, StdToml.sol, Vm.sol, console.sol, interfaces/IERC7540.sol and interfaces/IMulticall3.sol. The hashes recorded in vendor-checksums.txt are the correct upstream forge-std v1.9.7 hashes (I fetched the seven upstream files and they hash to exactly the recorded values), so it is the committed copies under lib/ that were altered after vendoring. The alterations are line-wrapping/whitespace only (forge-fmt style reflow, e.g. Vm.sol is 125019 bytes vs 125243 upstream, diff shows only re-wrapped signatures); no semantic change, and forge-std is test-only. The production dependency lib/openzeppelin-contracts/contracts/token/ERC20/ERC20.sol matches both the recorded checksum and upstream v5.1.0 byte for byte, so the deployed bytecode is not affected. Impact: the project's own provenance claim is false and the only documented integrity gate fails, so a release reviewer following the README cannot distinguish this benign reflow from a real tampering of the test harness. This is outside the assigned math area and is reported for completeness at low severity. Fix: either restore the seven files to their upstream bytes (so the checksum file and the 'unmodified' claim hold) or regenerate vendor-checksums.txt from the delivered files and drop the 'unmodified' wording; do not change foundry.toml.","line":18,"path":"vendor-checksums.txt","reproduction":"From the repository root run: `sha256sum --check vendor-checksums.txt`. Expected (per THIRD_PARTY.md line 28 and README 'Build and test'): every line OK, exit 0. Actual: 7 lines report FAILED (StdAssertions.sol, StdJson.sol, StdToml.sol, Vm.sol, console.sol, interfaces/IERC7540.sol, interfaces/IMulticall3.sol), 'WARNING: 7 computed checksums did NOT match', exit status 1. Cross-check: `curl -sL https://raw.githubusercontent.com/foundry-rs/forge-std/v1.9.7/src/Vm.sol | sha256sum` prints 9068805b...2cb1, equal to vendor-checksums.txt line 18, while `sha256sum lib/forge-std/src/Vm.sol` differs; `diff` of the two shows only re-wrapped function signatures.","severity":"low","snippet":"9068805b59ac1d0ea03a8fa1f15ae49c094e0c6c852a2500e0dd112f264b2cb1  lib/forge-std/src/Vm.sol","title":"Documented dependency integrity check fails: 7 vendored forge-std files do not match vendor-checksums.txt"}],"hash":"5cf08d5d837a604aa9cfec548fb16abf27c8e735f15e5b5a20e466abba6a7b0b","nodeId":"a1b52444-29e1-4d47-a4b3-61fa2e47c1c4","outcome":"completed","summary":"The review is complete and the findings file is written and validated.\n\n**Outcome.** The HOOKS token is clean in the assigned area. It is an unmodified OpenZeppelin v5.1.0 ERC20 with one constant mint of 10^27 units in the constructor, no division, no scaling, no external calls, no payable path and no privileged surface. I found one low-severity defect outside my area and no math, boundary or numerical-gap defect.\n\n**What I checked, per guide:**\n- Math Precision: the supply literal evaluates to exactly 10^27 and agrees with the 18 decimals returned. All OpenZeppelin unchecked blocks sit behind a checked guard, and the supply bound makes the unchecked additions safe.\n- Boundary: zero, exact, one-over and max-uint values for balance and allowance behave as the ERC-20 contract promises. Infinite allowance is a sentinel only at exactly max; max minus one decrements normally. ETH sends revert. Zero-address paths revert on both sides.\n- Numerical Gap: the 10/80/10 launch split of the supply leaves no dust, and the swarm's 2% plus 8% equals the 10% share exactly. Supply conservation holds under the existing invariant campaign and my own scratch fuzz run.\n\n**The one finding, low severity.** The README and THIRD_PARTY.md tell the operator to verify vendored dependencies with the checksum file and claim the files are unmodified. Running that check on the delivered tree fails for seven forge-std files. I fetched upstream forge-std v1.9.7 and confirmed the recorded hashes are correct, so the committed copies are what changed. The differences are whitespace reflow only, forge-std is test-only, and the production OpenZeppelin ERC20 matches upstream byte for byte, so deployed bytecode is unaffected. The fix is to restore the seven files or regenerate the checksum file.\n\n**Coverage.** All three ABI entry points are marked `holds` with reasons, plus six invariant rows. Scratch tests live under test/scratch/ and are not kept. No repository file was modified beyond the findings file.","treeHash":null,"usage":{"cachedInputTokens":645911,"inputTokens":258,"model":"claude-fable-5-1","outputTokens":14373,"runtime":"claude","turns":21,"wallClockMs":235169}},{"artifacts":[],"attempt":1,"bundleHash":"0e9e803b7099b3b00f06df750b8ca1e5ee6fa46b05bc649f7e470f6ce2c55c34","device":"553a378efc6a19cb","findings":[],"hash":"69a3bf9cb0f11bea5d5a379ac4caddaf23a87221ccd4ec9009a5f951a3b1061f","nodeId":"e21a542e-82d0-4f13-824e-62af48cb6358","outcome":"completed","summary":"Implemented `HooksStoreToken`: 1 billion HOOKS, 18 decimals, minted once to the deployer. Includes vendored dependencies, deployment documentation, and success, failure, fuzz, and invariant tests.\n\nAll checks passed:\n\n- `forge build`, including a clean offline build\n- `forge test`: 35 passed using the supplied fuzz seed\n- `forge fmt --check`","treeHash":"775c52851e99dfb1e1ec749479d89255b25ff933","usage":{"cachedInputTokens":625280,"inputTokens":47221,"model":"gpt-6-astra","outputTokens":18209,"runtime":"codex","turns":5,"wallClockMs":565590}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"ddfb1efa72fe9a94","findings":[{"citation":"resolved","description":"Merged from the audit_flow, audit_math and audit_economics reports, which all describe the same root cause. THIRD_PARTY.md states the vendored upstream files are unmodified and tells the reader to verify them with `sha256sum --check vendor-checksums.txt`; the README repeats that this check works offline. On the committed tree (HEAD ba7d8ab, git status clean) the command reports FAILED for seven forge-std files: lib/forge-std/src/StdAssertions.sol, StdJson.sol, StdToml.sol, Vm.sol, console.sol, interfaces/IERC7540.sol and interfaces/IMulticall3.sol. I reproduced this and cross-checked: the hash recorded on vendor-checksums.txt line 18 for Vm.sol (9068805b...2cb1) equals the SHA-256 of the upstream v1.9.7 file fetched from raw.githubusercontent.com, so the checksum file is correct and it is the committed copies under lib/ that changed; after stripping all whitespace the committed Vm.sol and the upstream file are identical, so the change is a formatter reflow (`forge fmt --check` passes on the tree, consistent with `forge fmt` having been run over lib/). Every production dependency is intact: all five vendored OpenZeppelin v5.1.0 files (ERC20.sol, IERC20.sol, IERC20Metadata.sol, Context.sol, draft-IERC6093.sol) pass the checksum and hash identically to the upstream v5.1.0 tag, and src/HooksStoreToken.sol imports only OpenZeppelin. forge-std is test-only, so the deployed bytecode is unaffected and there is no on-chain impact. Impact is to the project's own provenance guarantee: the one documented integrity gate fails as delivered, so a reviewer or launch operator following THIRD_PARTY.md gets a hard failure and cannot distinguish this benign reflow from real tampering of the test harness without redoing the upstream comparison. Fix (author's choice): restore the seven files to their exact upstream v1.9.7 bytes so the recorded checksums and the 'unmodified' claim hold (and keep lib/ out of future `forge fmt` runs), or regenerate vendor-checksums.txt from the delivered files and reword THIRD_PARTY.md to say the forge-std files are reformatted but semantically identical. Do not change foundry.toml in this task.","line":5,"path":"THIRD_PARTY.md","reproduction":"State: the committed tree at HEAD ba7d8ab, `git status` clean. Command, from the repository root: `sha256sum --check vendor-checksums.txt`. Expected (THIRD_PARTY.md line 5 and line 28, README 'Build and test'): every line prints OK. Actual: lib/forge-std/src/StdAssertions.sol: FAILED, lib/forge-std/src/StdJson.sol: FAILED, lib/forge-std/src/StdToml.sol: FAILED, lib/forge-std/src/Vm.sol: FAILED, lib/forge-std/src/console.sol: FAILED, lib/forge-std/src/interfaces/IERC7540.sol: FAILED, lib/forge-std/src/interfaces/IMulticall3.sol: FAILED, then 'sha256sum: WARNING: 7 computed checksums did NOT match'. All lib/openzeppelin-contracts entries print OK. Cross-check: `curl -sL https://raw.githubusercontent.com/foundry-rs/forge-std/v1.9.7/src/Vm.sol | sha256sum` prints 9068805b59ac1d0ea03a8fa1f15ae49c094e0c6c852a2500e0dd112f264b2cb1, the value on vendor-checksums.txt line 18, while `sha256sum lib/forge-std/src/Vm.sol` differs; `diff <(tr -d ' \\t\\n' < upstream/Vm.sol) <(tr -d ' \\t\\n' < lib/forge-std/src/Vm.sol)` is empty, so the difference is whitespace only.","severity":"low","snippet":"upstream files are unmodified. Only the listed subsets are included.","title":"Documented dependency integrity check fails: 7 vendored forge-std files were reformatted after vendoring and no longer match vendor-checksums.txt or the 'unmodified' claim"}],"hash":"da95a5f2f186f903743484c7ebc2e02628355bcf1d569f1cb4877bdb25b56975","nodeId":"dbef8ef0-5f3a-4506-8035-846337a4b4a8","outcome":"completed","summary":"The review is complete and `.imd-findings.json` is written. The tree is otherwise untouched.\n\n**Outcome.** The token is a plain, unmodified OpenZeppelin v5.1.0 ERC-20 with a zero-argument constructor that mints 10^27 units to the factory. I found no defect in the production code. One low-severity finding is kept, merged from the three specialists who reported it.\n\n**Finding 1, low.** The vendored forge-std files do not match the project's own provenance claim. THIRD_PARTY.md says the upstream files are unmodified and tells readers to run the checksum file. On the committed tree that command fails for seven forge-std files. I confirmed the recorded hashes are the correct upstream v1.9.7 values and that the committed copies differ from upstream only in whitespace, so this is a formatter reflow with no on-chain effect. All five OpenZeppelin files the token actually compiles against match both the checksum file and the upstream v5.1.0 tag byte for byte.\n\n**Dropped or not raised.**\n- The write_foundry_tests and audit_permissions specialists reported nothing, and nothing in my own pass contradicts that.\n- The aderyn large-literal lead is the readable underscore spelling of 10^27 and not a defect.\n- My first opcode scan flagged bytes in the runtime, but the disassembly shows they are PUSH2 immediates. There is no DELEGATECALL, CALLCODE or SELFDESTRUCT.\n\n**Coverage.** All three entry points, approve, transfer and transferFrom, are marked holds, with reasons traced through the vendored ERC20 code. Additional rows record the supply invariant, deployability under CREATE2 with empty constructor arguments and small bytecode, the opcode check, dependency provenance, and the passing build and test run.","treeHash":null,"usage":{"cachedInputTokens":499084,"inputTokens":258,"model":"claude-fable-5-1","outputTokens":11118,"runtime":"claude","turns":16,"wallClockMs":239715}},{"artifacts":[],"attempt":1,"bundleHash":"5205271d0c64537665431a09b2c4345e53cc18be32dca8c62222d4ff42aea445","device":"aeca54a62e4f602e","findings":[],"hash":"e83a2614ec3479a00b48e381a7cb4005e651c5c0d548375b12fcd63c4bb81e97","nodeId":"860c2c74-a726-4794-83a4-c44cd744e5f4","outcome":"completed","summary":"Added failure-path, boundary, and fuzz tests; strengthened stateful invariants across 32,768 randomized calls.\n\n`forge build` and `forge test` pass with the required seed: **49 passed, 0 failed**.\n\nOnly `test/` changed. No confirmed defects found.","treeHash":"9e3abeca85145870bfcdd47746d9b9239d2e56cb","usage":{"cachedInputTokens":606848,"inputTokens":61898,"model":"gpt-6-astra","outputTokens":10039,"runtime":"codex","turns":5,"wallClockMs":292453}}],"verification":[{"checks":[{"durationMs":1128,"exitCode":0,"name":"build","output":"Compiling 30 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.06s\nCompiler run successful!\n","passed":true},{"durationMs":2177,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 1 test for test/LaunchTransfers.t.sol:LaunchTransfersTest\n[PASS] test_factoryDistributionClaimsAndPoolTransfersArriveWhole() (gas: 612192)\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 763.99µs (609.32µs CPU time)\n\nRan 33 tests for test/HooksStoreToken.t.sol:HooksStoreTokenTest\n[PASS] testFuzz_create2MintsEntireSupplyToFactory(bytes32) (runs: 512, μ: 263905, ~: 264012)\n[PASS] testFuzz_transferAboveBalanceReverts(uint256,uint256) (runs: 512, μ: 127232, ~: 127490)\nLogs:\n  Bound result 128422311864425425109478889\n  Bound result 2\n\n[PASS] testFuzz_transferConservesSupply(address,uint256) (runs: 512, μ: 92854, ~: 93127)\nLogs:\n  Bound result 491669594030430660370028175\n\n[PASS] testFuzz_transferFromHonorsAllowance(uint256,uint256) (runs: 512, μ: 161180, ~: 164004)\nLogs:\n  Bound result 2\n\n[PASS] testFuzz_transferToZeroReverts(uint256) (runs: 512, μ: 51315, ~: 51038)\nLogs:\n  Bound result 255\n\n[PASS] testFuzz_unapprovedCallerCannotUseAnotherSpendersAllowance(address,uint256) (runs: 512, μ: 127215, ~: 126934)\nLogs:\n  Bound result 17\n\n[PASS] test_allowancesAreIndependentForEachOwnerAndSpender() (gas: 205546)\n[PASS] test_approvalReplacesRatherThanAddsToAllowance() (gas: 93502)\n[PASS] test_approveEmitsEventAndDoesNotMoveBalances() (gas: 88756)\n[PASS] test_approveZeroSpenderReverts() (gas: 37662)\n[PASS] test_constructorEmitsExactlyOneMintEvent() (gas: 9652)\n[PASS] test_deployerCannotSpendHolderBalanceWithoutApproval() (gas: 160587)\n[PASS] test_factoryGetsEntireSupplyInsteadOfTransactionOrigin() (gas: 276771)\n[PASS] test_metadataAndInitialSupply() (gas: 107693)\n[PASS] test_nativeCurrencyIsRejected() (gas: 42619)\n[PASS] test_noMintBurnAdminOrUpgradeEntryPoints() (gas: 1035280)\n[PASS] test_revokeAllowancePreventsFurtherSpending() (gas: 133380)\n[PASS] test_selfTransferPreservesBalance() (gas: 51410)\n[PASS] test_transferEntireBalance() (gas: 75743)\n[PASS] test_transferFromByHolderAlsoRequiresAllowance() (gas: 144141)\n[PASS] test_transferFromExhaustedAllowanceCannotBeReused() (gas: 162247)\n[PASS] test_transferFromInfiniteAllowanceRemainsUntilRevoked() (gas: 217807)\n[PASS] test_transferFromInsufficientAllowanceReverts() (gas: 116174)\n[PASS] test_transferFromInsufficientBalanceRestoresAllowance() (gas: 136839)\n[PASS] test_transferFromMovesExactAmountAndDecrementsAllowance() (gas: 175053)\n[PASS] test_transferFromSelfStillConsumesAllowance() (gas: 110140)\n[PASS] test_transferFromZeroAmountNeedsNoApproval() (gas: 81446)\n[PASS] test_transferFromZeroOwnerRevertsEvenForZeroAmount() (gas: 44747)\n[PASS] test_transferFromZeroRecipientRestoresAllowance() (gas: 114743)\n[PASS] test_transferInsufficientBalanceRevertsWithoutChanges() (gas: 120466)\n[PASS] test_transferMaximumUintRevertsWithoutOverflow() (gas: 54977)\n[PASS] test_transferMovesExactAmountAndEmitsEvent() (gas: 93528)\n[PASS] test_zeroTransferFromEmptyAccountEmitsEvent() (gas: 73378)\nSuite result: ok. 33 passed; 0 failed; 0 skipped; finished in 25.45ms (127.35ms CPU time)\n\nRan 1 test for test/HooksStoreToken.invariant.t.sol:HooksStoreTokenInvariantTest\n[PASS]\nHooksStoreTokenInvariantTest invariants:\n[PASS] invariant_balancesAndAllowancesMatchIndependentLedger\n[PASS] invariant_supplyIsFixedAndAllTokensAreAccountedFor\n HooksStoreTokenInvariantTest invariants (runs: 128, calls: 8192, reverts: 0)\n\n╭--------------+--------------+-------+---------+----------╮\n| Contract     | Selector     | Calls | Reverts | Discards |\n+==========================================================+\n| TokenHandler | approve      | 2781  | 0       | 0        |\n|--------------+--------------+-------+---------+----------|\n| TokenHandler | transfer     | 2685  | 0       | 0        |\n|--------------+--------------+-------+---------+----------|\n| TokenHandler | transferFrom | 2726  | 0       | 0        |\n╰--------------+--------------+-------+---------+----------╯\n\nLogs:\n  Bound result 1\n  Bound result 1\n  Bound result 0\n  Bound result 15\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 16\n  Bound result 0\n  Bound result 255\n  Bound result 0\n  Bound result 1\n  Bound result 0\n  Bound result 9\n  Bound result 0\n  Bound result 1224\n  Bound result 0\n  Bound result 1\n  Bound result 1\n  Bound result 356\n  Bound result 4466\n  Bound result 588\n  Bound result 16\n  Bound result 2\n  Bound result 262\n  Bound result 2\n  Bound result 22\n  Bound result 3147\n  Bound result 3\n  Bound result 0\n  Bound result 1\n  Bound result 3\n  Bound result 3\n  Bound result 1\n  Bound result 5460\n  Bound result 0\n  Bound result 1\n  Bound result 1\n  Bound result 735\n  Bound result 623\n  Bound result 0\n  Bound result 2514000704\n  Bound result 118\n  Bound result 17381483906994476776795310\n  Bound result 6\n  Bound result 125\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 2.09s (2.09s CPU time)\n\nRan 3 test suites in 2.09s (2.12s CPU time): 35 tests passed, 0 failed, 0 skipped (35 total tests)\n","passed":true},{"durationMs":42,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"HooksStoreToken.approve(address,uint256)\",\"HooksStoreToken.transfer(address,uint256)\",\"HooksStoreToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"LICENSE\":21,\"README.md\":138,\"THIRD_PARTY.md\":29,\"foundry.toml\":18,\"launch.json\":24,\"remappings.txt\":2,\"src/HooksStoreToken.sol\":17,\"test/HooksStoreToken.invariant.t.sol\":53,\"test/HooksStoreToken.t.sol\":410,\"test/LaunchTransfers.t.sol\":45,\"test/helpers/TokenFactory.sol\":15,\"test/helpers/TokenHandler.sol\":77,\"vendor-checksums.txt\":36},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"1ca68044f97bb092020c5208cfae919630fe46b3acc3c9ef15fbb5c57a68af93","verifiedTreeHash":"c569a59c47b8ee65f34df695afc102cd8144a872","verifierVersion":"0.1.0+ad64f8c4"},{"checks":[{"durationMs":1803,"exitCode":0,"name":"build","output":"Compiling 30 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.69s\nCompiler run successful!\n","passed":true},{"durationMs":2554,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 1 test for test/LaunchTransfers.t.sol:LaunchTransfersTest\n[PASS] test_factoryDistributionClaimsAndPoolTransfersArriveWhole() (gas: 612192)\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 974.59µs (770.09µs CPU time)\n\nRan 33 tests for test/HooksStoreToken.t.sol:HooksStoreTokenTest\n[PASS] testFuzz_create2MintsEntireSupplyToFactory(bytes32) (runs: 512, μ: 263905, ~: 264012)\n[PASS] testFuzz_transferAboveBalanceReverts(uint256,uint256) (runs: 512, μ: 127232, ~: 127490)\nLogs:\n  Bound result 27835\n  Bound result 19572\n\n[PASS] testFuzz_transferConservesSupply(address,uint256) (runs: 512, μ: 92854, ~: 93127)\nLogs:\n  Bound result 14261215264361730156728973\n\n[PASS] testFuzz_transferFromHonorsAllowance(uint256,uint256) (runs: 512, μ: 161180, ~: 164004)\nLogs:\n  Bound result 19572\n\n[PASS] testFuzz_transferToZeroReverts(uint256) (runs: 512, μ: 51315, ~: 51038)\nLogs:\n  Bound result 14\n\n[PASS] testFuzz_unapprovedCallerCannotUseAnotherSpendersAllowance(address,uint256) (runs: 512, μ: 127215, ~: 126934)\nLogs:\n  Bound result 499052195172744673943164779\n\n[PASS] test_allowancesAreIndependentForEachOwnerAndSpender() (gas: 205546)\n[PASS] test_approvalReplacesRatherThanAddsToAllowance() (gas: 93502)\n[PASS] test_approveEmitsEventAndDoesNotMoveBalances() (gas: 88756)\n[PASS] test_approveZeroSpenderReverts() (gas: 37662)\n[PASS] test_constructorEmitsExactlyOneMintEvent() (gas: 9652)\n[PASS] test_deployerCannotSpendHolderBalanceWithoutApproval() (gas: 160587)\n[PASS] test_factoryGetsEntireSupplyInsteadOfTransactionOrigin() (gas: 276771)\n[PASS] test_metadataAndInitialSupply() (gas: 107693)\n[PASS] test_nativeCurrencyIsRejected() (gas: 42619)\n[PASS] test_noMintBurnAdminOrUpgradeEntryPoints() (gas: 1035280)\n[PASS] test_revokeAllowancePreventsFurtherSpending() (gas: 133380)\n[PASS] test_selfTransferPreservesBalance() (gas: 51410)\n[PASS] test_transferEntireBalance() (gas: 75743)\n[PASS] test_transferFromByHolderAlsoRequiresAllowance() (gas: 144141)\n[PASS] test_transferFromExhaustedAllowanceCannotBeReused() (gas: 162247)\n[PASS] test_transferFromInfiniteAllowanceRemainsUntilRevoked() (gas: 217807)\n[PASS] test_transferFromInsufficientAllowanceReverts() (gas: 116174)\n[PASS] test_transferFromInsufficientBalanceRestoresAllowance() (gas: 136839)\n[PASS] test_transferFromMovesExactAmountAndDecrementsAllowance() (gas: 175053)\n[PASS] test_transferFromSelfStillConsumesAllowance() (gas: 110140)\n[PASS] test_transferFromZeroAmountNeedsNoApproval() (gas: 81446)\n[PASS] test_transferFromZeroOwnerRevertsEvenForZeroAmount() (gas: 44747)\n[PASS] test_transferFromZeroRecipientRestoresAllowance() (gas: 114743)\n[PASS] test_transferInsufficientBalanceRevertsWithoutChanges() (gas: 120466)\n[PASS] test_transferMaximumUintRevertsWithoutOverflow() (gas: 54977)\n[PASS] test_transferMovesExactAmountAndEmitsEvent() (gas: 93528)\n[PASS] test_zeroTransferFromEmptyAccountEmitsEvent() (gas: 73378)\nSuite result: ok. 33 passed; 0 failed; 0 skipped; finished in 36.09ms (206.07ms CPU time)\n\nRan 1 test for test/HooksStoreToken.invariant.t.sol:HooksStoreTokenInvariantTest\n[PASS]\nHooksStoreTokenInvariantTest invariants:\n[PASS] invariant_balancesAndAllowancesMatchIndependentLedger\n[PASS] invariant_supplyIsFixedAndAllTokensAreAccountedFor\n HooksStoreTokenInvariantTest invariants (runs: 128, calls: 8192, reverts: 0)\n\n╭--------------+--------------+-------+---------+----------╮\n| Contract     | Selector     | Calls | Reverts | Discards |\n+==========================================================+\n| TokenHandler | approve      | 2781  | 0       | 0        |\n|--------------+--------------+-------+---------+----------|\n| TokenHandler | transfer     | 2685  | 0       | 0        |\n|--------------+--------------+-------+---------+----------|\n| TokenHandler | transferFrom | 2726  | 0       | 0        |\n╰--------------+--------------+-------+---------+----------╯\n\nLogs:\n  Bound result 1\n  Bound result 1\n  Bound result 0\n  Bound result 15\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 16\n  Bound result 0\n  Bound result 255\n  Bound result 0\n  Bound result 1\n  Bound result 0\n  Bound result 9\n  Bound result 0\n  Bound result 1224\n  Bound result 0\n  Bound result 1\n  Bound result 1\n  Bound result 356\n  Bound result 4466\n  Bound result 588\n  Bound result 16\n  Bound result 2\n  Bound result 262\n  Bound result 2\n  Bound result 22\n  Bound result 3147\n  Bound result 3\n  Bound result 0\n  Bound result 1\n  Bound result 3\n  Bound result 3\n  Bound result 1\n  Bound result 5460\n  Bound result 0\n  Bound result 1\n  Bound result 1\n  Bound result 735\n  Bound result 623\n  Bound result 0\n  Bound result 2514000704\n  Bound result 118\n  Bound result 17381483906994476776795310\n  Bound result 6\n  Bound result 125\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 2.42s (2.41s CPU time)\n\nRan 3 test suites in 2.42s (2.45s CPU time): 35 tests passed, 0 failed, 0 skipped (35 total tests)\n","passed":true},{"durationMs":65,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"HooksStoreToken.approve(address,uint256)\",\"HooksStoreToken.transfer(address,uint256)\",\"HooksStoreToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"LICENSE\":21,\"README.md\":138,\"THIRD_PARTY.md\":29,\"foundry.toml\":18,\"remappings.txt\":2,\"src/HooksStoreToken.sol\":17,\"test/HooksStoreToken.invariant.t.sol\":53,\"test/HooksStoreToken.t.sol\":410,\"test/LaunchTransfers.t.sol\":45,\"test/helpers/TokenFactory.sol\":15,\"test/helpers/TokenHandler.sol\":77,\"vendor-checksums.txt\":36},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true},{"durationMs":1263,"exitCode":0,"name":"slither","output":"slither: no results at low impact or above","passed":true},{"durationMs":775,"exitCode":0,"name":"aderyn","output":"[low] large-numeric-literal at src/HooksStoreToken.sol:12: Large Numeric Literal","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"69a3bf9cb0f11bea5d5a379ac4caddaf23a87221ccd4ec9009a5f951a3b1061f","verifiedTreeHash":"775c52851e99dfb1e1ec749479d89255b25ff933","verifierVersion":"0.1.0+ad64f8c4"},{"checks":[{"durationMs":2319,"exitCode":0,"name":"build","output":"Compiling 31 files with Solc 0.8.26\nSolc 0.8.26 finished in 2.21s\nCompiler run successful!\n","passed":true},{"durationMs":9390,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 1 test for test/LaunchTransfers.t.sol:LaunchTransfersTest\n[PASS] test_factoryDistributionClaimsAndPoolTransfersArriveWhole() (gas: 612192)\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 1.22ms (980.99µs CPU time)\n\nRan 13 tests for test/HooksStoreToken.edges.t.sol:HooksStoreTokenEdgesTest\n[PASS] testFuzz_failedSpendCanBeRetriedAfterFunding(uint256,uint256,uint256) (runs: 1000, μ: 354116, ~: 354996)\nLogs:\n  Bound result 778116112060858170240630305\n  Bound result 955287220958304538479094162\n  Bound result 43044070831920228228899184870723709710215404233\n\n[PASS] testFuzz_finiteBudgetCannotBeOverspent(uint256,uint256) (runs: 1000, μ: 391002, ~: 392813)\nLogs:\n  Bound result 999999999999999999999999997\n  Bound result 658637544398006394316592604\n\n[PASS] testFuzz_invalidRecipientDoesNotConsumeApproval(uint256,uint256) (runs: 1000, μ: 229004, ~: 230109)\nLogs:\n  Bound result 977545306304\n  Bound result 115792089237316195423570985008687907853269984665640564039457584006935712031898\n\n[PASS] testFuzz_roundTripRestoresBothPreexistingBalances(uint256,uint256) (runs: 1000, μ: 257565, ~: 258410)\nLogs:\n  Bound result 977545306304\n  Bound result 127698266\n\n[PASS] testFuzz_splitDelegatedSpendMatchesSingleSpend(uint256,uint256,uint256) (runs: 1000, μ: 383275, ~: 384643)\nLogs:\n  Bound result 6000000000000000000\n  Bound result 7\n  Bound result 115792089237316195423570985008687907853269984665640564039451584007913129657426\n\n[PASS] test_infiniteApprovalCanBeReplacedWithFiniteAndRevokedAfterSpend() (gas: 340250)\n[PASS] test_maximumFiniteAllowanceIsConsumed() (gas: 153494)\n[PASS] test_maximumSpendWithInfiniteApprovalStillRequiresBalance() (gas: 129270)\n[PASS] test_oneWeiCanMoveAndBeSpentExactlyOnce() (gas: 323680)\n[PASS] test_selfTransferCannotBypassBalanceCheck() (gas: 227709)\n[PASS] test_zeroCallerCannotTransferOrApproveEvenZero() (gas: 100703)\n[PASS] test_zeroValueDoesNotMakeZeroRecipientValid() (gas: 146446)\n[PASS] test_zeroValueDoesNotMakeZeroSpenderValid() (gas: 48002)\nSuite result: ok. 13 passed; 0 failed; 0 skipped; finished in 165.97ms (816.56ms CPU time)\n\nRan 33 tests for test/HooksStoreToken.t.sol:HooksStoreTokenTest\n[PASS] testFuzz_create2MintsEntireSupplyToFactory(bytes32) (runs: 512, μ: 263907, ~: 264012)\n[PASS] testFuzz_transferAboveBalanceReverts(uint256,uint256) (runs: 512, μ: 127224, ~: 127508)\nLogs:\n  Bound result 27835\n  Bound result 19572\n\n[PASS] testFuzz_transferConservesSupply(address,uint256) (runs: 512, μ: 92768, ~: 93139)\nLogs:\n  Bound result 885424767543446047411050492\n\n[PASS] testFuzz_transferFromHonorsAllowance(uint256,uint256) (runs: 512, μ: 161107, ~: 164004)\nLogs:\n  Bound result 2\n\n[PASS] testFuzz_transferToZeroReverts(uint256) (runs: 512, μ: 51319, ~: 51038)\nLogs:\n  Bound result 255\n\n[PASS] testFuzz_unapprovedCallerCannotUseAnotherSpendersAllowance(address,uint256) (runs: 512, μ: 127218, ~: 126940)\nLogs:\n  Bound result 420630803173520769754486509\n\n[PASS] test_allowancesAreIndependentForEachOwnerAndSpender() (gas: 205546)\n[PASS] test_approvalReplacesRatherThanAddsToAllowance() (gas: 93502)\n[PASS] test_approveEmitsEventAndDoesNotMoveBalances() (gas: 88756)\n[PASS] test_approveZeroSpenderReverts() (gas: 37662)\n[PASS] test_constructorEmitsExactlyOneMintEvent() (gas: 9652)\n[PASS] test_deployerCannotSpendHolderBalanceWithoutApproval() (gas: 160587)\n[PASS] test_factoryGetsEntireSupplyInsteadOfTransactionOrigin() (gas: 276771)\n[PASS] test_metadataAndInitialSupply() (gas: 107693)\n[PASS] test_nativeCurrencyIsRejected() (gas: 42619)\n[PASS] test_noMintBurnAdminOrUpgradeEntryPoints() (gas: 1035280)\n[PASS] test_revokeAllowancePreventsFurtherSpending() (gas: 133380)\n[PASS] test_selfTransferPreservesBalance() (gas: 51410)\n[PASS] test_transferEntireBalance() (gas: 75743)\n[PASS] test_transferFromByHolderAlsoRequiresAllowance() (gas: 144141)\n[PASS] test_transferFromExhaustedAllowanceCannotBeReused() (gas: 162247)\n[PASS] test_transferFromInfiniteAllowanceRemainsUntilRevoked() (gas: 217807)\n[PASS] test_transferFromInsufficientAllowanceReverts() (gas: 116174)\n[PASS] test_transferFromInsufficientBalanceRestoresAllowance() (gas: 136839)\n[PASS] test_transferFromMovesExactAmountAndDecrementsAllowance() (gas: 175053)\n[PASS] test_transferFromSelfStillConsumesAllowance() (gas: 110140)\n[PASS] test_transferFromZeroAmountNeedsNoApproval() (gas: 81446)\n[PASS] test_transferFromZeroOwnerRevertsEvenForZeroAmount() (gas: 44747)\n[PASS] test_transferFromZeroRecipientRestoresAllowance() (gas: 114743)\n[PASS] test_transferInsufficientBalanceRevertsWithoutChanges() (gas: 120466)\n[PASS] test_transferMaximumUintRevertsWithoutOverflow() (gas: 54977)\n[PASS] test_transferMovesExactAmountAndEmitsEvent() (gas: 93528)\n[PASS] test_zeroTransferFromEmptyAccountEmitsEvent() (gas: 73378)\nSuite result: ok. 33 passed; 0 failed; 0 skipped; finished in 165.99ms (945.45ms CPU time)\n\nRan 2 tests for test/HooksStoreToken.invariant.t.sol:HooksStoreTokenInvariantTest\n[PASS]\nHooksStoreTokenInvariantTest invariants:\n[PASS] invariant_balancesAndAllowancesMatchIndependentLedger\n[PASS] invariant_supplyIsFixedAndAllTokensAreAccountedFor\n HooksStoreTokenInvariantTest invariants (runs: 256, calls: 32768, reverts: 0)\n\n╭--------------+----------------------+-------+---------+----------╮\n| Contract     | Selector             | Calls | Reverts | Discards |\n+==================================================================+\n| TokenHandler | approve              | 6644  | 0       | 0        |\n|--------------+----------------------+-------+---------+----------|\n| TokenHandler | approveBoundary      | 6501  | 0       | 0        |\n|--------------+----------------------+-------+---------+----------|\n| TokenHandler | transfer             | 6604  | 0       | 0        |\n|--------------+----------------------+-------+---------+----------|\n| TokenHandler | transferFrom         | 6507  | 0       | 0        |\n|--------------+----------------------+-------+---------+----------|\n| TokenHandler | transferFromBoundary | 6512  | 0       | 0        |\n╰--------------+----------------------+-------+---------+----------╯\n\nLogs:\n  Bound result 0\n  Bound result 1\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 1\n  Bound result 2529\n  Bound result 6369\n  Bound result 4\n  Bound result 6370\n  Bound result 211396208978695672223073206\n  Bound result 58\n  Bound result 2316\n  Bound result 7351\n  Bound result 458\n  Bound result 13\n  Bound result 0\n  Bound result 13697450\n  Bound result 1545\n  Bound result 2527\n  Bound result 415955171\n  Bound result 0\n  Bound result 211\n  Bound result 255\n  Bound result 388\n  Bound result 2512\n  Bound result 1890\n  Bound result 15\n  Bound result 9\n  Bound result 706887517289120635570895228\n  Bound result 217\n  Bound result 967610514520140069891423816\n  Bound result 19\n  Bound result 133\n  Bound result 19\n  Bound result 7979\n  Bound result 18\n  Bound result 1224\n  Bound result 610\n  Bound result 906847553351084715690338256\n  Bound result 2226\n  Bound result 48\n  Bound result 6703\n  Bound result 7342\n  Bound result 484862269180798285991271072\n  Bound result 2932\n  Bound result 16\n  Bound result 5652\n  Bound result 19\n  Bound result 4\n  Bound result 6195\n  Bound result 19\n  Bound result 13261\n  Bound result 4735\n  Bound result 636206670923173488387541826\n  Bound result 8828\n  Bound result 871\n  Bound result 6590\n  Bound result 702\n  Bound result 5844\n  Bound result 6852\n\n[PASS] test_handlerReplaysExhaustionFailureAndRefill() (gas: 2342462)\nLogs:\n  Bound result 1000000000000000000000000000\n\nSuite result: ok. 2 passed; 0 failed; 0 skipped; finished in 9.25s (9.25s CPU time)\n\nRan 4 test suites in 9.25s (9.58s CPU time): 49 tests passed, 0 failed, 0 skipped (49 total tests)\n","passed":true},{"durationMs":81,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"HooksStoreToken.approve(address,uint256)\",\"HooksStoreToken.transfer(address,uint256)\",\"HooksStoreToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"LICENSE\":21,\"README.md\":138,\"THIRD_PARTY.md\":29,\"foundry.toml\":18,\"remappings.txt\":2,\"src/HooksStoreToken.sol\":17,\"test/HooksStoreToken.edges.t.sol\":275,\"test/HooksStoreToken.invariant.t.sol\":87,\"test/HooksStoreToken.t.sol\":410,\"test/LaunchTransfers.t.sol\":45,\"test/helpers/TokenFactory.sol\":15,\"test/helpers/TokenHandler.sol\":124,\"vendor-checksums.txt\":36},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"e83a2614ec3479a00b48e381a7cb4005e651c5c0d548375b12fcd63c4bb81e97","verifiedTreeHash":"9e3abeca85145870bfcdd47746d9b9239d2e56cb","verifierVersion":"0.1.0+ad64f8c4"}]}