Approved workflow

The Invite (INVT) launch token and the ReferralList application contract are implemented, tested, documented, and exported. All checks pass.

Delivered

• src/LaunchToken.sol: Invite (INVT), 18 decimals, exactly 10^27 minor units minted to msg.sender, no arguments, no admin surface.
• src/ReferralList.sol: join for exactly 1,000 INVT with the 200/800 referrer split or a full 1,000 burn to the dead address, pull-based claim, depth and maxDepth tracking, member enumeration, and a permissionless burnExcess for stranded tokens. No owner, no ETH path, single $token constructor argument.
• test/: 37 tests across unit, failure-path, re-entrancy, fuzz, and stateful invariant suites. They cover every case the brief named, including the 5-level chain, double join, self-referral, claim-twice, and the balance-equals-claimable invariant.
• docs/abi/LaunchToken.json and docs/abi/ReferralList.json: ABI exports.
• README.md: deployment parameters, assumptions, the accepted second-wallet self-referral discount, operational responsibilities per downstream role, and the list of tested and untested edges.
• lib/: forge-std v1.9.7 and OpenZeppelin v5.1.0 vendored as plain files with nested git metadata removed, so the offline verifier can build.

Verification

One design addition to flag for the reviewer. The brief did not ask for burnExcess. I added it because INVT sent directly to the contract would otherwise be permanently unclaimable, which is one of the four attack targets the review must cover. It can only move the balance above totalClaimable and never touches referral credit. If the reviewer prefers the contract without it, removing the function and its two tests is a small change.

Nothing is committed. The working tree contains only ordinary files and no submodules, ready for the harness to commit.

Created launch.json for Invite (INVT), with ReferralList(["$token"]) and the supplied native-ETH pool settings.

Validated the schema, refinements, and compiled constructor ABIs. forge build succeeded; forge test passed all 37 tests.

Only launch.json is a submission change.

No blocking defects found. The implementation holds against every requested attack, and the manifest matches the constructor. Findings are written to .imd-findings.json. No source, test, config, or ABI files were changed.

Requested attacks, with why each fails

• Fee split arithmetic. The three amounts are compile-time constants with no division. With a referrer the contract credits 200e18 and forwards 800e18 to the dead address. Without one it forwards the full 1,000e18. Both paths pull exactly 1,000e18 from the joiner, and the unit, fuzz, and invariant tests all assert that every unit is burned, paid, or still claimable.
• Claim re-entrancy or double claim. The function zeroes the balance and decrements the total before the transfer, and is guarded by nonReentrant. INVT is plain OpenZeppelin ERC-20 with no hooks. A second claim reverts on the zero balance. The suite also proves the guard with a hostile callback token and checks the exact guard error selector.
• Referral cycles. A referrer must already be a member and the joiner must not be. Membership and the referrer pointer are written once and never cleared. Following the referrer chain therefore strictly decreases depth to zero. No call sequence produces a loop.
• Stranded INVT. Unsolicited direct transfers can be forwarded to the dead address by anyone, and that function cannot touch credit. The only residual case is credit owed to a referrer address that cannot itself call claim. That is inherent to the requested pull design and is recorded as an informational note with a reproduction.

Manifest check. The single constructor argument $token fills the one address parameter of ReferralList. The token has no constructor arguments and mints the full supply to the factory. No $owner reference exists, the constructor stores nothing about msg.sender, and no function is gated by any address, so the factory receives no role it cannot exercise. All schema fields are present and valid. The initial price is exactly 2^96 and the notes are under the length limit.

What I verified by running it

• The full Foundry suite passes. Formatting check passes.
• Both protected floor tests pass against the actual creation code with the factory as CREATE2 deployer and Sepolia chain id.
• The committed ABI exports are byte-for-byte equivalent to the compiled artifacts.

Findings reported

1. Low, test coverage. In the invariant handler's join function, the index into the member list is computed by calling memberAt before the guard that was meant to substitute a non-member referrer. When the modulo lands on the count, the handler call itself reverts and is discarded. The non-member branch is dead for every non-empty list, which is why the run shows 22 handler-level reverts on join. The unit test still covers that revert once.
2. Info. Credit owed to a contract account that cannot call claim stays in the contract forever. Documented pull-payment behavior, not a defect.
3. Info. The contract adds a permissionless excess-burn function, its event, and three read helpers beyond the workflow's enumerated interface. All are benign and reflected in the ABI exports.

The frontend is built, validated and committed as acca4c4 on top of the pinned source commit. The working tree is clean, only web/, dist/ and docs/ changed, and the submission bundle is 2.9 MB against the 8 MiB limit.

What was delivered

• Source in web/: Vite 7, React 19, TypeScript, wagmi 2 and viem 2, with the lockfile and a web/.gitignore that keeps node_modules out. Every primary action has a control: connect, switch network, approve 1,000 INVT, join with a ?ref= prefilled referrer, copy my link, claim credit, and burnExcess behind a disclosure. Reads show member count, max depth, fee split, unclaimed credit, and for a connected wallet its balance, allowance, membership, depth, referrer, credit and referral count. Referrals come from Joined events scanned in 40,000-block chunks with halving on provider rejection.
• Static export at dist/ with a relative base, plus dist/imd-deployment.json copied from the handoff: launch ID, chain, source commit, attestation hash, both contracts with verified ABI hashes, SHA-256 for all seven other files, and the network block copied unchanged. The app loads this same file at runtime as its only deployment configuration and refuses to start if an ABI hash mismatches. The Uniswap v4 quoter address from that block powers a read-only price quote. There is no in-page swap, as the approved workflow requires.
• Documentation: web/README.md (configuration, install, dev, preview, rebuild, validation), docs/validation.md (coverage of all six Better Interface domains, six findings with fixes, commands, browser evidence, untested behaviour), and docs/DESIGN.md (tokens, typography, layout, components).

Validation results

• Typecheck clean. 25 vitest tests pass against an in-memory mock wallet and RPC that mirrors the contract, covering connect, the 4902 add-then-switch flow, approve and join splits, referrer validation, rejection, claim, chunked event scans, clipboard copy and manifest guards.
• Playwright inspection of the final export at 320, 600, 768, 1024 and 1280 px: no console errors, no failed resources, no overflow, zero axe-core violations, visible focus ring at every tab stop, rendered contrast measured per state with no failing pair at rest. Live Sepolia reads worked, including ReferralList.token() and a real quoter price. Thirteen screenshots are in docs/validation/screenshots/.

Limitations to know about

• No real transaction was broadcast and no real wallet extension was driven. Write paths were exercised only against the mock chain.
• The MCP browser tool had no managed preview on this worker and its code-execution path was not permitted, so browser evidence comes from the Playwright script run as one bounded command.
• The acceptance criteria name a root DESIGN.md, but the repository root is outside the permitted write paths, so the document is at docs/DESIGN.md and the validation record says so.