Release Soapbox (ERC-20 symbol SOAP) on Sepolia as an evm_project: the fixed-supply launch token plus one application contract.

Token: Soapbox (SOAP), total supply 1,000,000,000 SOAP with 18 decimals, minted once to the deployer.

Application contract: Soapbox.

Currency: SOAP is the app's working currency. Soapbox's constructor takes one argument, the SOAP address (constructorArgs ["$token"]); it stores the token immutable, exposes it as token(), and holds no SOAP at deploy and never needs any: users get SOAP by swapping Sepolia ETH in the ETH/SOAP launch pool the factory seeds.

Every payment in is approve + SafeERC20.safeTransferFrom; payouts are pull withdrawals (safeTransfer to the caller, checks-effects-interactions, nonReentrant); burns are transfers to 0x000000000000000000000000000000000000dEaD. SOAP is a plain fixed-supply ERC-20 with no transfer fee, so the amount pulled is the amount credited. Soapbox has no payable function and no receive/fallback, so it never holds ETH.

No owner, admin, moderation, pause or upgrade path. post(bytes32 topic, string body): body 1 to 280 bytes (UTF-8 byte length); the fee is 100 SOAP (100e18 units) moved with safeTransferFrom(poster, 0x000000000000000000000000000000000000dEaD, 100e18), so Soapbox never holds SOAP; ids from 1.

The body is only emitted in Posted(id, author, topic, body); storage keeps author, topic, timestamp and tipsTotal per post. tip(postId, amount): the post exists, amount >= 1 SOAP; safeTransferFrom(tipper, author, amount) straight to the author; tipsTotal += amount; Tipped(postId, tipper, amount). Self-tips are allowed and pointless. Posts cannot be edited or deleted; everything is public forever.

Views: postCount(), post(id), token(). Tests (Foundry) must show: body lengths 0, 1, 280 and 281; the exact 100 SOAP burn; tips reaching the author; tips to a missing post or below 1 SOAP reverting; Soapbox's SOAP balance always 0. The independent adversarial review must attack: fee bypass, tips credited to the wrong post or author, and in the site script injection through bodies or topics.

Deploy through the project factory, then publish a one-page website to post (topic + body with a byte counter), tip, and a feed read from Posted events sorted by tipsTotal with a topic filter. Bodies and topics render as plain escaped text (no HTML, no auto-links) under a note that posts are unmoderated user content.

The page reads the SOAP address from Soapbox.token(), shows the connected wallet's SOAP balance and allowance, has an Approve step before every paying action, and says SOAP comes from swapping Sepolia ETH in the launch pool (no in-page swap). Lists come from contract views and events only (no backend, no indexer; log queries are chunked from the deployment block). Keep it to one small page; the static export has index.html in dist/.