Added the missing fixed-supply LaunchToken, 15 token tests, and updated documentation. The allowlist remains unchanged.

• forge build, all 34 project tests, and forge fmt --check pass.
• All 8 supplied protected checks pass with local deployment parameters.
• Allowlist runtime: 435 bytes; measured successful claim: 46,359 gas.

Sepolia deployment remains pending the reviewed Merkle root, RPC URL, and configured signing account.

Created launch.json matching the accepted contracts and using the documented demo Merkle root.

Schema and ABI validation passed. Offline forge build and forge test passed: 34 project tests and 8 protected checks.

Only the manifest is submitted. Sepolia deployment remains pending.

The audit is complete and the findings are written to .imd-findings.json. No file other than that report was changed.

Verdict: the contract is correct. I found no failing input for AllowlistClaim. The three findings are operational, ranked low, low, info, and none sends the implementation back.

What I verified

• Build, tests and format check pass offline in a scratch copy. All 34 tests pass, including the three fuzz tests.
• Runtime size is 435 bytes, matching the README and the gas report.
• The gas report reproduces exactly on a fresh local Anvil node using the shipped script. A depth-2 claim costs 46,359 gas.
• The fixed vector in the test and in the manifest is right. I recomputed the four-leaf root and both proof siblings with cast keccak and they match.
• All 8 protected floor checks pass against the compiled creation bytecode with a simulated CREATE2 factory on chain 11155111. The token mints the full supply to the factory and the allowlist constructor does not move it.
• The runtime contains no CALL, DELEGATECALL, CALLCODE, CREATE, CREATE2, STATICCALL or SELFDESTRUCT. It uses PUSH0, which Sepolia supports.
• Leaf hashing covers exactly the 20 address bytes, sorted-pair hashing matches the OpenZeppelin convention, the ABI decoder rejects dirty address bits and truncated proofs, ETH is rejected on every entry point and in the constructor, and the address-as-slot storage layout has no other variable to collide with.
• The manifest is schema-valid: all five required keys, no extras, a 66-character bytes32 argument, and notes well under the limit.

Findings

• Low, Deploy script. The bare offline dry-run fails with an encode length mismatch because only run(bytes32) exists, and the documented form reverts with "Sepolia only" on the default local chain. It works only with the chain id overridden. Non-blocking because the factory deploys from the manifest.
• Low, manifest root. The constructor root is the Anvil demo tree. Those four private keys are public, so anyone can spend all four claims on the launched instance. The notes disclose this and the contract is value-free. The requester must supply a real root if the allowlist is meant to mean anything.
• Info, no Sepolia receipt. The tree has no deployment record and the README says deployment is pending. That is expected before the network deployer runs.