Added 13 tests under test/, covering failure rollback, admin-call rejection, allowance invariants, and exact-output v4 swaps.

forge build and forge test pass: 44 tests, 0 failures, including 40,960 invariant calls.

No reproducible defects found. Integration tests run offline; live mainnet factory/router verification remains outstanding.

Updated launch.json, preserving the exact token, pool, and economics values and correcting the notes.

Validation passed against the supplied schema and compiled constructor ABI. forge build succeeded; forge test passed all 44 tests.

Only launch.json changed.

Review complete. The findings file is written and parses cleanly.

What I did. I read the Senior Auditor's Mindset and the Access Control, Trust Gap and Asymmetry guides, then traced every entry point of src/SIMDTESTToken.sol against them. I ran the existing suite (44 tests pass) and reproduced each lead against the vendored Uniswap v4 PoolManager in scratch tests.

Access control holds. The contract has no owner, role, initializer, fallback or receive. The constructor mints exactly 1e27 to the factory and hands out nothing. All admin selectors revert from every launch role. Supply has one writer after deployment, and it only decreases.

Findings written to .imd-findings.json:

1. Medium: claims-settled buys never burn. The burn fires only on an ERC-20 transfer whose sender is the PoolManager. Uniswap v4 lets any trader settle the SIMDTEST leg with ERC-6909 claims (mint on buy, burn on sell) instead of take, so no tokens leave the PoolManager and nothing burns. A 0.01 IMD buy yields 3,964.66 SIMDTEST gross with zero burn, where the take path burns 39.65. The claim is transferable and can be sold back without ever burning. This breaks brief items 4 and 6 for any trader using a claims-aware router. A plain ERC-20 cannot see this flow, so the fix is a requester design decision (afterSwap hook, or explicitly documenting the gap). A self-contained proof fails on the current code.

2. Low: non-buy PoolManager outflows are burned. Liquidity removal and protocol-fee collection are taxed 1% even though they are not buys. The README already documents this and the brief's own wording equates outflows with buys, so it is reported for confirmation only.

Coverage. All three listed entry points have rows, plus seven invariant and asymmetry rows, including the PoolManager self-take edge case (self-harm only, not reported) and the gross-versus-net slippage note (documented, not reported). No area in my assignment was left unreached. Fork runs against live mainnet state remain outside this review.

The findings file is in place (excluded from git by the harness's own .git/info/exclude, as intended), the scratch directory is removed, and no tracked file changed.

Review summary — economics (Economic Security, Invariant, Flow Gap)

Scope covered: src/SIMDTESTToken.sol in full (all three entry points, the constructor, _transfer), the launch manifest's economics/price consistency, and the four launch flows (swarm share → distributor → claimant, single-sided seed, buy, sell) traced against the vendored v4 PoolManager at the pinned address. The existing 44-test suite and tools/check_manifest.py pass. I did not run a mainnet fork (no network), so the real IMD pair token and production router are untested here — same gap the README already declares.

What holds: supply conservation (sum(balanceOf) == totalSupply), supply monotonically non-increasing, no mint/admin surface, exact inbound settlement to the PM (sells and seeding untaxed, so settle() is never short), atomic rollback of a burn on a failed unlock, PM reserve accounting never falling below pool accounting (the burn comes out of the recipient's side, not the PM's), and initialPrice ≡ √(2500e18 / 1e27)·2⁹⁶ for SIMDTEST as currency0.

Findings (2):

1. Medium — the 1% buy burn is avoidable via ERC-6909 claims. A swap whose output is settled with PoolManager.mint (and later paid back with PoolManager.burn) never calls SIMDTESTToken.transfer, so from == POOL_MANAGER never fires. Reproduced: ~396,293 SIMDTEST bought and resold with totalSupply unchanged at 1e27, versus 3,962.9 burned for the identical swap settled with take. Arbitrage/MEV volume — usually the bulk of pool volume — pays nothing; only take-settling (retail) buyers pay. No funds lost; the stated guarantee is just not enforceable from inside a hookless token. Fix requires a design decision (an afterSwap hook, or documenting the limitation).
2. Low — non-buy PM outflows are taxed. Liquidity withdrawal, LP fee collection and protocol-fee collection all go through take, so the factory's 900M-token position pays ~9,000,000 SIMDTEST on a full exit. Consistent with the brief's mechanism ("transfers from the PoolManager") and documented in the README, but contradicts its claim that "the fee applies only to buys"; flagged for an explicit requester sign-off.

Considered and not reported (dust/self-harm): burn-avoidance by splitting withdrawals into <100-unit transfers; a take to the PM itself (the taker must pay the full amount — pure donation); router slippage checks measuring the gross delta rather than net delivery (intended consequence of the requested design, already in the README).

Coverage record has 11 rows: the 3 ABI entry points (approve: holds, transfer: finding 1, transferFrom: holds) plus 8 invariant/flow/economics rows.

The review is complete. The findings file is at the repository root with three findings and nine coverage rows, and the scratch tests I used were removed so the tree is otherwise untouched.

Outcome. The token's arithmetic is sound. The one multiplication cannot overflow because any amount is bounded by the sender's balance, which is bounded by a supply that only shrinks. Balance conservation holds on every path including PoolManager self-transfers, and all zero, max and zero-address edges revert or no-op correctly. The defects I found sit at the Uniswap v4 boundary, not in the integer math, and none is severe enough to need a proof file.

Findings reported (all reproduced against the vendored PoolManager runtime at the pinned mainnet address):

• Low: non-buy outflows are burned. The only notion of a buy is the sender being the PoolManager. Removing liquidity, collecting LP fees and protocol fees all travel the same path. Withdrawing half the seeded position burned 4.5 million SIMDTEST from the provider's own principal, against the brief's statement that the burn applies only to buys. The README documents this reading, so the requester must either restate the rule or move the burn into a hook.
• Low: claim-settled buys are never burned. A swapper who settles with ERC-6909 claims instead of taking ERC-20, and sells back by burning claims, bought and resold about 3,965 SIMDTEST with zero burn. The rule is effectively an exit-from-PoolManager burn, not a buy burn. No funds are lost and the launch flow is unaffected.
• Info: rounding down and chunked takes. Outflows under 100 minor units burn nothing, and splitting a take into 99-unit chunks avoids the burn entirely. Quantified: about 788k gas to save 99e-18 tokens, so it is not exploitable. Recorded so the rounding direction is visibly covered.

Coverage. All three ABI entry points have rows. The approve and transferFrom paths hold. The transfer path carries finding 1, with finding 2 noted in the same row. Six additional rows record the invariants and boundaries I checked, including inbound seed and sell settlement in both currency orders.

Not reached. Nothing within the assigned math, boundary and numerical-gap area was left unchecked. Live-state fork checks against the real paired token and router remain owed to the operator, as the project's own README already states.

Both cited snippets match the tree exactly, the JSON parses (2 findings, 12 coverage rows), scratch files are removed, and the working tree is clean apart from .imd-findings.json. Nothing further is outstanding — the review is complete.

Summary

Area: Execution Trace, Periphery, First Principles — on SIMDTESTToken (77 lines, 3 state-changing entry points).

Result: the token holds. I traced every path of approve, transfer and transferFrom against the three guides' failure modes — parameter divergence, value leaks, sentinel bypass (type(uint256).max, address(0)), stale reads, partial state updates, approval residuals, desynchronized coupling, boundary abuse (0 / max / self-transfer / manager self-transfer), and the overflow assumption on line 65. None break: allowance is debited on the gross amount before the move, debit precedes credit so self-transfers are exact, sum(balances) == totalSupply after every path, supply only ever decreases, and there are no external calls so no reentrancy or inconsistent intermediate state. I also reproduced all five launch-floor flows (distributor transfer, claim, seed, buy, sell) against the real v4 PoolManager compiled in place: each moves exactly what it says.

Findings written to .imd-findings.json:

1. Low — periphery provenance record does not verify. sha256sum -c lib/SHA256SUMS fails on 8 of 48 vendored v4-core files. I fetched the pinned upstream commit and showed the recorded sums are the true upstream values; the committed files were reflowed by forge fmt (no [fmt] ignore for lib/). I verified the deviation is semantically nil (whitespace-only, plus one brace pair in Hooks.sol), so the integration tests do run real v4 logic — but DEPENDENCIES.md's "unchanged upstream files / exact downloaded contents" claim is false and the only offline provenance check fails.
2. Info — the 1% burn fires on every PoolManager outflow, not only buys. Reproduced with modifyLiquidity(-L) + take: an LP withdrawing gets 99% and 1% burns. This is exactly the requester's address-based rule and the README documents it, so not a defect; recorded because the brief's "(i.e., buys)" is inexact, routers checking v4 deltas enforce 1% less slippage than they think, and no existing test pins the LP-withdrawal / ERC-6909 / protocol-fee paths.

Coverage: all 3 ABI entry points holds, plus 9 invariant/periphery rows. No critical/high, so no proof files were needed. Static-analysis leads: slither empty; aderyn's large-literal lead at line 11 is style only — the literal is exactly 1e27 and left out.

Wrote .imd-findings.json with one low-severity finding: eight vendored dependency checksums fail verification.

All three entry points are covered. Burn-related reports were dropped because they follow the specified PoolManager-source transfer rule.

Offline build, formatting, manifest checks, and all 44 local tests passed with two seeds. No source or configuration files changed.