Approved workflow

Done. The DOOM launch token and DoomsdayClock game are implemented, tested, documented, and committed on main.

What was delivered

• src/LaunchToken.sol: Doomsday (DOOM), OpenZeppelin ERC20 plus a constructor minting 10^27 units to the deployer. No arguments, no mint, owner, pause, fee or upgrade path.
• src/DoomsdayClock.sol: the last-buyer timer game. Only constructor argument is the token address, exposed as token(). Holds no DOOM or ETH at deploy, has no payable, receive or fallback, no admin. All payouts are pull-based through withdraw(), every mutating function is nonReentrant and follows checks-effects-interactions.
• docs/abi/LaunchToken.json and docs/abi/DoomsdayClock.json, exported from the build.
• README.md: rules, assumptions, deployment parameters (constructorArgs ["$token"], no owner), operational responsibilities, and review targets.
• script/Deploy.s.sol: a local dev helper that reads no environment variables. The Sepolia path is the factory.
• Vendored forge-std v1.9.7 and openzeppelin-contracts v5.1.0 as plain files under lib/, no git metadata.

Verification

Tests cover the price sequence against an independent ceil reference (including key 7, the first where ceil differs from floor), the 100-key and 24-hour caps, maxCost reverts, buy after end settling first, buying in the same second as end, settle twice, claim twice, one address holding every key, carry across rounds, reentrancy through a hooking stand-in token, and a handler-driven invariant that DOOM held equals pot plus carry plus unclaimed shares plus withdrawable balances.

Design decisions worth flagging for review

• Opening a round sets end to now plus 1 hour and then the purchased keys add 30 seconds each, capped at 24 hours ahead.
• Carry is folded into the pot when the next round opens, so pot() and carry() are disjoint and sum cleanly in the invariant.
• The per-key share is floored once, so shares never exceed 30% of the pot and the dust goes to carry, which is therefore at least 20%.
• A purchase at exactly end settles the round rather than extending it.

The manifest step still needs to write launch.json naming LaunchToken and DoomsdayClock with constructorArgs ["$token"], and the independent review runs after that.

Done. The new handler-driven invariant suite is in place and the whole project passes.

What I added: test/DoomsdayClockHandlerInvariant.t.sol, alongside the existing simpler invariant file, which I left untouched.

• Handler drives buy, settle, claimShare and withdraw under four warp modes: small steps, one second before end, exactly end, and jumps of up to three days past it. It keeps independent ghost accounting for pot, carry-in per round, key costs, per-actor keys, per-actor paid-in and paid-out, shares paid per round, prize per round, and the ceil price walk.
• Failure paths run on every call, not skipped. Each expected revert is caught with try/catch and its exact error payload asserted: maxCost one below quote, n of 0 and 101, an unapproved buyer, an underfunded buyer, settle before end and settle twice, claim with no keys, claim twice, claim on the current or a future round, and withdraw with nothing owed twice. The handler also asserts that a reverted buy leaves round, end, pot and lastBuyer untouched.
• Invariants: DOOM held equals pot plus carry plus unclaimed shares plus the sum of withdrawable, cross-checked against the ghost flow. Shares paid per round stay within the floored allotment, which stays within 30% of the pot, with paid plus still-claimable equal to the allotment and prize plus allotment plus carry-out reconstructing the pot exactly. Carry-out of each round equals the carry-in of the next. Round bookkeeping, next-key price, 24-hour cap and per-actor balances match the ghost record.
• Drain step in afterInvariant settles, claims everything, withdraws everything, and asserts only pot plus carry remain and total supply is conserved.
• Scripted walk test forces every handler path deterministically, including a buy at the exact end second and a case where the low-balance actor wins the prize.

Results: all 50 tests pass, including a stress run at 64 runs by 200 depth with a different seed. forge fmt --check is clean.

No implementation defects found. Every failure in development was a test-side error on my part: a missing single-argument fail in the vendored forge-std, stack depth in the buy helper, an underflow in my balance formula when a winner spends more than their initial stake, and a seed wraparound in my claim loop. I did not write a findings file because there is nothing to report against the contract.

Wrote launch.json for the accepted Doomsday launch. It validates as an evm_project manifest, and the Foundry build and test suite pass against the unchanged source.

What the manifest contains

• Token: LaunchToken, name Doomsday, symbol DOOM, 18 decimals, no constructor arguments. Name and symbol match the ERC20 constructor call in src/LaunchToken.sol.
• Contracts: a single entry, DoomsdayClock, with constructorArgs ["$token"]. This matches the ABI export, which declares one nonpayable address parameter, and the approved workflow's stated argument list.
• Pool: paired against native ETH (zero address), fee 3000, tickSpacing 60, initialPrice as decimal sqrtPriceX96, no hook.
• Notes: describe both contracts, the absence of any owner or $owner argument, the no-ETH and no-DOOM-at-deploy properties, and that supply, allocations and ownership come from policy.

Checks run

• A scratch script in test/scratch/ checked the schema shape, key sets, patterns, uniqueness, the reserved MerkleDistributor name, backward-only references, address-typed reference slots, and cross-checked constructor arity and token name/symbol against the ABI exports and source. It reported no errors.
• forge build --offline, forge test --offline (50 passed, 0 failed) and forge fmt --check all succeeded.

Working tree

Only launch.json is new. The other untracked entries git lists are sandbox-provided device nodes, not files I created. The scratch validator lives under test/scratch/ and is removed before submission.

Wrote {"findings":[]} to .imd-findings.json. No substantiated security defects found.

launch.json supplies ["$token"], matching DoomsdayClock(address token_). It grants no privileged role. LaunchToken takes no constructor arguments and exposes no mint/admin authority.

Non-blocking accounting caveat: token.transfer(clock, 1) creates surplus outside the game’s accounting, so literal balance equality assumes no unsolicited transfers. This cannot increase claims or impair existing payouts.

Reviewed source, tests, protected checks, manifest, and ABI exports; checked arithmetic independently. The established Foundry suite was not rerun. Only the requested report was created.

Implemented the frontend and static export with verified ABIs and runtime deployment manifest.

• Build, typecheck, 14 browser tests, live RPC reads, and asset-hash checks passed.
• Export: 569 KB; conservative bundle bound: 3.59 MB.
• Evidence: docs/VALIDATION.md. Design documentation: docs/DESIGN.md, respecting the write scope.

Commit blocked: .git is read-only. All deliverable files remain ready in the workspace. No real transactions were broadcast.