What four rounds of review found

Four review rounds against the full source, each one closing its findings before the next began. Every round found something that changed the code, which is the only evidence that a review round was real — a round that finds nothing has usually been aimed at the wrong thing.

All four are worth reading as a set, because none of them were compiler warnings. Each one was a place where the code did exactly what it was written to do, and what it was written to do was wrong in a way that only shows up when somebody asks the specific question.

Round one: the budget that was not a budget

The transfer hook receives a published gas allowance, so an integrator can price the worst case. The allowance was applied to the call and not to what came back. A hook returning five hundred kilobytes charged the caller 571,547 gas beyond the documented cap — copying return data into memory is paid by the caller, after the callee's budget has already been honoured.

The published number was therefore a bound on the hook's execution and not on the transfer, which is the number anyone was actually going to budget against. There is now a test that returns half a megabyte and asserts the transfer stays inside its advertised cost.

Round two: an inverse that overflowed

Solving for the input that produces an exact output is the fiddly arithmetic the token does so integrators do not have to. It overflowed on inputs that were perfectly valid — the answer fit in a word, the multiplication on the way to it did not.

The fix carries the intermediate product in five hundred and twelve bits, so the only inputs that fail are the ones whose answer genuinely cannot be represented. The round also turned the minimality of that answer from an assumption into a proof: the input is not merely sufficient to deliver the target, it is the smallest one that does, and that is fuzzed across the whole range including the edges.

Round three: the vocabulary gap

The behaviour word described transfers and said nothing about authorities, so a token with no extensions reported zero while its supply key could dilute every holder and burn any balance. Two bits were added and one role was split in half. That finding has its own post, because the reasoning behind it is the more interesting part.

Round four: the deployment that could not be fixed

Passing the zero address as admin deployed a token whose every authority was permanently unreachable — including the one that could have granted them to somebody else. It deployed cleanly. It looked fine. It was scrap.

The guard for that has to live in the deploy script rather than in the token, and the reason is a good illustration of how these things hide. The script initialises the token with the broadcaster so it can configure the token before handing the roles over, so the token's own zero-admin check never sees the addresses that end up holding the roles — and granting a role to the zero address is accepted without complaint. The check belongs where the addresses are, and CI now runs the deployment cases that must be rejected as well as the ones that must work.

What is standing and reproducible

238 tests

All passing, covering 98.84% of lines and 95.05% of branches in the source tree. What is left uncovered is unreachable from any public entry point, and the reason is written down for each piece rather than waved at.

Four invariants

At 131,072 calls each, zero reverts. Balances sum to total supply under arbitrary call sequences, and declarations never move.

Twenty thousand runs

Fuzzing on the fee arithmetic and on checked transfers, where either the floor holds or nothing moves.

Thirty-two subsets

Every combination of the five modules deployed: the twenty permitted ones must transfer as declared, the twelve forbidden ones must fail inside their own constructor.

A lint gate

Not a lint report. High and medium findings fail the build.

What review cannot reach

The review above is internal, and internal review has a ceiling that more of it does not raise. Every round here was somebody asking the code a question they already knew how to ask. The interesting failures are the ones nobody thought to ask about, and those surface when a real protocol wires a real token into a real pool.

A round that finds nothing has usually been aimed at the wrong thing — and the sharpest aim comes from outside.

Which is why the framework is offered for integration rather than presented as finished, and why the review record above is written out in full rather than compressed into a badge. Read it as a well-tested reference implementation whose next findings will come from use.