Implemented LaunchToken (KICK) and CrowdfundCampaigns, with vendored dependencies, ABI exports, and deployment documentation.

Verified with Solidity 0.8.26:

• forge build passes.
• forge test: 46 passing checks, including reentrancy tests and 8,192 invariant calls.
• forge fmt --check passes.
• Clean offline verification with an empty environment passes.

Manifest creation, independent review, and deployment remain with their designated later stages.

Created launch.json for Kickoff (KICK) and CrowdfundCampaigns(["$token"]).

Schema, constructor, and ABI checks passed. forge build succeeded; forge test passed all 46 tests. Only launch.json changed outside scratch artifacts.

Review complete. No defects found; the findings file at .imd-findings.json contains three info-level observations only, each with a concrete reproduction, and no source, test, doc or manifest file was changed.

What I ran

• The full project suite: 46 tests pass, including the 128-run stateful invariant with zero reverts.
• Seven reviewer probes in a scratch copy under /tmp at 2000 fuzz runs each, since deleted. They covered claim/refund mutual exclusion in both orders, cross-id isolation in both id orders, the same-block goal-lock race with arbitrary amounts, three-backer conservation with interleaved unpledges, huge-amount pledges, inclusive creation boundaries, and a reverting contract creator.
• ABI exports under docs/abi compared byte for byte with fresh forge inspect output: identical. forge fmt --check passes. The runtime bytecode has no DELEGATECALL, CALLCODE or SELFDESTRUCT.

Attack by attack

• Claim and refund both paying on one campaign. Fails. After the deadline no function can change total, and claim requires total >= goal while refund requires total < goal. The two are disjoint on immutable state. Second claim reverts on the claimed flag; second refund reverts because the pledge is zeroed first. Fuzzed over goal and two pledges in both orderings: payout always equals exactly the pledged sum.
• Leakage across campaign ids. Fails. Both _campaigns and _pledges are keyed by id, and every payout reads only that id's entries. A backer with no pledge on an id gets InsufficientPledge or NothingToRefund. Claiming a funded id leaves a failed id's refunds exact.
• Goal lock racing an unpledge in the same block. Behaves as specified. Transactions execute in order: an unpledge before the goal-reaching pledge succeeds, one after it reverts with GoalReached. Once locked the total cannot fall below the goal while open, so the lock is permanent. The creator's ability to trigger the lock is an approved design choice and is recorded as an info observation.
• Rounding with fuzzed amounts. No division anywhere, so no rounding exists. Every path adds or subtracts exact minor units, and the incoming balance check rejects short receipts. Multi-backer fuzz confirms escrow, campaign total and token balance stay equal.
• Reentrancy. Fails. All five mutators share OpenZeppelin's guard, effects precede the token call, and KICK has no transfer hooks. The existing hostile-token tests exercise every mutator from within every transfer path and confirm the guard fires.

Manifest. The single constructor arg ["$token"] matches constructor(address token_), is address-typed, and grants no role. There is no $owner, no hard-coded wallet, and the contract has no owner or admin function. The token entry has no constructor args, and the pool fields match the Sepolia reference values. The manifest is schema-valid.

Not done. I did not attest to deployment, policy or service-stage outcomes, which are outside this assignment.

Implemented the frontend and static export with wallet controls, KICK approval, balance/allowance reads, and deployment manifest.

Build, typecheck, nine interaction tests, live-RPC browser validation, and hash checks passed. Bundle audit is below 3 MiB.

Validation report · Design documentation

Commit creation was blocked by read-only .git. Files remain ready in the working tree. Design documentation stays under docs/ to respect the allowed paths.