{"assessments":[],"deployments":[],"fuzz":[],"identity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"interpretation":"Records acceptance and evidence. Neither completion nor an AI assessment establishes correctness, safety, or independent review.","jobId":"b49d70db-cbbd-4d9f-92f0-9ffda63451a4","kind":"shape:chain","nodes":[{"acceptedSubmissionHash":"b3eb03e92888d38a413d2d9eff207cea33f15ef8206ee43d2034922c27b73421","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_economics","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"6765149108fdfb7db94891518709ff5be89ae10eda5b5296fd0bfbb6bf8a4070","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_flow","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"6b89fd33942d17f026eead0b5d157689ecd7f963dd4e1ab937c789bf0e497d9e","dependsOn":["build_contract_project","write_foundry_tests","manifest","audit_math","audit_permissions","audit_economics","audit_flow"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"af3aa01159bbf354f621cafa5c0006f6169e0938a8b015be508b7377dbf165bc","skillId":"audit-judge","tools":[]},"key":"audit_judge","kind":"code","role":"review","skillHash":"af3aa01159bbf354f621cafa5c0006f6169e0938a8b015be508b7377dbf165bc","skillId":"audit-judge","state":"accepted"},{"acceptedSubmissionHash":"91adbf437503cb4de6a8e683c8425eeb07441e1c3905abdec1d0d25e46567323","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_math","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"105caa365285af799564aeea158d2487fbded67d7ccf8394113c0955d74b3d2c","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_permissions","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"a0e752e95a2e51c95010d4165745029c7f0abe530bbc1fdd3c6a621b9cfaaafd","dependsOn":[],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"d59561da3b378461b7c749f6bd5084477d44993aa94972ddea90f542535751df","skillId":"build-contract-project","tools":[]},"key":"build_contract_project","kind":"code","role":"implement","skillHash":"d59561da3b378461b7c749f6bd5084477d44993aa94972ddea90f542535751df","skillId":"build-contract-project","state":"accepted"},{"acceptedSubmissionHash":"4aa589c5e375dcc7a0d57f20fa6730db52d3489fdde52358940de7f205800083","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"tools":[]},"key":"manifest","kind":"code","role":"integrate","skillHash":null,"skillId":null,"state":"accepted"},{"acceptedSubmissionHash":"f679743a3cf0b78b440cce09df6c9066f4343ea13d5bfa321b338c8c4d909d86","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"4c76766b00591dfe982fe85d3de589fdb2f810e5137c301155d1c5e36a1d3b23","skillId":"write-foundry-tests","tools":[]},"key":"write_foundry_tests","kind":"code","role":"tests","skillHash":"4c76766b00591dfe982fe85d3de589fdb2f810e5137c301155d1c5e36a1d3b23","skillId":"write-foundry-tests","state":"accepted"}],"objective":"A custom token: PABOXO (PABOXO).\nToken name: PABOXO\nToken symbol: PABOXO\nToken supply: 1,000,000,000 with 18 decimals, all minted once to the deployer in the constructor.","parentJobId":null,"planHash":"1b79c9551559c3281467e09f4473a43c29203e37eab598d266d60acb26dd499b","previousHash":"0000000000000000000000000000000000000000000000000000000000000000","projectId":"b49d70db-cbbd-4d9f-92f0-9ffda63451a4","publication":{"commit":null,"deliveredAt":null,"repoUrl":"https://github.com/identity-md-launches/launch-2409-paboxo"},"receiptIdentity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"registry":"0xb6d0a187b050fa5bb0b87033a203f37becf4a775","research":[],"schema":"identitymd-work-v1","signals":[{"agentId":"52262","feedbackHash":"97bfd76b4253b79c383fde91b0b34b20e4c46832f1d1366794db0bee843d83e3","nodeKey":"audit_economics","submissionHash":"b3eb03e92888d38a413d2d9eff207cea33f15ef8206ee43d2034922c27b73421","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51316","feedbackHash":"b85c411835ed645872270a090052bbed8865dc98b8a54b9dcec9ef8ee9244e51","nodeKey":"audit_flow","submissionHash":"6765149108fdfb7db94891518709ff5be89ae10eda5b5296fd0bfbb6bf8a4070","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"50989","feedbackHash":"2227b319e9a460f8ba652e246cace0e25429cc9a1853d2dc3d132f02e176b0ef","nodeKey":"audit_judge","submissionHash":"6b89fd33942d17f026eead0b5d157689ecd7f963dd4e1ab937c789bf0e497d9e","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"50904","feedbackHash":"96112d337dca7030f5d60b00e8a94339d4531acd55fecc2c16abc42ce2e272cc","nodeKey":"audit_math","submissionHash":"91adbf437503cb4de6a8e683c8425eeb07441e1c3905abdec1d0d25e46567323","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52611","feedbackHash":"ec9185c20f00c367aad5a6695a581d81b93d9a326fa239a3834fc7545f7d66d2","nodeKey":"audit_permissions","submissionHash":"105caa365285af799564aeea158d2487fbded67d7ccf8394113c0955d74b3d2c","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51178","feedbackHash":"a670f4f8fa4c1c0398e0a10f14b8f7cb3f22f4cc58470e362a9dfb0e51689e4f","nodeKey":"build_contract_project","submissionHash":"a0e752e95a2e51c95010d4165745029c7f0abe530bbc1fdd3c6a621b9cfaaafd","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"51003","feedbackHash":"5c985488e8ece250bf9c60038eb921167223aa5737a1a60b534b74f2b2783287","nodeKey":"manifest","submissionHash":"4aa589c5e375dcc7a0d57f20fa6730db52d3489fdde52358940de7f205800083","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"51389","feedbackHash":"7d2276fa8de3cb9f1870d0f5cf367b11e0c1e1ce3bacbbaeaba84191486476d0","nodeKey":"write_foundry_tests","submissionHash":"f679743a3cf0b78b440cce09df6c9066f4343ea13d5bfa321b338c8c4d909d86","tag1":"verification:checks","tag2":"acceptance-v2","value":1}],"site":null,"snapshotHash":"56b3175aa8189e1f17b86d425c89da00535c207be3b9c320466ab7f9d6c35322","state":"completed","submissions":[{"artifacts":[],"attempt":1,"bundleHash":null,"device":"2a4ad9be53991100","findings":[],"hash":"105caa365285af799564aeea158d2487fbded67d7ccf8394113c0955d74b3d2c","nodeId":"592b3330-eb30-49a6-b7c3-8f5f59aac5f2","outcome":"completed","summary":"I found no defects in PABOXO's permissions. The findings list in `.imd-findings.json` is empty, and its coverage record has a \"holds\" row for each of the three entry points, plus three for invariants I checked.\n\n**Why there's nothing to report:** `src/PABOXO.sol` is OpenZeppelin's standard ERC20 (v5.1.0) and nothing more. Its constructor mints the 1,000,000,000 × 10^18 supply once, to whoever deploys it, which in the launch is the factory. It has:\n- no owner or roles, and no initializer;\n- no way to mint, burn, pause, blacklist, set fees or exempt anyone after deployment.\n\nSo none of the three guides finds anything to work on:\n- **Access Control:** the only storage written after deployment is balances and allowances. `transfer` and `approve` touch only the caller's own entries, and `transferFrom` spends the allowance before it moves anything. There's no route to raise your own privileges, no initializer to call first, and no contract acting on someone else's behalf.\n- **Asymmetry:** the only paired actions are approve and spending an allowance, and transfer against transferFrom. Each pair updates state the same way. The one deliberate difference is that a maximum allowance never runs down, which is how the upstream library works.\n- **Trust Gap:** with no privileged actor and no fee or exemption logic, there's no point where who may call combines with who profits or who is treated differently.\n\n**What I checked:**\n- The library files in `lib/` match their recorded checksums (all 5 `.sol` files), and I read the transfer, allowance and supply code myself.\n- The project builds, and all 33 existing tests pass.\n- The aderyn \"Large Numeric Literal\" warning at `src/PABOXO.sol:12` (`1_000_000_000 * 10 ** 18`) is about style. The value is correct, so it isn't a defect.\n\n**Limits:** I didn't run the protected launch tests in `.imd/reads/protected/`, because they import `src/LaunchLiquidity.sol` and other files this tree doesn't have. The project's own launch test, which covers the factory, distributor and pool transfers, passed. I changed no repository files; the findings file doesn't show as a change in `git status`.","treeHash":null,"usage":{"cachedInputTokens":234849,"inputTokens":14,"model":"claude-opus-5-5","outputTokens":3063,"runtime":"claude","turns":7,"wallClockMs":47560}},{"artifacts":[],"attempt":1,"bundleHash":"f7af9fc997d44fb357ad859ca048b7ecb71b49b41e218b0f11199e8e4511f2b9","device":"2d977abd7ffb09d4","findings":[],"hash":"4aa589c5e375dcc7a0d57f20fa6730db52d3489fdde52358940de7f205800083","nodeId":"331187d1-e0b2-4737-ae04-70da6d4090a2","outcome":"completed","summary":"Created [launch.json](/var/lib/imd/seat-1689/work/b49d70db-cbbd-4d9f-92f0-9ffda63451a4/331187d1-e0b2-4737-ae04-70da6d4090a2/launch.json) matching PABOXO’s constructor, supply, pool settings, and exact economics.\n\nManifest and ABI checks passed. `forge build` and all 33 local tests passed with the supplied fuzz seed, using a temporary Solidity 0.8.26 wrapper.\n\nOnly `launch.json` is delivered.","treeHash":"8f8b626deebdcd8f97bb1a223416cc1d92848456","usage":{"cachedInputTokens":418432,"inputTokens":31015,"model":"gpt-6.1-sol","outputTokens":5706,"runtime":"codex","turns":5,"wallClockMs":166183}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"6b0a28df3d585600","findings":[{"citation":"resolved","description":"DEPENDENCIES.md states that every vendored dependency file is an unmodified upstream file and that each dependency directory's SHA256SUMS lists the digest of every vendored file. For lib/openzeppelin-contracts this holds: all six files verify, and ERC20.sol, IERC20.sol, IERC20Metadata.sol, Context.sol and draft-IERC6093.sol are byte-identical to upstream commit 69c8def5f222ff96f2b5beff05dfba996368aa79, so the token's compiled bytecode rests on genuine OpenZeppelin v5.1.0 code. For lib/forge-std the claim does not hold: ten of the vendored src files (StdAssertions, StdChains, StdCheats, StdInvariant, StdJson, StdMath, StdStorage, StdToml, StdUtils, Vm) fail `sha256sum -c SHA256SUMS`. The digests recorded in SHA256SUMS do match the upstream v1.9.6 files (I fetched each from the pinned commit and compared), so the recorded checksums are honest; it is the vendored copies that differ. Comparing with all whitespace stripped, every one of the ten files is token-identical to upstream, so the difference is formatting only (long lines re-wrapped to the project's 110-column style), with no semantic change. Impact: forge-std is used only by tests and does not enter the token's creation or runtime bytecode, so the launch artifact is unaffected. The defect is a provenance one: a verifier or judge who runs the integrity check the project itself documents gets ten FAILED lines and cannot confirm from the shipped files alone that the test harness is upstream code; they must do the whitespace-insensitive comparison I did. Minimal fix (preserves intended behaviour): restore the exact upstream bytes for those ten files, or regenerate lib/forge-std/SHA256SUMS from the files as shipped and reword DEPENDENCIES.md to say the forge-std sources are reformatted copies of the pinned commit. Note lib/ and configuration files are outside a worker's write budget, so this needs the author.","line":3,"path":"DEPENDENCIES.md","reproduction":"State: the repository as committed (HEAD d7faee8). Input: run `cd lib/openzeppelin-contracts && sha256sum -c SHA256SUMS` then `cd ../forge-std && sha256sum -c SHA256SUMS`. Expected (per DEPENDENCIES.md line 3): every line reports OK. Actual: OpenZeppelin reports 6 OK; forge-std reports src/StdAssertions.sol, src/StdChains.sol, src/StdCheats.sol, src/StdInvariant.sol, src/StdJson.sol, src/StdMath.sol, src/StdStorage.sol, src/StdToml.sol, src/StdUtils.sol and src/Vm.sol as FAILED (sha256sum exits non-zero, 'WARNING: 10 computed checksums did NOT match'). Example: `sha256sum lib/forge-std/src/StdMath.sol` gives 9c5a5c74b7af2037b3396bc1be63502a321bc18a3556cb1abcc63724e94d0186 while SHA256SUMS records f04fc0616741563eb32d66c11af7fdca55a7202221e14282268c7be851fc63ab, which is the digest of the upstream file at foundry-rs/forge-std commit 3b20d60d14b343ee4f908cb8079495c07f5e8981. `tr -d ' \\t\\n\\r' < <upstream StdMath.sol> | sha256sum` equals the same command on the vendored file (bb7338a60260...), showing a whitespace-only difference. forge fmt --check passes and forge build/test succeed, so nothing else detects the discrepancy.","severity":"low","snippet":"These source files are delivered as ordinary files, with no Git submodules or installation step. They are unmodified upstream files. Each dependency directory includes the upstream license and a `SHA256SUMS` file listing the SHA-256 digest of every vendored upstream file, relative to that directory.","title":"Vendored forge-std files were reformatted after vendoring, so the documented SHA256SUMS integrity check fails for 10 files and the 'unmodified upstream files' claim is false"}],"hash":"6765149108fdfb7db94891518709ff5be89ae10eda5b5296fd0bfbb6bf8a4070","nodeId":"259b2d52-126f-4839-865a-5dbb46567e21","outcome":"completed","summary":"Review complete. The findings file is written, validated against the tree, and the working tree is otherwise untouched.\n\n**Outcome:** the PABOXO token holds under the Execution Trace, Periphery and First Principles guides. I found no defect in the token or its on-chain behavior. One low-severity provenance finding is recorded.\n\n**What I checked**\n\n- **Token source** (`src/PABOXO.sol`): a 17-line contract inheriting OpenZeppelin ERC20 with a single constructor mint of 1e27 to msg.sender. No constructor arguments, no owner, no hooks, no receive or fallback.\n- **Execution traces**: transfer, approve and transferFrom traced through the OpenZeppelin internals. Zero-address sender and receiver, zero amounts, self-transfers, allowance at max and max minus one, and reverts rolling back allowance all behave as intended. A scratch test confirmed the edge paths and was deleted afterwards.\n- **Periphery**: all six vendored OpenZeppelin files verify against their checksums and are byte-identical to upstream v5.1.0.\n- **Bytecode**: the compiled runtime contains no CALL, DELEGATECALL, CALLCODE, STATICCALL or SELFDESTRUCT opcodes anywhere. The ABI exposes only the ERC20 surface plus the supply constant.\n- **Launch floor**: with no fee or exemption logic, the swarm share, pool seed and trader swaps cannot arrive short. The delivered 33-test suite passes with the README's seed. The static-analysis lead about a large literal is a benign compile-time constant.\n\n**The one finding (low):** DEPENDENCIES.md claims every vendored file is unmodified upstream and verifiable by SHA256SUMS. That holds for OpenZeppelin but ten forge-std files fail the check. I fetched the pinned upstream files and confirmed the recorded checksums are honest and the differences are whitespace-only reformatting. forge-std is test-only, so the token artifact is unaffected. The fix is for the author to restore exact upstream bytes or regenerate the checksums and reword the claim, since lib/ is outside a worker's write budget.\n\n**Coverage:** all three listed entry points are marked `holds`, with five additional invariant and periphery rows, one of which references the finding.","treeHash":null,"usage":{"cachedInputTokens":860634,"inputTokens":354,"model":"claude-fable-5-1","outputTokens":17222,"runtime":"claude","turns":31,"wallClockMs":299235}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"e36579e0223ff908","findings":[{"citation":"resolved","description":"Merged from the audit_math, audit_economics and audit_flow reports, which all describe the same root cause. I reproduced it on the current tree (HEAD 4ac4e1a; the commits after d7faee8 touched only launch.json and test/, not lib/). lib/openzeppelin-contracts passes its SHA256SUMS (6 OK) and I fetched ERC20.sol, IERC20.sol, IERC20Metadata.sol, Context.sol and draft-IERC6093.sol from OpenZeppelin commit 69c8def5f222ff96f2b5beff05dfba996368aa79 and confirmed each is byte-identical to the vendored copy, so the token's compiled bytecode rests on genuine v5.1.0 code. lib/forge-std does not pass: `sha256sum -c SHA256SUMS` reports 15 FAILED entries (StdAssertions, StdChains, StdCheats, StdInvariant, StdJson, StdMath, StdStorage, StdToml, StdUtils, Vm, console, interfaces/IERC1155, IERC4626, IERC721, IMulticall3). audit_flow counted 10 because it only listed the src/ root; the full list is 15. For StdMath.sol, StdAssertions.sol and Vm.sol I fetched the upstream file at forge-std commit 3b20d60d14b343ee4f908cb8079495c07f5e8981: the bytes differ, but with all whitespace stripped the files are identical, so the difference is line re-wrapping only (consistent with `forge fmt` at the project's line_length = 110), with no semantic change; Test.sol is byte-identical. Impact: forge-std is imported only by tests and is not in the token's creation or runtime bytecode, so nothing on chain is affected. The defect is that the integrity statement the project asks a reviewer to rely on is false for one of its two dependencies, and the shipped SHA256SUMS cannot be used as documented. Minimal fix (for the author, since lib/ and docs are outside a worker's write budget): restore the exact upstream bytes for the 15 files and exclude lib/ from `forge fmt`, or regenerate lib/forge-std/SHA256SUMS from the files as shipped and reword line 3 of DEPENDENCIES.md to say the forge-std sources are reformatted copies of the pinned commit. Severity low: a broken documented guarantee with no funds or launch impact.","line":3,"path":"DEPENDENCIES.md","reproduction":"State: the repository as committed. Input: `cd lib/openzeppelin-contracts && sha256sum -c SHA256SUMS` then `cd ../forge-std && sha256sum -c SHA256SUMS`. Expected (DEPENDENCIES.md line 3): every line OK for both. Actual: OpenZeppelin 6 OK; forge-std prints 'sha256sum: WARNING: 15 computed checksums did NOT match' with src/StdAssertions.sol, src/StdChains.sol, src/StdCheats.sol, src/StdInvariant.sol, src/StdJson.sol, src/StdMath.sol, src/StdStorage.sol, src/StdToml.sol, src/StdUtils.sol, src/Vm.sol, src/console.sol, src/interfaces/IERC1155.sol, src/interfaces/IERC4626.sol, src/interfaces/IERC721.sol, src/interfaces/IMulticall3.sol as FAILED. Whitespace-only check: `curl -sL https://raw.githubusercontent.com/foundry-rs/forge-std/3b20d60d14b343ee4f908cb8079495c07f5e8981/src/StdMath.sol | tr -d ' \\t\\n\\r' | sha256sum` equals `tr -d ' \\t\\n\\r' < lib/forge-std/src/StdMath.sol | sha256sum`, while `cmp` on the raw files reports a difference. forge build, forge test (47 passed) and forge fmt --check all succeed, so nothing else in the project detects it.","severity":"low","snippet":"They are unmodified upstream files. Each dependency directory includes the upstream license and a `SHA256SUMS` file listing the SHA-256 digest of every vendored upstream file, relative to that directory.","title":"DEPENDENCIES.md says every vendored file is unmodified upstream and verifiable by SHA256SUMS, but 15 forge-std files fail the shipped checksums (reformatted copies; test-only, no bytecode impact)"}],"hash":"6b89fd33942d17f026eead0b5d157689ecd7f963dd4e1ab937c789bf0e497d9e","nodeId":"91267cc9-00b1-4ee2-90b9-481de9f448f9","outcome":"completed","summary":"The review is complete and the findings file is validated. Nothing else is needed.\n\n**Outcome:** the PABOXO token is clean. One low-severity provenance finding is recorded in `.imd-findings.json`, and all three entry points are marked `holds`. No tracked files were changed.\n\n**What I verified**\n\n- The contract is a 17-line wrapper over the vendored OpenZeppelin v5.1.0 ERC20. The constructor mints exactly 10^27 units to msg.sender once, and the ABI exposes no mint, burn, owner, pause, blacklist or initialize path.\n- The five vendored OpenZeppelin files are byte-identical to upstream commit 69c8def5, so the compiled bytecode rests on genuine library code.\n- Creation and runtime bytecode are well under the size limits, have no linked libraries, and contain no reachable DELEGATECALL, CALLCODE or SELFDESTRUCT.\n- The launch manifest matches the tree: parameterless constructor, supply string equal to the minted amount, lowercase addresses, schema keys only.\n- The project's own 47 tests, including fuzz and invariant suites, pass. The protected floor tests cannot run here because they import the network's v4-core and launch harness, which are not in this repository, so I checked their assertions by tracing the code instead.\n\n**The one finding kept**\n\nThree specialists reported the same root cause, which I merged into one low finding. DEPENDENCIES.md states every vendored file is unmodified upstream and checkable with the shipped SHA256SUMS. That holds for OpenZeppelin but fails for 15 forge-std files. I confirmed against the pinned upstream commit that the differences are whitespace-only re-wrapping, so there is no semantic change and no on-chain impact. The fix is the author's: restore the upstream bytes or regenerate the checksums and reword the note.\n\n**Dropped or absorbed:** the aderyn large-numeric-literal lead is a compile-time constant equal to the documented supply, so it is noted in coverage, not reported as a defect. No specialist attached a proof, and no finding reaches the severity that requires one.","treeHash":null,"usage":{"cachedInputTokens":653135,"inputTokens":354,"model":"claude-fable-5-1","outputTokens":9455,"runtime":"claude","turns":12,"wallClockMs":180692}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"dbfcf48f94822fd7","findings":[{"citation":"resolved","description":"Outside the math area; reported because it is concrete and cheap to verify. lib/openzeppelin-contracts passes its SHA256SUMS and every file matches upstream v5.1.0 commit 69c8def5 byte for byte, so the token's only production dependency is exactly what the note claims. lib/forge-std does not: 15 of its src files (StdAssertions, StdChains, StdCheats, StdInvariant, StdJson, StdMath, StdStorage, StdToml, StdUtils, Vm, console, IERC1155, IERC4626, IERC721, IMulticall3) fail `sha256sum -c SHA256SUMS`. The listed digests equal the upstream v1.9.6 files, the working-tree files differ only by line wrapping (comparison with all whitespace stripped is identical for every file), consistent with `forge fmt` having been run over lib/. forge-std is test-only and does not enter the token's bytecode, so no on-chain behavior is affected; the provenance statement and checksum list are simply wrong for the delivered tree. No proof test is attached because the defect is in documentation/provenance, not contract code.","line":3,"path":"DEPENDENCIES.md","reproduction":"cd lib/forge-std && sha256sum -c SHA256SUMS | grep FAILED -> 15 lines. cd ../openzeppelin-contracts && sha256sum -c SHA256SUMS -> all OK. Expected per DEPENDENCIES.md line 3: every vendored file matches its listed digest. Actual: forge-std src files are reformatted copies; e.g. sha256(src/StdAssertions.sol) = 12fd182a... while SHA256SUMS and upstream commit 3b20d60d list d4c89eec.... Fix is either restoring the upstream bytes or regenerating SHA256SUMS and the note; either is a lib/ or docs change for the author, not the reviewer.","severity":"info","snippet":"These source files are delivered as ordinary files, with no Git submodules or installation step. They are unmodified upstream files. Each dependency directory includes the upstream license and a `SHA256SUMS` file listing the SHA-256 digest of every vendored upstream file, relative to that directory.","title":"DEPENDENCIES.md claims forge-std is unmodified, but 15 vendored forge-std files fail the shipped SHA256SUMS (reformatted, semantics unchanged)"}],"hash":"91adbf437503cb4de6a8e683c8425eeb07441e1c3905abdec1d0d25e46567323","nodeId":"1b05112f-0cab-4a53-91ed-4b353f083a03","outcome":"completed","summary":"The review is complete. The findings file is valid JSON, the snippet matches the tree, and no tracked file was changed. The scratch test lives under the gitignored test/scratch/ directory.\n\n**Outcome: the math holds.** PABOXO is a stock OpenZeppelin v5.1.0 ERC20 with one constructor mint and nothing else, so the Math Precision, Boundary and Numerical Gap guides find no reachable failure mode. I reported one info-level provenance discrepancy outside my area.\n\n**What I checked in the assigned area**\n\n- **Supply literal.** The constant is evaluated exactly at compile time to 1e27. It fits uint128, so pool liquidity and v4 balance deltas cannot saturate, and every basis-point share of it divides without truncation.\n- **Transfer arithmetic.** The unchecked subtraction is guarded by an explicit balance comparison, and the receiver's add is bounded by total supply. Scratch probes covered 0, 1 wei, whole supply, supply plus one, max uint, and 1000 dust transfers. All conserve supply exactly.\n- **Allowance arithmetic.** The unchecked decrement is guarded by an allowance comparison. Only the exact max sentinel is treated as infinite. Allowance equal to balance, max minus one, and whole-supply spend under infinite approval all behave as specified, and a failed transfer rolls the allowance back.\n- **Boundaries and seams.** The contract makes no external calls, has no payable, receive, fallback, sentinel branch, division, or bytes decoding, so the Boundary and Numerical Gap checklists have nothing to attach to. Zero-amount paths run the full update rather than an early return.\n- **Bytecode.** An opcode scan of the runtime code outside PUSH data found no DELEGATECALL, CALLCODE, SELFDESTRUCT or CREATE.\n- **Dependency integrity.** The five vendored OpenZeppelin files match the upstream v5.1.0 commit byte for byte.\n\n**One info finding, outside the area.** The dependency note states all vendored files are unmodified and lists checksums. Fifteen forge-std files fail that checksum list because they were reformatted. With whitespace stripped they are identical to upstream, and forge-std is test-only, so no on-chain behavior is affected.\n\n**Coverage.** All three ABI entry points are marked holds, with four additional rows for the supply, decimals, boundary and seam invariants. Nothing was left unreached. The existing suite of 33 tests and the invariant run of 8192 calls both pass on the current tree.","treeHash":null,"usage":{"cachedInputTokens":777901,"inputTokens":386,"model":"claude-fable-5-1","outputTokens":13911,"runtime":"claude","turns":23,"wallClockMs":236358}},{"artifacts":[],"attempt":1,"bundleHash":"f92a78142e246543f3359ab339eba040f8ae02eeb323382b318b0c77435f3482","device":"41ff1f83c6e68e78","findings":[],"hash":"a0e752e95a2e51c95010d4165745029c7f0abe530bbc1fdd3c6a621b9cfaaafd","nodeId":"81a754cb-6d40-4c2d-ab7c-bf7bcebd4e0c","outcome":"completed","summary":"Implemented [PABOXO.sol](/Users/hyperstition/.identitymd/work/b49d70db-cbbd-4d9f-92f0-9ffda63451a4/81a754cb-6d40-4c2d-ab7c-bf7bcebd4e0c/src/PABOXO.sol): 1 billion tokens, 18 decimals, minted once entirely to the deployer. Dependencies are vendored, and deployment responsibilities are documented.\n\nVerified with Solidity 0.8.26:\n\n- `forge build` passes, including offline rebuild.\n- All 33 local tests pass with the requested fuzz seed.\n- `forge fmt --check` passes.\n\nThe external protected launch harness remains for the verifier.","treeHash":"c6c82bc4f5a12f7fe3503dd59a9b8bc3ee546389","usage":{"cachedInputTokens":553344,"inputTokens":52607,"model":"gpt-6-astra","outputTokens":17845,"runtime":"codex","turns":5,"wallClockMs":412015}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"28e346843ec15530","findings":[{"citation":"resolved","description":"The provenance document states every vendored file is an unmodified upstream file and that lib/<dep>/SHA256SUMS lists the digest of each one. For lib/openzeppelin-contracts this is true: all six files verify against SHA256SUMS and are byte-identical to OpenZeppelin v5.1.0 at commit 69c8def5. For lib/forge-std, 15 of the vendored .sol files do not match SHA256SUMS. Diffing against forge-std v1.9.6 (commit 3b20d60d) shows the differences are whitespace/line-wrapping only (the files were run through forge fmt with the project's line_length = 110), not logic changes. forge-std is used only by tests and does not enter the token's creation or runtime bytecode, so there is no on-chain impact; the defect is that the integrity claim a reviewer is asked to rely on is false for one of the two dependencies, and the shipped SHA256SUMS cannot be used to verify it. Fix: either restore the pristine upstream forge-std sources (and exclude lib/ from forge fmt) or regenerate lib/forge-std/SHA256SUMS and reword DEPENDENCIES.md to say the files are reformatted.","line":3,"path":"DEPENDENCIES.md","reproduction":"From the repository root run `cd lib/openzeppelin-contracts && sha256sum -c SHA256SUMS` -> all 6 entries OK. Run `cd lib/forge-std && sha256sum -c SHA256SUMS` -> expected: every entry OK (per DEPENDENCIES.md line 3); actual: 'WARNING: 15 computed checksums did NOT match' for src/StdAssertions.sol, StdChains.sol, StdCheats.sol, StdInvariant.sol, StdJson.sol, StdMath.sol, StdStorage.sol, StdToml.sol, StdUtils.sol, Vm.sol, console.sol, interfaces/IERC1155.sol, IERC4626.sol, IERC721.sol, IMulticall3.sol. `diff <(curl -sL https://raw.githubusercontent.com/foundry-rs/forge-std/3b20d60d14b343ee4f908cb8079495c07f5e8981/src/StdAssertions.sol) lib/forge-std/src/StdAssertions.sol` shows only function-signature line re-wrapping.","severity":"info","snippet":"These source files are delivered as ordinary files, with no Git submodules or installation step. They are unmodified upstream files. Each dependency directory includes the upstream license and a `SHA256SUMS` file listing the SHA-256 digest of every vendored upstream file, relative to that directory.","title":"DEPENDENCIES.md claims vendored files are unmodified upstream, but 15 forge-std files fail their own SHA256SUMS"}],"hash":"b3eb03e92888d38a413d2d9eff207cea33f15ef8206ee43d2034922c27b73421","nodeId":"aec3f031-93d0-47f7-8f18-38de6ef9e47b","outcome":"completed","summary":"The review is complete and `.imd-findings.json` is written. The tracked tree is unchanged.\n\n**Outcome:** the PABOXO token holds up across the Economic Security, Invariant and Flow Gap checks. No defect in the token itself was found. One informational provenance finding was recorded.\n\n**What was checked and holds**\n\n- **Supply and mint.** `INITIAL_SUPPLY` compiles to exactly 10^27 and is minted once to the constructor's caller. A factory deploying via CREATE or CREATE2 receives the whole supply. No function reaches mint or burn after construction, so the supply can neither grow nor be diluted against the opening cap.\n- **Launch flows arrive whole.** The token is unmodified OpenZeppelin v5.1.0 ERC20 with no fee, rebase, hook or transfer restriction. Factory to distributor, distributor to claimant, factory to pool, and pool pull via transferFrom each move the exact stated amount. The 10 / 50 / 40 percent split divides 10^27 with no rounding residue.\n- **Conservation.** Sum of balances equals total supply under fuzzed transfer sequences, and the delivered stateful invariant suite agrees.\n- **No privileged surface.** No owner, pause, blacklist or seize. The reachable runtime bytecode contains no CALL-family, DELEGATECALL, CALLCODE or SELFDESTRUCT opcodes. Native ETH is rejected.\n- **Dependencies.** The vendored OpenZeppelin files are byte-identical to the pinned upstream commit.\n\n**Finding recorded (info)**\n\n`DEPENDENCIES.md` states every vendored file is unmodified upstream and verifiable through `SHA256SUMS`. That is true for OpenZeppelin but false for forge-std, where 15 files fail the shipped checksum file. The differences are `forge fmt` line wrapping only, and forge-std is test-only, so there is no on-chain impact. The fix is to restore pristine sources or regenerate the checksums and reword the claim.\n\n**Coverage:** all three entry points (approve, transfer, transferFrom) are marked `holds`, with six additional invariant and flow rows. The one gap is that Uniswap v4 settlement was traced by reasoning rather than executed, since v4-core is not vendored in this repository.","treeHash":null,"usage":{"cachedInputTokens":684348,"inputTokens":354,"model":"claude-fable-5-1","outputTokens":11854,"runtime":"claude","turns":16,"wallClockMs":304960}},{"artifacts":[],"attempt":1,"bundleHash":"1f34084237dd23320ad4be29987ebdb2a9840cfb5896cdd8d81cea7ccf9210ec","device":"63fda2736ec51b55","findings":[],"hash":"f679743a3cf0b78b440cce09df6c9066f4343ea13d5bfa321b338c8c4d909d86","nodeId":"9f949399-ae62-4df8-98aa-e434dec2c1c1","outcome":"completed","summary":"Added failure-path and fuzz tests for allowance limits, rollback, retries, and competing spenders. Expanded stateful invariants to check balances, allowances, fixed supply, metadata, and holder transfers.\n\nValidation passed offline with the supplied seed:\n\n- `forge build`\n- `forge test`: 47 passed, 0 failed\n- 32,768 random handler calls\n\nOnly `test/` files changed. No implementation defects found.","treeHash":"ba8b61d06d179001a67e39309cec323f304cfe54","usage":{"cachedInputTokens":821888,"inputTokens":67786,"model":"gpt-6-astra","outputTokens":12298,"runtime":"codex","turns":5,"wallClockMs":413430}}],"verification":[{"checks":[{"durationMs":3314,"exitCode":0,"name":"build","output":"Compiling 27 files with Solc 0.8.26\nSolc 0.8.26 finished in 3.16s\nCompiler run successful!\n","passed":true},{"durationMs":4207,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 2 tests for test/PABOXOLaunch.t.sol:PABOXOLaunchTest\n[PASS] test_Create2MintsEverythingToImmediateDeployer() (gas: 81389)\n[PASS] test_DistributionClaimsAndBidirectionalPoolTransfersDeliverExactAmounts() (gas: 421874)\nSuite result: ok. 2 passed; 0 failed; 0 skipped; finished in 66.01ms (1.92ms CPU time)\n\nRan 30 tests for test/PABOXO.t.sol:PABOXOTest\n[PASS] testFuzz_ApproveReplacesPreviousValue(uint256,uint256) (runs: 1024, μ: 104072, ~: 104164)\n[PASS] testFuzz_TransferAboveBalanceReverts(uint256) (runs: 1024, μ: 58815, ~: 59163)\nLogs:\n  Bound result 115792089237316195423570985008687907853269984665639564039457584007913129735567\n\n[PASS] testFuzz_TransferConservesSupply(address,uint256) (runs: 1024, μ: 92702, ~: 93179)\nLogs:\n  Bound result 999999999999999999999999999\n\n[PASS] testFuzz_TransferFromAboveAllowanceReverts(uint256,uint256) (runs: 1024, μ: 124945, ~: 125437)\nLogs:\n  Bound result 435269237444614862590429907\n  Bound result 564921997029300723272951149\n\n[PASS] testFuzz_TransferFromConservesSupplyAndTracksAllowance(uint256,uint256) (runs: 1024, μ: 162609, ~: 164862)\nLogs:\n  Bound result 3457\n  Bound result 100\n\n[PASS] test_AllowanceIsSpecificToOwnerAndSpender() (gas: 200411)\n[PASS] test_ApprovalRevocationPreventsFurtherSpending() (gas: 192337)\n[PASS] test_ApproveCanExceedBalance() (gas: 78326)\n[PASS] test_ApproveEmitsEventWithoutMovingTokens() (gas: 88776)\n[PASS] test_ApproveZeroSpenderReverts() (gas: 61929)\n[PASS] test_ConstructorEmitsExactlyOneMint() (gas: 9636)\n[PASS] test_DeployerCannotSpendHolderBalanceWithoutApproval() (gas: 157924)\n[PASS] test_MetadataAndEntireInitialSupply() (gas: 107672)\n[PASS] test_NoMintBurnUpgradeOrAdministrativeEndpoints() (gas: 1111071)\n[PASS] test_RejectsNativeEther() (gas: 84885)\n[PASS] test_SelfTransferPreservesBalanceAndSupply() (gas: 53947)\n[PASS] test_TransferEntireBalanceEmitsEventAndDeliversExactly() (gas: 88692)\n[PASS] test_TransferFromCannotSpendAllowanceTwice() (gas: 146720)\n[PASS] test_TransferFromConsumesFiniteAllowanceAndEmitsTransfer() (gas: 172648)\n[PASS] test_TransferFromInsufficientAllowanceReverts() (gas: 115665)\n[PASS] test_TransferFromInsufficientBalanceRollsBackAllowance() (gas: 126121)\n[PASS] test_TransferFromOwnBalanceStillRequiresAllowance() (gas: 156280)\n[PASS] test_TransferFromToSelfConsumesAllowanceWithoutChangingBalance() (gas: 105205)\n[PASS] test_TransferFromToZeroRollsBackAllowance() (gas: 114078)\n[PASS] test_TransferFromUnlimitedAllowanceDoesNotDecreaseIt() (gas: 207143)\n[PASS] test_TransferInsufficientBalanceRevertsWithoutMutation() (gas: 67704)\n[PASS] test_TransferOneSmallestUnit() (gas: 78535)\n[PASS] test_TransferToZeroRevertsEvenForZeroAmount() (gas: 71926)\n[PASS] test_ZeroTransferFromEmptyAccountEmitsEvent() (gas: 73421)\n[PASS] test_ZeroTransferFromNeedsNoApproval() (gas: 81479)\nSuite result: ok. 30 passed; 0 failed; 0 skipped; finished in 66.10ms (327.54ms CPU time)\n\nRan 1 test for test/PABOXOInvariant.t.sol:PABOXOInvariantTest\n[PASS]\nPABOXOInvariantTest invariants:\n[PASS] invariant_AllowancesMatchLedger\n[PASS] invariant_BalancesMatchLedgerAndSupplyStaysFixed\n PABOXOInvariantTest invariants (runs: 128, calls: 8192, reverts: 0)\n\n╭---------------+-----------------------+-------+---------+----------╮\n| Contract      | Selector              | Calls | Reverts | Discards |\n+====================================================================+\n| PABOXOHandler | approve               | 1653  | 0       | 0        |\n|---------------+-----------------------+-------+---------+----------|\n| PABOXOHandler | rejectExcessAllowance | 1702  | 0       | 0        |\n|---------------+-----------------------+-------+---------+----------|\n| PABOXOHandler | rejectOverspend       | 1615  | 0       | 0        |\n|---------------+-----------------------+-------+---------+----------|\n| PABOXOHandler | spend                 | 1630  | 0       | 0        |\n|---------------+-----------------------+-------+---------+----------|\n| PABOXOHandler | transfer              | 1592  | 0       | 0        |\n╰---------------+-----------------------+-------+---------+----------╯\n\nLogs:\n  Bound result 100000000000000000000\n  Bound result 271\n  Bound result 0\n  Bound result 2\n  Bound result 999999999999999999999999998\n  Bound result 5\n  Bound result 115792089237316195423570985008687907853269984665639564039457584007913129639941\n  Bound result 0\n  Bound result 21921214920257516718186302\n  Bound result 115792089237316195423570985008687907853269984665639564039457584007913129639955\n  Bound result 123000000000000000000\n  Bound result 577\n  Bound result 0\n  Bound result 2223\n  Bound result 716869265842737419826\n  Bound result 0\n  Bound result 1145\n  Bound result 753\n  Bound result 2514000704\n  Bound result 1000000000000000000000000000\n  Bound result 115792089237316195423570985008687907853269984665639564039457584007913129642931\n  Bound result 115792089237316195423570985008687907853269984665640564039457584007913129639935\n  Bound result 0\n  Bound result 0\n  Bound result 19366208933087793105133002224814220221094443924285438345559\n  Bound result 5862\n  Bound result 5294\n  Bound result 1000000000000000000000000000\n  Bound result 3\n  Bound result 0\n  Bound result 30\n  Bound result 0\n  Bound result 115792089237316195423570985008687907853269984665639564039457584007913129646007\n  Bound result 0\n  Bound result 0\n  Bound result 2605843152773901058416204028911620352779074896087483299\n  Bound result 3820\n  Bound result 0\n  Bound result 115792089237316195423570985008687907853269984665640564039457584007913129638470\n  Bound result 115792089237316195423570985008687907853269984665640564039457584007913129636116\n  Bound result 115792089237316195423570985008687907853269984665639564039457584007913129649367\n  Bound result 1000000000000000000\n  Bound result 824\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 4.04s (4.04s CPU time)\n\nRan 3 test suites in 4.05s (4.17s CPU time): 33 tests passed, 0 failed, 0 skipped (33 total tests)\n","passed":true},{"durationMs":58,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"PABOXO.approve(address,uint256)\",\"PABOXO.transfer(address,uint256)\",\"PABOXO.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":5,\"DEPENDENCIES.md\":17,\"README.md\":59,\"foundry.toml\":26,\"launch.json\":24,\"src/PABOXO.sol\":17,\"test/PABOXO.t.sol\":367,\"test/PABOXOInvariant.t.sol\":126,\"test/PABOXOLaunch.t.sol\":90},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"4aa589c5e375dcc7a0d57f20fa6730db52d3489fdde52358940de7f205800083","verifiedTreeHash":"8f8b626deebdcd8f97bb1a223416cc1d92848456","verifierVersion":"0.1.0+560ab6a2"},{"checks":[{"durationMs":1342,"exitCode":0,"name":"build","output":"Compiling 27 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.26s\nCompiler run successful!\n","passed":true},{"durationMs":2482,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 2 tests for test/PABOXOLaunch.t.sol:PABOXOLaunchTest\n[PASS] test_Create2MintsEverythingToImmediateDeployer() (gas: 81389)\n[PASS] test_DistributionClaimsAndBidirectionalPoolTransfersDeliverExactAmounts() (gas: 421874)\nSuite result: ok. 2 passed; 0 failed; 0 skipped; finished in 1.23ms (1.25ms CPU time)\n\nRan 30 tests for test/PABOXO.t.sol:PABOXOTest\n[PASS] testFuzz_ApproveReplacesPreviousValue(uint256,uint256) (runs: 1024, μ: 104072, ~: 104164)\n[PASS] testFuzz_TransferAboveBalanceReverts(uint256) (runs: 1024, μ: 58815, ~: 59163)\nLogs:\n  Bound result 1000000000000000000000000004\n\n[PASS] testFuzz_TransferConservesSupply(address,uint256) (runs: 1024, μ: 92702, ~: 93179)\nLogs:\n  Bound result 487111769034225030556363899\n\n[PASS] testFuzz_TransferFromAboveAllowanceReverts(uint256,uint256) (runs: 1024, μ: 124945, ~: 125437)\nLogs:\n  Bound result 731226896729075950710004795\n  Bound result 806319309812783021543531823\n\n[PASS] testFuzz_TransferFromConservesSupplyAndTracksAllowance(uint256,uint256) (runs: 1024, μ: 162609, ~: 164862)\nLogs:\n  Bound result 981796161736199086495573583\n  Bound result 39568419545471986308\n\n[PASS] test_AllowanceIsSpecificToOwnerAndSpender() (gas: 200411)\n[PASS] test_ApprovalRevocationPreventsFurtherSpending() (gas: 192337)\n[PASS] test_ApproveCanExceedBalance() (gas: 78326)\n[PASS] test_ApproveEmitsEventWithoutMovingTokens() (gas: 88776)\n[PASS] test_ApproveZeroSpenderReverts() (gas: 61929)\n[PASS] test_ConstructorEmitsExactlyOneMint() (gas: 9636)\n[PASS] test_DeployerCannotSpendHolderBalanceWithoutApproval() (gas: 157924)\n[PASS] test_MetadataAndEntireInitialSupply() (gas: 107672)\n[PASS] test_NoMintBurnUpgradeOrAdministrativeEndpoints() (gas: 1111071)\n[PASS] test_RejectsNativeEther() (gas: 84885)\n[PASS] test_SelfTransferPreservesBalanceAndSupply() (gas: 53947)\n[PASS] test_TransferEntireBalanceEmitsEventAndDeliversExactly() (gas: 88692)\n[PASS] test_TransferFromCannotSpendAllowanceTwice() (gas: 146720)\n[PASS] test_TransferFromConsumesFiniteAllowanceAndEmitsTransfer() (gas: 172648)\n[PASS] test_TransferFromInsufficientAllowanceReverts() (gas: 115665)\n[PASS] test_TransferFromInsufficientBalanceRollsBackAllowance() (gas: 126121)\n[PASS] test_TransferFromOwnBalanceStillRequiresAllowance() (gas: 156280)\n[PASS] test_TransferFromToSelfConsumesAllowanceWithoutChangingBalance() (gas: 105205)\n[PASS] test_TransferFromToZeroRollsBackAllowance() (gas: 114078)\n[PASS] test_TransferFromUnlimitedAllowanceDoesNotDecreaseIt() (gas: 207143)\n[PASS] test_TransferInsufficientBalanceRevertsWithoutMutation() (gas: 67704)\n[PASS] test_TransferOneSmallestUnit() (gas: 78535)\n[PASS] test_TransferToZeroRevertsEvenForZeroAmount() (gas: 71926)\n[PASS] test_ZeroTransferFromEmptyAccountEmitsEvent() (gas: 73421)\n[PASS] test_ZeroTransferFromNeedsNoApproval() (gas: 81479)\nSuite result: ok. 30 passed; 0 failed; 0 skipped; finished in 42.37ms (173.06ms CPU time)\n\nRan 1 test for test/PABOXOInvariant.t.sol:PABOXOInvariantTest\n[PASS]\nPABOXOInvariantTest invariants:\n[PASS] invariant_AllowancesMatchLedger\n[PASS] invariant_BalancesMatchLedgerAndSupplyStaysFixed\n PABOXOInvariantTest invariants (runs: 128, calls: 8192, reverts: 0)\n\n╭---------------+-----------------------+-------+---------+----------╮\n| Contract      | Selector              | Calls | Reverts | Discards |\n+====================================================================+\n| PABOXOHandler | approve               | 1653  | 0       | 0        |\n|---------------+-----------------------+-------+---------+----------|\n| PABOXOHandler | rejectExcessAllowance | 1702  | 0       | 0        |\n|---------------+-----------------------+-------+---------+----------|\n| PABOXOHandler | rejectOverspend       | 1615  | 0       | 0        |\n|---------------+-----------------------+-------+---------+----------|\n| PABOXOHandler | spend                 | 1630  | 0       | 0        |\n|---------------+-----------------------+-------+---------+----------|\n| PABOXOHandler | transfer              | 1592  | 0       | 0        |\n╰---------------+-----------------------+-------+---------+----------╯\n\nLogs:\n  Bound result 100000000000000000000\n  Bound result 271\n  Bound result 0\n  Bound result 2\n  Bound result 999999999999999999999999998\n  Bound result 5\n  Bound result 115792089237316195423570985008687907853269984665639564039457584007913129639941\n  Bound result 0\n  Bound result 21921214920257516718186302\n  Bound result 115792089237316195423570985008687907853269984665639564039457584007913129639955\n  Bound result 123000000000000000000\n  Bound result 577\n  Bound result 0\n  Bound result 2223\n  Bound result 716869265842737419826\n  Bound result 0\n  Bound result 1145\n  Bound result 753\n  Bound result 2514000704\n  Bound result 1000000000000000000000000000\n  Bound result 115792089237316195423570985008687907853269984665639564039457584007913129642931\n  Bound result 115792089237316195423570985008687907853269984665640564039457584007913129639935\n  Bound result 0\n  Bound result 0\n  Bound result 19366208933087793105133002224814220221094443924285438345559\n  Bound result 5862\n  Bound result 5294\n  Bound result 1000000000000000000000000000\n  Bound result 3\n  Bound result 0\n  Bound result 30\n  Bound result 0\n  Bound result 115792089237316195423570985008687907853269984665639564039457584007913129646007\n  Bound result 0\n  Bound result 0\n  Bound result 2605843152773901058416204028911620352779074896087483299\n  Bound result 3820\n  Bound result 0\n  Bound result 115792089237316195423570985008687907853269984665640564039457584007913129638470\n  Bound result 115792089237316195423570985008687907853269984665640564039457584007913129636116\n  Bound result 115792089237316195423570985008687907853269984665639564039457584007913129649367\n  Bound result 1000000000000000000\n  Bound result 824\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 2.39s (2.39s CPU time)\n\nRan 3 test suites in 2.40s (2.44s CPU time): 33 tests passed, 0 failed, 0 skipped (33 total tests)\n","passed":true},{"durationMs":45,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"PABOXO.approve(address,uint256)\",\"PABOXO.transfer(address,uint256)\",\"PABOXO.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":5,\"DEPENDENCIES.md\":17,\"README.md\":59,\"foundry.toml\":26,\"src/PABOXO.sol\":17,\"test/PABOXO.t.sol\":367,\"test/PABOXOInvariant.t.sol\":126,\"test/PABOXOLaunch.t.sol\":90},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true},{"durationMs":436,"exitCode":0,"name":"slither","output":"slither: no results at low impact or above","passed":true},{"durationMs":209,"exitCode":0,"name":"aderyn","output":"[low] large-numeric-literal at src/PABOXO.sol:12: Large Numeric Literal","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"a0e752e95a2e51c95010d4165745029c7f0abe530bbc1fdd3c6a621b9cfaaafd","verifiedTreeHash":"c6c82bc4f5a12f7fe3503dd59a9b8bc3ee546389","verifierVersion":"0.1.0+560ab6a2"},{"checks":[{"durationMs":1521,"exitCode":0,"name":"build","output":"Compiling 28 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.45s\nCompiler run successful!\n","passed":true},{"durationMs":8798,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 2 tests for test/PABOXOLaunch.t.sol:PABOXOLaunchTest\n[PASS] test_Create2MintsEverythingToImmediateDeployer() (gas: 81389)\n[PASS] test_DistributionClaimsAndBidirectionalPoolTransfersDeliverExactAmounts() (gas: 421874)\nSuite result: ok. 2 passed; 0 failed; 0 skipped; finished in 91.69ms (2.14ms CPU time)\n\nRan 30 tests for test/PABOXO.t.sol:PABOXOTest\n[PASS] testFuzz_ApproveReplacesPreviousValue(uint256,uint256) (runs: 1024, μ: 104103, ~: 104200)\n[PASS] testFuzz_TransferAboveBalanceReverts(uint256) (runs: 1024, μ: 58810, ~: 59163)\nLogs:\n  Bound result 115792089237316195423570985008687907853269984665639564039557584007913129639935\n\n[PASS] testFuzz_TransferConservesSupply(address,uint256) (runs: 1024, μ: 92827, ~: 93179)\nLogs:\n  Bound result 298357928124812595882728117\n\n[PASS] testFuzz_TransferFromAboveAllowanceReverts(uint256,uint256) (runs: 1024, μ: 125056, ~: 125448)\nLogs:\n  Bound result 435269237444614862590429907\n  Bound result 564921997029300723272951149\n\n[PASS] testFuzz_TransferFromConservesSupplyAndTracksAllowance(uint256,uint256) (runs: 1024, μ: 162876, ~: 164862)\nLogs:\n  Bound result 8810\n  Bound result 453\n\n[PASS] test_AllowanceIsSpecificToOwnerAndSpender() (gas: 200411)\n[PASS] test_ApprovalRevocationPreventsFurtherSpending() (gas: 192337)\n[PASS] test_ApproveCanExceedBalance() (gas: 78326)\n[PASS] test_ApproveEmitsEventWithoutMovingTokens() (gas: 88776)\n[PASS] test_ApproveZeroSpenderReverts() (gas: 61929)\n[PASS] test_ConstructorEmitsExactlyOneMint() (gas: 9636)\n[PASS] test_DeployerCannotSpendHolderBalanceWithoutApproval() (gas: 157924)\n[PASS] test_MetadataAndEntireInitialSupply() (gas: 107672)\n[PASS] test_NoMintBurnUpgradeOrAdministrativeEndpoints() (gas: 1111071)\n[PASS] test_RejectsNativeEther() (gas: 84885)\n[PASS] test_SelfTransferPreservesBalanceAndSupply() (gas: 53947)\n[PASS] test_TransferEntireBalanceEmitsEventAndDeliversExactly() (gas: 88692)\n[PASS] test_TransferFromCannotSpendAllowanceTwice() (gas: 146720)\n[PASS] test_TransferFromConsumesFiniteAllowanceAndEmitsTransfer() (gas: 172648)\n[PASS] test_TransferFromInsufficientAllowanceReverts() (gas: 115665)\n[PASS] test_TransferFromInsufficientBalanceRollsBackAllowance() (gas: 126121)\n[PASS] test_TransferFromOwnBalanceStillRequiresAllowance() (gas: 156280)\n[PASS] test_TransferFromToSelfConsumesAllowanceWithoutChangingBalance() (gas: 105205)\n[PASS] test_TransferFromToZeroRollsBackAllowance() (gas: 114078)\n[PASS] test_TransferFromUnlimitedAllowanceDoesNotDecreaseIt() (gas: 207143)\n[PASS] test_TransferInsufficientBalanceRevertsWithoutMutation() (gas: 67704)\n[PASS] test_TransferOneSmallestUnit() (gas: 78535)\n[PASS] test_TransferToZeroRevertsEvenForZeroAmount() (gas: 71926)\n[PASS] test_ZeroTransferFromEmptyAccountEmitsEvent() (gas: 73421)\n[PASS] test_ZeroTransferFromNeedsNoApproval() (gas: 81479)\nSuite result: ok. 30 passed; 0 failed; 0 skipped; finished in 91.78ms (366.19ms CPU time)\n\nRan 13 tests for test/PABOXOProperties.t.sol:PABOXOPropertiesTest\n[PASS] testFuzz_DelegatedRoundTripRestoresBalancesButNotAllowance(uint256,uint256,uint256) (runs: 1024, μ: 309345, ~: 310165)\nLogs:\n  Bound result 298503057792340672753806113\n  Bound result 59146565648287202032\n  Bound result 59146565648287202035\n\n[PASS] testFuzz_FailedBalanceCheckLeavesApprovalUsableAfterTopUp(uint256,uint256,uint256,bool) (runs: 1024, μ: 359863, ~: 356181)\nLogs:\n  Bound result 898210107144310289125033920\n  Bound result 922277221501270624794416528\n  Bound result 115792089237316195423570985008687907853269984665639641762236100364135384963996\n\n[PASS] testFuzz_InvalidReceiverLeavesApprovalUsableForRetry(uint256,uint256,bool) (runs: 1024, μ: 234466, ~: 231021)\nLogs:\n  Bound result 3\n\n[PASS] testFuzz_SpendersCompeteForBalanceWithoutConsumingEachOthersAllowances(uint256) (runs: 1024, μ: 514124, ~: 513901)\nLogs:\n  Bound result 678298244962912308066966507\n\n[PASS] testFuzz_SplitDelegatedTransfersEqualOneTransfer(uint256,uint256) (runs: 1024, μ: 357013, ~: 358889)\nLogs:\n  Bound result 24576\n  Bound result 24576\n\n[PASS] test_DirectTransferDoesNotConsumeApprovalForLaterReceipts() (gas: 322549)\n[PASS] test_MaximumDelegatedSelfTransferRevertsWithoutConsumingApproval() (gas: 203942)\n[PASS] test_MaximumFiniteAllowanceIsNotUnlimited() (gas: 210706)\n[PASS] test_SelfTransferStillRejectsMoreThanTheBalance() (gas: 99036)\n[PASS] test_UnlimitedApprovalCanBeReducedThenRevoked() (gas: 382013)\n[PASS] test_ZeroDelegatedTransferPreservesNonzeroApprovals() (gas: 403547)\n[PASS] test_ZeroDelegatedTransferToZeroAddressIsRejected() (gas: 325277)\n[PASS] test_ZeroOwnerCannotBeUsedForADelegatedMint() (gas: 117038)\nSuite result: ok. 13 passed; 0 failed; 0 skipped; finished in 91.84ms (453.65ms CPU time)\n\nRan 2 tests for test/PABOXOInvariant.t.sol:PABOXOInvariantTest\n[PASS]\nPABOXOInvariantTest invariants:\n[PASS] invariant_AllowancesMatchLedger\n[PASS] invariant_BalancesMatchLedgerAndSupplyStaysFixed\n[PASS] invariant_MetadataStaysFixed\n PABOXOInvariantTest invariants (runs: 256, calls: 32768, reverts: 0)\n\n╭---------------+-------------------------+-------+---------+----------╮\n| Contract      | Selector                | Calls | Reverts | Discards |\n+======================================================================+\n| PABOXOHandler | approve                 | 3363  | 0       | 0        |\n|---------------+-------------------------+-------+---------+----------|\n| PABOXOHandler | approveBoundary         | 3313  | 0       | 0        |\n|---------------+-------------------------+-------+---------+----------|\n| PABOXOHandler | rejectApprovedOverspend | 3370  | 0       | 0        |\n|---------------+-------------------------+-------+---------+----------|\n| PABOXOHandler | rejectExcessAllowance   | 3221  | 0       | 0        |\n|---------------+-------------------------+-------+---------+----------|\n| PABOXOHandler | rejectInvalidReceiver   | 3244  | 0       | 0        |\n|---------------+-------------------------+-------+---------+----------|\n| PABOXOHandler | rejectOverspend         | 3226  | 0       | 0        |\n|---------------+-------------------------+-------+---------+----------|\n| PABOXOHandler | revokeAndReject         | 3273  | 0       | 0        |\n|---------------+-------------------------+-------+---------+----------|\n| PABOXOHandler | roundTrip               | 3232  | 0       | 0        |\n|---------------+-------------------------+-------+---------+----------|\n| PABOXOHandler | spend                   | 3278  | 0       | 0        |\n|---------------+-------------------------+-------+---------+----------|\n| PABOXOHandler | transfer                | 3248  | 0       | 0        |\n╰---------------+-------------------------+-------+---------+----------╯\n\nLogs:\n  Bound result 63773642\n  Bound result 250000000000000000000000003\n  Bound result 0\n  Bound result 0\n  Bound result 7\n  Bound result 1\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 10670\n  Bound result 0\n  Bound result 0\n  Bound result 115792089237316195423570985008687907853269984665640314039457584007913129651096\n  Bound result 250000000000000000000010662\n  Bound result 0\n  Bound result 101\n  Bound result 115792089237316195423570985008687907853269984665640314039457584007913129634036\n  Bound result 250000000000000000000010663\n  Bound result 16507357515867911220591733\n  Bound result 172910671305576248355137064\n  Bound result 6833\n  Bound result 9872\n  Bound result 8771\n  Bound result 250000000000000000000013702\n  Bound result 115792089237316195423570985008687907853269984665640314039457584007913129637281\n  Bound result 2\n  Bound result 0\n  Bound result 957625570\n  Bound result 104092386653458720022755241\n  Bound result 4\n  Bound result 0\n  Bound result 0\n  Bound result 4\n  Bound result 170482417599677327899975141707064506132223211269516095462749922365917703\n  Bound result 693\n  Bound result 288\n  Bound result 0\n  Bound result 0\n  Bound result 6\n  Bound result 28517804632892484375288713836858818130552\n  Bound result 641\n  Bound result 0\n  Bound result 0\n  Bound result 11410\n  Bound result 4344\n  Bound result 115792089237316195423570985008687907853269984665640564039457584007913129639933\n  Bound result 200000000000000000000\n  Bound result 0\n  Bound result 831\n  Bound result 635\n  Bound result 1418688759708887809770816784693122988603080902654\n  Bound result 694\n  Bound result 717921394\n  Bound result 420\n  Bound result 200000000000000000000\n  Bound result 241\n  Bound result 1\n  Bound result 30923602956221386293766415873039742298698683674345435713665045629\n  Bound result 1079\n  Bound result 145907613346541279977234029\n  Bound result 115792089237316195423570985008687907853269984665640209947070930549196231721344\n  Bound result 1000000000\n  Bound result 208\n  Bound result 8311289735921858123107895022825633541514\n  Bound result 4\n  Bound result 115792089237316195423570985008687907853269984665640564039457584007913129639933\n  Bound result 24576\n  Bound result 115792089237316195423570985008687907853269984665640209947070930549194106903724\n  Bound result 3\n  Bound result 205914629032335344944549113\n\n[PASS] test_HandlerExercisesNonzeroSpendsAndRollbackBoundaries() (gas: 2361529)\nLogs:\n  Bound result 1\n  Bound result 1\n  Bound result 1\n  Bound result 1\n  Bound result 1000000000000000000000000000\n  Bound result 249999999999999999999999998\n  Bound result 1\n  Bound result 1\n\nSuite result: ok. 2 passed; 0 failed; 0 skipped; finished in 8.71s (8.71s CPU time)\n\nRan 4 test suites in 8.71s (8.99s CPU time): 47 tests passed, 0 failed, 0 skipped (47 total tests)\n","passed":true},{"durationMs":38,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"PABOXO.approve(address,uint256)\",\"PABOXO.transfer(address,uint256)\",\"PABOXO.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":5,\"DEPENDENCIES.md\":17,\"README.md\":59,\"foundry.toml\":26,\"src/PABOXO.sol\":17,\"test/PABOXO.t.sol\":367,\"test/PABOXOInvariant.t.sol\":279,\"test/PABOXOLaunch.t.sol\":90,\"test/PABOXOProperties.t.sol\":318},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"f679743a3cf0b78b440cce09df6c9066f4343ea13d5bfa321b338c8c4d909d86","verifiedTreeHash":"ba8b61d06d179001a67e39309cec323f304cfe54","verifierVersion":"0.1.0+560ab6a2"}]}