{"assessments":[],"deployments":[],"fuzz":[],"identity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"interpretation":"Records acceptance and evidence. Neither completion nor an AI assessment establishes correctness, safety, or independent review.","jobId":"b7722b73-f5c0-47b5-b5f5-2bea7cb959ab","kind":"shape:chain","nodes":[{"acceptedSubmissionHash":"c184801ebcb96528bc4bf7e64a882a26108420bcae36881d26d13d5c7c4c3c16","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_economics","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"8af7e70ff13365cf7a48a74a2b8b660b12d2683118ad6b7e9ee0d2718f6e55ba","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_flow","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"44acd4626d1cb2f5f383e9be7d11315d671f948fdff1c0e07e41506eb1b9660c","dependsOn":["build_contract_project","write_foundry_tests","manifest","audit_math","audit_permissions","audit_economics","audit_flow"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"af3aa01159bbf354f621cafa5c0006f6169e0938a8b015be508b7377dbf165bc","skillId":"audit-judge","tools":[]},"key":"audit_judge","kind":"code","role":"review","skillHash":"af3aa01159bbf354f621cafa5c0006f6169e0938a8b015be508b7377dbf165bc","skillId":"audit-judge","state":"accepted"},{"acceptedSubmissionHash":"720e3111318c1b64f590168c8b9d64620e5279fdc71e3c2391b2b08392863df5","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_math","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"b88b747b187795b3bf76965670559dd5acd1bf1aaba85b511ea141bd2d8f5925","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_permissions","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"bb3308cc97b6d37022f541ceba9dc3e49639d86d1e3d4d2a2ad890d1919ee533","dependsOn":[],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"d59561da3b378461b7c749f6bd5084477d44993aa94972ddea90f542535751df","skillId":"build-contract-project","tools":[]},"key":"build_contract_project","kind":"code","role":"implement","skillHash":"d59561da3b378461b7c749f6bd5084477d44993aa94972ddea90f542535751df","skillId":"build-contract-project","state":"accepted"},{"acceptedSubmissionHash":"7397aafb3373e46244575b33d7150bc2d545b0bcff9237a20cf32bb5ddb300a3","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"tools":[]},"key":"manifest","kind":"code","role":"integrate","skillHash":null,"skillId":null,"state":"accepted"},{"acceptedSubmissionHash":"0fa29849bfba8e8bb3de445ec97c65e89695b2b00c4051915c8a60ad994388bc","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"4c76766b00591dfe982fe85d3de589fdb2f810e5137c301155d1c5e36a1d3b23","skillId":"write-foundry-tests","tools":[]},"key":"write_foundry_tests","kind":"code","role":"tests","skillHash":"4c76766b00591dfe982fe85d3de589fdb2f810e5137c301155d1c5e36a1d3b23","skillId":"write-foundry-tests","state":"accepted"}],"objective":"A custom token: moneycanbuy (YOLO).\nToken name: moneycanbuy\nToken symbol: YOLO\nToken supply: 1,000,000,000 with 18 decimals, all minted once to the deployer in the constructor.\nWhat it does: yolo","parentJobId":null,"planHash":"be63ce90d290fc76330e6e1522778b5cd5fd9d94719a50b5a8586d8839347cd4","previousHash":"0000000000000000000000000000000000000000000000000000000000000000","projectId":"b7722b73-f5c0-47b5-b5f5-2bea7cb959ab","publication":{"commit":null,"deliveredAt":null,"repoUrl":"https://github.com/identity-md-launches/launch-2310-moneycanbuy"},"receiptIdentity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"registry":"0xb6d0a187b050fa5bb0b87033a203f37becf4a775","research":[],"schema":"identitymd-work-v1","signals":[{"agentId":"52191","feedbackHash":"b5b22c4f5c00ef58aff9e60602f01ca2f4712ad987516de50a098afc7b9bd3af","nodeKey":"audit_economics","submissionHash":"c184801ebcb96528bc4bf7e64a882a26108420bcae36881d26d13d5c7c4c3c16","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51451","feedbackHash":"381de5b6cf750e5ce5f6db1763009d5c9ac2e0fc565f4e7c6121df065dc7152e","nodeKey":"audit_flow","submissionHash":"8af7e70ff13365cf7a48a74a2b8b660b12d2683118ad6b7e9ee0d2718f6e55ba","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52165","feedbackHash":"58bb0e1ee76883ba6df2e2a62c457dca08bc5fb1eb92161ff366229599760c8b","nodeKey":"audit_judge","submissionHash":"44acd4626d1cb2f5f383e9be7d11315d671f948fdff1c0e07e41506eb1b9660c","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52180","feedbackHash":"8e0e06cca1065260c5066bab0f433341423dcbc314816cff91a2f46ef03679bb","nodeKey":"audit_math","submissionHash":"720e3111318c1b64f590168c8b9d64620e5279fdc71e3c2391b2b08392863df5","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"50961","feedbackHash":"80038fe40bf5882e74c3564b6f69b32630df777067936674f5fe1b5eafaa5259","nodeKey":"audit_permissions","submissionHash":"b88b747b187795b3bf76965670559dd5acd1bf1aaba85b511ea141bd2d8f5925","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52151","feedbackHash":"3db6b49ce9aad1eba4ae6ab43a26e030cecbb157486034f1e0237168187ed2aa","nodeKey":"build_contract_project","submissionHash":"bb3308cc97b6d37022f541ceba9dc3e49639d86d1e3d4d2a2ad890d1919ee533","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"52335","feedbackHash":"32a5fe5edb6bb29d0ed37a71478ea9186552c6530dd8ce72307fa1bdd96f8455","nodeKey":"manifest","submissionHash":"7397aafb3373e46244575b33d7150bc2d545b0bcff9237a20cf32bb5ddb300a3","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"52121","feedbackHash":"929aa5b0cc2a03a00f9c109fb1cdc3c5af37fe69c173a2b0e89b8611d3aca97a","nodeKey":"write_foundry_tests","submissionHash":"0fa29849bfba8e8bb3de445ec97c65e89695b2b00c4051915c8a60ad994388bc","tag1":"verification:checks","tag2":"acceptance-v2","value":1}],"site":null,"snapshotHash":"40acb2ac7a0140b453df51057cfaca063c02bc8307ac4d792ac176a68c69bf35","state":"completed","submissions":[{"artifacts":[],"attempt":1,"bundleHash":"870b6b5dd9a20b401237fdf9650a3c078fde120482899e9fe50d9b64c3e7f696","device":"bdd9b74dce66953d","findings":[],"hash":"0fa29849bfba8e8bb3de445ec97c65e89695b2b00c4051915c8a60ad994388bc","nodeId":"26bbbfd5-ff6d-4b16-8c0c-9880f2b9466a","outcome":"completed","summary":"I added two test files: an invariant suite and a set of edge-case tests. All 69 tests pass with `forge test` under the verifier's seed (`0x13ffeaa2…2bdc`), and `forge build` is clean. I found no defects in `YoloToken`, so there is no `.imd-findings.json`.\n\n**`test/YoloToken.invariant.t.sol`** runs random call sequences against the token.\n- **How it works:** a handler deploys the token, so it starts with the whole supply the way the factory does. It drives every call that changes state, using five actors and inputs aimed at the edges: zero, exactly the balance, one more than the balance, unlimited allowances, and adding one past the allowance limit.\n- **What it checks:** it keeps its own simple record of balances, allowances and burns, written separately from the token's code. Each call must match that record: success with exactly the expected effect, or a revert with the exact expected error.\n- **Invariants:**\n  - every call matched the record;\n  - balances add up to `totalSupply`, which equals the starting supply minus burns and never goes above it;\n  - address(0) never holds anything;\n  - every balance and allowance matches the record;\n  - name, symbol and decimals never change.\n- **Settings:** inline config sets 256 runs, depth 64, and fail-on-revert.\n- **Checked against planted bugs:** I put two bugs into `src/YoloToken.sol` one at a time: an allowance that wasn't fully spent, and a burn that took only half off `totalSupply`. The suite failed on both. I then restored the file, and `git status` shows `src/` unchanged.\n\n**`test/YoloToken.edge.t.sol`** covers what the existing `YoloToken.t.sol` didn't:\n- **Launch in one call:** a factory-like contract deploys the token with CREATE2 and splits it 10/60/30 in the same call; each share arrives exactly, and so does the distributor's claim. The supply goes to the deploying contract, not `tx.origin`.\n- **Supply edges:** transferring the whole supply works; the supply plus one and `uint256.max` both revert.\n- **Allowance failure paths:**\n  - `transferFrom` from your own account still needs an allowance, and allowances are tracked per owner and per spender.\n  - Spending exactly the allowance leaves zero; an unlimited allowance is never reduced and emits no Approval event.\n  - Overflow in `increaseAllowance` reverts with Panic 0x11; the zero-address spender is rejected by both increase and decrease.\n- **Burns:** burning the whole supply, burning zero, `burnFrom` with an unlimited allowance, and the right order of events. A `burnFrom` that fails on balance leaves the allowance unchanged. Tokens can't be burned from or moved out of address(0).\n- **Fuzz tests (1,000 runs each):** any sender and amount either moves exactly or reverts with the right error; `burnFrom` respects both the allowance and the balance; increasing then decreasing an allowance returns it to where it started.\n\nI didn't change `test/YoloToken.t.sol` (the existing accepted tests) or anything outside `test/`, and I haven't committed the two new files.","treeHash":"a8c67c358a7a066f949f05cee019ff459a66969c","usage":{"cachedInputTokens":439211,"inputTokens":18,"model":"claude-opus-5-5","outputTokens":19383,"runtime":"claude","turns":10,"wallClockMs":258957}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"e12f98dda6acc55f","findings":[{"citation":"resolved","description":"Merged from audit_permissions (low), audit_economics (info), audit_math (info) and audit_flow (info): one root cause. _transfer (line 139) guards only `to`, _approve (line 162) guards only `spender`, and _burn (line 151) and _spendAllowance (line 167) have no zero-address guard at all. The contract's own error NatSpec (line 60: 'Transfers and approvals involving the zero address are refused') and README line 29 promise that any zero-address transfer reverts. Because balanceOf[address(0)] and allowance[address(0)][x] are always 0, a non-zero amount reverts with InsufficientAllowance, so no value can ever move. With amount == 0 every check passes (0 < 0 is false), so any unprivileged caller can make the token emit Approval(address(0), caller, 0) and Transfer(address(0), to, 0) via transferFrom, or Transfer(address(0), address(0), 0) via burnFrom. Transfer from the zero address is the ERC-20 mint convention and is what the constructor (line 73) and the event NatSpec (line 44) use as the mint/burn signal, so indexers and explorers that classify by that shape can be fed arbitrary zero-value fake mint rows and fake holder entries for any address. No balance, allowance or totalSupply changes; the fixed supply and launch flows are unaffected, hence low. OpenZeppelin ERC20 rejects this with ERC20InvalidSender(address(0)). Minimal fix preserving the design: add `if (from == address(0)) revert ZeroAddress();` at the top of _transfer and _burn (or reject owner == address(0) in _spendAllowance), or amend the NatSpec and README to say only `to` and `spender` are refused.","line":139,"path":"src/YoloToken.sol","reproduction":"State: fresh `new YoloToken()`; bob = address(0xB0B) holds nothing and has no allowance from anyone. Call 1: vm.prank(bob); token.transferFrom(address(0), carol, 0). Expected (line 60 NatSpec, README line 29, OZ semantics): revert ZeroAddress(). Actual: returns true and emits Approval(address(0), bob, 0) then Transfer(address(0), carol, 0); totalSupply stays 1e27, balanceOf(carol) stays 0. Call 2: vm.prank(bob); token.burnFrom(address(0), 0). Expected: revert ZeroAddress(). Actual: succeeds and emits Transfer(address(0), address(0), 0); totalSupply stays 1e27. Control: vm.prank(bob); token.transferFrom(address(0), carol, 1) and burnFrom(address(0), 1) both revert InsufficientAllowance(bob, 0, 1), so nothing beyond the zero-value events is reachable. Reproduced against this tree with a scratch Foundry test using vm.expectEmit(true,true,true,true) on both events and assertTrue on the return value: all assertions pass on the current code (forge test --match-path test/scratch/ZeroFrom.t.sol, 6/6 passed).","severity":"low","snippet":"        if (to == address(0)) revert ZeroAddress();\n        uint256 fromBalance = balanceOf[from];\n        if (fromBalance < amount) revert InsufficientBalance(from, fromBalance, amount);","title":"transferFrom and burnFrom accept from == address(0) for zero amounts, emitting mint-shaped Transfer and Approval events the NatSpec and README say are refused"}],"hash":"44acd4626d1cb2f5f383e9be7d11315d671f948fdff1c0e07e41506eb1b9660c","nodeId":"7b3b6962-f5b2-4d9c-bfe3-f8b093c4901a","outcome":"completed","summary":"The review is complete. The findings file is written and the tree is otherwise unchanged.\n\n**Outcome:** one low-severity finding, merged from the four specialists' reports, which all described the same root cause. Nothing critical, high or medium was found.\n\n**The finding (low):** `transferFrom` and `burnFrom` accept the zero address as `from` when the amount is zero. The guard at `src/YoloToken.sol:139` only checks `to`, and `_burn` and `_spendAllowance` have no zero-address check. Any caller with no balance or allowance can make the token emit mint-shaped events such as Transfer from the zero address. No balance, allowance or supply changes, and a non-zero amount correctly reverts. The NatSpec and README promise these calls are refused, so this is a documented-behaviour mismatch that can feed indexers fake mint rows. I reproduced it with a scratch Foundry test, which has been removed. The fix is a one-line `from == address(0)` revert in `_transfer` and `_burn`, or amending the docs.\n\n**What I verified myself beyond the specialists:**\n- Self-transfers leave the balance unchanged despite the unchecked block.\n- Unlimited allowance is never decremented, and increasing an allowance past the maximum reverts.\n- Supply can only shrink, and only through a holder's own burn or an explicitly granted allowance.\n- The manifest matches the code: no constructor arguments, supply of 1e27 minted to the deployer, 18 decimals, lowercase addresses, schema keys only.\n- The static-analysis lead about a large numeric literal is the supply constant and is not a defect.\n\n**Coverage:** all 7 entry points answered, plus two invariant rows. Five hold, and two point to the single finding.","treeHash":null,"usage":{"cachedInputTokens":306114,"inputTokens":162,"model":"claude-fable-5-1","outputTokens":7248,"runtime":"claude","turns":13,"wallClockMs":105679}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"c722c2e9ac9aa084","findings":[{"citation":"resolved","description":"_transfer and _spendAllowance check only the recipient and the spender against the zero address, never the owner/sender. Since allowance[address(0)][x] is 0 and balanceOf[address(0)] is 0, a non-zero amount reverts correctly (InsufficientAllowance), but amount == 0 passes both `current < amount` and `fromBalance < amount`, so transferFrom(address(0), to, 0) succeeds, writes allowance[0][spender] = 0 and emits Approval(address(0), spender, 0) followed by Transfer(address(0), to, 0). burnFrom(address(0), 0) likewise emits Transfer(address(0), address(0), 0). No balance or supply changes, so there is no loss; the effect is that any unprivileged caller can forge zero-value events that indexers interpreting Transfer-from-zero as a mint will record. OpenZeppelin ERC20 rejects from == address(0) (ERC20InvalidSender). Suggested minimal fix: in _transfer (or in transferFrom/burnFrom) revert ZeroAddress() when from == address(0). This does not change any intended behaviour.","line":139,"path":"src/YoloToken.sol","reproduction":"State: fresh YoloToken; bob holds nothing and has no allowance from anyone. Call: vm.prank(bob); token.transferFrom(address(0), carol, 0). Expected (OpenZeppelin semantics and the contract's own ZeroAddress error doc): revert ZeroAddress(). Actual: returns true, emits Approval(address(0), bob, 0) and Transfer(address(0), carol, 0); totalSupply stays 1e27 and balanceOf(carol) stays 0. Likewise vm.prank(bob); token.burnFrom(address(0), 0) emits Transfer(address(0), address(0), 0). Verified with a Foundry test using vm.expectEmit on both events; a non-zero amount, e.g. transferFrom(address(0), carol, 1), correctly reverts InsufficientAllowance(bob, 0, 1).","severity":"info","snippet":"        if (to == address(0)) revert ZeroAddress();\n        uint256 fromBalance = balanceOf[from];\n        if (fromBalance < amount) revert InsufficientBalance(from, fromBalance, amount);","title":"transferFrom/burnFrom accept from == address(0) when amount == 0, letting anyone emit a mint-shaped Transfer(0x0, to, 0) and an Approval(0x0, spender, 0)"}],"hash":"720e3111318c1b64f590168c8b9d64620e5279fdc71e3c2391b2b08392863df5","nodeId":"54f08ad6-b7d3-451d-9723-4b7c5ed00161","outcome":"completed","summary":"The review is complete and the findings file is written. The tree is unchanged apart from the gitignored `.imd-findings.json`, and the scratch tests were removed.\n\n**Result:** the math in `src/YoloToken.sol` holds. The contract has no fixed-point math, no division, no external calls and no downcasts, so the Math Precision, Boundary and Numerical Gap checklists reduce to the supply constant, the four unchecked blocks and the allowance sentinel. I traced each and confirmed them with a scratch Foundry test suite of 11 tests, including fuzzed conservation of supply over random transfer and burn sequences, self-transfer inside the unchecked block, whole-supply moves and burns to zero, and every unlimited-allowance edge.\n\n**One informational finding was recorded.** Anyone can call `transferFrom(address(0), to, 0)` or `burnFrom(address(0), 0)`. The zero-amount path passes both the allowance and balance checks, so the call succeeds and emits a mint-shaped `Transfer(0x0, to, 0)` and an `Approval(0x0, spender, 0)`. Nothing moves and the supply is unchanged, so there is no loss. OpenZeppelin rejects a zero sender, and a one-line check on `from` in the internal transfer would close it without changing intended behaviour. It carries no proof file because it is not high severity.\n\n**Leads checked and dropped:**\n- The aderyn large-literal warning on the supply constant evaluates to exactly 1e27, matching the manifest supply.\n- Overflow of the allowance increase reverts with a checked-arithmetic panic rather than a typed error. That is documented in the project's own tests and is design, not a defect.\n\n**Coverage:** all seven entry points have rows, five hold and two reference the finding, plus two invariant rows. The protected launch test could not be run here because its Uniswap v4 dependencies and environment variables are not in this tree, so the launch-flow exactness is argued from the code's lack of any fee or exemption logic rather than executed.","treeHash":null,"usage":{"cachedInputTokens":669000,"inputTokens":290,"model":"claude-fable-5-1","outputTokens":13213,"runtime":"claude","turns":18,"wallClockMs":183462}},{"artifacts":[],"attempt":1,"bundleHash":"30ce42de75c1a1f611a587f565d0a1570daf6c27307aa138b5e718e59f733d8c","device":"4da6f73105193824","findings":[],"hash":"7397aafb3373e46244575b33d7150bc2d545b0bcff9237a20cf32bb5ddb300a3","nodeId":"9a38fa77-8e98-4906-acd5-917a45c0291a","outcome":"completed","summary":"Created [launch.json](/home/imd/.identitymd/work/b7722b73-f5c0-47b5-b5f5-2bea7cb959ab/9a38fa77-8e98-4906-acd5-917a45c0291a/launch.json) matching `YoloToken`, its constructor supply, and the exact pool and economics values.\n\n`forge build` succeeded. All 35 tests passed with the supplied fuzz seed. Only `launch.json` is changed for submission.","treeHash":"274922f0b22e09daea93e19ba6118379c7b9aa40","usage":{"cachedInputTokens":179072,"inputTokens":28996,"model":"gpt-6-astra","outputTokens":2294,"runtime":"codex","turns":3,"wallClockMs":80555}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"79373c79d1351eba","findings":[{"citation":"resolved","description":"Execution-trace sentinel check. _transfer (line 139) refuses to == address(0) but neither _transfer nor _burn nor _spendAllowance refuses from == address(0). For a non-zero amount the path is harmless because allowance[address(0)][caller] is 0 and the InsufficientAllowance check reverts. For amount == 0 every check passes (0 < 0 is false, balanceOf[0] = 0 >= 0), so any caller can make the token emit Transfer(address(0), to, 0) via transferFrom, or Transfer(address(0), address(0), 0) via burnFrom. Explorers and indexers classify a Transfer from the zero address as a mint, so an arbitrary caller can append zero-value 'mint' and 'burn' rows to the token's event history. No balance or totalSupply changes, so there is no loss and no supply growth. OpenZeppelin's ERC20 rejects this with ERC20InvalidSender(address(0)); a one-line `if (from == address(0)) revert ZeroAddress();` at the top of _transfer and _burn would match that and keep the event log honest. Reported for completeness; not a blocking defect.","line":167,"path":"src/YoloToken.sol","reproduction":"Deploy YoloToken. From any EOA bob (no balance, no allowance) call token.transferFrom(address(0), bob, 0). Expected (OZ semantics): revert for a zero-address sender. Actual: returns true, emits Transfer(0x0, bob, 0), totalSupply still 1e27, balanceOf(bob) still 0. Likewise token.burnFrom(address(0), 0) emits Transfer(0x0, 0x0, 0). With amount 1 both calls revert with InsufficientAllowance(bob, 0, 1). Verified with a Foundry test (vm.expectEmit on Transfer(address(0), bob, 0) passes against the current code).","severity":"info","snippet":"    function _spendAllowance(address owner, address spender, uint256 amount) internal {\n        uint256 current = allowance[owner][spender];\n        if (current == type(uint256).max) return;\n        if (current < amount) revert InsufficientAllowance(spender, current, amount);","title":"transferFrom/burnFrom accept from == address(0) with a zero amount and emit a Transfer from the zero address"}],"hash":"8af7e70ff13365cf7a48a74a2b8b660b12d2683118ad6b7e9ee0d2718f6e55ba","nodeId":"8c388a94-3219-4206-a1c7-0e4cb97545d6","outcome":"completed","summary":"The review is complete and `.imd-findings.json` is written at the repository root. No source files were changed, and the scratch test was removed.\n\n**Result: no defects of low severity or above.** The token at `src/YoloToken.sol` is a 176-line self-contained ERC-20 with no owner, no external calls, no receive or fallback, and no mint path. All 35 existing tests pass.\n\n**What I traced, per the three assigned lenses**\n\n- **Execution trace.** Every state-changing path from each of the seven entry points through `_transfer`, `_burn`, `_approve` and `_spendAllowance`. Balance and allowance checks precede the unchecked arithmetic, the unlimited-allowance sentinel skips only the decrement, a self-transfer ends with the balance unchanged, and a revert inside `_transfer` rolls back the allowance already spent in `transferFrom`.\n- **Periphery.** There are no libraries, helpers or dependencies. The launch harness side was checked instead: the constructor mints exactly one billion tokens with 18 decimals to `msg.sender`, transfers move the exact amount, and `transfer` returns true, so the factory-to-distributor move, the pool seed and both swap directions in the protected floor arrive whole.\n- **First principles.** The sum-of-balances equals totalSupply invariant holds because the constructor is the only upward write and `_burn` lowers balance and supply together. The unchecked `balanceOf[to] += amount` relies on that invariant and the fixed cap, which nothing can grow.\n\n**One informational finding.** A zero-amount `transferFrom` or `burnFrom` with `from == address(0)` succeeds and emits a Transfer from the zero address, which explorers display as a mint or burn of zero. Balances and supply are untouched. I verified it with a Foundry test before reporting and suggested a one-line sender check matching OpenZeppelin's behaviour.\n\n**Coverage.** All seven listed entry points have a row, plus three invariant rows. The two static-analysis leads were a style-only large-literal note and an empty Slither run, and neither produced a finding.","treeHash":null,"usage":{"cachedInputTokens":405850,"inputTokens":194,"model":"claude-fable-5-1","outputTokens":9111,"runtime":"claude","turns":17,"wallClockMs":141855}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"d68ba89c0b30801c","findings":[{"citation":"resolved","description":"Asymmetry (pair transfer-side `to` guard vs `from` guard; pair _transfer vs _approve): `_transfer` refuses `to == address(0)` and `_approve` refuses `spender == address(0)`, but neither `_transfer`, `_burn` nor `_spendAllowance` refuses `from == address(0)` / `owner == address(0)`. The contract's own error NatSpec (line 60, `/// @notice Transfers and approvals involving the zero address are refused.`) and the README state that every zero-address transfer is refused. Because `balanceOf[address(0)]` and `allowance[address(0)][*]` are always 0, a nonzero amount still reverts (InsufficientAllowance), so no value can move. But with amount == 0 every check passes: `_spendAllowance(address(0), caller, 0)` writes `allowance[0][caller] = 0` and emits `Approval(address(0), caller, 0)`; `_transfer(address(0), X, 0)` emits `Transfer(address(0), X, 0)`, which is exactly the shape of a mint event (the constructor and the NatSpec on line 44 define `Transfer` from the zero address as the mint/burn signal). `burnFrom(address(0), 0)` likewise emits `Transfer(address(0), address(0), 0)`. Access control: this is reachable by any unprivileged caller, no allowance required. Impact: no balance or supply change; indexers, explorers and holder-count services that classify `from == address(0)` as a mint, or that add `to` to a holder list on any Transfer, can be fed arbitrary fake mint/holder events to any address by anyone, and the stated guarantee is false. Reference OpenZeppelin ERC20 reverts with ERC20InvalidSender for `from == address(0)`. Minimal fix that preserves the design: add `if (from == address(0)) revert ZeroAddress();` at the top of `_transfer` and `_burn` (or in `_spendAllowance` for `owner == address(0)`), mirroring the existing `to`/`spender` guards.","line":139,"path":"src/YoloToken.sol","reproduction":"State: fresh YoloToken (any deployer). Call from any address A (no balance, no allowance): `token.transferFrom(address(0), victim, 0)`. Expected (per line 60 NatSpec / README): revert ZeroAddress(). Actual: returns true, emits Approval(address(0), A, 0) then Transfer(address(0), victim, 0); balances and totalSupply unchanged. Likewise `token.burnFrom(address(0), 0)` from A returns and emits Transfer(address(0), address(0), 0). With amount 1 instead of 0 the call reverts InsufficientAllowance(A, 0, 1), confirming no value path. Verified with a scratch Foundry test (vm.expectEmit on both events, assertTrue on the return value) against this tree: all assertions pass on the current code.","severity":"low","snippet":"    function _transfer(address from, address to, uint256 amount) internal {\n        if (to == address(0)) revert ZeroAddress();","title":"Asymmetric zero-address guard: transferFrom/burnFrom accept from == address(0), so anyone can emit spurious Transfer(address(0), X, 0) 'mint' and Approval(address(0), spender, 0) events, contradicting"}],"hash":"b88b747b187795b3bf76965670559dd5acd1bf1aaba85b511ea141bd2d8f5925","nodeId":"db1c020d-50fd-4e2c-9e22-dcc7da1b7acb","outcome":"completed","summary":"The review is complete. The findings file is written and validated, and the scratch directory is removed.\n\n**Outcome:** the token holds up on access control, trust gap and asymmetry. One low-severity defect is reported in `.imd-findings.json`, with full coverage rows for all seven entry points plus the constructor and four invariants.\n\n**What I checked**\n- Permission map: the ABI has 14 selectors, all ERC-20, burn or views. There is no owner, role, modifier, initializer, proxy, receive or fallback, and the runtime has no delegatecall, callcode or selfdestruct. The constructor mints exactly 1e27 to the factory with no arguments and no external calls.\n- Every writer of `balanceOf` and `allowance` was diffed against its paired writer. Guards mirror each other except for one zero-address check. The deployer cannot pull or burn a holder's balance without an allowance, which I re-traced along the protected test's path.\n- Trust-gap seams do not exist here. There is no privileged actor, no fee or price formula and no caller-class branch, so nothing sits at the intersection of authorization and economics.\n- The existing suite passes, 35 tests, and the token meets every row of the x-ray token assumption matrix.\n\n**The finding (low)**\n`_transfer` refuses `to == address(0)` and `_approve` refuses a zero spender, but nothing refuses `from == address(0)`. Since the zero address holds no balance or allowance, a nonzero amount reverts, but with amount 0 any caller can run `transferFrom(address(0), X, 0)` or `burnFrom(address(0), 0)`. That emits `Transfer(address(0), X, 0)`, the exact shape of a mint event, plus a spurious `Approval` from the zero address. No value moves, but it contradicts the contract's own NatSpec and README promise that zero-address transfers are refused, and it lets anyone feed fake mint or holder events to indexers. I verified it with a scratch Foundry test, which passed on the current code. The fix is a mirrored `from == address(0)` check in `_transfer` and `_burn`.\n\n**Not reported:** transfers to the token's own address are accepted and unrecoverable, but the README documents that as a known caveat by design, so I left it out.","treeHash":null,"usage":{"cachedInputTokens":557783,"inputTokens":226,"model":"claude-fable-5-1","outputTokens":11879,"runtime":"claude","turns":19,"wallClockMs":188503}},{"artifacts":[],"attempt":1,"bundleHash":"5e9e062b541919a8c1eeff3e591344398cb50d40490c374f1a88c421151895d1","device":"cdeffb0cd839cbf7","findings":[],"hash":"bb3308cc97b6d37022f541ceba9dc3e49639d86d1e3d4d2a2ad890d1919ee533","nodeId":"0869f2b4-06b8-41ae-88bc-53afd5f14e7e","outcome":"completed","summary":"The deliverable is complete and committed as 7c6da02 on main. The working tree is clean.\n\n**What was built**\n\n- `src/YoloToken.sol` is a self-contained, fixed-supply ERC-20. Name `moneycanbuy`, symbol `YOLO`, 18 decimals. The constructor mints the full 1,000,000,000 tokens once to `msg.sender`, which is the launch factory at deploy. It takes no constructor arguments and makes no external calls.\n- The brief's behaviour is \"yolo\", so the token has no transfer rules. There is no owner, no mint, no pause, no blocklist, no freeze, no upgrade path. Holders can `burn` their own tokens, and `burnFrom` works only through an allowance the holder granted, so supply can only shrink. Transfers move exactly the requested amount, which keeps the launch flows in the protected test whole.\n- Typed errors cover every failure path, and transfers or approvals to the zero address revert.\n- `foundry.toml` pins solc 0.8.26, sets `bytecode_hash = \"none\"` and `cbor_metadata = false`, disables `ffi` and filesystem permissions. The deployed bytecode tail confirms no metadata hash is appended.\n- `forge-std` v1.11.0 is vendored under `lib/forge-std` as plain files with no git metadata and no submodule entry.\n- `README.md` documents assumptions, deployment parameters for the manifest step, operational responsibilities, security notes, and which tools ran.\n\n**Checks**\n\n| Check | Result |\n| --- | --- |\n| `forge build` | passes |\n| `forge test` with the verifier's fuzz seed | 35 passed, 0 failed |\n| `forge test` with an empty environment | 35 passed |\n| `forge fmt --check` | passes |\n| Fresh clone, offline build and test | passes |\n\nThe 35 tests in `test/YoloToken.t.sol` cover metadata, the one-time mint, exact transfers including chained hops, allowance semantics including the unlimited case, burn paths, every revert with its typed error, the absence of admin selectors, the deployer's inability to move a holder's balance, an opcode scan for DELEGATECALL, CALLCODE and SELFDESTRUCT, and four fuzzed conservation properties.\n\n**Left out**\n\nSlither and Mythril were not available on this machine and were not run. The README says so. No `launch.json` was written, as the brief requires.","treeHash":"9b13cee34a11259c668e396f3299fe34097db25c","usage":{"cachedInputTokens":718073,"inputTokens":354,"model":"claude-fable-5-1","outputTokens":18949,"runtime":"claude","turns":21,"wallClockMs":307591}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"1f9cb1750ebf47ed","findings":[{"citation":"resolved","description":"The zero-address guard in _transfer only inspects `to`, and _burn has no zero-address guard at all. The NatSpec on the ZeroAddress error (line 60: 'Transfers and approvals involving the zero address are refused. Use burn instead.') promises both directions are refused. Because allowance[address(0)][anyone] is 0 and balanceOf[address(0)] is 0, any caller can pass `from = address(0)` with `amount = 0`: _spendAllowance passes (0 <= 0), _transfer/_burn pass (0 <= 0), and the contract emits Approval(address(0), caller, 0) plus Transfer(address(0), to, 0) (or Transfer(address(0), address(0), 0) for burnFrom). Transfer events from address(0) are the ERC-20 convention for mints, so off-chain indexers that count mints by that shape see zero-value 'mints' triggered by arbitrary accounts. No balance, allowance or totalSupply changes; the sum-of-balances == totalSupply invariant and the fixed supply are unaffected. OpenZeppelin v5 rejects from == address(0) with ERC20InvalidSender for comparison. Economic impact: none. Reported as an informational doc/behaviour mismatch only. Minimal fix that preserves intended behaviour: add `if (from == address(0)) revert ZeroAddress();` at the top of _transfer and _burn (or in transferFrom/burnFrom), or amend the NatSpec to say only `to`/`spender` are refused.","line":139,"path":"src/YoloToken.sol","reproduction":"State: fresh YoloToken, bob holds nothing, no approvals. Call 1: vm.prank(bob); token.transferFrom(address(0), bob, 0). Expected (per line 60 NatSpec): revert ZeroAddress(). Actual: returns true, emits Approval(0x0, bob, 0) and Transfer(0x0, bob, 0). Call 2: vm.prank(bob); token.burnFrom(address(0), 0). Expected: revert ZeroAddress(). Actual: succeeds, emits Transfer(0x0, 0x0, 0). totalSupply stays 1e27 and all balances unchanged. With amount = 1 both calls revert InsufficientAllowance(bob, 0, 1), so nothing beyond the zero-value event is reachable. Verified with a Foundry test using vm.expectEmit on Transfer(address(0), bob, 0) around the first call.","severity":"info","snippet":"        if (to == address(0)) revert ZeroAddress();","title":"transferFrom and burnFrom accept address(0) as `from` for zero amounts, emitting mint-shaped Transfer events the NatSpec says are refused"}],"hash":"c184801ebcb96528bc4bf7e64a882a26108420bcae36881d26d13d5c7c4c3c16","nodeId":"40e40bb9-55c8-4a68-b30a-caa1b7add928","outcome":"completed","summary":"The review is complete and `.imd-findings.json` is written. The tree is otherwise unchanged: the scratch tests were removed, and the only untracked items are the findings file and build caches, both ignored.\n\n**Outcome.** The economics of `YoloToken` hold. It is a plain fixed-supply ERC-20 with no external calls, no owner, no fee or exemption logic, and no path that can grow the supply. I found one informational defect and no medium or higher issue.\n\n**Finding (info).** The zero-address guard in `_transfer` checks only the recipient, and `_burn` has none. Any account can call `transferFrom(address(0), to, 0)` or `burnFrom(address(0), 0)`. Both succeed and emit a zero-value Transfer from the zero address, which is the mint shape indexers watch for. The NatSpec at src/YoloToken.sol:60 promises such calls are refused. Balances, allowances and supply do not change, so there is no economic impact. A non-zero amount reverts on the allowance check, which I confirmed in a Foundry test.\n\n**What I checked, by guide.**\n- **Economic Security:** no dependencies to break, no token misbehavior in either direction, exact-amount transfers return a 32-byte true so the Uniswap v4 settle and take paths see the full amount. ERC-20 compliance holds apart from the sentinel note above. Infinite allowance is honoured and documented.\n- **Invariant:** a handler-based invariant run of 256 sequences and 128,000 calls mixing transfer, transferFrom, burn, burnFrom and self-transfers never broke sum-of-balances equals totalSupply, never credited address(0), and never let supply exceed the initial mint minus burns. Allowance overflow and underflow revert as intended.\n- **Flow Gap:** no callbacks, no reentrancy surface, no cached-then-mutated state. Factory to distributor to claimant, single-sided seed, and buy/sell flows all move exactly what they say.\n\n**Coverage.** All seven entry points have rows. Five are `holds`. `transferFrom` and `burnFrom` are marked `finding` for the informational item. Five extra rows record the invariants and the launch flow I verified. The aderyn large-literal lead was checked and the literal equals the manifest supply exactly.\n\n**Not reached.** Nothing within the assigned area was left unchecked. I did not run the protected launch harness itself, since it needs the verifier's environment and the v4 core library that is not in this tree.","treeHash":null,"usage":{"cachedInputTokens":601022,"inputTokens":258,"model":"claude-fable-5-1","outputTokens":14617,"runtime":"claude","turns":21,"wallClockMs":340543}}],"verification":[{"checks":[{"durationMs":1456,"exitCode":0,"name":"build","output":"Compiling 23 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.39s\nCompiler run successful!\n","passed":true},{"durationMs":4960,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 35 tests for test/YoloToken.t.sol:YoloTokenTest\n[PASS] testFuzz_burnOnlyShrinksSupply(uint256,uint256) (runs: 256, μ: 126378, ~: 127272)\nLogs:\n  Bound result 680718636188480031186361802\n  Bound result 404518654316002540188551759\n\n[PASS] testFuzz_transferConservesSupply(address,uint256) (runs: 256, μ: 108454, ~: 108797)\nLogs:\n  Bound result 999999999999999999999999999\n\n[PASS] testFuzz_transferFromRespectsAllowance(uint256,uint256) (runs: 256, μ: 172659, ~: 179687)\nLogs:\n  Bound result 599662192\n  Bound result 718463160620551201991420958\n\n[PASS] testFuzz_transferRevertsAboveBalance(uint256,uint256) (runs: 256, μ: 102976, ~: 103422)\nLogs:\n  Bound result 8516182348700691\n  Bound result 8516182348700693\n\n[PASS] test_RevertWhen_approveZeroAddressSpender() (gas: 32542)\n[PASS] test_RevertWhen_burnExceedsBalance() (gas: 93062)\n[PASS] test_RevertWhen_burnFromWithoutAllowance() (gas: 97048)\n[PASS] test_RevertWhen_decreaseAllowanceBelowZero() (gas: 86061)\n[PASS] test_RevertWhen_increaseAllowanceOverflows() (gas: 85626)\n[PASS] test_RevertWhen_transferExceedsBalance() (gas: 95851)\n[PASS] test_RevertWhen_transferFromEmptyAccount() (gas: 37774)\n[PASS] test_RevertWhen_transferFromExceedsAllowance() (gas: 145894)\n[PASS] test_RevertWhen_transferFromExceedsBalanceEvenWithAllowance() (gas: 157735)\n[PASS] test_RevertWhen_transferFromToZeroAddress() (gas: 147885)\n[PASS] test_RevertWhen_transferFromWithoutAllowance() (gas: 98439)\n[PASS] test_RevertWhen_transferToZeroAddress() (gas: 90610)\n[PASS] test_approveOverwritesPreviousAllowance() (gas: 92460)\n[PASS] test_approveSetsAllowanceAndEmits() (gas: 64728)\n[PASS] test_burnFromSpendsAllowance() (gas: 177179)\n[PASS] test_burnReducesBalanceAndSupply() (gas: 114881)\n[PASS] test_constructorEmitsMintTransfer() (gas: 238132)\n[PASS] test_constructorMintsWholeSupplyToDeployer() (gas: 30179)\n[PASS] test_deployerCannotMoveAHoldersBalance() (gas: 165326)\n[PASS] test_increaseAndDecreaseAllowance() (gas: 149937)\n[PASS] test_metadata() (gas: 23667)\n[PASS] test_noAdminSelectorsExist() (gas: 355490)\n[PASS] test_runtimeHasNoDelegatecallCallcodeOrSelfdestruct() (gas: 780410)\n[PASS] test_supplyIsExactlyOneBillionWholeTokens() (gas: 26393)\n[PASS] test_transferChainArrivesWhole() (gas: 189420)\n[PASS] test_transferFromSpendsAllowanceAndEmits() (gas: 218783)\n[PASS] test_transferFromWithMaxAllowanceDoesNotDecrement() (gas: 187715)\n[PASS] test_transferMovesExactAmountAndEmits() (gas: 90188)\n[PASS] test_transferToSelfKeepsBalance() (gas: 98342)\n[PASS] test_transferWholeBalanceLeavesZero() (gas: 129940)\n[PASS] test_transferZeroAmountSucceeds() (gas: 44319)\nSuite result: ok. 35 passed; 0 failed; 0 skipped; finished in 27.67ms (97.02ms CPU time)\n\nRan 30 tests for test/YoloToken.edge.t.sol:YoloTokenEdgeTest\n[PASS] testFuzz_anySenderAnyAmountEitherMovesExactlyOrRevertsCleanly(address,address,uint256,uint256) (runs: 1000, μ: 118738, ~: 109266)\nLogs:\n  Bound result 172366250409661725300151281\n\n[PASS] testFuzz_burnFromNeverExceedsBothLimits(uint256,uint256,uint256) (runs: 1000, μ: 164086, ~: 157607)\nLogs:\n  Bound result 657\n  Bound result 455\n  Bound result 7\n\n[PASS] testFuzz_increaseThenDecreaseRoundTrips(uint256,uint256) (runs: 1000, μ: 144290, ~: 144485)\nLogs:\n  Bound result 6709178651510652073027518132479821836017831585108609750721902616357329700\n  Bound result 130579615538355362450392301822063284350791\n\n[PASS] test_RevertWhen_burnFromExceedsAllowance() (gas: 148078)\n[PASS] test_RevertWhen_burnFromExceedsBalanceRestoresAllowance() (gas: 148140)\n[PASS] test_RevertWhen_burnFromTheZeroAddress() (gas: 32878)\n[PASS] test_RevertWhen_decreaseAllowanceWithNone() (gas: 37793)\n[PASS] test_RevertWhen_decreaseAllowanceZeroSpender() (gas: 34804)\n[PASS] test_RevertWhen_increaseAllowanceOverflowsWithPanic() (gas: 89706)\n[PASS] test_RevertWhen_increaseAllowanceZeroSpender() (gas: 34957)\n[PASS] test_RevertWhen_transferMaxUint() (gas: 35625)\n[PASS] test_RevertWhen_transferOneMoreThanTheSupply() (gas: 35409)\n[PASS] test_allowanceIsPerSpenderAndPerOwner() (gas: 220242)\n[PASS] test_burnFromEmitsApprovalThenTransferToZero() (gas: 158190)\n[PASS] test_burnFromWithUnlimitedAllowanceDoesNotDecrement() (gas: 164770)\n[PASS] test_burnTheWholeSupply() (gas: 74860)\n[PASS] test_burnZeroChangesNothing() (gas: 41081)\n[PASS] test_burnedTokensCannotBeTransferredFromZero() (gas: 77211)\n[PASS] test_constructorMintsToTheCreatorNotTheOrigin() (gas: 484516)\n[PASS] test_decreaseAllowanceToExactlyZero() (gas: 90417)\n[PASS] test_decreaseUnlimitedAllowanceMakesItFinite() (gas: 217665)\n[PASS] test_increaseAllowanceToExactlyMaxBecomesUnlimited() (gas: 93088)\n[PASS] test_launchFlowsArriveExactlyInOneCall() (gas: 597711)\n[PASS] test_transferFromExactAllowanceLeavesZero() (gas: 217177)\n[PASS] test_transferFromSelfStillNeedsAllowance() (gas: 90568)\n[PASS] test_transferFromToOwnerKeepsBalanceButSpendsAllowance() (gas: 157083)\n[PASS] test_transferFromZeroAmountWithoutAllowance() (gas: 51800)\n[PASS] test_transferOfTheWholeSupplyArrivesWhole() (gas: 99924)\n[PASS] test_unlimitedAllowanceCanDrainThenStopsAtBalance() (gas: 197656)\n[PASS] test_unlimitedAllowanceTransferFromEmitsNoApproval() (gas: 171392)\nSuite result: ok. 30 passed; 0 failed; 0 skipped; finished in 134.58ms (188.19ms CPU time)\n\nRan 4 tests for test/YoloToken.invariant.t.sol:YoloTokenInvariantTest\n[PASS] invariant_balancesAndAllowancesMatchTheModel() (runs: 256, calls: 16384, reverts: 0)\n\n╭-------------+-------------------+-------+---------+----------╮\n| Contract    | Selector          | Calls | Reverts | Discards |\n+==============================================================+\n| YoloHandler | approve           | 1533  | 0       | 0        |\n|-------------+-------------------+-------+---------+----------|\n| YoloHandler | burn              | 1518  | 0       | 0        |\n|-------------+-------------------+-------+---------+----------|\n| YoloHandler | burnFrom          | 1471  | 0       | 0        |\n|-------------+-------------------+-------+---------+----------|\n| YoloHandler | checkpointSupply  | 1444  | 0       | 0        |\n|-------------+-------------------+-------+---------+----------|\n| YoloHandler | decreaseAllowance | 1493  | 0       | 0        |\n|-------------+-------------------+-------+---------+----------|\n| YoloHandler | increaseAllowance | 1468  | 0       | 0        |\n|-------------+-------------------+-------+---------+----------|\n| YoloHandler | transfer          | 2963  | 0       | 0        |\n|-------------+-------------------+-------+---------+----------|\n| YoloHandler | transferFrom      | 1525  | 0       | 0        |\n|-------------+-------------------+-------+---------+----------|\n| YoloHandler | transferToZero    | 1440  | 0       | 0        |\n|-------------+-------------------+-------+---------+----------|\n| YoloHandler | tryPrivileged     | 1529  | 0       | 0        |\n╰-------------+-------------------+-------+---------+----------╯\n\nLogs:\n  Bound result 8009\n  Bound result 1478698990\n  Bound result 12439\n  Bound result 5\n  Bound result 242\n  Bound result 9\n  Bound result 4000000000000000000\n  Bound result 5000000000000000001\n  Bound result 4000000000000000000\n  Bound result 67\n  Bound result 429\n  Bound result 14\n  Bound result 878351860980201554899803253\n  Bound result 1000000000000000000000000000\n  Bound result 4343\n  Bound result 1\n  Bound result 39573\n  Bound result 2000000000000000000\n  Bound result 5870\n  Bound result 0\n\n[PASS] invariant_balancesSumToSupplyAndSupplyOnlyShrinksByBurns() (runs: 256, calls: 16384, reverts: 0)\n\n╭-------------+-------------------+-------+---------+----------╮\n| Contract    | Selector          | Calls | Reverts | Discards |\n+==============================================================+\n| YoloHandler | approve           | 1533  | 0       | 0        |\n|-------------+-------------------+-------+---------+----------|\n| YoloHandler | burn              | 1518  | 0       | 0        |\n|-------------+-------------------+-------+---------+----------|\n| YoloHandler | burnFrom          | 1471  | 0       | 0        |\n|-------------+-------------------+-------+---------+----------|\n| YoloHandler | checkpointSupply  | 1444  | 0       | 0        |\n|-------------+-------------------+-------+---------+----------|\n| YoloHandler | decreaseAllowance | 1493  | 0       | 0        |\n|-------------+-------------------+-------+---------+----------|\n| YoloHandler | increaseAllowance | 1468  | 0       | 0        |\n|-------------+-------------------+-------+---------+----------|\n| YoloHandler | transfer          | 2963  | 0       | 0        |\n|-------------+-------------------+-------+---------+----------|\n| YoloHandler | transferFrom      | 1525  | 0       | 0        |\n|-------------+-------------------+-------+---------+----------|\n| YoloHandler | transferToZero    | 1440  | 0       | 0        |\n|-------------+-------------------+-------+---------+----------|\n| YoloHandler | tryPrivileged     | 1529  | 0       | 0        |\n╰-------------+-------------------+-------+---------+----------╯\n\nLogs:\n  Bound result 8009\n  Bound result 1478698990\n  Bound result 12439\n  Bound result 5\n  Bound result 242\n  Bound result 9\n  Bound result 4000000000000000000\n  Bound result 5000000000000000001\n  Bound result 4000000000000000000\n  Bound result 67\n  Bound result 429\n  Bound result 14\n  Bound result 878351860980201554899803253\n  Bound result 1000000000000000000000000000\n  Bound result 4343\n  Bound result 1\n  Bound result 39573\n  Bound result 2000000000000000000\n  Bound result 5870\n  Bound result 0\n\n[PASS] invariant_everyCallMatchesTheModel() (runs: 256, calls: 16384, reverts: 0)\n\n╭-------------+-------------------+-------+---------+----------╮\n| Contract    | Selector          | Calls | Reverts | Discards |\n+==============================================================+\n| YoloHandler | approve           | 1533  | 0       | 0        |\n|-------------+-------------------+-------+---------+----------|\n| YoloHandler | burn              | 1518  | 0       | 0        |\n|-------------+-------------------+-------+---------+----------|\n| YoloHandler | burnFrom          | 1471  | 0       | 0        |\n|-------------+-------------------+-------+---------+----------|\n| YoloHandler | checkpointSupply  | 1444  | 0       | 0        |\n|-------------+-------------------+-------+---------+----------|\n| YoloHandler | decreaseAllowance | 1493  | 0       | 0        |\n|-------------+-------------------+-------+---------+----------|\n| YoloHandler | increaseAllowance | 1468  | 0       | 0        |\n|-------------+-------------------+-------+---------+----------|\n| YoloHandler | transfer          | 2963  | 0       | 0        |\n|-------------+-------------------+-------+---------+----------|\n| YoloHandler | transferFrom      | 1525  | 0       | 0        |\n|-------------+-------------------+-------+---------+----------|\n| YoloHandler | transferToZero    | 1440  | 0       | 0        |\n|-------------+-------------------+-------+---------+----------|\n| YoloHandler | tryPrivileged     | 1529  | 0       | 0        |\n╰-------------+-------------------+-------+---------+----------╯\n\nLogs:\n  Bound result 8009\n  Bound result 1478698990\n  Bound result 12439\n  Bound result 5\n  Bound result 242\n  Bound result 9\n  Bound result 4000000000000000000\n  Bound result 5000000000000000001\n  Bound result 4000000000000000000\n  Bound result 67\n  Bound result 429\n  Bound result 14\n  Bound result 878351860980201554899803253\n  Bound result 1000000000000000000000000000\n  Bound result 4343\n  Bound result 1\n  Bound result 39573\n  Bound result 2000000000000000000\n  Bound result 5870\n  Bound result 0\n\n[PASS] invariant_metadataNeverChanges() (runs: 64, calls: 2048, reverts: 0)\n\n╭-------------+-------------------+-------+---------+----------╮\n| Contract    | Selector          | Calls | Reverts | Discards |\n+==============================================================+\n| YoloHandler | approve           | 183   | 0       | 0        |\n|-------------+-------------------+-------+---------+----------|\n| YoloHandler | burn              | 192   | 0       | 0        |\n|-------------+-------------------+-------+---------+----------|\n| YoloHandler | burnFrom          | 196   | 0       | 0        |\n|-------------+-------------------+-------+---------+----------|\n| YoloHandler | checkpointSupply  | 171   | 0       | 0        |\n|-------------+-------------------+-------+---------+----------|\n| YoloHandler | decreaseAllowance | 192   | 0       | 0        |\n|-------------+-------------------+-------+---------+----------|\n| YoloHandler | increaseAllowance | 193   | 0       | 0        |\n|-------------+-------------------+-------+---------+----------|\n| YoloHandler | transfer          | 386   | 0       | 0        |\n|-------------+-------------------+-------+---------+----------|\n| YoloHandler | transferFrom      | 187   | 0       | 0        |\n|-------------+-------------------+-------+---------+----------|\n| YoloHandler | transferToZero    | 164   | 0       | 0        |\n|-------------+-------------------+-------+---------+----------|\n| YoloHandler | tryPrivileged     | 184   | 0       | 0        |\n╰-------------+-------------------+-------+---------+----------╯\n\nLogs:\n  Bound result 924032265294100773956653746\n  Bound result 7789\n  Bound result 947607068235795648686588\n  Bound result 5288\n  Bound result 244047882517429651631427384\n  Bound result 7000000000000000000\n  Bound result 5937\n  Bound result 978004155326382573821207550\n  Bound result 6338\n  Bound result 849774788767681898993247427\n  Bound result 570965839308565227842831022\n  Bound result 0\n  Bound result 1817\n  Bound result 0\n  Bound result 4\n\nSuite result: ok. 4 passed; 0 failed; 0 skipped; finished in 4.88s (7.28s CPU time)\n\nRan 3 test suites in 4.88s (5.04s CPU time): 69 tests passed, 0 failed, 0 skipped (69 total tests)\n","passed":true},{"durationMs":33,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"YoloToken.approve(address,uint256)\",\"YoloToken.burn(uint256)\",\"YoloToken.burnFrom(address,uint256)\",\"YoloToken.decreaseAllowance(address,uint256)\",\"YoloToken.increaseAllowance(address,uint256)\",\"YoloToken.transfer(address,uint256)\",\"YoloToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":22,\"README.md\":104,\"foundry.toml\":23,\"src/YoloToken.sol\":176,\"test/YoloToken.edge.t.sol\":379,\"test/YoloToken.invariant.t.sol\":363,\"test/YoloToken.t.sol\":399},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"0fa29849bfba8e8bb3de445ec97c65e89695b2b00c4051915c8a60ad994388bc","verifiedTreeHash":"a8c67c358a7a066f949f05cee019ff459a66969c","verifierVersion":"0.1.0+6a374fcd"},{"checks":[{"durationMs":814,"exitCode":0,"name":"build","output":"Compiling 21 files with Solc 0.8.26\nSolc 0.8.26 finished in 744.04ms\nCompiler run successful!\n","passed":true},{"durationMs":89,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 35 tests for test/YoloToken.t.sol:YoloTokenTest\n[PASS] testFuzz_burnOnlyShrinksSupply(uint256,uint256) (runs: 256, μ: 126375, ~: 127290)\nLogs:\n  Bound result 680718636188480031186361802\n  Bound result 404518654316002540188551759\n\n[PASS] testFuzz_transferConservesSupply(address,uint256) (runs: 256, μ: 108345, ~: 108785)\nLogs:\n  Bound result 0\n\n[PASS] testFuzz_transferFromRespectsAllowance(uint256,uint256) (runs: 256, μ: 173219, ~: 196455)\nLogs:\n  Bound result 680718636188480031186361802\n  Bound result 446674734050887267620171935\n\n[PASS] testFuzz_transferRevertsAboveBalance(uint256,uint256) (runs: 256, μ: 102809, ~: 103423)\nLogs:\n  Bound result 935997596271885061434875913\n  Bound result 947533796296936815379356713\n\n[PASS] test_RevertWhen_approveZeroAddressSpender() (gas: 32542)\n[PASS] test_RevertWhen_burnExceedsBalance() (gas: 93062)\n[PASS] test_RevertWhen_burnFromWithoutAllowance() (gas: 97048)\n[PASS] test_RevertWhen_decreaseAllowanceBelowZero() (gas: 86061)\n[PASS] test_RevertWhen_increaseAllowanceOverflows() (gas: 85626)\n[PASS] test_RevertWhen_transferExceedsBalance() (gas: 95851)\n[PASS] test_RevertWhen_transferFromEmptyAccount() (gas: 37774)\n[PASS] test_RevertWhen_transferFromExceedsAllowance() (gas: 145894)\n[PASS] test_RevertWhen_transferFromExceedsBalanceEvenWithAllowance() (gas: 157735)\n[PASS] test_RevertWhen_transferFromToZeroAddress() (gas: 147885)\n[PASS] test_RevertWhen_transferFromWithoutAllowance() (gas: 98439)\n[PASS] test_RevertWhen_transferToZeroAddress() (gas: 90610)\n[PASS] test_approveOverwritesPreviousAllowance() (gas: 92460)\n[PASS] test_approveSetsAllowanceAndEmits() (gas: 64728)\n[PASS] test_burnFromSpendsAllowance() (gas: 177179)\n[PASS] test_burnReducesBalanceAndSupply() (gas: 114881)\n[PASS] test_constructorEmitsMintTransfer() (gas: 238132)\n[PASS] test_constructorMintsWholeSupplyToDeployer() (gas: 30179)\n[PASS] test_deployerCannotMoveAHoldersBalance() (gas: 165326)\n[PASS] test_increaseAndDecreaseAllowance() (gas: 149937)\n[PASS] test_metadata() (gas: 23667)\n[PASS] test_noAdminSelectorsExist() (gas: 355490)\n[PASS] test_runtimeHasNoDelegatecallCallcodeOrSelfdestruct() (gas: 780410)\n[PASS] test_supplyIsExactlyOneBillionWholeTokens() (gas: 26393)\n[PASS] test_transferChainArrivesWhole() (gas: 189420)\n[PASS] test_transferFromSpendsAllowanceAndEmits() (gas: 218783)\n[PASS] test_transferFromWithMaxAllowanceDoesNotDecrement() (gas: 187715)\n[PASS] test_transferMovesExactAmountAndEmits() (gas: 90188)\n[PASS] test_transferToSelfKeepsBalance() (gas: 98342)\n[PASS] test_transferWholeBalanceLeavesZero() (gas: 129940)\n[PASS] test_transferZeroAmountSucceeds() (gas: 44319)\nSuite result: ok. 35 passed; 0 failed; 0 skipped; finished in 8.93ms (38.82ms CPU time)\n\nRan 1 test suite in 9.63ms (8.93ms CPU time): 35 tests passed, 0 failed, 0 skipped (35 total tests)\n","passed":true},{"durationMs":30,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"YoloToken.approve(address,uint256)\",\"YoloToken.burn(uint256)\",\"YoloToken.burnFrom(address,uint256)\",\"YoloToken.decreaseAllowance(address,uint256)\",\"YoloToken.increaseAllowance(address,uint256)\",\"YoloToken.transfer(address,uint256)\",\"YoloToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":22,\"README.md\":104,\"foundry.toml\":23,\"launch.json\":20,\"src/YoloToken.sol\":176,\"test/YoloToken.t.sol\":399},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"7397aafb3373e46244575b33d7150bc2d545b0bcff9237a20cf32bb5ddb300a3","verifiedTreeHash":"274922f0b22e09daea93e19ba6118379c7b9aa40","verifierVersion":"0.1.0+6a374fcd"},{"checks":[{"durationMs":1415,"exitCode":0,"name":"build","output":"Compiling 21 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.30s\nCompiler run successful!\n","passed":true},{"durationMs":144,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 35 tests for test/YoloToken.t.sol:YoloTokenTest\n[PASS] testFuzz_burnOnlyShrinksSupply(uint256,uint256) (runs: 256, μ: 126375, ~: 127290)\nLogs:\n  Bound result 680718636188480031186361802\n  Bound result 404518654316002540188551759\n\n[PASS] testFuzz_transferConservesSupply(address,uint256) (runs: 256, μ: 108345, ~: 108785)\nLogs:\n  Bound result 545230\n\n[PASS] testFuzz_transferFromRespectsAllowance(uint256,uint256) (runs: 256, μ: 173219, ~: 196455)\nLogs:\n  Bound result 8516182348700691\n  Bound result 1\n\n[PASS] testFuzz_transferRevertsAboveBalance(uint256,uint256) (runs: 256, μ: 102809, ~: 103423)\nLogs:\n  Bound result 935997596271885061434875913\n  Bound result 947533796296936815379356713\n\n[PASS] test_RevertWhen_approveZeroAddressSpender() (gas: 32542)\n[PASS] test_RevertWhen_burnExceedsBalance() (gas: 93062)\n[PASS] test_RevertWhen_burnFromWithoutAllowance() (gas: 97048)\n[PASS] test_RevertWhen_decreaseAllowanceBelowZero() (gas: 86061)\n[PASS] test_RevertWhen_increaseAllowanceOverflows() (gas: 85626)\n[PASS] test_RevertWhen_transferExceedsBalance() (gas: 95851)\n[PASS] test_RevertWhen_transferFromEmptyAccount() (gas: 37774)\n[PASS] test_RevertWhen_transferFromExceedsAllowance() (gas: 145894)\n[PASS] test_RevertWhen_transferFromExceedsBalanceEvenWithAllowance() (gas: 157735)\n[PASS] test_RevertWhen_transferFromToZeroAddress() (gas: 147885)\n[PASS] test_RevertWhen_transferFromWithoutAllowance() (gas: 98439)\n[PASS] test_RevertWhen_transferToZeroAddress() (gas: 90610)\n[PASS] test_approveOverwritesPreviousAllowance() (gas: 92460)\n[PASS] test_approveSetsAllowanceAndEmits() (gas: 64728)\n[PASS] test_burnFromSpendsAllowance() (gas: 177179)\n[PASS] test_burnReducesBalanceAndSupply() (gas: 114881)\n[PASS] test_constructorEmitsMintTransfer() (gas: 238132)\n[PASS] test_constructorMintsWholeSupplyToDeployer() (gas: 30179)\n[PASS] test_deployerCannotMoveAHoldersBalance() (gas: 165326)\n[PASS] test_increaseAndDecreaseAllowance() (gas: 149937)\n[PASS] test_metadata() (gas: 23667)\n[PASS] test_noAdminSelectorsExist() (gas: 355490)\n[PASS] test_runtimeHasNoDelegatecallCallcodeOrSelfdestruct() (gas: 780410)\n[PASS] test_supplyIsExactlyOneBillionWholeTokens() (gas: 26393)\n[PASS] test_transferChainArrivesWhole() (gas: 189420)\n[PASS] test_transferFromSpendsAllowanceAndEmits() (gas: 218783)\n[PASS] test_transferFromWithMaxAllowanceDoesNotDecrement() (gas: 187715)\n[PASS] test_transferMovesExactAmountAndEmits() (gas: 90188)\n[PASS] test_transferToSelfKeepsBalance() (gas: 98342)\n[PASS] test_transferWholeBalanceLeavesZero() (gas: 129940)\n[PASS] test_transferZeroAmountSucceeds() (gas: 44319)\nSuite result: ok. 35 passed; 0 failed; 0 skipped; finished in 15.18ms (65.23ms CPU time)\n\nRan 1 test suite in 16.09ms (15.18ms CPU time): 35 tests passed, 0 failed, 0 skipped (35 total tests)\n","passed":true},{"durationMs":58,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"YoloToken.approve(address,uint256)\",\"YoloToken.burn(uint256)\",\"YoloToken.burnFrom(address,uint256)\",\"YoloToken.decreaseAllowance(address,uint256)\",\"YoloToken.increaseAllowance(address,uint256)\",\"YoloToken.transfer(address,uint256)\",\"YoloToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":22,\"README.md\":104,\"foundry.toml\":23,\"src/YoloToken.sol\":176,\"test/YoloToken.t.sol\":399},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true},{"durationMs":572,"exitCode":0,"name":"slither","output":"slither: no results at low impact or above","passed":true},{"durationMs":282,"exitCode":0,"name":"aderyn","output":"[low] large-numeric-literal at src/YoloToken.sol:25: Large Numeric Literal","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"bb3308cc97b6d37022f541ceba9dc3e49639d86d1e3d4d2a2ad890d1919ee533","verifiedTreeHash":"9b13cee34a11259c668e396f3299fe34097db25c","verifierVersion":"0.1.0+6a374fcd"}]}