The OGPass project is complete, verified, and committed on main (commit 926f674). Working tree is clean.

What was built

• src/OGPass.sol: soulbound ERC-721 ("OG Pass" / "OGPASS") paid in the OG token. Founder passes are claimed by Merkle proof (OpenZeppelin standard leaf) before an immutable 30-day deadline, sit off-curve, and can be burned for exactly 100,000 OG from a separately funded founder reserve. Public passes mint on the linear curve P(n) = 1,000,000 + 10,000·(n−1) OG and sell for 92.5 % of P(publicSupply) with 7.5 % sent to dEaD. The curve reserve always equals the sum of outstanding prices. Every transfer and approval reverts; one pass per wallet. The owner can only set the base URI and pause new buys; ownership handover is two-step. No withdraw path, no proxy.
• Supply cap of 1,000: unclaimed founder slots stay reserved until the deadline, so the public can take at most 951 before then. Burned passes of either kind free a slot.
• Safety: ReentrancyGuard, checks-effects-interactions, _mint instead of _safeMint, every deposit verified by balance delta, SafeERC20, custom errors, all requested events. The constructor never touches the token, so it deploys on an empty chain.
• script/DeployOGPass.s.sol holds the mainnet parameters (OG token, the given root, 49, the $owner address) in constants with a deploy(Config) function the tests call.
• README.md documents behaviour, assumptions, deployment parameters, and the operator's after-launch steps.

Verification results

Tests cover soulbound reverts, valid/invalid/double/late Merkle claims, buy and sell slippage and deadlines, random buy/sell/claim/buyback sequences with curveReserve == Σ P(i) and balance-equals-reserves after every step, any-order sell-out emptying the curve, founder buyback accounting, burnUnclaimed math including repeat calls, the 951/49 cap and slot freeing, one-pass-per-wallet, pause blocking only buys, fee-on-transfer rejection, and a hostile reentrant token.

Things to know

• OpenZeppelin v5.0.2 (full contracts/ minus mocks) and forge-std v1.9.6 are vendored as plain files with provenance notes; the OZ archive hash matches the copy already used elsewhere on this machine.
• The OG token address read back symbol() = "OG", decimals() = 18 from a public mainnet RPC today. The no-fee property is taken from the brief, and the contract rejects any shortfall regardless.
• At the exact deadline timestamp, claims are closed and the reserve burn is open.
• Founder buybacks only work if someone funds the reserve; nothing in the contract obliges anyone to. OG sent to the contract by plain transfer is unrecoverable by design, since the owner has no withdrawal power.
• Slither and Mythril were not available and did not run. No launch.json was written; the manifest step owns that.

Wrote launch.json for the single accepted contract. Build and all 79 Foundry tests pass, and only the manifest is a new file in the tree.

Manifest contents

• kind is evm_contracts with one contract, OGPass, in src/OGPass.sol:153.
• Constructor arguments in declaration order: the OG token address, the founder Merkle root from the brief, founderCount 49, and $owner for the owner that may set the base URI and pause buys.
• Notes describe the soulbound pass, the curve pricing, the founder reserve and buyback, the 1,000 cap, and the owner's limited powers, at 1,119 characters.

Checks done

• Confirmed the argument types are static ABI words: address, bytes32, uint256, and an owner reference, matching the README deployment table and the deploy script constants.
• Verified the file has exactly the three schema keys, every argument is a string, and the name is under 32 characters.
• The constructor makes no external call, so it deploys on the empty-chain rehearsal in the protected test.

No other file was changed. The working tree shows only the untracked manifest, which I did not commit since the brief did not ask for a commit.

I found one low-severity defect and no economic defects in src/OGPass.sol. The curve, founder reserve, supply cap and soulbound rules all match the brief. The results are in .imd-findings.json, which is the only file I wrote; I changed nothing in the source.

Finding 1 (low): the owner can make the buy pause permanent (src/OGPass.sol:288)

• What happens: the contract keeps the standard renounceOwnership() from OpenZeppelin. If the owner calls setBuysPaused(true) and then renounceOwnership(), owner() becomes the zero address. After that every buy() reverts with BuysPaused, and nobody can ever unpause.
• Why it matters: the brief gives the owner a pause they can undo, not a way to shut down new buys for good. No funds are locked, because sells, claims and founder buybacks still work.
• Evidence: I ran this sequence as a Foundry test against the current code and it behaved as described. The test file was in test/scratch/, which I deleted afterwards.
• Suggested fix: override renounceOwnership() so it reverts, or so it only works while buys are not paused.

Coverage: the file has a row for each of the 14 entry points: 13 holds and 1 finding (renounceOwnership), plus a row for the solvency invariant. In summary:

• Curve reserve: it always equals the sum of P(i) for outstanding public passes. Prices are multiples of 1e22, so the 92.5% / 7.5% split leaves no rounding dust, and selling every pass in any order empties the reserve to zero.
• Front-running: buying just before someone else and selling just after loses money at every supply level (-75k + 9,250 - 750·s OG).
• Founder reserve: burnUnclaimedFounderReserve() keeps exactly 100,000 OG for each founder pass still held. sellFounder pays only from the founder reserve and never touches the curve reserve.
• Supply cap: it counts unclaimed founder slots only until the deadline, and passes burned by selling free up room.
• Received-amount checks: every OG deposit is verified to arrive in full.
• Static-analysis leads: the Slither reentrancy lead in _pullExact can't be triggered with a plain ERC-20 like OG, because of the reentrancy guard and the received-amount check. The Aderyn "ETH send" lead doesn't apply: the contract never sends ETH.
• Not a finding: OG sent straight to the contract can never be recovered. That follows from the rule that the owner can't withdraw any OG.

The existing test suite passes: 79 tests, including the fuzz and invariant runs.

The review is complete. The findings file is written at the repository root and the scratch tests are removed, so no source or test file changed.

Outcome: the permission model of OGPass holds. Nothing in the Access Control, Trust Gap or Asymmetry area reaches medium severity. Three low/info observations are recorded, each with a concrete input, and all 14 entry points plus six invariants have coverage rows.

What I checked

• Every state-changing entry point, including the inherited ERC-721 transfer and approval paths and the Ownable2Step handover. Transfers and approvals revert on every route, and the self-burn route through a zero-address transfer is blocked before the soulbound override, so no pass can leave or be burned except through sell or sellFounder.
• Confused-deputy exposure. The contract only ever pulls OG from the caller, so a third party's standing approval cannot be spent by anyone else.
• Storage-write symmetry between buy and sell, and between claim and founder buyback. The curve reserve and the founder reserve are kept strictly apart, and the owner has no withdrawal path.
• The trust seams. The owner's pause touches only new buys and redirects no in-flight value. Sandwiching the curve is unprofitable unless at least nine later buyers follow, which is the curve's intended early-buyer economics rather than an extraction path.
• The live OG token. I fetched its verified source from Sourcify and confirmed symbol and decimals over a public RPC. It is a plain ERC-20 with no fee, pause or blacklist, and it accepts transfers to the burn address, so the seller payout can never be blocked by the burn leg.
• The static-analysis leads. The reentrancy, ETH-send and unsafe-mint lines do not reproduce against this code.

Recorded observations

1. Low: after the claim deadline, or after a founder buyback, public passes can exceed 951 and reach the full 1000. The README documents this as intentional, but the brief's wording "up to 951 public" leaves room for a stricter reading, so I flagged it for the requester to confirm.
2. Info: the inherited renounceOwnership is an owner power the brief does not list. Pausing buys and then renouncing makes the pause permanent, though every holder can still exit.
3. Info: isMember(address(0)) reverts instead of returning false.

Not reached in depth: the arithmetic of the price sum beyond the existing fuzz and invariant suites, and the launch manifest, which does not yet exist in the tree.

The findings file is written and validated: all three snippets match the tree, and every one of the 14 entry points has a coverage row (20 rows total, including the invariants checked). No tracked files were changed; the only additions are the findings file and my scratch probe under test/scratch/.

Recap

The math area is clean. The curve arithmetic is exact everywhere: every price is a multiple of 10,000 OG, so the 92.5 / 7.5 split leaves zero dust at all 1,000 in-range prices, the curve reserve equals the sum of outstanding prices by induction, and no intermediate can overflow. The supply-cap check keeps outstanding passes at or below 1,000 in every sequence, and the deadline boundary is consistent across claims, reserved slots and the reserve burn. The vendored OpenZeppelin v5.0.2 SafeERC20 rejects a no-code token, and I confirmed on mainnet that OG is a plain 18-decimal ERC-20 with no external calls, owner, or pause, and that it already treats dEaD as its burn sink.

Three findings were recorded, none with a proof file since none is high severity:

• Low: curve parameters versus OG supply. Filling 951 public passes needs about 5.47 billion OG, but OG's total supply is 1 billion. At most 347 public passes can ever exist with circulating OG, so the 1,000 cap and the SupplyCapReached branch are unreachable on mainnet. The code matches the brief literally, so this is flagged for the requester to confirm the intended prices before the immutable constants ship.
• Info: isMember(address(0)) reverts instead of returning false, because OpenZeppelin's balanceOf rejects the zero address.
• Info: renouncing ownership while buys are paused makes the pause permanent. This needs owner action, so it is recorded as a trust-assumption note rather than a vulnerability.

Coverage gaps: none in my area. Static-analysis leads were all checked: the reentrancy lead on the balance-delta pull is protected by the guard and CEI ordering, the timestamp leads are intended deadline logic, and the "ETH send" lead is a false positive on safeTransfer of an ERC-20.

Review complete. The findings file is written and validated, scratch tests are removed, and the working tree is clean apart from the ignored .imd-findings.json.

Outcome: no critical, high or medium defects. The contract's control flow holds under the Execution Trace, Periphery and First Principles checks. Three low-impact items are reported, each with a reproduction I confirmed in a Foundry test on the current code.

Findings written

1. Low. isMember(address(0)) reverts with ERC721InvalidOwner instead of returning false, because it forwards to OpenZeppelin's balanceOf. Interface gap only.
2. Low. Post-deadline deposits are accepted and instantly burnable. With no founder outstanding, a donor's deposit via fundFounderReserve is sent to dEaD by the next caller of burnUnclaimedFounderReserve. The burn is by design, but the deposit path has no guard against the mistake.
3. Info. Inherited renounceOwnership called while buys are paused freezes buys forever. Sells, claims and buybacks keep working, so no OG is lost. Recorded as a trust assumption.

What I verified as holding

• Every entry point traced for checks, effects and failure paths: soulbound overrides, Merkle claim, cap reservation math, curve pricing and exact 92.5/7.5 split, founder reserve accounting, checks-effects-interactions with the guard. The existing 79 tests pass.
• Periphery: the live OG token on mainnet is a plain ERC-20 with no pause, blacklist, fee or owner. I ran a mainnet-fork test of buy, fund, sell, founder buyback and reserve burn with the real token and every balance moved exactly. Transfers to dEaD succeed and are counted in the token's totalBurned.
• Vendored OpenZeppelin is byte-identical to the v5.0.2 tarball. forge-std differs from v1.9.6 only by formatting, which is test-only. No submodules. Runtime bytecode has no DELEGATECALL, CALLCODE or SELFDESTRUCT.
• Slither and aderyn leads were all false positives here: the reentrancy lead is behind the guard with state written first, the ETH-send lead is not ETH, and the timestamp uses are the intended deadline.

Open items I could not settle

• The founder Merkle root cannot be verified without the 49 addresses. If it was built with a different leaf encoding, no founder can claim, and the slots open to the public after 30 days.
• The requested price curve needs about 5.47 billion OG to fill 951 public passes, but OG's total supply is 1 billion. At most around 358 public passes can ever be outstanding. That is a parameter choice in the brief, not a code defect.

The findings file is in place and excluded from git by the harness, so the working tree is otherwise unchanged. The review is complete.

Outcome: no critical, high or medium defects. The code matches the brief, and the live OG token behaves as the brief assumes. I kept five findings, all reproduced, with no proofs since none is high or critical.

What I verified

• All 115 existing tests pass, including both invariant suites.
• A mainnet fork test ran the full flow against the real OG token. It is a plain ERC-20 with no owner, pause, proxy, fee or wallet limit. Buy, fund, sell, and burns to the dead address all moved exact amounts.
• Every specialist finding was rerun as a scratch Foundry test and behaved as reported. Static-analysis leads did not reproduce: the reentrancy line is guarded and the token has no callbacks, the "ETH send" line is a false positive, and timestamp use is the design.

Findings kept, after merging

1. Low. Inherited renounceOwnership while buys are paused makes the pause permanent. Four specialists reported this; merged into one. The adversarial suite already exercises the sequence and the README documents it, so it is a trust assumption the brief's owner-power list omits.
2. Low. isMember(address(0)) reverts instead of returning false. Three specialists reported this; merged.
3. Info. The curve constants need 5.47 billion OG to reach 951 public passes, but OG's total supply is 1 billion. The cap is unreachable on mainnet. The code follows the brief literally, so this is a parameter check for the requester before the immutable constants ship.
4. Info. Post-deadline founder-reserve deposits beyond what held founders need can be burned by anyone. This is the brief's own rule; recorded as a design note.
5. Info. Public passes can exceed 951 after the deadline or after a founder buyback. Only the 1,000 total is hard. The README documents this reading.

Coverage: all 14 entry points answered, plus rows for the reserve and supply invariants, deployment constraints, and the live token. Eleven hold, three point at findings 1, 4 and 5.