Review complete. The findings file holds two informational items and no defect that opens a revision.

Verdict. src/Profiles.sol matches the brief as it arrived. I found no loss, no broken invariant, no access gap and nothing the launch forbids. Both items in .imd-findings.json are informational.

What I read. src/Profiles.sol in full, src/helpers/TextRules.sol (checkScreenshotUrl, checkHost, the host list), src/interfaces/IDelegateRegistry.sol, test/Profiles.t.sol, test/fork/ProfilesFork.t.sol, the mocks, docs/LAUNCH-PROFILES.md, and the two protected floor tests. Both constructor contracts were reached on mainnet through a public RPC. The live TextRules runtime is byte-identical to the local build, and the live delegate.xyz v2 registry answers the exact selector Profiles sends with a 32-byte word.

What I verified by running code.

• The 34 Profiles tests and the 3 fork tests pass on a fork of current mainnet.
• A 256-run fuzz over random valid names confirms the stored-name skeleton and the parse-time skeleton agree. Renaming and clearing free exactly the skeleton another wallet can then take, and the reserved list matches the 17 skeletons in the brief.
• Delegation through the real registry works under the 30k cap: token-level and wallet-level delegations with all rights count, a specific-rights delegation does not, and a revoked one turns owned false. The repo's fork test only covers the holder path, so this was an untested edge.
• Deployed with the two mainnet addresses on an empty chain, the constructor succeeds and the runtime (5,489 bytes) has no DELEGATECALL, CALLCODE or SELFDESTRUCT on any reachable path.
• No owner, role, payable path, receive or fallback exists. Every outside call is a STATICCALL, so no reentrancy surface.

Findings (both info).

• Batch-minted ERC-721 tokens. ERC721A-style ownerOf walks back one cold SLOAD per position. Under the fixed 30,000 gas cap, a token held at position 13 or deeper in a batch gets NotNftOwner from set and reads as not owned. CALL_GAS is a fixed parameter and the accepted limitation covers gas-heavy tokens, so this is for the site's documentation only.
• clear() on an empty record emits ProfileCleared without changing state. Harmless log noise.

Not completed. The full forge test run for the 743 count did not finish within the 10-minute foreground limit, even with reduced fuzz and invariant runs. The Profiles, fork and protected-style checks that this launch depends on all pass. Scratch tests live under test/scratch/ and are not part of the submission.

Done. src/Profiles.sol ships unchanged: it already meets every launch rule, and neither imported finding required a code change.

What I verified

• Launch rules against the code as arrived: nonpayable constructor with two static address arguments, no external call or code requirement in the constructor, no owner or role, nothing handed to the factory, no DELEGATECALL/CALLCODE/SELFDESTRUCT reachable in the bytecode, runtime 5,489 bytes, no payable path, no library linking, none of the Slither hard rejects.
• Mainnet dependencies: both constructor addresses have code (checked through a public RPC). The fork test in test/fork/ProfilesFork.t.sol passed against live mainnet: the deployed TextRules runtime is byte-identical to the local source, and the real delegate.xyz registry and identity.md #827 work as expected.
• Own audit passes (reentrancy, external-call boundary cases, name-registry invariant, arithmetic, delegation signature) found nothing above informational. Details are in ADAPTATION.md.

Imported findings

• ERC721A-style ownerOf under CALL_GAS: reproduced exactly. Ids 1 to 12 of a batch are accepted, id 13 onward gets NotNftOwner. CALL_GAS is a fixed parameter and the gas-burning-token rule is an accepted limitation, so it is documented, not changed.
• clear() on an empty record emits ProfileCleared: reproduced. The brief defines clear() without a precondition and fixes the error list, so the behaviour stays and is documented for indexers.

Files changed

• ADAPTATION.md (new): the launch-rule table, the audit record, the two findings with reproductions and the reasons for no code change.
• test/ProfilesLaunch.t.sol (new, 6 tests): CREATE2 deployment through a factory stand-in on an empty chain, nonpayable constructor, runtime size and forbidden-opcode scan, the two findings pinned, and a skeleton-spelling fuzz property.
• docs/LAUNCH-PROFILES.md: two sentences in Known limitations and the updated test counts.

Test results with the verifier's fuzz seed:

No launch.json was written and no protected file was touched. Nothing is committed; the working tree holds the three files above for the submission step.

The review is complete. The findings file is written, scratch tests are removed, and no tracked file changed.

Outcome: the math, boundary and numerical-gap area of Profiles holds. I found no defect that opens a revision. The file .imd-findings.json holds one informational note and a coverage record of 124 rows, one for each of the 116 listed entry points plus 8 invariant rows.

What I checked in Profiles.sol

• Name parsing: length bounds, charset, the shift arithmetic that packs the name and its skeleton into 20 bytes (index never exceeds 19, so nothing truncates), and the 3-character skeleton floor.
• Skeleton consistency: the parse-time skeleton and the stored-name skeleton apply the same case fold, underscore drop and 0/1/i substitutions, confirmed by the existing fuzz test and by extra cases such as 20-byte names that collapse to a reserved word.
• Reserved list: exactly 17 whole-skeleton equalities, matching the brief. Substrings pass as intended.
• The 32-byte STATICCALL helper: gas cap, returndata size check, and every consumer tests the success flag before using the word. Dirty upper bits, short returns, huge returns, reverts and gas burners all resolve to not owned.
• Name registry invariant across set, rename, re-spelling and clear.
• The two live mainnet dependencies, read through the local endpoint: the TextRules runtime at the first constructor address is byte-identical to the local build, and the delegate.xyz registry answers every delegation level in under 11,000 gas, well inside the 30,000 cap. The fork test suite passed against mainnet.

The one note (info): the rule against names starting with 0x is applied to raw bytes, while every other rule works on the skeleton. Spellings like Ox123 or 0_x123 are accepted and share the skeleton that 0x123 would have had. This is exactly what the fixed name rule says, so it is recorded for the author and the site rather than as a defect.

Not reached: the other contracts in the entry-point list are outside this launch and are marked as such in the coverage record. They were not reviewed here.

The review is complete. Nothing further is needed.

Result: no defects found in the permissions area of Profiles. The findings file at the repository root holds an empty findings list and a full coverage record, one row for every listed entry point plus the invariants checked.

What I covered in depth

• Access Control. The contract has no owner, role, pause, upgrade path, payable function, receive or fallback. Both state-changing functions act only on the caller's own record. The constructor stores two immutables and hands nothing to the factory or tx.origin.
• Asymmetry. I diffed set against clear, the four picture branches of the picture check, and the parse and skeleton helpers. Each picture branch forces the other branches' fields empty, link is deleted when the picture type changes, and the name registry is rewritten only when the skeleton changes with the old key deleted first. The invariant that each stored name maps back to its holder and that only the holder can displace it holds on every path.
• Trust Gap. The two external dependencies are immutable. Every call to a token or the registry is a STATICCALL under the 30k cap reading 32 bytes, and the success flag is checked before the word is used. I ran a scratch fork test against the real delegate.xyz v2 registry on mainnet, which the existing fork test never exercises. Token-level, contract-level and wallet-level delegations with "all rights" are honoured, a delegation granted with specific rights is correctly refused, and a delegated ownership read costs about 27.7k gas cold, inside the cap.

Noted but not reported as findings. The batch-mint ownerOf gas cut and the no-precondition clear are already recorded in ADAPTATION.md as accepted limitations. A link picture on a chain where textRules has no code reverts without a reason instead of BadPicture, which cannot happen on mainnet and is not a defect of the launch.

Not reached. The other contracts in the repository are outside this launch and were marked as holding only in the sense that Profiles neither reads nor is read by them. Their own permission models were not traced.

Review complete. The findings file is written at .imd-findings.json with one finding and 123 coverage rows (all 116 listed entry points plus 7 invariant and dependency rows).

What I audited. The Profiles contract against the Pashov Economic Security, Invariant and Flow Gap guides, plus the Mindset. I traced both state-changing entry points and the three views, confirmed the 17 reserved skeletons match the brief exactly, and ran a stateful fuzz over set and clear with 15,000 calls checking that every stored name maps back to its wallet, no key is ever stranded, no reserved skeleton is ever held, and the contract never holds ETH. All held. The existing 40 Profiles tests pass.

Live dependencies. Through a public RPC, the deployed TextRules runtime is byte-identical to the local build, and it accepts an arweave link while rejecting an unlisted host. The delegate.xyz v2 registry call and the identity.md ownerOf both fit comfortably inside the 30,000 gas cap.

One finding, low severity. In set, the ERC-165 call runs before the ownership check inside the same transaction. For a token behind a proxy, that first call warms the implementation slot and account, so the ownerOf call in set has roughly 4,500 more gas inside the cap than a cold profileOf has later. With an ERC721A-style proxied collection, batch positions 10 and 11 are accepted by set but every later cold read reports them as not owned, although the wallet still holds the token. A proof test under test/scratch/ProfilesWarmth.t.sol fails on the current code and is included in the file. The minimal fix that keeps every fixed parameter is to call the ownership check before the ERC-165 call. This touches an accepted limitation, so the judge may downgrade it to documentation.

Not found. No path lets a wallet take or free another wallet's name, no value moves anywhere, and no external call can reenter or block another user. The other 114 entry points belong to contracts this launch does not deploy and that have no code path to Profiles; they are marked as untouched by this review's area rather than verified.

Review complete. The findings file is in place and the working tree has no source changes.

Outcome: no defect found in the control-flow area of src/Profiles.sol. The contract behaves as the brief specifies on every path I traced. The findings file holds two informational notes, both with concrete reproductions, and a coverage row for all 116 listed entry points plus four invariant rows.

What I checked (Execution Trace, Periphery, First Principles passes):

• set: name parse, skeleton mapping, the 17 reserved skeletons as whole-skeleton matches, NameTaken ordering, all four picture branches, the registry update when the skeleton changes, since, link deletion, and the event.
• clear: frees the skeleton key before deleting the record. The registry invariant held under fuzzed set/clear sequences over three wallets and six spellings.
• Periphery: every token and registry read is a STATICCALL capped at CALL_GAS reading 32 bytes. Probes with an Error(string) revert, a 31-byte answer, a 64-byte answer, dirty high address bits and supportsInterface returning 2 all produced owned=false or BadPicture without reverting reads.
• Mainnet fork via a public RPC: the deployed TextRules runtime equals the local source, HostNotAllowed and BadEvidence pass through unchanged, and a real delegate.xyz v2 delegation makes owned true inside the cap. One registry read costs about 8.5k gas on a hit or a miss.
• Constructor runs on an empty chain, no owner, pause, upgrade path, payable function, receive or fallback.

Informational notes recorded (no change required by the brief):

1. Only all-rights delegate.xyz delegations count. A delegation made with a specific rights string gives NotNftOwner. This matches the interface comment, so it is a documentation point for the site.
2. The 0x prefix rule is literal. "Oxabc" is accepted and takes the skeleton "oxabc" that the refused "0xabc" would have had.

Test status: the full suite passes.

The scratch files under test/scratch/ are mine and are not part of the submission. Entry points of the other contracts are marked holds with the reason that Profiles neither calls nor is called by them; they were not reviewed.