Implemented HEDS and CommitRevealCoinFlip, including vendored dependencies, ABI exports, deployment documentation, and adversarial tests.

Verified with Solidity 0.8.26:

• forge build passes.
• forge test: 46 passing, including 8,192 invariant calls.
• forge fmt --check and ABI consistency checks pass.

Withholding and coalition risks are documented and tested. Independent review, manifest generation, deployment, and frontend publication remain later-stage responsibilities.

The earlier non-zero exit was only the grep finding no "Compiler run" line because nothing needed recompiling. The full suite passes with the new file in place.

Delivered: test/PayoutConservationFuzz.t.sol, seven fuzz tests over 2 to 16 players with random sides, 256-bit random salts (a zero salt forced in about one run in eight), and random reveal subsets. The full suite now runs 53 tests and passes at both the default 256 and 1000 fuzz runs, and the file passes the formatter check.

What the tests assert, with every expected value recomputed independently rather than read from the contract's counters:

• Exact pot conservation. Sum of credits plus tokens sent to the dead address equals players times stake to the wei, the burn is the division remainder and always under 16 wei, all-withhold rounds burn nothing, and the coin matches an XOR-parity recomputation. Every credited player then withdraws exactly the credited amount and custody ends at zero.
• No non-revealer is paid when anyone revealed. A revealer and a withholder are forced at fuzzed positions. Withholders hold zero credit, their withdraw reverts, and the forfeited stakes land in the pot that revealers and the burn address split exactly.
• Unanimous sides. All-heads or all-tails rounds pay every revealer the same share whether they all won or none did, which pins the no-winner fallback to the winner path.
• Custody across overlapping rounds. Three staggered rounds with shared players, a random subset settled, a random subset of players withdrawing. HEDS held equals unsettled stakes plus the sum of withdrawable balances after every step, with the stakes recomputed per round and the credits per account, then all histories are driven to zero custody.
• Failure paths on a fuzzed round. Seventeenth join, join at the deadline, reveal before the window, wrong salt, wrong side, wrong sender, outsider reveal, duplicate reveal, reclaim on a competitive round, settle one second early, reveal at the reveal deadline, double settle, reclaim and join after settlement, and a second withdraw. None of them move custody.
• Fewer than two players. Lone player via reclaim or via settle, and the empty round, refund exactly with no burn. Stake bounds are checked at both edges including the overflow cap.

Mutation check. I ran the suite in the scratch area against two altered copies of the contract, one that keeps the rounding remainder instead of burning it and one that also credits withholders. Five of the seven tests fail against each mutant with concrete counterexamples, so the assertions are load-bearing. Scratch files were removed afterwards.

No findings file was written. I read the implementation adversarially and found no defect I would have had to test around. Payout, burn and counter accounting are consistent on every path, reentrancy is guarded, the stake cap prevents pot overflow, and the last-revealer withholding bias is already documented in the README and quantified by the existing withholding tests. The phase view reporting Reclaimable for an empty round is documented in the ABI guide, so I did not report it.

The new file is untracked in the working tree and not committed, since the task did not ask for a commit. Nothing was installed.

Created launch.json for Heads (HEDS) and CommitRevealCoinFlip with ["$token"].

Schema, metadata, and constructor checks passed. forge build succeeded; forge test passed all 53 tests. Only launch.json is a submission change.

Wrote .imd-findings.json with {"findings":[]}. No substantiated defects. Project files remain unchanged.

Independently exercised the requested attacks on local Anvil. Below, s = 10^18 token units; entrants approve their stake and join using keccak256(abi.encode(side, bytes32(salt), address, roundId)).

• Last-revealer withholding: With two players, A commits (tails, 0) and B (heads, 1). A reveals; B withholds; settlement credits A 2s and B zero. Revealing instead would credit B 2s. For 3 or 16 players, coalition wallets A/Z commit (tails, 0)/(tails, 1); outsiders commit (heads, 0). Everyone except Z reveals. Withholding gives A the entire pot: coalition net profit is 1s or 14s, versus zero receipts if Z reveals. These are conditional outcomes under the approved, documented randomness limitation, not implementation defects. A lone withholding address receives nothing when anyone reveals; all-withhold rounds refund everyone.
• Commitment replay: A joins round 1 with (heads, 7). B copies that commitment into round 1; A copies it into round 2 containing another participant. During the respective reveal windows, B’s reveal(1,true,7) and A’s reveal(2,true,7) both revert InvalidReveal(). Commitments bind both address and round.
• Premature settlement: After both players reveal, settle(id) at revealDeadline−1 reverts SettlementTooEarly(). At the deadline it succeeds; repeating it reverts AlreadySettled().
• Share rounding: Three players stake s+1. A/B reveal tails with salts 2/4; C withholds. Settlement credits A/B 1,500,000,000,000,000,001 units each and transfers 1 unit to the burn address. Changing both revealed choices to heads exercises the no-winner fallback with identical accounting.
• Withdrawal reentrancy: Using the callback test token, two players join and withhold; settlement credits each s. Enable the attacker’s transfer callback, then call collect() → withdraw() → token.transfer() → callback → withdraw(). The nested withdrawal reverts ReentrancyGuardReentrantCall(), observes zero remaining credit, and collects no second payment. Actual HEDS transfers provide no callback.

launch.json specifies CommitRevealCoinFlip.constructorArgs = ["$token"], matching its sole nonpayable address constructor argument and immutable token reference. It grants no privileged role. LaunchToken has a nonpayable, argument-free constructor and no ongoing mint/admin authority. Both exported ABIs match compiler output.

Implemented the frontend, static export, deployment manifest, and documentation.

Build, typecheck, 24 browser checks, ABI/hash verification, and live RPC reads passed. No live transactions were broadcast. Export size: 604 KB.

Validation evidence · Design documentation

Commit blocked: .git is read-only. Deliverables are present but uncommitted. DESIGN.md is under docs/ to respect the allowed paths.