{"assessments":[],"deployments":[],"fuzz":[],"identity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"interpretation":"Records acceptance and evidence. Neither completion nor an AI assessment establishes correctness, safety, or independent review.","jobId":"58681b92-9d23-465a-9fd6-f900c51c19d8","kind":"shape:chain","nodes":[{"acceptedSubmissionHash":"9798e180d1e01152224d26ce2ec0823b1fced9a099a6d184832a178f37d7e3d9","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_economics","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"58c28a2516648ba6e89add133c544310682a52e7e7c376480056d145f33a3283","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_flow","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"49c2f7831631aad7d0c69a191353fcb2d8de4af6f1165b2b6bd4919f6dd01e0d","dependsOn":["build_contract_project","write_foundry_tests","manifest","audit_math","audit_permissions","audit_economics","audit_flow"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"af3aa01159bbf354f621cafa5c0006f6169e0938a8b015be508b7377dbf165bc","skillId":"audit-judge","tools":[]},"key":"audit_judge","kind":"code","role":"review","skillHash":"af3aa01159bbf354f621cafa5c0006f6169e0938a8b015be508b7377dbf165bc","skillId":"audit-judge","state":"accepted"},{"acceptedSubmissionHash":"fc5368b8d9c8222eb0b22c4b91f12687e8a766a747c66751adaf4e3ee8ae4406","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_math","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"ef5743367c60a3f41432d180c2209926599b31d700e8009cbbbea60d47e624bc","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_permissions","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"72862ebc533b4b4d5991a82ae13469536b902f4678e3f07cc4214449f92f6052","dependsOn":[],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"d59561da3b378461b7c749f6bd5084477d44993aa94972ddea90f542535751df","skillId":"build-contract-project","tools":[]},"key":"build_contract_project","kind":"code","role":"implement","skillHash":"d59561da3b378461b7c749f6bd5084477d44993aa94972ddea90f542535751df","skillId":"build-contract-project","state":"accepted"},{"acceptedSubmissionHash":"8d12ce4d8f6f866e3a81e4a9b23b4df11dfdcd57bd98c2a87567c1cfaf4061fe","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"tools":[]},"key":"manifest","kind":"code","role":"integrate","skillHash":null,"skillId":null,"state":"accepted"},{"acceptedSubmissionHash":"b8d80991b870ea9cbf1b15faa089f3371fbd8ebce9837496edd816d0ae335738","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"4c76766b00591dfe982fe85d3de589fdb2f810e5137c301155d1c5e36a1d3b23","skillId":"write-foundry-tests","tools":[]},"key":"write_foundry_tests","kind":"code","role":"tests","skillHash":"4c76766b00591dfe982fe85d3de589fdb2f810e5137c301155d1c5e36a1d3b23","skillId":"write-foundry-tests","state":"accepted"}],"objective":"A custom token: Sooth Protocol (SOOTH).\nToken name: Sooth Protocol\nToken symbol: SOOTH\nToken supply: 1,000,000,000 with 18 decimals, all minted once to the deployer in the constructor.","parentJobId":null,"planHash":"6837752756273c13a173951469a98b897883991155118a3d80fe5542e579823d","previousHash":"0000000000000000000000000000000000000000000000000000000000000000","projectId":"58681b92-9d23-465a-9fd6-f900c51c19d8","publication":{"commit":null,"deliveredAt":null,"repoUrl":"https://github.com/identity-md-launches/launch-2360-sooth-protocol"},"receiptIdentity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"registry":"0xb6d0a187b050fa5bb0b87033a203f37becf4a775","research":[],"schema":"identitymd-work-v1","signals":[{"agentId":"51423","feedbackHash":"b6bd50aace55f7c292f83f8bcddb5c7dcdc0927c9b5ea53654e76fbba6f79a0c","nodeKey":"audit_economics","submissionHash":"9798e180d1e01152224d26ce2ec0823b1fced9a099a6d184832a178f37d7e3d9","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"53934","feedbackHash":"ae5f40fecb5debfa41adad5f1448e8cc8c8ed5fb785d099d54cf206a9b394391","nodeKey":"audit_flow","submissionHash":"58c28a2516648ba6e89add133c544310682a52e7e7c376480056d145f33a3283","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52189","feedbackHash":"ed19d518a6969c0593290ba2821fee1f5b177e4b904dc4b56dc87fb24fb78832","nodeKey":"audit_judge","submissionHash":"49c2f7831631aad7d0c69a191353fcb2d8de4af6f1165b2b6bd4919f6dd01e0d","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51742","feedbackHash":"0d133618d20c06db91a491b26dcdbb1e6bb23673f0d4846994b9fdc3af25638c","nodeKey":"audit_math","submissionHash":"fc5368b8d9c8222eb0b22c4b91f12687e8a766a747c66751adaf4e3ee8ae4406","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"53937","feedbackHash":"be9113d611a0a5687addaabe1c0aec9fb35e50a7acbd641978ea6ce44542d72b","nodeKey":"audit_permissions","submissionHash":"ef5743367c60a3f41432d180c2209926599b31d700e8009cbbbea60d47e624bc","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"50945","feedbackHash":"46905439e4ae4f8337bc29d5571d97db4c6f1de429034ca79b7fb1b72c9ac2fc","nodeKey":"build_contract_project","submissionHash":"72862ebc533b4b4d5991a82ae13469536b902f4678e3f07cc4214449f92f6052","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"51509","feedbackHash":"51448336fcba062e16bd55e8d6efc16777bee848258b0cdd7887b5dadbbf847f","nodeKey":"manifest","submissionHash":"8d12ce4d8f6f866e3a81e4a9b23b4df11dfdcd57bd98c2a87567c1cfaf4061fe","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"51229","feedbackHash":"6bd10e0295434389fa791ff1cd16cf0b3aab26b6b33498a44231070241e1d035","nodeKey":"write_foundry_tests","submissionHash":"b8d80991b870ea9cbf1b15faa089f3371fbd8ebce9837496edd816d0ae335738","tag1":"verification:checks","tag2":"acceptance-v2","value":1}],"site":null,"snapshotHash":"3c4526206c2b03805b4968be17417598105e680ccd35de6b0a56dafe57eb29f4","state":"completed","submissions":[{"artifacts":[],"attempt":1,"bundleHash":null,"device":"fe5e46fb044c6af1","findings":[{"citation":"resolved","description":"Merged from the audit_permissions, audit_math, audit_economics and audit_flow reports, which all describe the same root cause. DEPENDENCIES.md states both vendored libraries are unmodified upstream sources and tells the reader to verify them with `sha256sum --check DEPENDENCIES.sha256`. On the committed tree that command exits 1: seven forge-std files (lib/forge-std/src/Vm.sol, StdAssertions.sol, StdJson.sol, StdToml.sol, console.sol, interfaces/IERC7540.sol, interfaces/IMulticall3.sol) do not match the recorded hashes. I re-downloaded each of the seven files from the forge-std v1.9.7 tag: every upstream file hashes to exactly the value recorded in DEPENDENCIES.sha256 (e.g. line 18, `9068805b59ac1d0ea03a8fa1f15ae49c094e0c6c852a2500e0dd112f264b2cb1  lib/forge-std/src/Vm.sol`), and each vendored copy is byte-identical to upstream once all whitespace is stripped, so the committed copies are a `forge fmt` line reflow of the genuine upstream files with no semantic change. Production is unaffected: all six OpenZeppelin entries pass, and lib/openzeppelin-contracts/contracts/token/ERC20/ERC20.sol hashes to 2d874da1c1478ed22a2d30dcf1a6ec0d09a13f897ca680d55fb49fbcc0e0c5b1, which is the hash of upstream v5.0.2 ERC20.sol fetched from GitHub. forge-std is test-only. The defect is that the repository's own provenance claim and the verification step it hands to reviewers and the launch operator report failure on an honest tree, so the check either gets ignored or blocks a release step that keys on it. Fix (either): restore the seven files byte-for-byte from the v1.9.7 tag and exclude lib/ from `forge fmt` (note `forge fmt --check` currently passes only because the copies are reformatted), or regenerate DEPENDENCIES.sha256 from the committed files and amend line 15 to say the forge-std copies were reformatted. No change to src/ is needed.","line":15,"path":"DEPENDENCIES.md","reproduction":"State: the committed tree at 3d03317 (same at c1dc13b, where Vm.sol and DEPENDENCIES.sha256 were added in one commit). Command, from the repository root: `sha256sum --check DEPENDENCIES.sha256`. Expected (per DEPENDENCIES.md lines 15 and 22): every line OK, exit status 0. Actual: 29 OK, 7 FAILED (lib/forge-std/src/StdAssertions.sol, StdJson.sol, StdToml.sol, Vm.sol, console.sol, interfaces/IERC7540.sol, interfaces/IMulticall3.sol), 'WARNING: 7 computed checksums did NOT match', exit status 1. Cross-check: `sha256sum lib/forge-std/src/Vm.sol` gives a1b1c82924aecf0f38b53192fd1e801cccc1e1fd2ecd6b2301e4f4c4ab102a15; `curl -sSL https://raw.githubusercontent.com/foundry-rs/forge-std/v1.9.7/src/Vm.sol | sha256sum` gives 9068805b59ac1d0ea03a8fa1f15ae49c094e0c6c852a2500e0dd112f264b2cb1, the recorded value; `cmp <(tr -d ' \\t\\n\\r' < upstream/Vm.sol) <(tr -d ' \\t\\n\\r' < lib/forge-std/src/Vm.sol)` reports no difference. The same holds for the other six files.","severity":"low","snippet":"Both are unmodified upstream sources. Only OpenZeppelin's ERC-20 dependency","title":"Documented dependency integrity check fails: seven vendored forge-std files were reformatted after DEPENDENCIES.sha256 was recorded, so the 'unmodified upstream sources' claim is false for the committ"}],"hash":"49c2f7831631aad7d0c69a191353fcb2d8de4af6f1165b2b6bd4919f6dd01e0d","nodeId":"0643e17a-776f-4840-b727-d72bc84d100a","outcome":"completed","summary":"The review is complete and written to `.imd-findings.json`. The working tree is otherwise untouched apart from my scratch test under `test/scratch/`, which is gitignored and not kept.\n\n**Outcome: one low-severity finding, no defects in the token itself.**\n\n**What I verified**\n\n- The token is a 17-line plain OpenZeppelin ERC20 with no overrides. Its ABI exposes only approve, transfer and transferFrom as state-changing functions.\n- The vendored ERC20.sol hashes to the same value as the file fetched from the OpenZeppelin v5.0.2 tag, so the inherited code is genuine upstream.\n- I traced all three entry points through the upstream `_transfer`, `_update`, `_approve` and `_spendAllowance` bodies and marked each `holds`.\n- A scratch test mirrored the launch floor: CREATE2 deployment from a factory stand-in, exact supply and decimals, whole transfers along the swarm path, twenty-two admin and freeze selectors rejected from both a stranger and the factory, and a reachable-opcode scan with no DELEGATECALL, CALLCODE or SELFDESTRUCT. All four scratch tests and the project's 45 shipped tests pass.\n- Creation and runtime bytecode are far under the deployment limits, and launch.json matches the code: empty constructor args, supply of 10^27 minor units, 18 decimals, contract name within 32 characters.\n\n**The finding I kept**\n\nAll four specialists reported the same root cause, which I merged into one low finding. The documented command `sha256sum --check DEPENDENCIES.sha256` fails on the committed tree. Seven forge-std files were reformatted after the hashes were recorded. I confirmed every recorded hash is the real v1.9.7 upstream value and every vendored copy is byte-identical to upstream once whitespace is stripped. Production code is unaffected since forge-std is test-only, but the repository's own provenance claim and verification step are false as shipped. The fix is either to restore the seven files byte-for-byte or to regenerate the hash record and amend the claim.\n\n**Leads dropped**\n\nThe aderyn large-numeric-literal line points at the supply constant, which is written with digit separators and equals the manifest supply exactly. Nothing to report there.","treeHash":null,"usage":{"cachedInputTokens":517678,"inputTokens":258,"model":"claude-fable-5-1","outputTokens":11615,"runtime":"claude","turns":20,"wallClockMs":176554}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"5dd3af20ad7ac0c2","findings":[{"citation":"resolved","description":"DEPENDENCIES.md (line 15) states that both vendored dependencies are 'unmodified upstream sources' and tells a verifier to run `sha256sum --check DEPENDENCIES.sha256`. The recorded hashes are those of upstream forge-std v1.9.7 (confirmed by fetching the tagged files), but seven of the vendored forge-std files (Vm.sol, StdAssertions.sol, StdJson.sol, StdToml.sol, console.sol, interfaces/IERC7540.sol, interfaces/IMulticall3.sol) have been reformatted (line re-wrapping only; a whitespace-stripped comparison is identical to upstream). The documented integrity check therefore reports 7 FAILED. All five OpenZeppelin files are byte-identical to upstream v5.0.2 and pass. No production code is affected: forge-std is test-only, and the ERC20 base the token inherits is verified unmodified. This is a documentation/provenance inconsistency only; it may also have been introduced by tooling that reformatted lib/ after the hashes were recorded. Fix: either re-record the hashes of the files as shipped, or restore the byte-exact upstream files, and keep the 'unmodified' claim consistent with whichever is chosen.","line":18,"path":"DEPENDENCIES.sha256","reproduction":"In the repository root run `sha256sum --check DEPENDENCIES.sha256`. Expected (per DEPENDENCIES.md): every line OK. Actual: 29 OK and 7 FAILED (lib/forge-std/src/StdAssertions.sol, StdJson.sol, StdToml.sol, Vm.sol, console.sol, interfaces/IERC7540.sol, interfaces/IMulticall3.sol). `sha256sum lib/forge-std/src/Vm.sol` gives a1b1c829... while line 18 records 9068805b..., which is the hash of upstream v1.9.7 src/Vm.sol. `diff <(tr -d ' \\t\\n\\r' < upstream/Vm.sol) <(tr -d ' \\t\\n\\r' < lib/forge-std/src/Vm.sol)` is empty.","severity":"info","snippet":"9068805b59ac1d0ea03a8fa1f15ae49c094e0c6c852a2500e0dd112f264b2cb1  lib/forge-std/src/Vm.sol","title":"DEPENDENCIES.sha256 does not match the vendored forge-std files; the documented integrity check fails"}],"hash":"58c28a2516648ba6e89add133c544310682a52e7e7c376480056d145f33a3283","nodeId":"6dbf5810-f4a1-44af-8a9d-832503876336","outcome":"completed","summary":"The review is complete and `.imd-findings.json` holds the result. The working tree is otherwise clean.\n\n**Outcome:** no defect in the token code. The three state-changing entry points, `approve`, `transfer` and `transferFrom`, all hold. One info-level provenance inconsistency is reported.\n\n**What I checked, against the Execution Trace, Periphery and First Principles guides**\n\n- **Token source.** `src/SoothToken.sol` is 17 lines: OpenZeppelin ERC20 plus a constructor that mints exactly 10^27 base units to the deployer. No overrides, no owner, no args, no external calls.\n- **Periphery.** The five vendored OpenZeppelin files are byte-identical to upstream v5.0.2, confirmed by fetching the tagged files and diffing.\n- **Compiled ABI.** Only the ten ERC-20 functions plus a constant getter. No fallback, receive or payable path. Ether sent with any call is refused.\n- **Floor replica.** I wrote and ran a scratch test reproducing what the protected floor checks that can run without v4-core: CREATE2 deployment from a factory-like contract, the factory holding the whole supply, launch flows arriving whole, all 22 admin selectors reverting from both a stranger and the factory, holder balances untouchable without approval, and the protected opcode reachability scan on the runtime bytecode. All ten passed, then I deleted the scratch file.\n- **Existing suite.** Build is clean and all 26 project tests pass with the documented fuzz seed.\n\n**Finding (info).** `DEPENDENCIES.md` says both vendored dependencies are unmodified and tells a verifier to run the recorded checksum file. Seven forge-std files were reformatted, so that command reports 7 failures. Stripping whitespace, the files match upstream v1.9.7 exactly, and forge-std is test-only, so there is no production impact.\n\n**Coverage record.** Eleven rows: the three entry points hold, plus rows for the constructor mint, metadata, the absence of any privileged surface, the bytecode scan, the OpenZeppelin base, the owners check and the forge-std record. The one row marked unreached is the protected seed-and-swap test, since v4-core and the launch environment inputs are not in this tree. The transfer-level analogue was verified instead.","treeHash":null,"usage":{"cachedInputTokens":633285,"inputTokens":258,"model":"claude-fable-5-1","outputTokens":18324,"runtime":"claude","turns":26,"wallClockMs":265939}},{"artifacts":[],"attempt":1,"bundleHash":"66fb808756c63edd6ebb5c756a65426f55cfd70e4fdfd984b95931aa76a809ff","device":"f2eb60f00abb5b80","findings":[],"hash":"72862ebc533b4b4d5991a82ae13469536b902f4678e3f07cc4214449f92f6052","nodeId":"c1cf42eb-7d04-4412-9181-1a29ee03afb8","outcome":"completed","summary":"Implemented [SoothToken.sol](/home/imd-worker/.identitymd/work/58681b92-9d23-465a-9fd6-f900c51c19d8/c1cf42eb-7d04-4412-9181-1a29ee03afb8/src/SoothToken.sol): 1 billion SOOTH, 18 decimals, minted once entirely to the deployer.\n\nDependencies are vendored for offline builds. Deployment parameters, assumptions, and operational responsibilities are documented in `README.md`.\n\nValidation passed:\n\n- `forge build`\n- `forge test`: 26 passed, including fuzz and invariant checks using the supplied seed\n- `forge fmt --check`","treeHash":"2c0ac8733282d7945b21751d43b853146686ca09","usage":{"cachedInputTokens":347520,"inputTokens":56941,"model":"gpt-6-astra","outputTokens":12653,"runtime":"codex","turns":4,"wallClockMs":357741}},{"artifacts":[],"attempt":1,"bundleHash":"fc0b00c7b30fd2944517adb0231a86b7fd6576e34252e4bd1613e4dc9ece63ee","device":"74a99f640688d37b","findings":[],"hash":"8d12ce4d8f6f866e3a81e4a9b23b4df11dfdcd57bd98c2a87567c1cfaf4061fe","nodeId":"0ecbac7c-36dc-47e1-a6cd-112c1b78e32a","outcome":"completed","summary":"Done. I wrote `launch.json` for the Sooth Protocol launch and verified it against the accepted tree.\n\n**What the manifest says**\n- Kind is `custom_token`. The token contract is `SoothToken`, named Sooth Protocol, symbol SOOTH, 18 decimals.\n- Constructor arguments are empty, matching the accepted contract, which takes none and mints the whole supply to msg.sender.\n- totalSupply is 1000000000000000000000000000, exactly the contract's INITIAL_SUPPLY constant.\n- The contracts list is empty because the accepted tree contains only the token.\n- pool and economics are copied verbatim from the launch reference: IMD pair address, fee 12500, tick spacing 60, one-to-one provenance price, and the requester's 80% pool share, 3,500 IMD opening cap and remainder address.\n- notes describe only the token's actual behavior, under 700 characters.\n\n**Checks run**\n- A local script confirmed the manifest's keys, supply string, verbatim economics, lowercase addresses and notes length.\n- `forge build` compiled cleanly.\n- `forge test` with the verifier's fuzz seed passed all 26 tests.\n- Git status shows launch.json as the only new file. No other file changed.","treeHash":"3d1b967e182603fe3da2a2ccfc495c1e6a006a83","usage":{"cachedInputTokens":184014,"inputTokens":130,"model":"claude-fable-5-1","outputTokens":2485,"runtime":"claude","turns":8,"wallClockMs":42152}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"56e50117311155be","findings":[{"citation":"resolved","description":"DEPENDENCIES.md (line 15) states the vendored sources are unmodified upstream and (line 22) tells the operator to verify them with `sha256sum --check DEPENDENCIES.sha256`. On the committed tree that command exits 1: seven forge-std v1.9.7 files (StdAssertions.sol, StdJson.sol, StdToml.sol, Vm.sol, console.sol, interfaces/IERC7540.sol, interfaces/IMulticall3.sol) differ from the recorded hashes. The recorded hashes equal the real upstream v1.9.7 hashes (verified against the codeload tarball), so the record was computed first and the files were reformatted afterwards (forge fmt line-wrapping only; the diffs are whitespace, no semantic change). All five OpenZeppelin files, including the production ERC20.sol, still match their recorded hashes. Impact: the supply-chain check the project ships for its reviewers and the launch operator reports failure on an honest tree, which either gets ignored (defeating its purpose) or blocks a release step that keys on it. Production code is unaffected; forge-std is test-only. Fix: either regenerate DEPENDENCIES.sha256 from the files as committed and amend the 'unmodified' claim to note the formatting pass, or restore the seven files byte-for-byte from upstream v1.9.7 so the existing record and claim become true (forge fmt --check currently passes with the reformatted copies, so restoring them may require excluding lib/ from fmt).","line":15,"path":"DEPENDENCIES.md","reproduction":"State: the committed tree at c1dc13b. Command: `sha256sum --check DEPENDENCIES.sha256`. Expected (per DEPENDENCIES.md line 22 and README 'Build and test'): every line OK, exit 0. Actual: 'lib/forge-std/src/StdAssertions.sol: FAILED', StdJson.sol FAILED, StdToml.sol FAILED, Vm.sol FAILED, console.sol FAILED, interfaces/IERC7540.sol FAILED, interfaces/IMulticall3.sol FAILED, 'WARNING: 7 computed checksums did NOT match', exit 1. Cross-check: `sha256sum lib/forge-std/src/Vm.sol` gives a1b1c829...2a15 while DEPENDENCIES.sha256 line 18 records 9068805b...2cb1, which is the hash of upstream v1.9.7 src/Vm.sol; `diff` of the two shows only line-wrapping changes.","severity":"low","snippet":"Both are unmodified upstream sources. Only OpenZeppelin's ERC-20 dependency","title":"DEPENDENCIES.sha256 no longer matches seven vendored forge-std files, so the documented integrity check fails on the committed tree"}],"hash":"9798e180d1e01152224d26ce2ec0823b1fced9a099a6d184832a178f37d7e3d9","nodeId":"aeb4b0c0-129b-449e-bc06-04a83fc135cf","outcome":"completed","summary":"The review is complete and written to `.imd-findings.json`. The working tree is otherwise untouched.\n\n**Result: the token holds on every check in my area.** `SoothToken` is an unmodified OpenZeppelin v5.0.2 ERC20 with a single constructor mint of 10^27 units to `msg.sender`, 18 decimals, no owner, no mint, burn, pause, blacklist, hook or external call. The Economic Security, Invariant and Flow Gap failure modes all depend on surfaces this contract does not have.\n\nWhat I verified concretely:\n- **Launch flows arrive whole.** A CREATE2 factory analogue received the full supply, moved the swarm share, had 80% pulled by a pool-manager analogue through `transferFrom`, forwarded the remainder, and a trader bought and sold back exactly. Supply unchanged throughout.\n- **Conservation invariant.** The project's own 128-run stateful suite plus a scratch fuzz over eight random holders kept sum of balances equal to total supply.\n- **Protected floor conditions.** I re-ran the floor's reachable-opcode scan against the compiled runtime: no DELEGATECALL, CALLCODE or SELFDESTRUCT. Every admin selector the floor probes reverts.\n- **OpenZeppelin production files** match their recorded hashes and the v5.0.2 source.\n\n**One low finding.** `DEPENDENCIES.md` claims unmodified upstream sources and tells the operator to run `sha256sum --check DEPENDENCIES.sha256`. On the committed tree that command fails for seven forge-std files. The recorded hashes are the true upstream v1.9.7 hashes, and the diffs are formatter line-wrapping only, so the files were reformatted after hashing. Test-only code, no effect on the token, but the shipped integrity check reports failure on an honest tree.\n\nCoverage: all three ABI entry points are marked `holds`, with six extra rows for the invariants and launch flows I traced. Nothing in the assigned area was left unreached. Static analysis leads (aderyn's large-literal note) were confirmed benign: the literal equals the manifest supply exactly.","treeHash":null,"usage":{"cachedInputTokens":565616,"inputTokens":226,"model":"claude-fable-5-1","outputTokens":11631,"runtime":"claude","turns":18,"wallClockMs":175580}},{"artifacts":[],"attempt":1,"bundleHash":"2d0b402e8b213b129049ba32a942adfbb02ab38bddd9669da79c49963fd78f56","device":"4199bf0c80a9d6cf","findings":[],"hash":"b8d80991b870ea9cbf1b15faa089f3371fbd8ebce9837496edd816d0ae335738","nodeId":"93490e42-ec2b-4e9e-9b13-c028c89b7564","outcome":"completed","summary":"I added two test files for the SOOTH token. The full suite passes with the verifier's fuzz seed: 45 tests across 4 suites, with no failures and no unexpected reverts in either invariant handler.\n\n**What the contract is:** `src/SoothToken.sol` is a plain OpenZeppelin ERC-20. Its constructor mints 10^27 base units (1,000,000,000 tokens with 18 decimals) once, to whoever deploys it. It has no owner, no other functions and no changes to how transfers work. I found no defects, so I didn't write `.imd-findings.json`. The earlier contributor's tests already covered most of the basics; these files add to them without changing them.\n\n**`test/SoothToken.edges.t.sol`** (18 tests):\n- **Launch in one transaction:** a helper contract deploys the token with CREATE2 and splits the supply in a single constructor, the way the factory does. The helper ends up holding the whole supply, then nothing. The amounts arrive exactly, and neither the test contract nor `tx.origin` ever holds any.\n- **Deployment and bytecode:** separate launches produce separate tokens, and deploying twice with the same salt reverts. The deployed code is under the 24,576-byte size limit and has no reachable DELEGATECALL, CALLCODE or SELFDESTRUCT.\n- **Return values and bad calls:** `transfer`, `approve` and `transferFrom` each return a 32-byte `true`. Sending ether, calling an unknown function, or sending a call with its last argument cut off all revert.\n- **Failure paths:** `transferFrom` from the zero address, transferring 1 wei from an empty account, and spending again after an allowance is used up. Also that an allowance belongs to one owner and one spender, and that an allowance one below the maximum still goes down when spent.\n- **Tokens sent to the token contract** are stuck, because nothing can take them out again.\n- **Five fuzz tests at 1,000 runs each:** transfers between any two accounts conserve the supply, `approve` always overwrites the previous value, overdraws revert with the exact error and amounts, a failed `transferFrom` leaves the allowance as it was, and a stranger can't move a holder's tokens.\n\n**`test/SoothToken.openInvariant.t.sol`:** a second invariant suite. Unlike the existing one, which uses four fixed holders, its set of holders grows as random new addresses are added (up to 24), and the token contract itself is one of them. Random sequences of transfers and approvals are mixed with calls that must be rejected: sending to the zero address, approving the zero address, spending from the zero address, and spending more than the allowance. Each rejected call must revert with the exact error and change nothing. After every sequence it checks that:\n- the supply never changes and the tracked holders hold all of it;\n- every balance and allowance matches the test's own independent record;\n- the name, symbol and decimals never change.\n\nRun counts are set inside the files (`invariant.runs = 256`, `fuzz.runs = 1000`), since `foundry.toml` isn't mine to change.\n\nOne thing that isn't a bug: I first expected `transferFrom(address(0), to, 0)` to fail on the sender check. In OpenZeppelin v5 it fails earlier, on the approver check, because the remaining allowance is written back before the transfer happens. Either way the call reverts, which is correct, so the tests now expect the error the library actually raises.\n\nThe only changes in the working tree are the two new files under `test/`.","treeHash":"3839bac1388585a731ba014c3350e9c9d6133e82","usage":{"cachedInputTokens":434723,"inputTokens":20,"model":"claude-opus-5-5","outputTokens":13591,"runtime":"claude","turns":13,"wallClockMs":145245}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"33bef35e96ccb653","findings":[{"citation":"resolved","description":"DEPENDENCIES.md line 15 states 'Both are unmodified upstream sources' and line 22 instructs the reader to verify local integrity with `sha256sum --check DEPENDENCIES.sha256`. That command fails on the committed tree: lib/forge-std/src/Vm.sol, console.sol, StdAssertions.sol, StdJson.sol, StdToml.sol, interfaces/IERC7540.sol and interfaces/IMulticall3.sol all report FAILED. The hashes recorded in DEPENDENCIES.sha256 are correct for upstream forge-std v1.9.7 (I fetched each file from raw.githubusercontent.com/foundry-rs/forge-std/v1.9.7 and its sha256 equals the recorded value); the committed copies were re-wrapped by a formatter (e.g. `getDeployment(...)` on one line instead of four) and are identical to upstream once all whitespace is stripped. Production impact: none. The five OpenZeppelin v5.0.2 files that SoothToken compiles against are byte-identical to upstream and pass the check; forge-std is used only by tests. The defect is that the repository's own stated provenance claim and verification step are false for the committed tree, so a reviewer or the launch operator following DEPENDENCIES.md gets a failed integrity check and cannot tell from the repository alone whether the test library was tampered with. This is outside the Access Control / Trust Gap / Asymmetry area and is reported for completeness. Fix: either restore the seven files to their exact upstream bytes (and exclude lib/ from `forge fmt`), or regenerate DEPENDENCIES.sha256 from the committed files and drop or qualify the 'unmodified upstream sources' sentence.","line":18,"path":"DEPENDENCIES.sha256","reproduction":"From the repository root run `sha256sum --check DEPENDENCIES.sha256`. Expected (per DEPENDENCIES.md): every line OK, exit status 0. Actual: 'lib/forge-std/src/StdAssertions.sol: FAILED', 'lib/forge-std/src/StdJson.sol: FAILED', 'lib/forge-std/src/StdToml.sol: FAILED', 'lib/forge-std/src/Vm.sol: FAILED', 'lib/forge-std/src/console.sol: FAILED', 'lib/forge-std/src/interfaces/IERC7540.sol: FAILED', 'lib/forge-std/src/interfaces/IMulticall3.sol: FAILED', 'sha256sum: WARNING: 7 computed checksums did NOT match', exit status 1. `sha256sum lib/forge-std/src/Vm.sol` gives a1b1c82924aecf0f38b53192fd1e801cccc1e1fd2ecd6b2301e4f4c4ab102a15, not the recorded 9068805b...; the upstream v1.9.7 file hashes to the recorded value, and `tr -d ' \\t\\n\\r'` of both files hash identically.","severity":"low","snippet":"9068805b59ac1d0ea03a8fa1f15ae49c094e0c6c852a2500e0dd112f264b2cb1  lib/forge-std/src/Vm.sol","title":"Documented dependency integrity check fails: seven vendored forge-std files do not match DEPENDENCIES.sha256 (whitespace-only reformatting of upstream v1.9.7)"}],"hash":"ef5743367c60a3f41432d180c2209926599b31d700e8009cbbbea60d47e624bc","nodeId":"7e186293-9b1e-45d7-9bce-b228c953ab75","outcome":"completed","summary":"The review is complete and `.imd-findings.json` is written with one low finding and nine coverage rows.\n\n**Outcome.** SoothToken has no defect in the assigned area. It is a plain OpenZeppelin v5.0.2 ERC-20 with a constructor mint of exactly 10^27 units to msg.sender and nothing else. I traced all three state-changing entry points for access, asymmetry and trust-gap failure modes and each holds.\n\n**What I verified**\n- The five production OpenZeppelin files are byte-identical to the upstream v5.0.2 release, fetched independently.\n- The compiled ABI exposes only approve, transfer, transferFrom and views. There is no receive, fallback, mint, burn, owner, pause, blacklist, hook or proxy path.\n- A scratch Foundry test deployed the token through a CREATE2 factory and probed the surface: ETH sends, empty calldata and unknown selectors revert, the factory cannot pull from a holder without allowance, an attacker's approve never binds a victim, and a failed transferFrom leaves allowance and balance intact. All five probes passed and the scratch directory was removed.\n- The project's own 26 tests, including the stateful invariant suite, pass with the README's seed. `forge fmt --check` is clean.\n- The aderyn large-literal lead is a compile-time constant equal to 1e27 and not a defect.\n\n**One finding, low, outside the assigned area.** The repository's documented integrity check fails. Running `sha256sum --check DEPENDENCIES.sha256` reports seven forge-std files as FAILED, while DEPENDENCIES.md states the sources are unmodified upstream. The recorded hashes match upstream v1.9.7 exactly. The committed copies were re-wrapped by a formatter and are identical once whitespace is stripped. Production code is unaffected since forge-std is test-only, but the provenance claim and verification step in the repository are false as committed.\n\n**Not executed.** The supplied protected launch test needs v4-core and LaunchLiquidity, which are absent from this tree, so the pool seed and swap flows were verified by reading the transfer code rather than by running a swap.","treeHash":null,"usage":{"cachedInputTokens":614812,"inputTokens":258,"model":"claude-fable-5-1","outputTokens":14412,"runtime":"claude","turns":27,"wallClockMs":197909}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"ce319efac2b76da0","findings":[{"citation":"resolved","description":"Outside the assigned math area; recorded because the deliverable's own integrity instruction fails. DEPENDENCIES.md states both vendored libraries are unmodified upstream sources and tells the operator to verify them with `sha256sum --check DEPENDENCIES.sha256`. The hashes recorded in DEPENDENCIES.sha256 are the genuine forge-std v1.9.7 hashes (I re-downloaded the seven files from the v1.9.7 tag and they match the recorded hashes exactly), but the copies in lib/forge-std/src/ differ: Vm.sol, StdAssertions.sol, console.sol, StdJson.sol, StdToml.sol, interfaces/IERC7540.sol and interfaces/IMulticall3.sol. A diff against upstream shows only `forge fmt` line reflows (multi-line signatures joined onto one line, assembly reflowed), no semantic change, consistent with `forge fmt` having been run over lib/ instead of only src/ and test/. All affected files are test-only; the production dependency closure (OpenZeppelin ERC20, IERC20, IERC20Metadata, Context, draft-IERC6093) still matches its recorded hashes, so the token bytecode is unaffected. Fix: either restore the seven files byte-for-byte from the v1.9.7 tag (keeping DEPENDENCIES.sha256), or regenerate DEPENDENCIES.sha256 and amend DEPENDENCIES.md to say the forge-std copies were reformatted. lib/ is outside this reviewer's write scope, so nothing was changed.","line":15,"path":"DEPENDENCIES.md","reproduction":"In the repository root run `sha256sum --check DEPENDENCIES.sha256`. Expected (per DEPENDENCIES.md): every line OK, exit 0. Actual: 7 lines FAILED (lib/forge-std/src/StdAssertions.sol, StdJson.sol, StdToml.sol, Vm.sol, console.sol, interfaces/IERC7540.sol, interfaces/IMulticall3.sol), exit 1. Cross-check: `curl -sSL https://raw.githubusercontent.com/foundry-rs/forge-std/v1.9.7/src/Vm.sol | sha256sum` gives 9068805b59ac1d0ea03a8fa1f15ae49c094e0c6c852a2500e0dd112f264b2cb1, the value recorded in DEPENDENCIES.sha256, while `sha256sum lib/forge-std/src/Vm.sol` gives a1b1c82924aecf0f38b53192fd1e801cccc1e1fd2ecd6b2301e4f4c4ab102a15.","severity":"info","snippet":"Both are unmodified upstream sources. Only OpenZeppelin's ERC-20 dependency","title":"DEPENDENCIES.sha256 no longer matches 7 vendored forge-std files (forge fmt reflow), so the documented integrity check fails"}],"hash":"fc5368b8d9c8222eb0b22c4b91f12687e8a766a747c66751adaf4e3ee8ae4406","nodeId":"e5302be1-b06a-40e0-85ca-e39fdd65e69a","outcome":"completed","summary":"The review is complete. The findings file is valid JSON and the working tree shows no tracked-file changes (the findings file and `test/scratch/` are git-ignored).\n\n**Result: the math, boundary and numerical-gap area holds with no defects.** The token is 17 lines over unmodified OpenZeppelin v5.0.2 ERC20. There is no division, multiplication, scaling, cast or external call in any value-moving path, so the three guides' failure modes have nothing to attach to. I traced each entry point:\n\n- **Supply constant.** `1_000_000_000 * 10 ** 18` is a compile-time constant equal to exactly 1e27, `decimals()` is 18, and the value sits far below the uint128 and int128 limits that Uniswap v4 liquidity and deltas use. The aderyn large-literal lead is style only.\n- **transfer / transferFrom.** The unchecked subtractions in `_update` and `_spendAllowance` are guarded by explicit less-than checks. I tested 1 wei, exact balance, balance plus one, self-transfer, max and max-minus-one allowances, and a zero-value transferFrom from the zero address, which reverts rather than minting.\n- **Invariant.** Sum of balances equals total supply exactly, with no rounding to drift. The project's fuzz and invariant suites pass, as do my six scratch confirmation tests. The 10/80/10 launch split of 1e27 divides with zero remainder.\n- **Boundary surface.** No payable path, no sentinel branches, no bytes decoding. The reachable-opcode scan from the protected floor passes.\n\n**One info-level note outside my area** is recorded in `.imd-findings.json`. `sha256sum --check DEPENDENCIES.sha256` fails on seven forge-std files even though DEPENDENCIES.md calls them unmodified upstream. The recorded hashes match the real v1.9.7 files, which I re-downloaded. The tree's copies differ only by `forge fmt` line reflows, so someone ran the formatter over `lib/`. Test-only files are affected and the production OpenZeppelin closure still matches, so the token bytecode is unaffected. The fix is to restore the seven files byte-for-byte or regenerate the hash file and amend the note.\n\nCoverage: all three listed entry points plus four invariant rows are marked `holds`. No entry point was left unreached.","treeHash":null,"usage":{"cachedInputTokens":798310,"inputTokens":322,"model":"claude-fable-5-1","outputTokens":16137,"runtime":"claude","turns":31,"wallClockMs":257566}}],"verification":[{"checks":[{"durationMs":1126,"exitCode":0,"name":"build","output":"Compiling 27 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.06s\nCompiler run successful!\n","passed":true},{"durationMs":2022,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 25 tests for test/SoothToken.t.sol:SoothTokenTest\n[PASS] testFuzz_RevertOnAllowanceOverdraw(uint256,uint256) (runs: 512, μ: 123105, ~: 123962)\nLogs:\n  Bound result 40000000000000000000\n  Bound result 999999960000000000000015586\n\n[PASS] testFuzz_RevertOnOverdraw(uint256) (runs: 512, μ: 69534, ~: 69260)\nLogs:\n  Bound result 14258967791123979962266901833185372103207761761625883107800\n\n[PASS] testFuzz_TransferConservesSupply(address,uint256) (runs: 512, μ: 92521, ~: 93278)\nLogs:\n  Bound result 642827884699554152864842553\n\n[PASS] testFuzz_TransferFromConservesSupplyAndSpendsAllowance(uint256,uint256) (runs: 512, μ: 164268, ~: 167058)\nLogs:\n  Bound result 0\n  Bound result 0\n\n[PASS] test_ApproveEmitsEventAndCanReplaceAndRevoke() (gas: 190274)\n[PASS] test_ConstructorEmitsOneMintToImmediateDeployer() (gas: 34878)\n[PASS] test_DelegatedSelfTransferStillConsumesAllowance() (gas: 103371)\n[PASS] test_FactoryReceivesEverythingAndLaunchTransfersArriveWhole() (gas: 666910)\n[PASS] test_InfiniteApprovalIsNotDecremented() (gas: 139421)\n[PASS] test_MetadataAndWholeSupply() (gas: 108538)\n[PASS] test_NoPostDeploymentMintBurnOrAdminEntryPoints() (gas: 698711)\n[PASS] test_RevertWhenApproveZeroSpender() (gas: 37765)\n[PASS] test_RevertWhenDeployerTriesToSpendHolderBalanceWithoutApproval() (gas: 95344)\n[PASS] test_RevertWhenHolderUsesTransferFromWithoutSelfApproval() (gas: 36039)\n[PASS] test_RevertWhenTransferExceedsBalance() (gas: 55273)\n[PASS] test_RevertWhenTransferFromExceedsAllowance() (gas: 116006)\n[PASS] test_RevertWhenTransferFromExceedsBalanceRestoresAllowance() (gas: 136783)\n[PASS] test_RevertWhenTransferFromToZeroRestoresAllowance() (gas: 114294)\n[PASS] test_RevertWhenTransferToZeroIncludingZeroAmount() (gas: 72306)\n[PASS] test_SelfTransferPreservesBalance() (gas: 51506)\n[PASS] test_TransferEmitsEventAndMovesExactAmount() (gas: 91540)\n[PASS] test_TransferEntireSupply() (gas: 86048)\n[PASS] test_TransferFromSpendsOnlyApprovedAmount() (gas: 254685)\n[PASS] test_ZeroTransferFromEmptyAccountEmitsEvent() (gas: 73394)\n[PASS] test_ZeroTransferFromWithoutAllowance() (gas: 78823)\nSuite result: ok. 25 passed; 0 failed; 0 skipped; finished in 13.83ms (53.17ms CPU time)\n\nRan 1 test for test/SoothToken.invariant.t.sol:SoothTokenInvariantTest\n[PASS]\nSoothTokenInvariantTest invariants:\n[PASS] invariant_BalancesAndAllowancesMatchModel\n[PASS] invariant_SupplyIsFixedAndFullyAccountedFor\n SoothTokenInvariantTest invariants (runs: 128, calls: 8192, reverts: 0)\n\n╭-------------------+----------------+-------+---------+----------╮\n| Contract          | Selector       | Calls | Reverts | Discards |\n+=================================================================+\n| SoothTokenHandler | approve        | 2015  | 0       | 0        |\n|-------------------+----------------+-------+---------+----------|\n| SoothTokenHandler | rejectOverdraw | 2048  | 0       | 0        |\n|-------------------+----------------+-------+---------+----------|\n| SoothTokenHandler | transfer       | 2088  | 0       | 0        |\n|-------------------+----------------+-------+---------+----------|\n| SoothTokenHandler | transferFrom   | 2041  | 0       | 0        |\n╰-------------------+----------------+-------+---------+----------╯\n\nLogs:\n  Bound result 0\n  Bound result 0\n  Bound result 1000000000000000000000000000\n  Bound result 1422\n  Bound result 5499\n  Bound result 238224233821744827616211298\n  Bound result 100\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 1207\n  Bound result 0\n  Bound result 1036\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 11\n  Bound result 6542\n  Bound result 0\n  Bound result 662813329619881719682925458\n  Bound result 33056034752\n  Bound result 123000000000000000000\n  Bound result 6404\n  Bound result 318135628260117883073341726\n  Bound result 0\n  Bound result 5411\n  Bound result 123000000000000000000\n  Bound result 2\n  Bound result 0\n  Bound result 0\n  Bound result 100000000000000000000\n  Bound result 3\n  Bound result 0\n  Bound result 8\n  Bound result 1000000000000000000000000000\n  Bound result 60000000000000000000\n  Bound result 1000000000000000000\n  Bound result 6354\n  Bound result 50000000000000000000\n  Bound result 4110\n  Bound result 100000000000000000000\n  Bound result 0\n  Bound result 5230\n  Bound result 739915281340414427629026173\n  Bound result 160\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 1.94s (1.94s CPU time)\n\nRan 2 test suites in 1.95s (1.96s CPU time): 26 tests passed, 0 failed, 0 skipped (26 total tests)\n","passed":true},{"durationMs":39,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"SoothToken.approve(address,uint256)\",\"SoothToken.transfer(address,uint256)\",\"SoothToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"DEPENDENCIES.md\":23,\"DEPENDENCIES.sha256\":36,\"README.md\":125,\"foundry.toml\":18,\"remappings.txt\":2,\"src/SoothToken.sol\":17,\"test/SoothToken.invariant.t.sol\":115,\"test/SoothToken.t.sol\":336},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true},{"durationMs":401,"exitCode":0,"name":"slither","output":"slither: no results at low impact or above","passed":true},{"durationMs":214,"exitCode":0,"name":"aderyn","output":"[low] large-numeric-literal at src/SoothToken.sol:12: Large Numeric Literal","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"72862ebc533b4b4d5991a82ae13469536b902f4678e3f07cc4214449f92f6052","verifiedTreeHash":"2c0ac8733282d7945b21751d43b853146686ca09","verifierVersion":"0.1.0+a9b5b731"},{"checks":[{"durationMs":1161,"exitCode":0,"name":"build","output":"Compiling 27 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.08s\nCompiler run successful!\n","passed":true},{"durationMs":1999,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 25 tests for test/SoothToken.t.sol:SoothTokenTest\n[PASS] testFuzz_RevertOnAllowanceOverdraw(uint256,uint256) (runs: 512, μ: 123105, ~: 123962)\nLogs:\n  Bound result 18\n  Bound result 999999999999999999999999989\n\n[PASS] testFuzz_RevertOnOverdraw(uint256) (runs: 512, μ: 69534, ~: 69260)\nLogs:\n  Bound result 14258967791123979962266901833185372103207761761625883107800\n\n[PASS] testFuzz_TransferConservesSupply(address,uint256) (runs: 512, μ: 92521, ~: 93278)\nLogs:\n  Bound result 9\n\n[PASS] testFuzz_TransferFromConservesSupplyAndSpendsAllowance(uint256,uint256) (runs: 512, μ: 164268, ~: 167058)\nLogs:\n  Bound result 0\n  Bound result 0\n\n[PASS] test_ApproveEmitsEventAndCanReplaceAndRevoke() (gas: 190274)\n[PASS] test_ConstructorEmitsOneMintToImmediateDeployer() (gas: 34878)\n[PASS] test_DelegatedSelfTransferStillConsumesAllowance() (gas: 103371)\n[PASS] test_FactoryReceivesEverythingAndLaunchTransfersArriveWhole() (gas: 666910)\n[PASS] test_InfiniteApprovalIsNotDecremented() (gas: 139421)\n[PASS] test_MetadataAndWholeSupply() (gas: 108538)\n[PASS] test_NoPostDeploymentMintBurnOrAdminEntryPoints() (gas: 698711)\n[PASS] test_RevertWhenApproveZeroSpender() (gas: 37765)\n[PASS] test_RevertWhenDeployerTriesToSpendHolderBalanceWithoutApproval() (gas: 95344)\n[PASS] test_RevertWhenHolderUsesTransferFromWithoutSelfApproval() (gas: 36039)\n[PASS] test_RevertWhenTransferExceedsBalance() (gas: 55273)\n[PASS] test_RevertWhenTransferFromExceedsAllowance() (gas: 116006)\n[PASS] test_RevertWhenTransferFromExceedsBalanceRestoresAllowance() (gas: 136783)\n[PASS] test_RevertWhenTransferFromToZeroRestoresAllowance() (gas: 114294)\n[PASS] test_RevertWhenTransferToZeroIncludingZeroAmount() (gas: 72306)\n[PASS] test_SelfTransferPreservesBalance() (gas: 51506)\n[PASS] test_TransferEmitsEventAndMovesExactAmount() (gas: 91540)\n[PASS] test_TransferEntireSupply() (gas: 86048)\n[PASS] test_TransferFromSpendsOnlyApprovedAmount() (gas: 254685)\n[PASS] test_ZeroTransferFromEmptyAccountEmitsEvent() (gas: 73394)\n[PASS] test_ZeroTransferFromWithoutAllowance() (gas: 78823)\nSuite result: ok. 25 passed; 0 failed; 0 skipped; finished in 14.79ms (57.04ms CPU time)\n\nRan 1 test for test/SoothToken.invariant.t.sol:SoothTokenInvariantTest\n[PASS]\nSoothTokenInvariantTest invariants:\n[PASS] invariant_BalancesAndAllowancesMatchModel\n[PASS] invariant_SupplyIsFixedAndFullyAccountedFor\n SoothTokenInvariantTest invariants (runs: 128, calls: 8192, reverts: 0)\n\n╭-------------------+----------------+-------+---------+----------╮\n| Contract          | Selector       | Calls | Reverts | Discards |\n+=================================================================+\n| SoothTokenHandler | approve        | 2015  | 0       | 0        |\n|-------------------+----------------+-------+---------+----------|\n| SoothTokenHandler | rejectOverdraw | 2048  | 0       | 0        |\n|-------------------+----------------+-------+---------+----------|\n| SoothTokenHandler | transfer       | 2088  | 0       | 0        |\n|-------------------+----------------+-------+---------+----------|\n| SoothTokenHandler | transferFrom   | 2041  | 0       | 0        |\n╰-------------------+----------------+-------+---------+----------╯\n\nLogs:\n  Bound result 0\n  Bound result 0\n  Bound result 1000000000000000000000000000\n  Bound result 1422\n  Bound result 5499\n  Bound result 238224233821744827616211298\n  Bound result 100\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 1207\n  Bound result 0\n  Bound result 1036\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 11\n  Bound result 6542\n  Bound result 0\n  Bound result 662813329619881719682925458\n  Bound result 33056034752\n  Bound result 123000000000000000000\n  Bound result 6404\n  Bound result 318135628260117883073341726\n  Bound result 0\n  Bound result 5411\n  Bound result 123000000000000000000\n  Bound result 2\n  Bound result 0\n  Bound result 0\n  Bound result 100000000000000000000\n  Bound result 3\n  Bound result 0\n  Bound result 8\n  Bound result 1000000000000000000000000000\n  Bound result 60000000000000000000\n  Bound result 1000000000000000000\n  Bound result 6354\n  Bound result 50000000000000000000\n  Bound result 4110\n  Bound result 100000000000000000000\n  Bound result 0\n  Bound result 5230\n  Bound result 739915281340414427629026173\n  Bound result 160\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 1.92s (1.92s CPU time)\n\nRan 2 test suites in 1.93s (1.94s CPU time): 26 tests passed, 0 failed, 0 skipped (26 total tests)\n","passed":true},{"durationMs":35,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"SoothToken.approve(address,uint256)\",\"SoothToken.transfer(address,uint256)\",\"SoothToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"DEPENDENCIES.md\":23,\"DEPENDENCIES.sha256\":36,\"README.md\":125,\"foundry.toml\":18,\"launch.json\":24,\"remappings.txt\":2,\"src/SoothToken.sol\":17,\"test/SoothToken.invariant.t.sol\":115,\"test/SoothToken.t.sol\":336},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"8d12ce4d8f6f866e3a81e4a9b23b4df11dfdcd57bd98c2a87567c1cfaf4061fe","verifiedTreeHash":"3d1b967e182603fe3da2a2ccfc495c1e6a006a83","verifierVersion":"0.1.0+a9b5b731"},{"checks":[{"durationMs":1731,"exitCode":0,"name":"build","output":"Compiling 29 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.66s\nCompiler run successful!\n","passed":true},{"durationMs":6536,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 25 tests for test/SoothToken.t.sol:SoothTokenTest\n[PASS] testFuzz_RevertOnAllowanceOverdraw(uint256,uint256) (runs: 512, μ: 123334, ~: 123945)\nLogs:\n  Bound result 40000000000000000000\n  Bound result 999999960000000000000015586\n\n[PASS] testFuzz_RevertOnOverdraw(uint256) (runs: 512, μ: 69530, ~: 69260)\nLogs:\n  Bound result 115792089237316195423570985008687907853269984665639564039457584540033365833227\n\n[PASS] testFuzz_TransferConservesSupply(address,uint256) (runs: 512, μ: 92659, ~: 93284)\nLogs:\n  Bound result 12\n\n[PASS] testFuzz_TransferFromConservesSupplyAndSpendsAllowance(uint256,uint256) (runs: 512, μ: 164688, ~: 167058)\nLogs:\n  Bound result 0\n  Bound result 0\n\n[PASS] test_ApproveEmitsEventAndCanReplaceAndRevoke() (gas: 190274)\n[PASS] test_ConstructorEmitsOneMintToImmediateDeployer() (gas: 34878)\n[PASS] test_DelegatedSelfTransferStillConsumesAllowance() (gas: 103371)\n[PASS] test_FactoryReceivesEverythingAndLaunchTransfersArriveWhole() (gas: 666910)\n[PASS] test_InfiniteApprovalIsNotDecremented() (gas: 139421)\n[PASS] test_MetadataAndWholeSupply() (gas: 108538)\n[PASS] test_NoPostDeploymentMintBurnOrAdminEntryPoints() (gas: 698711)\n[PASS] test_RevertWhenApproveZeroSpender() (gas: 37765)\n[PASS] test_RevertWhenDeployerTriesToSpendHolderBalanceWithoutApproval() (gas: 95344)\n[PASS] test_RevertWhenHolderUsesTransferFromWithoutSelfApproval() (gas: 36039)\n[PASS] test_RevertWhenTransferExceedsBalance() (gas: 55273)\n[PASS] test_RevertWhenTransferFromExceedsAllowance() (gas: 116006)\n[PASS] test_RevertWhenTransferFromExceedsBalanceRestoresAllowance() (gas: 136783)\n[PASS] test_RevertWhenTransferFromToZeroRestoresAllowance() (gas: 114294)\n[PASS] test_RevertWhenTransferToZeroIncludingZeroAmount() (gas: 72306)\n[PASS] test_SelfTransferPreservesBalance() (gas: 51506)\n[PASS] test_TransferEmitsEventAndMovesExactAmount() (gas: 91540)\n[PASS] test_TransferEntireSupply() (gas: 86048)\n[PASS] test_TransferFromSpendsOnlyApprovedAmount() (gas: 254685)\n[PASS] test_ZeroTransferFromEmptyAccountEmitsEvent() (gas: 73394)\n[PASS] test_ZeroTransferFromWithoutAllowance() (gas: 78823)\nSuite result: ok. 25 passed; 0 failed; 0 skipped; finished in 44.79ms (157.96ms CPU time)\n\nRan 18 tests for test/SoothToken.edges.t.sol:SoothTokenEdgesTest\n[PASS] testFuzz_ApproveOverwritesRegardlessOfPrevious(uint256,uint256) (runs: 1000, μ: 103012, ~: 103113)\n[PASS] testFuzz_HolderOverdrawRevertsWithExactError(uint256,uint256) (runs: 1000, μ: 117337, ~: 118097)\nLogs:\n  Bound result 1563\n  Bound result 115792089237316195423570985008687907853269984665640564039457584007913129638626\n\n[PASS] testFuzz_StrangerCannotMoveAHoldersTokens(address,uint256) (runs: 1000, μ: 47879, ~: 47688)\nLogs:\n  Bound result 453353749538434585687094923\n\n[PASS] testFuzz_TransferBetweenHoldersConserves(uint256,uint256,address,address) (runs: 1000, μ: 164085, ~: 169294)\nLogs:\n  Bound result 462605098957554561088179469021961690362594893069\n  Bound result 1252940054864409451521451707920053489375971707375\n  Bound result 637919227865908700642750106\n  Bound result 427075262557982348246314481\n\n[PASS] testFuzz_TransferFromBalanceShortfallKeepsAllowance(uint256,uint256,uint256) (runs: 1000, μ: 177780, ~: 178482)\nLogs:\n  Bound result 342998421239366180219620869\n  Bound result 409761735414813963356905646\n  Bound result 115792089237316195423570985008687907853269984665640154277722169196887578119116\n\n[PASS] test_AllowanceIsPerSpenderAndPerOwner() (gas: 188414)\n[PASS] test_AllowanceOneBelowMaxIsFiniteAndDecrements() (gas: 123944)\n[PASS] test_DeployingAgainstAnExistingAddressFails() (gas: 213757)\n[PASS] test_IndependentLaunchesAreIndependentTokens() (gas: 436055)\n[PASS] test_OneTransactionLaunchDistributesExactly() (gas: 295275)\n[PASS] test_RejectsEtherAndUnknownSelectors() (gas: 94183)\n[PASS] test_RevertWhenEmptyAccountTransfersOneWei() (gas: 38156)\n[PASS] test_RevertWhenTransferFromZeroSender() (gas: 38006)\n[PASS] test_RuntimeHasNoDelegatecallCallcodeOrSelfdestruct() (gas: 2718280)\n[PASS] test_SecondSpendAfterExhaustionReverts() (gas: 146669)\n[PASS] test_TokensSentToTheTokenContractAreStuck() (gas: 100814)\n[PASS] test_TransferAndApproveReturnAbiEncodedTrue() (gas: 171951)\n[PASS] test_TruncatedCalldataReverts() (gas: 38565)\nSuite result: ok. 18 passed; 0 failed; 0 skipped; finished in 44.85ms (229.23ms CPU time)\n\nRan 1 test for test/SoothToken.invariant.t.sol:SoothTokenInvariantTest\n[PASS]\nSoothTokenInvariantTest invariants:\n[PASS] invariant_BalancesAndAllowancesMatchModel\n[PASS] invariant_SupplyIsFixedAndFullyAccountedFor\n SoothTokenInvariantTest invariants (runs: 128, calls: 8192, reverts: 0)\n\n╭-------------------+----------------+-------+---------+----------╮\n| Contract          | Selector       | Calls | Reverts | Discards |\n+=================================================================+\n| SoothTokenHandler | approve        | 2015  | 0       | 0        |\n|-------------------+----------------+-------+---------+----------|\n| SoothTokenHandler | rejectOverdraw | 2048  | 0       | 0        |\n|-------------------+----------------+-------+---------+----------|\n| SoothTokenHandler | transfer       | 2088  | 0       | 0        |\n|-------------------+----------------+-------+---------+----------|\n| SoothTokenHandler | transferFrom   | 2041  | 0       | 0        |\n╰-------------------+----------------+-------+---------+----------╯\n\nLogs:\n  Bound result 0\n  Bound result 0\n  Bound result 127\n  Bound result 1422\n  Bound result 5527\n  Bound result 238224233821744827616211298\n  Bound result 20000000000000000000\n  Bound result 0\n  Bound result 0\n  Bound result 95\n  Bound result 5707\n  Bound result 900\n  Bound result 1113\n  Bound result 376536355937703036893824486\n  Bound result 0\n  Bound result 0\n  Bound result 7\n  Bound result 0\n  Bound result 9\n  Bound result 3207\n  Bound result 0\n  Bound result 662813329619881719682925458\n  Bound result 33056034752\n  Bound result 32\n  Bound result 8\n  Bound result 110365531412432234359513279\n  Bound result 0\n  Bound result 5463\n  Bound result 253\n  Bound result 244\n  Bound result 71\n  Bound result 0\n  Bound result 5\n  Bound result 86\n  Bound result 0\n  Bound result 253\n  Bound result 127\n  Bound result 4\n  Bound result 10\n  Bound result 6470\n  Bound result 11775766178255139327756983\n  Bound result 24\n  Bound result 5\n  Bound result 1322366471609556362864897\n  Bound result 0\n  Bound result 739915281340414427629026173\n  Bound result 0\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 1.92s (1.92s CPU time)\n\nRan 1 test for test/SoothToken.openInvariant.t.sol:SoothTokenOpenInvariantTest\n[PASS]\nSoothTokenOpenInvariantTest invariants:\n[PASS] invariant_MetadataNeverChanges\n[PASS] invariant_StateMatchesModel\n[PASS] invariant_SupplyFixedAndHeldOnlyByTrackedHolders\n SoothTokenOpenInvariantTest invariants (runs: 256, calls: 16384, reverts: 0)\n\n╭------------------+-------------------------+-------+---------+----------╮\n| Contract         | Selector                | Calls | Reverts | Discards |\n+=========================================================================+\n| OpenSoothHandler | approve                 | 2432  | 0       | 0        |\n|------------------+-------------------------+-------+---------+----------|\n| OpenSoothHandler | rejectAllowanceOverdraw | 2312  | 0       | 0        |\n|------------------+-------------------------+-------+---------+----------|\n| OpenSoothHandler | rejectZeroReceiver      | 2343  | 0       | 0        |\n|------------------+-------------------------+-------+---------+----------|\n| OpenSoothHandler | rejectZeroSender        | 2226  | 0       | 0        |\n|------------------+-------------------------+-------+---------+----------|\n| OpenSoothHandler | rejectZeroSpender       | 2320  | 0       | 0        |\n|------------------+-------------------------+-------+---------+----------|\n| OpenSoothHandler | transfer                | 2345  | 0       | 0        |\n|------------------+-------------------------+-------+---------+----------|\n| OpenSoothHandler | transferFrom            | 2406  | 0       | 0        |\n╰------------------+-------------------------+-------+---------+----------╯\n\nLogs:\n  Bound result 84320605824438\n  Bound result 6850\n  Bound result 3463\n  Bound result 2856\n  Bound result 1000000000000000000\n  Bound result 0\n  Bound result 0\n  Bound result 999999999999999951\n  Bound result 7397\n  Bound result 95\n  Bound result 6\n  Bound result 0\n  Bound result 2409\n  Bound result 11678483\n  Bound result 66517031808093789355487593403856755280728700767025347038\n  Bound result 999999998999999999999999998\n  Bound result 0\n  Bound result 0\n  Bound result 41372389172398\n  Bound result 2\n  Bound result 40000000000000000000\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 6347\n  Bound result 0\n  Bound result 0\n  Bound result 4599221054035932827461656168464421130901940521943233224\n  Bound result 0\n  Bound result 0\n  Bound result 32\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 1\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 6.46s (6.45s CPU time)\n\nRan 4 test suites in 6.46s (8.46s CPU time): 45 tests passed, 0 failed, 0 skipped (45 total tests)\n","passed":true},{"durationMs":35,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"SoothToken.approve(address,uint256)\",\"SoothToken.transfer(address,uint256)\",\"SoothToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"DEPENDENCIES.md\":23,\"DEPENDENCIES.sha256\":36,\"README.md\":125,\"foundry.toml\":18,\"remappings.txt\":2,\"src/SoothToken.sol\":17,\"test/SoothToken.edges.t.sol\":273,\"test/SoothToken.invariant.t.sol\":115,\"test/SoothToken.openInvariant.t.sol\":188,\"test/SoothToken.t.sol\":336},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"b8d80991b870ea9cbf1b15faa089f3371fbd8ebce9837496edd816d0ae335738","verifiedTreeHash":"3839bac1388585a731ba014c3350e9c9d6133e82","verifierVersion":"0.1.0+a9b5b731"}]}