{"assessments":[],"deployments":[],"fuzz":[],"identity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"interpretation":"Records acceptance and evidence. Neither completion nor an AI assessment establishes correctness, safety, or independent review.","jobId":"5da7581c-6585-4149-9460-766b7a0bb417","kind":"shape:chain","nodes":[{"acceptedSubmissionHash":"28aa6c7db489c69b6a6cf15d57f3fef17863e846605d06423ed21be033d13877","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_economics","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"8710f5f3af3dff7f4c122315f891f082e0204571ee7f5499cbdd730f94445a84","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_flow","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"e8bf86bf11a95894fec04ecd3d1759d9817f61032ae75dd6a9b823b17a797c16","dependsOn":["build_contract_project","write_foundry_tests","manifest","audit_math","audit_permissions","audit_economics","audit_flow"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"af3aa01159bbf354f621cafa5c0006f6169e0938a8b015be508b7377dbf165bc","skillId":"audit-judge","tools":[]},"key":"audit_judge","kind":"code","role":"review","skillHash":"af3aa01159bbf354f621cafa5c0006f6169e0938a8b015be508b7377dbf165bc","skillId":"audit-judge","state":"accepted"},{"acceptedSubmissionHash":"78492725fa231acae99647e16b00dd38df02fbc59812b847d60268208c04d121","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_math","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"f9810dd72626e966abd78932020c16c62f5cdc9c4fda94600743278a18afb2ac","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_permissions","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"1879b4e43449dddc65c37b7e13c7f95f7a8794b0fd82bf0b11433f79e8c10a20","dependsOn":[],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"d59561da3b378461b7c749f6bd5084477d44993aa94972ddea90f542535751df","skillId":"build-contract-project","tools":[]},"key":"build_contract_project","kind":"code","role":"implement","skillHash":"d59561da3b378461b7c749f6bd5084477d44993aa94972ddea90f542535751df","skillId":"build-contract-project","state":"accepted"},{"acceptedSubmissionHash":"24d87b9d9b62ca725a278976dfcbaf61f400b70b2a993752a544b4e5de14a524","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"tools":[]},"key":"manifest","kind":"code","role":"integrate","skillHash":null,"skillId":null,"state":"accepted"},{"acceptedSubmissionHash":"eb1c60655c3a9b8eb823aff2d842a97c736a65c2f29744d96518c8531117eada","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"4c76766b00591dfe982fe85d3de589fdb2f810e5137c301155d1c5e36a1d3b23","skillId":"write-foundry-tests","tools":[]},"key":"write_foundry_tests","kind":"code","role":"tests","skillHash":"4c76766b00591dfe982fe85d3de589fdb2f810e5137c301155d1c5e36a1d3b23","skillId":"write-foundry-tests","state":"accepted"}],"objective":"A custom token: Mutually Assured Destruction (MAD).\nToken name: Mutually Assured Destruction\nToken symbol: MAD\nToken supply: 1,000,000,000 with 18 decimals, all minted once to the deployer in the constructor.","parentJobId":null,"planHash":"14184b803723edcce94c8d462a4a6e83b37e1b1e8bce6353e80519243191a21a","previousHash":"0000000000000000000000000000000000000000000000000000000000000000","projectId":"5da7581c-6585-4149-9460-766b7a0bb417","publication":{"commit":null,"deliveredAt":null,"repoUrl":"https://github.com/identity-md-launches/launch-2484-mutually-assured-destruction"},"receiptIdentity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"registry":"0xb6d0a187b050fa5bb0b87033a203f37becf4a775","research":[],"schema":"identitymd-work-v1","signals":[{"agentId":"51891","feedbackHash":"fbdab5e3daee3129be98a0348d2b8d6c4f28790089bfe6f47c756565dca80e46","nodeKey":"audit_economics","submissionHash":"28aa6c7db489c69b6a6cf15d57f3fef17863e846605d06423ed21be033d13877","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51021","feedbackHash":"2c1187b164412f6f0532756e934a986392c5300b49c32ba45bd7232ea0550560","nodeKey":"audit_flow","submissionHash":"8710f5f3af3dff7f4c122315f891f082e0204571ee7f5499cbdd730f94445a84","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52481","feedbackHash":"76520714bff39cd2895a8b1f705b2e996a0c75a4c08800a759cb313fac76b359","nodeKey":"audit_judge","submissionHash":"e8bf86bf11a95894fec04ecd3d1759d9817f61032ae75dd6a9b823b17a797c16","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51025","feedbackHash":"272a49f415afa39831f5256f540dc585d8b6a437103506cbafa2759f5a4de789","nodeKey":"audit_math","submissionHash":"78492725fa231acae99647e16b00dd38df02fbc59812b847d60268208c04d121","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51022","feedbackHash":"30f47e98b885943ddda48cf2dda9028e9b5ef966269d4e6ae00c73682667fa9e","nodeKey":"audit_permissions","submissionHash":"f9810dd72626e966abd78932020c16c62f5cdc9c4fda94600743278a18afb2ac","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51874","feedbackHash":"209a27fec765696137fdfbf58b6d449d4089dfda61050ddf3e7ec4a107825d2e","nodeKey":"build_contract_project","submissionHash":"1879b4e43449dddc65c37b7e13c7f95f7a8794b0fd82bf0b11433f79e8c10a20","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"51005","feedbackHash":"49d49aebfc460aeecebcf709b56569875e285615a4c732fb83c76c6d0c2cb6c7","nodeKey":"manifest","submissionHash":"24d87b9d9b62ca725a278976dfcbaf61f400b70b2a993752a544b4e5de14a524","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"51502","feedbackHash":"ffa501ead67ac1853effd02645ea2ec739c0d9cd17350ec389ef0125e943bac7","nodeKey":"write_foundry_tests","submissionHash":"eb1c60655c3a9b8eb823aff2d842a97c736a65c2f29744d96518c8531117eada","tag1":"verification:checks","tag2":"acceptance-v2","value":1}],"site":null,"snapshotHash":"762abbfd9a8b8e0c3a70dca5d9f79690d4feced6c9130543283f34fe93b5d083","state":"completed","submissions":[{"artifacts":[],"attempt":1,"bundleHash":"cce11b98959ed39fbd7b9629cf35efad267ede0488e03a4474e9cba2ec62a6f4","device":"fb26479062458645","findings":[],"hash":"1879b4e43449dddc65c37b7e13c7f95f7a8794b0fd82bf0b11433f79e8c10a20","nodeId":"d954fe86-e8fb-44c1-ae4f-c0319094f489","outcome":"completed","summary":"The work is complete and committed.\n\n**What was built**\n\n- `src/MADToken.sol`: a fixed-supply ERC-20 named Mutually Assured Destruction, symbol MAD, 18 decimals. The constructor mints the whole supply of 1,000,000,000 tokens to `msg.sender` and takes no arguments. There is no owner, no mint path, no fee, no pause, no blacklist and no upgrade.\n- `foundry.toml` pins solc 0.8.26, evm_version cancun, optimizer 200 runs, `bytecode_hash = \"none\"` and no CBOR metadata, so the deployed bytes are reproducible. ffi is off and fs_permissions is empty.\n- forge-std 1.9.7 and the five OpenZeppelin 5.1.0 files the ERC-20 needs are vendored under `lib/` as plain files. No submodules, no git metadata.\n- `script/Deploy.s.sol` is a minimal helper for fork or testnet deploys, with its `deploy()` function tested directly.\n- `README.md` documents assumptions, the manifest parameters, the fact that nothing needs setting after launch, operational responsibilities and the security review notes.\n\n**Checks run**\n\n| Check | Result |\n| --- | --- |\n| forge build | passes |\n| forge test with the verifier's fuzz seed | 29 passed, 0 failed |\n| forge test with an empty environment | 29 passed |\n| forge fmt --check | passes |\n\nThe tests mirror the protected floor's token checks: supply minted whole to a CREATE2 factory stand-in, the 10/80/10 launch split and claim arriving whole, the pool-manager round trip, every listed admin selector reverting from both a stranger and the deployer without moving or freezing a holder, and a reachable-opcode scan showing no DELEGATECALL, CALLCODE or SELFDESTRUCT. ERC-20 success and failure paths assert the exact ERC-6093 errors, and four fuzz tests cover supply conservation, overdraft reverts, allowance accounting and unknown selectors.\n\n**Notes for the next step**\n\n- The brief asked only for name, symbol and supply, so no burn, tax or governance was added. If the requester wants a burn function to match the name, that is a small addition.\n- The manifest step should record `token.contract` as `MADToken`, `constructorArgs` as empty, and `totalSupply` as 1000000000000000000000000000.\n- Slither and Mythril were not available on this machine and did not run.","treeHash":"e5d2249ddd2e03a3c5340783c25478e26d6eb01d","usage":{"cachedInputTokens":829878,"inputTokens":450,"model":"claude-fable-5-1","outputTokens":21389,"runtime":"claude","turns":24,"wallClockMs":391799}},{"artifacts":[],"attempt":1,"bundleHash":"92b9889cee0bf3b26198519ef7966056467ab9ab106fdf4be5b7c3d1d73972dd","device":"9b2fda471b13b14a","findings":[],"hash":"24d87b9d9b62ca725a278976dfcbaf61f400b70b2a993752a544b4e5de14a524","nodeId":"51d0f463-4ff8-4e2c-bdc1-d2e060fabbba","outcome":"completed","summary":"Created [launch.json](/home/imd-worker/.identitymd/work/5da7581c-6585-4149-9460-766b7a0bb417/51d0f463-4ff8-4e2c-bdc1-d2e060fabbba/launch.json) matching `MADToken`, its exact supply, and the required pool and economics.\n\nManifest and constructor ABI checks passed. `forge build` succeeded; all 29 tests passed with the specified fuzz seed.\n\nOnly `launch.json` is changed for submission.","treeHash":"62ff5f746b92f637f12178d1e66e52a31c6be8dd","usage":{"cachedInputTokens":185088,"inputTokens":27052,"model":"gpt-6-astra","outputTokens":2679,"runtime":"codex","turns":3,"wallClockMs":77426}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"934ef01306a3cc89","findings":[],"hash":"28aa6c7db489c69b6a6cf15d57f3fef17863e846605d06423ed21be033d13877","nodeId":"d2439f59-207d-4797-a38f-da9900513aaa","outcome":"completed","summary":"The review is complete and the findings file is written. No defects found in the assigned area.\n\n**What I checked**\n\n- **Source and dependencies.** The token is 40 lines over OpenZeppelin ERC20 5.1.0. I fetched the five vendored OpenZeppelin files at the README's pinned commit and confirmed each is byte-identical, so the inherited transfer, approve and allowance logic is the audited upstream code.\n- **Economic Security guide.** No fee, burn, rebasing, pause, blacklist or hook exists, so every launch flow moves exactly the requested amount. I ran the exact 10/80/10 manifest split, a trader round trip through a pool-manager stand-in, and 1 wei through full-supply transferFrom round trips.\n- **Invariant guide.** A stateful fuzz over transfer, approve and transferFrom across six actors ran 128,000 calls with zero reverts. Total supply stayed at exactly 10^27 and the sum of balances always equalled it. The only path to minting is the constructor.\n- **Flow Gap guide.** The token has no callbacks, address-dependent logic or balance-dependent logic, so the Uniswap v4 seed and swaps see exactly what is transferred. No launch.json exists yet in the tree. The README's stated manifest values match the code.\n- **Static analysis lead.** The aderyn large-literal note at line 26 evaluates to exactly one billion times 10^18, matching the manifest supply string. Not a defect.\n\n**Not reported, deliberately.** Standard ERC-20 approve front-running and tokens sent to the token's own address are properties of the interface, not defects of this code. They fail the guides' validation gates as by-design or self-harm only.\n\n**Output.** The repository root `.imd-findings.json` holds an empty findings list and seven coverage rows: one for each of the three listed entry points, all `holds`, plus four invariant and flow rows. The scratch tests were removed and the tree is otherwise untouched.","treeHash":null,"usage":{"cachedInputTokens":726931,"inputTokens":354,"model":"claude-fable-5-1","outputTokens":10785,"runtime":"claude","turns":17,"wallClockMs":187590}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"b273d407784470b4","findings":[],"hash":"78492725fa231acae99647e16b00dd38df02fbc59812b847d60268208c04d121","nodeId":"6e328b54-5802-4f87-8364-8d583bd2929f","outcome":"completed","summary":"The review is complete and the findings file is in place.\n\n**Result: no defects found** in the Math Precision, Boundary, or Numerical Gap areas. `.imd-findings.json` holds an empty findings list and seven coverage rows, all `holds`.\n\n**What the token is.** `src/MADToken.sol` is a plain OpenZeppelin 5.1.0 ERC-20 with a constant supply minted once in the constructor. It adds no arithmetic of its own: no fee, burn, division, scaling, external call, payable function, sentinel branch, bytes decoding, or receive/fallback.\n\n**What I checked against the three guides:**\n- **Math Precision.** The only arithmetic is in OZ's `_update` and `_spendAllowance`. Every unchecked subtraction is preceded by a strict less-than check, and the unchecked balance addition is bounded by a total supply of 1e27, far below any overflow. The supply constant is compile-time checked arithmetic. Aderyn's large-numeric-literal note is cosmetic.\n- **Boundary.** Transfers of the full supply, supply plus one, max uint, one wei, zero, self-transfer, and zero-address receiver or spender all behave as the standard specifies, reverting with the typed ERC-6093 errors rather than panicking. Max-uint allowance is treated as infinite, max-minus-one decrements, and an allowance above balance still fails on the balance check. Plain ETH, empty calldata and unknown selectors all revert.\n- **Numerical Gap.** No rounding, caps, accumulators or early-return fast paths exist, so no seam between lenses can open. A fuzz over two-hop transfers across the full supply range kept the balance sum exactly equal to total supply.\n\n**Verification.** I wrote a 13-case scratch Foundry test covering the cases above, ran it, and all passed. The existing 29 project tests also pass. The scratch file was removed afterwards, and the tree is unchanged apart from the findings file.","treeHash":null,"usage":{"cachedInputTokens":717571,"inputTokens":322,"model":"claude-fable-5-1","outputTokens":7001,"runtime":"claude","turns":11,"wallClockMs":101173}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"72ae9b5bbd1a54b6","findings":[],"hash":"8710f5f3af3dff7f4c122315f891f082e0204571ee7f5499cbdd730f94445a84","nodeId":"4c4fa9f2-e96f-42ec-8bcb-5a402d1ada46","outcome":"completed","summary":"Review complete. No defects found; the findings file holds an empty list and a full coverage record.\n\n**What was reviewed.** The token is `src/MADToken.sol`, a 37-line contract that inherits OpenZeppelin ERC20 5.1.0 and adds only four constants, a constructor that mints the whole supply to the deployer, and a pure `decimals()` override. No application contracts exist. I checked it against the Execution Trace, Periphery and First Principles guides and the Senior Auditor's Mindset.\n\n**What I did.**\n- Verified the vendored OpenZeppelin files are byte-identical to the pinned upstream commit, which was the main Periphery question, since the base contract is almost all of the code.\n- Traced the three entry points through the unmodified library code for every failure mode my guides name: sentinel inputs, parameter divergence, stale reads, partial updates, self-transfer ordering, allowance residuals, reentrancy via receiver hooks, and appended constructor data.\n- Ran the existing 29 tests, the fuzz suite under the verifier's seed, a format check, and 10 scratch probes of the edge cases the existing suite did not cover. All passed.\n- Confirmed from the compiled ABI that the surface is only ERC-20 plus constant getters, with no mint, burn, pause, blacklist, owner, receive or fallback path.\n\n**Coverage.** All three listed entry points are marked `holds`, with five extra rows for the constructor, the vendored library, the supply and privilege invariants, the launch-flow exactness, and the deploy script. One limit is stated in the record: the launch floor harness depends on v4-core and LaunchLiquidity, which are not in this tree, so the seed and swap flows were traced rather than executed. Nothing in the token can tax or block them, so this does not change the verdict.\n\n**Leads not promoted.** The standard ERC-20 approve front-running race and the sticky infinite allowance are inherent ERC-20 design properties, documented in the README, with no mechanism specific to this token, so they are not reported. The aderyn large-numeric-literal note is style only.\n\nNo files in the tree were changed. The only artifacts are `.imd-findings.json` and my scratch test, which is ignored by git and deleted before submission.","treeHash":null,"usage":{"cachedInputTokens":672708,"inputTokens":226,"model":"claude-fable-5-1","outputTokens":11701,"runtime":"claude","turns":22,"wallClockMs":177428}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"a4e285247c6f8aed","findings":[],"hash":"e8bf86bf11a95894fec04ecd3d1759d9817f61032ae75dd6a9b823b17a797c16","nodeId":"f8b6a2d3-422d-4e6a-8e82-8f47318a9dbc","outcome":"completed","summary":"The review is complete. The findings file holds an empty findings list and a full coverage record. No tracked file was changed.\n\n**Result: no defects found.** All four specialists and the independent tester reported nothing, so there was nothing to reproduce or merge. My own pass over the code confirmed the clean result.\n\n**What I verified**\n\n- `src/MADToken.sol` is a plain OpenZeppelin ERC-20 with a constant supply. The constructor takes no arguments, mints exactly 1e27 minor units to the deployer, and calls no other contract. The only override is `decimals()`, which returns 18.\n- The three entry points, approve, transfer and transferFrom, are the unmodified OpenZeppelin 5.1.0 implementations. I traced their checks and state changes. Transfers move exactly the requested amount with no fee, burn or hook, so every launch flow arrives whole.\n- The vendored OpenZeppelin files match upstream v5.1.0 byte for byte by SHA-256.\n- The runtime bytecode contains no DELEGATECALL, CALLCODE or SELFDESTRUCT and is well under the EIP-170 size limit.\n- The ABI exposes no mint, burn, pause, blacklist or owner function, so no privileged call can grow the supply or touch a holder's balance.\n- The manifest is schema-valid. The supply string equals the constant the constructor mints, the empty constructor argument list matches the zero-parameter constructor, and decimals agree.\n- The project's own 57 Foundry tests pass, including three invariant suites. The protected floor tests cannot be run here because they import v4-core and floor helpers absent from this tree, but every check they make is satisfied by the traced behaviour.\n- The one static-analysis lead, a large numeric literal, is a style note. The constant evaluates to exactly the manifest supply.\n\n**Coverage record** marks all three entry points as holding, plus six invariant rows covering supply, privileged calls, opcodes, dependency integrity, manifest validity and the static-analysis lead.","treeHash":null,"usage":{"cachedInputTokens":521649,"inputTokens":354,"model":"claude-fable-5-1","outputTokens":6244,"runtime":"claude","turns":12,"wallClockMs":142484}},{"artifacts":[],"attempt":1,"bundleHash":"6b631469d5a1000ce81af2c166d9791c30e0bffe247c8b755b3e9c396cafc046","device":"68fd8dd6450ac70c","findings":[],"hash":"eb1c60655c3a9b8eb823aff2d842a97c736a65c2f29744d96518c8531117eada","nodeId":"92f81cfe-3652-482e-8bce-a3ab1a8f461d","outcome":"completed","summary":"Added tests under `test/` covering failure paths, boundary values, allowance revocation, self-transfers, and state preservation after rejected calls, plus four-actor stateful invariants.\n\nValidation passed with the supplied seed:\n\n- `forge build`\n- `forge test`: 57 passed, zero failures\n- Invariants: 256 sequences, 32,768 calls\n\nNo implementation defects were found. Only two test files were added.","treeHash":"1cd6a129b9c04834f978bec88bed4c4f5da5fbe3","usage":{"cachedInputTokens":798848,"inputTokens":80247,"model":"gpt-6-astra","outputTokens":16104,"runtime":"codex","turns":6,"wallClockMs":457614}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"c35be49d2f8f8def","findings":[],"hash":"f9810dd72626e966abd78932020c16c62f5cdc9c4fda94600743278a18afb2ac","nodeId":"4934f0a3-b7e1-4de7-9292-e1f021e37687","outcome":"completed","summary":"Review complete. No defects found in the assigned area, and the findings file is written with an empty list plus a full coverage record.\n\n**What was reviewed.** `src/MADToken.sol` is a 37-line fixed-supply token inheriting OpenZeppelin ERC20 v5.1.0. The constructor mints 1,000,000,000 MAD with 18 decimals to msg.sender once. It adds only constants and a pure `decimals()` override. I checked it against the Senior Auditor's Mindset and the Access Control, Asymmetry and Trust Gap guides from the Pashov reference, and against the custom-token launch floor.\n\n**Why it holds.**\n- **Permission map is empty after deployment.** The compiled ABI exposes exactly approve, transfer and transferFrom as state changers. There is no owner, minter, pauser, initializer, proxy, permit, fallback or receive.\n- **Inherited code is unmodified.** All five vendored OpenZeppelin files hash-match the pinned upstream commit, so no inherited guard was altered.\n- **Asymmetry diff is trivial.** transfer and transferFrom share one `_update` path. The mint branch is unreachable after construction and there is no burn or admin variant to compare against.\n- **Trust gap is only the launch design.** The deployer, which is the ProjectFactory under the launch, holds the supply and forwards it. That is the intended trust assumption and not a bypass. The factory with no allowance cannot pull from a holder.\n- **Scratch tests confirmed these claims** and were deleted afterwards. The existing 29-test suite also passes.\n\n**Leads checked and dismissed.**\n- The aderyn large-numeric-literal line is a compile-time constant that the existing tests assert equals the manifest supply.\n- The ERC-20 approve front-running race is inherent to the standard and acknowledged in the README. I recorded it as a checked invariant rather than a finding.\n\n**Coverage.** Ten rows: the three listed entry points, the constructor, the permission map, the paired-function diff, the trust-gap seams, the approve race, the launch floor from my angle, and the static-analysis lead. All are marked as holding. Nothing was left unreached. The working tree is clean apart from the findings file.","treeHash":null,"usage":{"cachedInputTokens":1261687,"inputTokens":386,"model":"claude-fable-5-1","outputTokens":11711,"runtime":"claude","turns":26,"wallClockMs":184247}}],"verification":[{"checks":[{"durationMs":1192,"exitCode":0,"name":"build","output":"Compiling 29 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.11s\nCompiler run successful!\n","passed":true},{"durationMs":101,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 1 test for test/Deploy.t.sol:DeployTest\n[PASS] test_deployMintsSupplyToTheScriptCaller() (gas: 1550771)\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 398.06µs (200.97µs CPU time)\n\nRan 28 tests for test/MADToken.t.sol:MADTokenTest\n[PASS] testFuzz_transferBeyondBalanceReverts(uint256,uint256) (runs: 256, μ: 98617, ~: 98843)\nLogs:\n  Bound result 1223870080480415506998357\n  Bound result 1000000000000000000000000000\n\n[PASS] testFuzz_transferConservesSupply(address,uint256) (runs: 256, μ: 102890, ~: 103271)\nLogs:\n  Bound result 255\n\n[PASS] testFuzz_transferFromWithinAllowance(uint256,uint256) (runs: 256, μ: 199054, ~: 200546)\nLogs:\n  Bound result 728212440538528400623361855\n  Bound result 131135445039175515450895415\n\n[PASS] testFuzz_unknownSelectorReverts(bytes4,bytes) (runs: 256, μ: 48514, ~: 48285)\n[PASS] test_approveAndTransferFrom() (gas: 211596)\n[PASS] test_approveRevertsForZeroSpender() (gas: 30773)\n[PASS] test_constructorEmitsSingleTransferFromZero() (gas: 15414)\n[PASS] test_constructorMintsWholeSupplyToDeployer() (gas: 40183)\n[PASS] test_creationCodeTakesNoConstructorArguments() (gas: 665926)\n[PASS] test_deployerIsWhoeverCallsTheConstructor() (gas: 17977)\n[PASS] test_fullLaunchSplitConservesSupply() (gas: 224648)\n[PASS] test_hasNoOwnerOrPauseView() (gas: 52195)\n[PASS] test_infiniteAllowanceIsNotDecremented() (gas: 173793)\n[PASS] test_metadata() (gas: 58714)\n[PASS] test_noAdminCallIncreasesSupplyOrGrantsBalance() (gas: 706725)\n[PASS] test_noPrivilegedCallMovesOrFreezesAHolder() (gas: 455835)\n[PASS] test_plainEtherIsRefused() (gas: 37242)\n[PASS] test_poolManagerRoundTripMovesExactly() (gas: 175977)\n[PASS] test_runtimeCodeHasNoDelegatecallOrSelfdestruct() (gas: 3062681)\n[PASS] test_runtimeFitsEip170() (gas: 8537)\n[PASS] test_swarmShareArrivesWholeAndIsClaimableWhole() (gas: 163666)\n[PASS] test_transferEmitsAndUpdatesBalances() (gas: 136762)\n[PASS] test_transferFromRevertsBeyondAllowance() (gas: 138679)\n[PASS] test_transferFromRevertsBeyondBalanceEvenWithAllowance() (gas: 144244)\n[PASS] test_transferFromRevertsWithoutAllowance() (gas: 91441)\n[PASS] test_transferRevertsOnInsufficientBalance() (gas: 91263)\n[PASS] test_transferRevertsToZeroAddress() (gas: 88679)\n[PASS] test_transferZeroAmountSucceeds() (gas: 43274)\nSuite result: ok. 28 passed; 0 failed; 0 skipped; finished in 13.97ms (55.80ms CPU time)\n\nRan 2 test suites in 15.33ms (14.37ms CPU time): 29 tests passed, 0 failed, 0 skipped (29 total tests)\n","passed":true},{"durationMs":42,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"MADToken.approve(address,uint256)\",\"MADToken.transfer(address,uint256)\",\"MADToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"README.md\":146,\"foundry.toml\":22,\"remappings.txt\":2,\"script/Deploy.s.sol\":22,\"src/MADToken.sol\":37,\"test/Deploy.t.sol\":19,\"test/MADToken.t.sol\":381},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true},{"durationMs":512,"exitCode":0,"name":"slither","output":"slither: no results at low impact or above","passed":true},{"durationMs":224,"exitCode":0,"name":"aderyn","output":"[low] large-numeric-literal at src/MADToken.sol:26: Large Numeric Literal","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"1879b4e43449dddc65c37b7e13c7f95f7a8794b0fd82bf0b11433f79e8c10a20","verifiedTreeHash":"e5d2249ddd2e03a3c5340783c25478e26d6eb01d","verifierVersion":"0.1.0+ead9012e"},{"checks":[{"durationMs":1197,"exitCode":0,"name":"build","output":"Compiling 29 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.07s\nCompiler run successful!\n","passed":true},{"durationMs":101,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 1 test for test/Deploy.t.sol:DeployTest\n[PASS] test_deployMintsSupplyToTheScriptCaller() (gas: 1550771)\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 382.71µs (195.70µs CPU time)\n\nRan 28 tests for test/MADToken.t.sol:MADTokenTest\n[PASS] testFuzz_transferBeyondBalanceReverts(uint256,uint256) (runs: 256, μ: 98617, ~: 98843)\nLogs:\n  Bound result 880307722003829882101143409\n  Bound result 911653564775746259882243189\n\n[PASS] testFuzz_transferConservesSupply(address,uint256) (runs: 256, μ: 102890, ~: 103271)\nLogs:\n  Bound result 1\n\n[PASS] testFuzz_transferFromWithinAllowance(uint256,uint256) (runs: 256, μ: 199054, ~: 200546)\nLogs:\n  Bound result 1223870080480415506998357\n  Bound result 1223870080480415506998357\n\n[PASS] testFuzz_unknownSelectorReverts(bytes4,bytes) (runs: 256, μ: 48514, ~: 48285)\n[PASS] test_approveAndTransferFrom() (gas: 211596)\n[PASS] test_approveRevertsForZeroSpender() (gas: 30773)\n[PASS] test_constructorEmitsSingleTransferFromZero() (gas: 15414)\n[PASS] test_constructorMintsWholeSupplyToDeployer() (gas: 40183)\n[PASS] test_creationCodeTakesNoConstructorArguments() (gas: 665926)\n[PASS] test_deployerIsWhoeverCallsTheConstructor() (gas: 17977)\n[PASS] test_fullLaunchSplitConservesSupply() (gas: 224648)\n[PASS] test_hasNoOwnerOrPauseView() (gas: 52195)\n[PASS] test_infiniteAllowanceIsNotDecremented() (gas: 173793)\n[PASS] test_metadata() (gas: 58714)\n[PASS] test_noAdminCallIncreasesSupplyOrGrantsBalance() (gas: 706725)\n[PASS] test_noPrivilegedCallMovesOrFreezesAHolder() (gas: 455835)\n[PASS] test_plainEtherIsRefused() (gas: 37242)\n[PASS] test_poolManagerRoundTripMovesExactly() (gas: 175977)\n[PASS] test_runtimeCodeHasNoDelegatecallOrSelfdestruct() (gas: 3062681)\n[PASS] test_runtimeFitsEip170() (gas: 8537)\n[PASS] test_swarmShareArrivesWholeAndIsClaimableWhole() (gas: 163666)\n[PASS] test_transferEmitsAndUpdatesBalances() (gas: 136762)\n[PASS] test_transferFromRevertsBeyondAllowance() (gas: 138679)\n[PASS] test_transferFromRevertsBeyondBalanceEvenWithAllowance() (gas: 144244)\n[PASS] test_transferFromRevertsWithoutAllowance() (gas: 91441)\n[PASS] test_transferRevertsOnInsufficientBalance() (gas: 91263)\n[PASS] test_transferRevertsToZeroAddress() (gas: 88679)\n[PASS] test_transferZeroAmountSucceeds() (gas: 43274)\nSuite result: ok. 28 passed; 0 failed; 0 skipped; finished in 15.75ms (53.40ms CPU time)\n\nRan 2 test suites in 16.65ms (16.14ms CPU time): 29 tests passed, 0 failed, 0 skipped (29 total tests)\n","passed":true},{"durationMs":54,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"MADToken.approve(address,uint256)\",\"MADToken.transfer(address,uint256)\",\"MADToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"README.md\":146,\"foundry.toml\":22,\"launch.json\":24,\"remappings.txt\":2,\"script/Deploy.s.sol\":22,\"src/MADToken.sol\":37,\"test/Deploy.t.sol\":19,\"test/MADToken.t.sol\":381},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"24d87b9d9b62ca725a278976dfcbaf61f400b70b2a993752a544b4e5de14a524","verifiedTreeHash":"62ff5f746b92f637f12178d1e66e52a31c6be8dd","verifierVersion":"0.1.0+ead9012e"},{"checks":[{"durationMs":1886,"exitCode":0,"name":"build","output":"Compiling 31 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.81s\nCompiler run successful!\n","passed":true},{"durationMs":10098,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 1 test for test/Deploy.t.sol:DeployTest\n[PASS] test_deployMintsSupplyToTheScriptCaller() (gas: 1550771)\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 458.85µs (238.42µs CPU time)\n\nRan 28 tests for test/MADToken.t.sol:MADTokenTest\n[PASS] testFuzz_transferBeyondBalanceReverts(uint256,uint256) (runs: 256, μ: 98736, ~: 98853)\nLogs:\n  Bound result 1223870080480415506998357\n  Bound result 1000000000000000000000000000\n\n[PASS] testFuzz_transferConservesSupply(address,uint256) (runs: 256, μ: 103050, ~: 103271)\nLogs:\n  Bound result 1\n\n[PASS] testFuzz_transferFromWithinAllowance(uint256,uint256) (runs: 256, μ: 199296, ~: 200546)\nLogs:\n  Bound result 7855246750509725240\n  Bound result 3575560443821380119\n\n[PASS] testFuzz_unknownSelectorReverts(bytes4,bytes) (runs: 256, μ: 48510, ~: 48264)\n[PASS] test_approveAndTransferFrom() (gas: 211596)\n[PASS] test_approveRevertsForZeroSpender() (gas: 30773)\n[PASS] test_constructorEmitsSingleTransferFromZero() (gas: 15414)\n[PASS] test_constructorMintsWholeSupplyToDeployer() (gas: 40183)\n[PASS] test_creationCodeTakesNoConstructorArguments() (gas: 665926)\n[PASS] test_deployerIsWhoeverCallsTheConstructor() (gas: 17977)\n[PASS] test_fullLaunchSplitConservesSupply() (gas: 224648)\n[PASS] test_hasNoOwnerOrPauseView() (gas: 52195)\n[PASS] test_infiniteAllowanceIsNotDecremented() (gas: 173793)\n[PASS] test_metadata() (gas: 58714)\n[PASS] test_noAdminCallIncreasesSupplyOrGrantsBalance() (gas: 706725)\n[PASS] test_noPrivilegedCallMovesOrFreezesAHolder() (gas: 455835)\n[PASS] test_plainEtherIsRefused() (gas: 37242)\n[PASS] test_poolManagerRoundTripMovesExactly() (gas: 175977)\n[PASS] test_runtimeCodeHasNoDelegatecallOrSelfdestruct() (gas: 3062681)\n[PASS] test_runtimeFitsEip170() (gas: 8537)\n[PASS] test_swarmShareArrivesWholeAndIsClaimableWhole() (gas: 163666)\n[PASS] test_transferEmitsAndUpdatesBalances() (gas: 136762)\n[PASS] test_transferFromRevertsBeyondAllowance() (gas: 138679)\n[PASS] test_transferFromRevertsBeyondBalanceEvenWithAllowance() (gas: 144244)\n[PASS] test_transferFromRevertsWithoutAllowance() (gas: 91441)\n[PASS] test_transferRevertsOnInsufficientBalance() (gas: 91263)\n[PASS] test_transferRevertsToZeroAddress() (gas: 88679)\n[PASS] test_transferZeroAmountSucceeds() (gas: 43274)\nSuite result: ok. 28 passed; 0 failed; 0 skipped; finished in 271.51ms (511.42ms CPU time)\n\nRan 26 tests for test/MADTokenProperties.t.sol:MADTokenPropertiesTest\n[PASS] testFuzz_failedDelegatedTransferPreservesState(uint256,uint256,bool) (runs: 1000, μ: 662650, ~: 662576)\nLogs:\n  Bound result 528979068875192002076226172\n  Bound result 340178087155392789776828764331723471983399036912314623473453487900\n\n[PASS] testFuzz_partialSpendsExhaustExactlyOneApproval(uint256,uint256) (runs: 1000, μ: 843949, ~: 845659)\nLogs:\n  Bound result 4495\n  Bound result 96\n\n[PASS] testFuzz_replacementApprovalIsTheEntireNewBudget(uint256,uint256) (runs: 1000, μ: 206605, ~: 206944)\n[PASS] testFuzz_selfTransferPreservesAllState(uint256,uint256) (runs: 1000, μ: 658822, ~: 658988)\nLogs:\n  Bound result 651\n  Bound result 23\n\n[PASS] testFuzz_transferRoundTripRestoresAllState(uint256) (runs: 1000, μ: 667327, ~: 667354)\nLogs:\n  Bound result 412887340396042914\n\n[PASS] testFuzz_zeroRecipientPreservesAllowance(uint256,uint256) (runs: 1000, μ: 605872, ~: 606127)\nLogs:\n  Bound result 0\n  Bound result 9\n\n[PASS] test_approvalCannotBeBorrowedByAnotherSpender() (gas: 596096)\n[PASS] test_approvalReplacementAndRevocationTakeEffectImmediately() (gas: 1306639)\n[PASS] test_entireSupplyCanLeaveAndReturnToDeployer() (gas: 201239)\n[PASS] test_exactAllowanceCanOnlyBeSpentOnce() (gas: 690759)\n[PASS] test_infiniteApprovalSurvivesRepeatedSpendingButCanBeRevoked() (gas: 900342)\n[PASS] test_insufficientBalanceDoesNotConsumeAllowanceAndCanBeRetried() (gas: 783940)\n[PASS] test_maxMinusOneAllowanceIsFinite() (gas: 153357)\n[PASS] test_maximumTransferRevertsWithoutChangingState() (gas: 547819)\n[PASS] test_oneWeiMovesExactly() (gas: 93378)\n[PASS] test_repeatedApprovalIsIdempotentAndEmits() (gas: 597402)\n[PASS] test_selfTransferOfWholeSupplyEmitsAndPreservesState() (gas: 597727)\n[PASS] test_selfTransferStillRequiresSufficientBalance() (gas: 547615)\n[PASS] test_transferFromByHolderStillRequiresSelfApproval() (gas: 684922)\n[PASS] test_transferFromToSelfConsumesAllowanceWithoutMovingBalances() (gas: 128813)\n[PASS] test_zeroApprovalToZeroSpenderIsRejected() (gas: 602520)\n[PASS] test_zeroRecipientDoesNotConsumeFiniteAllowance() (gas: 598539)\n[PASS] test_zeroTransferFromEmptyAccountEmitsAndPreservesState() (gas: 603419)\n[PASS] test_zeroTransferFromNeedsNeitherBalanceNorAllowanceAndEmits() (gas: 556744)\n[PASS] test_zeroTransferFromToZeroRecipientIsRejected() (gas: 548574)\n[PASS] test_zeroTransferToZeroAddressIsRejected() (gas: 544666)\nSuite result: ok. 26 passed; 0 failed; 0 skipped; finished in 275.54ms (1.60s CPU time)\n\nRan 2 tests for test/MADTokenInvariant.t.sol:MADTokenInvariantTest\n[PASS]\nMADTokenInvariantTest invariants:\n[PASS] invariant_allowancesMatchLatestApprovalAndSpending\n[PASS] invariant_balancesMatchTransferHistory\n[PASS] invariant_fixedSupplyEqualsAllBalances\n MADTokenInvariantTest invariants (runs: 256, calls: 32768, reverts: 0)\n\n╭-----------------+---------------------+-------+---------+----------╮\n| Contract        | Selector            | Calls | Reverts | Discards |\n+====================================================================+\n| MADTokenHandler | approve             | 3245  | 0       | 0        |\n|-----------------+---------------------+-------+---------+----------|\n| MADTokenHandler | approveUnlimited    | 3242  | 0       | 0        |\n|-----------------+---------------------+-------+---------+----------|\n| MADTokenHandler | approveZeroSpender  | 3255  | 0       | 0        |\n|-----------------+---------------------+-------+---------+----------|\n| MADTokenHandler | attemptTransferFrom | 3193  | 0       | 0        |\n|-----------------+---------------------+-------+---------+----------|\n| MADTokenHandler | revoke              | 3381  | 0       | 0        |\n|-----------------+---------------------+-------+---------+----------|\n| MADTokenHandler | transfer            | 3178  | 0       | 0        |\n|-----------------+---------------------+-------+---------+----------|\n| MADTokenHandler | transferFrom        | 3363  | 0       | 0        |\n|-----------------+---------------------+-------+---------+----------|\n| MADTokenHandler | transferFromToZero  | 3316  | 0       | 0        |\n|-----------------+---------------------+-------+---------+----------|\n| MADTokenHandler | transferOverBalance | 3332  | 0       | 0        |\n|-----------------+---------------------+-------+---------+----------|\n| MADTokenHandler | transferToZero      | 3263  | 0       | 0        |\n╰-----------------+---------------------+-------+---------+----------╯\n\nLogs:\n  Bound result 130710264950932867319162150531\n  Bound result 0\n  Bound result 115792089237316195423570985008687907853269984665640314039457584007913129648763\n  Bound result 3124842407\n  Bound result 165835136700889764268097547\n  Bound result 115792089237316195423570985008687907853269984665640064039457584007916254531222\n  Bound result 415277056096073798304328960\n  Bound result 115792089237316195423570985008687907853269984665640148204320883118148024100805\n  Bound result 0\n  Bound result 1\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 91\n  Bound result 105151831\n  Bound result 115792089237316195423570985008687907853269984665640479874694284897677397737483\n  Bound result 27806097642003482484458960\n  Bound result 53379229735398954789962174\n  Bound result 90\n  Bound result 115792089237316195423570985008687907853269984665640507680691926901159882206829\n  Bound result 115792089237316195423570985008687907853269984665639620398223241114666377085429\n  Bound result 0\n  Bound result 115792089237316195423570985008687907853269984665639620399457241114666377083518\n  Bound result 115792089237316195423570985008687907853269984665639620398223241114666377094519\n  Bound result 185033328611249917434409953704171\n  Bound result 115792089237316195423570985008687907853269984665640564039457584007913129639935\n  Bound result 36874\n\n[PASS] test_handlerExercisesSpendingFailuresAndRecovery() (gas: 1722909)\nLogs:\n  Bound result 115792089237316195423570985008687907853269984665640564039457584007913129639935\n\nSuite result: ok. 2 passed; 0 failed; 0 skipped; finished in 10.01s (10.01s CPU time)\n\nRan 4 test suites in 10.01s (10.55s CPU time): 57 tests passed, 0 failed, 0 skipped (57 total tests)\n","passed":true},{"durationMs":48,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"MADToken.approve(address,uint256)\",\"MADToken.transfer(address,uint256)\",\"MADToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"README.md\":146,\"foundry.toml\":22,\"remappings.txt\":2,\"script/Deploy.s.sol\":22,\"src/MADToken.sol\":37,\"test/Deploy.t.sol\":19,\"test/MADToken.t.sol\":381,\"test/MADTokenInvariant.t.sol\":274,\"test/MADTokenProperties.t.sol\":374},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"eb1c60655c3a9b8eb823aff2d842a97c736a65c2f29744d96518c8531117eada","verifiedTreeHash":"1cd6a129b9c04834f978bec88bed4c4f5da5fbe3","verifierVersion":"0.1.0+ead9012e"}]}