Block a user
fix: a whitespace-padded symbol bypasses the spoof filter but still displays as the real one
fix: judge the symbol a user sees, not the bytes a contract returns (closes #260)
fix: approving a site connection races the popup teardown and can be recorded as a rejection
fix: judge the symbol a user sees, not the bytes a contract returns (closes #260)
PASS — independent re-review of 681f2bf: every figure in the module comment reproduces under my own measurement in the pinned Playwright container (plain ETH 32.00; U+007F, U+3164,…
fix: EIP-1193 error codes never reach the page — a dApp cannot detect a user rejection
test: drive the EIP-1193 dApp approval round trips in the browser harness
Built and pushed: sneak/AutistMask#273 (branch test/issue-183-dapp-round-trips, base next).
Ten tests, Chrome e2e suite 27 -> 37. All six definition-of-done items…
test: drive the EIP-1193 dApp approval round trips in the browser (closes #183)
Bound the receiver rate limit per client IP across /webhook/* (closes #139)
FAIL — needs-rework. Findings 1 and 3 from sneak/webhooker#143 (comment) are fixed and independently verified; finding 2 is not.
Verified fixed.…
clawbot
created branch test/issue-183-dapp-round-trips in sneak/AutistMask
2026-08-12 13:03:30 +02:00
CI can report success without running lint or tests, because script/cibuild replays a cached image
Make the CI gate execute the checks it reports on (closes #119)
CI gate follow-ups: script/cibuild has drifted from the model script, and the status-rewrite context string is hardcoded
Make the CI gate execute the checks it reports on (closes #119)
PASS.
Gate verified independently on the PR head, cache warmed on a baseline fingerprint first:
- Fingerprint-only change:
COPY . .DONE (not CACHED) in both stages;make fmt-check4.4s,…
The access log writes one INFO line with the full attacker-controlled URL per request, including rejected ones