3fa23364-90be-48d5-896c-31045d0c35bdIMD JOB

Done. The suite passes and three defects are reported with failing proofs. **What I added under `test/`** - `test/Invariants.t.sol`: a handler that drives all six contracts with five players and bounded inputs (found, join, leave, expel, buy troops, donate, treasury purchases, payouts, attacks, settlement, income collection, pacts, expiry, season close, claims, peace banners, time warps). It runs with fail-on-revert enabled, so every precondition is checked and every deliberately unmet precondition is asserted to revert. Thirteen invariants hold after every sequence: supply conservation, the game holds exactly what was paid in minus what was paid out, no player receives more than a vote or season awarded, each contract's balance equals its accounting (treasuries, active bonds, owed income, pools plus unclaimed prizes), troops are created only by purchase and destroyed only by settlement, tile and membership bookkeeping stay consistent, executed proposals had a majority, finished pacts never reopen, and settlement never runs ahead of the clock. A scratch probe confirmed the handler reaches deep states: 16 pacts with a betrayal, 18 closed seasons, 81 banners. - `test/EdgeCases.t.sol`: 47 tests. Eight fuzz properties cover strict majority for any guild size, proposal expiry at the exact second, member counts versus stints, battle resolution (unique largest wins, ties keep the holder, no troop creation, monotone survivors, unopposed attacker loses nothing), fee splits for any rate, per-tile income with dust carried, the pact window boundary, and season allocation with claims. The rest are failure paths the existing suite skipped: tile 143 versus 144, overflow purchases, expel on a member who already left, rejoined members voting, leavers staying in the denominator, standings with five guilds and a re-encountered pushed-out guild, out-of-order sign arguments, consumed proposals, one-epoch pacts, zero-pool seasons, expelled members claiming, and the full Banners ERC-721 failure surface. **Findings in `.imd-findings.json`** (three carry standalone proofs that fail on this code) - Medium: with lagging settlement an attack resolves against whoever holds the tile after earlier epochs settle, so a guild can take a pact partner's tile with no slash. `src/Realm.sol:209` - Medium: `Season.close` rolls unallocated prize money into the next season even if that season is already closed, stranding it forever. `src/Season.sol:112` - Medium: `declareAttack` has no caller check and approved proposals cannot be withdrawn, so a pact partner can trigger the other guild's stale attack and collect its bond. `src/Realm.sol:200` - Medium, no proof: the per-epoch resolution loop is unbounded. One address can freeze settlement permanently for about 1000 PACT plus gas. | Attacks on one tile | `settle()` gas | |---|---| | 100 | 3.13M | | 1000 | 30.5M | - Low: proposal targets are not validated per kind, so a Pact or TreasuryTroops proposal can be a disguised payout. Info: payouts to a game contract address are unrecoverable. Verification: `forge build` succeeds, `forge test` excluding scratch passes 146 tests, the invariant suite passes under three additional fixed seeds, and both new files pass `forge fmt --check`. Nothing outside `test/` and the findings file was touched.

Done. The Pacts game is implemented, tested and committed on `main` as commit `e51da88`, with 98 passing tests, a clean `forge build`, and `forge fmt --check` passing under the pinned solc 0.8.26. **What was built** - `src/LaunchToken.sol`: the Pact (PACT) token, fixed 10^27 supply minted to the deployer, no admin functions. - `src/Guilds.sol`: found, join, leave, expel, one-member-one-vote proposals with a strict majority of members who joined before the proposal, expiry at the end of the following epoch, pooled treasuries that release funds only to the majority-named target, and the shared epoch clock. - `src/Realm.sol`: 12x12 map, troop purchases with a fee to Season, open attack declarations that fail if the holder changed, in-order epoch settlement with proportional losses and largest-unique-force wins, per-tile income accrual, and top-three standings recorded at each season's final settlement. - `src/Diplomacy.sol`: pacts from two matching votes with non-zero bonds, blocked while an attack between the two is unsettled, automatic slashing to the victim on betrayal, bond return on expiry. - `src/Season.sol` and `src/Banners.sol`: 50/30/20 prize claims split equally among members fixed at season end, Winner banners on claim, Peace banners for guilds with no betrayal, and rollover of unfilled shares. **One design decision to flag for the manifest and review.** The five contracts depend on each other in both directions, and the launch allows constructor wiring only. Realm therefore creates Diplomacy and Season in its constructor, and Season creates Banners. Each nested contract trusts only its creator, so there is no initializer or binding window. The manifest lists two contracts: Guilds with `["$token", 3600]` and Realm with `["$token", "$contract:Guilds", 3600, 604800, "1000000000000000000", 500]`. The README explains this and how to read the nested addresses. **Verification** - The protected floor tests were exercised locally against the real init code with computed CREATE2 addresses and all 8 passed; Realm's init code is 26 KB. - Tests cover multi-attacker settlement, ties, votes and eligibility, expulsion, bond slashing and return, season close and claims, late joiners, and that unauthorized callers cannot move any funds, plus a balance-versus-accounting check through a full season. **Open items documented in the README:** troop price (1 PACT) and fee (5%) are my deployment choices, not fixed by the brief; voters must check a proposal's target address since it carries the same authority as a payout; tests are not an audit, and no Slither or Mythril run was part of this task.