{"assessments":[],"deployments":[],"fuzz":[],"identity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"interpretation":"Records acceptance and evidence. Neither completion nor an AI assessment establishes correctness, safety, or independent review.","jobId":"5be31add-6a39-4c95-b469-b28ce8167c3d","kind":"shape:chain","nodes":[{"acceptedSubmissionHash":"3b2b970a9f15031f99209736727045ae9e0c41fc733980b9899fb7cc1dd4f13f","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"bc5bfc8455464381f2db18badb2b55cf8bec1e535c019349a0378fa990741171","skillId":"audit-specialist","subagents":3,"tools":[]},"key":"audit_economics","kind":"code","role":"review","skillHash":"bc5bfc8455464381f2db18badb2b55cf8bec1e535c019349a0378fa990741171","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"2a9ed38ef7248c925115a1fdcb40f9a7e505f2acabbdedcae7f36bc89395b68d","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"bc5bfc8455464381f2db18badb2b55cf8bec1e535c019349a0378fa990741171","skillId":"audit-specialist","subagents":3,"tools":[]},"key":"audit_flow","kind":"code","role":"review","skillHash":"bc5bfc8455464381f2db18badb2b55cf8bec1e535c019349a0378fa990741171","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"a7942d16180da777a2c7a016c76066057b2d7d542685a8abc8dc75b621485acb","dependsOn":["build_contract_project","write_foundry_tests","manifest","audit_math","audit_permissions","audit_economics","audit_flow"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"b89279670f5a00f5d26286edee00c97dd158b997031350a01cafe6e0329ad227","skillId":"audit-judge","subagents":4,"tools":[]},"key":"audit_judge","kind":"code","role":"review","skillHash":"b89279670f5a00f5d26286edee00c97dd158b997031350a01cafe6e0329ad227","skillId":"audit-judge","state":"accepted"},{"acceptedSubmissionHash":"0b9252a4cea9a7050c45baa2cd6f5579490bde7e4ec7960cdd7a5b58eb797d90","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"bc5bfc8455464381f2db18badb2b55cf8bec1e535c019349a0378fa990741171","skillId":"audit-specialist","subagents":3,"tools":[]},"key":"audit_math","kind":"code","role":"review","skillHash":"bc5bfc8455464381f2db18badb2b55cf8bec1e535c019349a0378fa990741171","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"708f54a451277577f7512a367a28a0f42c8df01a44b0c01898fac2eaa06a9e24","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"bc5bfc8455464381f2db18badb2b55cf8bec1e535c019349a0378fa990741171","skillId":"audit-specialist","subagents":3,"tools":[]},"key":"audit_permissions","kind":"code","role":"review","skillHash":"bc5bfc8455464381f2db18badb2b55cf8bec1e535c019349a0378fa990741171","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"de6853dee74b3c801da69a37f67ae88edcff6835f1b1485bdfbdc0d700c46061","dependsOn":[],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"816fe39c7efd64504a19175b0f4dd9186d61069f37a22684c90358a18c60bddc","skillId":"build-contract-project","tools":[]},"key":"build_contract_project","kind":"code","role":"implement","skillHash":"816fe39c7efd64504a19175b0f4dd9186d61069f37a22684c90358a18c60bddc","skillId":"build-contract-project","state":"accepted"},{"acceptedSubmissionHash":"fddf19e960a633f223f8eef0367e95b9f99e05298f8e4dc2e9e6f63244c20d38","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"tools":[]},"key":"manifest","kind":"code","role":"integrate","skillHash":null,"skillId":null,"state":"accepted"},{"acceptedSubmissionHash":"e17bbf9c6c31e86d38875ff04c9a2e802e74a9ca103a805f10d2b2be0ed97641","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"606842ccca0e7c5d3017a54684625438eab9b351eb51dcf0cf88c43d1ea41464","skillId":"write-foundry-tests","subagents":4,"tools":[]},"key":"write_foundry_tests","kind":"code","role":"tests","skillHash":"606842ccca0e7c5d3017a54684625438eab9b351eb51dcf0cf88c43d1ea41464","skillId":"write-foundry-tests","state":"accepted"}],"objective":"A custom token: PAPERCLASH (PAPERCLASH).\nToken name: PAPERCLASH\nToken symbol: PAPERCLASH\nToken supply: 1,000,000,000 with 18 decimals, all minted once to the deployer in the constructor.","parentJobId":null,"planHash":"9d941dfe627310bc23ce5a7d26a343e777e3e33e77d0d0f1a91c5122b8cd3998","previousHash":"0000000000000000000000000000000000000000000000000000000000000000","projectId":"5be31add-6a39-4c95-b469-b28ce8167c3d","publication":{"commit":null,"deliveredAt":null,"repoUrl":"https://github.com/identity-md-launches/launch-2597-paperclash"},"receiptIdentity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"registry":"0xb6d0a187b050fa5bb0b87033a203f37becf4a775","research":[],"schema":"identitymd-work-v1","signals":[{"agentId":"52152","feedbackHash":"f91bfe7a103b2d9eae6dd81db64cb4c47da4673a9e668d6454816096859b40e1","nodeKey":"audit_economics","submissionHash":"3b2b970a9f15031f99209736727045ae9e0c41fc733980b9899fb7cc1dd4f13f","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51511","feedbackHash":"b7c474c7ff2c1639955494d4e2b5393d15e1484600d218619f8e55cb4c43eca3","nodeKey":"audit_flow","submissionHash":"2a9ed38ef7248c925115a1fdcb40f9a7e505f2acabbdedcae7f36bc89395b68d","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52615","feedbackHash":"9fd9966bc5b3f9a4733f0bc4525f1d236d17ef573973f0df1bf3c07c54ca0bd6","nodeKey":"audit_judge","submissionHash":"a7942d16180da777a2c7a016c76066057b2d7d542685a8abc8dc75b621485acb","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"53929","feedbackHash":"d87baaa40a096218b9e787f37e543cd20c3392b20fc619b84b9c2af3638530e2","nodeKey":"audit_math","submissionHash":"0b9252a4cea9a7050c45baa2cd6f5579490bde7e4ec7960cdd7a5b58eb797d90","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52170","feedbackHash":"204447ac15e83629559003043070c6e816d9b7dca530da8788af6a9c7a8e421d","nodeKey":"audit_permissions","submissionHash":"708f54a451277577f7512a367a28a0f42c8df01a44b0c01898fac2eaa06a9e24","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52670","feedbackHash":"b2167950416a05d67f06411570d133301bb8b8c5e4870ea5b56dd509923cf345","nodeKey":"build_contract_project","submissionHash":"de6853dee74b3c801da69a37f67ae88edcff6835f1b1485bdfbdc0d700c46061","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"51465","feedbackHash":"ba0c36c463ed22b9c7b461d9184609444fd0b240187220535f7075b6c7eb7423","nodeKey":"manifest","submissionHash":"fddf19e960a633f223f8eef0367e95b9f99e05298f8e4dc2e9e6f63244c20d38","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"50986","feedbackHash":"d4b047cdf9957d803fba378a80d4fc775fab42232c649c21dc22dd8802742a3b","nodeKey":"write_foundry_tests","submissionHash":"e17bbf9c6c31e86d38875ff04c9a2e802e74a9ca103a805f10d2b2be0ed97641","tag1":"verification:checks","tag2":"acceptance-v2","value":1}],"site":null,"snapshotHash":"c8c8920520079511daa30ce2b8af7dc55a9b37f8c0108d404370d60b020f151a","state":"completed","submissions":[{"artifacts":[],"attempt":1,"bundleHash":null,"device":"23617eab0c5242d6","findings":[],"hash":"0b9252a4cea9a7050c45baa2cd6f5579490bde7e4ec7960cdd7a5b58eb797d90","nodeId":"9cf4913c-7b4e-489a-80d7-ef4781b9cf74","outcome":"completed","summary":"I found no math defects in PAPERCLASH, so `.imd-findings.json` holds an empty findings list plus a coverage record for every listed entry point. I changed no other files.\n\n**What the token is:** `src/PAPERCLASH.sol` is a plain OpenZeppelin v5 ERC-20 with nothing overridden. Its constructor mints `INITIAL_SUPPLY = 1_000_000_000 * 10 ** 18` once to `msg.sender`. It has no custom transfer logic, fees, burns, rounding or privileged functions.\n\n**Math Precision, Boundary and Numerical Gap passes:**\n- **Supply:** 10^27 fits easily in a uint256, and the 10^18 scaling matches `decimals() == 18`. No path mints or burns after deployment, so the supply cannot change.\n- **Unchecked arithmetic in `_update`:** the subtraction is protected by a `value <= fromBalance` check. The recipient's addition is capped by the fixed total supply, so it cannot overflow.\n- **Allowances:** `_spendAllowance` checks the allowance before its unchecked subtraction. The maximum uint256 value means \"unlimited\" and is never decreased, which is the intended behaviour.\n- **Edge inputs:** zero-value transfers, self-transfers, transferring an exact full balance or allowance, and amounts one above them all behave as standard ERC-20. Transfers move exactly the stated amount, so the launch flows (factory to distributor, pool seeding, swaps) cannot arrive short.\n- **Static-analysis lead:** aderyn's \"large numeric literal\" note at line 12 is a style note. The constant is correct, so I didn't report it.\n\n**Coverage:** `holds` for `approve`, `transfer` and `transferFrom`, plus two invariants: the supply stays at exactly 1e27, and the sum of balances equals the total supply.\n\n**Checks run:** the project's own suite passes, 34 of 34 tests including the invariant suite. I didn't run the protected floor tests. They import harness files (`src/LaunchLiquidity.sol`, the floor `OwnerChecks.sol`) that aren't in this tree, so the verifier's environment has to run them.\n\n**Outside my area:** the token has no owner and no privileged calls, so the other specialists have little to examine there.","treeHash":null,"usage":{"cachedInputTokens":107961,"inputTokens":10,"model":"claude-opus-5-5","outputTokens":2113,"runtime":"claude","turns":5,"wallClockMs":33916}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"fbcdfc017217af1f","findings":[{"citation":"resolved","description":"Periphery pass (vendored dependency provenance). DEPENDENCIES.md states that every vendored file is unmodified from the pinned archives and that `sha256sum --check DEPENDENCIES.sha256` verifies the local copies. Running that command on the committed tree reports 7 mismatches, all under lib/forge-std/src (StdAssertions.sol, StdJson.sol, StdToml.sol, Vm.sol, console.sol, interfaces/IERC7540.sol, interfaces/IMulticall3.sol). A diff against upstream forge-std v1.9.7 shows the differences are line-wrapping only (the files were run through a formatter); there is no semantic change. All five vendored OpenZeppelin files (ERC20.sol, IERC20.sol, IERC20Metadata.sol, Context.sol, draft-IERC6093.sol) pass their checksums and are byte-identical to upstream v5.0.2, so the deployed token's code and bytecode are unaffected. forge-std is used only by tests and is not part of the deployed artifact. This is a documentation/provenance inconsistency only: a reviewer following the README's verification instructions gets a failing check and cannot rely on the hash file to attest the test harness. Fix: either regenerate DEPENDENCIES.sha256 from the committed files (and note the reformatting in DEPENDENCIES.md), or restore the seven files to their upstream v1.9.7 bytes.","line":30,"path":"DEPENDENCIES.md","reproduction":"From the repository root run `sha256sum --check DEPENDENCIES.sha256 | grep -v ': OK$'`. Expected per DEPENDENCIES.md: every line OK, exit 0. Actual: 7 lines `FAILED` (lib/forge-std/src/StdAssertions.sol, StdJson.sol, StdToml.sol, Vm.sol, console.sol, interfaces/IERC7540.sol, interfaces/IMulticall3.sol) and `sha256sum: WARNING: 7 computed checksums did NOT match`, exit 1. `curl -fsSL https://raw.githubusercontent.com/foundry-rs/forge-std/v1.9.7/src/Vm.sol | diff - lib/forge-std/src/Vm.sol` shows only multi-line signature wrapping differences. The same comparison for the five OpenZeppelin files against tag v5.0.2 shows them identical.","severity":"info","snippet":"Selected source files are unmodified from those archives. Licenses are included","title":"DEPENDENCIES.md claims vendored files are unmodified and verifiable, but seven forge-std files fail the recorded checksums (test-only, whitespace-only reformatting)"}],"hash":"2a9ed38ef7248c925115a1fdcb40f9a7e505f2acabbdedcae7f36bc89395b68d","nodeId":"4a5c89cd-dae7-4a1f-a3c3-b4fcba550e16","outcome":"completed","summary":"The review is complete and `.imd-findings.json` is written at the repository root. The tree is otherwise unchanged, and my scratch tests were removed.\n\n**Outcome: the PAPERCLASH token has no control-flow defect.** It is a 19-line wrapper over an unmodified OpenZeppelin v5.0.2 ERC20 that mints 10^27 base units once to its immediate deployer. I report one info-level note and nine coverage rows.\n\n**What I checked, by guide**\n\n- **Execution Trace.** Traced `approve`, `transfer` and `transferFrom` through `_approve`, `_spendAllowance`, `_transfer` and `_update`. Zero-address sentinels revert, insufficient balance or allowance reverts atomically with no partial state, the max allowance is not decremented, and no stale read or external call exists. The existing 34 tests pass under the README's fuzz seed.\n- **Periphery.** The five vendored OpenZeppelin files pass their recorded checksums and are byte-identical to the upstream v5.0.2 tag. `_msgSender()` is plain `msg.sender`. The compiled ABI exposes only the three ERC-20 writers, with no receive, fallback or constructor inputs.\n- **First Principles.** The constructor mints exactly the brief's supply with 18 decimals, name and symbol `PAPERCLASH`, no arguments and no calls. A scratch test replicating the protected floor confirmed CREATE2 deployment from a factory, exact launch flows in both directions, no reachable DELEGATECALL, CALLCODE, SELFDESTRUCT, CREATE, CALL or post-Paris opcode in the runtime, and that 1024 fuzzed selectors from a stranger and the factory leave supply and balances untouched.\n\n**One info finding.** DEPENDENCIES.md states all vendored files are unmodified and verifiable with the checksum file, but seven forge-std files fail that check. The differences are whitespace-only reformatting of v1.9.7, in test-only code, so the deployed token is unaffected. The fix is to regenerate the checksum file or restore the upstream bytes.\n\n**Coverage.** All three listed entry points hold, plus rows for the constructor, supply immutability, the opcode scan, library provenance and manifest expectations. Nothing in the assigned area was left unreached. Static-analysis leads were a cosmetic large-literal warning only; Slither found nothing.","treeHash":null,"usage":{"cachedInputTokens":810231,"inputTokens":322,"model":"claude-fable-5-1","outputTokens":17907,"runtime":"claude","turns":34,"wallClockMs":234077}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"7c748c02cd2ee98f","findings":[{"citation":"resolved","description":"Outside the economics area; reported because it is reproducible and misleads anyone who follows the repository's own verification instructions. DEPENDENCIES.md states the vendored files are unmodified from the pinned archives and that DEPENDENCIES.sha256 records the hash of every vendored file, and README.md/DEPENDENCIES.md tell a verifier to run `sha256sum --check DEPENDENCIES.sha256`. In the committed tree (git status clean) that command exits 1: seven files under lib/forge-std/src/ (StdAssertions.sol, StdJson.sol, StdToml.sol, Vm.sol, console.sol, interfaces/IERC7540.sol, interfaces/IMulticall3.sol) do not match the recorded hashes. The recorded hashes equal upstream forge-std v1.9.7; the local files equal upstream only after whitespace is stripped, so they were reformatted (line-wrapped, apparently by forge fmt) after the hash file was written. Not deployed code: forge-std is test-only, and all five vendored OpenZeppelin v5.0.2 files match both the recorded hashes and the upstream files fetched from GitHub byte for byte, so the token's bytecode is unaffected. The defect is that the repository's stated provenance check cannot be used as written. Fix: either restore the seven files from the v1.9.7 archive (and exclude lib/ from forge fmt) or regenerate DEPENDENCIES.sha256 and reword the 'unmodified' claim.","line":30,"path":"DEPENDENCIES.md","reproduction":"In the repository root run `sha256sum --check DEPENDENCIES.sha256`. Expected (per DEPENDENCIES.md): every line reports OK and the exit code is 0. Actual: `lib/forge-std/src/StdAssertions.sol: FAILED`, `lib/forge-std/src/StdJson.sol: FAILED`, `lib/forge-std/src/StdToml.sol: FAILED`, `lib/forge-std/src/Vm.sol: FAILED`, `lib/forge-std/src/console.sol: FAILED`, `lib/forge-std/src/interfaces/IERC7540.sol: FAILED`, `lib/forge-std/src/interfaces/IMulticall3.sol: FAILED`, `sha256sum: WARNING: 7 computed checksums did NOT match`, exit code 1. Confirmed upstream: sha256 of https://raw.githubusercontent.com/foundry-rs/forge-std/v1.9.7/src/Vm.sol starts 9068805b59ac (equals the recorded hash); the local file's starts a1b1c82924ae; with all whitespace removed both hash to fe772424ec5d.","severity":"info","snippet":"Selected source files are unmodified from those archives. Licenses are included","title":"DEPENDENCIES.md provenance claim is false: the documented sha256 check fails for 7 vendored forge-std files"}],"hash":"3b2b970a9f15031f99209736727045ae9e0c41fc733980b9899fb7cc1dd4f13f","nodeId":"9e46b386-b965-400b-8fb5-11ab17c867f7","outcome":"completed","summary":"The review is complete and the findings file is written and valid. The working tree is unchanged apart from the findings file and my scratch test, both of which are not part of the submission.\n\n**Outcome: no economic defect found in the token.** PAPERCLASH is an unmodified OpenZeppelin v5.0.2 ERC-20 with a single constructor mint, and every failure mode in the Economic Security, Invariant and Flow Gap guides either has no surface here or is guarded by code I traced and exercised.\n\nWhat I checked and how:\n- **Economic Security.** No external dependencies, oracles, callbacks or fee/rebase/blacklist/pause behaviour exist. Sentinel paths were probed: transfer to the zero address, transferFrom from the zero address with zero and nonzero value, and approve from the zero address all revert without touching state.\n- **Invariant.** The sum of balances always equals the total supply of 1e27, because only the internal update function writes supply, the only mint is in the constructor, and burn is unreachable from the ABI. The project's stateful invariant suite and my scratch probe both confirm it. Allowance boundaries hold: the maximum allowance is sticky, a finite one cannot underflow, and failed transfers restore allowance.\n- **Flow Gap.** The launch legs move exact amounts: factory to distributor, distributor to claimant, pool manager to trader and back through approve plus transferFrom. The opening economics of 80% single-sided at a 10 ETH cap sit comfortably inside Uniswap v4 price, tick and liquidity bounds, and nothing in the token can distort them.\n- **Outside my area, cheaply verified.** The compiled runtime has no DELEGATECALL, CALLCODE or SELFDESTRUCT on reachable paths, the ABI has no privileged function, and the five vendored OpenZeppelin files are byte-identical to the upstream v5.0.2 tag fetched from GitHub.\n\nOne informational finding was recorded. The repository's own provenance check, `sha256sum --check DEPENDENCIES.sha256`, fails on seven forge-std files that were reformatted after the hash file was written. The difference is whitespace only, forge-std is test-only, and the token bytecode is unaffected, so it is a documentation defect rather than a security one.\n\nCoverage: all three listed entry points are marked as holding, with six additional invariant rows. The protected floor tests could not be executed locally because v4-core and the harness environment are not vendored, so that row rests on tracing rather than a run.","treeHash":null,"usage":{"cachedInputTokens":857629,"inputTokens":386,"model":"claude-fable-5-1","outputTokens":17405,"runtime":"claude","turns":32,"wallClockMs":242449}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"fa99051b60a858d6","findings":[{"citation":"resolved","description":"DEPENDENCIES.md (line 36) tells the reader to verify the vendored tree with `sha256sum --check DEPENDENCIES.sha256` and states that 'Selected source files are unmodified from those archives'. On the committed tree (git status clean) that check fails for 7 forge-std files: src/StdAssertions.sol, src/StdJson.sol, src/StdToml.sol, src/Vm.sol, src/console.sol, src/interfaces/IERC7540.sol, src/interfaces/IMulticall3.sol. All 29 other entries, including every OpenZeppelin file that is compiled into the deployed token, match. forge-std is test-only and does not reach the token bytecode, so this is a documentation/provenance inconsistency, not a token defect. Outside the permissions area; recorded because the deliverable's own integrity instruction does not hold as shipped. Either the hash file or the vendored forge-std v1.9.7 copy should be refreshed so the two agree.","line":18,"path":"DEPENDENCIES.sha256","reproduction":"From the repository root run `sha256sum --check DEPENDENCIES.sha256`. Expected: every line reports OK. Actual: `lib/forge-std/src/Vm.sol: FAILED` (recorded 9068805b…, computed a1b1c829…) plus six other forge-std FAILED lines and `WARNING: 7 computed checksums did NOT match`.","severity":"info","snippet":"9068805b59ac1d0ea03a8fa1f15ae49c094e0c6c852a2500e0dd112f264b2cb1  lib/forge-std/src/Vm.sol","title":"Vendored forge-std files do not match DEPENDENCIES.sha256, so the documented provenance check fails"},{"citation":"resolved","description":"PAPERCLASH inherits OpenZeppelin v5.0.2 ERC20 unchanged. approve() overwrites the allowance (ERC20.sol:291 `_allowances[owner][spender] = value;`) and transferFrom() spends it (ERC20.sol:305-315). The contract does not expose increaseAllowance/decreaseAllowance (removed in OZ v5) or permit. This is the well-known ERC-20 approve front-running property, documented in README.md lines 107-109; it is inherent to the standard the brief asked for and is not a permission bypass. Listed as info only so the trust assumption is explicit: an approved spender is trusted for the full allowance until a zero-reset is confirmed. No code change is required by the brief; holders should set allowance to 0 before changing a non-zero allowance.","line":10,"path":"src/PAPERCLASH.sol","reproduction":"Deployer transfers 10e18 to HOLDER. HOLDER calls approve(SPENDER, 5e18). HOLDER then submits approve(SPENDER, 2e18) intending to lower it; SPENDER sees it pending and first calls transferFrom(HOLDER, SPENDER, 5e18) (succeeds, allowance 0), then after the re-approval lands calls transferFrom(HOLDER, SPENDER, 2e18) (succeeds). Expected by the holder: at most 5e18 ever spendable. Actual: SPENDER holds 7e18. Verified with test_approveRaceIsPossible in test/scratch/Permissions.t.sol (passes on current code, confirming the behaviour).","severity":"info","snippet":"contract PAPERCLASH is ERC20 {","title":"Standard ERC-20 approve race: a spender can consume old and new allowance across a non-zero re-approval"}],"hash":"708f54a451277577f7512a367a28a0f42c8df01a44b0c01898fac2eaa06a9e24","nodeId":"a07d4cd1-3d14-4e92-8b6a-57595a71933a","outcome":"completed","summary":"The review is complete and written to `.imd-findings.json`. No tracked files were changed; the only writes were the findings file and a scratch test under test/scratch/, which is ignored by git.\n\n**Result: the permission model holds.** PAPERCLASH is an unmodified OpenZeppelin v5.0.2 ERC20 with a single constructor mint of 1e27 to msg.sender. I found no access control, trust gap or asymmetry defect.\n\nWhat I checked in the assigned area:\n- **Access control.** The compiled ABI exposes exactly approve, transfer, transferFrom and views. There are no roles, modifiers, initializers, owner, upgrade path, delegatecall, receive or fallback. A scratch test fired 22 admin-style selectors from both the deployer and a stranger. All reverted and supply and balances were unchanged.\n- **Trust gap.** The deployer, which is the factory at launch, has no standing over a holder's balance once transferred. A transferFrom without allowance reverts for the deployer like anyone else. There is no fee, oracle, setter or exemption list for any seam to live in.\n- **Asymmetry.** transfer and transferFrom share the same internal path. Finite allowances decrement exactly and the max allowance is infinite. The vendored OpenZeppelin files, including Context's msg.sender resolution, hash-match the pinned release.\n- **Supply.** The project's 34 tests, its stateful invariant suite, and my 5 scratch tests all pass. The aderyn large-literal lead is a style note only.\n\nTwo info-level items are recorded, neither a blocking defect:\n1. The documented provenance check fails. Running `sha256sum --check DEPENDENCIES.sha256` reports 7 forge-std files as mismatched. Those files are test-only and not in the token bytecode, but the hash file or vendored copy should be refreshed so the instruction holds.\n2. The standard ERC-20 approve race exists, as inherent to the requested design and already documented in the README. It is listed so the trust assumption on approved spenders is explicit.\n\nCoverage rows answer all three listed entry points as holds, plus rows for the constructor, the access surface, the trust gap seams, asymmetry pairs and the supply invariant.","treeHash":null,"usage":{"cachedInputTokens":508149,"inputTokens":290,"model":"claude-fable-5-1","outputTokens":12545,"runtime":"claude","turns":25,"wallClockMs":188776}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"7f1df2a55552de06","findings":[],"hash":"7c87a2f2c0adbf9db1fca26e52647e25b54f1b46bf131cfd3b62bcc38dbc1d61","nodeId":"4a5c89cd-dae7-4a1f-a3c3-b4fcba550e16","outcome":"failed","summary":"Failed to authenticate: OAuth session expired and could not be refreshed","treeHash":null,"usage":{"cachedInputTokens":0,"inputTokens":0,"model":null,"outputTokens":0,"runtime":"claude","turns":1,"wallClockMs":1563}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"b8fd8054ea57c5d8","findings":[{"citation":"resolved","description":"Merged from audit_flow (f82ecef8), audit_permissions (0a779ccb) and audit_economics (f5f5630e); all three have the same root cause. DEPENDENCIES.md:30-36 says every vendored file is unmodified from the pinned archives and can be checked with `sha256sum --check DEPENDENCIES.sha256`. On the committed tree, 7 lib/forge-std/src files differ from their recorded hashes: StdAssertions.sol, StdJson.sol, StdToml.sol, Vm.sol, console.sol, interfaces/IERC7540.sol and interfaces/IMulticall3.sol. The recorded hashes (for example DEPENDENCIES.sha256:18 `9068805b...  lib/forge-std/src/Vm.sol`) are upstream v1.9.7's. The local files have only formatter line-wrapping changes. forge-std is used only by tests. All 6 OpenZeppelin entries pass, and I diffed ERC20.sol against upstream v5.0.2 and found it byte-identical, so the deployed bytecode is not affected. This is a provenance/documentation inconsistency only. Fix: restore the 7 files from the v1.9.7 archive, or regenerate DEPENDENCIES.sha256 and reword the 'unmodified' claim.","line":30,"path":"DEPENDENCIES.md","reproduction":"From the repository root, run `sha256sum --check DEPENDENCIES.sha256`. Expected (per DEPENDENCIES.md:30-36): every line OK, exit 0. Actual: `lib/forge-std/src/StdAssertions.sol: FAILED`, StdJson.sol, StdToml.sol, Vm.sol, console.sol, interfaces/IERC7540.sol and interfaces/IMulticall3.sol also FAILED, then `sha256sum: WARNING: 7 computed checksums did NOT match`, exit 1. Reproduced on this tree.","severity":"info","snippet":"Selected source files are unmodified from those archives. Licenses are included","title":"DEPENDENCIES.md says vendored files are unmodified, but its own sha256 check fails for 7 test-only forge-std files"}],"hash":"a7942d16180da777a2c7a016c76066057b2d7d542685a8abc8dc75b621485acb","nodeId":"e4f6dc51-fe7b-4994-8cac-8bd1d3978e7a","outcome":"completed","summary":"I found no defects in PAPERCLASH that block the launch. I kept one info-level finding about the documentation and dropped the rest. Everything is written to `.imd-findings.json` and no other file was changed.\n\n**The token itself.** `src/PAPERCLASH.sol` is a plain OpenZeppelin v5.0.2 ERC20 with nothing added. Its constructor mints 1,000,000,000 tokens (1e27 smallest units) once to the deployer. There is no owner, mint, burn, fee, pause or external call. I compared the vendored `ERC20.sol` with the upstream v5.0.2 file and they are byte-identical. `forge build` succeeds, the contract is small (1,814 bytes deployed, 2,708 bytes creation code), and all 46 existing tests pass. `launch.json` agrees with the code: no constructor arguments, the same total supply, 18 decimals and a valid contract name.\n\n**Specialist findings:**\n- **Kept, merged into one (info):** three specialists reported the same problem. `DEPENDENCIES.md` line 30 says the bundled third-party files are unmodified, but `sha256sum --check DEPENDENCIES.sha256` fails for 7 forge-std files. I re-ran the check and got the same 7 failures. The specialists found that the only differences are line-wrapping from a formatter. forge-std is only used by tests, and every OpenZeppelin file passes, so the deployed token is unaffected.\n- **Dropped:** the approve front-running note. Spending the old allowance before a new one lands is how every standard ERC-20 behaves, it's what the brief asked for, and the README documents it.\n- **Dropped:** aderyn's \"large numeric literal\" warning. The literal is the intended supply constant, not a defect.\n\n**Coverage:** I traced all three entry points (`approve`, `transfer`, `transferFrom`) myself and each holds. I also recorded two invariants as holding: the fixed supply minted to the deployer, and that the factory can deploy the contract. I didn't write a Foundry test as proof, since that is only required for critical or high findings.","treeHash":null,"usage":{"cachedInputTokens":205579,"inputTokens":14,"model":"claude-opus-5-5","outputTokens":3934,"runtime":"claude","turns":7,"wallClockMs":66112}},{"artifacts":[],"attempt":1,"bundleHash":"843ae98fd46b08e10441a898962cfefa2a28b71f4b55f500167edeb6727d5454","device":"a09316cd893b3b67","findings":[],"hash":"de6853dee74b3c801da69a37f67ae88edcff6835f1b1485bdfbdc0d700c46061","nodeId":"e79e9866-b8e7-4641-9c63-c237870ed520","outcome":"completed","summary":"Implemented PAPERCLASH with 18 decimals and exactly 1,000,000,000 tokens minted once to the deployer. No additional minting or admin powers.\n\nDependencies are vendored for offline builds. README documents assumptions, deployment parameters, and operational responsibilities.\n\nValidation passed:\n\n- `forge build`\n- `forge test`: 34 tests, including fuzz and stateful invariants, using the supplied seed\n- `forge fmt --check`","treeHash":"9e5dfede4040e45a5ac12267fbf2463fb91b5497","usage":{"cachedInputTokens":459776,"inputTokens":49867,"model":"gpt-6-astra","outputTokens":14396,"runtime":"codex","turns":5,"wallClockMs":360847}},{"artifacts":[],"attempt":1,"bundleHash":"5a91b2225fe8e4c9709545013aec57a9ab3e8150c5153816ca3746213b99cd37","device":"ef5038c1bdac3372","findings":[],"hash":"e17bbf9c6c31e86d38875ff04c9a2e802e74a9ca103a805f10d2b2be0ed97641","nodeId":"a74c2b3b-610e-4876-9837-72526e64e06b","outcome":"completed","summary":"I added `test/PAPERCLASH.adversarial.t.sol`, which brings the suite from 34 to 46 tests. `forge build` succeeds and `forge test` passes all 46 when run with the verifier's fuzz seed.\n\n**What I found:** no defects, so I wrote no `.imd-findings.json`. `src/PAPERCLASH.sol` is a plain OpenZeppelin v5.0.2 ERC20. It has a constant supply of 1,000,000,000 × 10¹⁸ minted once to whoever deploys it, and nothing else: no owner, no mint or burn, no pause, no way to receive ETH.\n\n**What was already there:** an earlier contributor's 33 unit and fuzz tests and one invariant suite. I left them unchanged.\n\n**What I added:**\n- **Fuzz tests on the paths that must fail:**\n  - Any caller pulling tokens without an allowance reverts, and so does any empty account sending a positive amount.\n  - A pull above the holder's balance reverts even with an unlimited allowance.\n  - `approve` sets exactly the value given, for any owner and spender pair.\n  - Chained transfers keep the total equal to the supply.\n- **Pinned edge cases:**\n  - Transfers of exactly one wei, and a one-wei overspend that reverts.\n  - Spending an allowance emits only a Transfer event, with no Approval.\n  - An allowance of max − 1 is treated as finite and goes down when spent.\n  - `transferFrom` from the zero address and `approve` called by the zero address both revert.\n  - Two tokens deployed by the same factory are independent, and reusing a salt fails.\n- **An invariant suite over random call sequences.** The token is deployed through the factory, as the launch does it. Six actors take part: the factory, a distributor, a pool manager, two traders and the token's own address. Ordinary transfers and approvals are mixed with calls that must fail:\n  - spending above a balance or an allowance;\n  - sending to, or approving, the zero address;\n  - mint, burn, burnFrom, pause, blacklist and seize, which the token does not have.\n\n  Each failing call is checked to revert. After every sequence, balances and allowances must match a separate record kept by the test, the balances must add up to the full supply, and the name, symbol, decimals and supply constant must be unchanged. It runs 16,384 calls with no unexpected reverts.\n\nOne test failed on my first run, and the fault was in my test rather than the token. A zero-amount `transferFrom` from the zero address reverts with `ERC20InvalidApprover`, not the `ERC20InvalidSender` I had expected. That's because OpenZeppelin 5.0.2 writes the allowance back even when the amount is 0. I corrected the expected error; the call reverts either way, which is the correct behaviour.\n\nThe new file is in the working tree but not committed.","treeHash":"22613823c104e4efa558797ec632e5e4dc2d9168","usage":{"cachedInputTokens":303885,"inputTokens":18,"model":"claude-opus-5-5","outputTokens":11324,"runtime":"claude","turns":12,"wallClockMs":136172}},{"artifacts":[],"attempt":1,"bundleHash":"aff69eb6a0624900a236b3ddcb1d1f6e6b21fc2960b1353d07794f915d3008fa","device":"f0c4ae5b8ada215c","findings":[],"hash":"fddf19e960a633f223f8eef0367e95b9f99e05298f8e4dc2e9e6f63244c20d38","nodeId":"c6b29475-d455-4f1a-9109-76d967508d22","outcome":"completed","summary":"Done. I wrote launch.json for the PAPERCLASH custom token launch, and it is the only file changed.\n\n**What the manifest says**\n\n- **Token:** contract PAPERCLASH, name and symbol PAPERCLASH, 18 decimals, empty constructorArgs. The accepted constructor at `src/PAPERCLASH.sol:15` takes no parameters and mints the whole supply once to msg.sender.\n- **totalSupply:** 10^27 minor units, matching the constant INITIAL_SUPPLY and the one billion token brief.\n- **Contracts:** an empty list. The accepted tree has no application contracts, only the token and local test fixtures.\n- **Pool and economics:** copied verbatim from the launch reference. Native ETH pair, fee 12500, tick spacing 60, the provenance-only initial price, and the requester's economics object.\n- **Notes:** a plain-language description of the token's behavior and the launch flows, well under the limit.\n\n**Verification**\n\n- A scratch script in test/scratch checked the manifest's keys, types, lowercase addresses, supply, and the verbatim economics object. It passed.\n- `forge build` compiled cleanly.\n- `forge test` with the verifier's fuzz seed passed all 34 tests across both suites.\n- `git status` shows only launch.json as new. No configuration, lib, or workflow files were touched.","treeHash":"5ad61efad39879c2658b7e1f4c73b6d2dc8a9381","usage":{"cachedInputTokens":129480,"inputTokens":130,"model":"claude-fable-5-1","outputTokens":3218,"runtime":"claude","turns":9,"wallClockMs":52548}}],"verification":[{"checks":[{"durationMs":1525,"exitCode":0,"name":"build","output":"Compiling 28 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.41s\nCompiler run successful!\n","passed":true},{"durationMs":6510,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 33 tests for test/PAPERCLASH.t.sol:PAPERCLASHTest\n[PASS] testFuzz_delegatedTransferConsumesOnlySpentAllowance(uint256,uint256) (runs: 1024, μ: 163362, ~: 165499)\nLogs:\n  Bound result 318514930503416737483835737\n  Bound result 153730258881288809639815558\n\n[PASS] testFuzz_delegatedTransferOverAllowanceReverts(uint256) (runs: 1024, μ: 119684, ~: 119879)\nLogs:\n  Bound result 1060\n\n[PASS] testFuzz_infiniteApprovalSurvivesTransfer(uint256) (runs: 1024, μ: 144577, ~: 144805)\nLogs:\n  Bound result 236959238955632781932952335\n\n[PASS] testFuzz_transferConservesSupply(address,uint256) (runs: 1024, μ: 93051, ~: 93324)\nLogs:\n  Bound result 162444832864178\n\n[PASS] testFuzz_transfersAboveSupplyRevert(uint256) (runs: 1024, μ: 59273, ~: 59601)\nLogs:\n  Bound result 115792089237316195423570985008687907853269984665639564039457584007913179954090\n\n[PASS] test_allowanceIsSpecificToSpender() (gas: 105742)\n[PASS] test_approveDoesNotRequireBalance() (gas: 78665)\n[PASS] test_approveEmitsEventAndReplacesAllowance() (gas: 119561)\n[PASS] test_approveZeroAddressReverts() (gas: 37745)\n[PASS] test_constructorEmitsExactlyOneMint() (gas: 9813)\n[PASS] test_constructorMintsToImmediateDeployer() (gas: 32742)\n[PASS] test_deployerCannotSpendUnapprovedHolderBalance() (gas: 95240)\n[PASS] test_factoryCreate2ReceivesWholeSupply() (gas: 297608)\n[PASS] test_factoryDistributionClaimsAndPoolTransfersArriveWhole() (gas: 639978)\n[PASS] test_metadataAndInitialSupply() (gas: 108583)\n[PASS] test_noMintBurnOrAdministrativeEntrypoints() (gas: 1559909)\n[PASS] test_plainEthAndUnknownCallsRevert() (gas: 61552)\n[PASS] test_revokedAllowanceCannotBeSpent() (gas: 131565)\n[PASS] test_selfTransferPreservesBalance() (gas: 53942)\n[PASS] test_selfTransferStillRequiresBalance() (gas: 36245)\n[PASS] test_transferEmitsEventAndMovesExactAmount() (gas: 91537)\n[PASS] test_transferEntireSupply() (gas: 161719)\n[PASS] test_transferExceedingBalanceRevertsWithoutChanges() (gas: 120352)\n[PASS] test_transferFromConsumesFiniteAllowance() (gas: 242162)\n[PASS] test_transferFromInsufficientAllowanceReverts() (gas: 116005)\n[PASS] test_transferFromInsufficientBalanceRestoresAllowance() (gas: 178819)\n[PASS] test_transferFromPreservesInfiniteAllowance() (gas: 207346)\n[PASS] test_transferFromToSelfConsumesAllowanceWithoutChangingBalance() (gas: 107559)\n[PASS] test_transferFromZeroRecipientRestoresAllowance() (gas: 114239)\n[PASS] test_transferToContractDoesNotCallRecipient() (gas: 174083)\n[PASS] test_transferToZeroRevertsEvenForZeroAmount() (gas: 72327)\n[PASS] test_zeroTransferFromEmptyAccountEmitsEvent() (gas: 73439)\n[PASS] test_zeroTransferFromNeedsNoPositiveAllowance() (gas: 81517)\nSuite result: ok. 33 passed; 0 failed; 0 skipped; finished in 36.35ms (180.00ms CPU time)\n\nRan 1 test for test/PAPERCLASH.invariant.t.sol:PAPERCLASHInvariantTest\n[PASS] invariant_supplyBalancesAndAllowancesMatchLedger() (runs: 256, calls: 16384, reverts: 0)\n\n╭--------------+-----------------+-------+---------+----------╮\n| Contract     | Selector        | Calls | Reverts | Discards |\n+=============================================================+\n| TokenHandler | approve         | 4112  | 0       | 0        |\n|--------------+-----------------+-------+---------+----------|\n| TokenHandler | approveInfinite | 4073  | 0       | 0        |\n|--------------+-----------------+-------+---------+----------|\n| TokenHandler | transfer        | 4103  | 0       | 0        |\n|--------------+-----------------+-------+---------+----------|\n| TokenHandler | transferFrom    | 4096  | 0       | 0        |\n╰--------------+-----------------+-------+---------+----------╯\n\nLogs:\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 6411\n  Bound result 0\n  Bound result 0\n  Bound result 3620\n  Bound result 1586\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 2\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 870845259297991817456551977\n  Bound result 8\n  Bound result 5205\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 1000000000\n  Bound result 30\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 6.38s (6.38s CPU time)\n\nRan 2 test suites in 6.38s (6.42s CPU time): 34 tests passed, 0 failed, 0 skipped (34 total tests)\n","passed":true},{"durationMs":41,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"PAPERCLASH.approve(address,uint256)\",\"PAPERCLASH.transfer(address,uint256)\",\"PAPERCLASH.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"DEPENDENCIES.md\":41,\"DEPENDENCIES.sha256\":36,\"README.md\":120,\"foundry.toml\":19,\"remappings.txt\":2,\"src/PAPERCLASH.sol\":18,\"test/PAPERCLASH.invariant.t.sol\":100,\"test/PAPERCLASH.t.sol\":403,\"test/helpers/TokenFactory.sol\":22},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true},{"durationMs":563,"exitCode":0,"name":"slither","output":"slither: no results at low impact or above","passed":true},{"durationMs":242,"exitCode":0,"name":"aderyn","output":"[low] large-numeric-literal at src/PAPERCLASH.sol:12: Large Numeric Literal","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"de6853dee74b3c801da69a37f67ae88edcff6835f1b1485bdfbdc0d700c46061","verifiedTreeHash":"9e5dfede4040e45a5ac12267fbf2463fb91b5497","verifierVersion":"0.1.0+944e816a"},{"checks":[{"durationMs":2274,"exitCode":0,"name":"build","output":"Compiling 29 files with Solc 0.8.26\nSolc 0.8.26 finished in 2.18s\nCompiler run successful!\n","passed":true},{"durationMs":7989,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 11 tests for test/PAPERCLASH.adversarial.t.sol:PAPERCLASHAdversarialTest\n[PASS] testFuzz_approveSetsExactValueForAnyPair(address,address,uint256,uint256) (runs: 1000, μ: 113672, ~: 113856)\n[PASS] testFuzz_chainedTransfersConserveSupply(uint256,uint256,uint256) (runs: 1000, μ: 260112, ~: 265940)\nLogs:\n  Bound result 803755732223959957911824270\n  Bound result 0\n  Bound result 0\n\n[PASS] testFuzz_emptyAccountCannotSendPositiveAmount(address,address,uint256) (runs: 1000, μ: 68278, ~: 68298)\nLogs:\n  Bound result 305486499180085030169844501967262507450716\n\n[PASS] testFuzz_strangerCannotPullWithoutAllowance(address,address,uint256) (runs: 1000, μ: 58423, ~: 58191)\nLogs:\n  Bound result 739999865793743751864340138\n\n[PASS] testFuzz_transferFromOverBalanceRevertsEvenWithInfiniteAllowance(uint256,uint256) (runs: 1000, μ: 177802, ~: 178588)\nLogs:\n  Bound result 306461081143310643342396787\n  Bound result 188787569339994698363139453767476442510871480172812401124552\n\n[PASS] test_maxMinusOneAllowanceIsFiniteAndDecrements() (gas: 121208)\n[PASS] test_oneWeiEdges() (gas: 146556)\n[PASS] test_redeployedTokensAreIndependent() (gas: 376987)\n[PASS] test_transferFromConsumingAllowanceEmitsNoApproval() (gas: 126130)\n[PASS] test_transferFromZeroOwnerReverts() (gas: 67651)\n[PASS] test_zeroAddressCannotApprove() (gas: 31128)\nSuite result: ok. 11 passed; 0 failed; 0 skipped; finished in 81.98ms (401.00ms CPU time)\n\nRan 33 tests for test/PAPERCLASH.t.sol:PAPERCLASHTest\n[PASS] testFuzz_delegatedTransferConsumesOnlySpentAllowance(uint256,uint256) (runs: 1024, μ: 163316, ~: 165501)\nLogs:\n  Bound result 1\n  Bound result 0\n\n[PASS] testFuzz_delegatedTransferOverAllowanceReverts(uint256) (runs: 1024, μ: 119778, ~: 119891)\nLogs:\n  Bound result 50314155\n\n[PASS] testFuzz_infiniteApprovalSurvivesTransfer(uint256) (runs: 1024, μ: 144662, ~: 144805)\nLogs:\n  Bound result 999999999999999999999999998\n\n[PASS] testFuzz_transferConservesSupply(address,uint256) (runs: 1024, μ: 93174, ~: 93330)\nLogs:\n  Bound result 49624821837878770998402752\n\n[PASS] testFuzz_transfersAboveSupplyRevert(uint256) (runs: 1024, μ: 59271, ~: 59601)\nLogs:\n  Bound result 115792089237316195423570985008687907853269984665639564039457584007913129640995\n\n[PASS] test_allowanceIsSpecificToSpender() (gas: 105742)\n[PASS] test_approveDoesNotRequireBalance() (gas: 78665)\n[PASS] test_approveEmitsEventAndReplacesAllowance() (gas: 119561)\n[PASS] test_approveZeroAddressReverts() (gas: 37745)\n[PASS] test_constructorEmitsExactlyOneMint() (gas: 9813)\n[PASS] test_constructorMintsToImmediateDeployer() (gas: 32742)\n[PASS] test_deployerCannotSpendUnapprovedHolderBalance() (gas: 95240)\n[PASS] test_factoryCreate2ReceivesWholeSupply() (gas: 297608)\n[PASS] test_factoryDistributionClaimsAndPoolTransfersArriveWhole() (gas: 639978)\n[PASS] test_metadataAndInitialSupply() (gas: 108583)\n[PASS] test_noMintBurnOrAdministrativeEntrypoints() (gas: 1559909)\n[PASS] test_plainEthAndUnknownCallsRevert() (gas: 61552)\n[PASS] test_revokedAllowanceCannotBeSpent() (gas: 131565)\n[PASS] test_selfTransferPreservesBalance() (gas: 53942)\n[PASS] test_selfTransferStillRequiresBalance() (gas: 36245)\n[PASS] test_transferEmitsEventAndMovesExactAmount() (gas: 91537)\n[PASS] test_transferEntireSupply() (gas: 161719)\n[PASS] test_transferExceedingBalanceRevertsWithoutChanges() (gas: 120352)\n[PASS] test_transferFromConsumesFiniteAllowance() (gas: 242162)\n[PASS] test_transferFromInsufficientAllowanceReverts() (gas: 116005)\n[PASS] test_transferFromInsufficientBalanceRestoresAllowance() (gas: 178819)\n[PASS] test_transferFromPreservesInfiniteAllowance() (gas: 207346)\n[PASS] test_transferFromToSelfConsumesAllowanceWithoutChangingBalance() (gas: 107559)\n[PASS] test_transferFromZeroRecipientRestoresAllowance() (gas: 114239)\n[PASS] test_transferToContractDoesNotCallRecipient() (gas: 174083)\n[PASS] test_transferToZeroRevertsEvenForZeroAmount() (gas: 72327)\n[PASS] test_zeroTransferFromEmptyAccountEmitsEvent() (gas: 73439)\n[PASS] test_zeroTransferFromNeedsNoPositiveAllowance() (gas: 81517)\nSuite result: ok. 33 passed; 0 failed; 0 skipped; finished in 82.01ms (391.15ms CPU time)\n\nRan 1 test for test/PAPERCLASH.invariant.t.sol:PAPERCLASHInvariantTest\n[PASS] invariant_supplyBalancesAndAllowancesMatchLedger() (runs: 256, calls: 16384, reverts: 0)\n\n╭--------------+-----------------+-------+---------+----------╮\n| Contract     | Selector        | Calls | Reverts | Discards |\n+=============================================================+\n| TokenHandler | approve         | 4112  | 0       | 0        |\n|--------------+-----------------+-------+---------+----------|\n| TokenHandler | approveInfinite | 4073  | 0       | 0        |\n|--------------+-----------------+-------+---------+----------|\n| TokenHandler | transfer        | 4103  | 0       | 0        |\n|--------------+-----------------+-------+---------+----------|\n| TokenHandler | transferFrom    | 4096  | 0       | 0        |\n╰--------------+-----------------+-------+---------+----------╯\n\nLogs:\n  Bound result 0\n  Bound result 0\n  Bound result 125000000000000000000\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 440046909273534668808600361\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 2459\n  Bound result 0\n  Bound result 0\n  Bound result 1000000000000000000\n  Bound result 0\n  Bound result 0\n  Bound result 2\n  Bound result 13\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 479211939656563121635859435\n  Bound result 3\n  Bound result 440046909273534668808600362\n  Bound result 0\n  Bound result 0\n  Bound result 100000000000000000000\n  Bound result 1000000000\n  Bound result 5173\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 6.71s (6.71s CPU time)\n\nRan 1 test for test/PAPERCLASH.adversarial.t.sol:PAPERCLASHAdversarialInvariantTest\n[PASS]\nPAPERCLASHAdversarialInvariantTest invariants:\n[PASS] invariant_ledgerMatchesAfterMixedSuccessAndFailure\n[PASS] invariant_metadataNeverChanges\n PAPERCLASHAdversarialInvariantTest invariants (runs: 256, calls: 16384, reverts: 0)\n\n╭--------------------+-------------------------------+-------+---------+----------╮\n| Contract           | Selector                      | Calls | Reverts | Discards |\n+=================================================================================+\n| AdversarialHandler | approve                       | 1702  | 0       | 0        |\n|--------------------+-------------------------------+-------+---------+----------|\n| AdversarialHandler | approveZero                   | 1640  | 0       | 0        |\n|--------------------+-------------------------------+-------+---------+----------|\n| AdversarialHandler | callPrivileged                | 1594  | 0       | 0        |\n|--------------------+-------------------------------+-------+---------+----------|\n| AdversarialHandler | overspendAllowance            | 1646  | 0       | 0        |\n|--------------------+-------------------------------+-------+---------+----------|\n| AdversarialHandler | overspendBalanceWithAllowance | 1708  | 0       | 0        |\n|--------------------+-------------------------------+-------+---------+----------|\n| AdversarialHandler | overspendTransfer             | 1628  | 0       | 0        |\n|--------------------+-------------------------------+-------+---------+----------|\n| AdversarialHandler | sendToZero                    | 1602  | 0       | 0        |\n|--------------------+-------------------------------+-------+---------+----------|\n| AdversarialHandler | transfer                      | 3238  | 0       | 0        |\n|--------------------+-------------------------------+-------+---------+----------|\n| AdversarialHandler | transferFrom                  | 1626  | 0       | 0        |\n╰--------------------+-------------------------------+-------+---------+----------╯\n\nLogs:\n  Bound result 6080\n  Bound result 7\n  Bound result 1878303205960209831710762154\n  Bound result 8\n  Bound result 115792089237316195423570985008687907853269984665640564039457584007913129639934\n  Bound result 115792089237316195423570985008687907853269984665640564039457584007913129639935\n  Bound result 7133\n  Bound result 9188\n  Bound result 17\n  Bound result 7\n  Bound result 8\n  Bound result 2\n  Bound result 0\n  Bound result 0\n  Bound result 1231162761171518387187028979\n  Bound result 40000000000000000000\n  Bound result 2\n  Bound result 0\n  Bound result 115792089237316195423570985008687907853269984665640564039457584007913129639933\n  Bound result 4647\n  Bound result 9\n  Bound result 115792089237316195423570985008687907853269984665640564039457584007913129639934\n  Bound result 0\n  Bound result 7133\n  Bound result 0\n  Bound result 436485174850447998581802986513358639813664115\n  Bound result 0\n  Bound result 0\n  Bound result 7133\n  Bound result 2309\n  Bound result 4\n  Bound result 0\n  Bound result 0\n  Bound result 2552851539\n  Bound result 1\n  Bound result 11\n  Bound result 1\n  Bound result 6\n  Bound result 3753\n  Bound result 0\n  Bound result 2742135629708560646234771023132040668428178740704687567975872126341567483000\n  Bound result 44095083117700579662406474119040682\n  Bound result 115792089237316195423570985008687907853269984665640564039457584007913129639921\n  Bound result 723\n  Bound result 0\n  Bound result 0\n  Bound result 3856\n  Bound result 16\n  Bound result 6110\n  Bound result 0\n  Bound result 0\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 7.84s (7.84s CPU time)\n\nRan 4 test suites in 7.85s (14.72s CPU time): 46 tests passed, 0 failed, 0 skipped (46 total tests)\n","passed":true},{"durationMs":50,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"PAPERCLASH.approve(address,uint256)\",\"PAPERCLASH.transfer(address,uint256)\",\"PAPERCLASH.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"DEPENDENCIES.md\":41,\"DEPENDENCIES.sha256\":36,\"README.md\":120,\"foundry.toml\":19,\"remappings.txt\":2,\"src/PAPERCLASH.sol\":18,\"test/PAPERCLASH.adversarial.t.sol\":342,\"test/PAPERCLASH.invariant.t.sol\":100,\"test/PAPERCLASH.t.sol\":403,\"test/helpers/TokenFactory.sol\":22},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"e17bbf9c6c31e86d38875ff04c9a2e802e74a9ca103a805f10d2b2be0ed97641","verifiedTreeHash":"22613823c104e4efa558797ec632e5e4dc2d9168","verifierVersion":"0.1.0+944e816a"},{"checks":[{"durationMs":1583,"exitCode":0,"name":"build","output":"Compiling 28 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.46s\nCompiler run successful!\n","passed":true},{"durationMs":6734,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 33 tests for test/PAPERCLASH.t.sol:PAPERCLASHTest\n[PASS] testFuzz_delegatedTransferConsumesOnlySpentAllowance(uint256,uint256) (runs: 1024, μ: 163362, ~: 165499)\nLogs:\n  Bound result 432815644766209452997154865\n  Bound result 53186489285493222462030313\n\n[PASS] testFuzz_delegatedTransferOverAllowanceReverts(uint256) (runs: 1024, μ: 119684, ~: 119879)\nLogs:\n  Bound result 2000172749579305120\n\n[PASS] testFuzz_infiniteApprovalSurvivesTransfer(uint256) (runs: 1024, μ: 144577, ~: 144805)\nLogs:\n  Bound result 2000172749579305120\n\n[PASS] testFuzz_transferConservesSupply(address,uint256) (runs: 1024, μ: 93051, ~: 93324)\nLogs:\n  Bound result 75689095\n\n[PASS] testFuzz_transfersAboveSupplyRevert(uint256) (runs: 1024, μ: 59273, ~: 59601)\nLogs:\n  Bound result 115792089237316195423570985008687907853269984665639564039580584007913129639935\n\n[PASS] test_allowanceIsSpecificToSpender() (gas: 105742)\n[PASS] test_approveDoesNotRequireBalance() (gas: 78665)\n[PASS] test_approveEmitsEventAndReplacesAllowance() (gas: 119561)\n[PASS] test_approveZeroAddressReverts() (gas: 37745)\n[PASS] test_constructorEmitsExactlyOneMint() (gas: 9813)\n[PASS] test_constructorMintsToImmediateDeployer() (gas: 32742)\n[PASS] test_deployerCannotSpendUnapprovedHolderBalance() (gas: 95240)\n[PASS] test_factoryCreate2ReceivesWholeSupply() (gas: 297608)\n[PASS] test_factoryDistributionClaimsAndPoolTransfersArriveWhole() (gas: 639978)\n[PASS] test_metadataAndInitialSupply() (gas: 108583)\n[PASS] test_noMintBurnOrAdministrativeEntrypoints() (gas: 1559909)\n[PASS] test_plainEthAndUnknownCallsRevert() (gas: 61552)\n[PASS] test_revokedAllowanceCannotBeSpent() (gas: 131565)\n[PASS] test_selfTransferPreservesBalance() (gas: 53942)\n[PASS] test_selfTransferStillRequiresBalance() (gas: 36245)\n[PASS] test_transferEmitsEventAndMovesExactAmount() (gas: 91537)\n[PASS] test_transferEntireSupply() (gas: 161719)\n[PASS] test_transferExceedingBalanceRevertsWithoutChanges() (gas: 120352)\n[PASS] test_transferFromConsumesFiniteAllowance() (gas: 242162)\n[PASS] test_transferFromInsufficientAllowanceReverts() (gas: 116005)\n[PASS] test_transferFromInsufficientBalanceRestoresAllowance() (gas: 178819)\n[PASS] test_transferFromPreservesInfiniteAllowance() (gas: 207346)\n[PASS] test_transferFromToSelfConsumesAllowanceWithoutChangingBalance() (gas: 107559)\n[PASS] test_transferFromZeroRecipientRestoresAllowance() (gas: 114239)\n[PASS] test_transferToContractDoesNotCallRecipient() (gas: 174083)\n[PASS] test_transferToZeroRevertsEvenForZeroAmount() (gas: 72327)\n[PASS] test_zeroTransferFromEmptyAccountEmitsEvent() (gas: 73439)\n[PASS] test_zeroTransferFromNeedsNoPositiveAllowance() (gas: 81517)\nSuite result: ok. 33 passed; 0 failed; 0 skipped; finished in 40.52ms (195.01ms CPU time)\n\nRan 1 test for test/PAPERCLASH.invariant.t.sol:PAPERCLASHInvariantTest\n[PASS] invariant_supplyBalancesAndAllowancesMatchLedger() (runs: 256, calls: 16384, reverts: 0)\n\n╭--------------+-----------------+-------+---------+----------╮\n| Contract     | Selector        | Calls | Reverts | Discards |\n+=============================================================+\n| TokenHandler | approve         | 4112  | 0       | 0        |\n|--------------+-----------------+-------+---------+----------|\n| TokenHandler | approveInfinite | 4073  | 0       | 0        |\n|--------------+-----------------+-------+---------+----------|\n| TokenHandler | transfer        | 4103  | 0       | 0        |\n|--------------+-----------------+-------+---------+----------|\n| TokenHandler | transferFrom    | 4096  | 0       | 0        |\n╰--------------+-----------------+-------+---------+----------╯\n\nLogs:\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 6411\n  Bound result 0\n  Bound result 0\n  Bound result 3620\n  Bound result 1586\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 2\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 870845259297991817456551977\n  Bound result 8\n  Bound result 5205\n  Bound result 2\n  Bound result 0\n  Bound result 0\n  Bound result 1000000000\n  Bound result 0\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 6.59s (6.59s CPU time)\n\nRan 2 test suites in 6.60s (6.63s CPU time): 34 tests passed, 0 failed, 0 skipped (34 total tests)\n","passed":true},{"durationMs":47,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"PAPERCLASH.approve(address,uint256)\",\"PAPERCLASH.transfer(address,uint256)\",\"PAPERCLASH.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"DEPENDENCIES.md\":41,\"DEPENDENCIES.sha256\":36,\"README.md\":120,\"foundry.toml\":19,\"launch.json\":24,\"remappings.txt\":2,\"src/PAPERCLASH.sol\":18,\"test/PAPERCLASH.invariant.t.sol\":100,\"test/PAPERCLASH.t.sol\":403,\"test/helpers/TokenFactory.sol\":22},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"fddf19e960a633f223f8eef0367e95b9f99e05298f8e4dc2e9e6f63244c20d38","verifiedTreeHash":"5ad61efad39879c2658b7e1f4c73b6d2dc8a9381","verifierVersion":"0.1.0+944e816a"}]}