Implemented GRID, CityRegistry, GrantExecutor, ABI exports, and deployment documentation.

Validation passed: forge build, forge test, and forge fmt --check—59 tests, including 4,096 invariant calls.

README documents burn semantics, deployment roles, and the resource-funding assumption that limits reachable progression to level 12. Final manifest review and deployment remain with later assignments.

Wrote .imd-findings.json.

• No substantiated defects across all 12 entry points.
• All 59 tests passed; all three exported ABIs match compiled source.
• Final deployment bindings remain unreviewed because launch.json is absent.

Source and configuration files are unchanged.

Created launch.json with matching token metadata, constructor dependencies, and $owner references.

Schema and ABI checks passed. forge build succeeded; all 67 tests passed, including eight protected checks.

Notes preserve the unresolved policy-owner/workflow-wallet match. Only launch.json is submitted.

The review is complete. No files in the tree were changed; the scratch test was removed and only .imd-findings.json was written.

Result: no permission bypass found. The access-control surface is small and every privileged path is bound at construction to immutable addresses. There is no initializer, no msg.sender use in constructors, no escalation route, and the reentrancy guard covers every registry mutator. All 59 existing tests pass, and the three ABI exports in docs/abi/ match the compiled ABIs exactly.

Findings written (ranked):

• Low: buyCity has no price bound. The quote a buyer reads and the price buyCity pulls can differ when another purchase lands first. A buyer who approved an unlimited allowance pays the higher price without consent. Reproduced: quoted total 10,400 GRID, actual pull 10,481.41 GRID after one front-running buy, and the front-runner captures half of the victim's reward share. The brief fixes the buyCity(uint256) signature, so the suggested fix is an added overload with a maxTotal argument, or a firm ABI-doc rule against unlimited approvals.
• Info: a new city shares in its own purchase fee. The first buyer can claim back the full 200 GRID reward leg immediately, making the effective first fee 2% rather than 4%. The README documents this choice; the brief is ambiguous, so it is flagged for the requester to confirm.
• Info: operator trust assumption. The operator, who is also the fee treasury, can buy a city, route the whole resource pot to it, level it up to dominate rewards, and pause grants forever. Every step needs the operator key, so this is the brief's intended power recorded with actor and preconditions, not a defect.

Coverage: all 12 listed entry points have rows (11 hold, buyCity carries finding 1), plus rows for the immutable-roles invariant, the ABI-export match, and one unreached row for launch.json constructor arguments, since no manifest exists in the tree yet. The manifest reviewer should verify that operator_ and treasury_ are the literal approved wallet, or $owner only if the pinned policy owner equals it.

The review is complete. Findings and coverage are in .imd-findings.json, the scratch tests are removed, and no source file was changed.

Outcome: the math in my area holds. I found no fund-loss, mis-payment or solvency defect, so no proof-carrying finding was warranted.

What I verified

• Price formula is exact at all 256 sale steps. The dividend carries a factor of 2^22, so division by 65536 leaves no remainder, and the later 4% fee and 50/30/10/10 split also have zero remainder at every price. The slither divide-before-multiply lead is therefore not a defect.
• Reward index cannot round to zero or overflow. Sum of claimable never exceeds the pool, with 133 wei of dust after all 256 sales. Level checkpoints use the old weight and the weight update cannot underflow.
• Custody identity holds after 256 buys, grants and 40 claims. Effects precede the checked transfers under the reentrancy guard, so the aderyn lead is not a defect.
• The exported ABIs match the compiled build byte for byte.

Findings recorded

• Low: the level cap of 20 is numerically unreachable. All 256 sales fund 71,500.078125 GRID of resources, while level 13 needs 81,800 cumulative resources at the 1 GRID per resource conversion the implementation chose. No city can pass level 12. The README documents this, but the conversion is immutable after deploy, so the requester should confirm it matches the intended economy.
• Info: a heartbeat cannot be recorded while fewer than three plots are owned, because the three winners must be distinct, owned, and positively funded.

Coverage rows answer all 12 listed entry points plus the two invariants and the two static-analysis leads. Nothing in my area was left unreached.

Saved .imd-findings.json with no substantiated defects and coverage for all 12 entry points.

Arithmetic checks passed. Foundry execution was blocked by missing Solidity 0.8.26. Deployment bindings remain unreviewed because launch.json is absent. No source or configuration files changed.

Added failure-path and boundary tests, plus stateful invariants for rewards, resources, heartbeats, token balances, and allowances.

forge build and forge test pass: 72 tests, 0 failures, including 57,344 random invariant calls.

Only test/ changed. No confirmed defects found.

Wrote .imd-findings.json: no confirmed defects, all 12 entry points covered.

All 72 Foundry tests passed. ABI exports match compiled contracts.

The required wallet’s match to $owner remains unverified because the policy owner wasn’t supplied.

Implemented source in web/, static export in dist/, and documentation in docs/.

• Build, typecheck, manifest verification, 15 browser scenarios and 7 swap checks pass.
• Export: 534 KB; submission files remain below 8 MiB.
• Transactions stay locked because deployed operator/treasury addresses conflict with the approved workflow.
• Git commit was blocked by read-only .git; deliverables are present in the working tree.

Validation and limitations. Design documentation is in docs/DESIGN.md to respect the path restriction.