{"assessments":[],"deployments":[],"fuzz":[],"identity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"interpretation":"Records acceptance and evidence. Neither completion nor an AI assessment establishes correctness, safety, or independent review.","jobId":"99336a14-127a-4e97-8e6e-0203c47ccc2c","kind":"shape:chain","nodes":[{"acceptedSubmissionHash":"14a009f364ee81e25877acfd9c5046a76e0dbe3e3f3d01ca1b24a4f711be25f8","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_economics","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"772c66298ac8c276fede6fa5ad95d401babd2b08379a282bbdd4016c626ad66e","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_flow","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"e9088b17eb994697e9cfa7b40657fa8508445ddf9a056fc35970f66a91c88ea6","dependsOn":["build_contract_project","write_foundry_tests","manifest","audit_math","audit_permissions","audit_economics","audit_flow"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"af3aa01159bbf354f621cafa5c0006f6169e0938a8b015be508b7377dbf165bc","skillId":"audit-judge","tools":[]},"key":"audit_judge","kind":"code","role":"review","skillHash":"af3aa01159bbf354f621cafa5c0006f6169e0938a8b015be508b7377dbf165bc","skillId":"audit-judge","state":"accepted"},{"acceptedSubmissionHash":"b5b0391211aab37d1a2c19c4c4b804c38b1c858697d723ff1110761c53821a7a","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_math","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"3a7f1322b204f7d89ebb6bd4855123a70fafdd8016a754a1a9973001f166368c","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_permissions","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"68957862c721095ba120a045f80556f6c62a96519eb8086ab7186bfc442afc0e","dependsOn":[],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"d59561da3b378461b7c749f6bd5084477d44993aa94972ddea90f542535751df","skillId":"build-contract-project","tools":[]},"key":"build_contract_project","kind":"code","role":"implement","skillHash":"d59561da3b378461b7c749f6bd5084477d44993aa94972ddea90f542535751df","skillId":"build-contract-project","state":"accepted"},{"acceptedSubmissionHash":"f4477aaa05c1d59259d79ca214a267d65842fe462bf5e1137c7e74bee340464c","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"tools":[]},"key":"manifest","kind":"code","role":"integrate","skillHash":null,"skillId":null,"state":"accepted"},{"acceptedSubmissionHash":"331b9fe050ab67090891ea975515fc9d53e6892f2a35dfabe89fe3dc0f37b847","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"4c76766b00591dfe982fe85d3de589fdb2f810e5137c301155d1c5e36a1d3b23","skillId":"write-foundry-tests","tools":[]},"key":"write_foundry_tests","kind":"code","role":"tests","skillHash":"4c76766b00591dfe982fe85d3de589fdb2f810e5137c301155d1c5e36a1d3b23","skillId":"write-foundry-tests","state":"accepted"}],"objective":"A custom token: Dongle (DONGLE).\nToken name: Dongle\nToken symbol: DONGLE\nToken supply: 1,000,000,000 with 18 decimals, all minted once to the deployer in the constructor.","parentJobId":null,"planHash":"aa493b2dee1b227758af45c4b0b0de3f25e8f016a7447e1e73cf07472ce8f3e2","previousHash":"0000000000000000000000000000000000000000000000000000000000000000","projectId":"99336a14-127a-4e97-8e6e-0203c47ccc2c","publication":{"commit":null,"deliveredAt":null,"repoUrl":"https://github.com/identity-md-launches/launch-2474-dongle"},"receiptIdentity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"registry":"0xb6d0a187b050fa5bb0b87033a203f37becf4a775","research":[],"schema":"identitymd-work-v1","signals":[{"agentId":"52599","feedbackHash":"f15cc95d1fdf35a8cc4074436834fa675f1a8e9d79853df0895a49cb2524d371","nodeKey":"audit_economics","submissionHash":"14a009f364ee81e25877acfd9c5046a76e0dbe3e3f3d01ca1b24a4f711be25f8","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51343","feedbackHash":"e4ea0e9a804277e9a231106b402758e12c673ce5fa13039136e508d1c23d8e8f","nodeKey":"audit_flow","submissionHash":"772c66298ac8c276fede6fa5ad95d401babd2b08379a282bbdd4016c626ad66e","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"50939","feedbackHash":"b93adaf9418e65d147ee4049318cecf2254f08aa9250f37010bab420e55ca297","nodeKey":"audit_judge","submissionHash":"e9088b17eb994697e9cfa7b40657fa8508445ddf9a056fc35970f66a91c88ea6","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51166","feedbackHash":"8bdcdfe495e5159bd1985b1b6c9c18352d86d5d833ebe93c697f1ec13df2aba3","nodeKey":"audit_math","submissionHash":"b5b0391211aab37d1a2c19c4c4b804c38b1c858697d723ff1110761c53821a7a","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52606","feedbackHash":"673ebfe83a78b7714bc9f934e8f918d03a86fa14ef06f57b1a6f77827a236850","nodeKey":"audit_permissions","submissionHash":"3a7f1322b204f7d89ebb6bd4855123a70fafdd8016a754a1a9973001f166368c","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51876","feedbackHash":"85155c009c5a97458d201ecb968de6c0eaf7cc26b1866f4300a2513f9a8299fc","nodeKey":"build_contract_project","submissionHash":"68957862c721095ba120a045f80556f6c62a96519eb8086ab7186bfc442afc0e","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"52686","feedbackHash":"183c9186054b84cff28b4eb984147c5bee554c4b567bf8978495188aca992a82","nodeKey":"manifest","submissionHash":"f4477aaa05c1d59259d79ca214a267d65842fe462bf5e1137c7e74bee340464c","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"52200","feedbackHash":"8a4bf05708273c2f94502f94ab53f7ab7b8a242f64f6d838044ca354d8db999e","nodeKey":"write_foundry_tests","submissionHash":"331b9fe050ab67090891ea975515fc9d53e6892f2a35dfabe89fe3dc0f37b847","tag1":"verification:checks","tag2":"acceptance-v2","value":1}],"site":null,"snapshotHash":"20fc151c3efc9b44067b18d796fbdf068fb329301a981c501bd4f3e97c0b090d","state":"completed","submissions":[{"artifacts":[],"attempt":1,"bundleHash":null,"device":"a315ee4cb81c640c","findings":[],"hash":"14a009f364ee81e25877acfd9c5046a76e0dbe3e3f3d01ca1b24a4f711be25f8","nodeId":"057424f3-a8d0-4ac6-89ea-89d8ca02ccbd","outcome":"completed","summary":"The review is complete and the findings file is written. No tracked file was changed.\n\n**Result: no defects found** in the Economic Security, Invariant and Flow Gap areas for the Dongle token. The findings list in `.imd-findings.json` is empty, with a nine-row coverage record covering all three state-changing entry points and the invariants I checked.\n\n**What I checked**\n\n- **Source and surface.** The token is OpenZeppelin ERC20 v5.1.0 plus constants and a constructor that mints the whole supply to the deployer. The compiled ABI has exactly approve, transfer and transferFrom as state-changing functions, with no owner, initializer, receive, fallback or privileged call.\n- **Supply chain.** The five vendored OpenZeppelin files are byte-identical to the upstream v5.1.0 release archive, so no hidden fee or exemption logic exists in the library.\n- **Conservation invariant.** A stateful fuzz run over random transfer, approve and transferFrom calls among eight actors kept the sum of balances equal to the fixed supply in every run. The only mint is in the constructor.\n- **Launch flows.** A simulation of the swarm share, two unequal claims, the pool seed, a trader buy and sell-back, and the requester remainder moved every leg exactly. There is no exemption list to get wrong, so the factory, distributor and PoolManager cannot be taxed or blocked.\n- **Economic and boundary cases.** Transfers and approvals to the zero address revert, one-wei and whole-balance transfers behave, the max-uint allowance is never decremented, and the constants agree with runtime values. The 1e27 supply and the 88 percent seed fit the integer widths Uniswap v4 uses.\n- **Deployment phase.** No constructor arguments, no external calls, no initializer to front-run.\n\n**Not run.** The protected floor tests need v4-core and launch environment variables absent from this tree. A plain OpenZeppelin ERC-20 satisfies each of their assertions by construction, which is recorded in the coverage notes rather than claimed as an executed result.\n\n**Leads excluded.** The aderyn large-numeric-literal line is the brief's own supply figure. The ERC-20 approve race and permanent max-uint allowances are properties of the standard, already documented in the README, not defects of this code.","treeHash":null,"usage":{"cachedInputTokens":471206,"inputTokens":226,"model":"claude-fable-5-1","outputTokens":13573,"runtime":"claude","turns":25,"wallClockMs":237329}},{"artifacts":[],"attempt":1,"bundleHash":"dd2cfcf1112d4b96ec8c5a33056c00671e3e3d583b28e6dff840429bf87d4348","device":"fdbedee33322a6ef","findings":[],"hash":"331b9fe050ab67090891ea975515fc9d53e6892f2a35dfabe89fe3dc0f37b847","nodeId":"6d84e676-5c18-460f-ba1b-99beacf84095","outcome":"completed","summary":"I added invariant tests and edge-case tests for the Dongle (DONGLE) token, and found no defects. `forge build` succeeds, and `forge test` with the verifier's fuzz seed passes all 47 tests: the 30 from the earlier contributor plus my 17.\n\n**`test/DongleTokenInvariant.t.sol`** runs random sequences of token calls across five holders: the deployer plus four others, with the supply spread unevenly between them. It makes 256 runs of 64 calls each.\n- **Calls that should work:** transfer, approve (often for the maximum amount) and transferFrom, with amounts kept within what the caller can actually spend.\n- **Calls that should fail:** sending more than the balance, spending beyond an allowance, and sending to the zero address. Each must revert with the exact expected error.\n- **What is checked after every call:**\n  - The total supply stays exactly 1,000,000,000 × 10¹⁸.\n  - The five holders' balances add up to the total supply, and the zero address, the token contract and the test driver hold nothing.\n  - Every balance and every allowance matches a separate record the test keeps of what they should be.\n  - The name, symbol and decimals never change.\n- **Failed checks inside the driver count:** I made any revert fail the run. Without that, Foundry would just count a failed assertion there as a revert and keep going.\n- **Checking the checks:** I ran a deliberately broken copy, where the test's record never reduced allowances. Every invariant failed on it, so the harness does catch errors.\n\n**`test/DongleTokenEdges.t.sol`** pins cases the earlier tests didn't cover:\n- An owner can't use transferFrom on their own tokens without first approving themselves.\n- A transferFrom of 0 succeeds even with no allowance.\n- transferFrom fails when sending from or to the zero address.\n- A new approval replaces the old one rather than adding to it, and approving 0 revokes it.\n- An allowance can be used up exactly, after which the next spend fails.\n- Allowances only apply to the owner and spender they were set for.\n- transferFrom emits only a Transfer event, with no Approval event.\n- Transfers of 1 wei and of the maximum possible amount behave correctly.\n- Tokens sent to the token contract's own address are accepted and can never be moved again. This is normal for a plain ERC-20, not a defect.\n- Calls to `mint`, `burn` or no function at all are rejected.\n- Two fuzz tests (1,000 runs each): a third party with no allowance can never move the deployer's tokens, and a transfer changes only the sender's and recipient's balances.\n\nThe token is a plain fixed-supply OpenZeppelin ERC-20 with no owner, mint, burn, fee or pause, so I didn't write `.imd-findings.json`. I changed only these two new files under `test/`.","treeHash":"11190145b4fb9939f0fa8cf110b1c9492c6e30d2","usage":{"cachedInputTokens":348641,"inputTokens":20,"model":"claude-opus-5-5","outputTokens":11001,"runtime":"claude","turns":11,"wallClockMs":198313}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"829d84438fb3fdc8","findings":[{"citation":"resolved","description":"Area: Asymmetry / Trust Gap (caller-class asymmetry between the allowance owner and the spender). DongleToken inherits OpenZeppelin ERC20 v5.1.0 unchanged, and its only allowance writer reachable by a holder is approve(spender, value), which overwrites _allowances[owner][spender] with the new value (lib/openzeppelin-contracts/contracts/token/ERC20/ERC20.sol:287, `_allowances[owner][spender] = value;`). OZ v5 removed increaseAllowance/decreaseAllowance, and the token adds no permit, no increase/decrease helpers and no 'must be zero before non-zero' guard. So the write moment of an allowance reduction is not atomic with respect to the spender: a spender who sees the owner's reduction in the mempool can transferFrom the old allowance first, then the new allowance lands as a fresh amount, and the spender moves old + new. This is the well-known ERC-20 approve race (EIP-20 security note). It is a property of the standard interface the token exposes, not a coding error, and every ERC-20 without permit/increase/decrease helpers shares it. It needs no privileged role: the actor is any address the holder has approved. It is recorded here because it is the only caller-class asymmetry in the contract and the README's 'Holders manage their own allowances' note does not mention it. Not a launch blocker: the launch flows (factory -> distributor -> claimants, PoolManager seed and swaps) use transfer and PoolManager's own settlement, not holder approvals to third parties. Possible minimal, design-preserving mitigation if the author wants one: document in the README that holders should set an allowance to 0 before changing it to a new non-zero value, or (scope decision) add ERC20Permit so allowances can be granted per-transaction. Changing approve() semantics itself (e.g. revert unless current allowance is 0) would break composability with routers and is not recommended.","line":12,"path":"src/DongleToken.sol","reproduction":"State: HOLDER holds 1000 DONGLE and has called approve(SPENDER, 100e18). HOLDER now decides SPENDER should only have 50e18 and broadcasts approve(SPENDER, 50e18). Call sequence: (1) SPENDER, seeing the pending tx, calls transferFrom(HOLDER, SINK, 100e18) first: succeeds, allowance becomes 0, HOLDER balance 900e18. (2) HOLDER's approve(SPENDER, 50e18) is mined: allowance is now 50e18 (overwritten, not reduced from 0). (3) SPENDER calls transferFrom(HOLDER, SINK, 50e18): succeeds. Actual: SINK received 150e18 and HOLDER has 850e18. Expected by the holder: SPENDER could move at most 100e18 (the larger of old and new) and after the change at most 50e18 in total. Confirmed with a Foundry test on this tree (test/scratch/Probe.t.sol, test_approveRaceSpendsOldPlusNew): balanceOf(SINK) == 150e18, balanceOf(HOLDER) == 850e18.","severity":"info","snippet":"contract DongleToken is ERC20 {","title":"approve() allowance change is front-runnable: a spender can spend the old and the new allowance (inherent ERC-20 race, not blocking)"}],"hash":"3a7f1322b204f7d89ebb6bd4855123a70fafdd8016a754a1a9973001f166368c","nodeId":"014627aa-cbc1-47f8-8e7f-5167c90631c9","outcome":"completed","summary":"The review is complete and the findings file is written and valid. The working tree is clean apart from the findings file and my scratch test, which are the only outputs this task allows.\n\n**Outcome:** no defect in the assigned area. The Access Control, Trust Gap and Asymmetry passes found nothing exploitable in `src/DongleToken.sol`. One informational note was recorded so the judge has the full picture.\n\n**What was checked**\n\n- **Surface.** The compiled ABI has exactly three state-changing functions, a no-argument constructor, and no receive, fallback, owner, role, mint, burn, pause or upgrade path. Nothing exists for a privileged actor to misuse.\n- **Dependencies.** All five vendored OpenZeppelin files hash identical to upstream v5.1.0. The token inherits that ERC-20 unchanged and adds only constants and a `pure` decimals override.\n- **Entry points.** Transfer and transferFrom only move the caller's own balance or allowance, with the checks in the right order and no fee, hook or exemption branch. The deployer has no special path and reverts on transferFrom with zero allowance.\n- **Invariants.** Supply cannot grow after construction, no call can move or freeze a holder's balance, launch flows move exactly what they say, and the runtime has no DELEGATECALL, CALLCODE or SELFDESTRUCT. The existing 30-test suite and a 5-test scratch probe all pass. The one scratch failure during the work was my own prank misuse, corrected and re-run green.\n- **Static analysis lead.** The aderyn large-literal note on line 23 is a style remark about `1_000_000_000` and is not a defect.\n\n**The single finding (info, not blocking)**\n\nThe approve function overwrites the allowance, so a spender who front-runs an allowance reduction can spend the old amount plus the new one. This is the inherent ERC-20 approve race, present in every token without permit or increase/decrease helpers, and the launch flows never rely on holder approvals. The reproduction is concrete and confirmed by a scratch test. Suggested handling is a README note or, as a scope decision, adding ERC20Permit. Changing approve semantics is not recommended.\n\n**Coverage record.** All three listed entry points have rows, plus six rows for the constructor, the invariants, the Trust Gap seams and the dependency check. Nothing in the assigned area was left unreached.","treeHash":null,"usage":{"cachedInputTokens":796351,"inputTokens":418,"model":"claude-fable-5-1","outputTokens":11414,"runtime":"claude","turns":22,"wallClockMs":173399}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"911c99a95f538613","findings":[],"hash":"4e8b66f2dd6d56ce0ec395f06483fbca16b1b93e50babd24ba91a3d87777473e","nodeId":"263e9fbe-c316-48db-bfe0-ec3b825e82e5","outcome":"failed","summary":"Failed to authenticate: OAuth session expired and could not be refreshed","treeHash":null,"usage":{"cachedInputTokens":0,"inputTokens":0,"model":null,"outputTokens":0,"runtime":"claude","turns":1,"wallClockMs":1743}},{"artifacts":[],"attempt":1,"bundleHash":"5e7ac703eeb2e4b1f257a27547e35f3f2684db8a43a7f415db667b40aad75abf","device":"d03fc84904b54d9e","findings":[],"hash":"68957862c721095ba120a045f80556f6c62a96519eb8086ab7186bfc442afc0e","nodeId":"263e9fbe-c316-48db-bfe0-ec3b825e82e5","outcome":"completed","summary":"The Dongle token project is complete, verified, and committed on `main`.\n\n**What was built**\n\n- `src/DongleToken.sol`: contract `DongleToken`, name `Dongle`, symbol `DONGLE`, 18 decimals. The constructor takes no arguments, calls no other contract, and mints the full supply once to `msg.sender`. It inherits OpenZeppelin `ERC20` v5.1.0 and adds nothing but constants, so there is no owner, mint, burn, pause, blacklist, fee, proxy, `delegatecall` or `selfdestruct`.\n- `foundry.toml` pins `solc = \"0.8.26\"`, sets `bytecode_hash = \"none\"` and `cbor_metadata = false`, optimizer on, `ffi` off, no filesystem permissions. I confirmed the built runtime carries no metadata and no link placeholders.\n- `lib/` vendors forge-std v1.9.7 (src only) and the five OpenZeppelin files the token imports, as ordinary files with their licences. No nested `.git` or submodule exists.\n- `README.md` documents the design, constants, deployment parameters, launch values decided elsewhere, operational responsibilities, assumptions, and the security checklist review.\n\n**Tests** in `test/DongleToken.t.sol`, 30 in total, all passing with the verifier's fuzz seed:\n\n- Success paths: metadata, supply constants, mint to a CREATE2 factory probe, mint to any deployer, single Transfer event, deployment on an empty chain, transfers, approvals, transferFrom, infinite allowance.\n- Failure paths: insufficient balance, empty account, zero-address receiver and spender, allowance exceeded, no approval, balance short despite allowance.\n- Launch floor mirrors: swarm share arrives and is claimable whole, every common mint and admin selector reverts from both a stranger and the deployer, every common freeze and seize selector reverts and the holder can still transfer, no payable surface, reachable runtime has no DELEGATECALL, CALLCODE or SELFDESTRUCT, runtime fits EIP-170.\n- Five fuzz tests covering supply conservation, revert bounds, allowance accounting, round trips and arbitrary deployers.\n\n**Checks run**: `forge build`, `forge test` with the given seed, and `forge fmt --check` all pass. Slither and Mythril were not available and did not run, as the README states.\n\n**Not done, by design**: no `launch.json`, no deploy script, no broadcast. The pinned protected tests need v4-core and the launch environment, so they could not be run here; my tests reproduce their token-level checks without the pool.","treeHash":"4c8b6bdb6e2e08ead750e06b70f5e76a2bdc2f53","usage":{"cachedInputTokens":650256,"inputTokens":354,"model":"claude-fable-5-1","outputTokens":20075,"runtime":"claude","turns":24,"wallClockMs":249520}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"feba2a869621cab2","findings":[{"citation":"resolved","description":"DongleToken inherits OpenZeppelin ERC20 v5.1.0 unmodified (verified byte-for-byte against the upstream v5.1.0 tag). Its approve() sets the allowance to the new value without reference to the old one, so a spender who sees a holder's allowance-reduction transaction in the mempool can spend the old allowance first and then the new one. This is the long-documented property of the ERC-20 standard itself, not a defect introduced by this code, and it is the only 'approval residual' path (Execution Trace guide) reachable in this token. OpenZeppelin v5 deliberately dropped increaseAllowance/decreaseAllowance, so no code change is recommended; the README's 'Holders manage their own allowances' section warns about infinite allowances but not about this, and a one-line note (set allowance to 0 before changing a non-zero one, or approve exact per-use amounts) would complete it. No launch flow is affected: the factory, distributor and PoolManager flows use transfer() or exact single-use allowances.","line":287,"path":"lib/openzeppelin-contracts/contracts/token/ERC20/ERC20.sol","reproduction":"State: holder A has 200e18 DONGLE and has called approve(SP, 100e18). A then submits approve(SP, 50e18) intending to reduce the allowance. SP front-runs it with transferFrom(A, SP, 100e18) (succeeds, allowance 100e18 -> 0), then A's approve(SP, 50e18) lands, then SP calls transferFrom(A, SP, 50e18). Expected by A: SP can take at most 100e18 (the larger of the two values ever approved). Actual: SP holds 150e18. Reproduced with a Foundry test on this tree (test_approveRaceSpendsOldPlusNew: balanceOf(SP) == 150e18 after the sequence).","severity":"info","snippet":"        _allowances[owner][spender] = value;","title":"approve() overwrites the allowance non-atomically (inherent ERC-20 approve race); README does not mention it"}],"hash":"772c66298ac8c276fede6fa5ad95d401babd2b08379a282bbdd4016c626ad66e","nodeId":"9591f6e4-bed5-4948-8146-5fb9692bc481","outcome":"completed","summary":"The jq error was only my query's precedence (it piped the array into the second expression). The file holds one finding and eleven coverage rows, which I confirmed valid earlier with `jq -e .`. The findings file exists at the repository root, and git shows no change beyond it, so the review wrote nothing to the tree.\n\n**Result: no defects found in the assigned area.** The Dongle token is the unmodified OpenZeppelin ERC20 v5.1.0 plus constants and a constructor, and every control-flow path I traced behaves as a standard fixed-supply ERC-20 should.\n\n**What I covered (Execution Trace, Periphery, First Principles)**\n\n- **Execution trace:** traced `approve`, `transfer` and `transferFrom` from entry to storage through `_approve`, `_spendAllowance`, `_transfer` and `_update`. Checked zero-address sentinels, zero amount, whole-supply moves, self-transfer, self-transferFrom, infinite allowance, allowance outliving a zero balance, and supply conservation. All held, confirmed with a scratch Foundry suite of eight tests that passed and was then deleted.\n- **Periphery:** diffed all five vendored OpenZeppelin files against the upstream v5.1.0 tag. All identical. `Context._msgSender` is plain `msg.sender`, so there is no forwarder surface.\n- **First principles / launch floor:** the constructor mints exactly 1e27 minor units once to `msg.sender`, `_mint` is internal and unreachable after construction, `decimals()` is a pure 18 that also feeds the supply constant, and the compiled ABI exposes nothing but the three state-changing ERC-20 functions plus views. Disassembly of the 2203-byte runtime shows no DELEGATECALL, CALLCODE or SELFDESTRUCT, and there is no receive or fallback. The aderyn large-literal lead is a style note only.\n\n**What I reported:** one informational item, the inherent ERC-20 approve race, with a concrete reproduction (holder approves 100, reduces to 50, spender front-runs and ends with 150). It is a property of the standard, not a code defect, and the recommended action is a README line only. All three listed entry points plus eight invariant rows are marked `holds`. Nothing was left unreached.","treeHash":null,"usage":{"cachedInputTokens":782405,"inputTokens":322,"model":"claude-fable-5-1","outputTokens":15288,"runtime":"claude","turns":29,"wallClockMs":219954}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"45aa937328087de3","findings":[],"hash":"b5b0391211aab37d1a2c19c4c4b804c38b1c858697d723ff1110761c53821a7a","nodeId":"f40761e1-f399-44e3-9b77-2bddba81f6ca","outcome":"completed","summary":"The review is complete. The findings file is written, the JSON parses, and the working tree is unchanged apart from that file.\n\n**Result: no defects found in the math, boundary, or numerical-gap area.** The file holds an empty findings list and eight coverage rows, one for each of the three state-changing entry points plus five invariant rows.\n\nWhat I checked, against the Math Precision, Boundary and Numerical Gap guides:\n\n- **Arithmetic.** The only computation in the token is the supply constant, which is a compile-time product equal to 1e27. That is far below the uint256 range, so the mint and every later balance addition inside OpenZeppelin's unchecked blocks cannot wrap. There is no division, no fee, no scale conversion and no downcast anywhere in the value path.\n- **Boundaries.** Scratch tests exercised zero amounts, 1 wei, exact balance, balance plus one, the maximum uint256, self-transfer of the whole balance, transfers to the zero address, approvals of max and max minus one, and transferFrom by the owner without an allowance. Each behaved as the ERC-20 standard and OpenZeppelin's ERC-6093 errors require. The compiled ABI has no payable, receive or fallback entry and the contract makes no external calls.\n- **Invariants.** A fuzzed chain of transfers across four holders kept the sum of balances exactly equal to the supply. Decimals are a fixed 18 with no cross-decimal math.\n- **Dependency integrity.** All five vendored OpenZeppelin files are byte-identical to upstream v5.1.0, confirmed by fetching the tagged sources and diffing them.\n- **Static analysis lead.** The aderyn large-numeric-literal note points at the named supply constant, whose value the existing tests pin. It is not a defect.\n\nThe scratch test directory was removed after running, since no finding needed a proof. Nothing outside the assigned area turned up that would warrant a report either: the token has no owner, no privileged functions and no transfer hooks.","treeHash":null,"usage":{"cachedInputTokens":719105,"inputTokens":322,"model":"claude-fable-5-1","outputTokens":10912,"runtime":"claude","turns":21,"wallClockMs":165500}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"72b617d4b615473a","findings":[],"hash":"e9088b17eb994697e9cfa7b40657fa8508445ddf9a056fc35970f66a91c88ea6","nodeId":"182263fb-18a7-4a11-9730-e3daa42d5cbf","outcome":"completed","summary":"I found no defects to report. `.imd-findings.json` holds an empty findings list and a coverage record of 5 rows. It covers all 3 listed entry points plus 2 checks I added: the token's supply and whether the factory can deploy it.\n\n**What the code is:** `src/DongleToken.sol` is a plain OpenZeppelin ERC20 v5.1.0 token. It adds only constants, a constructor with no arguments that mints 1e27 minor units to `msg.sender`, and a `decimals()` override that returns 18. I downloaded the five vendored OpenZeppelin files from the upstream v5.1.0 tag and they are byte-identical.\n\n**How I checked it:**\n- **Build:** `forge build --sizes` gives 2,203 B deployed and 3,369 B creation code. Both are well under the 24,576 / 49,152 byte limits.\n- **Tests:** `forge test` ran 47 tests and all 47 passed.\n- **Manifest:** `launch.json` matches the code. It has an empty constructor argument list, `totalSupply` of `1000000000000000000000000000`, decimals 18 and a contract name that fits. It uses only schema keys, lowercase addresses, and notes of 1,228 characters.\n- **Deployment and launch rules:** the token needs no particular address bits. It has no privileged roles and no delegatecall or selfdestruct, and it charges no fee or burn on transfer. So the factory can deploy it, and every launch transfer moves exactly what it says.\n\n**What the specialists reported:** two of them (`audit_flow` and `audit_permissions`) reported the same thing, at \"info\" severity. A spender who sees an `approve()` that lowers their allowance can spend the old allowance first and the new one after. I counted that as one finding and then dropped it. The sequence they describe does happen, but overwriting the allowance is what the ERC-20 standard specifies, and this code doesn't change it. Their only suggested remedy is a sentence in the README, and an open finding would hold the launch back over standard behaviour. I gave the reason in the `approve` coverage row.\n\n**Not checked or not reported:**\n- I couldn't verify that the `economics` values in `launch.json` match the requester's job, because the job's figures weren't among the inputs.\n- The README says the repository \"intentionally does not contain\" a `launch.json`, but one is there. That is a wording problem in the docs, not a code defect, so I left it out.\n- I didn't run the protected floor tests. They import harness files that aren't in this tree.\n- I wrote no test files and changed nothing else.","treeHash":null,"usage":{"cachedInputTokens":282931,"inputTokens":12,"model":"claude-opus-5-5","outputTokens":3797,"runtime":"claude","turns":6,"wallClockMs":65878}},{"artifacts":[],"attempt":1,"bundleHash":"f0214fa61de73736dea4f017edd13c1edc1df5c4a1a60694091f5eabf7d7a010","device":"8a05ec1ea94411ea","findings":[],"hash":"f4477aaa05c1d59259d79ca214a267d65842fe462bf5e1137c7e74bee340464c","nodeId":"42ede637-e2d7-4442-b565-ed05a415eb24","outcome":"completed","summary":"`launch.json` is written and is the only changed file. The build compiles and all 30 tests pass with the verifier's fuzz seed.\n\n**What the manifest describes**\n\n- **Token:** `DongleToken`, name Dongle, symbol DONGLE, 18 decimals. The constructor takes no arguments, so constructorArgs is an empty list, and totalSupply is the exact amount it mints to msg.sender in minor units.\n- **Contracts:** an empty list. The accepted tree has only the token and no application contracts.\n- **Pool and economics:** copied verbatim from the launch reference. The pair is the IMD address, fee 12500, tick spacing 60, the one-to-one provenance price, and the requester's economics object unchanged.\n- **Notes:** a short explanation of the token's fixed supply, absence of privileged functions, and the launch flows, well under the 4000-character limit.\n\n**Checks run**\n\n- A scratch script confirmed the file has only the schema's top-level keys, string uint256s and addresses in lowercase, integer fee, tickSpacing and decimals, and the economics object equal to the job's.\n- The git status shows only the new launch.json. No configuration, lib, or source file was touched.","treeHash":"b8f2a7f1463a806ad0a2936be566fd6bb335b117","usage":{"cachedInputTokens":189304,"inputTokens":130,"model":"claude-fable-5-1","outputTokens":3345,"runtime":"claude","turns":10,"wallClockMs":51899}}],"verification":[{"checks":[{"durationMs":1932,"exitCode":0,"name":"build","output":"Compiling 28 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.82s\nCompiler run successful!\n","passed":true},{"durationMs":6899,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 30 tests for test/DongleToken.t.sol:DongleTokenTest\n[PASS] testFuzz_anyDeployerReceivesWholeSupply(address) (runs: 256, μ: 21679, ~: 21679)\n[PASS] testFuzz_roundTripLeavesBalancesUnchanged(address,address,uint256) (runs: 256, μ: 195865, ~: 196981)\nLogs:\n  Bound result 21055\n\n[PASS] testFuzz_transferBeyondBalanceReverts(uint256,uint256) (runs: 256, μ: 105204, ~: 105827)\nLogs:\n  Bound result 485535706825732327684972660\n  Bound result 357517715281813586278955794\n\n[PASS] testFuzz_transferConservesSupply(address,uint256) (runs: 256, μ: 111539, ~: 111471)\nLogs:\n  Bound result 173257368452699703994447635\n\n[PASS] testFuzz_transferFromWithinAllowance(uint256,uint256) (runs: 256, μ: 208806, ~: 211154)\nLogs:\n  Bound result 159057879543148453757696723\n  Bound result 58489213474468923106888539\n\n[PASS] test_approveAndTransferFrom() (gas: 211622)\n[PASS] test_approveZeroSpenderReverts() (gas: 30818)\n[PASS] test_constructorEmitsSingleTransferFromZero() (gas: 10758)\n[PASS] test_deploysOnEmptyChainAtAnySalt() (gas: 954423)\n[PASS] test_infiniteAllowanceIsNotDecremented() (gas: 184308)\n[PASS] test_metadata() (gas: 58523)\n[PASS] test_mintsToWhoeverDeploys() (gas: 19173)\n[PASS] test_mintsWholeSupplyToDeployer() (gas: 44201)\n[PASS] test_noCommonAdminCallIncreasesSupply() (gas: 1054506)\n[PASS] test_noPayableSurface() (gas: 66919)\n[PASS] test_noPrivilegedHandMovesOrFreezesAHolder() (gas: 580266)\n[PASS] test_runtimeCodeHasNoDelegatecallOrSelfdestruct() (gas: 3180608)\n[PASS] test_runtimeFitsEip170() (gas: 8559)\n[PASS] test_supplyConstantsAgree() (gas: 25417)\n[PASS] test_swarmShareArrivesWholeAndIsClaimableWhole() (gas: 150974)\n[PASS] test_transferFromRevertsBeyondAllowance() (gas: 145592)\n[PASS] test_transferFromRevertsBeyondBalanceEvenWithAllowance() (gas: 144311)\n[PASS] test_transferFromWithoutApprovalReverts() (gas: 98219)\n[PASS] test_transferMovesExactAmount() (gas: 97121)\n[PASS] test_transferRevertsFromEmptyAccount() (gas: 33223)\n[PASS] test_transferRevertsOnInsufficientBalance() (gas: 98174)\n[PASS] test_transferToSelfKeepsBalance() (gas: 109512)\n[PASS] test_transferToZeroAddressReverts() (gas: 95478)\n[PASS] test_transferWholeBalance() (gas: 79441)\n[PASS] test_transferZeroAmountSucceeds() (gas: 83362)\nSuite result: ok. 30 passed; 0 failed; 0 skipped; finished in 19.12ms (113.08ms CPU time)\n\nRan 16 tests for test/DongleTokenEdges.t.sol:DongleTokenEdgesTest\n[PASS] testFuzz_thirdPartyCannotMoveFunds(address,address,uint256) (runs: 1000, μ: 52028, ~: 51779)\nLogs:\n  Bound result 34403272997883755516524319\n\n[PASS] testFuzz_transferChangesOnlySenderAndRecipient(uint256,uint256) (runs: 1000, μ: 120245, ~: 120568)\nLogs:\n  Bound result 3302\n\n[PASS] test_allowanceIsPerOwnerAndSpender() (gas: 170779)\n[PASS] test_allowanceSpentExactlyThenExhausted() (gas: 207257)\n[PASS] test_approveOverwritesRatherThanAdds() (gas: 133199)\n[PASS] test_approveToZeroRevokes() (gas: 113483)\n[PASS] test_maxUintTransferReverts() (gas: 38164)\n[PASS] test_oneWeiTransfers() (gas: 167858)\n[PASS] test_ownerCannotTransferFromSelfWithoutAllowance() (gas: 45466)\n[PASS] test_transferEmitsTransferEvent() (gas: 66615)\n[PASS] test_transferFromDoesNotEmitApproval() (gas: 125201)\n[PASS] test_transferFromToZeroAddressReverts() (gas: 108554)\n[PASS] test_transferFromZeroAddressReverts() (gas: 38040)\n[PASS] test_transferFromZeroAmountWithoutAllowanceSucceeds() (gas: 65736)\n[PASS] test_transferToTokenContractIsAcceptedAndStuck() (gas: 78226)\n[PASS] test_unknownSelectorReverts() (gas: 82150)\nSuite result: ok. 16 passed; 0 failed; 0 skipped; finished in 22.08ms (39.98ms CPU time)\n\nRan 1 test for test/DongleTokenInvariant.t.sol:DongleTokenInvariantTest\n[PASS]\nDongleTokenInvariantTest invariants:\n[PASS] invariant_actorsHoldTheWholeSupply\n[PASS] invariant_allowancesMatchModel\n[PASS] invariant_balancesMatchModel\n[PASS] invariant_metadataFixed\n[PASS] invariant_totalSupplyNeverChanges\n DongleTokenInvariantTest invariants (runs: 256, calls: 16384, reverts: 0)\n\n╭---------------+-----------------------------+-------+---------+----------╮\n| Contract      | Selector                    | Calls | Reverts | Discards |\n+==========================================================================+\n| DongleHandler | approve                     | 2745  | 0       | 0        |\n|---------------+-----------------------------+-------+---------+----------|\n| DongleHandler | transfer                    | 2750  | 0       | 0        |\n|---------------+-----------------------------+-------+---------+----------|\n| DongleHandler | transferFrom                | 2808  | 0       | 0        |\n|---------------+-----------------------------+-------+---------+----------|\n| DongleHandler | transferFromBeyondAllowance | 2684  | 0       | 0        |\n|---------------+-----------------------------+-------+---------+----------|\n| DongleHandler | transferToZero              | 2691  | 0       | 0        |\n|---------------+-----------------------------+-------+---------+----------|\n| DongleHandler | transferTooMuch             | 2706  | 0       | 0        |\n╰---------------+-----------------------------+-------+---------+----------╯\n\nLogs:\n  Bound result 40\n  Bound result 254\n  Bound result 0\n  Bound result 255\n  Bound result 3005\n  Bound result 825\n  Bound result 0\n  Bound result 2\n  Bound result 18\n  Bound result 338\n  Bound result 0\n  Bound result 255\n  Bound result 0\n  Bound result 7959\n  Bound result 5\n  Bound result 5140188991855308653467622174\n  Bound result 3576850822\n  Bound result 20\n  Bound result 0\n  Bound result 1327\n  Bound result 2948\n  Bound result 0\n  Bound result 31\n  Bound result 0\n  Bound result 266\n  Bound result 0\n  Bound result 16413\n  Bound result 7868031153166648053814\n  Bound result 50\n  Bound result 0\n  Bound result 7703\n  Bound result 5986\n  Bound result 0\n  Bound result 115792089237316195423570985008687907853269984665640564039457584007913129639934\n  Bound result 10\n  Bound result 0\n  Bound result 7523\n  Bound result 424\n  Bound result 10\n  Bound result 5000000000000000000\n  Bound result 7383\n  Bound result 0\n  Bound result 4511\n  Bound result 4166\n  Bound result 342575902830208722020919279\n  Bound result 3430074283791994401911045861980943510950467599738613483597764248277575219\n  Bound result 5\n  Bound result 9137208404602465147346459890067802846183545402248322320829852932\n  Bound result 6000000000000000000\n  Bound result 53664975462199436607693229\n  Bound result 3548\n  Bound result 1615452280536191699053067\n  Bound result 637\n  Bound result 747\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 6.78s (6.78s CPU time)\n\nRan 3 test suites in 6.79s (6.83s CPU time): 47 tests passed, 0 failed, 0 skipped (47 total tests)\n","passed":true},{"durationMs":66,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"DongleToken.approve(address,uint256)\",\"DongleToken.transfer(address,uint256)\",\"DongleToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":6,\"README.md\":116,\"foundry.toml\":25,\"remappings.txt\":2,\"src/DongleToken.sol\":37,\"test/DongleToken.t.sol\":428,\"test/DongleTokenEdges.t.sol\":193,\"test/DongleTokenInvariant.t.sol\":200},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"331b9fe050ab67090891ea975515fc9d53e6892f2a35dfabe89fe3dc0f37b847","verifiedTreeHash":"11190145b4fb9939f0fa8cf110b1c9492c6e30d2","verifierVersion":"0.1.0+ead9012e"},{"checks":[{"durationMs":1500,"exitCode":0,"name":"build","output":"Compiling 26 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.40s\nCompiler run successful!\n","passed":true},{"durationMs":140,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 30 tests for test/DongleToken.t.sol:DongleTokenTest\n[PASS] testFuzz_anyDeployerReceivesWholeSupply(address) (runs: 256, μ: 21679, ~: 21679)\n[PASS] testFuzz_roundTripLeavesBalancesUnchanged(address,address,uint256) (runs: 256, μ: 195488, ~: 197017)\nLogs:\n  Bound result 35\n\n[PASS] testFuzz_transferBeyondBalanceReverts(uint256,uint256) (runs: 256, μ: 105207, ~: 105855)\nLogs:\n  Bound result 78\n  Bound result 24576\n\n[PASS] testFuzz_transferConservesSupply(address,uint256) (runs: 256, μ: 111629, ~: 111471)\nLogs:\n  Bound result 387653042778064245943380043\n\n[PASS] testFuzz_transferFromWithinAllowance(uint256,uint256) (runs: 256, μ: 209429, ~: 211154)\nLogs:\n  Bound result 78\n  Bound result 7\n\n[PASS] test_approveAndTransferFrom() (gas: 211622)\n[PASS] test_approveZeroSpenderReverts() (gas: 30818)\n[PASS] test_constructorEmitsSingleTransferFromZero() (gas: 10758)\n[PASS] test_deploysOnEmptyChainAtAnySalt() (gas: 954423)\n[PASS] test_infiniteAllowanceIsNotDecremented() (gas: 184308)\n[PASS] test_metadata() (gas: 58523)\n[PASS] test_mintsToWhoeverDeploys() (gas: 19173)\n[PASS] test_mintsWholeSupplyToDeployer() (gas: 44201)\n[PASS] test_noCommonAdminCallIncreasesSupply() (gas: 1054506)\n[PASS] test_noPayableSurface() (gas: 66919)\n[PASS] test_noPrivilegedHandMovesOrFreezesAHolder() (gas: 580266)\n[PASS] test_runtimeCodeHasNoDelegatecallOrSelfdestruct() (gas: 3180608)\n[PASS] test_runtimeFitsEip170() (gas: 8559)\n[PASS] test_supplyConstantsAgree() (gas: 25417)\n[PASS] test_swarmShareArrivesWholeAndIsClaimableWhole() (gas: 150974)\n[PASS] test_transferFromRevertsBeyondAllowance() (gas: 145592)\n[PASS] test_transferFromRevertsBeyondBalanceEvenWithAllowance() (gas: 144311)\n[PASS] test_transferFromWithoutApprovalReverts() (gas: 98219)\n[PASS] test_transferMovesExactAmount() (gas: 97121)\n[PASS] test_transferRevertsFromEmptyAccount() (gas: 33223)\n[PASS] test_transferRevertsOnInsufficientBalance() (gas: 98174)\n[PASS] test_transferToSelfKeepsBalance() (gas: 109512)\n[PASS] test_transferToZeroAddressReverts() (gas: 95478)\n[PASS] test_transferWholeBalance() (gas: 79441)\n[PASS] test_transferZeroAmountSucceeds() (gas: 83362)\nSuite result: ok. 30 passed; 0 failed; 0 skipped; finished in 21.43ms (110.16ms CPU time)\n\nRan 1 test suite in 23.52ms (21.43ms CPU time): 30 tests passed, 0 failed, 0 skipped (30 total tests)\n","passed":true},{"durationMs":63,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"DongleToken.approve(address,uint256)\",\"DongleToken.transfer(address,uint256)\",\"DongleToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":6,\"README.md\":116,\"foundry.toml\":25,\"remappings.txt\":2,\"src/DongleToken.sol\":37,\"test/DongleToken.t.sol\":428},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true},{"durationMs":797,"exitCode":0,"name":"slither","output":"slither: no results at low impact or above","passed":true},{"durationMs":323,"exitCode":0,"name":"aderyn","output":"[low] large-numeric-literal at src/DongleToken.sol:23: Large Numeric Literal","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"68957862c721095ba120a045f80556f6c62a96519eb8086ab7186bfc442afc0e","verifiedTreeHash":"4c8b6bdb6e2e08ead750e06b70f5e76a2bdc2f53","verifierVersion":"0.1.0+ead9012e"},{"checks":[{"durationMs":1434,"exitCode":0,"name":"build","output":"Compiling 26 files with Solc 0.8.26\nSolc 0.8.26 finished in 1.30s\nCompiler run successful!\n","passed":true},{"durationMs":150,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 30 tests for test/DongleToken.t.sol:DongleTokenTest\n[PASS] testFuzz_anyDeployerReceivesWholeSupply(address) (runs: 256, μ: 21679, ~: 21679)\n[PASS] testFuzz_roundTripLeavesBalancesUnchanged(address,address,uint256) (runs: 256, μ: 195488, ~: 197017)\nLogs:\n  Bound result 21055\n\n[PASS] testFuzz_transferBeyondBalanceReverts(uint256,uint256) (runs: 256, μ: 105207, ~: 105855)\nLogs:\n  Bound result 485535706825732327684972660\n  Bound result 357517715281813586278955794\n\n[PASS] testFuzz_transferConservesSupply(address,uint256) (runs: 256, μ: 111629, ~: 111471)\nLogs:\n  Bound result 255857973541951925921595440\n\n[PASS] testFuzz_transferFromWithinAllowance(uint256,uint256) (runs: 256, μ: 209429, ~: 211154)\nLogs:\n  Bound result 826065634193869372875781567\n  Bound result 661230739283185453507696406\n\n[PASS] test_approveAndTransferFrom() (gas: 211622)\n[PASS] test_approveZeroSpenderReverts() (gas: 30818)\n[PASS] test_constructorEmitsSingleTransferFromZero() (gas: 10758)\n[PASS] test_deploysOnEmptyChainAtAnySalt() (gas: 954423)\n[PASS] test_infiniteAllowanceIsNotDecremented() (gas: 184308)\n[PASS] test_metadata() (gas: 58523)\n[PASS] test_mintsToWhoeverDeploys() (gas: 19173)\n[PASS] test_mintsWholeSupplyToDeployer() (gas: 44201)\n[PASS] test_noCommonAdminCallIncreasesSupply() (gas: 1054506)\n[PASS] test_noPayableSurface() (gas: 66919)\n[PASS] test_noPrivilegedHandMovesOrFreezesAHolder() (gas: 580266)\n[PASS] test_runtimeCodeHasNoDelegatecallOrSelfdestruct() (gas: 3180608)\n[PASS] test_runtimeFitsEip170() (gas: 8559)\n[PASS] test_supplyConstantsAgree() (gas: 25417)\n[PASS] test_swarmShareArrivesWholeAndIsClaimableWhole() (gas: 150974)\n[PASS] test_transferFromRevertsBeyondAllowance() (gas: 145592)\n[PASS] test_transferFromRevertsBeyondBalanceEvenWithAllowance() (gas: 144311)\n[PASS] test_transferFromWithoutApprovalReverts() (gas: 98219)\n[PASS] test_transferMovesExactAmount() (gas: 97121)\n[PASS] test_transferRevertsFromEmptyAccount() (gas: 33223)\n[PASS] test_transferRevertsOnInsufficientBalance() (gas: 98174)\n[PASS] test_transferToSelfKeepsBalance() (gas: 109512)\n[PASS] test_transferToZeroAddressReverts() (gas: 95478)\n[PASS] test_transferWholeBalance() (gas: 79441)\n[PASS] test_transferZeroAmountSucceeds() (gas: 83362)\nSuite result: ok. 30 passed; 0 failed; 0 skipped; finished in 23.32ms (110.71ms CPU time)\n\nRan 1 test suite in 28.30ms (23.32ms CPU time): 30 tests passed, 0 failed, 0 skipped (30 total tests)\n","passed":true},{"durationMs":45,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"DongleToken.approve(address,uint256)\",\"DongleToken.transfer(address,uint256)\",\"DongleToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":6,\"README.md\":116,\"foundry.toml\":25,\"launch.json\":24,\"remappings.txt\":2,\"src/DongleToken.sol\":37,\"test/DongleToken.t.sol\":428},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"f4477aaa05c1d59259d79ca214a267d65842fe462bf5e1137c7e74bee340464c","verifiedTreeHash":"b8f2a7f1463a806ad0a2936be566fd6bb335b117","verifierVersion":"0.1.0+ead9012e"}]}