{"assessments":[],"deployments":[],"fuzz":[],"identity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"interpretation":"Records acceptance and evidence. Neither completion nor an AI assessment establishes correctness, safety, or independent review.","jobId":"f570f71a-96e5-4212-a435-bacc84357533","kind":"shape:chain","nodes":[{"acceptedSubmissionHash":"c08e5704d36b32d419f55f64c28af5bfcfe18ade623ff7f3321df1bcfae8156b","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_economics","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"44354de1b846c50e02c1a81cf6b0e12826647ffc31d778994135057551757cd1","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_flow","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"c10c9508f99179837585fca5c1ce13b853512cbd9f80ecb590b8c856f44e7da6","dependsOn":["build_contract_project","write_foundry_tests","manifest","audit_math","audit_permissions","audit_economics","audit_flow"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"af3aa01159bbf354f621cafa5c0006f6169e0938a8b015be508b7377dbf165bc","skillId":"audit-judge","tools":[]},"key":"audit_judge","kind":"code","role":"review","skillHash":"af3aa01159bbf354f621cafa5c0006f6169e0938a8b015be508b7377dbf165bc","skillId":"audit-judge","state":"accepted"},{"acceptedSubmissionHash":"6c02f3c5e01eddd4c1b0554183f7d37d6d7de44e45db98c3165e0c8de1cc042a","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_math","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"6e907164d9bab5d18553e874e24fea0d319ad9c91fc1059f42ce2102670d76c0","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","tools":[]},"key":"audit_permissions","kind":"code","role":"review","skillHash":"e5ac2cb1fd91a56aa40b16487fc230c48de0d317c8266140331dd3219bb40a85","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"40074208fc502fcb80894c1302e721d6d01e2a969ce05d75ce48aa64806edb18","dependsOn":[],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"d59561da3b378461b7c749f6bd5084477d44993aa94972ddea90f542535751df","skillId":"build-contract-project","tools":[]},"key":"build_contract_project","kind":"code","role":"implement","skillHash":"d59561da3b378461b7c749f6bd5084477d44993aa94972ddea90f542535751df","skillId":"build-contract-project","state":"accepted"},{"acceptedSubmissionHash":"ab15d2b2e0c149aa35180b7139c0025ea912cb221775b89ff0ca5a0c8ef9fbd2","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"tools":[]},"key":"manifest","kind":"code","role":"integrate","skillHash":null,"skillId":null,"state":"accepted"},{"acceptedSubmissionHash":"524fddf0fa081199fd4b03c878d894d9253d5f19048baf3fefa661d9d4bf472a","dependsOn":["build_contract_project"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"4c76766b00591dfe982fe85d3de589fdb2f810e5137c301155d1c5e36a1d3b23","skillId":"write-foundry-tests","tools":[]},"key":"write_foundry_tests","kind":"code","role":"tests","skillHash":"4c76766b00591dfe982fe85d3de589fdb2f810e5137c301155d1c5e36a1d3b23","skillId":"write-foundry-tests","state":"accepted"}],"objective":"This launch opens its pool with IMD's own hook, and a pool's hook is fixed when it opens. Only a hook launch puts your hook on its pool, and it deploys the hook and the token alone. Order a hook launch, or leave the pool's trades unrestricted.\n\nToken name: Hamster Hour\nToken symbol: HAMSTER","parentJobId":null,"planHash":"7f24d87e9259a5b18cc716c01410d1ba41e3cc9a63f65583ea2bcfd55c7cb6df","previousHash":"0000000000000000000000000000000000000000000000000000000000000000","projectId":"f570f71a-96e5-4212-a435-bacc84357533","publication":{"commit":null,"deliveredAt":null,"repoUrl":"https://github.com/identity-md-launches/launch-2314-hamster-hour"},"receiptIdentity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"registry":"0xb6d0a187b050fa5bb0b87033a203f37becf4a775","research":[],"schema":"identitymd-work-v1","signals":[{"agentId":"51039","feedbackHash":"22105b83cf6b3e2aeda86667a756de6266cf0c35b79dacea46e6670c9425d0b1","nodeKey":"audit_economics","submissionHash":"c08e5704d36b32d419f55f64c28af5bfcfe18ade623ff7f3321df1bcfae8156b","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52250","feedbackHash":"55615ce60fc887c40304a57707d927c2ea066a8c27c3467c7ce67c618c0cdcac","nodeKey":"audit_flow","submissionHash":"44354de1b846c50e02c1a81cf6b0e12826647ffc31d778994135057551757cd1","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51229","feedbackHash":"3dcf911b4ae54f37f5739e0adc5abf7baeba0790048ebccb98ec37db2212b921","nodeKey":"audit_judge","submissionHash":"c10c9508f99179837585fca5c1ce13b853512cbd9f80ecb590b8c856f44e7da6","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52478","feedbackHash":"c01537014c479b70b06845c6c42a9c82a23017948812b2a84db2a9be386772d4","nodeKey":"audit_math","submissionHash":"6c02f3c5e01eddd4c1b0554183f7d37d6d7de44e45db98c3165e0c8de1cc042a","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51194","feedbackHash":"093f99493413654b778afa90074b3bdaa85132b0f33ee9a65f282be2047ff8f9","nodeKey":"audit_permissions","submissionHash":"6e907164d9bab5d18553e874e24fea0d319ad9c91fc1059f42ce2102670d76c0","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52341","feedbackHash":"56be85e62ba38ed81c194aa1f6af15ba4c27fd076e644a52ac9bf52fdbfe0585","nodeKey":"build_contract_project","submissionHash":"40074208fc502fcb80894c1302e721d6d01e2a969ce05d75ce48aa64806edb18","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"52657","feedbackHash":"9cd084cdfe0424482847104f9e5599aed75fcb08bd89235bf1852f11bb368c1c","nodeKey":"manifest","submissionHash":"ab15d2b2e0c149aa35180b7139c0025ea912cb221775b89ff0ca5a0c8ef9fbd2","tag1":"verification:checks","tag2":"acceptance-v2","value":1},{"agentId":"50995","feedbackHash":"0d0d0552f9d4b2a412304e4df567b1f6e75f04132af32cb18762298b7822a233","nodeKey":"write_foundry_tests","submissionHash":"524fddf0fa081199fd4b03c878d894d9253d5f19048baf3fefa661d9d4bf472a","tag1":"verification:checks","tag2":"acceptance-v2","value":1}],"site":null,"snapshotHash":"f4ed37cb10b786b0e3a654ee028f94abd9ba5d77c7f7081f75d3ee22bb727457","state":"completed","submissions":[{"artifacts":[],"attempt":1,"bundleHash":"28ecc38c69700b190e5329e03ffa4ce12716328b16a0dbb7bfdcba2e35485cdb","device":"11f978978d1e9b55","findings":[],"hash":"40074208fc502fcb80894c1302e721d6d01e2a969ce05d75ce48aa64806edb18","nodeId":"d0a40b91-4b40-4e4d-884a-658993e66219","outcome":"completed","summary":"Implemented Hamster Hour (HAMSTER) with a fixed billion-token supply and an initialization-only hook that leaves trading unrestricted.\n\nVerified with Solidity 0.8.26:\n\n- `forge build`, including a clean offline build\n- `forge test`: **42 passed**, using the required fuzz seed\n- `forge fmt --check`\n\nDependencies are vendored. Deployment parameters, assumptions, operational responsibilities, and review limits are documented in `README.md` and `SECURITY_REVIEW.md`.","treeHash":"4512fd5aa476cf02bd601aced0350430a3da4764","usage":{"cachedInputTokens":2272640,"inputTokens":94322,"model":"gpt-6-astra","outputTokens":29078,"runtime":"codex","turns":6,"wallClockMs":890107}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"fc87c05048aca47d","findings":[{"citation":"resolved","description":"The review record states that every vendored file was hash-checked against lib/dependencies.json, and README.md:163 states the vendored files retain upstream content. Neither holds for the committed tree. lib/dependencies.json records the SHA-256 of each file as it was extracted from the pinned upstream archives (scripts/vendor_dependencies.py writes the digest of the raw archive bytes), but 17 of those files were subsequently reformatted in place (line wrapping to the repository's 120-column fmt setting, and in lib/v4-core/src/libraries/Hooks.sol:294-296 braces added around a single-statement `if`), so their digests no longer match the manifest or upstream: lib/v4-core/src/{PoolManager.sol, libraries/Hooks.sol, libraries/Pool.sol, libraries/SqrtPriceMath.sol, libraries/StateLibrary.sol, libraries/SwapMath.sol, libraries/TickBitmap.sol, libraries/TransientStateLibrary.sol, types/Currency.sol, types/Slot0.sol} and lib/forge-std/src/{Vm.sol, StdAssertions.sol, StdJson.sol, StdToml.sol, console.sol, interfaces/IERC7540.sol, interfaces/IMulticall3.sol}. I diffed every mismatched file against the pinned upstream revision ignoring whitespace: all differences are formatting only, and the five OpenZeppelin files the production token compiles from match upstream byte for byte, so the compiled HamsterToken and HamsterHook are built against upstream-equivalent sources. The defect is that the integrity evidence the project ships, and the check SECURITY_REVIEW.md says was executed, is false: a reviewer who runs the documented check gets 17 failures, and a future edit to a vendored file (including the Hooks library the hook's constructor validation and the manager's callback dispatch come from) would be indistinguishable from this drift. Fix: either re-run scripts/vendor_dependencies.py so lib/ holds the pristine archive bytes and keep the formatter off lib/ (add `ignore = [\"lib/**\"]` under [fmt] or exclude lib from the fmt run), or regenerate the files_sha256 entries from the formatted files and drop the 'retain upstream content' wording; then make the hash check part of the documented local verification so the claim on line 47 is true.","line":47,"path":"SECURITY_REVIEW.md","reproduction":"From the repository root run: python3 -I -c \"import json,hashlib,os; d=json.load(open('lib/dependencies.json')); bad=[(x['name'],r) for x in d for r,h in x['files_sha256'].items() if hashlib.sha256(open(os.path.join('lib',x['name'],r),'rb').read()).hexdigest()!=h]; print(len(bad)); print(*bad,sep='\\n')\". Expected per SECURITY_REVIEW.md:47 and README.md:163-165: 0 mismatches. Actual: 17 mismatches, e.g. lib/v4-core/src/libraries/Hooks.sol hashes to 4a84355f148a0aefb58ad854185630e20259be278845a7892f49c67bd9356f73 while lib/dependencies.json:33 records 297d577998cdede64d48b47b12f15e4f442eea032fbb9676bb3c2f89da89b83c (which is the digest of the file at Uniswap/v4-core@46c6834698c48bc4a463a86d8420f4eb1d7f3b75; `curl -sL https://raw.githubusercontent.com/Uniswap/v4-core/46c6834698c48bc4a463a86d8420f4eb1d7f3b75/src/libraries/Hooks.sol | sha256sum` reproduces 297d57...). `diff -w` of that upstream file against lib/v4-core/src/libraries/Hooks.sol shows only three re-wrapped statements (lines 97, 293 and 302 upstream), so the content is semantically upstream but the recorded provenance is not.","severity":"low","snippet":"- Vendored-source hashes checked against `lib/dependencies.json`.","title":"Vendored-dependency hash manifest does not describe the tree: 17 files under lib/ fail the SHA-256 check the local review claims to have run"}],"hash":"44354de1b846c50e02c1a81cf6b0e12826647ffc31d778994135057551757cd1","nodeId":"7812f525-7c64-4677-8887-e33225b650c7","outcome":"completed","summary":"The review is complete and recorded in `.imd-findings.json`. The production contracts hold up; the one substantiated defect is in the vendored-dependency provenance.\n\n**Outcome**\n\n- **No defect in `src/`.** The hook enables only `beforeInitialize`, refuses every caller but its immutable PoolManager, returns the right selector, holds no storage, and never participates in swaps, liquidity changes, donations, or the factory's zero-liquidity fee collect. The token is an unmodified OpenZeppelin v5.2.0 ERC-20 that mints the whole supply once to its deployer. The existing suite passes, and a scratch probe I wrote and then removed confirmed behaviour on native-ETH, zero-fee, max-fee and dynamic-fee pools, with the protected floor's CREATE2 deployment path.\n\n- **One low finding, periphery.** The local review claims every vendored file was hash-checked against the recorded manifest, and the README says vendored files retain upstream content. Running that check gives 17 mismatches across v4-core and forge-std. I diffed each mismatched file against the pinned upstream commit: every difference is formatting only, and the OpenZeppelin files the token compiles from are byte-identical to upstream. So the compiled contracts are built from upstream-equivalent code, but the shipped integrity evidence is false and would not catch a real edit to the Hooks library later. The finding gives the exact one-line command that reproduces the mismatches and the hash for Hooks.sol on both sides.\n\n**Coverage**\n\n| Entry point | Verdict |\n| --- | --- |\n| `HamsterToken.approve` / `transfer` / `transferFrom` | holds |\n| `HamsterToken` and `HamsterHook` constructors, `beforeInitialize`, `getHookPermissions` | holds |\n| Initialization-before-code, no-op-on-trading, statelessness invariants | holds |\n| Vendored `lib/` provenance | finding 1 |\n\nNo finding reaches critical or high, so no proof test is attached. The guides' areas I could not exercise are outside the code: the real launch factory's atomic deploy-and-initialize transaction and the mainnet IMD pair token, which the protected harness and fork rehearsal cover separately.","treeHash":null,"usage":{"cachedInputTokens":1802642,"inputTokens":354,"model":"claude-fable-5-1","outputTokens":26485,"runtime":"claude","turns":39,"wallClockMs":371686}},{"artifacts":[],"attempt":1,"bundleHash":"4fce369c050c69f364287675b21fc21f18df9becf2da51c584caaa2fbf0dcc61","device":"b5e3297a04468fd3","findings":[{"description":"beforeInitialize returns its selector for any PoolKey the PoolManager forwards, including fee = LPFeeLibrary.DYNAMIC_FEE_FLAG (0x800000). A dynamic-fee pool starts with lpFee 0 and only its hook can change it via updateDynamicLPFee; HamsterHook has no such path, so anyone can open a HAMSTER pool carrying this hook whose LP fee is fixed at zero. It does not affect the launch pool (the factory opens it atomically at 12500) and the README states the hook deliberately does not validate pool terms, so this is informational: a second, zero-fee HAMSTER pool bearing IMD's hook can exist beside the launch pool.","line":35,"path":"src/HamsterHook.sol","reproduction":"Deploy HamsterHook at a 0x2000-flag address, then manager.initialize(PoolKey(HAMSTER, pair, 0x800000, 60, hook), 2**96). Expected (if the hook were to restrict pools to the launch policy): revert. Actual: succeeds; getSlot0 returns lpFee 0, and no caller can ever raise it.","severity":"info","title":"HamsterHook accepts pools opened with the dynamic-fee flag, which then trade at a permanent 0% LP fee"}],"hash":"524fddf0fa081199fd4b03c878d894d9253d5f19048baf3fefa661d9d4bf472a","nodeId":"0e6206a7-db5a-4b9e-aec5-47ce5729acff","outcome":"completed","summary":"I added two test files on top of the existing 42 tests. `forge test` passes with the required seed: 52 tests, 0 failures, 0 skips. That count leaves out my own scratch check, which is deleted before submission.\n\n**`test/HamsterPoolInvariant.t.sol`** holds the invariant tests for value held in the pool. A handler runs random sequences of swaps (exact-in and exact-out, both directions, random hook data), liquidity adds and removals, the factory's zero-liquidity fee collect, donations and time passing. Every action runs on the hooked Hamster pool and also on an identical pool with no hook, through twin actors. Over 64 runs × 48 calls (3,072 calls, 0 reverts) these held after every call:\n- Both pools stay identical: price, tick, liquidity and fee growth. The LP fee stays at 12500 and the pool's liquidity equals the total the test tracked.\n- Each pair of twin actors ends with the same balances in both tokens.\n- The hook never holds tokens, ETH, claims or open debts, and the PoolManager is left locked with nothing unsettled and no ETH.\n- The 1e27 HAMSTER supply always adds up across every holder.\n- At the end of each sequence, every position can be fully withdrawn from both pools, and the twins still match.\n\n**`test/HamsterLaunch.t.sol`** does the launch in one transaction through a helper contract that deploys the token and the hook and opens the pool, as the factory does:\n- **Launch and hook attachment:**\n  - The launch opens the pool with the hook in its pool key, and the full supply goes to the deployer.\n  - The same pool without the hook is a different pool, and the launch pool can't be opened a second time.\n- **Failed launches leave nothing behind:**\n  - A salt that gives the wrong hook address reverts the whole launch.\n  - So do pool terms the PoolManager rejects (tick spacing 0, a fee over 100%, a price out of range). No token or hook is left deployed.\n  - Reusing the same salt reverts.\n- **Opening the pool early:**\n  - Someone who predicts the token and hook addresses can't open the launch pool before the launch.\n  - If the launch were split across two transactions, anyone could open the pool first at a price they choose. The hook relies on the launch being one transaction, as the README says.\n- **Hook behaviour:**\n  - A fuzz test shows the hook's only callback returns the right answer to the PoolManager for any input and keeps no state.\n  - The runtime code of both the hook and the token has no SELFDESTRUCT, DELEGATECALL or CALLCODE.\n\n**One informational finding**, written to `.imd-findings.json`: the hook accepts a pool opened with the dynamic-fee flag. That pool's LP fee is stuck at 0%, because only the hook could raise it and this hook can't. So anyone can open a second, zero-fee HAMSTER pool carrying IMD's hook. It doesn't touch the launch pool, which the factory opens atomically at the 1.25% fee. I confirmed the behaviour with a scratch test and reported it rather than writing a test that treats it as correct.\n\nI found no defect that blocks the launch. Nothing outside `test/` was changed, and nothing has been committed.","treeHash":"4f6cc8eb6420888009fff7a7971969f2c8ee3ba9","usage":{"cachedInputTokens":1276681,"inputTokens":34,"model":"claude-opus-5-5","outputTokens":21408,"runtime":"claude","turns":17,"wallClockMs":311716}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"2bdd77125ec75e6c","findings":[{"citation":"resolved","description":"README.md:163-165 and SECURITY_REVIEW.md:47 state that the vendored sources were hash-checked against lib/dependencies.json. The hashes recorded there are the upstream file hashes (e.g. src/libraries/Hooks.sol = 297d5779...; the raw file at Uniswap/v4-core@46c6834 hashes to exactly that), but the checked-in copies of 10 v4-core files and 7 forge-std files were run through a formatter after download and hash differently (lib/v4-core/src/libraries/Hooks.sol hashes to 4a84355f...). A token-level comparison against upstream shows every one of the 10 v4-core differences is whitespace/brace-wrapping only, so the pool math and hook-dispatch code the tests exercise are semantically unchanged, and the two production contracts do not import any of the mismatched files except Hooks.sol (interfaces/types they use are unchanged). This is a documentation/reproducibility inconsistency, not a vulnerability: the author should either re-vendor the unformatted upstream bytes or regenerate dependencies.json from the checked-in files so the stated verification is actually true.","line":164,"path":"README.md","reproduction":"sha256sum lib/v4-core/src/libraries/Hooks.sol -> 4a84355f148a0aefb58ad854185630e20259be278845a7892f49c67bd9356f73; recorded in lib/dependencies.json (\"src/libraries/Hooks.sol\") -> 297d577998cdede64d48b47b12f15e4f442eea032fbb9676bb3c2f89da89b83c. Same for lib/v4-core/src/PoolManager.sol (recorded 3b6ab111..., actual b3c68cb5...), Pool.sol, SqrtPriceMath.sol, StateLibrary.sol, SwapMath.sol, TickBitmap.sol, TransientStateLibrary.sol, types/Currency.sol, types/Slot0.sol and 7 forge-std files. Expected: every files_sha256 entry matches the checked-in file as the docs claim. Actual: 17 of 86 entries mismatch. Diff of Hooks.sol with all whitespace removed differs only by `{ }` braces around one return statement, i.e. forge fmt output.","severity":"info","snippet":"SHA-256 digests are recorded in `lib/dependencies.json`. The optional maintenance","title":"Recorded vendored-source hashes do not match 17 checked-in lib/ files (reformatted after download)"}],"hash":"6c02f3c5e01eddd4c1b0554183f7d37d6d7de44e45db98c3165e0c8de1cc042a","nodeId":"e2a92f96-55be-4ddb-8cad-5008a8a1fc55","outcome":"completed","summary":"The review is complete and `.imd-findings.json` is written. No tracked file was changed; the scratch test lives under the gitignored test/scratch directory.\n\n**Result: no math, boundary or numerical-gap defect in the production code.** The two contracts contain almost no arithmetic to fail. HamsterToken is a byte-identical OpenZeppelin v5.2.0 ERC-20 with a single constructor mint of 1e27 units. HamsterHook enables only beforeInitialize, performs no arithmetic, and defers every range check to the PoolManager.\n\n**What I verified in my area**\n\n- **Token arithmetic edges.** Full-supply transfer, zero and self transfers, allowance exactly equal to the amount, allowance one short, max allowance never decrementing, max-minus-one decrementing, and balance-plus-one reverting with no partial state. The project's own 8,192-call invariant also holds.\n- **Supply versus v4 limits.** The supply fits comfortably in v4's int128 delta fields. Seeding seventy percent of supply single-sided into a full-range position at a price near the policy's 2,500 IMD market cap, then buying and running the factory's zero-liquidity fee collect, all succeed.\n- **Hook flag math.** The permission bit, mask and README values agree with the vendored Hooks library, which I confirmed is token-identical to upstream at the pinned commit.\n- **Boundary enumeration.** Pool initialization through the hook at fee 0, 12500, the maximum LP fee and the dynamic flag, at tick spacing 1, 60 and 32767, and at the minimum and maximum valid prices all pass. Out-of-range prices are rejected by core, not the hook. The hook has no payable path, receive, fallback, external call, bytes decoding or sentinel branch.\n\n**One informational finding, outside my area.** The README and SECURITY_REVIEW claim the vendored sources were hash-checked against lib/dependencies.json, but 17 of the 86 recorded hashes do not match the checked-in files. The recorded values are the upstream hashes. The checked-in copies were reformatted after download. I compared all ten affected v4-core files to upstream with whitespace stripped and every difference is formatting only, so the test results stand. The author should re-vendor the raw bytes or regenerate the hash file.\n\n**Coverage record.** All three listed entry points (approve, transfer, transferFrom) are marked holds, plus five invariant rows covering the token constructor, the hook constructor, the beforeInitialize callback, the hook's receive/fallback surface, and the supply-versus-v4-limits check. Nothing was left unreached.","treeHash":null,"usage":{"cachedInputTokens":1170020,"inputTokens":354,"model":"claude-fable-5-1","outputTokens":21759,"runtime":"claude","turns":28,"wallClockMs":494963}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"2f1d693f218c1c18","findings":[{"citation":"resolved","description":"Trust-gap / provenance: lib/dependencies.json records the upstream digest for each vendored file, and SECURITY_REVIEW.md:47 states \"Vendored-source hashes checked against `lib/dependencies.json`.\" while README.md says vendored files \"retain upstream licenses and content\". 17 vendored files do not match their recorded digests: v4-core src/PoolManager.sol, src/libraries/{Hooks,Pool,SqrtPriceMath,StateLibrary,SwapMath,TickBitmap,TransientStateLibrary}.sol, src/types/{Currency,Slot0}.sol, and forge-std src/{StdAssertions,StdJson,StdToml,Vm,console}.sol, src/interfaces/{IERC7540,IMulticall3}.sol. Diffed against the upstream archive at the pinned commit 46c6834 (archive sha256 669c7c79... equals the recorded archive_sha256), every difference is formatter reflow (line wrapping, `.toInt128()` / `.revertWith(` moved to a new line, braces added around the one-line early return in Hooks.afterSwap) with no semantic change; OpenZeppelin (6 files) and solmate (2 files) match exactly. Building HamsterHook and HamsterToken against the upstream v4-core sources gives byte-identical creation and runtime bytecode, so the launch contracts are unaffected. The defect is that the repository's own integrity record is wrong: anyone, including the release check SECURITY_REVIEW lists, who re-checks lib/ against dependencies.json gets 17 mismatches and cannot tell this reformatting apart from tampering with PoolManager/Hooks, which the hook relies on for validateHookPermissions.","line":33,"path":"lib/dependencies.json","reproduction":"From the repository root: node -e \"const fs=require('fs'),c=require('crypto');for(const d of JSON.parse(fs.readFileSync('lib/dependencies.json')))for(const[f,h]of Object.entries(d.files_sha256)){const a=c.createHash('sha256').update(fs.readFileSync('lib/'+d.name+'/'+f)).digest('hex');if(a!==h)console.log(d.name+'/'+f)}\". Expected (per SECURITY_REVIEW.md:47): no output. Actual: 17 paths printed; e.g. `sha256sum lib/v4-core/src/libraries/Hooks.sol` = 4a84355f148a0aefb58ad854185630e20259be278845a7892f49c67bd9356f73 vs recorded 297d577998cdede64d48b47b12f15e4f442eea032fbb9676bb3c2f89da89b83c. `diff -w` against the upstream archive https://codeload.github.com/Uniswap/v4-core/tar.gz/46c6834698c48bc4a463a86d8420f4eb1d7f3b75 shows only reflow (upstream Hooks.sol lines 97, 293, 302). Fix: restore the upstream bytes (re-run scripts/vendor_dependencies.py) and keep the formatter off lib/, or re-record the digests and drop the \"upstream content\" claim.","severity":"low","snippet":"      \"src/libraries/Hooks.sol\": \"297d577998cdede64d48b47b12f15e4f442eea032fbb9676bb3c2f89da89b83c\",","title":"Recorded vendored-source SHA-256 digests do not match 17 files in lib/ (v4-core Hooks.sol, PoolManager.sol among them), contradicting the README/SECURITY_REVIEW provenance claim"}],"hash":"6e907164d9bab5d18553e874e24fea0d319ad9c91fc1059f42ce2102670d76c0","nodeId":"b41f3072-6b1e-4852-beca-1bbeb149673f","outcome":"completed","summary":"The review found no access-control, trust-gap or asymmetry defect in either contract. It found one low-severity provenance problem outside the contracts, now recorded in `.imd-findings.json`. No other file in the repository was changed; all builds and probes ran in a copy under /tmp, which I deleted afterwards.\n\n**Finding 1 (low): the recorded dependency hashes are wrong for 17 vendored files.** `lib/dependencies.json:33` and the entries like it don't match what is on disk. `SECURITY_REVIEW.md:47` says these hashes were checked, and the README says the vendored files keep their upstream content. In fact 10 v4-core files (including `Hooks.sol` and `PoolManager.sol`) and 7 forge-std files differ from their recorded hashes. I compared them with the upstream archive at the pinned commit (whose archive hash matches the record): every difference is reformatting only, with no change in meaning. OpenZeppelin and solmate match exactly. Built from either the vendored or the upstream v4-core source, the two production contracts come out with identical creation and runtime bytecode, so the launch itself is unaffected. The problem is that anyone re-checking `lib/` gets 17 mismatches and can't tell reformatting from tampering. The finding includes a one-line command that lists the mismatches.\n\n**What holds:**\n- **`HamsterToken`** is an unmodified OpenZeppelin 5.2.0 ERC-20 that mints the full supply once to whoever deploys it. It has no owner, mint, pause, fee or blocklist. `approve`, `transfer` and `transferFrom` behave as standard; I traced their checks, state changes and failure paths.\n- **`HamsterHook`** turns on only `beforeInitialize`, which rejects any caller other than its fixed pool manager (`src/HamsterHook.sol:36`). Because that callback is on, nobody can open the launch pool before the hook's code exists, and the factory deploys the hook and opens the pool in one transaction.\n- The hook keeps no state, so pools other people open with it can't affect the launch pool.\n- The remove-liquidity callbacks are off, so the factory's fee collection can't be blocked.\n- Neither contract has a role that could be escalated, given up, or seized by front-running.\n\n**Checks run:** `forge build` and `forge test` pass, 42 of 42. The coverage record has a `holds` row for each of the three token entry points and five rows for the hook-related guarantees above. Because nothing reached high severity, none of the findings carry a Foundry proof test.\n\n**Not covered:** I could not run IMD's own admission tests, because they need harness files that aren't in this tree. Nothing was tested against a mainnet fork.","treeHash":null,"usage":{"cachedInputTokens":1553579,"inputTokens":40,"model":"claude-opus-5-5","outputTokens":15505,"runtime":"claude","turns":20,"wallClockMs":211519}},{"artifacts":[],"attempt":1,"bundleHash":"272702100aac229906d47c3c3e9f47f854801db86b93fb3fc6f57cf993d5024d","device":"edf1925726a58c54","findings":[],"hash":"ab15d2b2e0c149aa35180b7139c0025ea912cb221775b89ff0ca5a0c8ef9fbd2","nodeId":"10f8840b-aac2-42d6-a92e-9b73ef70c99a","outcome":"completed","summary":"Created [launch.json](/home/seat/.identitymd/work/f570f71a-96e5-4212-a435-bacc84357533/10f8840b-aac2-42d6-a92e-9b73ef70c99a/launch.json) matching the contracts, constructor arguments, permissions and required pool values.\n\nManifest checks and `forge build` passed. `forge test` passed all 42 tests with the supplied fuzz seed. Only `launch.json` is included in the deliverable.","treeHash":"79206991033ff2f20212ed8c369c6452690df506","usage":{"cachedInputTokens":473344,"inputTokens":43398,"model":"gpt-6-astra","outputTokens":3697,"runtime":"codex","turns":3,"wallClockMs":114827}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"9ab27edcfd62be02","findings":[],"hash":"c08e5704d36b32d419f55f64c28af5bfcfe18ade623ff7f3321df1bcfae8156b","nodeId":"c6f829b8-12ca-45c9-a2e5-8630709d9024","outcome":"completed","summary":"The review is complete and `.imd-findings.json` is written with an empty findings list and eight coverage rows. No file in the tree was changed. The scratch directory was removed after use.\n\n**Result: no reproducible defect in the assigned area.** The deliverable is a plain OpenZeppelin v5.2.0 ERC-20 with one constructor mint and a hook that implements only `beforeInitialize`. Neither contract moves value, holds state, takes a fee, returns a delta or exposes a privileged role, so the Economic Security, Invariant and Flow Gap failure modes have no surface to act on.\n\nWhat I verified, with evidence:\n\n- **Token conservation and exactness.** The vendored OpenZeppelin files are byte-identical to the pinned upstream commit, so `transfer`, `transferFrom` and `approve` are the stock implementation. The project's invariant campaign and the verifier's own token floor test both pass against the compiled creation code with the policy supply and 18 decimals.\n- **Supply is truly fixed.** One mint of 1e27 to the deployer, no mint, burn, owner, pause or upgrade path, and transfers to the zero address revert, so supply can neither grow nor shrink. The aderyn large-literal lead is just that constant, and it equals one billion tokens at 18 decimals as the README states.\n- **Hook has no economic surface.** Only the initialization flag is set and implemented. No swap, liquidity or donate callback runs, so the factory's zero-liquidity fee collect and full removal pass untouched, and swaps match an unhooked pool exactly.\n- **Pre-deployment pool squat is blocked.** A codeless predicted hook returns zero bytes, which `Hooks.callHook` rejects, and the project test reproduces that revert then succeeds once the hook exists.\n- **Vendored v4-core is upstream.** Ten files differ from the pinned commit, but a whitespace-stripped comparison shows only formatter reflow and one pair of braces around a single-statement `if`. The permission validator compiled into the production hook is therefore the real one.\n\nOne trust assumption worth the judge's note, not a finding: the hook accepts any initializer and any pool key after deployment. A third party could open a second pool with it, including a dynamic-fee key whose LP fee stays zero, but they can do the same with no hook at all, and the launch pool is unaffected.\n\nNot reached: the hook and owner floor tests could not be run locally because they import mocks and a `HookFlags` library that live in the verifier toolchain, not this repository. The project's own tests cover the same behaviors.","treeHash":null,"usage":{"cachedInputTokens":991851,"inputTokens":354,"model":"claude-fable-5-1","outputTokens":17990,"runtime":"claude","turns":33,"wallClockMs":311760}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"4199bf0c80a9d6cf","findings":[{"citation":"resolved","description":"Merged from audit_flow, audit_permissions and audit_math (same root cause). lib/dependencies.json records, per file, the SHA-256 of the pristine upstream file (I fetched src/libraries/Hooks.sol, src/PoolManager.sol, src/libraries/Pool.sol, src/libraries/SwapMath.sol and src/types/Currency.sol from Uniswap/v4-core@46c6834698c48bc4a463a86d8420f4eb1d7f3b75 and their digests equal the recorded values, e.g. Hooks.sol = 297d5779...). The checked-in copies of 10 v4-core files and 7 forge-std files were reformatted after vendoring (forge fmt at line_length 120; `forge fmt --check` passes on the tree) so their digests differ. `diff -w` against upstream shows only line re-wrapping and, in lib/v4-core/src/libraries/Hooks.sol lines 294-296, braces added around a single-statement `if` in afterSwap; no semantic change. The six OpenZeppelin files the production token compiles from (contracts/token/ERC20/ERC20.sol = c322867b...) and both solmate files match upstream byte for byte, so HamsterToken and HamsterHook are built from upstream-equivalent sources. The defect is the integrity evidence the project ships: SECURITY_REVIEW.md line 47 says the hash check was executed and README.md lines 163-164 say vendored files retain upstream content, yet anyone who runs that check gets 17 failures and cannot distinguish this drift from an edit to Hooks.sol (whose validateHookPermissions the hook's constructor relies on) or PoolManager.sol. Not a vulnerability in the deployed contracts. Fix: either restore the pristine bytes (re-run scripts/vendor_dependencies.py) and exclude lib/ from the formatter (`ignore = [\"lib/**\"]` under [fmt]), or regenerate files_sha256 from the formatted files and drop the 'retain upstream content' wording; then make the check part of the documented verification so line 47 is true.","line":47,"path":"SECURITY_REVIEW.md","reproduction":"From the repository root: python3 -I -c \"import json,hashlib,os; d=json.load(open('lib/dependencies.json')); bad=[(x['name'],r) for x in d for r,h in x['files_sha256'].items() if hashlib.sha256(open(os.path.join('lib',x['name'],r),'rb').read()).hexdigest()!=h]; print(len(bad)); print(*bad,sep='\\n')\". Expected per SECURITY_REVIEW.md:47: 0. Actual: 17 (v4-core src/PoolManager.sol, src/libraries/{Hooks,Pool,SqrtPriceMath,StateLibrary,SwapMath,TickBitmap,TransientStateLibrary}.sol, src/types/{Currency,Slot0}.sol; forge-std src/{StdAssertions,StdJson,StdToml,Vm,console}.sol, src/interfaces/{IERC7540,IMulticall3}.sol). sha256sum lib/v4-core/src/libraries/Hooks.sol = 4a84355f148a0aefb58ad854185630e20259be278845a7892f49c67bd9356f73, recorded at lib/dependencies.json:33 = 297d577998cdede64d48b47b12f15e4f442eea032fbb9676bb3c2f89da89b83c, which is the digest of https://raw.githubusercontent.com/Uniswap/v4-core/46c6834698c48bc4a463a86d8420f4eb1d7f3b75/src/libraries/Hooks.sol. `diff -w` of that upstream file against the checked-in one shows three re-wrapped statements only (upstream lines 97, 293, 302).","severity":"low","snippet":"- Vendored-source hashes checked against `lib/dependencies.json`.","title":"Shipped provenance record is false: 17 of 86 vendored files under lib/ do not match the SHA-256 digests in lib/dependencies.json that SECURITY_REVIEW.md and README.md claim were checked"},{"citation":"resolved","description":"From write_foundry_tests; reproduced. beforeInitialize returns its selector for any PoolKey the PoolManager forwards, including fee = LPFeeLibrary.DYNAMIC_FEE_FLAG (0x800000). A dynamic-fee pool starts at lpFee 0 and only its hook may call PoolManager.updateDynamicLPFee; HamsterHook has no such path, so a second HAMSTER pool carrying IMD's hook can exist whose LP fee is fixed at zero forever. The launch pool is unaffected: the factory opens it atomically at the manifest's 12500 and a pool's fee is part of its PoolId. README.md lines 41-50 and SECURITY_REVIEW.md lines 31-35 document that the hook deliberately validates no pool terms, and the hook is stateless, so this is a documented design choice rather than a defect. Recorded so the author can decide whether to reject the dynamic-fee flag (and optionally any fee other than 12500) in beforeInitialize; doing so would not affect the launch pool.","line":35,"path":"src/HamsterHook.sol","reproduction":"Deploy HamsterHook via CREATE2 at an address whose low 14 bits are 0x2000 with a fresh PoolManager, then from any address call manager.initialize(PoolKey(currency0=min(HAMSTER, 0xd34a...63b7), currency1=max(...), fee=0x800000, tickSpacing=60, hooks=hook), 79228162514264337593543950336). Expected if the hook enforced launch terms: revert. Actual: succeeds; StateLibrary.getSlot0(poolId) returns lpFee 0, and manager.updateDynamicLPFee(key, 12500) from any caller reverts with UnauthorizedDynamicLPFeeUpdate because only the hook may call it and the hook never does. Verified with a scratch Foundry test (test passes on current code, i.e. the behaviour is as described).","severity":"info","snippet":"    function beforeInitialize(address, PoolKey calldata, uint160) external view returns (bytes4) {","title":"HamsterHook accepts a pool opened with the dynamic-fee flag, which then trades at a permanent 0% LP fee that nobody can change"},{"citation":"resolved","description":"The README was written before the manifest assignment (commit f9e04b5) committed launch.json at the root. The manifest itself is consistent with the code: constructorArgs [\"$poolManager\"] matches constructor(IPoolManager), permissions [\"beforeInitialize\"] matches getHookPermissions, token has no constructor arguments, pairedCurrency is lowercase, fee 12500 is accepted by the hook (it checks nothing), initialPrice is a decimal string, notes are 803 characters. Only the README sentence is now wrong, and a reader following it would conclude the manifest is missing. Fix: reword README.md line 63-65 to point at launch.json.","line":64,"path":"README.md","reproduction":"`git ls-files launch.json` prints launch.json and `cat launch.json` shows the univ4_hook manifest for HamsterHook/HamsterToken; README.md line 64 says the repository deliberately contains no launch.json. Expected: README describes the tree. Actual: contradicts it.","severity":"info","snippet":"This repository deliberately contains no `launch.json`, broadcaster, private-key","title":"README states the repository contains no launch.json, but the accepted manifest step added one at the repository root"}],"hash":"c10c9508f99179837585fca5c1ce13b853512cbd9f80ecb590b8c856f44e7da6","nodeId":"2c4664f3-28b1-4f88-8144-2d94b1feaad1","outcome":"completed","summary":"The review is complete. The findings file is written and valid, the scratch test is removed, and the working tree has no stray files.\n\n**Outcome.** No defect in the deployable code. The three specialist hash reports were one root cause and are merged into one low finding. The tester's dynamic-fee note reproduces and is kept as informational. One stale README line is added as informational.\n\n**Findings written to `.imd-findings.json`:**\n\n- **Low, provenance record is false.** 17 of 86 vendored files under lib/ do not match the SHA-256 digests the repository records, while SECURITY_REVIEW.md line 47 says that check was run. I fetched five of the drifted v4-core files from the pinned upstream commit. The recorded digests are the pristine upstream hashes, and the checked-in copies differ only by formatter line wrapping plus braces around one single-statement `if` in Hooks.sol. The OpenZeppelin ERC20 the token compiles from matches upstream byte for byte, so the deployed contracts are unaffected. Fix is to re-vendor and keep the formatter off lib/, or regenerate the digests and drop the \"upstream content\" wording.\n- **Info, dynamic-fee pools accepted.** A scratch test opened a HAMSTER pool with the dynamic-fee flag on this hook. It opened at a zero LP fee, and no caller can raise it because the hook never calls updateDynamicLPFee. The launch pool is unaffected and the README documents that the hook validates no pool terms, so this is a design choice for the author to confirm.\n- **Info, README contradicts the tree.** README.md line 64 says the repository deliberately contains no launch.json. The manifest step committed one. The manifest itself matches the code: one constructor word written as `$poolManager`, permissions matching getHookPermissions, lowercase paired currency, fee 12500 accepted.\n\n**Coverage.** All three listed entry points hold. They are unmodified OpenZeppelin v5.2.0 ERC-20 functions with a single constructor mint to the deployer and no admin path. I added rows for the hook's constructor and callback, the manifest, and the factory's zero-liquidity fee collect, which the hook cannot block since no removal or swap callback is enabled.\n\n**Checks run.** Full project suite passed with 52 tests and no failures. `forge fmt --check` passed. The slither lead was empty and the aderyn large-literal lead is an underscore-separated constant, not a defect.","treeHash":null,"usage":{"cachedInputTokens":737352,"inputTokens":290,"model":"claude-fable-5-1","outputTokens":14294,"runtime":"claude","turns":25,"wallClockMs":244719}}],"verification":[{"checks":[{"durationMs":26132,"exitCode":0,"name":"build","output":"Compiling 81 files with Solc 0.8.26\nSolc 0.8.26 finished in 25.99s\nCompiler run successful!\n","passed":true},{"durationMs":930,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 14 tests for test/HamsterToken.t.sol:HamsterTokenTest\n[PASS] testFuzz_transferConservesSupply(address,uint256) (runs: 256, μ: 88284, ~: 88641)\nLogs:\n  Bound result 570618\n\n[PASS] test_approveEmitsEventAndTransferFromSpendsAllowance() (gas: 145659)\n[PASS] test_constructorEmitsSingleMintTransfer() (gas: 5947)\n[PASS] test_factoryReceivesEverythingAndOriginReceivesNothing() (gas: 223669)\n[PASS] test_failedTransferFromRestoresAllowance() (gas: 97504)\n[PASS] test_maximumAllowanceRetainsStandardInfiniteApprovalBehavior() (gas: 119998)\n[PASS] test_metadataAndExactFixedSupply() (gas: 50391)\n[PASS] test_neitherDeployerNorHolderHasMintBurnPauseOrUpgradeEntryPoints() (gas: 449317)\n[PASS] test_revokedApprovalCannotSpend() (gas: 115685)\n[PASS] test_transferEmitsEventAndMovesExactAmount() (gas: 87403)\n[PASS] test_transferFailsOnInsufficientBalance() (gas: 52354)\n[PASS] test_transferFromCannotExceedAllowance() (gas: 101670)\n[PASS] test_zeroAndSelfTransfersAreStandardERC20() (gas: 96479)\n[PASS] test_zeroRecipientAndZeroSpenderRevert() (gas: 53965)\nSuite result: ok. 14 passed; 0 failed; 0 skipped; finished in 6.39ms (10.73ms CPU time)\n\nRan 15 tests for test/HamsterHook.t.sol:HamsterHookTest\n[PASS] testFuzz_callbackRejectsEveryOtherCaller(address) (runs: 256, μ: 20705, ~: 20705)\n[PASS] testFuzz_initializationAcceptsTokenInEitherCurrencySlot(address) (runs: 256, μ: 82129, ~: 82177)\n[PASS] testFuzz_initializerAndValidOpeningPriceAreNotRestricted(address,uint160) (runs: 256, μ: 86890, ~: 86891)\nLogs:\n  Bound result 1461446703485210103287273052203988822374428844594\n\n[PASS] test_allDisabledCallbacksRevertEvenFromManager() (gas: 260019)\n[PASS] test_anotherManagerCannotInitializeUsingThisHook() (gas: 3857129)\n[PASS] test_callbackReturnsCorrectSelectorToManager() (gas: 22718)\n[PASS] test_constructorDoesNotCallOrRequireCodeAtManager() (gas: 4066427)\n[PASS] test_constructorRejectsWrongPermissionBits() (gas: 8652)\n[PASS] test_constructorRejectsZeroManager() (gas: 4076)\n[PASS] test_duplicateInitializationReverts() (gas: 110181)\n[PASS] test_factoryHasNoOwnerPauseOrUpgradeControls() (gas: 127113)\n[PASS] test_factoryOpensLaunchPolicyPool() (gas: 85048)\n[PASS] test_initializationBeforeHookDeploymentFailsThenSucceedsAfterDeployment() (gas: 13749159)\n[PASS] test_multiplePoolsCannotConsumeSharedInitializationState() (gas: 148168)\n[PASS] test_onlyInitializationPermissionIsEnabledAndMatchesAddress() (gas: 21739)\nSuite result: ok. 15 passed; 0 failed; 0 skipped; finished in 65.71ms (72.64ms CPU time)\n\nRan 12 tests for test/HamsterPool.t.sol:HamsterPoolTest\n[PASS] testFuzz_swapsMatchUnhookedPool(bool,bool,uint96,bytes) (runs: 256, μ: 455522, ~: 452948)\nLogs:\n  Bound result 9999999999999999010188\n\n[PASS] test_anotherTraderCanBuyAndSellWithArbitraryHookData() (gas: 1636713)\n[PASS] test_exactInputAndOutputBuysAndSellsMatchUnhookedPool() (gas: 1541699)\n[PASS] test_factoryCanRemoveAllItsLiquidityAfterTrading() (gas: 419249)\n[PASS] test_factoryCollectsBothCurrenciesWithZeroLiquidityChange() (gas: 689207)\n[PASS] test_failedPaymentRollsBackEntireSwap() (gas: 1441698)\n[PASS] test_invalidPriceLimitRevertsWithoutChangingBalances() (gas: 183062)\n[PASS] test_otherProvidersCanAddDonateCollectAndRemove() (gas: 1940861)\n[PASS] test_swapStillRequiresAnUnlockedManager() (gas: 40867)\n[PASS] test_tradingRemainsOpenAcrossHourDayAndBlockChanges() (gas: 1473535)\n[PASS] test_unsettledSwapCannotBypassCoreAccounting() (gas: 638712)\n[PASS] test_zeroAmountSwapIsRejectedByCore() (gas: 50030)\nSuite result: ok. 12 passed; 0 failed; 0 skipped; finished in 68.16ms (52.10ms CPU time)\n\nRan 1 test for test/HamsterTokenInvariant.t.sol:HamsterTokenInvariantTest\n[PASS] invariant_supplyAndSumOfBalancesNeverChange() (runs: 128, calls: 8192, reverts: 0)\n\n╭--------------+--------------+-------+---------+----------╮\n| Contract     | Selector     | Calls | Reverts | Discards |\n+==========================================================+\n| TokenHandler | approve      | 2745  | 0       | 0        |\n|--------------+--------------+-------+---------+----------|\n| TokenHandler | transfer     | 2726  | 0       | 0        |\n|--------------+--------------+-------+---------+----------|\n| TokenHandler | transferFrom | 2721  | 0       | 0        |\n╰--------------+--------------+-------+---------+----------╯\n\nLogs:\n  Bound result 0\n  Bound result 100000000000000000000\n  Bound result 1000000000000000000000\n  Bound result 4\n  Bound result 0\n  Bound result 0\n  Bound result 750\n  Bound result 7000000000000000000\n  Bound result 0\n  Bound result 0\n  Bound result 249999093000000000000000001\n  Bound result 0\n  Bound result 255\n  Bound result 12500\n  Bound result 0\n  Bound result 13000000000000000000\n  Bound result 5\n  Bound result 5623\n  Bound result 396\n  Bound result 3384\n  Bound result 1129\n  Bound result 249999079999999999999978238\n  Bound result 4940\n  Bound result 0\n  Bound result 10\n  Bound result 0\n  Bound result 1\n  Bound result 4987\n  Bound result 614627446238665907366545667\n  Bound result 12501\n  Bound result 0\n  Bound result 24\n  Bound result 60\n  Bound result 11\n  Bound result 1474\n  Bound result 0\n  Bound result 4\n  Bound result 16728\n  Bound result 111\n  Bound result 100000000000000000000\n  Bound result 4338\n  Bound result 0\n  Bound result 864628359238665907366551405\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 774.15ms (772.37ms CPU time)\n\nRan 4 test suites in 775.83ms (914.41ms CPU time): 42 tests passed, 0 failed, 0 skipped (42 total tests)\n","passed":true},{"durationMs":112,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"HamsterToken.approve(address,uint256)\",\"HamsterToken.transfer(address,uint256)\",\"HamsterToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"LICENSE\":23,\"README.md\":171,\"SECURITY_REVIEW.md\":67,\"foundry.toml\":23,\"remappings.txt\":4,\"scripts/vendor_dependencies.py\":91,\"src/HamsterHook.sol\":39,\"src/HamsterToken.sol\":14,\"test/HamsterHook.t.sol\":176,\"test/HamsterPool.t.sol\":239,\"test/HamsterToken.t.sol\":164,\"test/HamsterTokenInvariant.t.sol\":73,\"test/helpers/HookFixture.sol\":51,\"test/helpers/HookMiner.sol\":26,\"test/helpers/MockERC20.sol\":11,\"test/helpers/PoolActor.sol\":132},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true},{"durationMs":1618,"exitCode":0,"name":"slither","output":"slither: no results at low impact or above","passed":true},{"durationMs":492,"exitCode":0,"name":"aderyn","output":"[low] large-numeric-literal at src/HamsterToken.sol:9: Large Numeric Literal","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"40074208fc502fcb80894c1302e721d6d01e2a969ce05d75ce48aa64806edb18","verifiedTreeHash":"4512fd5aa476cf02bd601aced0350430a3da4764","verifierVersion":"0.1.0+6a374fcd"},{"checks":[{"durationMs":57262,"exitCode":0,"name":"build","output":"Compiling 83 files with Solc 0.8.26\nSolc 0.8.26 finished in 57.02s\nCompiler run successful!\n","passed":true},{"durationMs":2800,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 14 tests for test/HamsterToken.t.sol:HamsterTokenTest\n[PASS] testFuzz_transferConservesSupply(address,uint256) (runs: 256, μ: 88341, ~: 88641)\nLogs:\n  Bound result 158639437713830\n\n[PASS] test_approveEmitsEventAndTransferFromSpendsAllowance() (gas: 145659)\n[PASS] test_constructorEmitsSingleMintTransfer() (gas: 5947)\n[PASS] test_factoryReceivesEverythingAndOriginReceivesNothing() (gas: 223669)\n[PASS] test_failedTransferFromRestoresAllowance() (gas: 97504)\n[PASS] test_maximumAllowanceRetainsStandardInfiniteApprovalBehavior() (gas: 119998)\n[PASS] test_metadataAndExactFixedSupply() (gas: 50391)\n[PASS] test_neitherDeployerNorHolderHasMintBurnPauseOrUpgradeEntryPoints() (gas: 449317)\n[PASS] test_revokedApprovalCannotSpend() (gas: 115685)\n[PASS] test_transferEmitsEventAndMovesExactAmount() (gas: 87403)\n[PASS] test_transferFailsOnInsufficientBalance() (gas: 52354)\n[PASS] test_transferFromCannotExceedAllowance() (gas: 101670)\n[PASS] test_zeroAndSelfTransfersAreStandardERC20() (gas: 96479)\n[PASS] test_zeroRecipientAndZeroSpenderRevert() (gas: 53965)\nSuite result: ok. 14 passed; 0 failed; 0 skipped; finished in 14.88ms (15.24ms CPU time)\n\nRan 9 tests for test/HamsterLaunch.t.sol:HamsterLaunchTest\n[PASS] testFuzz_callbackFromManagerIsStatelessForAnyInput(address,(address,address,uint24,int24,address),uint160) (runs: 256, μ: 88326, ~: 88326)\n[PASS] test_hookIsFixedInThePoolIdentity() (gas: 134552)\n[PASS] test_launchPoolCannotBeOpenedBeforeTheLaunchTransaction() (gas: 124852)\n[PASS] test_launchRevertsAtomicallyWhenCoreRejectsThePoolTerms() (gas: 122572)\n[PASS] test_launchWithAMisminedSaltRevertsEverything() (gas: 49873)\n[PASS] test_oneTransactionLaunchOpensThePoolWithTheHookAttached() (gas: 103921)\n[PASS] test_runtimeCodeHasNoEscapeHatch() (gas: 2908173)\n[PASS] test_secondLaunchOnTheSameSaltReverts() (gas: 96961)\n[PASS] test_splitLaunchLetsAnyoneOpenThePoolFirst() (gas: 141712)\nSuite result: ok. 9 passed; 0 failed; 0 skipped; finished in 35.95ms (53.88ms CPU time)\n\nRan 15 tests for test/HamsterHook.t.sol:HamsterHookTest\n[PASS] testFuzz_callbackRejectsEveryOtherCaller(address) (runs: 256, μ: 20705, ~: 20705)\n[PASS] testFuzz_initializationAcceptsTokenInEitherCurrencySlot(address) (runs: 256, μ: 82129, ~: 82177)\n[PASS] testFuzz_initializerAndValidOpeningPriceAreNotRestricted(address,uint160) (runs: 256, μ: 86890, ~: 86891)\nLogs:\n  Bound result 1461446703485210103287273052203988822374428842239\n\n[PASS] test_allDisabledCallbacksRevertEvenFromManager() (gas: 260019)\n[PASS] test_anotherManagerCannotInitializeUsingThisHook() (gas: 3857129)\n[PASS] test_callbackReturnsCorrectSelectorToManager() (gas: 22718)\n[PASS] test_constructorDoesNotCallOrRequireCodeAtManager() (gas: 4066427)\n[PASS] test_constructorRejectsWrongPermissionBits() (gas: 8652)\n[PASS] test_constructorRejectsZeroManager() (gas: 4076)\n[PASS] test_duplicateInitializationReverts() (gas: 110181)\n[PASS] test_factoryHasNoOwnerPauseOrUpgradeControls() (gas: 127113)\n[PASS] test_factoryOpensLaunchPolicyPool() (gas: 85048)\n[PASS] test_initializationBeforeHookDeploymentFailsThenSucceedsAfterDeployment() (gas: 13749159)\n[PASS] test_multiplePoolsCannotConsumeSharedInitializationState() (gas: 148168)\n[PASS] test_onlyInitializationPermissionIsEnabledAndMatchesAddress() (gas: 21739)\nSuite result: ok. 15 passed; 0 failed; 0 skipped; finished in 83.90ms (92.68ms CPU time)\n\nRan 12 tests for test/HamsterPool.t.sol:HamsterPoolTest\n[PASS] testFuzz_swapsMatchUnhookedPool(bool,bool,uint96,bytes) (runs: 256, μ: 455521, ~: 452948)\nLogs:\n  Bound result 1000003\n\n[PASS] test_anotherTraderCanBuyAndSellWithArbitraryHookData() (gas: 1636713)\n[PASS] test_exactInputAndOutputBuysAndSellsMatchUnhookedPool() (gas: 1541699)\n[PASS] test_factoryCanRemoveAllItsLiquidityAfterTrading() (gas: 419249)\n[PASS] test_factoryCollectsBothCurrenciesWithZeroLiquidityChange() (gas: 689207)\n[PASS] test_failedPaymentRollsBackEntireSwap() (gas: 1441698)\n[PASS] test_invalidPriceLimitRevertsWithoutChangingBalances() (gas: 183062)\n[PASS] test_otherProvidersCanAddDonateCollectAndRemove() (gas: 1940861)\n[PASS] test_swapStillRequiresAnUnlockedManager() (gas: 40867)\n[PASS] test_tradingRemainsOpenAcrossHourDayAndBlockChanges() (gas: 1473535)\n[PASS] test_unsettledSwapCannotBypassCoreAccounting() (gas: 638712)\n[PASS] test_zeroAmountSwapIsRejectedByCore() (gas: 50030)\nSuite result: ok. 12 passed; 0 failed; 0 skipped; finished in 100.53ms (71.93ms CPU time)\n\nRan 1 test for test/HamsterTokenInvariant.t.sol:HamsterTokenInvariantTest\n[PASS] invariant_supplyAndSumOfBalancesNeverChange() (runs: 128, calls: 8192, reverts: 0)\n\n╭--------------+--------------+-------+---------+----------╮\n| Contract     | Selector     | Calls | Reverts | Discards |\n+==========================================================+\n| TokenHandler | approve      | 2745  | 0       | 0        |\n|--------------+--------------+-------+---------+----------|\n| TokenHandler | transfer     | 2726  | 0       | 0        |\n|--------------+--------------+-------+---------+----------|\n| TokenHandler | transferFrom | 2721  | 0       | 0        |\n╰--------------+--------------+-------+---------+----------╯\n\nLogs:\n  Bound result 0\n  Bound result 100000000000000000000\n  Bound result 2000000000000000000\n  Bound result 10000000000000000000000000\n  Bound result 0\n  Bound result 0\n  Bound result 750\n  Bound result 6\n  Bound result 0\n  Bound result 1000000\n  Bound result 249999901999999999998999249\n  Bound result 0\n  Bound result 0\n  Bound result 63989780591837388736\n  Bound result 0\n  Bound result 18\n  Bound result 95\n  Bound result 5631\n  Bound result 396\n  Bound result 17300810454348326657\n  Bound result 905\n  Bound result 7000000000000000000\n  Bound result 4963\n  Bound result 0\n  Bound result 10000000000000000000000\n  Bound result 12500\n  Bound result 96\n  Bound result 4972\n  Bound result 92964871009153005939095263\n  Bound result 157035114990846994060887227\n  Bound result 1471\n  Bound result 26\n  Bound result 120\n  Bound result 0\n  Bound result 0\n  Bound result 902\n  Bound result 10000000000000000000000000\n  Bound result 100\n  Bound result 0\n  Bound result 100000000000000000000\n  Bound result 4283\n  Bound result 0\n  Bound result 352964780009153005938096342\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 1.03s (1.02s CPU time)\n\nRan 1 test for test/HamsterPoolInvariant.t.sol:HamsterPoolInvariantTest\n[PASS]\nHamsterPoolInvariantTest invariants:\n[PASS] invariant_fixedSupplyIsConservedAcrossHolders\n[PASS] invariant_hookNeverHoldsValueOrDebt\n[PASS] invariant_hookedPoolStateMatchesUnhookedPool\n[PASS] invariant_twinActorsHoldIdenticalBalances\n HamsterPoolInvariantTest invariants (runs: 64, calls: 3072, reverts: 0)\n\n╭-------------+-----------------+-------+---------+----------╮\n| Contract    | Selector        | Calls | Reverts | Discards |\n+============================================================+\n| PoolHandler | addLiquidity    | 523   | 0       | 0        |\n|-------------+-----------------+-------+---------+----------|\n| PoolHandler | donate          | 474   | 0       | 0        |\n|-------------+-----------------+-------+---------+----------|\n| PoolHandler | factoryCollect  | 544   | 0       | 0        |\n|-------------+-----------------+-------+---------+----------|\n| PoolHandler | passTime        | 521   | 0       | 0        |\n|-------------+-----------------+-------+---------+----------|\n| PoolHandler | removeLiquidity | 487   | 0       | 0        |\n|-------------+-----------------+-------+---------+----------|\n| PoolHandler | swap            | 523   | 0       | 0        |\n╰-------------+-----------------+-------+---------+----------╯\n\nLogs:\n  Bound result 2293255546494631029\n  Bound result 2215983844302624257\n  Bound result 48648770538288046240\n  Bound result 92800\n  Bound result 999999999999000000272\n  Bound result 96\n  Bound result 2065\n  Bound result 9999999900000000001\n  Bound result 1130\n  Bound result 395201\n  Bound result 10\n  Bound result 14701\n  Bound result 85214\n  Bound result 1209\n  Bound result 997784016155697375743\n  Bound result 523585\n  Bound result 127\n  Bound result 95\n  Bound result 2456\n  Bound result 105841\n  Bound result 16436\n  Bound result 12514\n  Bound result 270303245796676118193\n  Bound result 431\n  Bound result 1000000\n  Bound result 4567\n  Bound result 1653\n  Bound result 4917\n  Bound result 514343565755464722173\n  Bound result 86301603496530236811\n  Bound result 457176161254672\n  Bound result 2592000\n  Bound result 4842419453852474183\n  Bound result 3744222755696039827\n  Bound result 295409\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 2.55s (2.50s CPU time)\n\nRan 6 test suites in 2.55s (3.81s CPU time): 52 tests passed, 0 failed, 0 skipped (52 total tests)\n","passed":true},{"durationMs":194,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"HamsterToken.approve(address,uint256)\",\"HamsterToken.transfer(address,uint256)\",\"HamsterToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"LICENSE\":23,\"README.md\":171,\"SECURITY_REVIEW.md\":67,\"foundry.toml\":23,\"remappings.txt\":4,\"scripts/vendor_dependencies.py\":91,\"src/HamsterHook.sol\":39,\"src/HamsterToken.sol\":14,\"test/HamsterHook.t.sol\":176,\"test/HamsterLaunch.t.sol\":202,\"test/HamsterPool.t.sol\":239,\"test/HamsterPoolInvariant.t.sol\":282,\"test/HamsterToken.t.sol\":164,\"test/HamsterTokenInvariant.t.sol\":73,\"test/helpers/HookFixture.sol\":51,\"test/helpers/HookMiner.sol\":26,\"test/helpers/MockERC20.sol\":11,\"test/helpers/PoolActor.sol\":132},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"524fddf0fa081199fd4b03c878d894d9253d5f19048baf3fefa661d9d4bf472a","verifiedTreeHash":"4f6cc8eb6420888009fff7a7971969f2c8ee3ba9","verifierVersion":"0.1.0+6a374fcd"},{"checks":[{"durationMs":15874,"exitCode":0,"name":"build","output":"Compiling 81 files with Solc 0.8.26\nSolc 0.8.26 finished in 15.77s\nCompiler run successful!\n","passed":true},{"durationMs":585,"exitCode":0,"name":"test","output":"No files changed, compilation skipped\n\nRan 14 tests for test/HamsterToken.t.sol:HamsterTokenTest\n[PASS] testFuzz_transferConservesSupply(address,uint256) (runs: 256, μ: 88284, ~: 88641)\nLogs:\n  Bound result 999999999999999999999999997\n\n[PASS] test_approveEmitsEventAndTransferFromSpendsAllowance() (gas: 145659)\n[PASS] test_constructorEmitsSingleMintTransfer() (gas: 5947)\n[PASS] test_factoryReceivesEverythingAndOriginReceivesNothing() (gas: 223669)\n[PASS] test_failedTransferFromRestoresAllowance() (gas: 97504)\n[PASS] test_maximumAllowanceRetainsStandardInfiniteApprovalBehavior() (gas: 119998)\n[PASS] test_metadataAndExactFixedSupply() (gas: 50391)\n[PASS] test_neitherDeployerNorHolderHasMintBurnPauseOrUpgradeEntryPoints() (gas: 449317)\n[PASS] test_revokedApprovalCannotSpend() (gas: 115685)\n[PASS] test_transferEmitsEventAndMovesExactAmount() (gas: 87403)\n[PASS] test_transferFailsOnInsufficientBalance() (gas: 52354)\n[PASS] test_transferFromCannotExceedAllowance() (gas: 101670)\n[PASS] test_zeroAndSelfTransfersAreStandardERC20() (gas: 96479)\n[PASS] test_zeroRecipientAndZeroSpenderRevert() (gas: 53965)\nSuite result: ok. 14 passed; 0 failed; 0 skipped; finished in 3.68ms (5.56ms CPU time)\n\nRan 15 tests for test/HamsterHook.t.sol:HamsterHookTest\n[PASS] testFuzz_callbackRejectsEveryOtherCaller(address) (runs: 256, μ: 20705, ~: 20705)\n[PASS] testFuzz_initializationAcceptsTokenInEitherCurrencySlot(address) (runs: 256, μ: 82129, ~: 82177)\n[PASS] testFuzz_initializerAndValidOpeningPriceAreNotRestricted(address,uint160) (runs: 256, μ: 86890, ~: 86891)\nLogs:\n  Bound result 1461446703485210103287273052203988822374428842239\n\n[PASS] test_allDisabledCallbacksRevertEvenFromManager() (gas: 260019)\n[PASS] test_anotherManagerCannotInitializeUsingThisHook() (gas: 3857129)\n[PASS] test_callbackReturnsCorrectSelectorToManager() (gas: 22718)\n[PASS] test_constructorDoesNotCallOrRequireCodeAtManager() (gas: 4066427)\n[PASS] test_constructorRejectsWrongPermissionBits() (gas: 8652)\n[PASS] test_constructorRejectsZeroManager() (gas: 4076)\n[PASS] test_duplicateInitializationReverts() (gas: 110181)\n[PASS] test_factoryHasNoOwnerPauseOrUpgradeControls() (gas: 127113)\n[PASS] test_factoryOpensLaunchPolicyPool() (gas: 85048)\n[PASS] test_initializationBeforeHookDeploymentFailsThenSucceedsAfterDeployment() (gas: 13749159)\n[PASS] test_multiplePoolsCannotConsumeSharedInitializationState() (gas: 148168)\n[PASS] test_onlyInitializationPermissionIsEnabledAndMatchesAddress() (gas: 21739)\nSuite result: ok. 15 passed; 0 failed; 0 skipped; finished in 45.44ms (46.68ms CPU time)\n\nRan 12 tests for test/HamsterPool.t.sol:HamsterPoolTest\n[PASS] testFuzz_swapsMatchUnhookedPool(bool,bool,uint96,bytes) (runs: 256, μ: 455522, ~: 452948)\nLogs:\n  Bound result 1000003\n\n[PASS] test_anotherTraderCanBuyAndSellWithArbitraryHookData() (gas: 1636713)\n[PASS] test_exactInputAndOutputBuysAndSellsMatchUnhookedPool() (gas: 1541699)\n[PASS] test_factoryCanRemoveAllItsLiquidityAfterTrading() (gas: 419249)\n[PASS] test_factoryCollectsBothCurrenciesWithZeroLiquidityChange() (gas: 689207)\n[PASS] test_failedPaymentRollsBackEntireSwap() (gas: 1441698)\n[PASS] test_invalidPriceLimitRevertsWithoutChangingBalances() (gas: 183062)\n[PASS] test_otherProvidersCanAddDonateCollectAndRemove() (gas: 1940861)\n[PASS] test_swapStillRequiresAnUnlockedManager() (gas: 40867)\n[PASS] test_tradingRemainsOpenAcrossHourDayAndBlockChanges() (gas: 1473535)\n[PASS] test_unsettledSwapCannotBypassCoreAccounting() (gas: 638712)\n[PASS] test_zeroAmountSwapIsRejectedByCore() (gas: 50030)\nSuite result: ok. 12 passed; 0 failed; 0 skipped; finished in 46.56ms (32.73ms CPU time)\n\nRan 1 test for test/HamsterTokenInvariant.t.sol:HamsterTokenInvariantTest\n[PASS] invariant_supplyAndSumOfBalancesNeverChange() (runs: 128, calls: 8192, reverts: 0)\n\n╭--------------+--------------+-------+---------+----------╮\n| Contract     | Selector     | Calls | Reverts | Discards |\n+==========================================================+\n| TokenHandler | approve      | 2745  | 0       | 0        |\n|--------------+--------------+-------+---------+----------|\n| TokenHandler | transfer     | 2726  | 0       | 0        |\n|--------------+--------------+-------+---------+----------|\n| TokenHandler | transferFrom | 2721  | 0       | 0        |\n╰--------------+--------------+-------+---------+----------╯\n\nLogs:\n  Bound result 0\n  Bound result 100000000000000000000\n  Bound result 1000000000000000000000\n  Bound result 4\n  Bound result 0\n  Bound result 0\n  Bound result 750\n  Bound result 7000000000000000000\n  Bound result 0\n  Bound result 0\n  Bound result 249999093000000000000000001\n  Bound result 0\n  Bound result 255\n  Bound result 12500\n  Bound result 0\n  Bound result 13000000000000000000\n  Bound result 5\n  Bound result 5623\n  Bound result 396\n  Bound result 3384\n  Bound result 1129\n  Bound result 249999079999999999999978238\n  Bound result 4940\n  Bound result 0\n  Bound result 25\n  Bound result 0\n  Bound result 1\n  Bound result 4988\n  Bound result 614627446238665907366545667\n  Bound result 4938\n  Bound result 12\n  Bound result 902\n  Bound result 60\n  Bound result 1000000000000000000000\n  Bound result 38269\n  Bound result 0\n  Bound result 4\n  Bound result 12070\n  Bound result 15\n  Bound result 100000000000000000000\n  Bound result 4311\n  Bound result 0\n  Bound result 864627359238665907366551383\n\nSuite result: ok. 1 passed; 0 failed; 0 skipped; finished in 493.25ms (492.21ms CPU time)\n\nRan 4 test suites in 494.46ms (588.93ms CPU time): 42 tests passed, 0 failed, 0 skipped (42 total tests)\n","passed":true},{"durationMs":49,"exitCode":0,"name":"source-index","output":"{\"v\":1,\"entryPoints\":[\"HamsterToken.approve(address,uint256)\",\"HamsterToken.transfer(address,uint256)\",\"HamsterToken.transferFrom(address,address,uint256)\"],\"files\":{\".gitignore\":4,\"LICENSE\":23,\"README.md\":171,\"SECURITY_REVIEW.md\":67,\"foundry.toml\":23,\"launch.json\":25,\"remappings.txt\":4,\"scripts/vendor_dependencies.py\":91,\"src/HamsterHook.sol\":39,\"src/HamsterToken.sol\":14,\"test/HamsterHook.t.sol\":176,\"test/HamsterPool.t.sol\":239,\"test/HamsterToken.t.sol\":164,\"test/HamsterTokenInvariant.t.sol\":73,\"test/helpers/HookFixture.sol\":51,\"test/helpers/HookMiner.sol\":26,\"test/helpers/MockERC20.sol\":11,\"test/helpers/PoolActor.sol\":132},\"excluded\":[\"lib/\",\"node_modules/\"],\"truncated\":false}","passed":true}],"detail":"all checks passed","evaluation":"checks","profile":"foundry","status":"accepted","submissionHash":"ab15d2b2e0c149aa35180b7139c0025ea912cb221775b89ff0ca5a0c8ef9fbd2","verifiedTreeHash":"79206991033ff2f20212ed8c369c6452690df506","verifierVersion":"0.1.0+6a374fcd"}]}