Approved workflow

Release Badges (ERC-20 symbol BDGE) on Sepolia as an evm_project: the fixed-supply launch token plus one application contract. Token: Badges (BDGE), total supply 1,000,000,000 BDGE with 18 decimals, minted once to the deployer. Application contract: SoulboundBadges. Currency: creating a badge type burns 100 BDGE as an anti-spam fee. SoulboundBadges takes the BDGE address as its only constructor argument (constructorArgs ["$token"]), exposes it as token() and holds no BDGE at deploy or ever: the fee moves straight from the creator to 0x000000000000000000000000000000000000dEaD with SafeERC20.safeTransferFrom after a BDGE ERC-20 approve (users get BDGE by swapping Sepolia ETH in the launch pool). No payable function, no owner, admin, pause or upgrade path. A Sepolia test toy: badges are not credentials, and the README and the page say so. SoulboundBadges is an OpenZeppelin ERC-721 with ERC721Enumerable, named "Soulbound Badges" with symbol "SBADGE" (source constants, not constructor arguments); badge type ids and token ids both start at 1 and increase by one. Tokens are soulbound per ERC-5192 (interface id 0xb45a3c0e): locked(tokenId) always returns true, Locked is emitted at mint, and badge transfers plus the badge contract's own ERC-721 approve and setApprovalForAll revert (burn is the only way a badge leaves its holder). createBadgeType(bytes32 name): the name must be 1-32 characters from [A-Za-z0-9 _-] right-padded with zero bytes (anything else reverts, which keeps the on-chain JSON and SVG safe to render); burns the 100 BDGE fee; the caller becomes the type's issuer. Names need not be unique, so the site always shows the type id and issuer next to a name. setIssuer(typeId, newIssuer): current issuer only, non-zero. award(typeId, to): issuer only; one live badge per (type, holder); to != address(0). burn(tokenId): the holder only; afterwards the issuer may award that type to them again. Actors: anyone creates a badge type; only a type's current issuer awards it or hands it over; only a holder burns its badge; any other call reverts. tokenURI reverts for a burned or unminted id and otherwise returns on-chain base64 JSON (name, type id, issuer, image) with a generated SVG showing the badge name and a colour derived from the type id. Views: badgeType(typeId) returning (name, issuer), typeCount(), badgeOf(typeId, holder) returning the holder's live badge token id or 0, typeOf(tokenId), tokenOfOwnerByIndex, supportsInterface (721, 721Enumerable, 5192). Events: TypeCreated(typeId, name, issuer), IssuerChanged, Transfer and Locked from the standards. Tests (Foundry) must cover: badge transferFrom, both safeTransferFrom variants, ERC-721 approve and setApprovalForAll all reverting, the name charset check, the fee burn (the contract never holds BDGE), duplicate awards refused, holder-only burn and re-award, issuer handover, tokenURI decoding to valid JSON with an SVG, and supportsInterface for ERC-5192. The independent adversarial review must attack: any path that moves a badge (safeTransferFrom variants, approvals), JSON/SVG injection through the name, awarding a type you do not issue, and the fee being skippable. Deploy through the project factory, then publish a one-page website to create a badge type (approve 100 BDGE), award badges, and show a profile page of any address's badges. The page shows the connected wallet's BDGE balance and allowance and says BDGE comes from swapping Sepolia ETH in the launch pool. Lists come from contract views and events only (no backend, no indexer). Keep it to one small page; the static export has index.html in dist/.

Sepolia (11155111) only. GitHub publication and IPFS hosting are approved. Launch token: a separate fixed-supply ERC-20, 18 decimals, no constructor arguments, exactly 1,000,000,000 minted to msg.sender, no mint or admin functions. The factory sends that supply to LP and rewards, so no application contract may need a launch-token balance at deploy. Application contracts are fully configured in nonpayable constructors using only address, uint, bool or bytes32 arguments (no strings, arrays, proxies, delegatecall or selfdestruct); anything else is set at runtime. No owner unless the request names one, and then it is $owner. No external oracles, VRF or keepers: randomness is commit-reveal or a future blockhash read within 256 blocks with a refund path. foundry.toml sets bytecode_hash = "none". The website is a static export with index.html in dist/. Site label lab-soulbound-badges.

Build BDGE and SoulboundBadges (SoulboundBadges takes constructorArgs ["$token"] and burns 100 BDGE per badge type) with Foundry tests and an independent adversarial review, deploy them through the project factory, then build the one-page website against the live deployment.

One static page, no framework beyond what the skill needs, reading the live deployment's ABI and address. Approve BDGE before paying; show BDGE balance and allowance.