Implemented BurnTracker, tests, real result fixtures, offline dependencies, and deployment documentation.

• forge build, all 61 tests, and forge fmt --check pass.
• Live mainnet-fork integration passes.
• Callbacks fit 200,000 gas without creating storage slots.
• The 4,545-byte update uses 287,765 settled gas; 327,565 before refunds.

Ready for IdentityMD’s launch deployment. No transactions were broadcast.

Created launch.json with only BurnTracker and all seven required constructor arguments, verified against the compiled ABI.

forge build succeeded. All 61 tests passed with the specified fuzz seed. Only launch.json is changed for submission.

Review complete. The findings file is written at the repository root, and the only other file I created is the scratch proof under test/scratch/, which is not kept. No source or configuration file was touched.

What I audited. The Economic Security, Invariant and Flow Gap guides against src/BurnTracker.sol, with the project's 61 tests passing as a baseline. I traced every state-changing entry point for who pays, what moves, which slots callbacks write, and whether each state transition keeps the "one order at a time", "nonzero callback slots" and "no residue" invariants. The slither reentrancy and strict-equality leads do not reproduce: all mutators are guarded, callbacks reject reentry and make no external calls, and the equality is an enum-style state compare.

Findings.

• Low, with a failing Foundry proof. A refused replacement open from STUCK maps to UNOPENED, where recover and setResultHash both revert WrongState. Sequence: open completes, a sponsored refresh fails (status 2, STUCK), the owner re-opens with a body the plane refuses (status 1). The existing project with a valid result hash can no longer be continued from this payer. A replacement open that fails with status 2 returns to STUCK and keeps recovery, so the two failure statuses are asymmetric. The spec's "refused open returns to UNOPENED" line was written for the first open. The fix needs a scope decision, which I stated in the finding. The proof test fails on the current code for exactly this reason.
• Info, no code change implied. A refused refresh returns to IDLE with the old proof, as specified. If the stored parent is permanently stale, each new sponsor pays 0.5 IMD per cooldown for a guaranteed plane refusal until the owner adopts the right hash. Reported as an economic trust note for sponsors.

Coverage. All 13 entry points have a row. Twelve hold; onFailure carries the finding. Three invariant rows are added. Nothing in my area was left unreached. The manifest-side facts also check out: seven static words, the live Intake and IMD addresses, the two action words as padded strings, and timing values inside the constructor's bounds.

The review is complete and .imd-findings.json is written at the repository root with two findings and a sixteen-row coverage record. No tracked file was changed.

Result. The access-control, trust-gap and asymmetry passes found no permission bypass, no callback-authority hole and no unguarded writer. Every state-changing entry point was traced and recorded. Build and all 61 project tests pass.

Findings written:

• Low, src/BurnTracker.sol:187. A refused replacement open collapses to UNOPENED even when a completed project already exists. From UNOPENED, recover, setResultHash and updateBurntracker all revert, so the owner cannot continue the existing project until a second open is paid for and completes. This follows the brief's sentence literally, so the fix is a scope decision. Reproduced with a scratch test against the mock Intake.
• Info, src/BurnTracker.sol:499. Documented trust assumption: the owner can redirect a sponsor's in-flight update payment, bounded by maxPrice, by reconfiguring the intake, actions or body ahead of the sponsor's transaction. The README already declares the owner trusted, so this is recorded for the judge rather than as a defect. Reproduced with a scratch test.

Checked and holding. Callback acceptance is bound to the intake that took the order, the awaited request id and the PENDING state, once only. Third-party requests through the real Intake and cross-chain delivery through IntakeDelivery are both refused. Both callbacks write only slots the constructor made nonzero. The constructor hands roles only to the owner argument, never to the factory. Two-step ownership, owner-only setters, exact live-price payment with no residual allowance, and the stale, cooldown and timing bounds all match the brief.

Not reached in depth. The JSON parser internals and the gas measurements belong to other specialists. I confirmed only that the parser cannot be driven by an unauthenticated caller, since the document must hash to the stored result hash first.

The review is complete and written to .imd-findings.json. The tree is otherwise untouched: the scratch tests I used were removed and git reports no changes besides the findings file.

Outcome: no reproducible defect in the assigned area. The Execution Trace, Periphery and First Principles passes over src/BurnTracker.sol found the control flow sound. I report one info item and sixteen coverage rows, one per listed entry point plus three invariant rows.

What I traced and confirmed

• Order flow. Price is read, the maxPrice check runs before any token call, state and _pendingIntake are set before external calls, the request id is checked nonzero and fresh, and allowance and balance are restored to their prior values. Reentrant callbacks during an order are refused by the guard check.
• Callback gate. Only the Intake that took the order, only while PENDING, only for the awaited id, only once. Dependency swap through setIntake does not move callback authority. Late callbacks after setResultHash, recover or a replacement open are refused, verified by a scratch sequence.
• State machine. Refused open to UNOPENED, refused update to IDLE with cooldown restart, refused recover and any status 2 to STUCK, other statuses revert and leave the order pending. Stale deadline is fixed at placement.
• Parser (periphery). Both scanner paths were checked for the SWAR borrow false-candidate behaviour, complete chunk coverage of backslashes before any key match, and reads at or beyond the end of the document. Because the proof bytes are fixed by the hash, the only attacker freedom is calldata appended after the proof. A scratch test appending a backslash and a forged "jobId" key with a different UUID still extracted the authentic parent and ordered the correct body.
• Glamsterdam slot rule. Callbacks write only resultHash and _status, both nonzero from the constructor, and the sentinel plus zero-hash rejection keeps them nonzero. The existing state-diff test confirms it.
• Launch inputs. Seven static words in declaration order, action words match the pinned reference, constructor touches no external code.

The one reported item is the owner's ability to redirect a sponsor's in-flight refresh payment by changing the Intake, asset, actions or body before the sponsor's transaction lands. The brief requires these to be owner-settable and the README documents it, so it is filed as a trust assumption at info, with a concrete reproduction using the repo's mock.

Static-analysis leads were all checked and dismissed: the reentrancy lines are covered by the transient guard and balance equalities, the strict equalities compare state enums, and the timestamp uses are the specified deadlines.

Not reached: the policy gas ceiling is not in the tree, so I could only measure deployment at about 4.2M gas and flag it for the manifest step rather than name a failing state. The live Intake v2 bytecode was exercised only through the project's offline replay, not a fresh fork.

Added failure-path, payment, parser, boundary, and stateful invariant tests. All seven added files are under test/.

Validation passed with the required seed: 98 tests, including 32,768 invariant calls. forge build passed. No contract defects were reproduced.

The review is complete and .imd-findings.json holds the result: one low finding and 16 coverage rows, all 13 verifier entry points answered.

What I checked (Math Precision, Boundary, Numerical Gap guides against src/BurnTracker.sol):

• Arithmetic and casts. Timing fields are uint40/uint32 with checked uint256 addition before narrowing, so no reachable truncation or overflow. Cooldown and staleAfter bounds are inclusive at exactly 1 hour and 30 days, and the body-size limit in setBody matches the order-time limit and the Intake's 16 KiB cap at the exact boundary. Scratch tests confirmed each edge.
• Parser. I ran a differential fuzz of the jobId extractor against Python's JSON decoder on 600 random canonical documents with escapes, nesting, unicode, decoy keys and malformed UUIDs. No wrong extraction and no acceptance of an invalid document. The only rejections of valid documents were keys containing escape sequences, which the code documents as intentional and which real result.json keys never contain. Reads past the end of calldata are all guarded by the trailing-brace requirement or explicit bounds checks, and the word-scan borrow false candidates never hide a true match.
• External boundaries. Price is read before any token movement, PriceTooHigh and ActionNotSold revert first, balance-delta and allowance-reset checks hold, and callbacks write only the two constructor-initialized nonzero slots at 15k to 53k gas, under the 200k stipend even with a 4,000-byte URI. Against the recorded mainnet Intake, two identical repeated orders get distinct request ids, so the duplicate-id guard cannot brick repeat updates.

The finding is a state-machine seam, not a math defect. A refused replacement open placed from STUCK returns the contract to UNOPENED, where recover and setResultHash are rejected, so the owner loses the recovery path it had and must pay for a new project. This follows the brief's literal rule for a refused open, so I filed it as low with a passing scratch test demonstrating the lockout and left the design call to the author.

Static-analysis leads (reentrancy in _order, strict equalities, timestamp comparisons) were traced and do not hold: state is set before external calls and callbacks are blocked by the transient guard. Nothing outside test/scratch/ and the findings file was written.

Review complete. The findings are in .imd-findings.json at the repository root, with a full coverage record, and the working tree is otherwise unchanged.

Outcome. The contract is sound. All 98 project tests pass, deployability holds (no constructor calls, 7 static words matching launch.json, runtime and initcode well under the limits), the callback path writes only constructor-initialized nonzero slots under 200k gas, and the stored template matches the preflighted body that the plane accepted with no blockers. I found no critical, high or medium defect, and nothing the four specialists missed.

Findings kept, after reproduction:

• Low, merged from three specialists. A refused replacement open() placed from STUCK or a stale PENDING drops to UNOPENED, which is the one state that rejects both recover and setResultHash. The owner loses the recovery paths for a project the plane still accepts continuations for, and the only exit is paying for a brand-new project. I ran the economics specialist's proof under test/scratch; it fails on the current code as stated, and it is attached to the finding. This follows the brief's literal rule for a refused open, so the fix is a scope decision: return to STUCK when the refused open replaced an existing project.
• Info, merged from two specialists. The owner can retarget a sponsor's in-flight refresh payment up to maxPrice through setIntake, setActions or setBody, since they take effect with no delay. Reproduced with a scratch test where the sponsor's full maxPrice landed with the owner. The brief asks for these powers and the README documents them, so this is a recorded trust assumption.
• Info. A refused refresh returns to IDLE with the hash unchanged, so a permanently refused parent costs each later sponsor the price every cooldown until the owner adopts a new hash. Reproduced over three cycles. This is the brief's stated rule.

Dropped. The slither reentrancy and strict-equality leads do not reproduce: state is written before external calls, every entry point is guarded, callbacks are refused while the guard is entered, and the equalities compare a state enum. The aderyn lines are style notes.

Coverage. All 13 entry points are answered. Twelve hold; onFailure carries the low finding. Two invariant rows cover deployability and payment atomicity.