I built the site and committed the output to dist/, but I couldn't publish it to IPFS from here. So I don't have a sites.imd.fun URL or CID to give you. Publishing under the "ogclub" label is left to the upload step that runs after this job. I didn't compute a CID myself, because it might not match what the upload produces.

The brief's npm ci doesn't work for this repository. npm ci failed because the repo has no package-lock.json. I didn't stop the job over it, since that rule was about the address and ABI check, which passed. I used the install the README documents, npm install --no-package-lock, so no lockfile was written or committed. Without a lockfile, the versions come from the ^ ranges in package.json, which today gave vite 6.4.4, viem 2.57.4 and @openzeppelin/merkle-tree 1.0.8. A later build could pick up newer versions.

• Package manager: npm 10.9.9 on Node 22.
• Build command: npm run build (vite build).
• Where it wrote: dist/ at the repository root, which is Vite's default and what the README says. It contains dist/index.html, four files in dist/assets/, favicon.svg and imd-deployment.json, 544 KB in total, well under the 8 MiB limit.

Address and ABI check: the build read deployment/imd-deployment.json and passed its own check of address 0xca9d…3217, all required functions and events, and deploy block 26171777. The repo's other two checks also passed: npm run verify:root printed MATCH for the founder Merkle root, and npm run check:bundle found no trackers or secrets.

Page check: the only changes are the committed dist/ and one line removed from .gitignore (dist/). I tested on a local copy served under an IPFS-style path (/ipfs/<cid>/), not on the real gateway. In headless Chromium:

• Every asset path in index.html is relative (./assets/..., ./favicon.svg), and no local request failed.
• At both 375×812 and 1440×900, the page showed live mainnet data (block 26,175,098):
  • public supply 1
  • next pass buy price 1,010,000 OG (about 0.0208 ETH)
  • curve reserve 1,000,000 OG
  • founder buyback reserve 4,900,000 OG (funded)
• There was no horizontal overflow at either size.

The only console message was the browser ignoring frame-ancestors in the page's meta security policy, which is harmless.

Once it's published, the same checks are worth repeating on the real gateway URL.

The review is complete and .imd-findings.json holds three findings, none of them critical or high. The site can be hosted.

What was read. Every file that will be served (dist/index.html, the three JS chunks, the CSS, favicon, dist/imd-deployment.json) and all of the source it was built from: index.html, vite.config.js, every module under src/, both scripts, the deployment handoff, README and .env.example. A fresh npm install && npm run build in a scratch copy reproduced the committed dist byte-for-byte, so the source I read is exactly what will be pinned.

What the scripts do. The only network destinations in the bundle are the three public RPCs, Etherscan links, the Swarm map link, and unused viem-internal defaults. There is no analytics, no remote code loading, no eval or dynamic Function, no iframe, no redirect. Wallet access uses EIP-6963 discovery plus eth_requestAccounts only. The buy flow approves exactly the quoted amount, never unlimited, and calls buy with maxPrice equal to the quote and a ten-minute deadline. Sell passes minOut equal to the quoted payout. Nothing asks for seed phrases or keys. The disclaimer is shown twice and must be ticked before buying, and it states the passes are not an investment, that the price can fall, and that the owner is the largest OG holder.

Live verification. I read the contract at the OGPass address through the public RPCs. MAX_SUPPLY 1000, founderCount 49, SELL_BPS 9250, FOUNDER_BUYBACK 100,000 OG, a 30-day claim window and the founder Merkle root all match what the page says, and the 49-address list rebuilds the on-chain root. Rendering the sections in Node with those live values produced the public supply, next price and buyback reserve figures the hosting job must check for.

Findings written:

• Medium, package.json: the job as specified fails at npm ci because the repo has no lockfile. Publishing the committed dist, or using npm install, both work and reproduce the same files.
• Low, dist/index.html line 10: the CSP connect-src ends with a bare https: and a dev-only localhost websocket, so the RPC allowlist is ineffective. The shipped code still only talks to the three RPCs.
• Info, src/ui/render.js lines 444 and 464: the ledger hardcodes the deploy block as text instead of using the handoff value. It is correct for the current handoff.

Not done. No headless browser exists on this machine, so the 375x812 and desktop screenshot check remains for the hosting job itself.