Implemented all requested project files, including the contract, tests, deployment script, ABI, exact Foundry configuration, vendored forge-std, and documentation.

Passed forge build, forge test (33 tests), forge fmt --check, and clean offline builds/tests. Exported verification input reproduces both creation and runtime bytecode.

On-chain deployment and explorer verification remain pending a confirmed deployment address. Verification artifacts and operator commands are included.

Added 10 tests under test/, covering hostile token responses, holder boundaries, failure atomicity, and an independent lifecycle/history invariant with 24,576 randomized calls.

Offline build and full test suite passed: 43 tests, 0 failures, 0 skipped.

No implementation defects reproduced. Only test/ changed.

Created launch.json with kind evm_contracts, one MemecoinCemetery entry, empty constructor arguments, and implementation notes.

Validation passed: schema and ABI matching, offline build, formatting, and all 43 tests on both runs, including a second fuzz seed.

Only launch.json is changed for submission.

Scope

Files read: src/MemecoinCemetery.sol (403 lines, every line), script/Deploy.s.sol, launch.json, README.md, test/MemecoinCemetery.t.sol (mocks, boundary, threshold and transition tests), the test names of the adversarial, invariant and model suites, the protected floor test, and the Pashov Mindset plus the Access Control, Asymmetry, Trust Gap and Finding Validation guides. forge build --offline and forge test --offline pass with 43 tests. A scratch probe exercised a 24-decimal token, the deadline and cooldown boundaries, an escaped symbol and three ETH paths, then was deleted.

Severity counts: 0 Critical · 0 High · 0 Medium · 0 Low

No defect survived the verification gate in the assigned area. .imd-findings.json holds an empty findings list and eleven coverage rows, one per entry point plus the two brief invariants, the trust surface and the artefacts.

Coverage

• Permission model. There are no roles, setters, initializers, proxies or owner; the constructor hands nothing to the factory. Each storage variable has one writer per transition, so there is no weaker-guard parallel path. receive and fallback revert unconditionally and every application function is nonpayable.
• Asymmetry pairs. itLives uses a strict less-than on the deadline and seal a greater-or-equal, so the two are complementary with no gap or overlap. seal increments both burials and graveCount and rise decrements only graveCount, which keeps the count equal to the Buried set because Buried has no other exit. dig resets the latest attempt's dates and mourners but never the lifetime counters. mourn mirrors its count into the numbered record and is blocked in Risen, freezing the record.
• Trust gap. The only trusted input is token-supplied supply, decimals, balance and symbol. All four are read through a 50,000-gas static call with an exact 32-byte or bounded 128-byte size check, so a token cannot re-enter, bomb or corrupt state. I checked whether a caller could starve the decimals read of gas to lower the threshold for a token with more than 18 decimals. The fixed cap makes that impossible: if the call runs out of gas, the remaining sixty-fourth cannot finish the transaction.
• Holder rule. The threshold is the maximum of one and the smaller of one whole token and a thousandth of supply, traced for 0, 6, 18, 24, 36 and over-36 decimals and for a supply under 1000.
• Artefacts. The ABI file equals the compiled ABI, the manifest is schema-valid with empty constructor arguments, the deploy script rejects every chain but 4663 and reads no environment, and forge-std is vendored as ordinary tracked files.

Observations (non-blocking)

• Anyone can re-dig a live token every ten days, so holders of a healthy token pay gas each cycle to object. The brief asks for exactly this.
• A token can lie about balances or make its reads revert after being dug, which would stop its holders from saving it. The brief accepts token-supplied data and the README documents it.
• Forced ETH through SELFDESTRUCT or block rewards is unrecoverable, which the static tools flag as locked ether. The brief forbids ETH and any withdraw path, and the README states it.

Review complete. No tracked files were changed; .imd-findings.json holds the report, and the proof lives under test/scratch/.

Result

One substantiated finding (medium), with a Foundry proof that fails on the current code and passes with the fix.

_requireHolder forwards only 50,000 gas to balanceOf, so holders of reflection-style tokens can neither save nor rise — and since dig only needs the cheap totalSupply, such burials are permanent. (src/MemecoinCemetery.sol:279, root at TOKEN_GAS line 59 / _readWord line 293)

• The guides' lens: Execution Trace's untrusted return values / query function differs from the operational one and First Principles' assumption chain: dig validates the token via totalSupply() (O(1) everywhere), but the defensive paths itLives/rise depend on balanceOf() succeeding under the same 50k cap.
• Measured with a faithful copy of the SafeMoon balanceOf → tokenFromReflection → _getRate → _getCurrentSupply loop: 12.2k gas with no excluded accounts, +8.3k per excluded account, so the cap is exceeded at 5 excluded accounts (contract, burn, pair, owner, marketing is a typical list). Every itLives/rise then reverts TokenReadFailed(token, 0x70a08231) regardless of balance; Buried has no other exit.
• The cap buys nothing on this path: these are STATICCALLs whose gas is paid by the holder who chose to call. Fix: a much larger cap (or gasleft()) for the three reads inside _requireHolder; the proof passes with a 1,000,000-gas holder cap (verified against a scratch copy).

Coverage (15 rows in the file)

• dig, seal, mourn, receive, fallback — holds; itLives, rise — finding 1.
• Invariants graveCount == |Buried| and sealed-record immutability — hold.
• Periphery: _readWord return-size/scratch handling, _symbol canonical-ABI bounds, _escapeXML buffer sizing, _shortAddress nibble math — hold. _date fuzzed 256 runs against BokkyPooBah's independent algorithm for 1970–9999 — matched, so slither's divide-before-multiply leads are the algorithm's intended floor steps.
• Static-analysis leads (locked-ether, timestamp, uninitialized local, unused state) — reproduced as non-defects.
• Deliverable checks outside my area: docs/abi equals the compiled ABI; runtime keccak 0x9056…80ed and sizes match build.json; Deploy script guards chain 4663.

Not reached: nothing within the assigned area; I did not independently re-verify the README prose or the model/invariant test harnesses beyond running them (all 43 existing tests pass).

The review is complete. The findings file is valid JSON, both snippets match the source lines, and the working tree is clean apart from the findings file (which is ignored by git).

Outcome. The math in src/MemecoinCemetery.sol holds up. No critical, high or medium defects were found in the Math Precision, Boundary or Numerical Gap areas. The file .imd-findings.json carries two minor items and 13 coverage rows covering all 7 entry points plus the static-analysis leads and both stated invariants.

What I verified with concrete values

• Holder threshold max(1, min(10**decimals, supply/1000)) behaves correctly at the 6-decimal boundary, the 1-base-unit floor for supply under 1000, decimals 36, and decimals 37 defaulting to 18.
• The on-chain date algorithm matched an independent loop-based calendar across 2000 fuzz runs from 1970 through 9999, plus leap-year and 2038/2100 edges. Slither's divide-before-multiply lines there are the algorithm itself, not a bug.
• Symbol decoding accepts a 64-byte symbol, rejects 65, rejects non-canonical sizes, and escapes all five XML metacharacters. The seal/itLives deadline comparisons are exact complements with no gap or overlap.
• The full project suite passes, 43 tests including both invariants.

Findings reported

1. Low. The fixed 50,000-gas cap on balanceOf reads locks holders of reflection-style tokens out of itLives and rise. A SafeMoon-shaped mock with 6 excluded accounts costs about 53k gas cold, so both calls revert and the token is buried unopposed despite a holder owning 1% of supply. With 5 excluded accounts it works. The README discloses this trade-off and the brief names the cap, so this is a design decision to revisit rather than a logic defect. Since the calls are static, raising the cap carries no reentrancy cost.
2. Info. Tokens returning a raw bytes32 symbol (MKR-style) always render the shortened address on the headstone, which is consistent with the brief's fallback rule.

Nothing in my area was left unreached. The scratch tests were removed after use, as nothing under test/scratch/ is kept.

Review complete. The findings file is written with 2 findings and 12 coverage rows, and the proof test fails on the current code for the stated reason.

Outcome

The contract's economics and invariants hold almost everywhere I checked. All 43 project tests pass, the committed ABI matches the compiled one, and the runtime bytecode hash matches the build record. The state machine, 72-hour wake, 7-day cooldown, grave count coupling, burial-record immutability, mourn-once-per-burial rule and the holder threshold formula all behave as the brief specifies. Two defects were substantiated, both in .imd-findings.json.

Findings

• Medium, holder reads capped at 50k gas. The read helper forwards exactly 50,000 gas for balanceOf and totalSupply inside itLives and rise, the same cap the brief asked for in dig. Reflection-style memecoins (SafeMoon and its forks) compute balanceOf by looping over reward-excluded accounts. With six or more such accounts the call needs more than 50k gas, so dig succeeds on a cheap totalSupply while every holder's objection reverts with a read failure. The token is sealed after 72 hours and can never rise. This breaks the brief's core guarantee that any real holder can stop a burial. A proof test under test/scratch/HolderGasCap.t.sol fails today and passes against a copy with a larger cap. Suggested fix: forward much more gas on the holder paths only, since the holder is the caller paying for it.
• Low, ERC-721 Enumerable collections pass dig. The only token check is code plus a non-zero totalSupply. An NFT collection with 10,000 pieces is accepted, and the threshold becomes 10 whole NFTs, so typical holders cannot object. Suggested fix is a gas-capped ERC-165 probe for the ERC-721 interface, or an explicit README note.

Coverage

All seven listed entry points have rows. seal, mourn, receive and fallback hold. dig carries finding 2. itLives and rise carry finding 1. Five additional rows record the invariants I verified. The static-analysis leads (divide-before-multiply in the calendar code, locked ether, timestamp comparisons) were checked and are not defects: the calendar arithmetic is the published algorithm and is tested at leap and century boundaries, and forced ETH has no victim and is documented.

Not covered

I did not evaluate Robinhood Chain sequencer timestamp drift against the 72-hour window, and I did not assess the explorer verification step, which needs a deployed address.

Taylor, the review is done. .imd-findings.json is written at the repository root with 3 findings and 10 coverage rows. No tracked file was changed; the scratch proof lives in the git-ignored test/scratch/ directory.

Result: one real defect, two informational notes, otherwise the contract holds.

• Medium, finding 1, merged from three specialists. The holder check in _requireHolder forwards the same 50,000-gas cap used for dig's totalSupply read to balanceOf. On SafeMoon-style reflection tokens with six or more reward-excluded accounts, balanceOf exceeds that budget, so a legitimate holder is rejected with TokenReadFailed on both itLives and rise. Anyone can dig such a live token, nobody can object, seal buries it, and it can never rise. I reproduced it with a proof file that fails on the current code and passes against a copy with the holder-read cap raised to 500,000 gas. The audit_flow, audit_math and audit_economics reports described the same root cause and are merged at medium: no funds are lost, but the brief's central guarantee breaks for a common token class.
• Info, finding 2. An ERC-721 Enumerable collection passes dig and its holders need totalSupply/1000 NFTs to object. Reproduced, but this is exactly what the brief specifies for dig and the holder rule, so I lowered it from low to info.
• Info, finding 3. A bytes32 symbol() renders the shortened address instead of the symbol. Reproduced; it matches the brief's fallback rule.

What I checked beyond the specialists. All 43 project tests pass offline. The committed ABI is byte-identical to the compiled ABI. The on-chain date routine matches Python's UTC calendar for 58 timestamps including leap-century edges. Every state transition, cooldown, counter and the two invariants trace correctly. The static-analysis lines are false positives: receive and fallback revert so no ether can be locked, the divide-before-multiply hits are intentional rounding, and TOKEN_GAS is used inside assembly.

Coverage. dig, seal, mourn, receive and fallback hold. itLives and rise carry finding 1.

Fixed holder reads to use available caller gas; nomination and symbol reads retain the 50,000-gas cap.

Added regression tests, documented the ERC-721 limitation, retained the documented bytes32 fallback, and answered all findings in .imd-responses.json. Updated bytecode verification artifacts.

Builds, reviewer proof, full suite, 1,024-run fuzz tests, invariants, and formatting checks pass.

Deployment and explorer verification remain with the network deployer.

Updated adversarial tests to replace the stale holder gas ceiling with failure-atomicity checks and strengthen decimals fallback coverage.

All 50 tests pass, including a second-seed run with increased fuzz iterations. Offline build and formatting checks pass. Only the test file changed.

Updated only launch.json, correcting the gas-limit notes to match the accepted implementation.

Manifest and constructor checks passed. Offline build succeeded; all 50 tests passed on both runs, including a second fuzz seed with increased cases.

The review is complete and the findings file is written with an empty findings list.

Settlement of the prior round

• Medium, holder reads capped at 50,000 gas: fixed. The read helper now takes a gas limit. The nomination supply read and the headstone symbol read keep the 50,000 cap, while the holder check forwards the caller's remaining gas for totalSupply, decimals and balanceOf. I copied all three attached proofs under test/scratch and ran them against the revised contract. All eight proof tests pass, including the reflection-token save and rise cases that previously reverted with TokenReadFailed. The author also added a permanent regression file for expensive balance, supply and decimals reads on both defensive paths.
• Info, ERC-721 collections can be dug: closed. The README now documents the input-class limitation with the 10-NFT example, and the contract behaviour stays as the brief specifies.
• Info, bytes32 symbols fall back to the address: dropped. The author's dispute is correct. This is the documented fallback for a failed read, it never reverts, and the README states it.

Fresh pass on the changed code

I re-read the gas-forwarding change as new code. Forwarding gasleft() on STATICCALL paths only lets a hostile token waste the gas of the holder who chose to call. State cannot change inside a static call, and the return copy is still bounded to one word with an exact 32-byte size check. The static-analysis leads do not hold up. The locked-ether warnings are false positives because receive and fallback always revert. The divide-before-multiply lines are the standard Hinnant calendar arithmetic. The uninitialized local in the XML escaper is assigned on every path that reads it.

Artifact checks

The committed ABI equals the offline build output. The creation and runtime bytecode keccak hashes and the source sha256 in the build record all match the compiled output. The manifest lists one contract with no constructor arguments and no owner. The full offline suite passes with 50 tests, including the invariant and model suites.

The scratch directory was removed, and the working tree holds only the required findings file.