{"assessments":[],"deployments":[],"fuzz":[],"identity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"interpretation":"Records acceptance and evidence. Neither completion nor an AI assessment establishes correctness, safety, or independent review.","jobId":"52c9f526-f659-4577-b817-3af7013460ec","kind":"skill:site-content-check","nodes":[{"acceptedSubmissionHash":"4ed495a6fbf785221a20bd1092b022f73c5ec56a6322ea6b231d8e4550b16911","dependsOn":[],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"8189a3059fc9bb774ad7dcee66b87f32e25d781025f0e9f82a4c75182fe0ef19","skillId":"site-content-check","tools":[]},"key":"site_content_check","kind":"code","role":"review","skillHash":"8189a3059fc9bb774ad7dcee66b87f32e25d781025f0e9f82a4c75182fe0ef19","skillId":"site-content-check","state":"accepted"}],"objective":"Host this repository's committed static site from dist/ exactly as built (no rebuild): Identity Machine, a game on Robinhood Chain. dist/deploy.robinhood.json holds the live contract addresses, verified on chain against swarm launch 2025.","parentJobId":null,"planHash":"952de1624ca3378426a8b65c4da47a6e6a93c007547760b7b4c189aa4a505b15","previousHash":"a37c0b3ec39bd26525e94d5dec6bc3acee0a478f72becf9ef5005253da092cfb","projectId":"52c9f526-f659-4577-b817-3af7013460ec","publication":{"commit":null,"deliveredAt":null,"repoUrl":"https://github.com/identity-md-launches/launch-2072-host-repository-s-committed-static"},"receiptIdentity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"registry":"0xb6d0a187b050fa5bb0b87033a203f37becf4a775","research":[],"schema":"identitymd-work-v1","signals":[],"site":{"cid":"bafybeicldeg73l5lcl7nykcgxxpvzeewrfmfjomzh25xw4lnzkttna37ey","ensName":"identitymachine.site.identitymd.eth","namingTransaction":"0x97553d430e7885c93009cc0a761d650ddbcc91f29525d98d78e436c9529bac1b"},"snapshotHash":"10d0d5ab6d946ac56f0d3aaeaed6650910f328f82b902652b19a7aaf7e28f1f6","state":"completed","submissions":[{"artifacts":[],"attempt":1,"bundleHash":null,"device":"8e25456c4ae69acf","findings":[{"citation":"resolved","description":"When you pay with IMD, mint() in app/src/main.ts:514 calls S.allow(S.D.machine, max). If the allowance you already have is too small, allow() sends approve(machine, 2^256-1) on the IMD token. The toast just says 'Approve IMD'. The spender is the IdentityMachine address from dist/deploy.robinhood.json (0xAbAC8872a7cE4A9aC4798e98cDCAe2d3E7885230). I checked on chain that this is the game contract: its imd() and inventory() match the manifest, and views.machine() and ethMinter.machine() both point to it. So this is not a drainer, and the page and llms.txt both tell you to approve IMD to the machine. The only problem is that the approval is unlimited and the UI doesn't say so. Advisory only: it doesn't stop hosting. The committed dist/assets/shell-CIgSAMct.js contains the same call (approve with Fo=maxUint256).","line":547,"path":"app/src/store.ts","reproduction":"Open dist/index.html with a wallet holding IMD and no prior allowance, open Packs, keep 'Pay with IMD', press Buy. The wallet shows approve(0xAbAC8872a7cE4A9aC4798e98cDCAe2d3E7885230, 115792089237316195423570985008687907853269984665640564039457584007913129639935) on IMD 0x5F7Bb593…7127. You'd expect an approval for about the quoted total (cost*1.02); you actually get an unlimited one.","severity":"low","snippet":" const ok = await this.send(\"approve\", [spender, maxUint256], { label: `Approve ${name}`, done: `${name} approved`, doneMs: 1500, address: token, abi: erc20Abi });","title":"Checkout asks for an unlimited (maxUint256) IMD approval to the game contract, shown only as 'Approve IMD'"},{"citation":"resolved","description":"index.html, archive.html, docs.html and parts.html all link a stylesheet from https://fonts.googleapis.com (line 10 of each). That stylesheet then pulls font files from fonts.gstatic.com. So every visit to the IPFS/ENS-hosted site sends the visitor's IP and referrer to Google, and the site depends on a third party for its typography. Nothing on the site mentions it. It's only a stylesheet, not a script, so it can't run code. Advisory (third-party request without disclosure); it doesn't stop hosting.","line":10,"path":"dist/index.html","reproduction":"Open dist/index.html with the browser devtools Network tab open: there is a request to https://fonts.googleapis.com/css2?family=IBM+Plex+Mono... and then to fonts.gstatic.com. Expected: a self-contained site served only from the pinned content. Actual: a third-party request on every page load.","severity":"low","snippet":" ","title":"Every page loads Google Fonts from fonts.googleapis.com without telling the visitor"},{"citation":"resolved","description":"The guide for AI agents served at /llms.txt names https://identitymachine.fun as the canonical site. The export is being pinned and named under a different ENS name, so agents that read this file are sent to an outside domain that this hosting doesn't control. The domain isn't linked anywhere else in the pages or scripts. Informational only.","line":6,"path":"dist/llms.txt","reproduction":"Open /llms.txt on the hosted site. Line 6 reads 'Site: https://identitymachine.fun'. You'd expect the hosted name or a relative link; it names an outside domain instead.","severity":"info","snippet":"beacon). EXPERIMENTAL. Site: https://identitymachine.fun, human docs: ./docs.html","title":"llms.txt gives https://identitymachine.fun as the site, not the name it will be hosted under"}],"hash":"4ed495a6fbf785221a20bd1092b022f73c5ec56a6322ea6b231d8e4550b16911","nodeId":"3fbe8bb9-b007-45d5-88bf-2d77cda74997","outcome":"completed","summary":"The site is safe to host: I found nothing critical or high in `dist/`. There are three advisory findings, written to `.imd-findings.json`, and no repository files were changed.\n\n**What I checked**\n- **The export matches the source.** I built `app/` in a temp copy outside the repo, with the locked dependencies, and the output was byte-identical to the committed `dist/`. So reading `app/src` is an accurate reading of every served script.\n- **Every page and asset.** I read `index.html`, `archive.html`, `docs.html` and `parts.html`, the SVGs, `llms.txt` and `deploy.robinhood.json`. I searched every JS chunk for outside URLs, `eval`/`Function`/`atob`, iframes, redirects, and signature or permit requests. The 121 KB `dist-*.js` chunk is MetaMask's JSON-RPC utility library. The 4byte, ipfs.io and arweave URLs are part of the bundled viem library.\n- **Outside requests.** The only ones are the Robinhood Chain RPC, the drand randomness service (`api.drand.sh`), Blockscout links and Google Fonts. No script loads code from outside the site.\n- **No credential prompts.** Nothing asks for a seed phrase, private key or password. The only mnemonic is Anvil's public test phrase, and the code refuses to use it in the production build.\n- **The wallet calls are honest.** The only approval goes to the game contract, and checkout is a mint call.\n- **The addresses are right.** All six addresses in `deploy.robinhood.json` have code on chain. Their links to each other match the manifest: `machine.imd()`, `machine.beacon()`, `machine.inventory()`, `views.machine()` and `ethMinter.machine()` all point where they should.\n- **No impersonation or deceptive claims.** The docs warn plainly that the game is experimental, can't be changed, and has no refunds, and they mention the trust in the chain's sequencer. Robinhood Chain is only named as the network it runs on, with no Robinhood logo or branding.\n\n**Findings**\n1. **Low: unlimited approval** (`app/src/store.ts:547`). Paying with IMD approves the maximum possible amount (`maxUint256`) to the game contract, and the screen only says \"Approve IMD\". The spender is the real contract.\n2. **Low: Google Fonts** (`dist/index.html:10`, and the same line in the other three pages). Every page load sends a request to Google that the site never mentions.\n3. **Info: outside domain in `llms.txt`** (`dist/llms.txt:6`). It names `https://identitymachine.fun` as the site, not the ENS name it will be hosted under.\n\nNone of these needed a Foundry proof, since none is critical or high and none is in Solidity.","treeHash":null,"usage":{"cachedInputTokens":828460,"inputTokens":38,"model":"claude-opus-5-5","outputTokens":8386,"runtime":"claude","turns":19,"wallClockMs":127773}}],"verification":[]}