Approved workflow

Release Lease (ERC-20 symbol LEAS) on Sepolia as an evm_project: the fixed-supply launch token plus one application contract. Token: Lease (LEAS), total supply 1,000,000,000 LEAS with 18 decimals, minted once to the deployer. Application contract: RentableNFT. Currency: LEAS is the app's working currency. RentableNFT's constructor takes one argument, the LEAS address (constructorArgs ["$token"]); it stores the token immutable, exposes it as token(), and holds no LEAS at deploy and never needs any: users get LEAS by swapping Sepolia ETH in the ETH/LEAS launch pool the factory seeds. The only LEAS movement is rent, approve + SafeERC20.safeTransferFrom straight from the renter to the token owner; RentableNFT holds no balances and has no payouts. RentableNFT has no payable function and no receive/fallback, so it never holds ETH. No owner, admin, pause or upgrade path. RentableNFT is an OpenZeppelin ERC-721 named "Lease Keys" with symbol "LKEY" (source constants) that implements ERC-4907 (userOf, userExpires, setUser, UpdateUser event, supportsInterface 0xad092b5c) plus a rental market paid in LEAS. Mint: mint() is free, at most 3 per address for life and 3,000 in total, ids from 1 in order. Listing: the token owner calls list(tokenId, pricePerDay) with pricePerDay > 0 in LEAS units (18 decimals) and unlist(tokenId); a listing records the lister and is void once ownerOf changes. Renting: rent(tokenId, days, maxPricePerDay) with days 1 to 30; requires a live listing, no active user (userOf == 0, i.e. any earlier rental has expired), renter != owner, and pricePerDay <= maxPricePerDay (front-running guard). Cost = pricePerDay x days, moved with safeTransferFrom(renter, owner, cost) straight to the owner, so RentableNFT never holds LEAS; the renter becomes user until block.timestamp + days x 86,400. The listing stays open for the next renter after expiry. Paid rentals cannot be cut short: setUser by the owner or approved operator is allowed only while no rental is active; and, deliberately unlike the EIP-4907 reference implementation, a transfer does not clear an active user (document the deviation). userOf returns address(0) once expires <= block.timestamp. Events: Listed, Unlisted, Rented (tokenId, renter, owner, days, cost, expires). Views: totalMinted(), mintedBy(address), listing(tokenId). Edge cases with defined outcomes: renting an unlisted or stale-listed token, renting while in use, days 0 or 31, self-rent, a 4th mint by one address, and a transfer during a rental all revert or behave as stated. Tests (Foundry) must cover: each edge case above, and, fuzzing days, prices and warps, that rent moves exactly the cost from renter to owner, RentableNFT's LEAS balance is always 0, userOf is 0 exactly at expiry, and no owner action (setUser, transfer, unlist, relist) ends a paid rental early. The independent adversarial review must attack: any way for an owner to revoke or shorten a paid rental (setUser, transfer, unlist, relist), stale listings after a transfer, price front-running, and payment to the wrong address. Deploy through the project factory, then publish a one-page website to mint, list, rent (approve LEAS then rent), and a token table with owner, listing price, current user and expiry, 25 tokens per page (ids from 1 to totalMinted()). The page reads the LEAS address from RentableNFT.token(), shows the connected wallet's LEAS balance and allowance, has an Approve step before every paying action, and says LEAS comes from swapping Sepolia ETH in the launch pool (no in-page swap). Lists come from contract views and events only (no backend, no indexer; log queries are chunked from the deployment block). Keep it to one small page; the static export has index.html in dist/.

Sepolia (11155111) only. GitHub publication and IPFS hosting are approved. Launch token: a separate fixed-supply ERC-20, 18 decimals, no constructor arguments, exactly 1,000,000,000 minted to msg.sender, no mint or admin functions. The factory sends that supply to LP and rewards, so no application contract may need a launch-token balance at deploy. Application contracts are fully configured in nonpayable constructors using only address, uint, bool or bytes32 arguments (no strings, arrays, proxies, delegatecall or selfdestruct); anything else is set at runtime. No owner unless the request names one, and then it is $owner. No external oracles, VRF or keepers: randomness is commit-reveal or a future blockhash read within 256 blocks with a refund path. foundry.toml sets bytecode_hash = "none". The website is a static export with index.html in dist/. Site label lab-rentable-nft.

Build LEAS and RentableNFT (ERC-721 + ERC-4907, rent paid in LEAS, constructorArgs ["$token"]) with Foundry tests and an independent adversarial review, deploy them through the project factory, then build the website against the live deployment.

Mint, list, rent with an approve step, and a token table (owner, price, user, expiry) paginated 25 per page from totalMinted() and views.