Approved workflow

The deliverable is complete and verified offline.

What was built

• src/LaunchToken.sol: Crown (CRWN), OpenZeppelin ERC-20, no constructor args, 18 decimals, exactly 10^27 minor units minted to the deployer. No mint, owner, pause or upgrade path.
• src/KingOfTheHill.sol: the round-based game with the CRWN address as its only constructor argument, exposed as token(). Fixed constants of 1,000 CRWN, 110%, 5% and 24 hours. Claims pull CRWN via SafeERC20, payouts are pull-only through withdraw(), every mutating function is nonReentrant and follows checks-effects-interactions. No owner, no payable path, no receive or fallback.
• script/Deploy.s.sol: a key-free rehearsal script. Its chain guard accepts only 0, 31337 and 11155111, and its deploy() function is tested directly.
• docs/abi/LaunchToken.json and docs/abi/KingOfTheHill.json, exported from the build.
• README.md covering rules, economics with a worked example, interface, assumptions, manifest parameters and operational responsibilities. REVIEW.md is a builder-side adversarial pass across the five attack lines the workflow names, clearly marked as not the independent review.
• forge-std 1.16.2 and OpenZeppelin 5.7.0 vendored as plain files under lib/. No submodules, nothing needs the network.

Verification results

The tests cover the 1,000 CRWN minimum, the ceil(110%) boundary on an exact multiple and a value that must round up, the 5% bonus rounding down, a refused self-claim, claims one second before, at and after the deadline, settle before, at and after it with and without a king, a contract king, reentrancy blocked on all three actions through a callback mock token, fuzzed claim chains, and an invariant suite asserting held CRWN equals credits plus pot and that the pot equals the king's payment minus that round's bonuses.

Notes for downstream assignments

• The manifest should list KingOfTheHill with constructorArgs: ["$token"] and no owner; the game reads nothing from msg.sender in its constructor.
• Two documented design points for the independent reviewer: lastClaimAt is not cleared at settle (masked by deadline() returning 0), and CRWN sent by plain transfer instead of claim is unrecoverable.
• I did not commit. The working tree holds all new files as untracked, and the seat's global git config is unreadable in this sandbox, so committing needs GIT_CONFIG_GLOBAL=/dev/null or the harness's own commit step.

The only new file in the tree is launch.json. The other untracked entries are sandbox device nodes that were present before I started, not files I created.

Outcome. I wrote launch.json for the accepted Crown / KingOfTheHill project and verified it. No other file was changed.

Manifest contents

• kind is evm_project.
• Token is LaunchToken, name Crown, symbol CRWN, 18 decimals, matching the constructor in src/LaunchToken.sol, which takes no arguments.
• One application contract, KingOfTheHill, with constructorArgs ["$token"]. Its only constructor input is an address, so the reference is type-correct. It has no owner parameter, so $owner is not used.
• Pool pairs against native ETH with fee 3000, tick spacing 60, initialPrice 79228162514264337593543950336, no hook.
• Notes describe the accepted source, the fixed game rules, the pool and the offline build, and stay well under the 4000-character limit.

Checks run

• A schema check of every field, key set, pattern and refinement passed, including unique names, the reserved MerkleDistributor name, backward-only references, and the sqrtPriceX96 bound.
• Constructor arity and argument types were cross-checked against docs/abi/KingOfTheHill.json and docs/abi/LaunchToken.json.
• forge build --offline, forge test --offline (51 passed, 0 failed), forge fmt --check and the EXPECTED_CHAIN_ID=0 deploy dry run all passed.

error: the argument '--model ' cannot be used multiple times

Usage: codex exec [OPTIONS] [PROMPT] codex exec [OPTIONS] [ARGS]

For more information, try '--help'.

Saved one low-severity finding in .imd-findings.json.

A holder calling token.transfer(game, 1) breaks the required balance equality: held becomes 1 while pot and credits remain zero. That unit remains stranded after a complete claim–settle–withdraw cycle. The invariant handler cannot generate direct transfers. This causes no insolvency or excess payout.

The requested attacks otherwise failed:

• Rounding: After claim(1000e18 + 1), the minimum is 1100e18 + 2; one unit below reverts. Bonus calculations correctly floor across all 20 remainder classes.
• Claim/settle boundary: At deadline minus one second, claiming succeeds and extends the deadline; settlement reverts. At the deadline, claiming reverts and settlement succeeds. Repeated settlement reverts.
• Contract king: A contract with a reverting fallback claims 1000e18; another player claims 1100e18. Settlement and withdrawals succeed, paying respectively 1055e18 and 1045e18, without invoking the fallback.
• Timestamp drift: Probes immediately before and after the deadline obeyed the specified timestamp comparisons. Inclusion timing can change eligibility, but cannot bypass those checks.
• Excess payouts: An independent 400-step sequence containing 174 claims and 51 settlements preserved accounting and ended with payouts exactly equal to payments. A whole-supply claim also settled and withdrew correctly.

launch.json uses ["$token"], matching the nonpayable constructor(address token_). It grants no privileged role. LaunchToken has no constructor arguments, and both ABI exports match compilation.

Only the requested findings file was created.

Implemented source, static export, deployment manifest, and documentation.

• Build/typecheck and 17 interaction tests passed.
• ABI hashes and live RPC checks passed.
• Bundle-size check: 2.91 MB, below 8 MiB.
• Validation: docs/validation.md; design: docs/DESIGN.md.

Commit creation was blocked by the read-only .git directory. Deliverables remain ready in the workspace.