ExpiringMerkleDistributor is implemented, built, tested, and committed as b52b6e6. Only src/ExpiringMerkleDistributor.sol was added. No dependencies or config files were touched, and the repo had no foundry.toml, so Foundry's defaults were used.

What the contract does

• Constructor stores token, merkleRoot, expiry and sweepTo as immutables. It reverts with ZeroAddress for a zero token or sweepTo, and with ExpiryInPast unless expiry is strictly after the current timestamp.
• claim is open to anyone and always pays the account in the leaf. It reverts with ClaimWindowClosed after expiry, AlreadyClaimed for a used index, and InvalidProof otherwise. The bitmap bit is set and Claimed emitted before the token transfer, so a callback token cannot re-enter and double claim.
• Leaf and proof format match OpenZeppelin StandardMerkleTree: the leaf is the double keccak of the ABI-encoded triple, and proof siblings are hashed as sorted pairs. The double hash rules out passing an inner node as a leaf.
• isClaimed reads a bitmap with 256 indices per storage word.
• sweep is open to anyone, reverts with NotYetExpired while the timestamp is at or before expiry, and otherwise transfers the whole balance to sweepTo and emits Swept. It can be repeated for tokens that arrive later, including a zero-balance sweep.
• Safe transfer helper uses a low-level call. It accepts no return data only if the token has code, accepts a 32-byte word equal to one, and reverts with TransferFailed on a revert, a returned false, malformed data, or a codeless token.

Verification

• forge build succeeds. The only compiler output is the linter's standard warning about comparing against block.timestamp, which is inherent to a deadline contract.
• forge test passes 31 tests in test/scratch, written against an inlined cheatcode interface so no forge-std was needed. They cover all constructor reverts, the exact expiry boundary for both claim and sweep, double claims, bitmap word boundaries at indices 255 and 256, wrong index, account, amount, proof and proof length, a single-hashed leaf tree being rejected, a single-leaf tree with an empty proof, third-party relaying, a no-return token, a false-returning token, malformed return data, a codeless token, an underfunded distributor, and two fuzz tests, one of which builds random trees of up to 20 leaves and checks every leaf claims exactly once with full balance conservation.

Assumptions and notes for the integrator

• The contract has no admin and no pause. The only privileged address is the passive sweepTo recipient.
• Swept is emitted even when the balance is zero. That is a design choice, not an error.
• Fee-on-transfer or rebasing tokens are not specially handled. Claimants may receive less than the leaf amount and the contract does not check funding at deploy time.
• The claim event parameters are unindexed, matching the signature given in the task. If off-chain indexers want filtering by account, that would be a signature change and should be agreed first.
• A zero merkleRoot is accepted by the constructor. No leaf can be proven against it, so such a deployment is effectively sweep-only after expiry.

Wrote .imd-findings.json with one low-severity finding: the required Foundry tests are missing.

No substantiated contract exploit was found in the requested areas. Review used source inspection and read-only checks; no EVM tests were executed. Implementation files remain unchanged.

The build artifacts under cache/ and out/ are git-ignored, so the only change in the tree is the test file. The work is complete.

Result: test/ExpiringMerkleDistributor.t.sol adds 52 tests, all passing under forge test with 256 fuzz runs each. No dependencies were added and no configuration files were touched.

What the suite covers

• Fixture: a 6-leaf tree built in Solidity with StandardMerkleTree double-hashed leaves and sorted-pair inner nodes. Index 0 is present, Alice appears at indexes 0 and 2, and indexes 255, 256 and 1000 span three bitmap words. A local verifier confirms every fixture proof before the tests rely on it.
• Constructor: zero token, zero sweepTo, expiry equal to now, expiry in the past, expiry one second ahead, and the revert priority when both checks fail.
• Claims: happy path with event, relayer submission paying the account rather than the caller, same account across two indexes, arbitrary claim order, and conservation of funded tokens under fuzzed claim subsets.
• Double claims: same caller, different caller, garbage proof after a claim, and both sides of the 255/256 word boundary.
• Bad inputs: wrong index, swapped indexes between the two Alice leaves, wrong account, wrong amount, another leaf's proof, empty, truncated, extended, bit-flipped and reordered proofs, plus fuzzed wrong accounts, amounts and unknown indexes.
• Inner node as leaf: takes a genuine inner node with its shortened path to the root, confirms locally that the path verifies for the node, then shows every plausible reinterpretation of its children as claim arguments is rejected. Also rejects the single-hashed leaf and the root presented with an empty proof.
• Expiry: claim at exactly expiry passes, at expiry plus one reverts, fuzzed timestamps on both sides, and the window check taking precedence over proof errors.
• Sweep: reverts before and at expiry, sends everything at expiry plus one, repeat sweep emits zero, later arrivals are swept again, and the bitmap survives a sweep.
• Tokens: a USDT-style no-bool mock succeeds for claim and sweep, a false-returning token, a token returning a non-boolean word, an underfunded token and a token address with no code all revert with the contract's transfer error. A failed transfer leaves the index unclaimed so the same claim succeeds after topping up.
• Bitmap: fuzzed four-leaf trees with indexes anywhere in the uint256 space, asserting each claim sets only its own bit and no neighbour bit in the same or adjacent word. A fixed test hits 0, 255, 256, 511, 512, the 2^255 word and the top of the space.

Defects: none found, so no findings file was written. Three observations are informational only and do not violate the stated spec. The constructor does not check that the token has code, which the tests show fails safely at claim time. Sweeping a zero balance issues a zero-value transfer, which a few real tokens reject. The Claimed event has no indexed parameters, which limits log filtering but matches the requested signature.