{"assessments":[],"deployments":[{"attestationHash":"c7a198d6a12da949d318918ca72a5b91a58bede5e79859ecd4f8327c6ef024e8","chainId":1,"contracts":[{"address":"0x2af8144176bdf18117ad3d2bb15135cf5386107a","blockNumber":26272127,"name":"YOLO","role":"token","txHash":"0xc1e28b52f2fead2ab9775205688eb5012deb2cb5fc24ed0f1ed47f7fe41e8fda"},{"address":"0x784ff9a3ac5d88a30bfff6f7f2a270161fbe6000","blockNumber":26272127,"name":"PoolInitializationGuard","role":"hook","txHash":"0xc1e28b52f2fead2ab9775205688eb5012deb2cb5fc24ed0f1ed47f7fe41e8fda"},{"address":"0xf605fd847887a029cda243d28e5b586b647d5b84","blockNumber":26272127,"name":"MerkleDistributor","role":"distributor","txHash":"0xc1e28b52f2fead2ab9775205688eb5012deb2cb5fc24ed0f1ed47f7fe41e8fda"}],"id":"7d0543a0-3e27-4ca0-bacc-df4ef932f581","manifestHash":"ae1f4a926513830d8fb37998d03a417e5ae4673af2747a8c8ceab48772a01714","status":"live"}],"fuzz":[],"identity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"interpretation":"Records acceptance and evidence. Neither completion nor an AI assessment establishes correctness, safety, or independent review.","jobId":"63828c99-fb02-4c9f-96fa-26c4b1923dc0","kind":"shape:chain","nodes":[{"acceptedSubmissionHash":"e4733974fadcf82f4e6cac807acd22a306e13ec004e78bc68af126f6835b2edb","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"bc5bfc8455464381f2db18badb2b55cf8bec1e535c019349a0378fa990741171","skillId":"audit-specialist","subagents":3,"tools":[]},"key":"audit_economics","kind":"code","role":"review","skillHash":"bc5bfc8455464381f2db18badb2b55cf8bec1e535c019349a0378fa990741171","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"a7377d5fc5e3f566723ec802b92a2e79b5be3f56f7e7e1fb6417dc892d1574fc","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"bc5bfc8455464381f2db18badb2b55cf8bec1e535c019349a0378fa990741171","skillId":"audit-specialist","subagents":3,"tools":[]},"key":"audit_flow","kind":"code","role":"review","skillHash":"bc5bfc8455464381f2db18badb2b55cf8bec1e535c019349a0378fa990741171","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"798981dc8fb66856def3cbd1e0ce0456bde7d2a6489d4a085002305260bf8463","dependsOn":["build_contract_project","write_foundry_tests","manifest","audit_math","audit_permissions","audit_economics","audit_flow"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"b89279670f5a00f5d26286edee00c97dd158b997031350a01cafe6e0329ad227","skillId":"audit-judge","subagents":4,"tools":[]},"key":"audit_judge","kind":"code","role":"review","skillHash":"b89279670f5a00f5d26286edee00c97dd158b997031350a01cafe6e0329ad227","skillId":"audit-judge","state":"accepted"},{"acceptedSubmissionHash":"237cd9aac449fe8254e27d44d361d608d188a0145669c33b1cdd5b89b9522ccd","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"bc5bfc8455464381f2db18badb2b55cf8bec1e535c019349a0378fa990741171","skillId":"audit-specialist","subagents":3,"tools":[]},"key":"audit_math","kind":"code","role":"review","skillHash":"bc5bfc8455464381f2db18badb2b55cf8bec1e535c019349a0378fa990741171","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"d23ddf3009dbd3365827ee53c3f9913291d36a9f07fb4136a190171268068d23","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"bc5bfc8455464381f2db18badb2b55cf8bec1e535c019349a0378fa990741171","skillId":"audit-specialist","subagents":3,"tools":[]},"key":"audit_permissions","kind":"code","role":"review","skillHash":"bc5bfc8455464381f2db18badb2b55cf8bec1e535c019349a0378fa990741171","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"fbec802950dea55ecff9a388855f7f36c8dfb78f43f1704f4f6212b75269855f","dependsOn":[],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"816fe39c7efd64504a19175b0f4dd9186d61069f37a22684c90358a18c60bddc","skillId":"build-contract-project","tools":[]},"key":"build_contract_project","kind":"code","role":"implement","skillHash":"816fe39c7efd64504a19175b0f4dd9186d61069f37a22684c90358a18c60bddc","skillId":"build-contract-project","state":"accepted"},{"acceptedSubmissionHash":"46f9f75b7f2c7013bd1fab494bb94d0d583c5a9310a6a4e0ea3a802097b80858","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"tools":[]},"key":"manifest","kind":"code","role":"integrate","skillHash":null,"skillId":null,"state":"accepted"},{"acceptedSubmissionHash":"f0567a5d2adf30cc1f9bb9d2f31dafe1d0a3c36ffc60693a2da271ecfe9b0afc","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"606842ccca0e7c5d3017a54684625438eab9b351eb51dcf0cf88c43d1ea41464","skillId":"write-foundry-tests","subagents":4,"tools":[]},"key":"write_foundry_tests","kind":"code","role":"tests","skillHash":"606842ccca0e7c5d3017a54684625438eab9b351eb51dcf0cf88c43d1ea41464","skillId":"write-foundry-tests","state":"accepted"}],"objective":"A custom token: YOLO (YOLO).\nToken name: YOLO\nToken symbol: YOLO\nToken supply: 1,000,000,000 with 18 decimals, all minted once to the deployer in the constructor.","parentJobId":null,"planHash":"ed689552a687c014d352d24110a3954c6badc14f4729b9ddd87c7db71a071d67","previousHash":"54fa639cb552d6709f7e272eef6f4b22786341ba54fc1938e1283ed09454d4a2","projectId":"63828c99-fb02-4c9f-96fa-26c4b1923dc0","publication":{"commit":"bd97a0e9b75c417c88b3e7d48e8e4c88a56a4172","deliveredAt":"2026-10-25T20:36:44.347Z","repoUrl":"https://github.com/identity-md-launches/launch-2583-yolo"},"receiptIdentity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"registry":"0xb6d0a187b050fa5bb0b87033a203f37becf4a775","research":[],"schema":"identitymd-work-v1","signals":[],"site":null,"snapshotHash":"ec6cd27bba2b54be4e6792acec2566ff077f7e5f1ba8764464ca7152aed3143e","state":"completed","submissions":[{"artifacts":[],"attempt":1,"bundleHash":null,"device":"ea89e16822824c6f","findings":[],"hash":"05305317333769225abc12422bc59e85a75cd99329d223f40eaf62965bf97e60","nodeId":"eb3ea74c-c017-4f77-adfc-1cbeee515e9a","outcome":"failed","summary":"Failed to authenticate: OAuth session expired and could not be refreshed","treeHash":null,"usage":{"cachedInputTokens":0,"inputTokens":0,"model":null,"outputTokens":0,"runtime":"claude","turns":1,"wallClockMs":2107}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"5ded77c3c883b7b0","findings":[{"citation":"resolved","description":"README.md lists `sha256sum --check DEPENDENCIES.sha256` as one of the four build-and-check steps, and DEPENDENCIES.md (line 24) states forge-std is 'unmodified upstream src/'. On the tree as submitted the check fails for seven files: lib/forge-std/src/StdAssertions.sol, StdJson.sol, StdToml.sol, Vm.sol, console.sol, interfaces/IERC7540.sol and interfaces/IMulticall3.sol. The hashes recorded in DEPENDENCIES.sha256 are the genuine upstream v1.9.7 hashes (for example 6620d9c5...342e3 for interfaces/IMulticall3.sol matches the raw file at the v1.9.7 tag), but the files in lib/ have been re-wrapped by a formatter (e.g. the one-line `aggregate(...)` declaration became a four-line one; `diff -w` and plain `diff` give identical line counts, so the change is line wrapping only). Impact is limited: the seven files are test-only, the OpenZeppelin ERC20 closure (ERC20.sol, IERC20.sol, IERC20Metadata.sol, Context.sol, draft-IERC6093.sol) matches upstream v5.1.0 byte for byte, and the token's bytecode is unaffected. But the deliverable's own provenance claim is false and its documented verification step is red, which a reviewer following the README will treat as tampering. Fix: either restore the seven files from the v1.9.7 archive (and exclude lib/ from `forge fmt`), or regenerate DEPENDENCIES.sha256 from the tree and amend DEPENDENCIES.md to say the files are reformatted.","line":59,"path":"README.md","reproduction":"From the repository root run `sha256sum --check DEPENDENCIES.sha256`. Expected (per README.md line 59 and DEPENDENCIES.md line 24): every line `OK`, exit code 0. Actual: `lib/forge-std/src/StdAssertions.sol: FAILED`, `StdJson.sol: FAILED`, `StdToml.sol: FAILED`, `Vm.sol: FAILED`, `console.sol: FAILED`, `interfaces/IERC7540.sol: FAILED`, `interfaces/IMulticall3.sol: FAILED`, `sha256sum: WARNING: 7 computed checksums did NOT match`, exit code 1. Cross-check: `sha256sum lib/forge-std/src/interfaces/IMulticall3.sol` gives 1b63ca78...053b while DEPENDENCIES.sha256 line 29 and the upstream v1.9.7 file both give 6620d9c5...342e3.","severity":"low","snippet":"sha256sum --check DEPENDENCIES.sha256","title":"Documented dependency integrity check fails: 7 vendored forge-std files do not match DEPENDENCIES.sha256 or upstream v1.9.7"}],"hash":"237cd9aac449fe8254e27d44d361d608d188a0145669c33b1cdd5b89b9522ccd","nodeId":"392438a4-3840-485e-a6ea-85285d2f7a68","outcome":"completed","summary":"The review is complete. `.imd-findings.json` holds one low finding and eight coverage rows; the working tree is otherwise untouched.\n\n**Math area verdict: clean.** YOLO is OpenZeppelin v5.1.0 `ERC20` plus one constructor mint, and the vendored ERC20 closure matches upstream byte for byte. There is no division, scaling, downcast, fee or external call anywhere in the token, so the Math Precision, Boundary and Numerical Gap failure modes have nothing to attach to. I confirmed the edges directly with a scratch Foundry test, since removed:\n\n- Supply constant is exactly 1e27 and equals one billion times ten to the `decimals()` power.\n- Transfers at balance, balance plus one, zero and max uint behave as documented, from both full and empty accounts.\n- Allowance at max is infinite, at max minus one is finite and decrements, and a failed transfer rolls the allowance back.\n- Every basis-point split of 1e27 is exact, so the swarm's 10% and any pool share leave no dust.\n- Sum of balances equals total supply under fuzzing, and the project's own 256 by 64 stateful invariant run passes.\n- No payable, receive or fallback path exists; ETH sent with any calldata reverts.\n\nThe aderyn \"large numeric literal\" lead is cosmetic: the constant is compile-time checked and correct.\n\n**One finding, outside my area, low severity.** The README documents `sha256sum --check DEPENDENCIES.sha256` as a build step and DEPENDENCIES.md claims forge-std is unmodified upstream. Both are false on the submitted tree: seven forge-std files were re-wrapped by a formatter after the hash file was written, so the check reports seven failures and exits nonzero. The recorded hashes are the genuine v1.9.7 ones. The files are test-only and the token bytecode is unaffected, but the deliverable's provenance claim does not hold. The fix is to restore the files from the v1.9.7 archive or regenerate the hashes and amend the note.\n\nAll three ABI entry points are marked `holds`, with extra rows for the constructor, the conservation invariant, launch split arithmetic, boundary classes and metadata. Nothing in my area was left unreached.","treeHash":null,"usage":{"cachedInputTokens":339646,"inputTokens":194,"model":"claude-fable-5-1","outputTokens":13163,"runtime":"claude","turns":21,"wallClockMs":202195}},{"artifacts":[],"attempt":1,"bundleHash":"6849b028c4988b602ec1f5981c623260c5274ed51a9fd8c4c8608d1c4b1d86c8","device":"1731fbfe0c4574fb","findings":[],"hash":"46f9f75b7f2c7013bd1fab494bb94d0d583c5a9310a6a4e0ea3a802097b80858","nodeId":"a0a594b5-9721-463c-86fa-47a5a1811096","outcome":"completed","summary":"`launch.json` is written and verified. It is the only new file in the tree.\n\n**What the manifest says**\n- Kind `custom_token`, token contract `YOLO`, name and symbol YOLO, 18 decimals.\n- Constructor arguments are an empty list. The compiled ABI confirms the constructor takes no parameters.\n- Total supply is the constructor's single mint to msg.sender, 10^27 minor units, matching the `INITIAL_SUPPLY` constant.\n- No application contracts, since the accepted tree contains only the token.\n- Pool and economics objects are copied exactly as the launch defines them: IMD pair, fee 12500, tick spacing 60, the one-to-one provenance price, and the requester's 60% pool / 2,300 IMD cap / remainder address.\n- Notes describe the token's fixed supply, full-value transfers, and absence of any privileged functions, at 962 characters.\n\n**Checks run**\n- `forge build` compiled cleanly with solc 0.8.26.\n- `forge test` with the verifier's fuzz seed passed all 29 tests across 3 suites, including the two stateful invariants.\n- A script confirmed the manifest has only the six schema keys, the supply string equals 1,000,000,000 times 10^18, and pool and economics match the job verbatim.\n- `git status` shows only the untracked `launch.json`. No other file was touched.\n\nThe protected tests run in the verifier's own harness with resolved launch environment variables, so they were read rather than executed here. The token's plain OpenZeppelin ERC-20 behavior satisfies each of their requirements: whole supply to the factory, untaxed transfers, no supply growth, no privileged calls, and no DELEGATECALL, CALLCODE or SELFDESTRUCT.","treeHash":"d21b46e05b81a97526d7887acae3b4d49e9b2a3e","usage":{"cachedInputTokens":165827,"inputTokens":162,"model":"claude-fable-5-1","outputTokens":3614,"runtime":"claude","turns":11,"wallClockMs":95579}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"a8006a8757108cd3","findings":[{"citation":"resolved","description":"README.md line 59 lists `sha256sum --check DEPENDENCIES.sha256` as a build-and-check step, and DEPENDENCIES.md line 24 states forge-std v1.9.7 is vendored as 'unmodified upstream `src/`'. On the tree as submitted (HEAD 8887f54, clean) that check fails for 7 of 36 entries, all test-only forge-std sources: lib/forge-std/src/StdAssertions.sol, StdJson.sol, StdToml.sol, Vm.sol, console.sol, interfaces/IERC7540.sol and interfaces/IMulticall3.sol. I reproduced it: the hashes recorded in DEPENDENCIES.sha256 are the genuine upstream v1.9.7 hashes (fetched Vm.sol and IMulticall3.sol from the v1.9.7 tag: 9068805b... and 6620d9c5..., matching lines 18 and 29 of the hash file), while the vendored copies hash to a1b1c829... and 1b63ca78.... Stripping all whitespace from each of the seven vendored files and its upstream counterpart yields identical bytes, so the difference is formatter line-wrapping only; no token, literal or statement changed. The five OpenZeppelin v5.1.0 files that form YOLO's entire production dependency closure (ERC20.sol, IERC20.sol, IERC20Metadata.sol, Context.sol, draft-IERC6093.sol) match both the hash file and the upstream tag byte for byte, forge build succeeds and all 48 tests pass. Impact is confined to the deliverable's provenance claim: the documented verification step is red and the 'unmodified' statement is false, so an operator following the README cannot distinguish this benign reformat from a tampered test harness without repeating the upstream comparison. No change to src/YOLO.sol is needed. Fix: restore the seven files from the v1.9.7 archive (and keep `forge fmt` off lib/), or regenerate DEPENDENCIES.sha256 from the tree and amend DEPENDENCIES.md line 24 to say the forge-std sources are reformatted but content-identical. Three specialists reported this same root cause; it is one finding, kept at low.","line":59,"path":"README.md","reproduction":"State: fresh checkout of HEAD 8887f54, git status clean. From the repository root run `sha256sum --check DEPENDENCIES.sha256`. Expected (README.md:59, DEPENDENCIES.md:24-27): every line OK, exit status 0. Actual: 29 lines OK, then `lib/forge-std/src/StdAssertions.sol: FAILED`, `lib/forge-std/src/StdJson.sol: FAILED`, `lib/forge-std/src/StdToml.sol: FAILED`, `lib/forge-std/src/Vm.sol: FAILED`, `lib/forge-std/src/console.sol: FAILED`, `lib/forge-std/src/interfaces/IERC7540.sol: FAILED`, `lib/forge-std/src/interfaces/IMulticall3.sol: FAILED`, `sha256sum: WARNING: 7 computed checksums did NOT match`, exit status 1. Cause: `sha256sum lib/forge-std/src/Vm.sol` = a1b1c82924aecf0f38b53192fd1e801cccc1e1fd2ecd6b2301e4f4c4ab102a15, while DEPENDENCIES.sha256 line 18 records 9068805b59ac1d0ea03a8fa1f15ae49c094e0c6c852a2500e0dd112f264b2cb1, which is the sha256 of https://raw.githubusercontent.com/foundry-rs/forge-std/v1.9.7/src/Vm.sol. `tr -d ' \\t\\n\\r' < lib/forge-std/src/Vm.sol | sha256sum` equals the same command on the upstream file, for all seven files, so only whitespace differs. The OpenZeppelin entries all report OK and match upstream v5.1.0 byte for byte.","severity":"low","snippet":"sha256sum --check DEPENDENCIES.sha256","title":"Documented dependency integrity check fails: seven vendored forge-std files do not match DEPENDENCIES.sha256 or the 'unmodified upstream' v1.9.7 claim (merged from audit_flow, audit_permissions, audit"}],"hash":"798981dc8fb66856def3cbd1e0ce0456bde7d2a6489d4a085002305260bf8463","nodeId":"25722273-c4f5-4c75-9f64-c745ff0a598b","outcome":"completed","summary":"The review is complete and written to `.imd-findings.json`. No tracked file was changed.\n\n**Outcome:** the token is clean. The YOLO contract in `src/YOLO.sol` is an unmodified OpenZeppelin v5.1.0 ERC20 with a no-argument constructor that mints exactly one billion tokens with 18 decimals to the deployer. I confirmed the five OpenZeppelin files match the upstream tag byte for byte, the build succeeds, all 48 project tests pass, and the bytecode is far under the size limits with no delegatecall or selfdestruct. The manifest's constructor arguments, supply and decimals agree with the code.\n\n**Findings kept: one, at low.** Three specialists reported the same root cause and I merged them.\n\n- **Documented hash check fails.** Running the `sha256sum --check` step the README names reports seven forge-std files as mismatched. The recorded hashes are the genuine upstream v1.9.7 hashes. The vendored copies differ only by whitespace, which I verified by stripping whitespace from both sides and comparing. These files are test-only and the token is unaffected, so the defect is a false provenance claim, not a security issue. The fix is to restore the seven files or regenerate the hash file and amend the dependency note.\n\n**Dropped or absent:** the test writer and the economics specialist reported nothing, and the static-analysis lead about the large numeric literal checked out as correct.\n\n**Coverage:** all three entry points hold, plus three invariant rows for the supply, deployability under the launch floor, and the static-analysis lead. No proofs were attached since nothing reached high or critical.","treeHash":null,"usage":{"cachedInputTokens":281439,"inputTokens":162,"model":"claude-fable-5-1","outputTokens":6959,"runtime":"claude","turns":10,"wallClockMs":103486}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"b273d407784470b4","findings":[{"citation":"resolved","description":"DEPENDENCIES.md (line 24) states the vendored lib/forge-std/src is the unmodified upstream v1.9.7 tree, and both DEPENDENCIES.md (line 27) and README.md (line 59) instruct the launch operator to verify the tree with `sha256sum --check DEPENDENCIES.sha256`. That command fails on the tree as submitted: seven forge-std files (src/StdAssertions.sol, src/StdJson.sol, src/StdToml.sol, src/Vm.sol, src/console.sol, src/interfaces/IERC7540.sol, src/interfaces/IMulticall3.sol) hash differently from the values recorded in DEPENDENCIES.sha256. I fetched the same seven files from the upstream v1.9.7 tag: the recorded hashes are the genuine upstream hashes, so it is the vendored copies that were altered after the hash file was written. Stripping all whitespace from both versions gives identical content for every file, so the change is formatting only (the files look re-wrapped by a formatter, e.g. multi-line function signatures and the console staticcall block collapsed onto single lines) and the test behaviour is unaffected; this is why forge build and all 29 tests still pass. The five OpenZeppelin v5.1.0 files (ERC20.sol, IERC20.sol, IERC20Metadata.sol, Context.sol, draft-IERC6093.sol) match both DEPENDENCIES.sha256 and the upstream tag byte for byte, so the production dependency closure of YOLO is genuinely unmodified. Impact is limited to the deliverable's own provenance story: the documented verification step is red, the 'unmodified upstream' claim is false for forge-std, and an operator following the README cannot distinguish this harmless reformatting from a deliberate edit to the test harness without doing the upstream comparison themselves. Fix: either restore the seven files from the v1.9.7 archive (so the existing hash file and the 'unmodified' statement become true), or regenerate DEPENDENCIES.sha256 from the tree and amend DEPENDENCIES.md to say the forge-std sources are reformatted but content-identical to v1.9.7. No change to src/YOLO.sol is needed.","line":24,"path":"DEPENDENCIES.md","reproduction":"From the repository root run `sha256sum --check DEPENDENCIES.sha256`. Expected (per README.md line 59 and DEPENDENCIES.md line 27): every line reports OK and the exit status is 0. Actual: exit status 1 with `sha256sum: WARNING: 7 computed checksums did NOT match`, the failing entries being lib/forge-std/src/StdAssertions.sol, StdJson.sol, StdToml.sol, Vm.sol, console.sol, interfaces/IERC7540.sol and interfaces/IMulticall3.sol. For example DEPENDENCIES.sha256 line 18 records 9068805b59ac1d0ea03a8fa1f15ae49c094e0c6c852a2500e0dd112f264b2cb1 for lib/forge-std/src/Vm.sol (which is the hash of upstream v1.9.7 src/Vm.sol), while `sha256sum lib/forge-std/src/Vm.sol` on the tree gives a1b1c82924aecf0f38b53192fd1e801cccc1e1fd2ecd6b2301e4f4c4ab102a15. `diff` against upstream v1.9.7 shows whitespace/line-wrapping changes only (e.g. `getDeployment(...)` and `parseJsonAddressArray(...)` signatures joined onto one line); removing all whitespace from both copies yields identical bytes for all seven files.","severity":"low","snippet":"- Scope: unmodified upstream `src/` plus both license files; used by tests only.","title":"Documented dependency integrity check fails: 7 vendored forge-std files do not match DEPENDENCIES.sha256 or the stated 'unmodified upstream' v1.9.7 sources"}],"hash":"a7377d5fc5e3f566723ec802b92a2e79b5be3f56f7e7e1fb6417dc892d1574fc","nodeId":"0b4d2d7e-07d5-4b92-b192-135bcfb52631","outcome":"completed","summary":"Review complete. The findings file is written and validated, and the working tree holds only `.imd-findings.json` beyond the original commit.\n\n**Outcome:** the YOLO token itself is clean in my area. The one defect found is a low-severity provenance issue in the vendored test dependency.\n\n**What I checked (Execution Trace, Periphery, First Principles):**\n- `src/YOLO.sol` is a 17-line contract: unmodified OpenZeppelin v5.1.0 ERC20 plus a constructor that mints 1e27 units to msg.sender. I traced approve, transfer and transferFrom through `_approve`, `_spendAllowance`, `_transfer` and `_update` for sentinel inputs, zero and max amounts, partial-update and stale-read paths. All failure paths revert atomically and there are no external calls, callbacks, hooks or admin surface.\n- Periphery: I hashed the five vendored OpenZeppelin files against the upstream v5.1.0 tag. They match byte for byte, so the production dependency closure is genuinely unmodified.\n- First principles: supply constant equals 1,000,000,000 × 10^18, decimals default to 18, name and symbol are YOLO, the whole supply lands on the immediate deployer under CREATE2, and launch flows (factory to distributor, claims, pool round trips via transfer and transferFrom) move exact amounts. A scratch Foundry probe confirmed these plus the rejection of 22 common mint, pause, freeze and seize selectors from both a stranger and the deployer, and an opcode scan of the runtime found no DELEGATECALL, CALLCODE, SELFDESTRUCT or CALL.\n- The project's own 29 tests, fuzz and invariants pass with the README's seed, and `forge fmt --check` passes.\n\n**Finding (low):** the README and DEPENDENCIES.md tell the operator to run `sha256sum --check DEPENDENCIES.sha256`, and that command fails with seven mismatches in `lib/forge-std/src`. The recorded hashes are the real upstream v1.9.7 hashes. The vendored copies were reformatted after the hash file was written. Content is identical once whitespace is removed, so behaviour is unaffected, but the documented integrity step is red and the \"unmodified upstream\" claim is false for forge-std. Fix by restoring the seven files from the v1.9.7 archive or regenerating the hash file and amending the note.\n\n**Coverage:** all three listed entry points plus the constructor and four invariant or periphery rows are recorded as holds, with the forge-std row pointing at finding 1. Nothing in my area was left unreached. The protected launch test's pool seed and swap paths need the network harness and v4-core sources that are not in this tree, so I could not execute them here. The token has no fee or hook logic that could affect them.","treeHash":null,"usage":{"cachedInputTokens":739540,"inputTokens":354,"model":"claude-fable-5-1","outputTokens":16466,"runtime":"claude","turns":32,"wallClockMs":253541}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"2ab0b432477fde6c","findings":[{"citation":"resolved","description":"README.md lists `sha256sum --check DEPENDENCIES.sha256` as one of the four build-and-check steps and DEPENDENCIES.md says the file records the hash of every vendored file so their integrity can be verified. On the committed tree (HEAD b409286, clean working copy) the check fails for 7 of the 33 vendored files, all under lib/forge-std/src/: StdAssertions.sol, StdJson.sol, StdToml.sol, Vm.sol, console.sol, interfaces/IERC7540.sol, interfaces/IMulticall3.sol. The recorded hashes (e.g. DEPENDENCIES.sha256:18, 9068805b... for Vm.sol) are the hashes of upstream forge-std v1.9.7, which I confirmed by fetching those files from the v1.9.7 tag. The committed copies differ from upstream only by formatter line-reflows (multi-line function signatures joined onto one line, console.sol's assembly block reflowed): `diff -w -B` still reports differences because line structure changed, but no token, identifier, literal or statement differs. So the test-only dependency is semantically intact and the token itself is unaffected; the OpenZeppelin files (the token's whole dependency closure) are byte-identical to upstream v5.1.0 and pass the check. The defect is that the deliverable's own provenance claim is false as shipped: a verifier or auditor who runs the documented step gets 'WARNING: 7 computed checksums did NOT match' and cannot distinguish this benign reformat from a tampered library without doing the upstream diff themselves. Fix: either regenerate DEPENDENCIES.sha256 from the committed files (and note in DEPENDENCIES.md that forge-std was reformatted), or restore the seven files to their upstream bytes so the recorded hashes hold. This is outside the permissions area and has no security impact on YOLO; it is reported because it is a reproducible defect in the deliverable's stated checks.","line":59,"path":"README.md","reproduction":"State: fresh checkout of HEAD b409286 (git status clean). Run from the repository root: `sha256sum --check DEPENDENCIES.sha256`. Expected (per README.md:59 and DEPENDENCIES.md): every line OK, exit 0. Actual: 26 OK, then `lib/forge-std/src/StdAssertions.sol: FAILED`, `lib/forge-std/src/StdJson.sol: FAILED`, `lib/forge-std/src/StdToml.sol: FAILED`, `lib/forge-std/src/Vm.sol: FAILED`, `lib/forge-std/src/console.sol: FAILED`, `lib/forge-std/src/interfaces/IERC7540.sol: FAILED`, `lib/forge-std/src/interfaces/IMulticall3.sol: FAILED`, `sha256sum: WARNING: 7 computed checksums did NOT match`, exit 1. Confirming the cause: `sha256sum lib/forge-std/src/Vm.sol` prints a1b1c82924aecf0f38b53192fd1e801cccc1e1fd2ecd6b2301e4f4c4ab102a15 while DEPENDENCIES.sha256:18 records 9068805b59ac1d0ea03a8fa1f15ae49c094e0c6c852a2500e0dd112f264b2cb1, which is the sha256 of https://raw.githubusercontent.com/foundry-rs/forge-std/v1.9.7/src/Vm.sol. `git show HEAD:lib/forge-std/src/Vm.sol | sha256sum` also gives a1b1c8..., so the mismatch is in the committed tree, not a local modification.","severity":"low","snippet":"sha256sum --check DEPENDENCIES.sha256","title":"Documented dependency integrity check fails on the committed tree: seven vendored forge-std files do not match DEPENDENCIES.sha256"}],"hash":"d23ddf3009dbd3365827ee53c3f9913291d36a9f07fb4136a190171268068d23","nodeId":"ed162d91-d1fc-4b6f-9ee2-26989a7820a6","outcome":"completed","summary":"The review is complete and the findings file is written and validated. The working tree is otherwise unchanged.\n\n**Outcome.** The YOLO token's permission model is clean. It is OpenZeppelin v5.1.0 ERC-20, byte-identical to upstream, plus a constructor that mints 1e27 units once to the deployer. There are no roles, owner, initializer, proxy, hooks, fee exemptions or callbacks, so none of the Access Control, Trust Gap or Asymmetry failure modes have a surface to attach to.\n\n**What I checked in my area**\n\n- **Access Control:** every storage writer is one of approve, transfer or transferFrom, each guarded only by msg.sender or allowance, with no second writer to any slot. Fourteen admin-style selectors called from the deployer and from a stranger all revert with empty returndata. Reachable runtime code contains no DELEGATECALL, CALLCODE or SELFDESTRUCT.\n- **Trust Gap:** no privileged actor exists, so no access-times-economics seam is possible. The factory holds the whole supply after construction and has no power over holders beyond ordinary ERC-20 rules. The deployer's transferFrom without allowance reverts.\n- **Asymmetry:** transfer and transferFrom with max allowance leave identical balances and supply. approve and transferFrom mirror each other correctly. The one inherent ERC-20 approve front-run is possible and is already documented in the README.\n\n**One finding, low severity, outside my area.** The README's documented step `sha256sum --check DEPENDENCIES.sha256` fails on the committed tree. Seven forge-std files were reformatted after their hashes were recorded. I confirmed the recorded hashes are upstream v1.9.7 and the committed files differ only by line reflows, so the test library is semantically intact and the token is unaffected. The deliverable's provenance claim is nonetheless false as shipped. The fix is to regenerate the hash file or restore the upstream bytes.\n\n**Coverage.** All three listed entry points hold, plus rows for the constructor and four invariants. The full project suite passed under the README's fuzz seed. The protected launch harness could not run here because it depends on v4-core sources not in this tree, so I mirrored its opcode and privilege checks in a scratch test, which passed, and then removed it.","treeHash":null,"usage":{"cachedInputTokens":629355,"inputTokens":290,"model":"claude-fable-5-1","outputTokens":15033,"runtime":"claude","turns":28,"wallClockMs":249519}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"7cb215928f3c9473","findings":[],"hash":"e4733974fadcf82f4e6cac807acd22a306e13ec004e78bc68af126f6835b2edb","nodeId":"2ba20b26-bd6c-45bf-b686-dd93c8009d4b","outcome":"completed","summary":"I found no economic defects, so I wrote `.imd-findings.json` with an empty findings list and a coverage row for each of the three entry points, all marked `holds`.\n\n**What the code is:** `src/YOLO.sol` is the unchanged OpenZeppelin v5.1.0 `ERC20` with nothing overridden. Its constructor mints `INITIAL_SUPPLY = 1_000_000_000 * 10 ** 18` (10^27) to `msg.sender`, which is the factory, once. It has no mint, burn, owner, pause, fee or upgrade function and no constructor arguments. The OpenZeppelin files match their recorded checksums.\n\n**Economic Security, Invariant and Flow Gap passes:**\n- **Supply:** the only mint is in the constructor and nothing can call one later, so the supply can't grow. It stays exactly what the manifest states and lands at the factory.\n- **Launch flows:** no code runs on transfer. The swarm's 10% to the distributor, each claim, the pool seed, the remainder and trades through the PoolManager each move exactly the amount stated. Nothing depends on `distributorOf`.\n- **Allowances:** `transferFrom` takes exactly the amount from the allowance (an unlimited allowance stays unlimited), then makes the same exact move. Nothing can move or freeze a holder's balance without their approval.\n- **Value extraction:** with no fees, burns or price inputs, there is nothing to sandwich or round against.\n- **Checks run:** the project's 29 tests pass, including the invariant suite of 256 runs and 16,384 calls. I could not run the protected floor test, because it needs the deployer's environment variables and floor files that aren't on this machine.\n- **Static analysis:** the aderyn lead (large numeric literal at `src/YOLO.sol:12`) is style only; the value is correct at 10^27.\n\n**Outside my area (not reported as a finding):** 7 vendored forge-std files don't match `DEPENDENCIES.sha256`, though `DEPENDENCIES.md` says they're unmodified. They're used only by tests and don't affect the deployed bytecode, but the integrity claim in `DEPENDENCIES.md` is wrong.\n\nA clean review doesn't prove the code has no defects.","treeHash":null,"usage":{"cachedInputTokens":172781,"inputTokens":12,"model":"claude-opus-5-5","outputTokens":2605,"runtime":"claude","turns":6,"wallClockMs":45415}},{"artifacts":[],"attempt":1,"bundleHash":"d61ea161c5ba7cdb2a1bc97e84d92377a13805b144545864e7c912c9e5ae4d71","device":"884410e598069409","findings":[],"hash":"f0567a5d2adf30cc1f9bb9d2f31dafe1d0a3c36ffc60693a2da271ecfe9b0afc","nodeId":"1bf67e28-56b3-472b-ab34-d61a6e49b5e7","outcome":"completed","summary":"Added failure-path and fuzz tests covering allowance lifecycles, authorization, rollback, and transfer properties. Expanded invariants to 11 actions across four actors.\n\nOffline build and tests passed with the required seed: **48 tests passed**, including **32,768 invariant calls**.\n\nOnly `test/` changed. No implementation defects were found.","treeHash":"9b755d3eebf96351927e381ef8eb2e46e2813da5","usage":{"cachedInputTokens":925056,"inputTokens":78542,"model":"gpt-6-astra","outputTokens":13213,"runtime":"codex","turns":5,"wallClockMs":343344}},{"artifacts":[],"attempt":1,"bundleHash":"34c882b4342c595c575aaa6c046f46a68283d2818e6e60de39ee2c8cf9c5007d","device":"8576036969b9332c","findings":[],"hash":"fbec802950dea55ecff9a388855f7f36c8dfb78f43f1704f4f6212b75269855f","nodeId":"eb3ea74c-c017-4f77-adfc-1cbeee515e9a","outcome":"completed","summary":"Implemented YOLO with 18 decimals and exactly 1,000,000,000 tokens minted once to the deployer. No later minting or administrative powers.\n\nIncluded vendored dependencies, success/failure tests, stateful invariants, and deployment/operations documentation.\n\nVerified with Solidity 0.8.26:\n\n- `forge build` passed.\n- `forge test` passed: 29 tests using the supplied fuzz seed.\n- `forge fmt --check` passed.\n- Bytecode checks found no unresolved library links or prohibited opcodes.","treeHash":"fe854ecf0ec98b0614691d3108e08cdc4e4a9e0b","usage":{"cachedInputTokens":372224,"inputTokens":45069,"model":"gpt-6-astra","outputTokens":13654,"runtime":"codex","turns":5,"wallClockMs":306781}}],"verification":[{"checks":[{"durationMs":1317,"exitCode":0,"name":"build","output":"Compiling 28 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.24s\nCompiler run successful!\n","passed":true},{"durationMs":3658,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 2 tests for test/YOLOLaunch.t.sol:YOLOLaunchTest\n[PASS] test_create2MintsEverythingToImmediateFactory() (gas: 332658)\n[PASS] test_launchTransfersClaimsAndTradingTransfersArriveWhole() (gas: 677271)\nSuite result: ok. 2 passed; 0 failed; 0 skipped; finished in 1.04ms (1.45ms CPU time)\n\nRan 26 tests for test/YOLO.t.sol:YOLOTest\n[PASS] testFuzz_overspendingRevertsWithoutChangingBalances(uint256,uint256) (runs: 1024, μ: 127891, ~: 128146)\nLogs:\n  Bound result 682539920763578105002224816\n  Bound result 164575766300615184770911039705648385931524621588856177031\n\n[PASS] testFuzz_transferFromPreservesSupplyAndAccountsForAllowance(uint256,uint256) (runs: 1024, μ: 167929, ~: 170029)\nLogs:\n  Bound result 12091\n  Bound result 849\n\n[PASS] testFuzz_transferPreservesSupplyAndExactBalances(address,uint256) (runs: 1024, μ: 97577, ~: 97886)\nLogs:\n  Bound result 554748260681325448697718655\n\n[PASS] test_approvalCanBeReplacedAndRevoked() (gas: 179685)\n[PASS] test_approvalEmitsEventWithoutMovingTokens() (gas: 93624)\n[PASS] test_approvalToZeroSpenderReverts() (gas: 40256)\n[PASS] test_constructorEmitsExactlyOneMint() (gas: 12235)\n[PASS] test_deployerCannotSeizeHolderBalanceWithoutApproval() (gas: 161697)\n[PASS] test_entireSupplyCanBeTransferred() (gas: 88713)\n[PASS] test_infiniteAllowanceIsNotDecremented() (gas: 144582)\n[PASS] test_metadataAndEntireSupplyBelongToDeployer() (gas: 111810)\n[PASS] test_noMintBurnOrAdminEntryPointsForDeployerOrStranger() (gas: 663679)\n[PASS] test_plainEtherTransferIsRejected() (gas: 40148)\n[PASS] test_selfTransferFromConsumesAllowanceWithoutChangingBalance() (gas: 110541)\n[PASS] test_selfTransferPreservesBalance() (gas: 54132)\n[PASS] test_transferEmitsEventAndArrivesWhole() (gas: 96264)\n[PASS] test_transferFromBeyondAllowanceRevertsAtomically() (gas: 120892)\n[PASS] test_transferFromBeyondBalanceRollsBackAllowance() (gas: 127052)\n[PASS] test_transferFromSpendsOnlyCallersAllowance() (gas: 295395)\n[PASS] test_transferFromToZeroRollsBackAllowance() (gas: 119281)\n[PASS] test_transferMaximumUintRevertsWithoutOverflow() (gas: 45199)\n[PASS] test_transferToZeroRevertsEvenForZeroAmount() (gas: 74910)\n[PASS] test_transferWithoutBalanceReverts() (gas: 57401)\n[PASS] test_unapprovedSpenderCannotMoveTokens() (gas: 123010)\n[PASS] test_zeroTransferFromEmptyAccountEmitsEvent() (gas: 63077)\n[PASS] test_zeroTransferFromNeedsNoAllowance() (gas: 80746)\nSuite result: ok. 26 passed; 0 failed; 0 skipped; finished in 22.68ms (72.17ms CPU time)\n\nRan 1 test for test/YOLOInvariant.t.sol:YOLOInvariantTest\n[PASS]\nYOLOInvariantTest invariants:\n[PASS] invariant_allowancesMatchApprovalsAndSpending\n[PASS] invariant_supplyAndBalancesAreConserved\n YOLOInvariantTest invariants (runs: 256, calls: 16384, reverts: 0)\n\n╭-------------+------------------+-------+---------+----------╮\n| Contract    | Selector         | Calls | Reverts | Discards |\n+=============================================================+\n| YOLOHandler | approve          | 4116  | 0       | 0        |\n|-------------+------------------+-------+---------+----------|\n| YOLOHandler | attemptOverspend | 4187  | 0       | 0        |\n|-------------+------------------+-------+---------+----------|\n| YOLOHandler | transfer         | 3994  | 0       | 0        |\n|-------------+------------------+-------+---------+----------|\n| YOLOHandler | transferFrom     | 4087  | 0       | 0        |\n╰-------------+------------------+-------+---------+----------╯\n\nLogs:\n  Bound result 10\n  Bound result 0\n  Bound result 255\n  Bound result 1\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 4\n  Bound result 1000000000\n  Bound result 1000000000\n  Bound result 0\n  Bound result 241\n  Bound result 2\n  Bound result 3926\n  Bound result 0\n  Bound result 5038\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 1000000000\n  Bound result 0\n  Bound result 0\n  Bound result 52250536084568101395\n  Bound result 0\n  Bound result 0\n  Bound result 18\n  Bound result 3048786028553714802\n  Bound result 5776\n  Bound result 60000000000000000000\n  Bound result 4344710413075000203\n  Bound result 832247332\n  Bound result 0\n  Bound result 0\n  Bound result 0\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 3.56s (3.56s CPU time)\n\nRan 3 test suites in 3.56s (3.59s CPU time): 29 tests passed, 0 failed, 0 skipped (29 total tests)\n","passed":true},{"durationMs":40,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"YOLO.approve(address,uint256)\",\"YOLO.transfer(address,uint256)\",\"YOLO.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"DEPENDENCIES.md\":27,\"DEPENDENCIES.sha256\":36,\"README.md\":110,\"foundry.toml\":19,\"launch.json\":24,\"remappings.txt\":2,\"src/YOLO.sol\":17,\"test/YOLO.t.sol\":331,\"test/YOLOInvariant.t.sol\":111,\"test/YOLOLaunch.t.sol\":74},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"46f9f75b7f2c7013bd1fab494bb94d0d583c5a9310a6a4e0ea3a802097b80858","verifiedTreeHash":"d21b46e05b81a97526d7887acae3b4d49e9b2a3e","verifierVersion":"0.1.0+f3653923"},{"checks":[{"durationMs":1856,"exitCode":0,"name":"build","output":"Compiling 29 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.74s\nCompiler run successful!\n","passed":true},{"durationMs":9455,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 2 tests for test/YOLOLaunch.t.sol:YOLOLaunchTest\n[PASS] test_create2MintsEverythingToImmediateFactory() (gas: 332658)\n[PASS] test_launchTransfersClaimsAndTradingTransfersArriveWhole() (gas: 677271)\nSuite result: ok. 2 passed; 0 failed; 0 skipped; finished in 137.60ms (1.31ms CPU time)\n\nRan 18 tests for test/YOLOProperties.t.sol:YOLOPropertiesTest\n[PASS] testFuzz_delegatedSelfTransferSpendsAllowanceWithoutMovingBalances(uint256,uint256,bool) (runs: 1024, μ: 188848, ~: 189393)\nLogs:\n  Bound result 8476385914129\n\n[PASS] testFuzz_insufficientAllowanceCannotUseAnotherSpendersApproval(uint256,uint256) (runs: 1024, μ: 250083, ~: 250524)\nLogs:\n  Bound result 433657637239440855484015425\n  Bound result 566342362760559144516013615\n\n[PASS] testFuzz_repeatedBalanceFailuresPreserveFiniteOrInfiniteApproval(uint256,uint256,bool) (runs: 1024, μ: 373464, ~: 376075)\nLogs:\n  Bound result 8\n  Bound result 10\n\n[PASS] testFuzz_replacementApprovalAfterPartialSpendIsExact(uint256,uint256,uint256) (runs: 1024, μ: 387516, ~: 386779)\nLogs:\n  Bound result 167207486364134968806284428\n  Bound result 87974060591938405799669939\n\n[PASS] testFuzz_roundTripRestoresBalancesAndLeavesApprovalsAlone(uint256,uint256,uint256) (runs: 1024, μ: 429933, ~: 431305)\nLogs:\n  Bound result 5\n  Bound result 1188\n\n[PASS] testFuzz_spenderCannotReuseApprovalForAnotherOwner(uint256,uint256) (runs: 1024, μ: 253559, ~: 253566)\nLogs:\n  Bound result 573233641543620862238168648\n  Bound result 109863519181162600581532839\n\n[PASS] testFuzz_splitDelegatedTransfersEqualOneTransfer(uint256,uint256,uint256) (runs: 1024, μ: 403974, ~: 409519)\nLogs:\n  Bound result 196590558536886587803005453\n  Bound result 161438708371209530308733612\n\n[PASS] testFuzz_zeroReceiverFailurePreservesAllowance(uint256,bool) (runs: 1024, μ: 180501, ~: 181658)\nLogs:\n  Bound result 123476921740247920\n\n[PASS] test_approvalBeforeFundingSurvivesFailedSpendAndWorksAfterFunding() (gas: 369102)\n[PASS] test_approveZeroSpenderRejectsEvenZeroAllowance() (gas: 121750)\n[PASS] test_contractRecipientDoesNotNeedACallback() (gas: 299553)\n[PASS] test_infiniteApprovalCanBeRevokedAfterSpending() (gas: 279854)\n[PASS] test_maximumMinusOneAllowanceIsFinite() (gas: 209334)\n[PASS] test_ownerUsingTransferFromNeedsSelfApproval() (gas: 313474)\n[PASS] test_returningTokensDoesNotRestoreExhaustedAllowance() (gas: 361567)\n[PASS] test_selfTransferCannotBypassInsufficientBalance() (gas: 141834)\n[PASS] test_zeroTransferFromEmptyHolderEmitsTransfer() (gas: 137921)\n[PASS] test_zeroTransferFromToZeroIsStillInvalid() (gas: 127322)\nSuite result: ok. 18 passed; 0 failed; 0 skipped; finished in 137.62ms (1.08s CPU time)\n\nRan 26 tests for test/YOLO.t.sol:YOLOTest\n[PASS] testFuzz_overspendingRevertsWithoutChangingBalances(uint256,uint256) (runs: 1024, μ: 127878, ~: 128182)\nLogs:\n  Bound result 3\n  Bound result 519\n\n[PASS] testFuzz_transferFromPreservesSupplyAndAccountsForAllowance(uint256,uint256) (runs: 1024, μ: 167890, ~: 170031)\nLogs:\n  Bound result 4\n  Bound result 3\n\n[PASS] testFuzz_transferPreservesSupplyAndExactBalances(address,uint256) (runs: 1024, μ: 97523, ~: 97886)\nLogs:\n  Bound result 554748260681325448697718655\n\n[PASS] test_approvalCanBeReplacedAndRevoked() (gas: 179685)\n[PASS] test_approvalEmitsEventWithoutMovingTokens() (gas: 93624)\n[PASS] test_approvalToZeroSpenderReverts() (gas: 40256)\n[PASS] test_constructorEmitsExactlyOneMint() (gas: 12235)\n[PASS] test_deployerCannotSeizeHolderBalanceWithoutApproval() (gas: 161697)\n[PASS] test_entireSupplyCanBeTransferred() (gas: 88713)\n[PASS] test_infiniteAllowanceIsNotDecremented() (gas: 144582)\n[PASS] test_metadataAndEntireSupplyBelongToDeployer() (gas: 111810)\n[PASS] test_noMintBurnOrAdminEntryPointsForDeployerOrStranger() (gas: 663679)\n[PASS] test_plainEtherTransferIsRejected() (gas: 40148)\n[PASS] test_selfTransferFromConsumesAllowanceWithoutChangingBalance() (gas: 110541)\n[PASS] test_selfTransferPreservesBalance() (gas: 54132)\n[PASS] test_transferEmitsEventAndArrivesWhole() (gas: 96264)\n[PASS] test_transferFromBeyondAllowanceRevertsAtomically() (gas: 120892)\n[PASS] test_transferFromBeyondBalanceRollsBackAllowance() (gas: 127052)\n[PASS] test_transferFromSpendsOnlyCallersAllowance() (gas: 295395)\n[PASS] test_transferFromToZeroRollsBackAllowance() (gas: 119281)\n[PASS] test_transferMaximumUintRevertsWithoutOverflow() (gas: 45199)\n[PASS] test_transferToZeroRevertsEvenForZeroAmount() (gas: 74910)\n[PASS] test_transferWithoutBalanceReverts() (gas: 57401)\n[PASS] test_unapprovedSpenderCannotMoveTokens() (gas: 123010)\n[PASS] test_zeroTransferFromEmptyAccountEmitsEvent() (gas: 63077)\n[PASS] test_zeroTransferFromNeedsNoAllowance() (gas: 80746)\nSuite result: ok. 26 passed; 0 failed; 0 skipped; finished in 137.69ms (399.90ms CPU time)\n\nRan 2 tests for test/YOLOInvariant.t.sol:YOLOInvariantTest\n[PASS]\nYOLOInvariantTest invariants:\n[PASS] invariant_allowancesMatchApprovalsAndSpending\n[PASS] invariant_metadataAndZeroAddressStateStayUnchanged\n[PASS] invariant_supplyAndBalancesAreConserved\n YOLOInvariantTest invariants (runs: 256, calls: 32768, reverts: 0)\n\n╭-------------+---------------------------+-------+---------+----------╮\n| Contract    | Selector                  | Calls | Reverts | Discards |\n+======================================================================+\n| YOLOHandler | approve                   | 2969  | 0       | 0        |\n|-------------+---------------------------+-------+---------+----------|\n| YOLOHandler | approveBoundary           | 2998  | 0       | 0        |\n|-------------+---------------------------+-------+---------+----------|\n| YOLOHandler | attemptAllowanceOverspend | 2972  | 0       | 0        |\n|-------------+---------------------------+-------+---------+----------|\n| YOLOHandler | attemptDelegatedOverspend | 2946  | 0       | 0        |\n|-------------+---------------------------+-------+---------+----------|\n| YOLOHandler | attemptInvalidRecipient   | 2999  | 0       | 0        |\n|-------------+---------------------------+-------+---------+----------|\n| YOLOHandler | attemptOverspend          | 2874  | 0       | 0        |\n|-------------+---------------------------+-------+---------+----------|\n| YOLOHandler | revokeAndAttemptSpend     | 2956  | 0       | 0        |\n|-------------+---------------------------+-------+---------+----------|\n| YOLOHandler | roundTrip                 | 3063  | 0       | 0        |\n|-------------+---------------------------+-------+---------+----------|\n| YOLOHandler | transfer                  | 3030  | 0       | 0        |\n|-------------+---------------------------+-------+---------+----------|\n| YOLOHandler | transferEntireBalance     | 2962  | 0       | 0        |\n|-------------+---------------------------+-------+---------+----------|\n| YOLOHandler | transferFrom              | 2999  | 0       | 0        |\n╰-------------+---------------------------+-------+---------+----------╯\n\nLogs:\n  Bound result 0\n  Bound result 0\n  Bound result 2287400826\n  Bound result 250000000000000000000000000\n  Bound result 5\n  Bound result 75850617294062392605322123\n  Bound result 0\n  Bound result 0\n  Bound result 7388\n  Bound result 7388\n  Bound result 7388\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 18\n  Bound result 8\n  Bound result 0\n  Bound result 9430\n  Bound result 10\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 4907\n  Bound result 3380\n  Bound result 3380\n  Bound result 3380\n  Bound result 0\n  Bound result 3612\n  Bound result 3612\n  Bound result 3612\n  Bound result 134785499293633908807146302\n  Bound result 134785499293633908807146302\n  Bound result 134785499293633908807146302\n  Bound result 0\n  Bound result 0\n  Bound result 2365\n  Bound result 2365\n  Bound result 2365\n  Bound result 3930\n  Bound result 0\n  Bound result 2316\n  Bound result 2316\n  Bound result 2316\n  Bound result 5011\n  Bound result 27\n  Bound result 27\n  Bound result 27\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 44260811690663791923364711\n  Bound result 44260811690663791923364711\n  Bound result 44260811690663791923364711\n  Bound result 586\n  Bound result 10\n  Bound result 10\n  Bound result 10\n  Bound result 250000000000000000000000586\n  Bound result 7\n  Bound result 100167225202607452766818567\n  Bound result 100167225202607452766818567\n  Bound result 100167225202607452766818567\n  Bound result 3\n  Bound result 349784263298658821101581111\n  Bound result 349784263298658821101581111\n  Bound result 349784263298658821101581111\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 2\n  Bound result 2\n  Bound result 2\n  Bound result 3\n  Bound result 3\n  Bound result 3\n  Bound result 0\n  Bound result 4\n  Bound result 249999999999999999999999992\n  Bound result 10680\n  Bound result 10680\n  Bound result 10680\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 250000000\n  Bound result 3685\n  Bound result 499999999999999999999995101\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 40000000000000000000\n  Bound result 40000000000000000000\n  Bound result 40000000000000000000\n  Bound result 24576\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 250000000000000000000032574\n  Bound result 0\n  Bound result 0\n  Bound result 255\n  Bound result 255\n  Bound result 255\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 175483775035755918640810175\n  Bound result 26451325107267755922329701\n  Bound result 26451325107267755922329701\n  Bound result 26451325107267755922329701\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 18\n  Bound result 0\n  Bound result 0\n\n[PASS] test_handlerLifecycleIncludesSpendingRevocationAndRollback() (gas: 2596221)\nLogs:\n  Bound result 1\n  Bound result 1\n  Bound result 1\n  Bound result 1\n  Bound result 1\n  Bound result 1\n  Bound result 1\n  Bound result 250000000000000000000000001\n  Bound result 1\n  Bound result 1\n\nSuite result: ok. 2 passed; 0 failed; 0 skipped; finished in 9.34s (9.34s CPU time)\n\nRan 4 test suites in 9.34s (9.75s CPU time): 48 tests passed, 0 failed, 0 skipped (48 total tests)\n","passed":true},{"durationMs":77,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"YOLO.approve(address,uint256)\",\"YOLO.transfer(address,uint256)\",\"YOLO.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"DEPENDENCIES.md\":27,\"DEPENDENCIES.sha256\":36,\"README.md\":110,\"foundry.toml\":19,\"remappings.txt\":2,\"src/YOLO.sol\":17,\"test/TESTING.md\":63,\"test/YOLO.t.sol\":331,\"test/YOLOInvariant.t.sol\":246,\"test/YOLOLaunch.t.sol\":74,\"test/YOLOProperties.t.sol\":305},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"f0567a5d2adf30cc1f9bb9d2f31dafe1d0a3c36ffc60693a2da271ecfe9b0afc","verifiedTreeHash":"9b755d3eebf96351927e381ef8eb2e46e2813da5","verifierVersion":"0.1.0+f3653923"},{"checks":[{"durationMs":1544,"exitCode":0,"name":"build","output":"Compiling 28 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.44s\nCompiler run successful!\n","passed":true},{"durationMs":3998,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 2 tests for test/YOLOLaunch.t.sol:YOLOLaunchTest\n[PASS] test_create2MintsEverythingToImmediateFactory() (gas: 332658)\n[PASS] test_launchTransfersClaimsAndTradingTransfersArriveWhole() (gas: 677271)\nSuite result: ok. 2 passed; 0 failed; 0 skipped; finished in 26.57ms (6.52ms CPU time)\n\nRan 26 tests for test/YOLO.t.sol:YOLOTest\n[PASS] testFuzz_overspendingRevertsWithoutChangingBalances(uint256,uint256) (runs: 1024, μ: 127891, ~: 128146)\nLogs:\n  Bound result 22102545054038\n  Bound result 87641\n\n[PASS] testFuzz_transferFromPreservesSupplyAndAccountsForAllowance(uint256,uint256) (runs: 1024, μ: 167929, ~: 170029)\nLogs:\n  Bound result 12091\n  Bound result 849\n\n[PASS] testFuzz_transferPreservesSupplyAndExactBalances(address,uint256) (runs: 1024, μ: 97577, ~: 97886)\nLogs:\n  Bound result 514120272295021422066322566\n\n[PASS] test_approvalCanBeReplacedAndRevoked() (gas: 179685)\n[PASS] test_approvalEmitsEventWithoutMovingTokens() (gas: 93624)\n[PASS] test_approvalToZeroSpenderReverts() (gas: 40256)\n[PASS] test_constructorEmitsExactlyOneMint() (gas: 12235)\n[PASS] test_deployerCannotSeizeHolderBalanceWithoutApproval() (gas: 161697)\n[PASS] test_entireSupplyCanBeTransferred() (gas: 88713)\n[PASS] test_infiniteAllowanceIsNotDecremented() (gas: 144582)\n[PASS] test_metadataAndEntireSupplyBelongToDeployer() (gas: 111810)\n[PASS] test_noMintBurnOrAdminEntryPointsForDeployerOrStranger() (gas: 663679)\n[PASS] test_plainEtherTransferIsRejected() (gas: 40148)\n[PASS] test_selfTransferFromConsumesAllowanceWithoutChangingBalance() (gas: 110541)\n[PASS] test_selfTransferPreservesBalance() (gas: 54132)\n[PASS] test_transferEmitsEventAndArrivesWhole() (gas: 96264)\n[PASS] test_transferFromBeyondAllowanceRevertsAtomically() (gas: 120892)\n[PASS] test_transferFromBeyondBalanceRollsBackAllowance() (gas: 127052)\n[PASS] test_transferFromSpendsOnlyCallersAllowance() (gas: 295395)\n[PASS] test_transferFromToZeroRollsBackAllowance() (gas: 119281)\n[PASS] test_transferMaximumUintRevertsWithoutOverflow() (gas: 45199)\n[PASS] test_transferToZeroRevertsEvenForZeroAmount() (gas: 74910)\n[PASS] test_transferWithoutBalanceReverts() (gas: 57401)\n[PASS] test_unapprovedSpenderCannotMoveTokens() (gas: 123010)\n[PASS] test_zeroTransferFromEmptyAccountEmitsEvent() (gas: 63077)\n[PASS] test_zeroTransferFromNeedsNoAllowance() (gas: 80746)\nSuite result: ok. 26 passed; 0 failed; 0 skipped; finished in 27.67ms (80.48ms CPU time)\n\nRan 1 test for test/YOLOInvariant.t.sol:YOLOInvariantTest\n[PASS]\nYOLOInvariantTest invariants:\n[PASS] invariant_allowancesMatchApprovalsAndSpending\n[PASS] invariant_supplyAndBalancesAreConserved\n YOLOInvariantTest invariants (runs: 256, calls: 16384, reverts: 0)\n\n╭-------------+------------------+-------+---------+----------╮\n| Contract    | Selector         | Calls | Reverts | Discards |\n+=============================================================+\n| YOLOHandler | approve          | 4116  | 0       | 0        |\n|-------------+------------------+-------+---------+----------|\n| YOLOHandler | attemptOverspend | 4187  | 0       | 0        |\n|-------------+------------------+-------+---------+----------|\n| YOLOHandler | transfer         | 3994  | 0       | 0        |\n|-------------+------------------+-------+---------+----------|\n| YOLOHandler | transferFrom     | 4087  | 0       | 0        |\n╰-------------+------------------+-------+---------+----------╯\n\nLogs:\n  Bound result 10\n  Bound result 0\n  Bound result 255\n  Bound result 1\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 4\n  Bound result 1000000000\n  Bound result 1000000000\n  Bound result 0\n  Bound result 241\n  Bound result 2\n  Bound result 3926\n  Bound result 0\n  Bound result 5038\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 1000000000\n  Bound result 0\n  Bound result 0\n  Bound result 52250536084568101395\n  Bound result 0\n  Bound result 0\n  Bound result 18\n  Bound result 3048786028553714802\n  Bound result 5776\n  Bound result 60000000000000000000\n  Bound result 4344710413075000203\n  Bound result 832247332\n  Bound result 0\n  Bound result 0\n  Bound result 0\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 3.88s (3.88s CPU time)\n\nRan 3 test suites in 3.88s (3.94s CPU time): 29 tests passed, 0 failed, 0 skipped (29 total tests)\n","passed":true},{"durationMs":49,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"YOLO.approve(address,uint256)\",\"YOLO.transfer(address,uint256)\",\"YOLO.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"DEPENDENCIES.md\":27,\"DEPENDENCIES.sha256\":36,\"README.md\":110,\"foundry.toml\":19,\"remappings.txt\":2,\"src/YOLO.sol\":17,\"test/YOLO.t.sol\":331,\"test/YOLOInvariant.t.sol\":111,\"test/YOLOLaunch.t.sol\":74},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true},{"durationMs":694,"exitCode":0,"name":"slither","output":"slither: no results at low impact or above","passed":true},{"durationMs":321,"exitCode":0,"name":"aderyn","output":"[low] large-numeric-literal at src/YOLO.sol:12: Large Numeric Literal","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"fbec802950dea55ecff9a388855f7f36c8dfb78f43f1704f4f6212b75269855f","verifiedTreeHash":"fe854ecf0ec98b0614691d3108e08cdc4e4a9e0b","verifierVersion":"0.1.0+f3653923"}]}