Implemented TokenDeals with vendored dependencies, adversarial tests, invariants, and deployment documentation.

Validation passed:

• forge build
• forge test: 82 tests, including 8,192 invariant calls using the supplied seed
• forge fmt --check
• Local deployment rehearsal

Ready for the IMD launch service; no mainnet transaction was broadcast. The owner configures passSigner after launch.

Created launch.json, matching TokenDeals’ zero-argument constructor and documenting signer setup.

Validation passed: manifest structure, compiled ABI, forge build, and all 82 tests using the supplied fuzz seed. Only the manifest is included in the deliverable.

The findings file is valid, all three snippets match their cited lines, and the coverage record answers all 11 entry points plus three invariants. The scratch tests live under the gitignored test/scratch directory and no tracked file changed.

Outcome. The math area of TokenDeals holds up. I found no medium or higher defect. The file .imd-findings.json holds one low and two info findings, each with a reproduction verified by a scratch Foundry test on this tree.

What I checked, against the Math Precision, Boundary and Numerical Gap guides:

• Cost uses OpenZeppelin mulDiv with Ceil and fee uses floor, exactly as the brief specifies. Overflowing products revert through checked arithmetic rather than wrapping. There are no narrowing casts of user values.
• Sum of partial buys never underpays the seller, and the per-coin caps are checked on the rounded total in the correct base units for every default coin.
• ETH and coin branches enforce exact msg.value, pull the total from the payer, and pay cost and fee separately. The live FeeSplitter on mainnet accepts ETH in about 220 gas of execution, so the 50k gas push cannot fail against current code.
• Taxed sold tokens, no-bool tokens, donations and pay coins that are also escrowed all keep the escrow solvent. The existing suite of 82 tests, including the 128 by 64 invariant run, passes.

Findings written:

1. Low. Deal expiry is exclusive at the exact timestamp while pass expiry is inclusive, so a pass signed to expire at T still buys at the discounted fee at T.
2. Info. Fee rounds to zero when cost is under 100 base units, and minBuy may be zero, but gas makes splitting uneconomic.
3. Info. In 6-decimal coins the smallest price step is one millionth of a coin per whole token, which cannot price very low-value tokens finely.

Not reached. I did not build a test for a buyer deliberately starving a contract seller's ETH push of gas via the 63/64 rule, because the brief defines a failed push as a credited debt, so that path is in-spec rather than a defect.

The permissions review of TokenDeals is complete. I found no substantiated defect in the Access Control, Trust Gap or Asymmetry areas, and .imd-findings.json holds an empty findings list with a coverage row for every one of the 11 entry points plus three invariant rows.

What I checked against the code

• Access control map. The owner is a compiled constant, so neither the factory nor the transaction origin ever holds it. The six owner functions carry the same guard. Seller-only paths check the recorded seller. There is no receive or fallback, so direct ETH reverts. No sweep, execute, approve, upgrade or ownership function exists in the ABI.
• Asymmetry pairs. The ETH and coin branches of buy pay the seller the cost and the FeeSplitter the fee in the same order and both skip a zero fee. Inventory and open status are written before any external call in buy and cancel. Credit is zeroed before the payout in claimOwed. The open and update validation rules match for price and expiry, with minBuy bounded by actual receipt and by remaining inventory respectively.
• Trust gap seams. Fee changes are bounded by the buyer's maxTotal and route to a constant recipient, so the owner cannot profit from them. Cap changes and pauses can only make buys revert, never move value, and sellers keep cancel and claims. The holder pass is recipient-bound and reusable within 24 hours by design.

Live checks on Ethereum mainnet

• The FeeSplitter accepts a plain ETH send for about 220 gas of execution, well inside the 50,000-gas push limit, so fees will not pile up in the owed ledger.
• USDC, USDT, IMD and SHIFT have code, report the decimals the caps assume, and delivered exact amounts in a fork probe, including a cap-sized buy through a fresh desk. USDT returned no boolean and SafeERC20 handled it.
• The owner address carries an EIP-7702 delegation designator. This does not affect the onlyOwner checks.

Local verification. The existing suite passed: 81 unit and fuzz tests across six suites plus the three stateful invariants. My scratch fork probes were removed and nothing in the tree was changed besides the findings file.

Not reached in depth. Math rounding, numerical boundaries and economics belong to the other specialists and I only touched them where they intersected with permissions. One documented trust assumption remains for the author to keep in mind: any coin added later through setPayCoin must be a plain ERC-20, since the payment side trusts the pulled amount while the sale side measures receipt.

Review complete. The findings file is valid, the quoted snippet matches lines 354 to 356 of the contract, and the scratch test lives only under test/scratch.

Outcome. The control-flow area of TokenDeals holds up. I traced every entry point through its checks, state writes and external calls against the Execution Trace, Periphery and First Principles guides and found no critical, high or medium defect. The existing suite of 82 tests passes and covers every item the brief's test list names.

One low finding, written to .imd-findings.json with a reproduction. The ETH push to a seller forwards at most 50k gas. A seller that is a contract whose receive needs more than roughly 52,300 gas is silently credited to owed instead of paid, and if that contract cannot issue an arbitrary call it can never run claimOwed, so the ETH stays in the desk forever. The brief mandates the credit path, so this is a documented limitation with a concrete trigger rather than a spec breach. A scratch test shows a receiver with two fresh storage writes is paid and one with three is credited.

Periphery checks done against the live chain. The FeeSplitter at the fixed address has an empty receive, no proxy slot and no upgrade path, and its ABI has no function able to call claimOwed. The stipend alone covers its receive, so a fee push to it cannot fail. That matters because a failed fee push would otherwise be unrecoverable.

Leads I examined and rejected. The static analysis lines on reentrancy, strict equality and the ignored tryRecover return all sit behind the guard or are handled explicitly. Fee-on-transfer sold tokens, pay coins escrowed in other deals, recipient hooks, malicious tokens and sellers, pass replay across chain or contract, expired-deal renewal, pause interplay and owner powers all behave as the brief specifies.

Coverage record. All eleven entry points have a row, ten hold and buy carries the finding. Five extra rows cover the escrow, exact-payout and no-custody invariants, pass validation, and the test suite itself. Nothing in my area was left unreached.

The review is complete. The economics of TokenDeals hold up well; I found no critical or high defects, and the findings file at the repository root records three items with a full coverage record.

What I checked

• Traced all eleven state-changing entry points against the Economic Security, Invariant and Flow Gap guides, plus the Senior Auditor's Mindset: value flows, token misbehaviour, conservation laws, cap and fee paths, view versus write agreement, and the seams between execution, periphery and intent.
• Ran the project suite with the README seed. All 82 tests pass, including the stateful invariant campaign, and the format check on project files passes.
• Verified the live dependencies on Ethereum mainnet: the FeeSplitter accepts a plain ETH send for roughly 220 gas inside the 50k push bound, and USDC, USDT, IMD and SHIFT report the decimals and symbols the caps assume.
• Ruled out several leads after tracing them: fee-rounding evasion by splitting buys is dust-level, gas-starving the ETH push cannot leave enough gas to finish the buy under the 63/64 rule, and seller price raises are bounded by maxTotal and exact msg.value.

Findings written to .imd-findings.json

1. Low, with proof. A coin buy pulls the total and pushes cost plus fee assuming the full amount arrived. If an allowlisted coin starts taxing transfers, which USDT's fee switch can do without any owner action, each buy drains other sellers' escrow of that coin. The scratch proof fails on current code: the desk holds 998.99 USDT against 1,000 USDT of an unrelated open deal, and that seller's cancel reverts. A balance-delta check on the pull closes it.
2. Low. The buy call commits only to the deal id. A buy submitted against a predicted id while the seller's open is pending can be front-run by an open of a worthless token at the same price. Reproduced in a scratch test. The fix touches the agreed ABI, so it is flagged as a scope decision.
3. Info. The FeeSplitter is a keeper-driven distributor with no arbitrary-call function, so it could never claim credited ETH fees. Its receive currently succeeds cheaply, so nothing is credited today. Recorded for the operator.

Coverage. Every listed entry point has a row: buy is marked finding, the other ten hold. Four extra rows cover the escrow, exact-payout and ETH-credit invariants and the mainnet dependency reads. No part of the assigned area was left unreached. Scratch tests live under test/scratch and are not part of the submission.

I added two test files. forge build passes, and forge test with the verifier's seed passes all 102 tests in 9 suites (82 already there, 20 new). I found no defect that needs a failing proof.

The earlier contributor's suite already covered most of the brief, so I wrote tests for the gaps and committed them as b759283:

test/TokenDealsEdges.t.sol (19 tests, 6 of them fuzz):

• Pricing: a 6-decimal sold token is priced per 1e18 base units, as the brief says (5e6 units at 2 ETH cost 1e7 wei).
• Exact boundaries:
  • A buy one second before expiry works and one at expiry fails.
  • A pass expiring 24 hours plus one second ahead is refused, and the same pass works one second later.
  • When minBuy equals what's left, only the rest can be bought.
  • The leftover below minBuy after odd partial buys can still be bought.
  • Deal ids keep counting up across cancels and fills.
• Fees:
  • At 0% fee, nothing goes to the FeeSplitter.
  • The 2% maximum settles exactly at an odd price.
  • The cap counts the reduced holder total, so a pass can fit a buy under the cap that would otherwise be refused.
• Relayer buying for a user: a relayer pays USDC for a private deal using the recipient's pass. The relayer's own pass and the relayer as recipient are both refused.
• Reentrancy from a seller: while being paid in ETH, a seller contract tries cancel, update, buy and claimOwed. All four are blocked. Then it rejects ETH, gets credited, and claims the credit.
• Fuzz:
  • Splitting a buy never lowers the seller's cost.
  • The holder fee is never above the normal fee or 2%.
  • Invalid fee settings are always refused.
  • A deposit of a token with a 2% transfer tax holds exactly what arrived.
  • USDT buys for another recipient pay exactly cost and fee, with the cap and maxTotal checked.
  • Any wrong msg.value is refused.

test/TokenDealsConservation.t.sol: a second invariant suite with its own handler (256 runs, 16,384 calls, no unexpected reverts). It keeps running totals across ETH, USDC and USDT, a plain token and a 2%-tax token, a seller that rejects ETH, relayers and passes. During the run the owner changes fees, pauses and changes caps. It checks that:

• Sellers' balances plus what they're owed equal the total cost of every buy, and the FeeSplitter's equal the total fees.
• The contract never keeps USDC or USDT, and its ETH equals the total owed.
• Each token's escrow equals deposits minus sales minus cancels, which equals the sum of left over open deals.
• Closed deals never reopen.
• Calls that must fail (wrong maxTotal, wrong ETH, a stranger or the owner cancelling, buying when paused or closed) never succeed and move nothing.

The first invariant run failed because of a bug in my handler, not the contract: after partial buys, left can drop below minBuy, which is valid. I fixed the handler.

I checked the live FeeSplitter through a public RPC. Receiving ETH costs about 220 gas beyond the 21,000 base, so the contract's 50,000-gas forward to it is safe.

I wrote two informational items to .imd-findings.json (it's git-excluded, so it isn't in the commit). Neither is asserted in a test:

1. Cap units: setMaxPay takes base units, but the brief describes caps in whole coins. Read literally, setMaxPay(USDC, 3000) sets a cap of 0.003 USDC. The requester should confirm the unit and document it for the owner.
2. Desk as recipient: buy accepts the contract itself as recipient. The payer pays, but the tokens stay stuck in the contract. Only the payer's own mistake is at risk.

The machine had no git identity, so I committed under the repo's existing IdentityMD Worker identity for that one commit and left the global config unchanged.

Review complete. The findings file is written at .imd-findings.json with 7 findings and 13 coverage rows. No tracked file was changed.

Outcome. TokenDeals is sound. Nothing critical or high was found. All 102 project tests pass, the deployed runtime is 7,443 bytes with no reachable DELEGATECALL, CALLCODE or SELFDESTRUCT, the owner role matches the brief, and launch.json is schema-valid for the zero-argument constructor.

What I kept, after reproducing each against the code:

• Low, with proof: buy pulls total of the payment coin and pays out cost + fee without measuring what arrived. If an allowlisted coin starts taxing transfers (USDT has that switch), each buy drains other sellers' escrow of that coin. The economics specialist's proof fails on this tree as described, so it is attached.
• Low, merged from two specialists: ETH credited to owed[] is only claimable by the credited account. The 50k gas push bound credits legitimate receivers that need about 66k gas, and such contracts often cannot call claimOwed. The live FeeSplitter accepts the push today, which I confirmed over mainnet RPC, but it has no way to claim either.
• Low: pass expiry is inclusive at the exact timestamp while deal expiry is exclusive.
• Info: buy commits only to the deal id, so buying a predicted id can be front-run by an open of junk at the same price. Info: setMaxPay takes base units while the brief says whole coins. Info: the desk itself is an allowed recipient, stranding tokens. Info: fees round to zero under 100 base units and minBuy = 0 allows fee-free splitting.

Dropped: the 6-decimal price granularity note, since it describes the brief's own price definition rather than a defect.

Coverage. All 11 entry points answered: buy carries finding 1, the other ten hold. Two extra rows record the custody/opcode invariant and the manifest check.