Implemented PrismRiot (PRIO): 1 billion tokens, 18 decimals, minted once to the deployer. No later minting or administrative powers.

Included offline dependencies, success/failure tests, fuzz and invariant coverage, and deployment documentation.

Verified: forge build, forge test (28 passed), and forge fmt --check with Solidity 0.8.26.

Created launch.json matching PrismRiot’s constructor, exact supply, paired currency, and verbatim economics.

Schema and ABI checks passed. forge build succeeded; forge test passed all 28 tests.

Only launch.json changed outside permitted scratch output.

Saved .imd-findings.json.

No substantiated findings; all three entry points covered. All 28 local Foundry tests passed.

Protected launch integration remains unverified because platform dependencies and launch inputs are absent.

Wrote .imd-findings.json with no substantiated defects and coverage for all three entry points.

Offline build, formatting check, all 28 tests, and second-seed fuzz testing passed.

The protected seed-and-swap test remains unverified because platform dependencies and launch inputs are absent.

Recorded no substantiated defects in .imd-findings.json, with all three entry points covered.

All 28 Foundry tests passed, including 8,192 invariant calls. Full protected launch integration remains unverified because platform dependencies and launch inputs were unavailable. No source or configuration files changed.

Wrote .imd-findings.json: no substantiated defects; all three entry points covered.

Offline build, formatting, and 28 tests passed, including a second fuzz seed with 1,024 runs per fuzz test. Source files remain unchanged.

Full platform launch integration remains unverified because required contracts and deployment fixtures are absent.

Added 15 tests and expanded invariants to cover failed transfers, allowance rollback, approval isolation, and numeric boundaries.

forge build and forge test pass: 43 tests, including 32,768 random handler calls. No defects found. Only files under test/ changed.

Wrote .imd-findings.json: no substantiated defects; all 3 entry points marked holds.

Foundry passed 43 tests, including 32,768 invariant calls. Full platform launch integration and authorization of the manifest’s economics remain unverified because required inputs were absent.

Changed only pool.fee in launch.json from 3000 to 12500. Every other byte is preserved.

Manifest checks and forge build passed. forge test passed all 28 tests. No other deliverable changed.

Review complete. The findings file is written at .imd-findings.json with two findings and seven coverage rows, and no tracked file was changed.

Outcome: the token holds. All three state-changing entry points behave as intended, and no specialist finding existed to reproduce or merge. The two items I report are manifest text and dependency provenance, not token defects.

What I verified against the code

• The vendored OpenZeppelin ERC20, Context and interface files are byte-identical to upstream v5.0.2 at the pinned commit. PrismRiot adds only a constructor that mints 1e27 to the caller once.
• The compiled ABI exposes only approve, transfer and transferFrom as state-changing. Admin selector probes from the factory address revert, and supply cannot grow.
• The runtime bytecode contains no DELEGATECALL, CALLCODE, SELFDESTRUCT, CALL, STATICCALL or CREATE opcodes, and bytecode_hash is none.
• Factory-to-distributor, distributor-to-claimant and pool-manager in-and-out transfers deliver exact amounts. The project suite passed 43 tests including a 32,768-call invariant run with zero reverts, and my scratch test mirroring the protected harness flows passed before I removed it.
• launch.json has only schema keys, lowercase addresses, empty constructorArgs matching the zero-parameter constructor, totalSupply equal to the minted amount, and an initialPrice that matches my own recomputation exactly. Per the operator, pool.fee 12500 is correct and I did not flag it.

Findings kept

• Low, launch.json line 19. The notes string still says the pool uses a 0.3% fee while pool.fee is 12500 (1.25%). The value is right; the explanatory text was not updated with it.
• Info, lib/dependencies.json line 39. Seven vendored forge-std files do not match the recorded v1.9.7 checksums, which I confirmed are the true upstream hashes. README's claim that all 36 files matched is stale. Test-only, no production impact.

Coverage: approve, transfer and transferFrom each marked holds with the trace stated. Two extra rows for the manifest and dependency provenance point at the findings above.