{"assessments":[],"deployments":[],"fuzz":[],"identity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"interpretation":"Records acceptance and evidence. Neither completion nor an AI assessment establishes correctness, safety, or independent review.","jobId":"a184579a-d366-48e7-a116-cd6c80fee464","kind":"shape:chain","nodes":[{"acceptedSubmissionHash":"5bac961606258413088a3e2459dc23436b1f3c041272bb72a50452980486bd98","dependsOn":[],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"8189a3059fc9bb774ad7dcee66b87f32e25d781025f0e9f82a4c75182fe0ef19","skillId":"site-content-check","tools":[]},"key":"site_content_check","kind":"code","role":"review","skillHash":"8189a3059fc9bb774ad7dcee66b87f32e25d781025f0e9f82a4c75182fe0ef19","skillId":"site-content-check","state":"accepted"}],"objective":"Check the PLEA website in this repository. dist/ is its finished static export (Vite + React + viem, hash routes, relative paths); it reads PLEA's contracts on Ethereum from public RPCs and the judges' panels from api.imd.fun, and every transaction is sent by the visitor's own wallet. The source is in web/ and needs no build or change. Read the pages and scripts in dist/ for anything that could mislead or harm a visitor: wallet requests, approvals, links, scripts or requests to other sites, and how money, fees and risks are described.","parentJobId":null,"planHash":"a3a23c13ab138e64b32aaf93b5e33ba348b8ea17c558f8f1ff707ec07caeb179","previousHash":"0000000000000000000000000000000000000000000000000000000000000000","projectId":"a184579a-d366-48e7-a116-cd6c80fee464","publication":{"commit":null,"deliveredAt":null,"repoUrl":null},"receiptIdentity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"registry":"0xb6d0a187b050fa5bb0b87033a203f37becf4a775","research":[],"schema":"identitymd-work-v1","signals":[{"agentId":"52601","feedbackHash":"303b4fb4940e8aa56fc961bdde965e0d741330f7ce464475d638773ee5a6c2df","nodeKey":"site_content_check","submissionHash":"5bac961606258413088a3e2459dc23436b1f3c041272bb72a50452980486bd98","tag1":"review:submission","tag2":"acceptance-v2","value":1}],"site":null,"snapshotHash":"115b587764cbd9e02030598427a3d2259fc3e684a364bc1734be2d9b7ca4d4a6","state":"completed","submissions":[{"artifacts":[],"attempt":1,"bundleHash":null,"device":"cc86b49d3c401897","findings":[{"citation":"resolved","description":"dist/index.html points og:image (line 16) and twitter:image (line 21) at ./og.png, and og:url at https://plea.imd.site/. The image dist/og.png (identical to web/public/og.png) is the card from the Sepolia test run: its bottom-right corner reads 'plea-test-run-9.sites.imd.fun/' (the siteUrl of web/networks/sepolia-run9/site.json), and its headline says 'The Cabal is in session' while the Ethereum deployment has not opened trading (PleaHook.seeded is false per web/src/docs/numbers.json). So every link to the Ethereum site shared on X, Telegram, Discord etc. renders a card that names a different, testnet site. It is not deceptive in the sense of the critical/high classes (the test site is the same project and currently answers 200), but it sends visitors toward a Sepolia site when they expected the Ethereum one and contradicts the card's own og:url. Advisory: regenerate og.png for the Ethereum build (web/scripts/network.mjs already derives ogImage from site.siteUrl, only the bitmap is stale).","line":16,"path":"dist/index.html","reproduction":"Open dist/og.png (or dist/index.html and follow the og:image meta on line 16). Expected: a card for https://plea.imd.site/. Actual: the card's URL line reads 'plea-test-run-9.sites.imd.fun/'. Also: `cmp web/public/og.png dist/og.png` prints nothing (same bytes), and `grep siteUrl web/networks/sepolia-run9/site.json` gives https://plea-test-run-9.sites.imd.fun/.","severity":"low","snippet":"    <meta property=\"og:image\" content=\"https://plea.imd.site/og.png\" />","title":"Social preview image (og.png) shows the Sepolia test-run URL, not the Ethereum site's"},{"citation":"resolved","description":"dist/imd-deployment.json names claimsPath 'claims.json' and the main bundle (dist/assets/index-Dj7Bj4FL.js, the Profile claim panel: fetch(\"./\"+Ae().claimsPath)) requests it once PleaDistributor.merkleRoot is set. The file is not in dist/ (and not in the manifest's assets list), so on IPFS the request 404s. The code handles it: the panel shows 'The published claims.json file is not available yet. Load the published list below.' and offers a manual load. Nothing misleading or harmful; noted so the author knows the airdrop panel cannot work from the export alone until claims.json is added in a later version (which would also change the manifest).","line":184,"path":"dist/imd-deployment.json","reproduction":"ls dist/claims.json -> No such file. Open #/profile with a connected wallet once the distributor's Merkle root is non-zero: the claims panel shows the 'not available yet' message instead of the visitor's claim.","severity":"info","snippet":"    \"claimsPath\": \"claims.json\",","title":"Profile page fetches ./claims.json, which is not in the export"}],"hash":"5bac961606258413088a3e2459dc23436b1f3c041272bb72a50452980486bd98","nodeId":"17166695-bca3-48e3-ad37-77e5333a9f8f","outcome":"completed","summary":"The review is complete and `.imd-findings.json` holds the result: nothing critical or high, one low and one info.\n\n**What was read.** Every hosted file in `dist/`: the HTML shell, the three Vite bundles, the CCIP chunk, the text-check and icon scripts, the stylesheet, the deployment manifest, all eight ABIs, the fonts, the wallet logos, the favicon and the social image. The wallet, trade, router, connector and approval code in `web/src/` was read alongside the minified bundle to confirm the bundle does what the source says. All 28 manifest hashes match the files on disk.\n\n**What the scripts do, verified.**\n- Only the injected EIP-6963 connector is offered. There is no WalletConnect relay, no analytics, no beacon, no WebSocket, no eval or dynamic script injection, no iframe, no password or seed-phrase input anywhere.\n- Every approval is for the exact amount entered. The ERC-20 approve to Permit2 and the Permit2 allowance to Uniswap's Universal Router both use the typed amount, and the Permit2 allowance expires after 30 minutes from the chain clock. The plea fee approval to CabalGate is for exactly the oracle fee. The UI text under each button says the same.\n- The only signature paths in the bundle are unused viem library code. The app never calls signMessage or signTypedData.\n- Network requests go to the four public RPCs and contracts listed in the manifest, the project's own indexer, the oracle request endpoint on api.imd.fun, and same-origin files. Outbound links are Etherscan, GitHub, Sourcify, the audit hosts, delegate.xyz, imdacc.fun, the X share intent, and mobile wallet deep links carrying the current page URL.\n- Money and risk wording is accurate. The fee, cap, cooldown, pass mark, oracle fee and stake values printed in the docs were read from the live Ethereum contracts via public RPC and all match. The Risks page states non-sellability, fee loss on denial, owner powers and the honeypot-scanner warning plainly. The footer and docs say the site is not an official IMD page and not financial advice.\n\n**Findings written.**\n- **Low, dist/index.html line 16.** The social preview image is the Sepolia test-run card: its URL line reads the test site's address and its headline says the Cabal is in session, while og:url points at the Ethereum site and trading has not opened. Shared links will show a card naming a different, testnet site. Regenerating og.png for the Ethereum build fixes it.\n- **Info, dist/imd-deployment.json line 184.** The Profile page fetches claims.json, which is not in the export. The code handles the 404 with a clear message and a manual load option, so the airdrop panel simply cannot work from the export alone until the file ships.\n\nNo file other than `.imd-findings.json` was changed.","treeHash":null,"usage":{"cachedInputTokens":914067,"inputTokens":354,"model":"claude-fable-5-1","outputTokens":15253,"runtime":"claude","turns":32,"wallClockMs":246586}}],"verification":[]}