Implemented LaunchToken and PulseDrone, with heartbeat tracking, staking ranks, onchain art, ABI exports, and deployment documentation.

Validation passed: build, formatting, ABI checks, and all 42 tests, including a clean offline run with a cleared environment.

Deployment assumptions and responsibilities are in README.md. Manifest creation and independent review remain separate stages.

Created launch.json with Pulse/PULSE, PulseDrone("$token"), and the prescribed pool values.

Manifest and constructor ABI checks passed. forge build succeeded; forge test passed all 42 tests. Only launch.json changed.

The review is complete. The findings file is written at .imd-findings.json and no source, test or config file was changed. The scratch test used for measurement was removed.

Outcome. The permission model of PulseDrone and LaunchToken holds on every state-changing entry point. One low-severity trust-gap finding is reported.

What I checked, per the Access Control, Asymmetry and Trust Gap guides

• Role inventory. There is no owner, initializer, proxy, delegatecall or selfdestruct. The constructor takes only $token, rejects zero or self, captures no sender, and makes no external calls, so it deploys on an empty chain and leaves no role with the factory or IMD.
• Caller guards. beat, stake and unstake key on droneOf[msg.sender], which equals ERC-721 ownership because every transfer, approval and burn path is overridden to revert and _update rejects them at the state layer.
• Paired writes. stake and unstake write drone.staked and totalStaked in mirror directions, move tokens only to or from the caller, and sit behind the reentrancy guard. The static-analysis reentrancy and ETH-send leads are false positives: no ETH is ever sent and the token is a hookless ERC-20.
• Mint callback. State is finalized before the receiver callback and the guard blocks any mutation during it.
• Manifest. No launch.json exists yet, so that row is marked unreached. The README's handoff terms match the source.

Finding (low). mint() is free and guarded only per address, while the 4,096 cap is permanent with no burn or admin. One actor can take the whole collection and lock every later wallet out forever. Measured cost for all 4,096 mints:

This matches the brief's design, and the README already disclaims uniqueness of humans, so it is reported as a documented trust assumption for the requester to decide on, not a code defect that requires a fix.

Coverage. All eight listed entry points have rows, plus rows for the soulbound overrides, constructor and role inventory, receive/fallback, the manifest, and the staking conservation invariant.

The review is complete. The findings file is valid JSON, the quoted snippet matches the tree exactly, and no tracked files changed.

Outcome: PulseDrone and LaunchToken hold up under the Economic Security, Invariant and Flow Gap checklists. I found no fund-loss, accounting or custody defect. One low-severity design-level finding is recorded.

What I traced

• Staking round trip: stake and unstake are checks-effects-interactions under one reentrancy guard, the ledger and totalStaked move symmetrically, and the exact balance-delta check rejects fee or rebasing tokens. A front-run donation does not break the check. Every credited unit stays withdrawable, including while dormant.
• Heartbeat timers: lastBeatAt is written only by mint and beat, so no secondary path resets the cooldown or revives a Drone. The view's alive rule matches the write's streak rule at the 48-hour boundary.
• Rank: a flash stake-then-unstake in one transaction leaves no persistent rank, so only block-end snapshots reach the leaderboard.
• Launch floor: constructor makes no external calls, runtime is 15.6 KB, the forbidden-opcode scan passes, ABI exports verify, and the vendored libraries are plain files with no submodules.

Finding recorded (low): the free one-per-address mint lets a single actor with 4,096 addresses capture the entire Drone cap, permanently denying later humans. Measured cost is about 240k gas per mint, roughly 5 to 20 ETH for the full cap at mainnet gas prices. This is inherent to the approved brief, so the proposed fix is explicit documentation; anything stronger needs a requester decision.

Not reached or out of scope: no launch.json exists yet, so manifest review awaits the manifest assignment. The README's allocation line (88% pool, 2% payer) and the aura-ring interpretation (streak counts rather than days) are documentation and policy matters I could not verify against a network or policy file and did not report as findings.

Coverage rows answer all eight listed entry points plus four invariants. The scratch test under test/scratch/ is working material only.

The review is complete. The findings file is written, valid, and the working tree holds no stray files (the findings file is excluded by the repository's own exclude rule, and the scratch test directory is removed).

Outcome: no arithmetic, boundary or numerical-gap defect was found in the PULSE contracts. One informational spec mismatch is recorded.

What I checked in my area

• Heartbeat timing in src/PulseDrone.sol. The elapsed-time subtraction cannot underflow, the 20-hour cooldown admits exactly 20 hours, and the 48-hour streak window shares its inclusive boundary with the Alive status. I probed 20h-1, 20h, 48h and 48h+1 by scratch test, and the existing fuzz test covers the same.
• Staking accounting. Zero and max inputs revert without touching state, the whole 10^27 supply fits and reaches Queen's Guard, the exact balance-delta check rejects fee-on-transfer, and the token-code check closes the SafeERC20 empty-address no-op corner the Boundary guide names. Unstake validates before subtracting, so the ledger and the aggregate cannot underflow.
• Rank thresholds, caste and trait derivation, pagination bounds, and the decimal formatter in src/lib/DroneArt.sol. All held at every boundary I fed them, including 1 wei, 1e18+1, 1e27-1 and 1e27.
• Static analysis leads. The reentrancy lines are guarded by the shared nonReentrant modifier and covered by a reentrant-token test. The timestamp and weak-randomness lines are documented cosmetic uses with no economic effect.
• Exported ABIs match the compiled artifacts. The full suite of 42 tests passes.

The one finding (info): the brief says the first aura ring appears "at 7 days", but the renderer keys rings on the beat count. With a 20-hour cooldown, streak 7 is reachable 120 hours after mint, so the ring shows at 5 days. The README documents this interpretation deliberately. I reported it with the exact call sequence so the requester can confirm the wording or ask for a time-based tier.

Coverage record: all eight listed entry points have rows, plus three invariant rows for rank thresholds, pagination bounds and numeric rendering. Nothing was left unreached.

The review is complete and the findings file is written.

Outcome: no exploitable defect found in src/PulseDrone.sol, src/LaunchToken.sol or src/lib/DroneArt.sol. The file .imd-findings.json holds one info-level note and eleven coverage rows, all eight listed entry points answered as holds.

What I traced, by guide:

• Execution Trace. Mint writes every storage field and emits events before the ERC-721 receiver callback, and the shared reentrancy guard blocks re-entry into mint, beat, stake and unstake. Stake updates the ledger before the token pull and then requires the exact balance delta. Unstake checks the caller's credited amount before transferring. The slither and aderyn reentrancy lines are not reachable: the launch token has no callbacks and the guard plus checks-effects-interactions ordering hold.
• Periphery. The vendored OpenZeppelin v5.0.2 files are committed as plain files with no submodule. The three-argument safeTransferFrom forwards to the overridden four-argument one and reverts Soulbound, and the _update override rejects any move of an existing token. DroneArt output decodes to valid JSON and well-formed SVG in the largest state (streak 121, Queen's Guard, fractional stake), and the PULSE formatter keeps 18 places correctly.
• First Principles. No owner, msg.sender or tx.origin role exists; the constructor makes no external calls and binds $token immutably, matching the brief's preferred option. Beat timing matches the 20-hour and inclusive 48-hour boundaries. A full 256-item getDrones page and the largest tokenURI stay far below RPC call limits.

The one note (info): aura rings key on heartbeat count, so a ring appears after 7 beats, reachable in 5 days, while the brief says "7 days". The README documents this reading, so the requester only needs to confirm it.

Checks run: forge build, the full 42-test suite, forge fmt, and the ABI export check all pass. launch.json does not exist yet, which is expected before the manifest assignment and is recorded as unreached with the constructor shape it must carry. My scratch test directory has been removed and the tree is unchanged.

Added failure-path and fuzz tests plus stronger custody and token invariants. Only test/ files changed.

Validation passed: forge build and all 51 tests, including 49,152 random invariant calls. No confirmed defects found.

The review is done and the findings file is written. The working tree is clean apart from .imd-findings.json, which is gitignored.

Outcome: no blocking defects. The PULSE contracts, tests and manifest hold up against the specialists' leads, the static-analysis leads, and my own pass.

What I verified

• The full suite passes: 51 tests across 9 suites, including the staking invariant and fuzzed heartbeat timing.
• PulseDrone runtime is 15,568 bytes and initcode 16,492 bytes, well inside the deployment limits. No DELEGATECALL, CALLCODE or SELFDESTRUCT. Constructor makes no external calls.
• The ABI exports under docs/abi match the build. The manifest uses only schema keys, passes $token as the single address argument, and keeps the token argument-free.
• All eight listed entry points traced and answered in the coverage record, plus three invariant rows (constructor and manifest, soulbound surface, views).
• Slither's and aderyn's reentrancy leads on stake do not reproduce: effects precede the external call, every mutation shares the reentrancy guard, and the exact balance-delta check closes fee or short transfers. The "weak randomness" lead is the brief's own seed formula and is cosmetic only.

Findings kept, both informational

1. Aura rings count beats, not days. Merged from audit_flow and audit_math. Reproduced: six beats at 20-hour spacing give streak 7 after 120 hours, and the SVG already carries the first ring. The README documents this reading; the requester should confirm it.
2. Free one-per-address mint can be sybil-exhausted. Merged from audit_permissions and audit_economics. Reproduced: 4,096 distinct addresses fill the cap for about 884M gas, then every later mint reverts forever. This is exactly the design the brief specifies, so I recalibrated it from low to info. No code change is needed. The README should state the risk explicitly.

Neither finding carries a proof file, since neither is critical or high. The scratch test I used to reproduce them has been removed.

Implemented source in web/, static export in dist/, and validation evidence.

Passed build/typecheck, 8 unit tests, 22 browser scenarios, and ABI/manifest checks. Verified bundle: 3,480,046 bytes. No live transactions sent.

Git commit was blocked by the read-only .git mount. Files remain ready for collection. Design documentation is at docs/DESIGN.md to respect the path restrictions.

Findings are in .imd-findings.json: 3 high, 2 medium, 4 low. No file in the tree was changed. The probe ran with the Playwright copy under the MCP install; WebKit is not installed on this machine, so the Safari pass did not run and the layout judgement is Chromium only.

Requirements

• "dark, near-black background, amber and gold accents, hexagon motifs, a soft heartbeat line animating across the hero. Mobile first": met. Tokens at web/src/styles.css:17-40, heartbeat SVG at App.tsx:232, animation measured as "signal 6s".
• Hero "The swarm never sleeps. Neither does your Drone.": met, App.tsx:190-194, verbatim.
• "Live counters: Drones minted / 4,096, Drones alive now, longest active streak": met, App.tsx:241-261, read live from chain 1 as 0 / 4,096, 0, 0 beats at block 26,176,908. Below the first screen on phones (medium finding).
• "Big 'Mint your Drone' button": met, App.tsx:202, on the first screen at 390 and 320.
• "Mint: connect wallet, mint for free, then reveal the Drone's SVG with its Caste and call sign": met, DronePanel.tsx:37-65 and 149-165. Not executed, no wallet here.
• "My Drone: live SVG, streak, best streak, total beats, rank, staked PULSE. A large BEAT button with a countdown ... warning (under 6 hours left)": met, DronePanel.tsx:66-126. The 20h, inclusive 48h and 42h boundaries in domain.ts:61-70 match the contract.
• "Stake: approve and stake PULSE, unstake, with a bar showing progress to the next rank": met, DronePanel.tsx:180-383.
• "The Hive: grid of all minted Drones (lazy loaded via getDrones), filter Alive / Dormant / Caste, leaderboard of the top 50": met, Hive.tsx; state read in 128-batches at chain.ts:178, art lazy via IntersectionObserver. The refresh cost is a low finding.
• "About: how the IMD swarm built and verified this project, plus PULSE and PulseDrone contract addresses with Etherscan links": met, App.tsx:323-406, both handoff addresses link to etherscan.io.
• "Bind PULSE token" admin panel: met by the brief's own condition. The deployed PulseDrone takes the token in its constructor, pulseToken() returns the LaunchToken address and owner() reverts, so there is nothing to bind.
• Deployment manifest: met. dist/imd-deployment.json copies launchId, chainId 1, sourceCommit, attestationHash, both contracts with abiHash, poolKey, network and walletAddChain unchanged; all 10 asset hashes verified; the runtime loads it and the ABIs by abiPath with a keccak check (config.ts:78-127).
• Wallet connection and swap controls: met, wallet.ts (EIP-6963), SwapPanel.tsx (Uniswap v4 quoter, Permit2, Universal Router).

The idea. A soulbound Drone that lives only while you send it a heartbeat, carried by one amber pulse line over near-black. Keep the heartbeat line and the hexagon; cut the mono specimen captions, kickers and slogan fragments that crowd it.

Findings, most severe first

• High, taste: one .eyebrow class puts tracked caps mono kickers over 12 headings, including the first screen, and wraps the counter labels onto three lines at 390. Delete the kicker elements, restyle the three counter labels as plain small text.
• High, taste: five two-beat slogans stack in the hero around the brief's headline. Keep the headline, keep the one plain sentence, delete the rest.
• High, taste: 9 to 12 type sizes and 6 weights, with the h1 at 500 lighter than strong text at 650 and the brand at 700. Collapse to six sizes and three weights.
• Medium, fidelity: at 390 the illustration and its captions push the hero counters to 1,213px. Hide the illustration under 43rem and delete the caption rows.
• Medium, taste: no og:ima

Committed as 8bc8add. All nine findings reproduced and fixed; responses are in .imd-responses.json.

Build, typecheck, 17 unit tests, 22 browser scenarios, revision checks and manifest verification passed. Final bundle: 6,516,566 bytes, below 8 MiB.

No live transactions were sent.

All nine earlier findings are fixed. .imd-findings.json contains {"findings":[]}. Website files are unchanged.

PULSE is a wallet-connected Drone companion, carried visually by gold hexagons and a heartbeat trace against near-black.

Validation passed: typecheck, build, 17 unit tests, all 22 interaction scenarios in both Chromium and WebKit, and the focused revision suite in both engines. The rebuilt export matches the committed export byte-for-byte. Live read-only RPC checks confirmed chain 1, deployed code and the correct PULSE binding. Transaction interactions used mocks; no transactions were broadcast.

The three raw taste failures do not reopen findings: the monospace line reports snapshot data, the em dashes represent unavailable amounts, and the four detected slogans occur across separate sections rather than stacking in the hero. The brief’s exact headline also overrides the six-word heuristic.

The requirement inventory below groups related clauses and deduplicates the repeated workflow. Contract rows record preservation of the accepted pinned implementation and existing verification evidence; this was not a new Solidity audit.