{"assessments":[],"deployments":[],"fuzz":[],"identity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"interpretation":"Records acceptance and evidence. Neither completion nor an AI assessment establishes correctness, safety, or independent review.","jobId":"d5dbbaf4-017d-4bb9-be5d-06570fa00032","kind":"shape:chain","nodes":[{"acceptedSubmissionHash":"42d44ab7af48d356439bca130762fd0c2902e6535afe661d09f6acf3a3b747eb","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_economics","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"1dba86a9538937865676e4e89cb617dc684ea8aa76c7c68b7c64bf565c95afb5","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_flow","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"5aad6281dcad010261f38c21628d39fb57f91987e1e340adb71598066f635676","dependsOn":["build_contract_project","write_foundry_tests","manifest","audit_math","audit_permissions","audit_economics","audit_flow"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"af3aa01159bbf354f621cafa5c0006f6169e0938a8b015be508b7377dbf165bc","skillId":"audit-judge","tools":[]},"key":"audit_judge","kind":"code","role":"review","skillHash":"af3aa01159bbf354f621cafa5c0006f6169e0938a8b015be508b7377dbf165bc","skillId":"audit-judge","state":"accepted"},{"acceptedSubmissionHash":"522b2452da7842fbfddf5039477cabc6f04eea89c3fcd30620114ad0825cd4c4","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_math","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"2baf38938d2362ff15f269152f4a45652daae125c7a1a6c106cbaf6c9aa4f4e3","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_permissions","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"b7ee0811a0cb51d783a051e0ba09dbe2aeca1cd070794e31cdbacd08c0eac548","dependsOn":[],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"d59561da3b378461b7c749f6bd5084477d44993aa94972ddea90f542535751df","skillId":"build-contract-project","tools":[]},"key":"build_contract_project","kind":"code","role":"implement","skillHash":"d59561da3b378461b7c749f6bd5084477d44993aa94972ddea90f542535751df","skillId":"build-contract-project","state":"accepted"},{"acceptedSubmissionHash":"ebf60dab212b3f8eb1080a9ffbd377c4e43f1a1e703729d9189ee06da2ad6ed2","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"tools":[]},"key":"manifest","kind":"code","role":"integrate","skillHash":null,"skillId":null,"state":"accepted"},{"acceptedSubmissionHash":"e3805a387e232648cc7011f2dcb6ddd6abd212f0d2593a63553069e1a2542798","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"4c76766b00591dfe982fe85d3de589fdb2f810e5137c301155d1c5e36a1d3b23","skillId":"write-foundry-tests","tools":[]},"key":"write_foundry_tests","kind":"code","role":"tests","skillHash":"4c76766b00591dfe982fe85d3de589fdb2f810e5137c301155d1c5e36a1d3b23","skillId":"write-foundry-tests","state":"accepted"}],"objective":"A custom token: Yolo (YOLO).\nToken name: Yolo\nToken symbol: YOLO\nToken supply: 1,000,000,000 with 18 decimals, all minted once to the deployer in the constructor.","parentJobId":null,"planHash":"b5c422c26150c7af0399a347f42c87eb639e0ea70ad4fd5d92d74ef19303b58e","previousHash":"0000000000000000000000000000000000000000000000000000000000000000","projectId":"d5dbbaf4-017d-4bb9-be5d-06570fa00032","publication":{"commit":null,"deliveredAt":null,"repoUrl":"https://github.com/identity-md-launches/launch-2293-yolo"},"receiptIdentity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"registry":"0xb6d0a187b050fa5bb0b87033a203f37becf4a775","research":[],"schema":"identitymd-work-v1","signals":[{"agentId":"51142","feedbackHash":"019a0983ae592f0de6839d4a16e111073ac325089c5d115447ba1deb59e79173","nodeKey":"audit_economics","submissionHash":"42d44ab7af48d356439bca130762fd0c2902e6535afe661d09f6acf3a3b747eb","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"53934","feedbackHash":"2b4fea3c72b4f9bb29702fb672eab70134a32ab66e4fbe519a8d8729ebf67f89","nodeKey":"audit_flow","submissionHash":"1dba86a9538937865676e4e89cb617dc684ea8aa76c7c68b7c64bf565c95afb5","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51465","feedbackHash":"1f9cb7b5d3dc104ed7edf7472f9d86ee7e20055095db436c5dbbb2e97354ba94","nodeKey":"audit_judge","submissionHash":"5aad6281dcad010261f38c21628d39fb57f91987e1e340adb71598066f635676","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51423","feedbackHash":"2bed118b8cf3ed7970cefd5a7450bdfb207e589d9189043fc3a74196f58427e1","nodeKey":"audit_math","submissionHash":"522b2452da7842fbfddf5039477cabc6f04eea89c3fcd30620114ad0825cd4c4","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51367","feedbackHash":"08a360b09e4cc06e08aeb1ecf3a0807b57650cc0cf51090f7cdde9ed9f59824d","nodeKey":"audit_permissions","submissionHash":"2baf38938d2362ff15f269152f4a45652daae125c7a1a6c106cbaf6c9aa4f4e3","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51091","feedbackHash":"d7bf1246048e379c1911d88103012f6c4c4c661f02c755e88ba0ced37e4246ba","nodeKey":"build_contract_project","submissionHash":"b7ee0811a0cb51d783a051e0ba09dbe2aeca1cd070794e31cdbacd08c0eac548","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"51093","feedbackHash":"01af81fb6da1ebae7a696ce2cdffef306bec6c4a7ba8efb748c089c79234f295","nodeKey":"manifest","submissionHash":"ebf60dab212b3f8eb1080a9ffbd377c4e43f1a1e703729d9189ee06da2ad6ed2","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"51094","feedbackHash":"fe489a0cc4f96bd40e2f8c2c87e99e18b622e6ad9e4878b18bfa2b942726b297","nodeKey":"write_foundry_tests","submissionHash":"e3805a387e232648cc7011f2dcb6ddd6abd212f0d2593a63553069e1a2542798","tag1":"verification:checks","tag2":"acceptance-v2","value":1}],"site":null,"snapshotHash":"5483fa6be0919faa2782b7693c046fa22cec145472ebe81134404a93406ee9be","state":"completed","submissions":[{"artifacts":[],"attempt":1,"bundleHash":null,"device":"5dd3af20ad7ac0c2","findings":[{"citation":"resolved","description":"Periphery/provenance check. dependencies.lock.json records SHA-256 digests for every vendored file and the README states that all 36 matched and that dependencies are unmodified upstream sources (README.md:135 'Dependencies are unmodified source files, not submodules.'). The six OpenZeppelin v5.0.2 production files and LICENSE do match both the lock file and upstream commit dbb6104 byte for byte (verified by fetching upstream and comparing digests). However seven tracked files under lib/forge-std/src do not match the lock: StdAssertions.sol, StdJson.sol, StdToml.sol, Vm.sol, console.sol, interfaces/IERC7540.sol, interfaces/IMulticall3.sol. The lock's digests are the true upstream v1.9.7 (commit 77041d2) digests; the tree's copies have been reformatted (forge fmt style line wrapping) and so differ. A diff against upstream shows only whitespace/line-break changes, no semantic change, and forge-std is a test-only dependency, so the deployed token is unaffected. Impact is limited to a false provenance statement in the deliverable: anyone who runs the documented digest check will get mismatches and cannot distinguish this from a tampered test library without diffing. Minimal fix: either restore the seven files to their upstream v1.9.7 bytes (so the lock holds) or regenerate dependencies.lock.json digests from the tree and correct the README sentences at lines 111-112 and 135 to say the forge-std files were reformatted. Do not change foundry.toml or lib/ as part of a review; this is for the author.","line":111,"path":"README.md","reproduction":"State: the repository as committed (HEAD 45aa2e0). Input: for each entry in dependencies.lock.json compute sha256 of path/file and compare to the recorded digest. Expected per README.md:111-112: all 36 match. Actual: 29 match, 7 mismatch. Example: dependencies.lock.json:39 records src/Vm.sol = 9068805b59ac1d0ea03a8fa1f15ae49c094e0c6c852a2500e0dd112f264b2cb1 (which equals upstream forge-std v1.9.7 src/Vm.sol); sha256sum lib/forge-std/src/Vm.sol in the tree = a1b1c82924aecf0f38b53192fd1e801cccc1e1fd2ecd6b2301e4f4c4ab102a15. `diff <(curl -sL https://raw.githubusercontent.com/foundry-rs/forge-std/77041d2ce690e692d6e03cc812b57d1ddaa4d505/src/Vm.sol) lib/forge-std/src/Vm.sol` shows only line-wrapping differences (e.g. getDeployment, parseJsonAddressArray signatures joined onto one line). Command to reproduce: python3 -I -c \"import json,hashlib;[print(p,f,hashlib.sha256(open(p+'/'+f,'rb').read()).hexdigest()==h) for d in json.load(open('dependencies.lock.json')) for p in [d['path']] for f,h in d['files'].items()]\" | grep False","severity":"info","snippet":"runtime is 1,752 bytes, with no library links. All 36 vendored files matched\ntheir recorded SHA-256 digests.","title":"README and dependencies.lock.json claim every vendored file matches its recorded digest, but 7 tracked forge-std files do not (whitespace-only reformatting)"}],"hash":"1dba86a9538937865676e4e89cb617dc684ea8aa76c7c68b7c64bf565c95afb5","nodeId":"107cf35b-9194-415e-bc19-6d6f59f64160","outcome":"completed","summary":"The findings file is valid, the snippet matches the README exactly, and no tracked file was changed. The review is complete.\n\n**Result: no defects in the token's execution flow.** The Yolo contract is a 16-line, unmodified OpenZeppelin v5.0.2 ERC20 with a single constructor mint of 10^27 base units to the deployer. All three entry points hold. The only finding is informational, about documentation provenance.\n\n**What I checked, from the Execution Trace, Periphery and First Principles guides:**\n- **Execution Trace.** Traced approve, transfer and transferFrom through the vendored `_update`, `_spendAllowance` and `_approve`. No external calls, no encoding, no partial state. Allowance spending rolls back on any later revert. Max allowance is never decremented. Zero-address sender, receiver and spender all revert. Confirmed with a scratch test under test/scratch/ that also walks the launch flows: factory to distributor, claim, push to a manager-like counterparty and take back.\n- **Periphery.** Fetched the six OpenZeppelin files and license at upstream commit dbb6104 and compared digests. All match the tree and the lock file byte for byte.\n- **First Principles.** The constructor's only assumption is that msg.sender is the intended recipient, which the factory-driven CREATE2 launch satisfies. The supply constant evaluates to exactly 10^27, so the aderyn literal lead is not a defect. No owner, mint, burn, pause, freeze, fallback or receive paths exist.\n- **Existing suite.** All 36 tests and both stateful invariants pass with the README's seed.\n\n**The one finding (info).** Seven tracked forge-std files differ from the digests in dependencies.lock.json, which the README says all matched. The lock's digests are the true upstream v1.9.7 values. The tree's copies were reformatted with whitespace-only changes, so nothing on-chain is affected. The author should either restore the upstream bytes or regenerate the lock and correct the README.\n\n**Not reached.** The protected seed-and-swap test against a real Uniswap v4 PoolManager could not be run here because the floor's harness contracts and v4-core are not in this tree. That row is marked unreached in the coverage record, with the reasoning that a hook-free ERC20 satisfies v4's sync, settle and take pattern.","treeHash":null,"usage":{"cachedInputTokens":924751,"inputTokens":386,"model":"claude-fable-5-1","outputTokens":16648,"runtime":"claude","turns":23,"wallClockMs":269410}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"ddfb1efa72fe9a94","findings":[],"hash":"2baf38938d2362ff15f269152f4a45652daae125c7a1a6c106cbaf6c9aa4f4e3","nodeId":"c8d844cf-8770-461b-921e-93e1ac875396","outcome":"completed","summary":"The findings file is in place and the harness excludes it from git on purpose. The scratch directory is removed and the working tree is otherwise untouched.\n\n**Result: no defects found in the assigned area.** The findings file at the repository root holds an empty findings list and nine coverage rows, all marked `holds`.\n\n**What the token is.** A single contract that inherits the vendored OpenZeppelin ERC20 and mints the whole supply to the deployer in its constructor. It has no owner, modifier, setter, initializer, proxy, receive or fallback. The compiled ABI exposes exactly three state-changing functions: approve, transfer and transferFrom.\n\n**What I checked, per guide.**\n- Access Control: mapped every storage writer. Balances are written only through transfer and transferFrom, which authorize by caller or by allowance. Allowances are written only by the caller's own row. The constructor hands out no role. Selectors for owner, mint, burn, pause, initialize and permit all revert when called by the deployer. Storage beyond the five ERC-20 slots is empty.\n- Asymmetry: the only paired surface is approve against the allowance spend inside transferFrom. A spend reduces exactly the approved row by exactly the amount and never crosses rows. The branch where the sender is the zero address reverts before any balance logic, even for a zero amount. The absence of an Approval event on spend is documented OpenZeppelin v5 behaviour, not a defect.\n- Trust Gap: with no privileged actor and no mutable formula or destination, no seam exists between authorization and value flow.\n\n**Verification performed.**\n- The vendored OpenZeppelin files were fetched from upstream at the pinned commit and diffed. They are byte-identical.\n- The project's full suite passed, 36 tests and both stateful invariants.\n- A scratch suite of seven counterexample probes passed. Each tried an unauthorized spend, a cross-row approval, a hidden role slot or an unexpected selector, and each was rejected.\n\n**Leads not reported.** The ERC-20 approve front-running race is inherent to the standard and documented in the README. The static-analysis note about a large numeric literal is style only.\n\n**Launch fit, outside my area but checked.** Supply is exactly 10^27 base units, minted to msg.sender. Decimals are 18. The constructor takes no arguments, so the manifest's constructorArgs should be an empty list. Transfers move whole amounts, so the distributor, seed and swap flows arrive intact.","treeHash":null,"usage":{"cachedInputTokens":1021535,"inputTokens":450,"model":"claude-fable-5-1","outputTokens":11273,"runtime":"claude","turns":18,"wallClockMs":202377}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"e57a8e639cccfbab","findings":[],"hash":"42d44ab7af48d356439bca130762fd0c2902e6535afe661d09f6acf3a3b747eb","nodeId":"b7dc3a53-51ef-4b74-b4f3-871fd6ff8073","outcome":"completed","summary":"The review is complete. The findings file is in place with an empty findings list and nine coverage rows, and the working tree holds no stray files.\n\n**Result: no defects found in the Economic Security, Invariant or Flow Gap areas.**\n\n**What the token is.** `src/Yolo.sol` is a 16-line contract that inherits OpenZeppelin ERC-20 v5.0.2 with no overrides and mints one billion tokens with 18 decimals to the deployer in the constructor. The vendored ERC20.sol is byte-identical to upstream v5.0.2 (SHA-256 matched against the GitHub tag and the lock file).\n\n**What I checked against each guide.**\n- Economic Security: no external dependencies, oracles, callbacks or sentinel-address paths exist. Token misbehaviour items (fee, rebase, pause, blacklist) do not apply because no transfer path is overridden. Every ERC-20 guarantee the README claims holds at the boundary values.\n- Invariant: the sum of balances always equals total supply at exactly 1e27. Only the constructor reaches the mint helper, the burn helper is unreachable, and the existing stateful invariant suite over 8,192 handler calls matched an independent ledger. The manifest supply, the constant and the test constant all agree.\n- Flow Gap: I traced the launch seams with a scratch test. The 10/50/40 split in basis points sums to the whole supply with zero dust. A pool-manager-style allowance pull leaves no residual allowance, a trader round trip returns the pool's balance exactly, and the supply is unchanged throughout.\n\n**Leads from static analysis.** The aderyn large-numeric-literal note is style only. The literal evaluates to exactly 1e27 and is asserted against the manifest supply by the test suite.\n\n**Coverage.** All three entry points are marked as holding, plus rows for the conservation, single-mint, launch-flow and no-external-call invariants. One informational row records that tokens sent to the token's own address are stranded, which is standard ERC-20 behaviour and documented in the README.\n\n**Verification runs.** The full suite passed (36 tests, both invariants), and the scratch flow test passed before I deleted it. The findings JSON parses cleanly and `git status` shows only ignored paths.","treeHash":null,"usage":{"cachedInputTokens":651408,"inputTokens":290,"model":"claude-fable-5-1","outputTokens":10533,"runtime":"claude","turns":27,"wallClockMs":174813}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"56e50117311155be","findings":[{"citation":"resolved","description":"Outside the assigned math area, reported because it is concrete and verifiable. dependencies.lock.json records a SHA-256 for each of the 36 vendored files and README.md states that all 36 matched. Recomputing the digests over the tree shows 7 forge-std files do not match their recorded digest: lib/forge-std/src/StdAssertions.sol, StdJson.sol, StdToml.sol, Vm.sol, console.sol, interfaces/IERC7540.sol and interfaces/IMulticall3.sol. Comparing each against upstream forge-std v1.9.7 (commit 77041d2c, the one the lock names) shows the differences are whitespace-only: the vendored copies have long signatures and the console staticcall on single lines where upstream wraps them, consistent with a formatter having been run over lib/. All 6 OpenZeppelin v5.0.2 files match both the lock and upstream byte for byte, so the production ERC20 code and the token's bytecode are unaffected. Impact is limited to provenance: the lock file does not attest the test tree it ships with, and the README's verification claim is false, so a reviewer who relies on either would accept an unverified tree. Fix: either restore the 7 files to the upstream bytes or regenerate their digests in dependencies.lock.json, and make the README claim true.","line":111,"path":"README.md","reproduction":"From the repository root run: python3 -I -c \"import json,hashlib; d=json.load(open('dependencies.lock.json')); print([e['path']+'/'+r for e in d for r,h in e['files'].items() if hashlib.sha256(open(e['path']+'/'+r,'rb').read()).hexdigest()!=h])\". Expected (per README line 111 and the lock file): an empty list. Actual: ['lib/forge-std/src/StdAssertions.sol', 'lib/forge-std/src/StdJson.sol', 'lib/forge-std/src/StdToml.sol', 'lib/forge-std/src/Vm.sol', 'lib/forge-std/src/console.sol', 'lib/forge-std/src/interfaces/IERC7540.sol', 'lib/forge-std/src/interfaces/IMulticall3.sol']. Stripping all whitespace from each of the 7 files and from the upstream v1.9.7 copy yields identical hashes, so the content difference is formatting only.","severity":"low","snippet":"runtime is 1,752 bytes, with no library links. All 36 vendored files matched\ntheir recorded SHA-256 digests.","title":"dependencies.lock.json digests and README claim do not match 7 vendored forge-std files"}],"hash":"522b2452da7842fbfddf5039477cabc6f04eea89c3fcd30620114ad0825cd4c4","nodeId":"67843c50-2082-4002-852a-81366d967a6e","outcome":"completed","summary":"The review is complete and `.imd-findings.json` holds the result. The token's math is clean in the assigned area, and one low-severity provenance defect outside it is reported.\n\n**What was checked**\n\n- `src/Yolo.sol` is a plain OpenZeppelin v5.0.2 ERC20 with a single constructor mint of 10^27 base units to the deployer. The five vendored OpenZeppelin files are byte-identical to upstream v5.0.2, so the transfer and allowance arithmetic is the audited upstream code.\n- Math Precision guide: no divisions, fixed-point scales, downcasts or fee formulas exist. The supply constant is an exact compile-time value of 10^27, which closes the aderyn large-literal lead. Both unchecked blocks in the transfer path are guarded by the preceding balance and allowance comparisons, and the balance sum is bounded by 10^27, so no overflow is reachable.\n- Boundary guide: no external calls, no payable, receive or fallback, no bytes decoding. The only sentinel branches are the zero-address checks, traced on both sides. Max-uint transfer, supply plus one, exact supply, full self-transfer, one-wei round trip, allowance at max minus one and at max were all exercised in a scratch Foundry suite of 12 tests, all passing.\n- Numerical Gap guide: any basis-point split of the supply is exact because 10^27 is divisible by 10^4, so the swarm, pool and remainder shares leave no dust. The project's own stateful invariants and a scratch fuzz confirm balances always sum to the supply.\n- All 36 project tests pass under the README's seed.\n\n**Finding reported (low)**\n\nThe lock file records SHA-256 digests for 36 vendored files and the README states all 36 matched. Seven forge-std files do not match their recorded digests. Comparison against upstream forge-std v1.9.7 shows whitespace-only reformatting, so test tooling and production bytecode are unaffected, but the lock does not attest the shipped tree and the README claim is false. The reproduction is a one-line digest check in the finding.\n\n**Coverage**\n\nAll three entry points, `approve`, `transfer` and `transferFrom`, are marked `holds`, with five additional invariant rows covering the supply constant, constructor mint, exact splits, supply conservation and the boundary inventory. The scratch directory was removed, and no repository file was changed.","treeHash":null,"usage":{"cachedInputTokens":778233,"inputTokens":418,"model":"claude-fable-5-1","outputTokens":17634,"runtime":"claude","turns":25,"wallClockMs":248882}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"f0c4ae5b8ada215c","findings":[{"citation":"resolved","description":"Merged from the audit_math and audit_flow reports, which share one root cause. dependencies.lock.json records a SHA-256 digest for each of the 36 vendored files, README.md:111-112 states that all 36 matched, and README.md:135 states 'Dependencies are unmodified source files, not submodules.' Reproduced against the tree at HEAD 256ee6e: 29 files match, 7 do not, all under lib/forge-std/src: StdAssertions.sol, StdJson.sol, StdToml.sol, Vm.sol, console.sol, interfaces/IERC7540.sol, interfaces/IMulticall3.sol. Fetching the same files from upstream forge-std commit 77041d2ce690e692d6e03cc812b57d1ddaa4d505 (v1.9.7, the commit the lock names) shows the lock digests are the true upstream digests and the tree copies differ from upstream only in whitespace (identical once all whitespace is stripped), consistent with a formatter having been run over lib/. All six OpenZeppelin v5.0.2 files (ERC20.sol, IERC20.sol, IERC20Metadata.sol, Context.sol, draft-IERC6093.sol, LICENSE) are byte-identical to upstream commit dbb6104 and match the lock, so the production token bytecode is unaffected; forge-std is test-only. Impact is limited to provenance: the lock file does not attest the test tree it ships with, and the README's verification claim is false, so anyone running the documented check gets mismatches they cannot distinguish from a tampered test library without diffing against upstream. Minimal fix for the author: either restore the seven files to their upstream v1.9.7 bytes so the lock holds, or regenerate those seven digests in dependencies.lock.json and correct README.md lines 111-112 and 135 to say the forge-std files were reformatted. This is a documentation/lock change for the author; a review writes nothing under lib/.","line":111,"path":"README.md","reproduction":"State: the repository as committed (HEAD 256ee6e), no changes. Input: from the repository root run\n\npython3 -I -c \"import json,hashlib; d=json.load(open('dependencies.lock.json')); print([e['path']+'/'+r for e in d for r,h in e['files'].items() if hashlib.sha256(open(e['path']+'/'+r,'rb').read()).hexdigest()!=h])\"\n\nExpected per README.md:111-112 ('All 36 vendored files matched their recorded SHA-256 digests'): an empty list []. Actual: ['lib/forge-std/src/StdAssertions.sol', 'lib/forge-std/src/StdJson.sol', 'lib/forge-std/src/StdToml.sol', 'lib/forge-std/src/Vm.sol', 'lib/forge-std/src/console.sol', 'lib/forge-std/src/interfaces/IERC7540.sol', 'lib/forge-std/src/interfaces/IMulticall3.sol']. Concrete example: dependencies.lock.json:39 records src/Vm.sol = 9068805b59ac1d0ea03a8fa1f15ae49c094e0c6c852a2500e0dd112f264b2cb1 (equal to sha256 of https://raw.githubusercontent.com/foundry-rs/forge-std/77041d2ce690e692d6e03cc812b57d1ddaa4d505/src/Vm.sol); `sha256sum lib/forge-std/src/Vm.sol` in the tree gives a1b1c82924aecf0f38b53192fd1e801cccc1e1fd2ecd6b2301e4f4c4ab102a15. For each of the 7 files, b''.join(upstream.split()) == b''.join(tree.split()) is True while upstream == tree is False, so the difference is whitespace only.","severity":"low","snippet":"runtime is 1,752 bytes, with no library links. All 36 vendored files matched","title":"README and dependencies.lock.json claim every vendored file matches its recorded digest, but 7 forge-std files in the tree do not (whitespace-only reformatting)"}],"hash":"5aad6281dcad010261f38c21628d39fb57f91987e1e340adb71598066f635676","nodeId":"42c4a2a4-770a-47fb-ab71-7936f8dd5eab","outcome":"completed","summary":"The review is complete and `.imd-findings.json` is written at the repository root. The working tree is otherwise untouched.\n\n**Outcome:** one low finding kept, nothing critical or high, all three entry points hold.\n\n**What I verified**\n\n- **Specialist findings merged.** The math and flow specialists reported the same root cause, so they are one finding. Seven vendored forge-std files do not match the digests in dependencies.lock.json, contradicting the README's claim on line 111 that all 36 matched. I reproduced the mismatch with the documented digest check, fetched the upstream v1.9.7 files at the commit the lock names, and confirmed the lock digests are the true upstream ones while the tree copies differ only in whitespace. The six OpenZeppelin production files are byte-identical to upstream, so the token's bytecode is unaffected. Severity stays low because the impact is a false provenance statement, not a code defect.\n- **My own pass over the token.** The contract is an unmodified OpenZeppelin v5.0.2 ERC20 with an argument-free constructor that mints the full supply once to msg.sender. There are no mint, burn, pause, owner, or external-call paths, and no delegatecall or selfdestruct. The constant equals the manifest's totalSupply, name, symbol and decimals agree with launch.json, and the manifest uses only schema keys with correct types and lowercase addresses.\n- **Checks run.** The build succeeds and all 54 tests pass. The formatting check passes. The static-analysis lead about the large numeric literal is the supply constant and is correct.\n\n**Coverage record.** Seven rows: approve, transfer and transferFrom each hold with the traced checks and failure paths, three invariant rows hold, and the dependency-provenance row points at finding 1.\n\nOne note on my process: a mistyped path on one write created a stray file outside the repository. I deleted it and its empty directories before writing the real findings file.","treeHash":null,"usage":{"cachedInputTokens":555436,"inputTokens":354,"model":"claude-fable-5-1","outputTokens":10385,"runtime":"claude","turns":12,"wallClockMs":168253}},{"artifacts":[],"attempt":1,"bundleHash":"5831db8672ba69e58d5d6c04461e932ad2e4702d25e28e3e8473bdd509a931f3","device":"9704b5b521bdf559","findings":[],"hash":"b7ee0811a0cb51d783a051e0ba09dbe2aeca1cd070794e31cdbacd08c0eac548","nodeId":"22386975-17b5-4dc7-868e-e8afa440ea5e","outcome":"completed","summary":"Implemented Yolo (YOLO) with 18 decimals and 1,000,000,000 tokens minted once to the deployer.\n\n- `forge build`, `forge test`, and `forge fmt --check` pass.\n- Specified fuzz seed used; 35 unit/fuzz tests and both stateful invariants pass.\n- Dependencies vendored for offline builds.\n- Deployment assumptions and operational responsibilities documented in `README.md`.\n\nFull factory/Uniswap integration remains for the external launch verifier.","treeHash":"1e3b62f0f9cb9da6497c3331ef9500d2c02e16f7","usage":{"cachedInputTokens":643968,"inputTokens":61550,"model":"gpt-6-astra","outputTokens":14726,"runtime":"codex","turns":5,"wallClockMs":421943}},{"artifacts":[],"attempt":1,"bundleHash":"02801f13ac5c02e6c0dd07ac260c79908dde968d8022854accd7ecb3a5ad0528","device":"ea30e435c4dd5aff","findings":[],"hash":"e3805a387e232648cc7011f2dcb6ddd6abd212f0d2593a63553069e1a2542798","nodeId":"6bb8077d-e036-48af-aefd-65c66cd09b51","outcome":"completed","summary":"Added 18 boundary and fuzz tests and strengthened three stateful invariants.\n\n`forge build` and `forge test` pass with the required seed: 54 tests and 32,768 invariant calls.\n\nOnly `test/` files changed. No implementation defects found.","treeHash":"9bf7870448dd6fb6b76fb0a9b6004fd12beec318","usage":{"cachedInputTokens":823552,"inputTokens":81327,"model":"gpt-6-astra","outputTokens":12186,"runtime":"codex","turns":5,"wallClockMs":355234}},{"artifacts":[],"attempt":1,"bundleHash":"00d570a055eb537a662f85be49c60abdd4e29acbcb4cbd1dc026fbaeccb7790f","device":"575a41a8798743c2","findings":[],"hash":"ebf60dab212b3f8eb1080a9ffbd377c4e43f1a1e703729d9189ee06da2ad6ed2","nodeId":"4c250728-cb2d-40b6-b03a-b535d8eb9def","outcome":"completed","summary":"Created `launch.json` matching the accepted Yolo constructor, exact supply, and required pool and economics values.\n\n`forge build` succeeded. `forge test` passed all 36 tests with the supplied fuzz seed. Only `launch.json` changed outside permitted scratch artifacts.","treeHash":"d33eb9ef835d950456d916cc233a42b25d70ee4f","usage":{"cachedInputTokens":252032,"inputTokens":40706,"model":"gpt-6-astra","outputTokens":2253,"runtime":"codex","turns":3,"wallClockMs":76320}}],"verification":[{"checks":[{"durationMs":1071,"exitCode":0,"name":"build","output":"Compiling 28 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.00s\nCompiler run successful!\n","passed":true},{"durationMs":2405,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 35 tests for test/Yolo.t.sol:YoloTest\n[PASS] testFuzz_ApproveStoresExactValue(uint256) (runs: 512, μ: 88365, ~: 88741)\n[PASS] testFuzz_DelegatedTransferAboveAllowanceReverts(uint256,uint256) (runs: 512, μ: 125396, ~: 125984)\nLogs:\n  Bound result 1652709300869763571\n  Bound result 932372949703827494577089297\n\n[PASS] testFuzz_DelegatedTransferConservesSupplyAndAllowance(uint256,uint256) (runs: 512, μ: 163064, ~: 165217)\nLogs:\n  Bound result 100000000000000000000\n  Bound result 9\n\n[PASS] testFuzz_TransferAboveBalanceReverts(uint256,uint256) (runs: 512, μ: 127351, ~: 127578)\nLogs:\n  Bound result 217056903806276151083144475\n  Bound result 17208636105367718029821872980760674167172\n\n[PASS] testFuzz_TransferConservesSupply(address,uint256) (runs: 512, μ: 92975, ~: 93267)\nLogs:\n  Bound result 20761\n\n[PASS] test_ApprovalCanExceedCurrentBalance() (gas: 78393)\n[PASS] test_ApprovalDoesNotAuthorizeAnotherSpender() (gas: 105537)\n[PASS] test_ApproveEmitsEventReplacesAndRevokesAllowance() (gas: 173018)\n[PASS] test_ApproveZeroSpenderReverts() (gas: 37551)\n[PASS] test_ConstructorMintsOnceAndEmitsOneTransfer() (gas: 26684)\n[PASS] test_ContractDeployerReceivesEntireSupply() (gas: 327388)\n[PASS] test_Create2DeploymentHasNoArgumentsOrExternalRequirements() (gas: 310146)\n[PASS] test_DeployerCannotSpendHolderTokensWithoutApproval() (gas: 158497)\n[PASS] test_LaunchDistributionClaimsAndTradingTransfersArriveWhole() (gas: 686608)\n[PASS] test_MetadataAndEntireInitialSupply() (gas: 107606)\n[PASS] test_NoMintBurnAdminInitializationOrUpgradeEntryPoints() (gas: 809040)\n[PASS] test_RejectsEtherAndUnknownCalls() (gas: 86517)\n[PASS] test_RevokedApprovalCannotBeUsed() (gas: 118463)\n[PASS] test_RuntimeFitsDeploymentLimitAndHasNoForbiddenOpcodes() (gas: 1033587)\n[PASS] test_SelfTransferCannotExceedBalance() (gas: 40210)\n[PASS] test_SelfTransferPreservesBalance() (gas: 53925)\n[PASS] test_TransferEmitsEventAndMovesExactAmount() (gas: 93575)\n[PASS] test_TransferEntireBalance() (gas: 151457)\n[PASS] test_TransferFromInsufficientAllowanceLeavesStateUnchanged() (gas: 116197)\n[PASS] test_TransferFromInsufficientBalanceRollsBackAllowanceSpending() (gas: 136861)\n[PASS] test_TransferFromMovesTokensAndConsumesFiniteAllowance() (gas: 257101)\n[PASS] test_TransferFromPreservesInfiniteAllowance() (gas: 139807)\n[PASS] test_TransferFromToSelfConsumesAllowanceWithoutChangingBalance() (gas: 105719)\n[PASS] test_TransferFromToZeroRollsBackAllowanceSpending() (gas: 114594)\n[PASS] test_TransferFromWithoutAllowanceReverts() (gas: 57824)\n[PASS] test_TransferFromZeroSenderRevertsEvenForZeroAmount() (gas: 44556)\n[PASS] test_TransferRevertsForInsufficientBalance() (gas: 67814)\n[PASS] test_TransferToZeroRevertsIncludingZeroAmount() (gas: 71883)\n[PASS] test_ZeroTransferFromEmptyAccountEmitsEvent() (gas: 73420)\n[PASS] test_ZeroTransferFromWithoutAllowanceSucceedsAndEmits() (gas: 81491)\nSuite result: ok. 35 passed; 0 failed; 0 skipped; finished in 17.49ms (91.36ms CPU time)\n\nRan 1 test for test/Yolo.invariant.t.sol:YoloInvariantTest\n[PASS]\nYoloInvariantTest invariants:\n[PASS] invariant_AllowancesMatchIndependentLedger\n[PASS] invariant_SupplyAndBalancesMatchIndependentLedger\n YoloInvariantTest invariants (runs: 128, calls: 8192, reverts: 0)\n\n╭-------------+--------------+-------+---------+----------╮\n| Contract    | Selector     | Calls | Reverts | Discards |\n+=========================================================+\n| YoloHandler | approve      | 2667  | 0       | 0        |\n|-------------+--------------+-------+---------+----------|\n| YoloHandler | transfer     | 2816  | 0       | 0        |\n|-------------+--------------+-------+---------+----------|\n| YoloHandler | transferFrom | 2709  | 0       | 0        |\n╰-------------+--------------+-------+---------+----------╯\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 2.33s (2.33s CPU time)\n\nRan 2 test suites in 2.33s (2.35s CPU time): 36 tests passed, 0 failed, 0 skipped (36 total tests)\n","passed":true},{"durationMs":35,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"Yolo.approve(address,uint256)\",\"Yolo.transfer(address,uint256)\",\"Yolo.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":3,\"LICENSE\":21,\"README.md\":136,\"dependencies.lock.json\":54,\"foundry.toml\":18,\"remappings.txt\":2,\"src/Yolo.sol\":16,\"test/Yolo.invariant.t.sol\":128,\"test/Yolo.t.sol\":441,\"test/helpers/FactoryHarness.sol\":19},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true},{"durationMs":369,"exitCode":0,"name":"slither","output":"slither: no results at low impact or above","passed":true},{"durationMs":185,"exitCode":0,"name":"aderyn","output":"[low] large-numeric-literal at src/Yolo.sol:11: Large Numeric Literal","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"b7ee0811a0cb51d783a051e0ba09dbe2aeca1cd070794e31cdbacd08c0eac548","verifiedTreeHash":"1e3b62f0f9cb9da6497c3331ef9500d2c02e16f7","verifierVersion":"0.1.0+6a374fcd"},{"checks":[{"durationMs":1513,"exitCode":0,"name":"build","output":"Compiling 29 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.44s\nCompiler run successful!\n","passed":true},{"durationMs":11610,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 18 tests for test/Yolo.boundaries.t.sol:YoloBoundaryTest\n[PASS] testFuzz_DelegatedSelfTransferPreservesBalanceAndSpendsApproval(uint256,uint256,uint256) (runs: 1000, μ: 211415, ~: 212121)\nLogs:\n  Bound result 1745953059164287\n  Bound result 577056232035549\n  Bound result 577056232035549\n\n[PASS] testFuzz_InsufficientBalanceRollsBackAnySufficientAllowance(uint256,uint256,uint256) (runs: 1000, μ: 211205, ~: 211611)\nLogs:\n  Bound result 595544183624053143477769130\n  Bound result 390477772010356233693807890310807296688448183607858190708806708\n  Bound result 957233854024147900170966283839237\n\n[PASS] testFuzz_RevocationAfterPartialSpendBlocksUntilReapproved(uint256,uint256,bool) (runs: 1000, μ: 412869, ~: 412408)\nLogs:\n  Bound result 9923\n  Bound result 255\n\n[PASS] testFuzz_SplitDelegatedTransfersMatchOneTransfer(uint256,uint256,uint256,bool) (runs: 1000, μ: 377766, ~: 376482)\nLogs:\n  Bound result 779374988206162922397101153\n  Bound result 49431\n\n[PASS] testFuzz_TransferRoundTripRestoresBalancesAndPreservesApprovals(uint256,uint256,uint256) (runs: 1000, μ: 349098, ~: 351138)\nLogs:\n  Bound result 398315834418274627853201797\n  Bound result 11623541771209040012778655\n\n[PASS] test_ExhaustedApprovalCannotBeReusedAfterBalanceRefill() (gas: 298936)\n[PASS] test_InfiniteApprovalCannotBypassZeroRecipientValidation() (gas: 149865)\n[PASS] test_InfiniteApprovalDoesNotAuthorizeMaximumOverdraft() (gas: 129308)\n[PASS] test_LargestFiniteAllowanceIsConsumedRatherThanTreatedAsInfinite() (gas: 210773)\n[PASS] test_MaximumTransferRevertsWithoutChangingBalances() (gas: 65292)\n[PASS] test_OneBaseUnitCanBeTransferredApprovedAndSpentExactly() (gas: 220795)\n[PASS] test_ReapprovalAfterPartialSpendReplacesRemainingAllowance() (gas: 255804)\n[PASS] test_ReducingInfiniteApprovalImmediatelyLimitsSpender() (gas: 278097)\n[PASS] test_RepeatedSameApprovalEmitsWithoutAccumulatingAllowance() (gas: 213710)\n[PASS] test_SpenderReceivingTokensStillConsumesAllowance() (gas: 191830)\n[PASS] test_TransferFromByHolderStillRequiresSelfApproval() (gas: 258787)\n[PASS] test_ZeroApprovalStillRejectsZeroSpender() (gas: 58340)\n[PASS] test_ZeroTransferFromStillRejectsZeroRecipientWithoutAllowance() (gas: 79104)\nSuite result: ok. 18 passed; 0 failed; 0 skipped; finished in 86.24ms (417.84ms CPU time)\n\nRan 35 tests for test/Yolo.t.sol:YoloTest\n[PASS] testFuzz_ApproveStoresExactValue(uint256) (runs: 1000, μ: 88337, ~: 88741)\n[PASS] testFuzz_DelegatedTransferAboveAllowanceReverts(uint256,uint256) (runs: 1000, μ: 125490, ~: 125996)\nLogs:\n  Bound result 244\n  Bound result 14\n\n[PASS] testFuzz_DelegatedTransferConservesSupplyAndAllowance(uint256,uint256) (runs: 1000, μ: 163226, ~: 165217)\nLogs:\n  Bound result 244\n  Bound result 14\n\n[PASS] testFuzz_TransferAboveBalanceReverts(uint256,uint256) (runs: 1000, μ: 127468, ~: 127632)\nLogs:\n  Bound result 244\n  Bound result 14\n\n[PASS] testFuzz_TransferConservesSupply(address,uint256) (runs: 1000, μ: 92994, ~: 93267)\nLogs:\n  Bound result 735694331692993268464461514\n\n[PASS] test_ApprovalCanExceedCurrentBalance() (gas: 78393)\n[PASS] test_ApprovalDoesNotAuthorizeAnotherSpender() (gas: 105537)\n[PASS] test_ApproveEmitsEventReplacesAndRevokesAllowance() (gas: 173018)\n[PASS] test_ApproveZeroSpenderReverts() (gas: 37551)\n[PASS] test_ConstructorMintsOnceAndEmitsOneTransfer() (gas: 26684)\n[PASS] test_ContractDeployerReceivesEntireSupply() (gas: 327388)\n[PASS] test_Create2DeploymentHasNoArgumentsOrExternalRequirements() (gas: 310146)\n[PASS] test_DeployerCannotSpendHolderTokensWithoutApproval() (gas: 158497)\n[PASS] test_LaunchDistributionClaimsAndTradingTransfersArriveWhole() (gas: 686608)\n[PASS] test_MetadataAndEntireInitialSupply() (gas: 107606)\n[PASS] test_NoMintBurnAdminInitializationOrUpgradeEntryPoints() (gas: 809040)\n[PASS] test_RejectsEtherAndUnknownCalls() (gas: 86517)\n[PASS] test_RevokedApprovalCannotBeUsed() (gas: 118463)\n[PASS] test_RuntimeFitsDeploymentLimitAndHasNoForbiddenOpcodes() (gas: 1033587)\n[PASS] test_SelfTransferCannotExceedBalance() (gas: 40210)\n[PASS] test_SelfTransferPreservesBalance() (gas: 53925)\n[PASS] test_TransferEmitsEventAndMovesExactAmount() (gas: 93575)\n[PASS] test_TransferEntireBalance() (gas: 151457)\n[PASS] test_TransferFromInsufficientAllowanceLeavesStateUnchanged() (gas: 116197)\n[PASS] test_TransferFromInsufficientBalanceRollsBackAllowanceSpending() (gas: 136861)\n[PASS] test_TransferFromMovesTokensAndConsumesFiniteAllowance() (gas: 257101)\n[PASS] test_TransferFromPreservesInfiniteAllowance() (gas: 139807)\n[PASS] test_TransferFromToSelfConsumesAllowanceWithoutChangingBalance() (gas: 105719)\n[PASS] test_TransferFromToZeroRollsBackAllowanceSpending() (gas: 114594)\n[PASS] test_TransferFromWithoutAllowanceReverts() (gas: 57824)\n[PASS] test_TransferFromZeroSenderRevertsEvenForZeroAmount() (gas: 44556)\n[PASS] test_TransferRevertsForInsufficientBalance() (gas: 67814)\n[PASS] test_TransferToZeroRevertsIncludingZeroAmount() (gas: 71883)\n[PASS] test_ZeroTransferFromEmptyAccountEmitsEvent() (gas: 73420)\n[PASS] test_ZeroTransferFromWithoutAllowanceSucceedsAndEmits() (gas: 81491)\nSuite result: ok. 35 passed; 0 failed; 0 skipped; finished in 86.21ms (415.70ms CPU time)\n\nRan 1 test for test/Yolo.invariant.t.sol:YoloInvariantTest\n[PASS]\nYoloInvariantTest invariants:\n[PASS] invariant_AllowancesMatchIndependentLedger\n[PASS] invariant_MetadataRemainsFixed\n[PASS] invariant_SupplyAndBalancesMatchIndependentLedger\n YoloInvariantTest invariants (runs: 256, calls: 32768, reverts: 0)\n\n╭-------------+----------------------+-------+---------+----------╮\n| Contract    | Selector             | Calls | Reverts | Discards |\n+=================================================================+\n| YoloHandler | approve              | 4642  | 0       | 0        |\n|-------------+----------------------+-------+---------+----------|\n| YoloHandler | approveBoundary      | 4653  | 0       | 0        |\n|-------------+----------------------+-------+---------+----------|\n| YoloHandler | rejectZeroAddress    | 4659  | 0       | 0        |\n|-------------+----------------------+-------+---------+----------|\n| YoloHandler | transfer             | 4665  | 0       | 0        |\n|-------------+----------------------+-------+---------+----------|\n| YoloHandler | transferBoundary     | 4692  | 0       | 0        |\n|-------------+----------------------+-------+---------+----------|\n| YoloHandler | transferFrom         | 4758  | 0       | 0        |\n|-------------+----------------------+-------+---------+----------|\n| YoloHandler | transferFromBoundary | 4699  | 0       | 0        |\n╰-------------+----------------------+-------+---------+----------╯\n\nLogs:\n  Bound result 0\n  Bound result 962924220319241665870383993\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 3\n  Bound result 127\n  Bound result 0\n  Bound result 0\n  Bound result 0\n  Bound result 5425\n  Bound result 858\n  Bound result 958\n  Bound result 192\n  Bound result 9267\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 11.53s (11.53s CPU time)\n\nRan 3 test suites in 11.53s (11.70s CPU time): 54 tests passed, 0 failed, 0 skipped (54 total tests)\n","passed":true},{"durationMs":38,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"Yolo.approve(address,uint256)\",\"Yolo.transfer(address,uint256)\",\"Yolo.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":3,\"LICENSE\":21,\"README.md\":136,\"dependencies.lock.json\":54,\"foundry.toml\":18,\"remappings.txt\":2,\"src/Yolo.sol\":16,\"test/Yolo.boundaries.t.sol\":363,\"test/Yolo.invariant.t.sol\":225,\"test/Yolo.t.sol\":442,\"test/helpers/FactoryHarness.sol\":19},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"e3805a387e232648cc7011f2dcb6ddd6abd212f0d2593a63553069e1a2542798","verifiedTreeHash":"9bf7870448dd6fb6b76fb0a9b6004fd12beec318","verifierVersion":"0.1.0+6a374fcd"},{"checks":[{"durationMs":1099,"exitCode":0,"name":"build","output":"Compiling 28 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.03s\nCompiler run successful!\n","passed":true},{"durationMs":2451,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 35 tests for test/Yolo.t.sol:YoloTest\n[PASS] testFuzz_ApproveStoresExactValue(uint256) (runs: 512, μ: 88365, ~: 88741)\n[PASS] testFuzz_DelegatedTransferAboveAllowanceReverts(uint256,uint256) (runs: 512, μ: 125396, ~: 125984)\nLogs:\n  Bound result 889842865499943112595037027\n  Bound result 29284991733471934664929128\n\n[PASS] testFuzz_DelegatedTransferConservesSupplyAndAllowance(uint256,uint256) (runs: 512, μ: 163064, ~: 165217)\nLogs:\n  Bound result 217056903806276151083144475\n  Bound result 168590425426361316846957640\n\n[PASS] testFuzz_TransferAboveBalanceReverts(uint256,uint256) (runs: 512, μ: 127351, ~: 127578)\nLogs:\n  Bound result 217056903806276151083144475\n  Bound result 17208636105367718029821872980760674167172\n\n[PASS] testFuzz_TransferConservesSupply(address,uint256) (runs: 512, μ: 92975, ~: 93267)\nLogs:\n  Bound result 348312891890935563230363960\n\n[PASS] test_ApprovalCanExceedCurrentBalance() (gas: 78393)\n[PASS] test_ApprovalDoesNotAuthorizeAnotherSpender() (gas: 105537)\n[PASS] test_ApproveEmitsEventReplacesAndRevokesAllowance() (gas: 173018)\n[PASS] test_ApproveZeroSpenderReverts() (gas: 37551)\n[PASS] test_ConstructorMintsOnceAndEmitsOneTransfer() (gas: 26684)\n[PASS] test_ContractDeployerReceivesEntireSupply() (gas: 327388)\n[PASS] test_Create2DeploymentHasNoArgumentsOrExternalRequirements() (gas: 310146)\n[PASS] test_DeployerCannotSpendHolderTokensWithoutApproval() (gas: 158497)\n[PASS] test_LaunchDistributionClaimsAndTradingTransfersArriveWhole() (gas: 686608)\n[PASS] test_MetadataAndEntireInitialSupply() (gas: 107606)\n[PASS] test_NoMintBurnAdminInitializationOrUpgradeEntryPoints() (gas: 809040)\n[PASS] test_RejectsEtherAndUnknownCalls() (gas: 86517)\n[PASS] test_RevokedApprovalCannotBeUsed() (gas: 118463)\n[PASS] test_RuntimeFitsDeploymentLimitAndHasNoForbiddenOpcodes() (gas: 1033587)\n[PASS] test_SelfTransferCannotExceedBalance() (gas: 40210)\n[PASS] test_SelfTransferPreservesBalance() (gas: 53925)\n[PASS] test_TransferEmitsEventAndMovesExactAmount() (gas: 93575)\n[PASS] test_TransferEntireBalance() (gas: 151457)\n[PASS] test_TransferFromInsufficientAllowanceLeavesStateUnchanged() (gas: 116197)\n[PASS] test_TransferFromInsufficientBalanceRollsBackAllowanceSpending() (gas: 136861)\n[PASS] test_TransferFromMovesTokensAndConsumesFiniteAllowance() (gas: 257101)\n[PASS] test_TransferFromPreservesInfiniteAllowance() (gas: 139807)\n[PASS] test_TransferFromToSelfConsumesAllowanceWithoutChangingBalance() (gas: 105719)\n[PASS] test_TransferFromToZeroRollsBackAllowanceSpending() (gas: 114594)\n[PASS] test_TransferFromWithoutAllowanceReverts() (gas: 57824)\n[PASS] test_TransferFromZeroSenderRevertsEvenForZeroAmount() (gas: 44556)\n[PASS] test_TransferRevertsForInsufficientBalance() (gas: 67814)\n[PASS] test_TransferToZeroRevertsIncludingZeroAmount() (gas: 71883)\n[PASS] test_ZeroTransferFromEmptyAccountEmitsEvent() (gas: 73420)\n[PASS] test_ZeroTransferFromWithoutAllowanceSucceedsAndEmits() (gas: 81491)\nSuite result: ok. 35 passed; 0 failed; 0 skipped; finished in 17.66ms (89.84ms CPU time)\n\nRan 1 test for test/Yolo.invariant.t.sol:YoloInvariantTest\n[PASS]\nYoloInvariantTest invariants:\n[PASS] invariant_AllowancesMatchIndependentLedger\n[PASS] invariant_SupplyAndBalancesMatchIndependentLedger\n YoloInvariantTest invariants (runs: 128, calls: 8192, reverts: 0)\n\n╭-------------+--------------+-------+---------+----------╮\n| Contract    | Selector     | Calls | Reverts | Discards |\n+=========================================================+\n| YoloHandler | approve      | 2667  | 0       | 0        |\n|-------------+--------------+-------+---------+----------|\n| YoloHandler | transfer     | 2816  | 0       | 0        |\n|-------------+--------------+-------+---------+----------|\n| YoloHandler | transferFrom | 2709  | 0       | 0        |\n╰-------------+--------------+-------+---------+----------╯\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 2.37s (2.37s CPU time)\n\nRan 2 test suites in 2.37s (2.39s CPU time): 36 tests passed, 0 failed, 0 skipped (36 total tests)\n","passed":true},{"durationMs":33,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"Yolo.approve(address,uint256)\",\"Yolo.transfer(address,uint256)\",\"Yolo.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":3,\"LICENSE\":21,\"README.md\":136,\"dependencies.lock.json\":54,\"foundry.toml\":18,\"launch.json\":24,\"remappings.txt\":2,\"src/Yolo.sol\":16,\"test/Yolo.invariant.t.sol\":128,\"test/Yolo.t.sol\":441,\"test/helpers/FactoryHarness.sol\":19},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"ebf60dab212b3f8eb1080a9ffbd377c4e43f1a1e703729d9189ee06da2ad6ed2","verifiedTreeHash":"d33eb9ef835d950456d916cc233a42b25d70ee4f","verifierVersion":"0.1.0+6a374fcd"}]}