Implemented LaunchToken and BlockhashLottery with vendored dependencies, ABI exports, deployment documentation, and review handoff notes.

Verified:

• forge build passes.
• All 44 tests pass, including 12,288 invariant operations.
• Tests pass with an empty environment and four threads.
• forge fmt --check and ABI consistency checks pass.

Independent review, manifest generation, deployment, and the live frontend remain downstream assignments.

Implemented within test/:

• Added multi-round fuzz tests using vm.roll for purchase boundaries, settlement timing/order, zero hashes, and full refunds.
• Strengthened invariants for DRAW conservation, single settlement, and refunds of tickets × 1,000 DRAW.
• Covered invalid buys and rejected repeat settlements, refunds, and claims.

forge build and full forge test passed, including 12,288 invariant actions. No reproducible implementation defects found.

Created launch.json for Draw (DRAW) and BlockhashLottery(["$token"]).

Validated the canonical schema, refinements, metadata, and constructor ABI matches. forge build succeeded; all 48 tests passed. Only launch.json is changed outside scratch build artifacts.

Review complete. No exploitable defect found in the implementation; one informational test-coverage gap recorded in .imd-findings.json. No repository files were changed.

Attack-by-attack results

• Blockhash window (zero hash, off-by-one). Fails. Settle at or before the draw block reverts TooEarly. Without injected hashes, Foundry returns a real hash at draw+256 and zero at draw+257, and the contract draws at +256 and expires at +257, matching the spec. A zero hash inside the window reverts HashUnavailable and leaves the round retryable. Mutating the window to 255 or 257, or the TooEarly comparison to strict, breaks 6 to 17 existing tests.
• Range lookup off-by-one. Fails. Cumulative end indices are strictly increasing and the last one equals the ticket count, so the search always lands inside the array. I confirmed the winner at indices 0, 99, 100, 199 and 200 across a 100/100/1 purchase layout. Mutating the comparison to <= breaks 12 tests.
• Carry accounting across settle order. Fails. The hash window closes at G+300r+560, which is inside round r+1's sale window, so a drawn round's carry can only ever land in round r+1. Only expired or empty rounds can forward carry further, and the destination is always the currently selling round, which cannot yet be finalized. The balance invariant held over 12,288 randomized calls with reverts disallowed, and in both settle orders for interleaved expired and drawn rounds.
• Double settle or double refund. Fails. The state enum blocks a second settle on drawn, expired and empty rounds. The refunded mapping blocks a second refund. Removing the refunded flag breaks 18 tests.
• Predicting or steering the result. Fails within the approved design. Purchases use the round of the executing block, so nothing bought after the hash is visible can enter the drawn round. The winner depends only on the draw hash and round number, so settle timing cannot change it. The remaining levers are validator block withholding and total settlement inactivity for 256 blocks forcing refunds, both documented in the README as accepted for a Sepolia toy.

Manifest. launch.json is schema-valid. BlockhashLottery's constructor takes one nonpayable address and the manifest passes ["$token"]. LaunchToken has no constructor arguments. Neither contract has an owner, role, initializer, payable path, receive or fallback, so no privilege is granted to the factory or anyone else. The protected floor tests pass under a simulated CREATE2 factory flow with the token deployed first.

The one finding (info). No test observes that a drawn round's carryIn is reset to zero. Deleting that reset leaves all 48 tests green because carry assertions target the next round and the invariant only counts carry on unsettled rounds. The shipped code does reset it, so the impact is confined to a possible future regression in the historical pot view.

Implemented the frontend, static export, runtime deployment manifest, and documentation.

• Build, typecheck, and 23 interaction checks pass.
• ABI hashes, asset inventory, and live RPC reads verified.
• Submission audit: 1.75 MB, below 8 MiB.
• No live transactions or publication performed.

See validation and design notes, placed under docs/ to respect scope.

Commit blocked: .git is read-only. Deliverables remain in the working tree.