Implemented Infinite Money Dopamine (IMD): 18 decimals, exactly 1,000,000,000 tokens minted once to the deployer, with no administrative powers.

Added vendored dependencies, success/failure tests, fuzz tests, stateful invariants, and deployment/operations documentation in README.md.

Verified with Solidity 0.8.26:

• forge build
• forge test
• forge fmt --check
• Clean offline build and parallel tests

All local checks pass. The protected network integration harness remains for the independent verifier.

runtime reported , not the required premium model claude-fable-5-1

I found no defects in the economics of IMD. I wrote .imd-findings.json with an empty findings list and a coverage record that answers all three entry points.

What I covered: the Economic Security, Invariant and Flow Gap guides

• Source: src/IMD.sol is a plain OpenZeppelin ERC-20. Its only custom code is the constant INITIAL_SUPPLY = 1_000_000_000 * 10 ** 18 and a constructor that mints that amount once to msg.sender. The vendored OpenZeppelin files are from v5.1.0, and I checked each one against the upstream tag: all five are byte-identical.
• Supply invariant: the only mint is in the constructor. The compiled contract has no other functions that change state, so it has no owner, mint, burn, upgrade or initializer function, and decimals are 18. The supply of 10^27 matches the brief and goes to the factory, which deploys the token through CREATE2.
• Flow gap: transfers charge no fee, burn nothing, rebase nothing, exempt no address and make no outside calls. Every launch flow arrives with exactly the amount sent: the swarm's 10% to the distributor, each claim, the pool seed through the PoolManager, and trader buys and sells. 10^27 is below 2^128, so the size of the supply cannot overflow the pool's liquidity maths.
• Economic security: nothing lets a privileged caller pause, blacklist, freeze, seize or burnFrom a holder. transferFrom needs a real allowance, uses it up exactly, and reverts with no partial change when the balance or allowance is short. The runtime code has no DELEGATECALL, CALLCODE or SELFDESTRUCT.
• Static analysis lead: aderyn flagged a large number written out at src/IMD.sol:10. That is a style note only; the value is correct.

Checks run: forge test passes all 27 tests, including the stateful invariant runs (128 runs × 64 calls). I did not run the protected launch harness: it needs the network's launch environment and some source files this repository doesn't contain, such as LaunchLiquidity and v4-core. I worked through the seed and swap paths by hand against its code instead, so that part is reasoned, not executed.

Outside my area: there is no launch.json yet, so I couldn't check the pool settings or the economics block. Also, this token shares the name "IMD" with the network's pair token. That is the requester's choice rather than a code defect, but anyone writing the manifest should make sure pool.pairedCurrency is not confused with this token's own address.

No tracked files changed.

I found no defects in IMD, so .imd-findings.json has an empty findings list. It also has a coverage row marked holds for each of the three entry points, plus two invariant rows. The JSON parses and no tracked file was changed.

What I reviewed:

• The token itself: src/IMD.sol adds nothing to the OpenZeppelin ERC‑20 except the name, the symbol and a single mint in the constructor. That mint gives 1_000_000_000 * 10**18 to msg.sender, which is the factory at launch. There is no owner, mint or burn function, pause, blacklist, proxy, initializer or external call.
• The vendored library: the OpenZeppelin copy in the commit says it is unmodified v5.1.0, and its ERC20.sol behaves that way. Nothing in IMD overrides how transfers are processed, so every transfer moves exactly the amount asked. That means the launch transfers arrive whole: factory to distributor, distributor to claimant, and seeding and swaps through the PoolManager. None of these are taxed or need an exemption.
• Entry points:
  • approve sets the allowance to the new value, rejects a zero spender and emits Approval.
  • transfer reverts if the balance is too low or the recipient is the zero address.
  • transferFrom checks the allowance before moving anything; a maximum allowance is never reduced, and any failure undoes the whole call.
• Launch rules: the supply cannot grow after deployment, nothing privileged can move or freeze a holder's balance, and there are no DELEGATECALL, CALLCODE or SELFDESTRUCT paths.
• Static analysis: aderyn's "large numeric literal" warning is about the fixed supply constant and is harmless. Slither reported nothing.
• Tests: the existing forge test suite passes, 27 of 27 including the invariant run.

Limits:

• There is no launch.json in the tree yet, so this review does not cover the manifest fields (supply string, constructor arguments, economics).
• The supplied launch check (Token.protected.t.sol) depends on v4 and launch contracts that aren't in this tree, so I couldn't run it. I compared the token against its assertions by reading the code instead.
• I didn't write a proof test, since none is needed without a high or critical finding.

Created launch.json with exact token supply, empty constructor arguments, required economics and pair currency.

Validation passed against the supplied schema and compiled constructor ABI. forge build succeeded; forge test passed all 27 tests.

Only launch.json is included in the deliverable.

Review complete. The findings file is on disk at .imd-findings.json (its exclusion via .git/info/exclude is the harness's own rule, alongside .imd/); test/scratch/ is removed, and only ignored build output (out/, cache/) remains beside it.

Result: no defects in the assigned area

Scope covered (Access Control, Trust Gap, Asymmetry):

• Permission model — There is none to break. The compiled ABI exposes exactly approve, transfer, transferFrom plus views; no owner, pauser, minter, initializer, proxy, receive/fallback. Storage is only _balances, _allowances, _totalSupply, _name, _symbol. Unknown selectors and plain ETH revert.
• Constructor / deployment-time trust — Mints exactly 1e27 (checked against an independent literal, since the project's own test compares INITIAL_SUPPLY against the same expression) once to the immediate msg.sender, not tx.origin (verified with a deploying contract under a pranked origin). _totalSupply is only ever increased inside _update with from == 0, reachable only from the constructor's _mint.
• Trust gap: vendored library — All five OpenZeppelin files diffed byte-identical against the upstream v5.1.0 archive (SHA-256 matches PROVENANCE.md). Context._msgSender() is plain msg.sender — no forwarder backdoor.
• Asymmetry — transfer and transferFrom funnel into one _transfer/_update with identical checks and writes; transferFrom only adds the allowance decrement. No caller class (factory, PoolManager, distributor) is treated differently, so launch flows move exactly what they say. The deployer cannot move a holder's balance without allowance; a failed transferFrom restores allowance atomically; from == address(0) reverts before any transfer.
• Runtime opcodes — No CALL, STATICCALL, DELEGATECALL, CALLCODE, SELFDESTRUCT, CREATE, CREATE2. Project suite (27 tests incl. invariants) passes; forge fmt --check is clean on project files.

Static-analysis leads: Slither reported nothing; aderyn's "large numeric literal" at src/IMD.sol:10 is a compile-time constant that evaluates to the correct 1e27 — not a defect.

Behaviours noted but not reported as defects (standard ERC-20, documented in the README): the approve/transferFrom race; zero-value transferFrom emitting Transfer(from,to,0) without allowance (EIP-20 requires it); tokens sent to the contract itself being unrecoverable.

One open deployment item, recorded in coverage rather than as a finding: the runtime uses PUSH0 and MCOPY (evm_version = "cancun", a verifier-owned config). No chain table was supplied, so the deployer must confirm the launch chain supports Cancun.

Coverage record: 9 rows — the three listed entry points all holds, plus the constructor and five invariant/note rows.

Done. git status is clean apart from the (untracked, intended) .imd-findings.json; the scratch directory is removed and the JSON parses: 1 finding, 7 coverage rows.

Summary

Area: Math Precision, Boundary, Numerical Gap — for src/IMD.sol

The contract is a 16-line fixed-supply token over OpenZeppelin v5.1.0 ERC20. What I verified:

• Supply constant 1_000_000_000 * 10 ** 18 is exactly 10^27 (28 digits, computed with node, far below 2^256; compile-time constant so no runtime overflow). It equals 1e9 * 10**decimals() with decimals() == 18, and is minted once to msg.sender (the CREATE2 factory) in the constructor and nowhere else.
• No math surface of its own: no division, cast, fixed-point conversion, external call, payable path, receive/fallback, bytes decoding or sentinel branch in IMD.sol. OZ _update's unchecked blocks are bounded by a totalSupply that is fixed forever at 10^27.
• Vendored OZ integrity: all five files under lib/openzeppelin-contracts/contracts are byte-identical to the upstream v5.1.0 tag (downloaded and cmp'd) — the one place a hidden arithmetic change could have lived.
• Boundary probes (9 scratch tests, all passing as the standard specifies): amount 0, exact balance, balance+1, type(uint256).max; allowance exactly equal, max-1 (finite, decremented), max (infinite, untouched); self-transfer and self-transferFrom; transferFrom(from = address(0), …) cannot reach _update's mint branch; sum(balances) == totalSupply exact across 200 one-wei transfers (no rounding anywhere, so no precision×invariant drift).

Findings: none that are defects. One info row records the inherent ERC-20 approve race (owner approves 100 → spender takes 100 → owner approves 50 → spender takes 50 = 150), reproduced on this tree and explicitly marked as standard semantics requiring no revision — it's there so the judge has the boundary case on file.

Coverage: approve → finding 1 (info), transfer → holds, transferFrom → holds, plus four invariant rows (supply constant, single mint / no admin entry points, OZ unmodified, no payable/external surface).

Static-analysis lead (aderyn large-numeric-literal at line 10) checked: the literal evaluates exactly to 10^27 and is not a defect.

Added 13 boundary, failure-path, and fuzz tests. Extended invariants to mix successful and rejected calls across four actors.

Offline forge build and forge test pass: 40 tests, including 32,768 invariant calls.

Only test/ changed. No defects found.

The review is complete. The findings file is written and the working tree is otherwise untouched.

Outcome. The IMD token has no defects that require a revision. It is a 16-line contract inheriting OpenZeppelin v5.1.0 ERC20 unchanged, with no owner, mint, burn, pause, blacklist, receive, fallback or delegatecall surface. The constructor mints exactly 1e27 units to msg.sender once, matching the manifest's supply, decimals and empty constructor argument list.

Specialist findings judged.

• The single audit_math finding, the ERC-20 approve race, reproduced on this tree in a scratch Foundry test. I kept it at info severity. It is the standard's own semantics, needs a spender the owner already trusts, and opens no revision. No other specialist reported it, so there was nothing to merge.
• The other three specialists and the independent tester reported nothing, and my own pass against the Pashov, x-ray, Trail of Bits entry-point and ethskills checklists found nothing they missed.

What I verified myself.

• All three entry points traced through the vendored OZ code and probed at the boundaries: zero value, exact balance, balance plus one, self-transfer, zero addresses, finite and infinite allowance, over-balance spend. Every path reverts with the expected typed error or moves the exact amount.
• Common admin selectors called from the factory address all revert, and an ETH send reverts, so supply cannot grow and no holder can be frozen.
• The vendored library is plain tracked files, not a submodule. The existing 40-test suite and my 6 scratch tests all pass.

Coverage record. All three listed entry points answered holds, plus two invariant rows for the constructor supply and the launch flows. The scratch test directory was removed after the run.