Goal: build, test and security-review a portfolio of 45 independent Solidity contracts in one Foundry project, and write a detailed analysis of each one. This is a capacity test: deliver as many contracts as you can to a high standard, in the listed order, and state clearly in the docs which ones are complete, partial or not started.

Contracts (name: required behaviour):

1. LendingPool: over-collateralised lending of one ERC-20 against another, utilisation-based interest rate, liquidation with a 5% bonus.
2. Vault4626: ERC-4626 yield vault with deposit cap, withdrawal queue and rounding that always favours the vault.
3. StakingRewards: stake a token, earn a second token per second, reward rate set by owner for fixed periods.
4. Governor: token-weighted proposals with quorum 4%, voting delay 1 day, voting period 3 days.
5. Timelock: queue, execute and cancel calls after a minimum 2-day delay, admin handover in two steps.
6. MultiSig: M-of-N owners, submit/confirm/revoke/execute, owner add/remove only via the multisig itself.
7. DutchAuction: price falls linearly from start to floor over a set time, first buyer at current price wins, refunds excess ETH.
8. NFTMarketplace: list ERC-721 for ETH, buy, cancel, 2.5% fee to treasury, pull-payment withdrawals.
9. Vesting: linear vesting with cliff per beneficiary, revocable by owner with unvested tokens returned.
10. Escrow: buyer deposits, seller delivers, buyer releases or arbiter resolves a dispute, timeout refund.
11. Raffle: ticket sales in ETH, winner chosen from a commit-reveal seed supplied by the operator, prize claim.
12. TokenBridgeLock: lock tokens with a nonce and emit an event; unlock only with a signature from a configured relayer set (no real bridge).
13. PriceOracleAdapter: wraps a Chainlink-style feed, rejects stale (>1h) or non-positive answers, exposes 18-decimal price.
14. ConstantProductAMM: x*y=k pair with 0.3% fee, add/remove liquidity with LP shares, minimum liquidity burn.
15. FlashLender: ERC-3156 flash loans of a held token with a 0.09% fee, reentrancy guarded.
16. InsurancePool: members pay premiums into a pool, owner-approved claims paid out up to coverage, cooldown on withdrawals.
17. Crowdfund: goal and deadline, pledges refundable if goal missed, creator claims if met.
18. DAOTreasury: holds ETH and ERC-20, spending only through the Governor via the Timelock.
19. Subscription: monthly subscriptions paid in an ERC-20, keeper-triggered renewals, cancel anytime.
20. PerpetualsLite: single-market isolated-margin perps with funding rate from the oracle adapter, liquidation at 80% margin used.
21. StableSwap2: two-stablecoin curve-style pool with amplification coefficient and 0.04% fee.
22. RevenueSplitter: splits incoming ETH and ERC-20 between payees by shares, pull-based release.
23. Allowlist721: ERC-721 mint gated by a Merkle allowlist, max per wallet, owner can reveal base URI once.
24. RateLimitedMinter: role-based ERC-20 minter with a per-day mint cap per minter.
25. EmergencyPausableRegistry: registry of addresses to metadata with guardian pause, owner unpause, events on every change.
26. SoulboundBadge: non-transferable ERC-721 badges issued and revoked by an issuer role.
27. Permit2612Token: ERC-20 with EIP-2612 permit, owner-only mint up to the cap. Token name: SIMD Stress Token. Symbol: SST. Total supply cap: 1,000,000 SST with 18 decimals, none minted at deploy.
28. BatchAirdrop: Merkle-proof airdrop claims with a deadline after which the owner can sweep unclaimed tokens.
29. DCAVault: users deposit a stablecoin and a keeper swaps a fixed amount into ETH through the AMM each day.
30. LimitOrderBook: on-chain limit orders for one token pair, partial fills, cancel and expiry.
31. Bonding curve sale: linear bonding-curve token sale with buy and sell back to the curve and a 1% spread.
32. ReferralRewards: tracks referrers on first deposit and pays a 1% referral reward from a funded pool.
33. SavingsLock: lock ETH until a chosen date, early exit with a 10% penalty sent to a charity address.
34. VotingEscrow: lock tokens for 1 week to 4 years for decaying voting power, extend lock or amount.
35. GaugeController: VotingEscrow holders vote weekly on how rewards split between gauges.
36. NameRegistry: first-come name registration for a yearly fee in ETH, renew, transfer, expiry with grace period.
37. Tipping: send ETH tips with a message to a creator, creator withdraws, top-tipper leaderboard of 10.
38. Lottery commit-reveal: players commit hashes, then reveal; the XOR of revealed secrets picks the winner, non-revealers forfeit.
39. WrappedETH: minimal WETH: deposit, withdraw, ERC-20 transfers.
40. CreditDelegation: a lender delegates borrowing power in the LendingPool to a trusted borrower with a limit.
41. StreamingPayments: sender streams an ERC-20 to a recipient per second between start and end, recipient withdraws accrued, sender cancels and gets the rest.
42. BountyBoard: post bounties in ETH, hunters submit a hash of their work, poster accepts one and pays, unclaimed bounties refundable after expiry.
43. Whitelist sale: fixed-price ERC-20 sale for allowlisted buyers with per-wallet cap, hard cap and owner withdrawal after the sale ends.
44. ProofOfAttendance: event organiser creates events; attendees claim one non-transferable badge per event with an organiser signature.
45. KeeperRegistry: keepers register with a bond, perform upkeep for a fee, and lose part of the bond if a missed upkeep is reported and confirmed by the owner.

Rules for every contract:

• Solidity ^0.8.24, OpenZeppelin where it helps, NatSpec on every external function, custom errors, events for every state change.
• Checks-effects-interactions, reentrancy guards where value moves, no tx.origin, no unbounded loops over user-controlled arrays.
• Owner or role powers kept minimal and listed in the docs.
• Foundry tests: happy paths, reverts, and at least one fuzz or invariant test per contract.
• Keep every contract independent unless the spec names another contract; where it does, use an interface so each file compiles alone.
• Use safe ERC-20 transfers, handle fee-on-transfer tokens by measuring balances, and never assume 18 decimals.
• Timestamps and block numbers may be manipulated slightly by validators; design deadlines with that in mind.
• Prefer pull payments over pushing ETH to arbitrary addresses.
• Every admin action emits an event and is listed in the docs with who can call it.

Analysis depth for docs/ANALYSIS.md, per contract (aim for 300 to 600 words each):

• A one-paragraph plain-English description a non-developer can follow.
• A table of roles and the functions each role can call.
• The lifecycle: states, transitions and what triggers each one.
• At least five concrete risks with a short attack or failure scenario each, the impact, and how the code prevents or limits it.
• Gas notes: the most expensive function and why.
• Test coverage: which behaviours the tests prove, and which are not covered.
• Status: complete, partial (say what is missing) or not started.

Order of work: follow the list. If time or budget runs out, finish the current contract cleanly, then write the analysis and summary for everything done so far rather than leaving half-written files.

Required files:

• src/.sol for each contract.
• test/.t.sol for each contract.
• docs/ANALYSIS.md with one section per contract: purpose, roles and permissions, state machine, trust assumptions, main risks (economic, access control, oracle, reentrancy, rounding, griefing), mitigations, test coverage summary, and a status line (complete / partial / not started).
• docs/SUMMARY.md: a table of all contracts with status, lines of code, number of tests, and the top risk of each.

Do not deploy anything. Do not add a front end.