The review is complete. The findings file holds an empty list because no defect reproduced.

Verdict. Profiles as it arrived matches its launch text and I found no reproducible defect of any severity. The file .imd-findings.json contains {"findings":[]}.

What was read. All of it: Profiles, the TextRules helper and TextLib, the delegate registry interface, VaultTypes for the shared error declarations, both test files and both mocks, the launch text, and the two protected floor tests. Nothing in scope was out of reach.

What was verified beyond reading.

• Shipped suite: 34 tests pass, the fork test skips without FORK_URL, as the text says.
• Fork suite on mainnet: run against a public RPC, 3 of 3 pass, including the real identity.md NFT and the real registry.
• Constructor contracts: the TextRules runtime at the first address is byte-identical to the local build, and the registry at the second address has code and rejects ERC-721 interface id in its own supportsInterface.
• Gas cap: the registry's worst path and the NFT's ownerOf both execute in well under the 30,000 cap. The deployed TextRules accepts an arweave link and rejects an evil host with the expected selector.
• Forbidden opcodes: a scan of the compiled runtime, same rule as the protected floor, finds no reachable DELEGATECALL, CALLCODE or SELFDESTRUCT. Runtime is 5,489 bytes.
• Scratch tests (removed afterwards): a fuzz invariant that the skeleton computed on set equals the one recomputed from storage on rename and clear, an ERC-721 that returns address zero from ownerOf while the registry answers true (correctly NotNftOwner), clear dropping a stored link, the literal 0x rule versus underscore and capital O prefixes, and six reserved variants through the mapping. All pass.

Review passes. Access control (two public functions, each touching only the caller's record and the name slot it holds), reentrancy (every outside call is a STATICCALL), arithmetic (shifts bounded by index under 20, no unchecked blocks), the name invariant (a stored name implies its skeleton maps back to that wallet, and no path writes another wallet's slot), picture checks, error selector pass-through from VaultTypes, constructor behaviour on an empty chain, and launch-forbidden features. None turned up a failing input.

Notes for the adapter, not findings.

• clear() on a wallet with no record succeeds and emits ProfileCleared. Harmless to an indexer, and the text does not ask for a revert, so leave it.
• ERC-721A collections minted in large batches can need more than 30,000 gas in ownerOf, so such tokens show NotNftOwner or owned false. This is the accepted gas-cap rule, and CALL_GAS is fixed.
• The fork test exercises the registry only on the false path. The mainnet gas estimate shows the true path fits the cap as well.
• The protected tests pin solc 0.8.26 while foundry.toml pins 0.8.28. Earlier launches from this repository passed with the same config, so the floor compiles them separately.

Profiles meets the launch requirements without production changes. Added 10 factory/audit tests and recorded the review in ADAPTATION.md.

Validation with the required fuzz seed:

• forge build: passed.
• forge test: 44 passed, 0 failed, 1 skipped.

The mainnet fork suite skipped because FORK_URL is unset. No transaction was broadcast.

I found no defects in Profiles that I could reproduce, so .imd-findings.json has an empty findings list. It also has a coverage row for each of the two entry points and three rows for invariants I checked. No repository files were changed. I deleted my temporary test file under test/scratch/ afterwards.

Tests

• I reached a public mainnet RPC, so I ran the full suite against a mainnet fork: 47 passed, 0 failed, 0 skipped. That includes the 3 fork tests the earlier pass had to skip because FORK_URL was unset.
• I added one temporary fork test that used the real delegate.xyz v2 registry. A token-level delegation and a whole-wallet delegation with all rights both let the hot wallet set an ERC-721 picture (an Azuki token) and read back as owned. A delegation with non-zero rights correctly reverted with NotNftOwner.

Coverage

• set(string,uint8,address,uint256,string): holds. Every check (name rules, reserved list, NameTaken, picture rules) runs before anything is written. The only outside calls are read-only (STATICCALL), including the call to TextRules, so nothing can call back in and change state. The name reservation is swapped only when the old and new skeletons differ.
• clear(): holds. It makes no outside call, frees the skeleton worked out from the stored name and deletes the whole record, including since and the link.
• Name skeletons. Names are first checked when they come in, and later re-derived from the stored copy; both use the same mapping (upper case, I/i/1 to l, 0 to o, _ dropped). So each skeleton has at most one holder. The 17 reserved skeletons match the brief exactly and are compared as whole skeletons only.
• Gas cap on token and registry calls. The 30,000 cap is far above what these calls need on mainnet. A registry check where no delegation exists, which runs all three lookups, uses about 8k gas beyond the transaction's base cost; Azuki ownerOf uses about 5k.
• Link pictures. HostNotAllowed and BadEvidence from TextRules pass through unchanged. The existing fork test confirms the deployed TextRules accepts the same hosts.

Leads I ruled out

• Gas-heavy NFT contracts. I looked at whether some collections' ownerOf could exceed the 30,000 cap and lock real holders out. Azuki did not come close, and the brief accepts this case anyway, with CALL_GAS fixed.
• Wallets sending less gas. A caller who sends too little gas only makes their own set fail with NotNftOwner; it can't affect anyone else.

From the Execution Trace, Periphery and First Principles guides, the parts that don't apply here are reentrancy that writes state, money moving in or out, signatures and upgrades: the contract has none of these. A clean review is not proof that no defects exist.

Created launch.json for Profiles with the exact constructor addresses and order.

• Manifest structure and compiled ABI checks passed.
• forge build passed.
• Seeded forge test: 44 passed, 0 failed, 1 skipped (FORK_URL unset).

Only launch.json changed.

The review is complete. The findings file is written, and the tree holds no other change.

Result: the permission model of Profiles holds. One informational asymmetry is recorded, nothing of higher severity.

What I checked, in my area:

• Access Control. Both writers, set and clear, are unguarded by design and touch only the caller's own record. The name index can only be written to the caller after the holder check, and only the caller's own skeleton is ever deleted. The constructor hands no role to the factory. There is no initializer, proxy, delegatecall or payable path.
• Asymmetry. The parser key and the stored-name skeleton agree for every charset byte, so rename and clear always release the right slot. The ownership check at write and at read is the same function. The only mismatch is that set rejects the empty record while clear accepts it.
• Trust Gap. With no privileged actor, no fee and no value flow, no seam can form. The two constructor dependencies were verified live.

Live verification on a mainnet fork through a public RPC, beyond what the shipped tests run:

• The TextRules runtime at the constructor address is byte-identical to the local source.
• Real delegate.xyz v2 wallet-level and token-level delegations grant the picture under the 30,000 gas cap, and revocation removes it. A rights-specific delegation is rejected, as documented.
• ownerOf on identity.md stays under the cap for every existing token, ids 0 to 1999.

The one finding (info): calling clear() from a wallet that never had a profile emits ProfileCleared with no state change. It affects only off-chain consumers that count or trust that event. It is a behaviour choice for the author, not a permission defect.

Coverage record: nine rows, covering both listed entry points plus the constructor, the name-index invariant, the views, the live delegate path, both dependencies and the gas cap. Nothing was left unreached. Scratch tests were removed after running.

Review complete. The findings file is written and the working tree is otherwise untouched.

Outcome. One low-severity finding in the math and boundary area, with a proof test that fails on the current code. The rest of the arithmetic and boundary surface holds.

Finding 1 (low), src/Profiles.sol:257. The 30000-gas STATICCALL cap on ownerOf rejects honest holders of ERC721A batch-minted tokens. ERC721A stores the owner only at the first token of a batch and walks back one cold SLOAD per token, so the read exhausts the cap at about the twelfth token of an untouched batch. A faithful model shows offsets 0 to 11 of a 20-token batch succeed and offsets 12 to 19 fail. For those tokens set reverts NotNftOwner even though the token contract says the caller owns it. The brief's known limitation only covers misbehaving token contracts, not well-behaved ones with an expensive read. CALL_GAS is a fixed parameter, so the remedy is a decision to accept and document it or to fail the job, not a code edit.

What holds, with evidence.

• Shifts and casts in the name parser and skeleton stay inside the top 20 bytes; the timestamp cast cannot truncate; there is no division or fixed point.
• The two skeleton routines agree on every stored name, and the name-ownership mapping stays consistent through set, rename, picture-only and clear.
• The 32-byte call decoder checks success and return size before any consumer reads the word.
• The deployed TextRules matches the repository source and behaves as specified at the 300 and 512 byte boundaries. I ran the repository's fork test against a public mainnet RPC and it passed.
• The live delegate.xyz check costs about 8.8k gas and the identity.md read about 3.1k, both well inside the cap.

Not pinned down. The mainnet ERC721A collections I sampled had already-initialized slots for the sampled ids, so the finding rests on the model of ERC721A's loop rather than a specific live tokenId.

Coverage. Both listed entry points have rows: set is marked finding, clear holds. Ten further rows cover the view functions, the constructor and the invariants checked. The proof and a threshold test sit under test/scratch/, which is not kept.

Added failure-path, fuzz, invariant, and fork coverage under test/.

• Build passed.
• Seeded suite: 84 passed, including 10 mainnet fork tests at block 26305652.
• Invariants: 25,600 calls, no unexpected reverts.
• Offline: 74 passed, fork suite skipped.

No contract defects reproduced. Changes documented in test/ADAPTATION.md.

I found nothing wrong in Profiles.sol itself. The review keeps one low finding, which is in the test suite, and drops both specialist findings. The results are in .imd-findings.json, and no repository file was changed.

Kept (low): the fork test ignores FORK_URL. test/fork/ProfilesFork.t.sol:39 now reads MAINNET_RPC_URL. An earlier accepted test commit (3e0981d) made that change. The launch rules and the README both say the fork test runs when FORK_URL is set. I confirmed it locally: with FORK_URL set to an unreachable RPC, the fork suite just reports "skipped". With MAINNET_RPC_URL set to the same address, it tries the fork and fails. So anyone following the documented setup never runs the mainnet check of the two constructor contracts, and the skip looks the same as having no RPC. The fix is in the test only.

Dropped:

• ERC721A tokens deep in a batch mint (math specialist, low). The specialist's proof does fail as they describe: a 30,000-gas ownerOf call on token 12 or later of an untouched batch runs out of gas, and set() reverts NotNftOwner. But that is the behaviour the brief fixes: every token call is capped at 30,000 gas, a failure counts as not owned, and a token contract that burns gas only makes its own owned false. Fixing it would mean changing CALL_GAS, which is a fixed parameter, so it is an accepted rule rather than a finding. The holder can also work around it by sending the token to themselves, which records its owner directly.
• clear() emits an event on an empty record (permissions specialist, info). It reproduces, but the brief only says clear() erases the record and emits ProfileCleared. Nothing breaks and no other wallet is affected, so it is not a defect.

The economics and flow specialists and the tester reported nothing.

Coverage:

• set holds. All the name rules check out: charset, the 0x prefix, length, the skeleton mapping (the same when a name is checked and when it is stored), exactly the 17 reserved names as whole skeletons, and NameTaken. A rename or an empty name frees the old name. Each picture type is checked as specified; every token and registry call is capped and a failure counts as not owned. TextRules errors pass through unchanged, and every revert happens before anything is written.
• clear holds. It frees only the caller's own name and erases only the caller's record.
• Name ownership stays consistent. nameOwner always points to the wallet whose stored name has that skeleton.
• Deployment holds. The constructor only stores the two addresses and makes no outside call. launch.json matches the brief, and the contract is far under the size limits.

The full suite gave 74 passed and 1 skipped (the fork suite, since no RPC was set), plus the specialist's proof failing as expected. I couldn't reach mainnet, so the fork tests themselves didn't run. I deleted the scratch copy of the proof afterwards.