Created launch.json with the exact CETS supply, empty constructor arguments, required paired currency, and verbatim economics.

Schema and compiled ABI checks passed. forge build succeeded; forge test passed all 29 tests. Only launch.json changed outside permitted scratch files.

The review is complete. The findings file is written and no source files were changed.

Result: no defects found. The file .imd-findings.json holds an empty findings list and six coverage rows, all holds.

What was checked, per the Execution Trace, Periphery and First Principles guides:

• Execution flow. Each of the three entry points was traced through the inherited OpenZeppelin code to its final state. Transfers move exactly the requested amount with no fee, hook or external call. Delegated transfers spend allowance before moving balance, with nothing in between that could go stale, and a revert at any step restores allowance and balance atomically. The only residual behaviour is the standard ERC-20 approve-replacement race, which the README documents and which is inherent to the interface, not a defect of this token.
• Periphery. The vendored OpenZeppelin files match the hashes recorded in the dependencies manifest and read as unmodified v5.0.2. The context helper returns the plain message sender, so there is no trusted-forwarder path. Dependencies are plain files, not submodules, and the build and all 29 project tests pass offline.
• First principles. The constructor mints one billion tokens with 18 decimals, exactly 10^27 base units, once to the immediate deployer. With a CREATE2 factory that deployer is the factory, confirmed in a scratch test with the factory etched at a fixed address. The compiled ABI has no mint, burn, owner, pause, blacklist, initializer, upgrade, receive or fallback entry, so the supply cannot grow and no privileged hand can move or freeze a holder.
• Static-analysis lead. The aderyn large-numeric-literal line is a compile-time constant that equals the manifest supply and is asserted by tests. Not a defect.
• Bytecode. The runtime contains no DELEGATECALL, CALLCODE, SELFDESTRUCT, CALL or STATICCALL.

What was not run. The protected harness itself cannot execute here because it imports Uniswap v4 and launch helper contracts that are not in this tree. Its token-only checks were reproduced in a local scratch test that passed and has since been deleted. Pool seeding and swap behaviour therefore rest on the token being a plain ERC-20 with no transfer restrictions, which the trace confirms.

The review is complete. The math audit of the Cets token found no defects in the token itself.

Result: .imd-findings.json holds one informational finding and eight coverage rows, all three listed entry points marked holds. The scratch test was removed, and no other file was changed.

What was checked, against the Math Precision, Boundary and Numerical Gap guides:

• Supply constant. The literal evaluates exactly to 1e27 at compile time, matches the brief, and fits in both uint128 and int128, so Uniswap v4 liquidity and balance deltas cannot truncate it.
• Transfer arithmetic. The vendored OpenZeppelin v5.0.2 _update checks the balance before its unchecked subtraction and bounds the unchecked addition by total supply. One-wei, full-supply, supply plus one, max-uint, self-transfer and zero-amount cases all behave exactly.
• Allowance arithmetic. Only max-uint is treated as infinite, max-minus-one decrements, an allowance larger than the balance fails on the balance with allowance untouched, and the zero-address sender cannot be used as a mint path.
• Launch shares. Every poolBps from 1 to 9000, and the 10, 2 and 8 percent swarm splits, divide this supply with no rounding dust.
• Conservation. The existing invariant suite and a scratch fuzz both keep the sum of balances equal to total supply. The contract has no burn, fee, mint or hook path, so there is no seam for drift.
• Static-analysis lead. The aderyn large-literal warning is style only.

Informational finding: seven vendored forge-std files were re-wrapped by a formatter, so their hashes no longer match the values recorded in dependencies.json. Ignoring whitespace they are byte-identical to upstream v1.9.7, and all six OpenZeppelin files match upstream exactly, so this is a stale record rather than tampering. It is outside the math area and affects only a test dependency.

Not reached: nothing in the assigned area. Price derivation from the market cap and the distributor's per-claimant division live outside this tree and were not reviewed.

Review complete. The findings file is written and the working tree is otherwise unchanged.

Result: the Cets token holds under the Economic Security, Invariant and Flow Gap checklists. One low-severity provenance defect was found, outside the token's runtime.

What was checked

• The token is a fixed-supply ERC-20 built on the unmodified OpenZeppelin v5.0.2 implementation. All six vendored OpenZeppelin files match their recorded checksums, and the ERC20 body matches upstream.
• The constructor mints exactly 10^27 base units to msg.sender once. There is no mint, burn, pause, blocklist, owner, hook, fee or transfer-time branching, so the factory, distributor, pool manager and trader flows all move exactly what they say.
• Supply conservation and the three entry points were traced through every guard and failure path. The project's 29 tests pass, and a scratch fuzz test I ran drove the full launch flow at every pool share from 1 to 9000 basis points, plus claims and buy/sell round trips, with exact balances throughout. The scratch test was removed afterwards.
• Sentinel cases hold: transfers to the zero address revert, transferFrom from the zero address cannot mint, the token rejects ether, and max allowances cannot exceed the owner's balance.

Finding (low): dependencies.json records SHA-256 digests for seven forge-std files that do not match the files actually vendored, even though the README presents that file as the offline provenance record. The committed files match their git blobs, so this is content drift, not line endings. It is test-only and does not touch the token bytecode. The reproduction command is in the finding.

Coverage: rows for approve, transfer and transferFrom are all holds, with three additional invariant and flow rows. The launch economics row is unreached because no manifest exists in the tree yet, and nothing in the token depends on those values.

The review is complete. The findings file is written and validated, and no source or configuration files were changed.

Outcome. The Cets token has no access-control, trust-gap or asymmetry defects. It is an unmodified OpenZeppelin v5.0.2 ERC-20 plus a constructor that mints the full supply to the deployer. There are no roles, no initializer, no owner, no external calls, and no mint or burn path after construction. The compiled runtime contains no DELEGATECALL, CALLCODE or SELFDESTRUCT. All 29 existing tests pass, including the stateful supply invariant.

What I checked against each guide:

• Access Control. The permission map is empty. Every storage slot has one writer path with one guard: balances move only when the sender is the holder or holds allowance, and the deployer has no power over anyone after the constructor. I confirmed the factory cannot pull from a holder without approval.
• Asymmetry. The transfer and transferFrom pair reach the same internal transfer and move identical amounts. The infinite-allowance branch not decrementing is upstream behavior and documented in the README. Mint and burn are asymmetric by design, since burn is unreachable.
• Trust Gap. No privileged actor, no price or fee formula, and no settable recipient exist, so none of the four seams has material to combine.

Findings written to .imd-findings.json:

1. Low. The dependency record claims exact checksums, but seven forge-std files do not match the hashes listed for v1.9.7. The six OpenZeppelin files do match, so the production code is provenance-verified. This is test-only and outside my area, but it is concrete and reproducible.
2. Info. The standard ERC-20 allowance replacement race, with a concrete 150-token trace. It is inherent upstream behavior the README already mitigates, recorded so the judge has the trace rather than as a request for change.

Coverage. All three listed entry points are marked as holding, with one-line reasons, plus rows for the constructor, the no-privileged-role invariant, the fixed-supply invariant, the trust-gap seams, and dependency provenance. The static-analysis lead about a large numeric literal is a style note, not a defect, and was dropped.

The scratch test under test/scratch/ is not part of the submission. Nothing in the tree outside the findings file was modified.

Added failure-path and boundary tests, plus stateful invariants tracking balances, allowances, and rollback across random call sequences.

forge build and forge test pass offline, including 7,000 fuzz cases and 32,768 invariant actions.

No defects found. All changes are confined to test/.

Review complete. The findings file is valid, the one snippet matches its line, and the working tree has no stray files.

Outcome: one low finding, no token defects. The Cets contract is the unmodified OpenZeppelin v5.0.2 ERC-20 plus a constructor that mints the manifest supply to msg.sender. All three entry points hold.

What I reproduced and kept

• Checksum drift in dependencies.json (low). Three specialists reported the same root cause, so I merged them into one finding. Seven vendored forge-std files hash differently from the recorded values. I fetched those files from the pinned upstream commit: the recorded hashes match upstream exactly, and with whitespace stripped each vendored file is identical to upstream. The drift is formatter re-wrapping only. It affects test-only code and breaks nothing at runtime, but the README's provenance claim no longer holds against the tree. Reproduction is the sha256sum command with expected and actual digests.

What I dropped

• The approve replacement race from the permissions specialist. It reproduces, but it is standard ERC-20 semantics inherited unchanged and already documented in the README. It is not a defect of this code, so I recorded it as a note on the approve coverage row instead.

Own pass with the Pashov and entry-point checklists

• ABI exposes only the ERC-20 surface, with no owner, mint, pause, blacklist, burnFrom or upgrade path.
• Disassembled runtime contains no DELEGATECALL, CALLCODE or SELFDESTRUCT.
• The vendored ERC20 and its four dependencies hash-match OpenZeppelin v5.0.2 exactly.
• launch.json is consistent with the source, and its sqrt price agrees with the economics to double precision.
• The existing suite of 39 tests passes, and forge fmt --check is clean. No proof test was needed since nothing reached high severity.

Coverage record: six rows, all holds, covering the three listed entry points plus the supply, privilege and manifest invariants.