Immunefi Audit CompetitionsENS | Audit Competition
Reports by Severity
Critical
- 89535 - [W&A - Critical] manager profile page renders an attacker chosen eth address next to a name s genuine owner
- 89548 - [W&A - Critical] registration and renewal use un normalized labels the name the manager shows is not the name it writes on chain
- 89563 - [W&A - Critical] ens explorer resolver remove user save silently leaves the root all names grant intact so a removed manager keeps write access to every name
- 89585 - [W&A - Critical] critical name transfer resolves its recipient to the v1 registry controller not the erc 721 holder the explorer also labels that controller as owner
- 89593 - [W&A - Critical] incorrect scope inference in the resolver roles editor leaves a removed user s resolver wide grant live up to role upgrade
- 89253 - [W&A - Critical] wrong resource revocation in resolver roles lets a removed account retain role set addr and redirect another ens name
- 89601 - [W&A - Critical] missing ensip 15 normalisation in the manager registration path causes users to pay for and receive a different permanently unresolvable name than the one the app showed as av
- 89611 - [W&A - Critical] resolver remove user revokes only one name and leaves global address upgrade authority active
- 89614 - [W&A - Critical] cross resource role aggregation makes remove user revoke only one name and leaves delegated resolver control
- 89630 - [W&A - Critical] renewal payment is redirected to an attacker s look alike name
- 89641 - [W&A - Critical] explorer invents a recipient address and sends the user s ens name to it
- 89728 - [W&A - Critical] Explorer app fabricates a 'Resolved:' for recordless ENS names - silently substitutes the name's owner, sending name transfers and registry-wide role grants to an attacker's ad...
- 89744 - [W&A - Critical] v1→v2 migration unconditionally grants ROLE_SET_RESOLVER on the v2 ETHRegistry to the name's stale v1 registry controller — an attacker-settable address the Manager never displ...
- 89761 - [W&A - Critical] Removing a resolver user revokes only one displayed ENS name, allowing redirected incoming payments
- 89864 - [W&A - Critical] ens explorer silently resolves a name with no addr 60 record to its token owner owner fallback and consumes it on irreversible authority granting action paths misdirectin
- 89888 - [W&A - Critical] missing ensip 15 normalization in manager registration lets an attacker own the canonical name while a victim buys a hidden lookalike
- 89917 - [W&A - Critical] the app acts on a different ens name than the one it displays and just verified you own an unsolicited airdrop turns get rid of this junk into irreversible loss of a valuab
- 89930 - [W&A - Critical] manager profile displays a trusted name s owner but an attacker controlled receiving address owner node vs records node normalization split
- 89952 - [W&A - Critical] an omitted non root role mapping makes edit user roles encode a root scoped grant
- 89960 - [W&A - Critical] raw name ownership check can transfer a different normalized ensv2 token
- 89990 - [W&A - Critical] Resolver roles page revokes a single name while claiming removal of all roles — removed users keep live record-write authority on other names and ROOT
- 90071 - [W&A - Critical] lossy resolver role grouping makes remove user from all roles leave global role set addr active
- 90094 - [W&A - Critical] renewing a name from the portal confirm screen builds the transaction for a different on chain name than the one it displays the payment renews normalize name not the nam
- 90161 - [W&A - Critical] explorer authorizes a transfer against the name in the url but moves the token of the normalized name so disposing of an unsolicited look alike transfers the victim s real name
- 90163 - [W&A - Critical] manager renewal route proves renewability from the normalized name but renews the raw label so a user pays to extend an attacker s registration
- 90165 - [W&A - Critical] Resolver role removal merges name-scoped permissions and leaves a delegate authorized
- 90190 - [W&A - Critical] manager bulk renewal displays the raw label but renews the normalized one so a user s rent payment extends a name they do not own
- 90206 - [W&A - Critical] The transfer flow authorises against one ENS name and signs the transfer of a different one
- 90245 - [W&A - Critical] explorer remove user confirms removal from all roles but only revokes the name scope root roles keep resolver wide addr write
- 90255 - [W&A - Critical] apps portal resolver roles ui remove user revokes only the name scope while confirming removal from all roles the root grant stays active
- 89264 - [W&A - Critical] persistent root resolver authorization survives ens name transfer allowing former owners to rewrite sold name records and unrelated resolver resources
- 89270 - [W&A - Critical] manager profile page resolves records from the raw url name but owner expiry from the normalized name letting an attacker display their own address under a victim name s identity
- 90951 - [W&A - Critical] portal remove user from all roles submits incomplete revocation calldata and leaves the delegate authorized
- 89278 - [W&A - Critical] portal displays raw alice eth but transfers the distinct canonical alice eth nft
- 89279 - [W&A - Critical] previous owner permanently controls what a transferred ens name resolves to
- 90320 - [W&A - Critical] Removed resolver user can still redirect ENS names
- 90337 - [W&A - Critical] explorer removes only one grouped role scope allowing removed users to redirect ens transfers
- 90363 - [W&A - Critical] Editing a Fine-Grained Resolver Role Silently Grants Root-Wide Authority
- 89293 - [W&A - Critical] explorer resolver remove user confirms a full revocation and signs a single resource one leaving the target holding root role set addr
- 89314 - [W&A - Critical] manager v1 to v2 migration silently keeps an attacker s resolver and grants the attacker role set resolver on the v2 registry for gifted secondary market names
- 90379 - [W&A - Critical] deleting one resolver role row rebinds its permission draft to the next account and grants that account an unselected address role
- 89336 - [W&A - Critical] v1 to v2 migration grants stale owners resolver control
- 91004 - [W&A - Critical] the explorer transfer flow checks ownership of the name in the url and moves its normalized sibling
- 91014 - [W&A - Critical] scoped hca sessions are downgraded to owner mode bypassing refund authorization and transferring hca tokens
- 91044 - [W&A - Critical] explorer authorises a raw ens name but transfers the normalised name so a user disposing of a decoy burns their genuine name
- 90459 - [W&A - Critical] incomplete resolver role revocation leaves attacker control over another ens name and enables direct fund theft
- 89360 - [W&A - Critical] the name profile route resolves one url parameter as two ens names rendering an attacker s receiving address under the victim s genuine owner and expiry
- 90498 - [W&A - Critical] resolver role table merges different names into one row but signs calldata for only one name
- 91062 - [W&A - Critical] scope collapse in the resolver roles editor causes role writes to target the resolver root resource granting authority over every name it serves and making remove user repor
- 91063 - [W&A - Critical] owner fallback in portal s ens name resolution pre fills an unpublished address sending role grants and name transfers to an unintended recipient
- 90544 - [W&A - Critical] post confirmation unicode normalization substitutes an attacker owned primary name causing manager to render an attacker controlled optimism recipient
- 89363 - [W&A - Critical] ENS v1→v2 migration grants resolver authority over the migrated name to an unverified, never-displayed third party
- 91080 - [W&A - Critical] a visually identical link makes a name holder pay to extend somebody else s registration manager decides ownership expiry and the third party renewal warning on the ens norma
- 91095 - [W&A - Critical] portal remove user from all roles sends a one name revoke and leaves root resolver authority usable
- 91097 - [W&A - Critical] explorer s remove user from all roles signs a one resource revoke leaving a former delegate able to redirect another ens name
- 90622 - [W&A - Critical] lossy resolver role aggregation causes remove user from all roles to retain global permissions enabling ens record hijacking
- 91098 - [W&A - Critical] renew page shows the correct name but signs a different one invisible unicode causes wrong recipient renewal
- 91121 - [W&A - Critical] manager profile page resolves one route name against two different ens nodes rendering an attacker controlled receiving address beside the victim s genuine ownership data
- 89387 - [W&A - Critical] remove user from all roles leaves root resolver authority active enabling ens address redirection
- 91150 - [W&A - Critical] explorer replaces the displayed ensv2 asset s erc 1155 tokenid before the connected wallet transfer
- 89395 - [W&A - Critical] unsafe owner fallback in the shared address resolver leads to irreversible transfer of ens names to an unintended address
- 90637 - [W&A - Critical] removing a resolver user leaves every root scoped role in place
- 91181 - [W&A - Critical] normalization desync in the manager renewal route validates one name and renews another letting a link make a victim pay to extend an attacker s name
- 89398 - [W&A - Critical] missing address record validation in resolveaddressorname causes irreversible ens name transfers to the wrong recipient
- 90638 - [W&A - Critical] renew gate reads one name renew calldata spends on another
- 89408 - [W&A - Critical] The Manager profile page asks the attacker's resolver for the victim's node, and renders the answer under the victim's real ownership and expiry
- 90639 - [W&A - Critical] transfer authorises the raw label moves the normalized label s token
- 89418 - [W&A - Critical] broken access control in the resolver remove user flow leaves a revoked delegate able to redirect the address records of every name on the resolver
- 90647 - [W&A - Critical] v1 v2 migration silently grants a third party address permanent in practice role set resolver over the user s migrated name with the grantee never displayed and no way to re
- 89420 - [W&A - Critical] resolver roles sidebar collapses an account s multiple role resources into one write scope so remove user displays one scope and writes another leaving removed accounts wit
- 89431 - [W&A - Critical] stale transaction success falsely completes later role revocations leaving resolver authority active
- 91224 - [W&A - Critical] explorer renew transfer encode the on chain write from a normalizing helper while the ownership gate and displayed transaction use the raw name a victim renews or transfers a
- 89433 - [W&A - Critical] transfer flow never resets the transaction manager so a stale step actor from an abandoned attempt is matched by id to the next attempt and the steps before it are skipped whi
- 90678 - [W&A - Critical] explorer remove user revokes one resolver scope leaving removed accounts with sibling name roles and global upgrade authority
- 90688 - [W&A - Critical] incomplete role revocation resolver remove user leaves a co manager s global root role in place so a removed user can still set any name s address record and redirect funds
- 91295 - [W&A - Critical] iost only resolver delegate can make manager show and copy its value as the sol receiving address
- 90691 - [W&A - Critical] portal authorizes a raw ensv2 name but transfers the victim s canonical twin nft
- 91299 - [W&A - Critical] unmapped resolver role becomes global and lets a delegate redirect other ens names
- 89456 - [W&A - Critical] renewal route prices and displays the normalized name but signs the raw label so a crafted url renews an attacker s lookalike name with the victim s funds
- 90693 - [W&A - Critical] the manager profile page reads records from the raw url name and ownership from its ensip 15 name so an attacker controlled address record is rendered under a real name s owner
- 89460 - [W&A - Critical] every ens registration overwrites the previous one s transaction history
- 91306 - [W&A - Critical] explorer s resolver roles editor builds every transaction against a scope it never displays silently granting an account authority over every name a resolver serves
- 90702 - [W&A - Critical] v1 v2 migration silently grants a stale v1 controller role set resolver on the migrated name enabling resolution hijack of an acquired name
- 91318 - [W&A - Critical] portal s remove all roles action revokes only one name leaving a delegate s global resolver authority active
- 90725 - [W&A - Critical] encoded labelhash confusion in portal deletion unregisters a different victim owned subname and enables registrar takeover
- 91333 - [W&A - Critical] portal s remove user from all roles submits a one resource revocation and leaves the removed delegate s root resolver authority active
- 90770 - [W&A - Critical] remove user from all roles revokes one resolver scope and leaves address control authority active
- 91335 - [W&A - Critical] portal applies the registry role schema to a permissionedresolver one ordinary registrar add user grant becomes global set address authority
- 90784 - [W&A - Critical] Critical: Portal account-only role grouping collapses resolver scopes, leaving an offboarded collaborator able to redirect ENS resolution
- 91337 - [W&A - Critical] v1 to v2 migration silently grants the v1 registry controller resolver authority over the buyer s name
- 89467 - [W&A - Critical] inconsistent name normalization between the renewal checks and the renewal transaction leads to the user signing a renewal for an attacker controlled name
- 90794 - [W&A - Critical] explorer confirms an uppercase ensv2 transfer but signs the distinct lowercase token id causing direct nft theft
- 91345 - [W&A - Critical] resolveaddressorname treats an unresolved v1 manager as a transfer recipient sending a v2 name nft to an unintended address
- 89474 - [W&A - Critical] explorer transfer flow moves a different ens name than the one displayed stealing the victim s name
- 90820 - [W&A - Critical] the manager checks name ownership with one canonicalization function and builds the renewal transaction with another so one invisible character in a url makes a user pay to re
- 91348 - [W&A - Critical] Public Safe ERC-1271 transcript can be redeemed first to steal an ENS seven-day JWT
- 89483 - [W&A - Critical] empty resolvednames falls back to root scope so editing one role row signs grantrootroles over every name on the resolver
- 90843 - [W&A - Critical] portal turns an unresolved name scoped resolver role into root granting resolver wide control over unrelated names
- 91396 - [W&A - Critical] an iost only delegate can replace manager s copied solana recipient without modifying the sol record
- 89507 - [W&A - Critical] remove user on the resolver roles panel revokes only one resource scope leaving listed authority in place
- 90852 - [W&A - Critical] the explorer s irreversible name transfer resolves a recipient name with no address record to its registry controller silently delivering the name to the previous owner while
- 90874 - [W&A - Critical] portal authorizes a literal bracket label decoy but changes the resolver of the embedded hash ens name
- 89516 - [W&A - Critical] v1 v2 migration assigns the migrated name s resolver to a third party and grants them the role that keeps it
- 90883 - [W&A - Critical] the manager renewal flow reads one name and pays for another so a name s owner funds an attacker s registration while their own name is untouched
- 90894 - [W&A - Critical] apps portal resolver roles ui remove user revokes only the name scope while confirming removal from all roles the root grant stays active
- 91449 - [W&A - Critical] broken access control multi resource role aggregation in resolver roles management causes incomplete revocation and persistent root level access
- 90896 - [W&A - Critical] apps portal remove user confirms removal from all roles the approved transaction revokes one name scope
- 90904 - [W&A - Critical] mis scoped resolver role removal leaves a removed account able to repoint any name the resolver serves
- 91485 - [W&A - Critical] missing ens normalization in the manager renewal flow leads to a victim extending the attacker s name with their own funds
- 90907 - [W&A - Critical] the migration flow silently grants a third party permanent role set resolver over the user s name and destroys the only revocation path in the same transaction
- 90931 - [W&A - Critical] resolver row index reuse carries a removed user s root upgrade permission into another collaborator and enables shared resolver takeover
- 91524 - [W&A - Critical] base58 case folding substitutes the solana copy target
- 91566 - [W&A - Critical] explorer remove user from all roles revokes one name resource and leaves root address authority live
- 91569 - [W&A - Critical] inconsistent ens name normalization displays and copies an attacker controlled address as the victim profile s main receiving address
- 91580 - [W&A - Critical] resolver roles editor writes a scope the admin was never shown defaulting to root
- 91602 - [W&A - Critical] incorrect privilege assignment in the v1 to v2 migration leads to resolver hijack and loss of funds
- 91635 - [W&A - Critical] incorrect resolution on the manager profile page displays an attacker controlled receiving address under a legitimate ens name s owner identity
- 91637 - [W&A - Critical] manager profile page renders an attacker controlled receiving address under a genuine name s verified owner identity
- 91640 - [W&A - Critical] bulk renewal signs a different label than the name displayed so the fee renews an unintended name displayed vs signed mismatch
- 91641 - [W&A - Critical] explorer resolver role editor writes grants and revokes to a wrongly derived eac resource so revoking a delegate s permissions silently leaves them in place
- 91645 - [W&A - Critical] wrong field ens ownership resolution in the explorer s recipient input sends name transfers to a v1 name s former controller instead of its owner
- 91681 - [W&A - Critical] manager displays the victim s nfc expiry but renews an attacker owned raw nfd ens token
- 91688 - [W&A - Critical] Manager authorizes a canonical-name victim to write to an attacker-owned raw-name resolver
- 91698 - [W&A - Critical] crafted renew url renews an attacker s look alike name while the page displays the victim s own name and on chain expiry
- 91717 - [W&A - Critical] explorer transfer flow moves a different ens name than the ui and wallet prompt display because on chain identity is derived from the normalized label
- 91722 - [W&A - Critical] choosing a primary name claims the ensip 15 normalized twin of the displayed row handing the victim s on chain identity to whoever owns that twin
- 91724 - [W&A - Critical] extending a name from the address page renews the ensip 15 normalized twin while every screen shows the raw indexer name so the fee extends someone else s registration
- 91731 - [W&A - Critical] renewal screen displays an expiry date computed from a different ens name than the one the transaction renews
- 91757 - [W&A - Critical] resolver role aggregation mis scopes removal and preserves global authority
- 91768 - [W&A - Critical] remove user from all roles preserves global resolver authority
- 91830 - [W&A - Critical] explorer renews a different ens name than it displays the victim pays to extend an attacker s name while their own expires
- 91982 - [W&A - Critical] manager keep v1 migration of a locked custom resolver name freezes record control
- 91838 - [W&A - Critical] migration grants a stale v1 controller a permanent role set resolver on the migrated v2 name letting a third party repoint what the victim s name resolves to
- 92028 - [W&A - Critical] manager renew signs a transaction for a look alike name while the ui shows the victim s real name
- 91848 - [W&A - Critical] Editing a record-scoped resolver delegate silently submits grantRootRoles — authority over every name on the resolver
- 92042 - [W&A - Critical] ensv2 migration grants role set resolver on migrated names to a subgraph sourced manager address it never verifies on chain or shows the user resolver hijack
- 92043 - [W&A - Critical] explorer renewal sends renew the ensip 15 normalized label while every rendered string is the raw on chain label the user pays full rent their own name gains zero seconds
- 91855 - [W&A - Critical] Portal treats an unresolved resolver-role scope as ROOT, enabling cross-name resolution hijacking
- 92064 - [W&A - Critical] incorrect eac resource scoping in the resolver role editor leads to an unintended global set addr grant
- 91869 - [W&A - Critical] normalization mismatch between the owner and records queries in the manager profile route displays an attacker s name and address under the victim s ownership causing stealthy
- 92094 - [W&A - Critical] [Critical] Explorer role removal preserves global ROLE_SET_ADDR, enabling post-offboarding ENS address diversion
- 91900 - [W&A - Critical] explorer resolves a recipient ens name that has no addr 60 record to the owner of its ens v2 registry entry so one ordinary paid v2 registration by a stranger redirects a nam
- 91909 - [W&A - Critical] grouped resolver role removal signs a single resource revoke leaving a removed delegate able to replace the ens address
- 92111 - [W&A - Critical] portal authorizes a fullwidth raw ensv2 name but transfers the victim s ascii canonical twin nft
- 92112 - [W&A - Critical] a direct registry url applies registry bit 0 to a resolver and grants address control
- 91967 - [W&A - Critical] ownership check on the wrong name in the explorer transfer flow leads to hijacking of a victim s ens name leaving it inaccessible after the flow
- 92121 - [W&A - Critical] manager renewal signs a different ens registration from the one the page describes the route parameter is ensip 15 normalized for the expiry it displays and only lower cased f
- 92128 - [W&A - Critical] inconsistent ens name normalization in the manager profile page renders a trusted name s owner beside an attacker controlled receiving address leading to theft of user funds
- 92155 - [W&A - Critical] renewal flow checks and displays one ens name but signs renew calldata for a different one so the user pays to extend a name they were never shown
- 92174 - [W&A - Critical] registration and migration grant resolver global not name scoped root roles that detach the resolver never revokes so a name s seller keeps redirecting the buyer s addr 6
- 92452 - [W&A - Critical] explorer collapses per name resolver roles by account so remove user leaves a delegate able to redirect another ens name to an attacker controlled address
- 92464 - [W&A - Critical] resolver role aggregation causes remove user from all roles to revoke only one resource leaving the delegate able to redirect ens addresses
- 92203 - [W&A - Critical] primary name dialog derives the displayed name and the written name from two different expressions so the confirmed operation writes a reverse record for a different ens node
- 92465 - [W&A - Critical] owner controller role confusion in the explorer s address resolution fallback resolveensowner leads to irreversible transfer of the user s ens name to an unintended recipient
- 92222 - [W&A - Critical] portal remove user leaves root text authority allowing a former delegate to overwrite another owner s profile
- 92474 - [W&A - Critical] improper resource binding in portal remove user leaves root resolver authority untouched
- 92475 - [W&A - Critical] a profile url carrying one invisible codepoint renders the victim s verified owner beside an address published by a name the attacker registered
- 92239 - [W&A - Critical] one ticked permission on a record scoped row makes the explorer s roles page sign grantrootroles authority over every name the resolver serves with no scope shown on any sc
- 92483 - [W&A - Critical] migrate to v2 hand your name s resolver to a third party the app never validated
- 92257 - [W&A - Critical] resolver role editor upgrades a name scoped grant to resolver root submitting a broader transaction than the operator selected
- 92278 - [W&A - Critical] Both renewal routes prove one ENS name is renewable and then bill the user to renew a different one
- 92510 - [W&A - Critical] portal authorizes an attacker gifted raw nfd name but transfers the victim s distinct nfc erc 1155 name token
- 92522 - [W&A - Critical] unconditional owner fallback in explorer name resolution leads to the app resolving a record less ens name to its owner an attacker controlled address pre filled into the nam
- 92527 - [W&A - Critical] The Explorer's resolver-roles editor writes a scope the administrator never chose: narrow grants are signed as resolver-wide (ROOT), and "remove from all roles" leaves ROOT sta...
- 92300 - [W&A - Critical] portal lists an attacker owned name under names you own in place of the user s own and transferring it transfers the user s real name instead
- 92535 - [W&A - Critical] portal row reuse can grant one resolver delegate another account s upgrade role
- 92602 - [W&A - Critical] explorer causes a connected wallet to grant a delegate resolver control over every name instead of one
- 92605 - [W&A - Critical] merged resolver role removal revokes one scope while leaving root record write authority
- 92545 - [W&A - Critical] removing a resolver user leaves root upgrade authority intact
- 92345 - [W&A - Critical] attacker can register a name s normalized twin to redirect the owner s bulk renew payment and let their name expire
- 92352 - [W&A - Critical] portal says it removed all roles but sends a one name revoke
- 92552 - [W&A - Critical] portal remove user from all roles revokes only one resolver scope the surviving scope permits a profile description write that remains after role cleanup
- 92353 - [W&A - Critical] raw unicode name causes portal to transfer the victim s different canonical ens token
- 92555 - [W&A - Critical] name transfer never revokes the seller s resolver roles letting the former owner rewrite the buyer s eth address record and redirect resolution to an attacker name hijack a
- 92616 - [W&A - Critical] explorer resolves a typed ens name to a previous owner and builds the wrong recipient transaction
- 92559 - [W&A - Critical] explorer reuses a former owner ens resolution and encodes the wrong recipient in an ensv2 nft transfer
- 92564 - [W&A - Critical] apps/portal: Remove user revokes only the root grant it promised to clear entirely
- 92622 - [W&A - Critical] an unmappable name scoped resolver role becomes a resolver wide root grant signed by the victim
- 92565 - [W&A - Critical] the explorer s extend flow renders the raw indexer name on every surface but signs the ensip 15 normalized label so a renewal reached from the address names table pays to exte
- 92568 - [W&A - Critical] profile editing authorizes the normalized name but encodes the raw route param so a crafted url makes the victim sign a record write to an attacker s node on an attacker s res
- 92411 - [W&A - Critical] incorrect labelhash resolution in portal leads to deletion of other unintended ens subnames and resolving hijacking of unintended
- 92570 - [W&A - Critical] set primary name writes its forward legs against the raw name and signs the reverse leg against the normalized name so one click points the victim s reverse record at a name t
- 92572 - [W&A - Critical] ensv2 registration applies no ensip 15 normalization at any step so a crafted url prices displays and registers a label the user cannot see and that ens does not consider par
- 92626 - [W&A - Critical] manager bulk renewal renders the raw indexer name on every row and signs the normalized label so the victim s stablecoins extend a registration that appears nowhere in the dialog
- 92416 - [W&A - Critical] mixed case transfer route sends the lowercase sibling ens nft
- 92632 - [W&A - Critical] a resolver role row whose scope the ui cannot resolve is saved as a root grant so one click on a single account s row signs grantrootroles over every name on the resolver
- 92429 - [W&A - Critical] the explorer s remove user filters the root scope out of the resource it revokes so an account the operator removed keeps write authority over the address record of every na
- 92581 - [W&A - Critical] the explorer names the ensv1 registry controller as a name s owner so a seller who has already handed over the nft is still shown as the owner on the official ens explorer
- 92584 - [W&A - Critical] explorer s resolver role table omits role set data so remove user throws for every account the registration flow provisions and otherwise leaves write access the roles table r
- 92651 - [W&A - Critical] explorer transfer resolves an ens recipient to the name s v1 controller rather than its owner sending the user s name to a party that does not own the name they addressed
- 92587 - [W&A - Critical] explorer s resolver permission editor keys its checkbox state to the table row index so re opening a row position grants the previous occupant s permissions to a different acc
- 92588 - [W&A - Critical] transfer ownership signs the token id of getlabel name while every screen shows the raw route param so the name that leaves the victim s wallet is not the name the flow displ
- 92658 - [W&A - Critical] manager migration grants a former v1 controller resolver authority over the buyer s v2 name
- 92591 - [W&A - Critical] manager reads the profile with ensip 15 and writes the renewal with tolowercase so a crafted link makes the victim s own profile suppress the third party renewal warning and
- 92593 - [W&A - Critical] explorer s extend flow charges the user to renew a stranger s ens name instead of the one shown
- 92782 - [W&A - Critical] registration and renewal write an on chain node that no compliant client resolves
- 92794 - [W&A - Critical] manager s bulk renew dialog substitutes a normalized lookalike for the victim s real registered label letting a victim s own connected wallet pay to renew an attacker s name
- 92699 - [W&A - Critical] a role scope the app cannot resolve is granted on every name instead
- 92806 - [W&A - Critical] resolver role removal silently leaves role set data authority on chain
- 92713 - [W&A - Critical] a phishing link renews the attacker s own junk registration with the victim s money while manager displays the victim s real name
- 92714 - [W&A - Critical] resolver remove user silently no ops root scoped roles enables persistent ens name resolution hijack
- 92817 - [W&A - Critical] missing label validation in the portal s change resolver flow leads to resolver hijack of a different real ens name
- 92716 - [W&A - Critical] index based row identity in portal s resolver roles table lets an admin s stale draft silently grant a global resolver role to an uninvolved account
- 92818 - [W&A - Critical] missing label validation in the portal s configure registry flow leads to subregistry detachment of a different real ens name
- 92820 - [W&A - Critical] explorer remove user save on a resolver operator revokes a single scope while the row aggregates root and name scopes so root level roles survive a remove this user fr
- 92738 - [W&A - Critical] resolver remove user from all roles revokes only one scope leaving global address hijack authority active
- 92740 - [W&A - Critical] missing ensip 15 normalization on the manager s name route splits one profile page across two ens nodes rendering an attacker controlled address beside the real owner and
- 92746 - [W&A - Critical] ens explorer s remove user from all roles leaves active address control permission on another name
- 92752 - [W&A - Critical] removing a resolver user revokes only one resource and leaves root or other name authority active
- 92840 - [W&A - Critical] explorer s renewal builder substitutes the name it signs the user pays to renew a different ens name than the one displayed
- 92753 - [W&A - Critical] incomplete revocation in the resolver user removal flow retains resolver root authority leading to theft of user funds via payment address redirection
- 92842 - [W&A - Critical] a name scoped role grant gives a limited registrar root resolver authority
- 92761 - [W&A - Critical] inconsistent ens normalization makes manager submit an attacker owned label in a victim approved renewal
- 92850 - [W&A - Critical] two conflicting ens name derivations on the manager s renewal page cause the victim to pay to extend an attacker s registration instead of the name shown on screen
- 92859 - [W&A - Critical] Unresolved name-scoped resolver role is converted into a root grant, enabling unauthorized record changes for unrelated names
- 92762 - [W&A - Critical] late ens normalization makes the portal detach and transfer a different name than the transfer page authorizes
- 92764 - [W&A - Critical] encoded label recipient names select an attacker owned literal label but query the honest hash only node redirecting portal name transfers
- 92771 - [W&A - Critical] portal treats a factory verified userregistry as a permissionedresolver so set pubkey grants registry wide unregister
- 92955 - [W&A - Critical] scope substitution in the resolver role editor converts an unresolvable name scoped role into a resolver root grant giving unintended global authority over every name on the r
- 92773 - [W&A - Critical] unresolved resolver scopes turn scoped set address edits into resolver wide grants
- 92775 - [W&A - Critical] manager renders a lookalike ens name with the victim s identity above the attacker s receiving address
- 92877 - [W&A - Critical] ens explorer s remove user action can leave global resolver permissions active
- 92963 - [W&A - Critical] cross name profile state makes a description only save set an attacker address on another ens name
- 92880 - [W&A - Critical] explorer transfers a user s ensv2 name to a separate address the seller selected before the sale
- 92967 - [W&A - Critical] the manager checks name ownership on one node and writes to another
- 92971 - [W&A - Critical] manager falsely confirms a canonical ens renewal while extending an attacker owned raw unicode name
- 92887 - [W&A - Critical] incomplete mixed resolver role removal leaves a former delegate able to change an ens address record
- 92978 - [W&A - Critical] portal transfer flow authorises ownership of one ens node and then executes irreversible writes against a different one
- 92890 - [W&A - Critical] high manager authorizes record edits via the resolver s stale internal roles instead of registry ownership a name s previous owner keeps full write access incl the coins
- 92892 - [W&A - Critical] remove user revokes only ui recognized role bits and can leave official authority active
- 92990 - [W&A - Critical] cross account receipt reuse skips resolver role revocation and makes portal render an attacker controlled ens address
- 92902 - [W&A - Critical] portal treats an empty eth record as a v1 controller resolution and transfers to the wrong recipient
- 92993 - [W&A - Critical] explorer send name checks the name in the url and signs away the owner s real name
- 92914 - [W&A - Critical] missing ensip 15 normalization check on the primary name render path lets an attacker s address be displayed as another party s name
- 92925 - [W&A - Critical] the manager profile page normalizes the name for the owner query but not for the records query resolving an ens name to an attacker controlled address
- 92944 - [W&A - Critical] recipient resolution returns a different address than every conformant ens client sending an irreversible name transfer to whoever registered a look alike name
- 93073 - [W&A - Critical] explorer remove user on a resolver role holder with root plus named roles only revokes one named scope leaving the root role active
- 92945 - [W&A - Critical] renew name displays the victim s expiry but signs renew for the attacker s label the victim pays to extend someone else s name
- 93010 - [W&A - Critical] profile page reads ownership and records from two different names so a look alike name displays an attacker controlled receiving address
- 93080 - [W&A - Critical] Improper resolver-role grouping causes incomplete revocation and attacker-controlled ENS resolution
- 92949 - [W&A - Critical] explorer remove user revokes only one resolver scope and leaves global address write authority active
- 93016 - [W&A - Critical] manager and explorer transact the normalized twin of the displayed ens name so a renewal pays to extend an attacker s registration and a transfer moves the wrong name and th
- 93081 - [W&A - Critical] resolver roles sidebar coerces an un invertible resource hash to the empty string which the save path reads as root so an operator scoping a grant to one name silently grants
- 93084 - [W&A - Critical] renewal flow signs a paid transaction against a different ens name than the one it resolves gates and displays
- 93018 - [W&A - Critical] raw cased profile url renders the real owner over an attacker resolver s address
- 93090 - [W&A - Critical] explorer send name resolves a recipient ens name with no address record to the name s registry owner instead of failing
- 93093 - [W&A - Critical] A pending role grant can be relabelled with a trusted recipient while retaining attacker calldata
- 93026 - [W&A - Critical] a name sent with the portal s default plan bricks every third party subname beneath it and the name s new holder can re mint those labels to an address of their choosing
- 93030 - [W&A - Critical] broken scope derivation in the portal resolver roles editor leads to resolving ens names to an attacker controlled address
- 93099 - [W&A - Critical] resolver roles the sidebar displays one permission scope and signs a different one
- 93103 - [W&A - Critical] deleting a resolver delegate can grant an unselected address record role to the next delegate
- 93111 - [W&A - Critical] ens falsely shows a victim as owner of an attacker s v1 name via unconsented setowner suppressing the third party renewal warning so the victim pays to renew the attacker s name
- 93043 - [W&A - Critical] erc1271 signature mode confusion lets a bounded hca session drain the account s refund token
- 93112 - [W&A - Critical] unresolved resolver role resource becomes a root grant
- 93044 - [W&A - Critical] the v1 v2 migration automatically grants role set resolver on the newly migrated v2 name to the legacy v1 registry controller an address that is by construction never the
- 93115 - [W&A - Critical] manager renew route the victim pays to renew an attacker s name and their own lapses
- 93045 - [W&A - Critical] explorer resolves a recipient ens name to the ens v1 registry controller so a retained controller name silently redirects name transfers subname ownership and role grants t
- 93116 - [W&A - Critical] after abandoning alpha and switching portal to bravo the surviving registration actor later submits register alpha while portal displays bravo
- 93049 - [W&A - Critical] missing resolver contract type validation turns record role delegation into registry wide name theft
- 93118 - [W&A - Critical] missing ensip 15 normalization on the register and renew write paths lets an attacker redirect a victim s renewal payment to a name the attacker owns
- 93119 - [W&A - Critical] transfer flow authorizes one ens name and signs transactions for a different one
- 93121 - [W&A - Critical] renewal flow signs a paid transaction against a different ens name than the one it resolves gates and displays
- 93127 - [W&A - Critical] ens manager profile page reads ownership from the normalized name and records from the raw url name letting an attacker show their own receiving address on a victim s profile
- 93129 - [W&A - Critical] stale role state tied to the row position in the resolver roles sheet quietly adds root role set addr to a grant so ens names resolve to an attacker controlled address
- 93135 - [W&A - Critical] Unresolved record-part role rows silently grant global resolver authority
High
- 89578 - [W&A - High] unreconciled funding budget in manager hca registration leads to the user approving a permit for 2 5 the total the checkout displays
- 89727 - [W&A - High] Manager checkout does not bind the accepted USDC amount to the later Permit and transfer
- 89328 - [W&A - High] registration checkout charges more than displayed
- 91001 - [W&A - High] the registration checkout shows the rent as the total while no funding budget has been fetched and admits the click on that figure
- 89329 - [W&A - High] Uncapped funding permit → full USDC drain on owner-signed HCA actions
- 89462 - [W&A - High] hca registration budget omits the resolver deployment so a first registration is funded short and its commitment cannot be recovered
- 90749 - [W&A - High] portal reparses a flat dotted label and grants resolver authority on a different ens name
- 91441 - [W&A - High] an unrelated contract can inject persistent arbitrary text into another name s canonical portal history
- 91648 - [W&A - High] hca funding permit is sized from an unbounded orchestrator quote with no ceiling or cross check
- 91834 - [W&A - High] missing resolver ownership validation in the name history query leads to persistent forged content injection on any ens name s history page
- 91924 - [W&A - High] manager can display a lower registration total and execute a higher hca spend without reconfirmation
- 92110 - [W&A - High] portal reparses a two dot raw label and authorizes a different four label ens name
- 92461 - [W&A - High] Portal registration shows $8.01 for name B, charges 160.109598 USDC for name A
- 92463 - [W&A - High] unbounded eip 2612 permit in planhcaintentfunding lets a hostile intent quote drain the connected wallet s usdc on a transaction whose amount the app never displays
- 92597 - [W&A - High] hca registration checkout can display exact rent while a recovered quote authorizes a larger wallet debit
- 92540 - [W&A - High] the explorer s role history panel identifies a name by its label hash alone and never by the registry that holds it
- 92413 - [W&A - High] unpinned warp settlementlayers and dest only 0x03 session policy lead to direct theft of hybrid custody account funds
- 92665 - [W&A - High] manager does not bind orchestrator returned hca registration calldata to the requested calldata allowing an attacker controlled subregistry on a victim owned root name
- 92779 - [W&A - High] Owner-signed HCA intents are signed from the orchestrator's returned intent with no execution-equivalence check, on the client or on chain
- 92996 - [W&A - High] portal s symbol collision preserves a prior owner s base address when a canonical row is deleted
- 93001 - [W&A - High] any contract can write persistent fabricated rows including a forged set address to 0xattacker into any ens name s history page the v1 history query has no resolver provenan
- 93021 - [W&A - High] swallowed budget quote failure makes the registration checkout show the rent as an exact total while the machine sizes the funding permit from the full budget so the user approves
- 93029 - [W&A - High] manager writes l2 address records to mainnet derived coin types while the explorer reads sepolia derived ones so all five l2 rows render the owner s coin 60 address and a sender s
- 93033 - [W&A - High] apps portal s address history page trusts unconsented on chain ownership anyone can plant attacker authored history and a forged from address on any address s page including a
- 93046 - [W&A - High] unchecked registration subregistry lets an hca session signer retain control of victim owned subnames
- 93128 - [W&A - High] manager hca quote failure can authorize more usdc than the exact wallet total shown at checkout
- 93137 - [W&A - High] charged vs displayed divergence on the hca registration checkout on a failed budget quote the screen shows the rent 8 but the funding permit charges the full budget 20 20
Medium
- 89249 - [W&A - Medium] stale authorization in v1 to v2 manager migration resurrects a revoked manager and lets a former seller hijack the ens resolver
- 89616 - [W&A - Medium] migration restores a stale former ensv1 manager allowing post reclaim resolver hijacking
- 89627 - [W&A - Medium] apps portal the name transfer cleanup checklist omits third party role grants so a stranger keeps setresolver on the sold name and repoints its eth address
- 89675 - [W&A - Medium] v1 v2 migration re grants role set resolver to a revoked manager from a stale snapshot
- 89903 - [W&A - Medium] Manager migration restores resolver authority to a revoked ENSv1 manager
- 89967 - [W&A - Medium] Manager executes cached V1 migration state, restoring revoked resolver authority and redirecting ENS payments
- 90002 - [W&A - Medium] Manager grants V2 ROLE_SET_RESOLVER from unverified V1 manager state, restoring authority to a revoked manager during migration
- 89254 - [W&A - Medium] cross user notification channel disablement via unscoped target predicate
- 90056 - [W&A - Medium] toctou in v1 to v2 migration restores revoked manager resolver authority
- 90156 - [W&A - Medium] missing execution time manager validation restores a removed v1 manager and lets them hijack a migrated name s resolver
- 90239 - [W&A - Medium] revoked v1 managers regain persistent v2 resolver control due to stale manager state during migration
- 90250 - [W&A - Medium] missing v1 registry owner revalidation re authorizes a revoked manager during v2 migration enabling resolver hijacking
- 90254 - [W&A - Medium] migration plan cache key omits v1 authority fields restoring an attacker resolver
- 90944 - [W&A - Medium] portal transfer cleanup preserves third party authority that can hijack the recipient s name
- 90957 - [W&A - Medium] v1 to v2 migration can reinstall a revoked attacker controlled resolver after manager receives corrected v1 state
- 90314 - [W&A - Medium] Migration resurrects a revoked V1 manager with V2 resolver authority
- 89285 - [W&A - Medium] fresh v1 owner updates do not invalidate a migration plan re authorizing a revoked manager
- 90980 - [W&A - Medium] manager migration can grant a revoked v1 manager persistent v2 resolver authority enabling ens name hijacking
- 90981 - [W&A - Medium] a former owner will redirect a transferred ens name to an attacker controlled address for the new owner by retaining permissionedresolver write authority
- 90446 - [W&A - Medium] no per user push channel cap and faulty retry after a partial commit permanently suppress other users external expiry reminders
- 89352 - [W&A - Medium] v1 to v2 migration silently replays prior owner resolver records pointing the victim s migrated name at the attacker
- 89356 - [W&A - Medium] toctou in v1 to v2 manager validation enables ens resolver hijacking by a revoked manager
- 90583 - [W&A - Medium] manager trusts stale v1 owner and resolver during eth migration
- 89366 - [W&A - Medium] missing execution time owner re verification in v1 v2 migration leads to role set resolver granted to a former manager
- 90613 - [W&A - Medium] stale v1 manager state during v1 v2 migration resurrects a revoked manager with role set resolver enabling resolver hijacking
- 89374 - [W&A - Medium] stale v1 registry state reinstalls a revoked attacker resolver during v1 to v2 migration enabling ens name hijacking
- 89381 - [W&A - Medium] migration can restore resolver authority to a former v1 manager after reclaim
- 91127 - [W&A - Medium] unbounded favorite fan out lets an attacker poison shared expiry batches and suppress cross user notifications
- 90626 - [W&A - Medium] Manager migration restores a removed V1 manager, enabling resolver hijack and fund theft
- 91189 - [W&A - Medium] portal hides resolver cleanup when the seller lacks direct role set resolver leaving a delegate able to redirect the new owner s ens resolution and later transactions
- 89445 - [W&A - Medium] one user s bounce or unsubscribe rewrites every other user s channel with the same target
- 91314 - [W&A - Medium] explorer builds a user s own name list from an ensjs query whose default relation set includes resolvedaddress so any name an attacker points at a victim s address is listed a
- 90755 - [W&A - Medium] cached v1 manager authority is restored as a persistent v2 resolver role during migration
- 91342 - [W&A - Medium] manager resurrects a relinquished v1 manager as a v2 resolver delegate after the pre wallet state check
- 90807 - [W&A - Medium] stale authorization in v1 to v2 manager restoration re grants revoked resolver control enabling ens name hijack
- 90812 - [W&A - Medium] toctou in manager migration installs an attacker resolver and restores former v1 manager authority
- 91414 - [W&A - Medium] revoked v1 manager can regain resolver control through a stale v1 v2 migration plan
- 91600 - [W&A - Medium] manager executes a cached migration plan after v1 authority revocation restoring the revoked manager and resolver
- 91615 - [W&A - Medium] queues event ingestion ts idempotency key stamped before the delivery fan out
- 91689 - [W&A - Medium] portal direct child route and spoofable resolver authentication substitute an attacker contract as the victim s transaction target
- 91690 - [W&A - Medium] manager migration restores a revoked v1 manager with persistent v2 resolver authority
- 91765 - [W&A - Medium] stale v1 migration state resurrects a revoked manager on v2
- 91824 - [W&A - Medium] v1 v2 migration resurrects a revoked legacy manager with fresh role set resolver after the victim reclaims the v1 node
- 91852 - [W&A - Medium] former v1 manager is incorrectly granted v2 resolver authority allowing ens redirection and nft theft
- 92097 - [W&A - Medium] manager migration resurrects a removed attacker controlled resolver and re grants a relinquished manager role from a stale v1 snapshot
- 91913 - [W&A - Medium] Incomplete KNOWN_PUBLIC_RESOLVERS skip of locked-record safety wipes ETH/text records on Manager v1→v2 Upgrade
- 91931 - [W&A - Medium] Manager migration reauthorizes a revoked V1 manager, enabling resolver hijack
- 91974 - [W&A - Medium] sendgrid webhook resolves notification channels by email alone so a cross user duplicate is not ownership bound when provider events are processed
- 91977 - [W&A - Medium] explorer s v2 transfer never revokes third party roles so a delegate the seller kept can re point the buyer s resolver
- 92156 - [W&A - Medium] usemigrationgasestimate preserves an authority bearing plan after manager revocation restoring a revoked address during v1 to v2 migration
- 92446 - [W&A - Medium] stale v1 migration plan restores revoked manager authority and attacker resolver hijacking an ens name
- 92448 - [W&A - Medium] revoked ensv1 manager regains resolver control when the owner migrates
- 92177 - [W&A - Medium] stale v1 manager snapshot re grants a former manager v2 resolver authority during migration
- 92205 - [W&A - Medium] stale v1 authority cache restores attacker resolver control during ensv2 migration
- 92466 - [W&A - Medium] unbounded ens description record is emitted twice through a 6x expanding html escaper so one attacker owned name kills the explorer s cloudflare worker isolate for every concu
- 92489 - [W&A - Medium] apps/manager: migration grants ROLE_SET_RESOLVER to a revoked V1 manager
- 92263 - [W&A - Medium] a seller who keeps the resolver on a name transfer keeps root authority over the sold name and can repoint it at their own address after the sale
- 92503 - [W&A - Medium] stale v1 manager cache re grants a revoked manager during v2 migration
- 92509 - [W&A - Medium] revoked manager regains resolver control during v1 to v2 migration
- 92517 - [W&A - Medium] same key record replacement is serialized deletion last causing portal to expose a revoked delegate s address as the base recipient
- 92542 - [W&A - Medium] explorer s roles editor revokes role can transfer admin in a remove user whose only warning describes a different consequence freezing the name for the rest of its registrat
- 92341 - [W&A - Medium] manager restores v2 resolver authority to a v1 manager removed before confirmation
- 92608 - [W&A - Medium] explorer checkout shows a 0 00 total deletes the approval step and the registrar charges the full rent price the user was never shown
- 92609 - [W&A - Medium] stale v1 controller snapshot grants a revoked controller v2 resolver authority during migration
- 92611 - [W&A - Medium] stale v1 resolver snapshot migrates an attacker controlled resolver after v1 recovery
- 92373 - [W&A - Medium] same id migration refresh retains removed resolver authority in an executable plan
- 92618 - [W&A - Medium] revoked v1 manager receives persistent ensv2 resolver control from an already prepared migration
- 92398 - [W&A - Medium] unscoped replay unprotected sendgrid webhook over duplicate email rows lead to silent cross user disabling of ens email notifications
- 92623 - [W&A - Medium] registry wide role event cap hides a retained delegate and enables post transfer resolver and subregistry hijacking
- 92625 - [W&A - Medium] stale v1 registry state restores a revoked manager and resolver during v1 to v2 migration
- 92578 - [W&A - Medium] notification channel state is read and written by target address alone with no user id predicate over a schema that deliberately allows the same target on multiple accounts
- 92648 - [W&A - Medium] the explorer certifies a resolver as official audited and considered secure from a storage word any contract can forge and the same forged bit replaces the record edit owners
- 92585 - [W&A - Medium] explorer certifies any contract as the official audited ens permissioned resolver from a single storage word the contract writes itself
- 92649 - [W&A - Medium] improper record deduplication in the portal silently deletes a reviewed base address and resolves the ens name to an attacker controlled fallback
- 92661 - [W&A - Medium] missing ownership check in the sendgrid webhook s channel lookup lets any account silently disable another person s verified ens email notifications permanently
- 92596 - [W&A - Medium] manager v1 v2 migration restores a removed v1 manager as persistent v2 resolver authority hijacking the name s resolver
- 92685 - [W&A - Medium] stale v1 resolver state in manager migration restores an attacker controlled resolver and hijacks the migrated ens name
- 92695 - [W&A - Medium] setupcontrolledresolver intent underfunding and session key policy reversion prevents controlled resolver deployment and profile setup in manager
- 92816 - [W&A - Medium] the expiry discovery cron s non unique timestamp cursor pagination permanently and silently drops names tied at a page 1000 boundary from every expiry notification
- 92718 - [W&A - Medium] portal s v1 bulk renewal table treats resolves to me as owned by me letting a victim s own connected wallet pay to renew an attacker s name
- 92723 - [W&A - Medium] missing ccipread guard in the explorer s og image worker client lets an attacker controlled resolver drive unbounded server side requests exhausting the worker s rpc provider
- 92825 - [W&A - Medium] missing registry scoping in the role history query lets anyone write permanent forged role change entries into any ens name s audit trail
- 92828 - [W&A - Medium] stale manager state restores a revoked account that hijacks the migrated ens resolver
- 92836 - [W&A - Medium] payment token picker silently treats a failed price read as 0 hiding insufficient balance and skipping the real approval amount
- 92838 - [W&A - Medium] toctou in manager v1 to v2 migration reinstalls a replaced attacker controlled resolver and hijacks an ens name
- 92951 - [W&A - Medium] Missing on-chain validation in ENS migration lets a third party hijack the resolver of a user's name
- 92870 - [W&A - Medium] case folded role name lookup in the manager profile leads to persistent injection of third party ens names on any address s public page
- 92778 - [W&A - Medium] manager accepts an attacker controlled subregistry as a completed hca registration after the intended reveal fails
- 92964 - [W&A - Medium] manager migration can restore a revoked v1 manager s permission to change the resolver
- 92885 - [W&A - Medium] stale v1 manager is encoded as the nested v2 grantroles recipient after a same id refresh
- 92976 - [W&A - Medium] stale v1 manager state during ensv2 migration resurrects former manager resolver authority and enables name hijacking
- 92977 - [W&A - Medium] missing registry filter in userolehistory lets any user plant fake role grants in another name s explorer history panel
- 92899 - [W&A - Medium] stale v1 resolver snapshot during migration reinstalls a removed attacker operated resolver
- 92988 - [W&A - Medium] missing live v1 owner check re grants resolver control to a revoked manager during migration
- 92908 - [W&A - Medium] historical resolver provenance check reattaches attacker upgraded code during profile editing
- 93056 - [W&A - Medium] migration replays attacker controlled records from a removed cached v1 resolver into the authoritative v2 resolver
- 92909 - [W&A - Medium] migration reuses uncleared resolver state and activates a revoked delegate s attacker address
- 92995 - [W&A - Medium] a contact tab discord edit republishes inherited social handles through manager s resolver replacement
- 92912 - [W&A - Medium] any address can replace the rendered history of any ens name
- 92913 - [W&A - Medium] A keep-resolver sale strands the sold name under the seller's resolution control -- and if the seller burns the resolver role first, no one can ever undo it
- 92997 - [W&A - Medium] missing factory check in the permissioned resolver lookup lets any contract get ens s audited and considered secure badge on its page and og card
- 92934 - [W&A - Medium] Unauthenticated server-side egress from the ENS Portal Worker via EIP-3668 CCIP-Read leads to ressource exhaustion
- 93006 - [W&A - Medium] medium portal registration checkout fails open on a single transient price read failure the ui freezes at 0 00 and drops every approval step while the machine charges the li
- 93008 - [W&A - Medium] recipient controlled transfer failure leaves ens resolution attacker controlled and diverts payments
- 93079 - [W&A - Medium] a stale manager migration plan can restore a former owner s attacker controlled resolver
- 93019 - [W&A - Medium] ens manager regrants a revoked v1 manager during migration enabling resolver hijack
- 93096 - [W&A - Medium] missing manager revalidation during v1 v2 migration grants resolver control to a revoked manager
- 93032 - [W&A - Medium] stale v1 manager snapshot restores revoked resolver authority during migration
- 93106 - [W&A - Medium] stale subgraph state in the manager s v1 to v2 migration flow re grants resolver control authority to an ensv1 manager the registrant already revoked
- 93040 - [W&A - Medium] stale ensv1 manager restoration during migration grants a revoked attacker ensv2 resolver control
- 93042 - [W&A - Medium] migration resurrects a revoked v1 manager from stale indexed state
- 93051 - [W&A - Medium] default clean transfer preserves a prior resolver delegate allowing the recipient s ens name to be hijacked
- 93053 - [W&A - Medium] failed per token price read renders a selectable 0 00 quote skips the approval leg and the amount less renew silently charges the live price against the standing 2x allowance
- 93130 - [W&A - Medium] a stale manager migration plan can restore a former owner s attacker controlled resolver
- 93132 - [W&A - Medium] explorer stamps a verified forward match true primary name badge on an unverified default reverse name so any address displays a name it does not own as its confirmed prima
- 93133 - [W&A - Medium] Stale V1 migration state restores a revoked manager and attacker resolver in ENSv2
Low
- 89569 - [W&A - Low] email notification channels are not unique per address an attacker can bind a victim s email to their own account take the address out of the victim s reach and have ens mail del
- 89891 - [W&A - Low] notifications channels email verify verifies whoever s token you send not whoever asks
- 90069 - [W&A - Low] missing ownership re check in email channel verification lets any authenticated user bind another user s email address to their own account as a verified notification channel
- 90264 - [W&A - Low] unauthenticated post wallet fund spends a server held private key behind a non atomic kv lock allowing concurrent funds to collide on the funder s nonce and to be issued witho
- 90307 - [W&A - Low] explorer renders an unbounded on chain uint64 expiry through temporal without a range check so one unsolicited subname permanently breaks a victim s names page
- 89286 - [W&A - Low] unauthenticated post wallet fund enables gas griefing against the faucet s own funding wallet
- 90651 - [W&A - Low] unverified email channel lets any authenticated user delete another user s sendgrid contact silently unsubscribing them from ens broadcast email
- 91233 - [W&A - Low] manager suppresses a cross name avatar header record update and preserves former owner media control
- 91256 - [W&A - Low] Unauthenticated verify endpoint binds a victim's email address to the attacker's ENS account
- 89444 - [W&A - Low] any anonymous caller can drain the faucet hot wallet and hang worker invocations
- 91443 - [W&A - Low] an unsolicited transferred name s one byte abi record indefinitely locks manager s default dashboard
- 91444 - [W&A - Low] an unsolicited ensv2 name with an oversized coin 121 result blocks the victim s default manager dashboard
- 91446 - [W&A - Low] quadratic primary contact deduplication temporarily locks the victim s manager tab after an unsolicited name transfer
- 91450 - [W&A - Low] unbounded links rendering blocks manager navigation for 14 seconds on a gifted name
- 91487 - [W&A - Low] api worker user channels never enforces one verified owner per email target
- 91631 - [W&A - Low] missing token to account binding in the unauthenticated email verification endpoint leads to cross account mailbox binding victim lock out and an email membership oracle
- 91813 - [W&A - Low] email verification never identifies the requesting wallet so an attacker binds a victim s mailbox to their own account
- 91822 - [W&A - Low] editing the recipient during portal transfer preparation sends the ens name to the replaced address
- 91997 - [W&A - Low] manager re authors a prior owner s social records into the recipient s replacement resolver despite a clear old details promise
- 91925 - [W&A - Low] email verification binds another user s mailbox to the requesting account unauthenticated
- 92165 - [W&A - Low] unauthenticated verify endpoint binds a victim s email to the attacker s ens account
- 92481 - [W&A - Low] email channel takeover an unauthenticated verify endpoint finalises a pre bound victim address
- 92494 - [W&A - Low] apps/portal: transfer encodes a cached ENS resolution as the recipient
- 92305 - [W&A - Low] email verification rate limiter runs after the rows it should gate and is keyed on the target address so any account can burn a chosen email s hourly quota and block that person fr
- 92544 - [W&A - Low] explorer s name page asserts you are the owner of name and a paid figure taken verbatim from the url query string on any name for any visitor beside an ownership free button
- 92408 - [W&A - Low] email verification endpoint has no authentication letting an attacker bind a victim s email address to the attacker s account
- 92583 - [W&A - Low] post notifications channels email verify ships with no requireauth and re checks nothing so one click on a genuine ens email transfers a victim s address to an attacker s account
- 92586 - [W&A - Low] one ens text record keyed on an object prototype member permanently replaces a name s manager profile page and the edit dialog inside it with an error screen
- 92792 - [W&A - Low] any account can exhaust the email verification rate limit for an address it does not own blocking that address s verification for an hour
- 92739 - [W&A - Low] portal transfer step id reuse redirects an ens name recipient transfer to the former address
- 92868 - [W&A - Low] unauthenticated notifications channels email verify grants authority by bare token possession cross user email channel hijack and permanent victim lockout
- 92966 - [W&A - Low] deleting an unverified email channel can remove another user s sendgrid contact
- 92893 - [W&A - Low] live ens recipient refetch changes the undisclosed owner of a new subname
- 92905 - [W&A - Low] live resolver access refetch changes replace continue into a transaction to the previous owner s resolver
- 93060 - [W&A - Low] attacker initiated verification binds a victim email to the attacker
- 93089 - [W&A - Low] sendgrid webhook matches events to the first channel row with that email so a pre registered pending duplicate absorbs another user s unsubscribe or bounce
- 93031 - [W&A - Low] missing cross user authorization on the email channel verify endpoint lets an attacker bind any third party s email to their own ens account disabling that user s own notifications
- 93104 - [W&A - Low] any authenticated user can bind a stranger s mailbox to their own ens account with one click and lock the real owner out of email notifications
- 93109 - [W&A - Low] missing per user scoping in the email verification rate limit lets any signed in account lock another user out of adding their email to notifications
- 93124 - [W&A - Low] an unauthenticated attacker can recover a victim s siwe nonce verbatim and burn it before any verification locking the victim out of login
- 93125 - [W&A - Low] missing authorization in the notifications channel delete handler s broadcast cleanup lets any authenticated user delete another user s sendgrid marketing contact config gated
Insight
- 89551 - [W&A - Insight] ens explorer renders a forged forward match true primary name verification badge for an attacker s unverified default reverse name
- 89583 - [W&A - Insight] critical explorer renders an unverified default reverse name as a confirmed primary name the forward match column prints true on a branch that never reads forwardmatch
- 89599 - [W&A - Insight] ENS Portal prints the namehash of a different, third-party-owned name as the viewed name's identity
- 89705 - [W&A - Insight] missing recipient address validation in set primary name leads to ens name resolution hijacked to an attacker controlled address
- 89736 - [W&A - Insight] unverified default reverse name rendered as a verified primary name on l2 rows enabling identity spoofing
- 90095 - [W&A - Insight] one signature on a legitimate app ens domains screen redirects a victim s ens name to the attacker the app builds the redirect from an attacker chosen unverified record and ne
- 89255 - [W&A - Insight] attacker controlled ens name injected into telegram expiry notifications without escaping
- 89300 - [W&A - Insight] patched rhinestone sdk identity is undocumented in source two provenance comments assert two different superseded sha 256 values
- 90584 - [W&A - Insight] unescaped ens label injected into markdown parsed telegram notifications allows an attacker to place arbitrary hyperlinks in first party ens bot messages
- 90593 - [W&A - Insight] the token info page publishes the namehash of a name s punycode a label so every non ascii ens name shows the node of a different separately registerable name
- 89389 - [W&A - Insight] any wallet can enumerate ens users by email address bypass the per address send limit and get a victim s own expiry alerts switched off
- 90636 - [W&A - Insight] unverified default reverse name is displayed as a verified primary name
- 90646 - [W&A - Insight] explorer renders an unverified default reverse claim as a verified primary name letting any address assert any ens name e g vitalik eth with a green forward match true
- 90662 - [W&A - Insight] token info page derives the displayed namehash from the idna punycode form of the name showing the node of a different and separately registrable ens name
- 89441 - [W&A - Insight] explorer certifies an unverified reverse record as a forward verified primary name
- 89461 - [W&A - Insight] missing cleanup on an interrupted migration leaves a permanent registry wide setapprovalforall on the ens v2 registry exposing every name the wallet owns to theft
- 89464 - [W&A - Insight] ens explorer reverse resolution certifies an unverified default reverse name as the verified l2 primary name
- 89469 - [W&A - Insight] ssrf self host protection bypass in the og image worker leads to temporary denial of service resource amplification of the card preview service
- 89513 - [W&A - Insight] missing markdown escaping in notification worker allows attacker author ens branded telegram message content or silently suppress a victim s expiry warnings
- 90859 - [W&A - Insight] the explorer s reverse resolution table prints forward match true and a primary name badge for a name it never forward verified letting any address present itself under a
- 89534 - [W&A - Insight] session enable signs attacker authored policy hidden in an opaque salt yielding an effectively permanent attacker keyed session
- 91571 - [W&A - Insight] set primary name in the ens explorer signs setaddr with the address from the url not the connected wallet so an attacker can redirect where any ens name resolves
- 91658 - [W&A - Insight] missing forward match verification in reverse resolution lets any address display any ens name as its verified primary name causing users to send funds to the attacker
- 91702 - [W&A - Insight] telegram expiry notifications render an attacker chosen link inside the official ens bot s message
- 91728 - [W&A - Insight] explorer renders an unverified default reverse claim as a forward verified primary name on every l2 row letting any address be displayed as any ens name
- 91732 - [W&A - Insight] attacker chosen ens text record key is rendered verbatim into the explorer homepage activity feed
- 91839 - [W&A - Insight] an attacker gifted v1 name modifies the arguments of the migration transaction set the victim signs adding an approval that would not otherwise be requested and widening a toke
- 91851 - [W&A - Insight] explorer certifies a victim s wallet as an attacker owned ens name name address offers set primary name for names the visitor has no relationship with
- 92105 - [W&A - Insight] explorer prints forward match true and primary name for a default reverse record ens resolution reports as a mismatch
- 92108 - [W&A - Insight] unescaped ens name in api worker telegram push notification templates allows markdown injection and a clickable phishing link inside official ens expiry alerts
- 91962 - [W&A - Insight] hardcoded true in the explorer s forward match column certifies any address as the verified primary name holder of any ens name
- 92445 - [W&A - Insight] telegram notification markdown injection via attacker controlled ens name
- 92283 - [W&A - Insight] notification templates interpolate an ens label with no escaping a third party can plant persistent text in another user s manager inbox with no interaction by that user and a
- 92307 - [W&A - Insight] dos on api worker from insufficient transaction payload validation
- 92546 - [W&A - Insight] explorer s name page asserts you are the owner of name and a paid figure taken verbatim from the url query string on any name for any visitor beside an ownership free bu
- 92553 - [W&A - Insight] explorer home page recent activity shows unverified reverse record names as genuine ens names persistent content injection
- 92361 - [W&A - Insight] missing transaction history storage limits allow one authenticated user to exhaust shared database capacity
- 92635 - [W&A - Insight] the explorer offers set primary name based on a record the attacker controls and never checks name ownership so one click on a link replaces the victim s primary name with a
- 92439 - [W&A - Insight] unescaped ens name in telegram expiry notification template enables persistent markdown link injection reaching third party users
- 92796 - [W&A - Insight] unverified default reverse is falsely labelled forward match true and primary name on inherited l2 rows
- 92701 - [W&A - Insight] missing escaping in the notification worker lets a registered ens label inject markdown into official ens notifications placing an attacker chosen link inside messages delivere
- 92706 - [W&A - Insight] telegram markdown injection in notification delivery unescaped ens name enables phishing via the official notifications bot
- 92719 - [W&A - Insight] a gifted ens name with a crafted label injects persistent attacker controlled markdown into a victim s real telegram expiry alert notifications
- 92837 - [W&A - Insight] safe owner removal does not revoke the ens api session they created
- 92954 - [W&A - Insight] unauthorized profile image change upload does not verify signer ownership
- 92961 - [W&A - Insight] portal falsely marks an unverified inherited reverse name as a verified primary name
- 92878 - [W&A - Insight] persistent markdown content injection into telegram expiry notification messages via an unsanitized ens name label
- 92979 - [W&A - Insight] telegram authentication accepts future dated auth date values
- 92986 - [W&A - Insight] ens worker allows telegram markdown injection
- 93024 - [W&A - Insight] stale worker jwt lets a removed safe owner modify successor notifications and read their email
Reports by Type
Websites & Apps
- 89249 - [W&A - Medium] stale authorization in v1 to v2 manager migration resurrects a revoked manager and lets a former seller hijack the ens resolver
- 89535 - [W&A - Critical] manager profile page renders an attacker chosen eth address next to a name s genuine owner
- 89548 - [W&A - Critical] registration and renewal use un normalized labels the name the manager shows is not the name it writes on chain
- 89551 - [W&A - Insight] ens explorer renders a forged forward match true primary name verification badge for an attacker s unverified default reverse name
- 89563 - [W&A - Critical] ens explorer resolver remove user save silently leaves the root all names grant intact so a removed manager keeps write access to every name
- 89569 - [W&A - Low] email notification channels are not unique per address an attacker can bind a victim s email to their own account take the address out of the victim s reach and have ens mail del
- 89578 - [W&A - High] unreconciled funding budget in manager hca registration leads to the user approving a permit for 2 5 the total the checkout displays
- 89583 - [W&A - Insight] critical explorer renders an unverified default reverse name as a confirmed primary name the forward match column prints true on a branch that never reads forwardmatch
- 89585 - [W&A - Critical] critical name transfer resolves its recipient to the v1 registry controller not the erc 721 holder the explorer also labels that controller as owner
- 89593 - [W&A - Critical] incorrect scope inference in the resolver roles editor leaves a removed user s resolver wide grant live up to role upgrade
- 89253 - [W&A - Critical] wrong resource revocation in resolver roles lets a removed account retain role set addr and redirect another ens name
- 89599 - [W&A - Insight] ENS Portal prints the namehash of a different, third-party-owned name as the viewed name's identity
- 89601 - [W&A - Critical] missing ensip 15 normalisation in the manager registration path causes users to pay for and receive a different permanently unresolvable name than the one the app showed as av
- 89611 - [W&A - Critical] resolver remove user revokes only one name and leaves global address upgrade authority active
- 89614 - [W&A - Critical] cross resource role aggregation makes remove user revoke only one name and leaves delegated resolver control
- 89616 - [W&A - Medium] migration restores a stale former ensv1 manager allowing post reclaim resolver hijacking
- 89627 - [W&A - Medium] apps portal the name transfer cleanup checklist omits third party role grants so a stranger keeps setresolver on the sold name and repoints its eth address
- 89630 - [W&A - Critical] renewal payment is redirected to an attacker s look alike name
- 89641 - [W&A - Critical] explorer invents a recipient address and sends the user s ens name to it
- 89675 - [W&A - Medium] v1 v2 migration re grants role set resolver to a revoked manager from a stale snapshot
- 89705 - [W&A - Insight] missing recipient address validation in set primary name leads to ens name resolution hijacked to an attacker controlled address
- 89727 - [W&A - High] Manager checkout does not bind the accepted USDC amount to the later Permit and transfer
- 89728 - [W&A - Critical] Explorer app fabricates a 'Resolved:' for recordless ENS names - silently substitutes the name's owner, sending name transfers and registry-wide role grants to an attacker's ad...
- 89736 - [W&A - Insight] unverified default reverse name rendered as a verified primary name on l2 rows enabling identity spoofing
- 89744 - [W&A - Critical] v1→v2 migration unconditionally grants ROLE_SET_RESOLVER on the v2 ETHRegistry to the name's stale v1 registry controller — an attacker-settable address the Manager never displ...
- 89761 - [W&A - Critical] Removing a resolver user revokes only one displayed ENS name, allowing redirected incoming payments
- 89864 - [W&A - Critical] ens explorer silently resolves a name with no addr 60 record to its token owner owner fallback and consumes it on irreversible authority granting action paths misdirectin
- 89888 - [W&A - Critical] missing ensip 15 normalization in manager registration lets an attacker own the canonical name while a victim buys a hidden lookalike
- 89891 - [W&A - Low] notifications channels email verify verifies whoever s token you send not whoever asks
- 89903 - [W&A - Medium] Manager migration restores resolver authority to a revoked ENSv1 manager
- 89917 - [W&A - Critical] the app acts on a different ens name than the one it displays and just verified you own an unsolicited airdrop turns get rid of this junk into irreversible loss of a valuab
- 89930 - [W&A - Critical] manager profile displays a trusted name s owner but an attacker controlled receiving address owner node vs records node normalization split
- 89952 - [W&A - Critical] an omitted non root role mapping makes edit user roles encode a root scoped grant
- 89960 - [W&A - Critical] raw name ownership check can transfer a different normalized ensv2 token
- 89967 - [W&A - Medium] Manager executes cached V1 migration state, restoring revoked resolver authority and redirecting ENS payments
- 89990 - [W&A - Critical] Resolver roles page revokes a single name while claiming removal of all roles — removed users keep live record-write authority on other names and ROOT
- 90002 - [W&A - Medium] Manager grants V2 ROLE_SET_RESOLVER from unverified V1 manager state, restoring authority to a revoked manager during migration
- 89254 - [W&A - Medium] cross user notification channel disablement via unscoped target predicate
- 90056 - [W&A - Medium] toctou in v1 to v2 migration restores revoked manager resolver authority
- 90069 - [W&A - Low] missing ownership re check in email channel verification lets any authenticated user bind another user s email address to their own account as a verified notification channel
- 90071 - [W&A - Critical] lossy resolver role grouping makes remove user from all roles leave global role set addr active
- 90094 - [W&A - Critical] renewing a name from the portal confirm screen builds the transaction for a different on chain name than the one it displays the payment renews normalize name not the nam
- 90095 - [W&A - Insight] one signature on a legitimate app ens domains screen redirects a victim s ens name to the attacker the app builds the redirect from an attacker chosen unverified record and ne
- 90156 - [W&A - Medium] missing execution time manager validation restores a removed v1 manager and lets them hijack a migrated name s resolver
- 90161 - [W&A - Critical] explorer authorizes a transfer against the name in the url but moves the token of the normalized name so disposing of an unsolicited look alike transfers the victim s real name
- 90163 - [W&A - Critical] manager renewal route proves renewability from the normalized name but renews the raw label so a user pays to extend an attacker s registration
- 90165 - [W&A - Critical] Resolver role removal merges name-scoped permissions and leaves a delegate authorized
- 90190 - [W&A - Critical] manager bulk renewal displays the raw label but renews the normalized one so a user s rent payment extends a name they do not own
- 90206 - [W&A - Critical] The transfer flow authorises against one ENS name and signs the transfer of a different one
- 90239 - [W&A - Medium] revoked v1 managers regain persistent v2 resolver control due to stale manager state during migration
- 90245 - [W&A - Critical] explorer remove user confirms removal from all roles but only revokes the name scope root roles keep resolver wide addr write
- 90250 - [W&A - Medium] missing v1 registry owner revalidation re authorizes a revoked manager during v2 migration enabling resolver hijacking
- 90254 - [W&A - Medium] migration plan cache key omits v1 authority fields restoring an attacker resolver
- 90255 - [W&A - Critical] apps portal resolver roles ui remove user revokes only the name scope while confirming removal from all roles the root grant stays active
- 89255 - [W&A - Insight] attacker controlled ens name injected into telegram expiry notifications without escaping
- 89264 - [W&A - Critical] persistent root resolver authorization survives ens name transfer allowing former owners to rewrite sold name records and unrelated resolver resources
- 90264 - [W&A - Low] unauthenticated post wallet fund spends a server held private key behind a non atomic kv lock allowing concurrent funds to collide on the funder s nonce and to be issued witho
- 90944 - [W&A - Medium] portal transfer cleanup preserves third party authority that can hijack the recipient s name
- 89270 - [W&A - Critical] manager profile page resolves records from the raw url name but owner expiry from the normalized name letting an attacker display their own address under a victim name s identity
- 90307 - [W&A - Low] explorer renders an unbounded on chain uint64 expiry through temporal without a range check so one unsolicited subname permanently breaks a victim s names page
- 90951 - [W&A - Critical] portal remove user from all roles submits incomplete revocation calldata and leaves the delegate authorized
- 89278 - [W&A - Critical] portal displays raw alice eth but transfers the distinct canonical alice eth nft
- 90957 - [W&A - Medium] v1 to v2 migration can reinstall a revoked attacker controlled resolver after manager receives corrected v1 state
- 89279 - [W&A - Critical] previous owner permanently controls what a transferred ens name resolves to
- 90314 - [W&A - Medium] Migration resurrects a revoked V1 manager with V2 resolver authority
- 90320 - [W&A - Critical] Removed resolver user can still redirect ENS names
- 89285 - [W&A - Medium] fresh v1 owner updates do not invalidate a migration plan re authorizing a revoked manager
- 90980 - [W&A - Medium] manager migration can grant a revoked v1 manager persistent v2 resolver authority enabling ens name hijacking
- 90337 - [W&A - Critical] explorer removes only one grouped role scope allowing removed users to redirect ens transfers
- 89286 - [W&A - Low] unauthenticated post wallet fund enables gas griefing against the faucet s own funding wallet
- 90363 - [W&A - Critical] Editing a Fine-Grained Resolver Role Silently Grants Root-Wide Authority
- 89293 - [W&A - Critical] explorer resolver remove user confirms a full revocation and signs a single resource one leaving the target holding root role set addr
- 89300 - [W&A - Insight] patched rhinestone sdk identity is undocumented in source two provenance comments assert two different superseded sha 256 values
- 90981 - [W&A - Medium] a former owner will redirect a transferred ens name to an attacker controlled address for the new owner by retaining permissionedresolver write authority
- 89314 - [W&A - Critical] manager v1 to v2 migration silently keeps an attacker s resolver and grants the attacker role set resolver on the v2 registry for gifted secondary market names
- 90379 - [W&A - Critical] deleting one resolver role row rebinds its permission draft to the next account and grants that account an unselected address role
- 89328 - [W&A - High] registration checkout charges more than displayed
- 91001 - [W&A - High] the registration checkout shows the rent as the total while no funding budget has been fetched and admits the click on that figure
- 89329 - [W&A - High] Uncapped funding permit → full USDC drain on owner-signed HCA actions
- 89336 - [W&A - Critical] v1 to v2 migration grants stale owners resolver control
- 90446 - [W&A - Medium] no per user push channel cap and faulty retry after a partial commit permanently suppress other users external expiry reminders
- 91004 - [W&A - Critical] the explorer transfer flow checks ownership of the name in the url and moves its normalized sibling
- 89352 - [W&A - Medium] v1 to v2 migration silently replays prior owner resolver records pointing the victim s migrated name at the attacker
- 91014 - [W&A - Critical] scoped hca sessions are downgraded to owner mode bypassing refund authorization and transferring hca tokens
- 89356 - [W&A - Medium] toctou in v1 to v2 manager validation enables ens resolver hijacking by a revoked manager
- 91044 - [W&A - Critical] explorer authorises a raw ens name but transfers the normalised name so a user disposing of a decoy burns their genuine name
- 90459 - [W&A - Critical] incomplete resolver role revocation leaves attacker control over another ens name and enables direct fund theft
- 89360 - [W&A - Critical] the name profile route resolves one url parameter as two ens names rendering an attacker s receiving address under the victim s genuine owner and expiry
- 90498 - [W&A - Critical] resolver role table merges different names into one row but signs calldata for only one name
- 91062 - [W&A - Critical] scope collapse in the resolver roles editor causes role writes to target the resolver root resource granting authority over every name it serves and making remove user repor
- 91063 - [W&A - Critical] owner fallback in portal s ens name resolution pre fills an unpublished address sending role grants and name transfers to an unintended recipient
- 90544 - [W&A - Critical] post confirmation unicode normalization substitutes an attacker owned primary name causing manager to render an attacker controlled optimism recipient
- 89363 - [W&A - Critical] ENS v1→v2 migration grants resolver authority over the migrated name to an unverified, never-displayed third party
- 90583 - [W&A - Medium] manager trusts stale v1 owner and resolver during eth migration
- 89366 - [W&A - Medium] missing execution time owner re verification in v1 v2 migration leads to role set resolver granted to a former manager
- 90584 - [W&A - Insight] unescaped ens label injected into markdown parsed telegram notifications allows an attacker to place arbitrary hyperlinks in first party ens bot messages
- 91080 - [W&A - Critical] a visually identical link makes a name holder pay to extend somebody else s registration manager decides ownership expiry and the third party renewal warning on the ens norma
- 90593 - [W&A - Insight] the token info page publishes the namehash of a name s punycode a label so every non ascii ens name shows the node of a different separately registerable name
- 91095 - [W&A - Critical] portal remove user from all roles sends a one name revoke and leaves root resolver authority usable
- 90613 - [W&A - Medium] stale v1 manager state during v1 v2 migration resurrects a revoked manager with role set resolver enabling resolver hijacking
- 91097 - [W&A - Critical] explorer s remove user from all roles signs a one resource revoke leaving a former delegate able to redirect another ens name
- 90622 - [W&A - Critical] lossy resolver role aggregation causes remove user from all roles to retain global permissions enabling ens record hijacking
- 91098 - [W&A - Critical] renew page shows the correct name but signs a different one invisible unicode causes wrong recipient renewal
- 89374 - [W&A - Medium] stale v1 registry state reinstalls a revoked attacker resolver during v1 to v2 migration enabling ens name hijacking
- 89381 - [W&A - Medium] migration can restore resolver authority to a former v1 manager after reclaim
- 91121 - [W&A - Critical] manager profile page resolves one route name against two different ens nodes rendering an attacker controlled receiving address beside the victim s genuine ownership data
- 89387 - [W&A - Critical] remove user from all roles leaves root resolver authority active enabling ens address redirection
- 91127 - [W&A - Medium] unbounded favorite fan out lets an attacker poison shared expiry batches and suppress cross user notifications
- 89389 - [W&A - Insight] any wallet can enumerate ens users by email address bypass the per address send limit and get a victim s own expiry alerts switched off
- 90626 - [W&A - Medium] Manager migration restores a removed V1 manager, enabling resolver hijack and fund theft
- 90636 - [W&A - Insight] unverified default reverse name is displayed as a verified primary name
- 91150 - [W&A - Critical] explorer replaces the displayed ensv2 asset s erc 1155 tokenid before the connected wallet transfer
- 89395 - [W&A - Critical] unsafe owner fallback in the shared address resolver leads to irreversible transfer of ens names to an unintended address
- 90637 - [W&A - Critical] removing a resolver user leaves every root scoped role in place
- 91181 - [W&A - Critical] normalization desync in the manager renewal route validates one name and renews another letting a link make a victim pay to extend an attacker s name
- 89398 - [W&A - Critical] missing address record validation in resolveaddressorname causes irreversible ens name transfers to the wrong recipient
- 90638 - [W&A - Critical] renew gate reads one name renew calldata spends on another
- 89408 - [W&A - Critical] The Manager profile page asks the attacker's resolver for the victim's node, and renders the answer under the victim's real ownership and expiry
- 90639 - [W&A - Critical] transfer authorises the raw label moves the normalized label s token
- 90646 - [W&A - Insight] explorer renders an unverified default reverse claim as a verified primary name letting any address assert any ens name e g vitalik eth with a green forward match true
- 89418 - [W&A - Critical] broken access control in the resolver remove user flow leaves a revoked delegate able to redirect the address records of every name on the resolver
- 90647 - [W&A - Critical] v1 v2 migration silently grants a third party address permanent in practice role set resolver over the user s migrated name with the grantee never displayed and no way to re
- 91189 - [W&A - Medium] portal hides resolver cleanup when the seller lacks direct role set resolver leaving a delegate able to redirect the new owner s ens resolution and later transactions
- 90651 - [W&A - Low] unverified email channel lets any authenticated user delete another user s sendgrid contact silently unsubscribing them from ens broadcast email
- 89420 - [W&A - Critical] resolver roles sidebar collapses an account s multiple role resources into one write scope so remove user displays one scope and writes another leaving removed accounts wit
- 90662 - [W&A - Insight] token info page derives the displayed namehash from the idna punycode form of the name showing the node of a different and separately registrable ens name
- 89431 - [W&A - Critical] stale transaction success falsely completes later role revocations leaving resolver authority active
- 91224 - [W&A - Critical] explorer renew transfer encode the on chain write from a normalizing helper while the ownership gate and displayed transaction use the raw name a victim renews or transfers a
- 89433 - [W&A - Critical] transfer flow never resets the transaction manager so a stale step actor from an abandoned attempt is matched by id to the next attempt and the steps before it are skipped whi
- 91233 - [W&A - Low] manager suppresses a cross name avatar header record update and preserves former owner media control
- 90678 - [W&A - Critical] explorer remove user revokes one resolver scope leaving removed accounts with sibling name roles and global upgrade authority
- 89441 - [W&A - Insight] explorer certifies an unverified reverse record as a forward verified primary name
- 91256 - [W&A - Low] Unauthenticated verify endpoint binds a victim's email address to the attacker's ENS account
- 90688 - [W&A - Critical] incomplete role revocation resolver remove user leaves a co manager s global root role in place so a removed user can still set any name s address record and redirect funds
- 91295 - [W&A - Critical] iost only resolver delegate can make manager show and copy its value as the sol receiving address
- 89444 - [W&A - Low] any anonymous caller can drain the faucet hot wallet and hang worker invocations
- 90691 - [W&A - Critical] portal authorizes a raw ensv2 name but transfers the victim s canonical twin nft
- 89445 - [W&A - Medium] one user s bounce or unsubscribe rewrites every other user s channel with the same target
- 91299 - [W&A - Critical] unmapped resolver role becomes global and lets a delegate redirect other ens names
- 89456 - [W&A - Critical] renewal route prices and displays the normalized name but signs the raw label so a crafted url renews an attacker s lookalike name with the victim s funds
- 90693 - [W&A - Critical] the manager profile page reads records from the raw url name and ownership from its ensip 15 name so an attacker controlled address record is rendered under a real name s owner
- 89460 - [W&A - Critical] every ens registration overwrites the previous one s transaction history
- 91306 - [W&A - Critical] explorer s resolver roles editor builds every transaction against a scope it never displays silently granting an account authority over every name a resolver serves
- 90702 - [W&A - Critical] v1 v2 migration silently grants a stale v1 controller role set resolver on the migrated name enabling resolution hijack of an acquired name
- 91314 - [W&A - Medium] explorer builds a user s own name list from an ensjs query whose default relation set includes resolvedaddress so any name an attacker points at a victim s address is listed a
- 89461 - [W&A - Insight] missing cleanup on an interrupted migration leaves a permanent registry wide setapprovalforall on the ens v2 registry exposing every name the wallet owns to theft
- 91318 - [W&A - Critical] portal s remove all roles action revokes only one name leaving a delegate s global resolver authority active
- 90725 - [W&A - Critical] encoded labelhash confusion in portal deletion unregisters a different victim owned subname and enables registrar takeover
- 89462 - [W&A - High] hca registration budget omits the resolver deployment so a first registration is funded short and its commitment cannot be recovered
- 89464 - [W&A - Insight] ens explorer reverse resolution certifies an unverified default reverse name as the verified l2 primary name
- 90749 - [W&A - High] portal reparses a flat dotted label and grants resolver authority on a different ens name
- 91333 - [W&A - Critical] portal s remove user from all roles submits a one resource revocation and leaves the removed delegate s root resolver authority active
- 90755 - [W&A - Medium] cached v1 manager authority is restored as a persistent v2 resolver role during migration
- 90770 - [W&A - Critical] remove user from all roles revokes one resolver scope and leaves address control authority active
- 91335 - [W&A - Critical] portal applies the registry role schema to a permissionedresolver one ordinary registrar add user grant becomes global set address authority
- 90784 - [W&A - Critical] Critical: Portal account-only role grouping collapses resolver scopes, leaving an offboarded collaborator able to redirect ENS resolution
- 91337 - [W&A - Critical] v1 to v2 migration silently grants the v1 registry controller resolver authority over the buyer s name
- 89467 - [W&A - Critical] inconsistent name normalization between the renewal checks and the renewal transaction leads to the user signing a renewal for an attacker controlled name
- 90794 - [W&A - Critical] explorer confirms an uppercase ensv2 transfer but signs the distinct lowercase token id causing direct nft theft
- 89469 - [W&A - Insight] ssrf self host protection bypass in the og image worker leads to temporary denial of service resource amplification of the card preview service
- 91342 - [W&A - Medium] manager resurrects a relinquished v1 manager as a v2 resolver delegate after the pre wallet state check
- 90807 - [W&A - Medium] stale authorization in v1 to v2 manager restoration re grants revoked resolver control enabling ens name hijack
- 90812 - [W&A - Medium] toctou in manager migration installs an attacker resolver and restores former v1 manager authority
- 91345 - [W&A - Critical] resolveaddressorname treats an unresolved v1 manager as a transfer recipient sending a v2 name nft to an unintended address
- 89474 - [W&A - Critical] explorer transfer flow moves a different ens name than the one displayed stealing the victim s name
- 90820 - [W&A - Critical] the manager checks name ownership with one canonicalization function and builds the renewal transaction with another so one invisible character in a url makes a user pay to re
- 91348 - [W&A - Critical] Public Safe ERC-1271 transcript can be redeemed first to steal an ENS seven-day JWT
- 89483 - [W&A - Critical] empty resolvednames falls back to root scope so editing one role row signs grantrootroles over every name on the resolver
- 90843 - [W&A - Critical] portal turns an unresolved name scoped resolver role into root granting resolver wide control over unrelated names
- 91396 - [W&A - Critical] an iost only delegate can replace manager s copied solana recipient without modifying the sol record
- 89507 - [W&A - Critical] remove user on the resolver roles panel revokes only one resource scope leaving listed authority in place
- 89513 - [W&A - Insight] missing markdown escaping in notification worker allows attacker author ens branded telegram message content or silently suppress a victim s expiry warnings
- 90852 - [W&A - Critical] the explorer s irreversible name transfer resolves a recipient name with no address record to its registry controller silently delivering the name to the previous owner while
- 90859 - [W&A - Insight] the explorer s reverse resolution table prints forward match true and a primary name badge for a name it never forward verified letting any address present itself under a
- 91414 - [W&A - Medium] revoked v1 manager can regain resolver control through a stale v1 v2 migration plan
- 90874 - [W&A - Critical] portal authorizes a literal bracket label decoy but changes the resolver of the embedded hash ens name
- 91441 - [W&A - High] an unrelated contract can inject persistent arbitrary text into another name s canonical portal history
- 89516 - [W&A - Critical] v1 v2 migration assigns the migrated name s resolver to a third party and grants them the role that keeps it
- 90883 - [W&A - Critical] the manager renewal flow reads one name and pays for another so a name s owner funds an attacker s registration while their own name is untouched
- 91443 - [W&A - Low] an unsolicited transferred name s one byte abi record indefinitely locks manager s default dashboard
- 89534 - [W&A - Insight] session enable signs attacker authored policy hidden in an opaque salt yielding an effectively permanent attacker keyed session
- 91444 - [W&A - Low] an unsolicited ensv2 name with an oversized coin 121 result blocks the victim s default manager dashboard
- 91446 - [W&A - Low] quadratic primary contact deduplication temporarily locks the victim s manager tab after an unsolicited name transfer
- 90894 - [W&A - Critical] apps portal resolver roles ui remove user revokes only the name scope while confirming removal from all roles the root grant stays active
- 91449 - [W&A - Critical] broken access control multi resource role aggregation in resolver roles management causes incomplete revocation and persistent root level access
- 90896 - [W&A - Critical] apps portal remove user confirms removal from all roles the approved transaction revokes one name scope
- 91450 - [W&A - Low] unbounded links rendering blocks manager navigation for 14 seconds on a gifted name
- 90904 - [W&A - Critical] mis scoped resolver role removal leaves a removed account able to repoint any name the resolver serves
- 91485 - [W&A - Critical] missing ens normalization in the manager renewal flow leads to a victim extending the attacker s name with their own funds
- 90907 - [W&A - Critical] the migration flow silently grants a third party permanent role set resolver over the user s name and destroys the only revocation path in the same transaction
- 90931 - [W&A - Critical] resolver row index reuse carries a removed user s root upgrade permission into another collaborator and enables shared resolver takeover
- 91487 - [W&A - Low] api worker user channels never enforces one verified owner per email target
- 91524 - [W&A - Critical] base58 case folding substitutes the solana copy target
- 91566 - [W&A - Critical] explorer remove user from all roles revokes one name resource and leaves root address authority live
- 91569 - [W&A - Critical] inconsistent ens name normalization displays and copies an attacker controlled address as the victim profile s main receiving address
- 91571 - [W&A - Insight] set primary name in the ens explorer signs setaddr with the address from the url not the connected wallet so an attacker can redirect where any ens name resolves
- 91580 - [W&A - Critical] resolver roles editor writes a scope the admin was never shown defaulting to root
- 91600 - [W&A - Medium] manager executes a cached migration plan after v1 authority revocation restoring the revoked manager and resolver
- 91602 - [W&A - Critical] incorrect privilege assignment in the v1 to v2 migration leads to resolver hijack and loss of funds
- 91615 - [W&A - Medium] queues event ingestion ts idempotency key stamped before the delivery fan out
- 91631 - [W&A - Low] missing token to account binding in the unauthenticated email verification endpoint leads to cross account mailbox binding victim lock out and an email membership oracle
- 91635 - [W&A - Critical] incorrect resolution on the manager profile page displays an attacker controlled receiving address under a legitimate ens name s owner identity
- 91637 - [W&A - Critical] manager profile page renders an attacker controlled receiving address under a genuine name s verified owner identity
- 91640 - [W&A - Critical] bulk renewal signs a different label than the name displayed so the fee renews an unintended name displayed vs signed mismatch
- 91641 - [W&A - Critical] explorer resolver role editor writes grants and revokes to a wrongly derived eac resource so revoking a delegate s permissions silently leaves them in place
- 91645 - [W&A - Critical] wrong field ens ownership resolution in the explorer s recipient input sends name transfers to a v1 name s former controller instead of its owner
- 91648 - [W&A - High] hca funding permit is sized from an unbounded orchestrator quote with no ceiling or cross check
- 91658 - [W&A - Insight] missing forward match verification in reverse resolution lets any address display any ens name as its verified primary name causing users to send funds to the attacker
- 91681 - [W&A - Critical] manager displays the victim s nfc expiry but renews an attacker owned raw nfd ens token
- 91688 - [W&A - Critical] Manager authorizes a canonical-name victim to write to an attacker-owned raw-name resolver
- 91689 - [W&A - Medium] portal direct child route and spoofable resolver authentication substitute an attacker contract as the victim s transaction target
- 91690 - [W&A - Medium] manager migration restores a revoked v1 manager with persistent v2 resolver authority
- 91698 - [W&A - Critical] crafted renew url renews an attacker s look alike name while the page displays the victim s own name and on chain expiry
- 91702 - [W&A - Insight] telegram expiry notifications render an attacker chosen link inside the official ens bot s message
- 91717 - [W&A - Critical] explorer transfer flow moves a different ens name than the ui and wallet prompt display because on chain identity is derived from the normalized label
- 91722 - [W&A - Critical] choosing a primary name claims the ensip 15 normalized twin of the displayed row handing the victim s on chain identity to whoever owns that twin
- 91724 - [W&A - Critical] extending a name from the address page renews the ensip 15 normalized twin while every screen shows the raw indexer name so the fee extends someone else s registration
- 91728 - [W&A - Insight] explorer renders an unverified default reverse claim as a forward verified primary name on every l2 row letting any address be displayed as any ens name
- 91731 - [W&A - Critical] renewal screen displays an expiry date computed from a different ens name than the one the transaction renews
- 91732 - [W&A - Insight] attacker chosen ens text record key is rendered verbatim into the explorer homepage activity feed
- 91757 - [W&A - Critical] resolver role aggregation mis scopes removal and preserves global authority
- 91765 - [W&A - Medium] stale v1 migration state resurrects a revoked manager on v2
- 91768 - [W&A - Critical] remove user from all roles preserves global resolver authority
- 91813 - [W&A - Low] email verification never identifies the requesting wallet so an attacker binds a victim s mailbox to their own account
- 91822 - [W&A - Low] editing the recipient during portal transfer preparation sends the ens name to the replaced address
- 91824 - [W&A - Medium] v1 v2 migration resurrects a revoked legacy manager with fresh role set resolver after the victim reclaims the v1 node
- 91830 - [W&A - Critical] explorer renews a different ens name than it displays the victim pays to extend an attacker s name while their own expires
- 91982 - [W&A - Critical] manager keep v1 migration of a locked custom resolver name freezes record control
- 91834 - [W&A - High] missing resolver ownership validation in the name history query leads to persistent forged content injection on any ens name s history page
- 91838 - [W&A - Critical] migration grants a stale v1 controller a permanent role set resolver on the migrated v2 name letting a third party repoint what the victim s name resolves to
- 91997 - [W&A - Low] manager re authors a prior owner s social records into the recipient s replacement resolver despite a clear old details promise
- 91839 - [W&A - Insight] an attacker gifted v1 name modifies the arguments of the migration transaction set the victim signs adding an approval that would not otherwise be requested and widening a toke
- 92028 - [W&A - Critical] manager renew signs a transaction for a look alike name while the ui shows the victim s real name
- 91848 - [W&A - Critical] Editing a record-scoped resolver delegate silently submits grantRootRoles — authority over every name on the resolver
- 91851 - [W&A - Insight] explorer certifies a victim s wallet as an attacker owned ens name name address offers set primary name for names the visitor has no relationship with
- 92042 - [W&A - Critical] ensv2 migration grants role set resolver on migrated names to a subgraph sourced manager address it never verifies on chain or shows the user resolver hijack
- 91852 - [W&A - Medium] former v1 manager is incorrectly granted v2 resolver authority allowing ens redirection and nft theft
- 92043 - [W&A - Critical] explorer renewal sends renew the ensip 15 normalized label while every rendered string is the raw on chain label the user pays full rent their own name gains zero seconds
- 91855 - [W&A - Critical] Portal treats an unresolved resolver-role scope as ROOT, enabling cross-name resolution hijacking
- 92064 - [W&A - Critical] incorrect eac resource scoping in the resolver role editor leads to an unintended global set addr grant
- 91869 - [W&A - Critical] normalization mismatch between the owner and records queries in the manager profile route displays an attacker s name and address under the victim s ownership causing stealthy
- 92094 - [W&A - Critical] [Critical] Explorer role removal preserves global ROLE_SET_ADDR, enabling post-offboarding ENS address diversion
- 92097 - [W&A - Medium] manager migration resurrects a removed attacker controlled resolver and re grants a relinquished manager role from a stale v1 snapshot
- 91900 - [W&A - Critical] explorer resolves a recipient ens name that has no addr 60 record to the owner of its ens v2 registry entry so one ordinary paid v2 registration by a stranger redirects a nam
- 91909 - [W&A - Critical] grouped resolver role removal signs a single resource revoke leaving a removed delegate able to replace the ens address
- 92105 - [W&A - Insight] explorer prints forward match true and primary name for a default reverse record ens resolution reports as a mismatch
- 91913 - [W&A - Medium] Incomplete KNOWN_PUBLIC_RESOLVERS skip of locked-record safety wipes ETH/text records on Manager v1→v2 Upgrade
- 92108 - [W&A - Insight] unescaped ens name in api worker telegram push notification templates allows markdown injection and a clickable phishing link inside official ens expiry alerts
- 91924 - [W&A - High] manager can display a lower registration total and execute a higher hca spend without reconfirmation
- 92110 - [W&A - High] portal reparses a two dot raw label and authorizes a different four label ens name
- 91925 - [W&A - Low] email verification binds another user s mailbox to the requesting account unauthenticated
- 91931 - [W&A - Medium] Manager migration reauthorizes a revoked V1 manager, enabling resolver hijack
- 92111 - [W&A - Critical] portal authorizes a fullwidth raw ensv2 name but transfers the victim s ascii canonical twin nft
- 91962 - [W&A - Insight] hardcoded true in the explorer s forward match column certifies any address as the verified primary name holder of any ens name
- 92112 - [W&A - Critical] a direct registry url applies registry bit 0 to a resolver and grants address control
- 91967 - [W&A - Critical] ownership check on the wrong name in the explorer transfer flow leads to hijacking of a victim s ens name leaving it inaccessible after the flow
- 91974 - [W&A - Medium] sendgrid webhook resolves notification channels by email alone so a cross user duplicate is not ownership bound when provider events are processed
- 92121 - [W&A - Critical] manager renewal signs a different ens registration from the one the page describes the route parameter is ensip 15 normalized for the expiry it displays and only lower cased f
- 91977 - [W&A - Medium] explorer s v2 transfer never revokes third party roles so a delegate the seller kept can re point the buyer s resolver
- 92128 - [W&A - Critical] inconsistent ens name normalization in the manager profile page renders a trusted name s owner beside an attacker controlled receiving address leading to theft of user funds
- 92155 - [W&A - Critical] renewal flow checks and displays one ens name but signs renew calldata for a different one so the user pays to extend a name they were never shown
- 92156 - [W&A - Medium] usemigrationgasestimate preserves an authority bearing plan after manager revocation restoring a revoked address during v1 to v2 migration
- 92165 - [W&A - Low] unauthenticated verify endpoint binds a victim s email to the attacker s ens account
- 92445 - [W&A - Insight] telegram notification markdown injection via attacker controlled ens name
- 92174 - [W&A - Critical] registration and migration grant resolver global not name scoped root roles that detach the resolver never revokes so a name s seller keeps redirecting the buyer s addr 6
- 92446 - [W&A - Medium] stale v1 migration plan restores revoked manager authority and attacker resolver hijacking an ens name
- 92448 - [W&A - Medium] revoked ensv1 manager regains resolver control when the owner migrates
- 92177 - [W&A - Medium] stale v1 manager snapshot re grants a former manager v2 resolver authority during migration
- 92452 - [W&A - Critical] explorer collapses per name resolver roles by account so remove user leaves a delegate able to redirect another ens name to an attacker controlled address
- 92461 - [W&A - High] Portal registration shows $8.01 for name B, charges 160.109598 USDC for name A
- 92463 - [W&A - High] unbounded eip 2612 permit in planhcaintentfunding lets a hostile intent quote drain the connected wallet s usdc on a transaction whose amount the app never displays
- 92464 - [W&A - Critical] resolver role aggregation causes remove user from all roles to revoke only one resource leaving the delegate able to redirect ens addresses
- 92203 - [W&A - Critical] primary name dialog derives the displayed name and the written name from two different expressions so the confirmed operation writes a reverse record for a different ens node
- 92205 - [W&A - Medium] stale v1 authority cache restores attacker resolver control during ensv2 migration
- 92465 - [W&A - Critical] owner controller role confusion in the explorer s address resolution fallback resolveensowner leads to irreversible transfer of the user s ens name to an unintended recipient
- 92222 - [W&A - Critical] portal remove user leaves root text authority allowing a former delegate to overwrite another owner s profile
- 92466 - [W&A - Medium] unbounded ens description record is emitted twice through a 6x expanding html escaper so one attacker owned name kills the explorer s cloudflare worker isolate for every concu
- 92474 - [W&A - Critical] improper resource binding in portal remove user leaves root resolver authority untouched
- 92475 - [W&A - Critical] a profile url carrying one invisible codepoint renders the victim s verified owner beside an address published by a name the attacker registered
- 92239 - [W&A - Critical] one ticked permission on a record scoped row makes the explorer s roles page sign grantrootroles authority over every name the resolver serves with no scope shown on any sc
- 92481 - [W&A - Low] email channel takeover an unauthenticated verify endpoint finalises a pre bound victim address
- 92483 - [W&A - Critical] migrate to v2 hand your name s resolver to a third party the app never validated
- 92257 - [W&A - Critical] resolver role editor upgrades a name scoped grant to resolver root submitting a broader transaction than the operator selected
- 92489 - [W&A - Medium] apps/manager: migration grants ROLE_SET_RESOLVER to a revoked V1 manager
- 92263 - [W&A - Medium] a seller who keeps the resolver on a name transfer keeps root authority over the sold name and can repoint it at their own address after the sale
- 92494 - [W&A - Low] apps/portal: transfer encodes a cached ENS resolution as the recipient
- 92503 - [W&A - Medium] stale v1 manager cache re grants a revoked manager during v2 migration
- 92278 - [W&A - Critical] Both renewal routes prove one ENS name is renewable and then bill the user to renew a different one
- 92509 - [W&A - Medium] revoked manager regains resolver control during v1 to v2 migration
- 92510 - [W&A - Critical] portal authorizes an attacker gifted raw nfd name but transfers the victim s distinct nfc erc 1155 name token
- 92517 - [W&A - Medium] same key record replacement is serialized deletion last causing portal to expose a revoked delegate s address as the base recipient
- 92522 - [W&A - Critical] unconditional owner fallback in explorer name resolution leads to the app resolving a record less ens name to its owner an attacker controlled address pre filled into the nam
- 92283 - [W&A - Insight] notification templates interpolate an ens label with no escaping a third party can plant persistent text in another user s manager inbox with no interaction by that user and a
- 92527 - [W&A - Critical] The Explorer's resolver-roles editor writes a scope the administrator never chose: narrow grants are signed as resolver-wide (ROOT), and "remove from all roles" leaves ROOT sta...
- 92300 - [W&A - Critical] portal lists an attacker owned name under names you own in place of the user s own and transferring it transfers the user s real name instead
- 92535 - [W&A - Critical] portal row reuse can grant one resolver delegate another account s upgrade role
- 92597 - [W&A - High] hca registration checkout can display exact rent while a recovered quote authorizes a larger wallet debit
- 92305 - [W&A - Low] email verification rate limiter runs after the rows it should gate and is keyed on the target address so any account can burn a chosen email s hourly quota and block that person fr
- 92540 - [W&A - High] the explorer s role history panel identifies a name by its label hash alone and never by the registry that holds it
- 92307 - [W&A - Insight] dos on api worker from insufficient transaction payload validation
- 92542 - [W&A - Medium] explorer s roles editor revokes role can transfer admin in a remove user whose only warning describes a different consequence freezing the name for the rest of its registrat
- 92602 - [W&A - Critical] explorer causes a connected wallet to grant a delegate resolver control over every name instead of one
- 92544 - [W&A - Low] explorer s name page asserts you are the owner of name and a paid figure taken verbatim from the url query string on any name for any visitor beside an ownership free button
- 92605 - [W&A - Critical] merged resolver role removal revokes one scope while leaving root record write authority
- 92341 - [W&A - Medium] manager restores v2 resolver authority to a v1 manager removed before confirmation
- 92545 - [W&A - Critical] removing a resolver user leaves root upgrade authority intact
- 92345 - [W&A - Critical] attacker can register a name s normalized twin to redirect the owner s bulk renew payment and let their name expire
- 92608 - [W&A - Medium] explorer checkout shows a 0 00 total deletes the approval step and the registrar charges the full rent price the user was never shown
- 92546 - [W&A - Insight] explorer s name page asserts you are the owner of name and a paid figure taken verbatim from the url query string on any name for any visitor beside an ownership free bu
- 92352 - [W&A - Critical] portal says it removed all roles but sends a one name revoke
- 92552 - [W&A - Critical] portal remove user from all roles revokes only one resolver scope the surviving scope permits a profile description write that remains after role cleanup
- 92609 - [W&A - Medium] stale v1 controller snapshot grants a revoked controller v2 resolver authority during migration
- 92353 - [W&A - Critical] raw unicode name causes portal to transfer the victim s different canonical ens token
- 92553 - [W&A - Insight] explorer home page recent activity shows unverified reverse record names as genuine ens names persistent content injection
- 92611 - [W&A - Medium] stale v1 resolver snapshot migrates an attacker controlled resolver after v1 recovery
- 92555 - [W&A - Critical] name transfer never revokes the seller s resolver roles letting the former owner rewrite the buyer s eth address record and redirect resolution to an attacker name hijack a
- 92361 - [W&A - Insight] missing transaction history storage limits allow one authenticated user to exhaust shared database capacity
- 92616 - [W&A - Critical] explorer resolves a typed ens name to a previous owner and builds the wrong recipient transaction
- 92559 - [W&A - Critical] explorer reuses a former owner ens resolution and encodes the wrong recipient in an ensv2 nft transfer
- 92373 - [W&A - Medium] same id migration refresh retains removed resolver authority in an executable plan
- 92618 - [W&A - Medium] revoked v1 manager receives persistent ensv2 resolver control from an already prepared migration
- 92564 - [W&A - Critical] apps/portal: Remove user revokes only the root grant it promised to clear entirely
- 92622 - [W&A - Critical] an unmappable name scoped resolver role becomes a resolver wide root grant signed by the victim
- 92398 - [W&A - Medium] unscoped replay unprotected sendgrid webhook over duplicate email rows lead to silent cross user disabling of ens email notifications
- 92565 - [W&A - Critical] the explorer s extend flow renders the raw indexer name on every surface but signs the ensip 15 normalized label so a renewal reached from the address names table pays to exte
- 92623 - [W&A - Medium] registry wide role event cap hides a retained delegate and enables post transfer resolver and subregistry hijacking
- 92408 - [W&A - Low] email verification endpoint has no authentication letting an attacker bind a victim s email address to the attacker s account
- 92568 - [W&A - Critical] profile editing authorizes the normalized name but encodes the raw route param so a crafted url makes the victim sign a record write to an attacker s node on an attacker s res
- 92411 - [W&A - Critical] incorrect labelhash resolution in portal leads to deletion of other unintended ens subnames and resolving hijacking of unintended
- 92570 - [W&A - Critical] set primary name writes its forward legs against the raw name and signs the reverse leg against the normalized name so one click points the victim s reverse record at a name t
- 92625 - [W&A - Medium] stale v1 registry state restores a revoked manager and resolver during v1 to v2 migration
- 92413 - [W&A - High] unpinned warp settlementlayers and dest only 0x03 session policy lead to direct theft of hybrid custody account funds
- 92572 - [W&A - Critical] ensv2 registration applies no ensip 15 normalization at any step so a crafted url prices displays and registers a label the user cannot see and that ens does not consider par
- 92626 - [W&A - Critical] manager bulk renewal renders the raw indexer name on every row and signs the normalized label so the victim s stablecoins extend a registration that appears nowhere in the dialog
- 92416 - [W&A - Critical] mixed case transfer route sends the lowercase sibling ens nft
- 92632 - [W&A - Critical] a resolver role row whose scope the ui cannot resolve is saved as a root grant so one click on a single account s row signs grantrootroles over every name on the resolver
- 92578 - [W&A - Medium] notification channel state is read and written by target address alone with no user id predicate over a schema that deliberately allows the same target on multiple accounts
- 92429 - [W&A - Critical] the explorer s remove user filters the root scope out of the resource it revokes so an account the operator removed keeps write authority over the address record of every na
- 92635 - [W&A - Insight] the explorer offers set primary name based on a record the attacker controls and never checks name ownership so one click on a link replaces the victim s primary name with a
- 92581 - [W&A - Critical] the explorer names the ensv1 registry controller as a name s owner so a seller who has already handed over the nft is still shown as the owner on the official ens explorer
- 92439 - [W&A - Insight] unescaped ens name in telegram expiry notification template enables persistent markdown link injection reaching third party users
- 92583 - [W&A - Low] post notifications channels email verify ships with no requireauth and re checks nothing so one click on a genuine ens email transfers a victim s address to an attacker s account
- 92584 - [W&A - Critical] explorer s resolver role table omits role set data so remove user throws for every account the registration flow provisions and otherwise leaves write access the roles table r
- 92648 - [W&A - Medium] the explorer certifies a resolver as official audited and considered secure from a storage word any contract can forge and the same forged bit replaces the record edit owners
- 92585 - [W&A - Medium] explorer certifies any contract as the official audited ens permissioned resolver from a single storage word the contract writes itself
- 92649 - [W&A - Medium] improper record deduplication in the portal silently deletes a reviewed base address and resolves the ens name to an attacker controlled fallback
- 92586 - [W&A - Low] one ens text record keyed on an object prototype member permanently replaces a name s manager profile page and the edit dialog inside it with an error screen
- 92651 - [W&A - Critical] explorer transfer resolves an ens recipient to the name s v1 controller rather than its owner sending the user s name to a party that does not own the name they addressed
- 92587 - [W&A - Critical] explorer s resolver permission editor keys its checkbox state to the table row index so re opening a row position grants the previous occupant s permissions to a different acc
- 92588 - [W&A - Critical] transfer ownership signs the token id of getlabel name while every screen shows the raw route param so the name that leaves the victim s wallet is not the name the flow displ
- 92658 - [W&A - Critical] manager migration grants a former v1 controller resolver authority over the buyer s v2 name
- 92591 - [W&A - Critical] manager reads the profile with ensip 15 and writes the renewal with tolowercase so a crafted link makes the victim s own profile suppress the third party renewal warning and
- 92661 - [W&A - Medium] missing ownership check in the sendgrid webhook s channel lookup lets any account silently disable another person s verified ens email notifications permanently
- 92593 - [W&A - Critical] explorer s extend flow charges the user to renew a stranger s ens name instead of the one shown
- 92665 - [W&A - High] manager does not bind orchestrator returned hca registration calldata to the requested calldata allowing an attacker controlled subregistry on a victim owned root name
- 92596 - [W&A - Medium] manager v1 v2 migration restores a removed v1 manager as persistent v2 resolver authority hijacking the name s resolver
- 92779 - [W&A - High] Owner-signed HCA intents are signed from the orchestrator's returned intent with no execution-equivalence check, on the client or on chain
- 92782 - [W&A - Critical] registration and renewal write an on chain node that no compliant client resolves
- 92685 - [W&A - Medium] stale v1 resolver state in manager migration restores an attacker controlled resolver and hijacks the migrated ens name
- 92792 - [W&A - Low] any account can exhaust the email verification rate limit for an address it does not own blocking that address s verification for an hour
- 92695 - [W&A - Medium] setupcontrolledresolver intent underfunding and session key policy reversion prevents controlled resolver deployment and profile setup in manager
- 92794 - [W&A - Critical] manager s bulk renew dialog substitutes a normalized lookalike for the victim s real registered label letting a victim s own connected wallet pay to renew an attacker s name
- 92699 - [W&A - Critical] a role scope the app cannot resolve is granted on every name instead
- 92796 - [W&A - Insight] unverified default reverse is falsely labelled forward match true and primary name on inherited l2 rows
- 92806 - [W&A - Critical] resolver role removal silently leaves role set data authority on chain
- 92701 - [W&A - Insight] missing escaping in the notification worker lets a registered ens label inject markdown into official ens notifications placing an attacker chosen link inside messages delivere
- 92706 - [W&A - Insight] telegram markdown injection in notification delivery unescaped ens name enables phishing via the official notifications bot
- 92713 - [W&A - Critical] a phishing link renews the attacker s own junk registration with the victim s money while manager displays the victim s real name
- 92816 - [W&A - Medium] the expiry discovery cron s non unique timestamp cursor pagination permanently and silently drops names tied at a page 1000 boundary from every expiry notification
- 92714 - [W&A - Critical] resolver remove user silently no ops root scoped roles enables persistent ens name resolution hijack
- 92817 - [W&A - Critical] missing label validation in the portal s change resolver flow leads to resolver hijack of a different real ens name
- 92716 - [W&A - Critical] index based row identity in portal s resolver roles table lets an admin s stale draft silently grant a global resolver role to an uninvolved account
- 92818 - [W&A - Critical] missing label validation in the portal s configure registry flow leads to subregistry detachment of a different real ens name
- 92718 - [W&A - Medium] portal s v1 bulk renewal table treats resolves to me as owned by me letting a victim s own connected wallet pay to renew an attacker s name
- 92820 - [W&A - Critical] explorer remove user save on a resolver operator revokes a single scope while the row aggregates root and name scopes so root level roles survive a remove this user fr
- 92719 - [W&A - Insight] a gifted ens name with a crafted label injects persistent attacker controlled markdown into a victim s real telegram expiry alert notifications
- 92723 - [W&A - Medium] missing ccipread guard in the explorer s og image worker client lets an attacker controlled resolver drive unbounded server side requests exhausting the worker s rpc provider
- 92825 - [W&A - Medium] missing registry scoping in the role history query lets anyone write permanent forged role change entries into any ens name s audit trail
- 92828 - [W&A - Medium] stale manager state restores a revoked account that hijacks the migrated ens resolver
- 92738 - [W&A - Critical] resolver remove user from all roles revokes only one scope leaving global address hijack authority active
- 92739 - [W&A - Low] portal transfer step id reuse redirects an ens name recipient transfer to the former address
- 92836 - [W&A - Medium] payment token picker silently treats a failed price read as 0 hiding insufficient balance and skipping the real approval amount
- 92740 - [W&A - Critical] missing ensip 15 normalization on the manager s name route splits one profile page across two ens nodes rendering an attacker controlled address beside the real owner and
- 92837 - [W&A - Insight] safe owner removal does not revoke the ens api session they created
- 92746 - [W&A - Critical] ens explorer s remove user from all roles leaves active address control permission on another name
- 92838 - [W&A - Medium] toctou in manager v1 to v2 migration reinstalls a replaced attacker controlled resolver and hijacks an ens name
- 92752 - [W&A - Critical] removing a resolver user revokes only one resource and leaves root or other name authority active
- 92840 - [W&A - Critical] explorer s renewal builder substitutes the name it signs the user pays to renew a different ens name than the one displayed
- 92753 - [W&A - Critical] incomplete revocation in the resolver user removal flow retains resolver root authority leading to theft of user funds via payment address redirection
- 92842 - [W&A - Critical] a name scoped role grant gives a limited registrar root resolver authority
- 92761 - [W&A - Critical] inconsistent ens normalization makes manager submit an attacker owned label in a victim approved renewal
- 92850 - [W&A - Critical] two conflicting ens name derivations on the manager s renewal page cause the victim to pay to extend an attacker s registration instead of the name shown on screen
- 92859 - [W&A - Critical] Unresolved name-scoped resolver role is converted into a root grant, enabling unauthorized record changes for unrelated names
- 92762 - [W&A - Critical] late ens normalization makes the portal detach and transfer a different name than the transfer page authorizes
- 92764 - [W&A - Critical] encoded label recipient names select an attacker owned literal label but query the honest hash only node redirecting portal name transfers
- 92951 - [W&A - Medium] Missing on-chain validation in ENS migration lets a third party hijack the resolver of a user's name
- 92954 - [W&A - Insight] unauthorized profile image change upload does not verify signer ownership
- 92771 - [W&A - Critical] portal treats a factory verified userregistry as a permissionedresolver so set pubkey grants registry wide unregister
- 92955 - [W&A - Critical] scope substitution in the resolver role editor converts an unresolvable name scoped role into a resolver root grant giving unintended global authority over every name on the r
- 92868 - [W&A - Low] unauthenticated notifications channels email verify grants authority by bare token possession cross user email channel hijack and permanent victim lockout
- 92773 - [W&A - Critical] unresolved resolver scopes turn scoped set address edits into resolver wide grants
- 92961 - [W&A - Insight] portal falsely marks an unverified inherited reverse name as a verified primary name
- 92870 - [W&A - Medium] case folded role name lookup in the manager profile leads to persistent injection of third party ens names on any address s public page
- 92775 - [W&A - Critical] manager renders a lookalike ens name with the victim s identity above the attacker s receiving address
- 92877 - [W&A - Critical] ens explorer s remove user action can leave global resolver permissions active
- 92963 - [W&A - Critical] cross name profile state makes a description only save set an attacker address on another ens name
- 92778 - [W&A - Medium] manager accepts an attacker controlled subregistry as a completed hca registration after the intended reveal fails
- 92964 - [W&A - Medium] manager migration can restore a revoked v1 manager s permission to change the resolver
- 92878 - [W&A - Insight] persistent markdown content injection into telegram expiry notification messages via an unsanitized ens name label
- 92880 - [W&A - Critical] explorer transfers a user s ensv2 name to a separate address the seller selected before the sale
- 92966 - [W&A - Low] deleting an unverified email channel can remove another user s sendgrid contact
- 92967 - [W&A - Critical] the manager checks name ownership on one node and writes to another
- 92885 - [W&A - Medium] stale v1 manager is encoded as the nested v2 grantroles recipient after a same id refresh
- 92971 - [W&A - Critical] manager falsely confirms a canonical ens renewal while extending an attacker owned raw unicode name
- 92887 - [W&A - Critical] incomplete mixed resolver role removal leaves a former delegate able to change an ens address record
- 92976 - [W&A - Medium] stale v1 manager state during ensv2 migration resurrects former manager resolver authority and enables name hijacking
- 92977 - [W&A - Medium] missing registry filter in userolehistory lets any user plant fake role grants in another name s explorer history panel
- 92978 - [W&A - Critical] portal transfer flow authorises ownership of one ens node and then executes irreversible writes against a different one
- 92890 - [W&A - Critical] high manager authorizes record edits via the resolver s stale internal roles instead of registry ownership a name s previous owner keeps full write access incl the coins
- 92892 - [W&A - Critical] remove user revokes only ui recognized role bits and can leave official authority active
- 92979 - [W&A - Insight] telegram authentication accepts future dated auth date values
- 92893 - [W&A - Low] live ens recipient refetch changes the undisclosed owner of a new subname
- 92986 - [W&A - Insight] ens worker allows telegram markdown injection
- 92899 - [W&A - Medium] stale v1 resolver snapshot during migration reinstalls a removed attacker operated resolver
- 92988 - [W&A - Medium] missing live v1 owner check re grants resolver control to a revoked manager during migration
- 92990 - [W&A - Critical] cross account receipt reuse skips resolver role revocation and makes portal render an attacker controlled ens address
- 92902 - [W&A - Critical] portal treats an empty eth record as a v1 controller resolution and transfers to the wrong recipient
- 92905 - [W&A - Low] live resolver access refetch changes replace continue into a transaction to the previous owner s resolver
- 92993 - [W&A - Critical] explorer send name checks the name in the url and signs away the owner s real name
- 92908 - [W&A - Medium] historical resolver provenance check reattaches attacker upgraded code during profile editing
- 93056 - [W&A - Medium] migration replays attacker controlled records from a removed cached v1 resolver into the authoritative v2 resolver
- 92909 - [W&A - Medium] migration reuses uncleared resolver state and activates a revoked delegate s attacker address
- 92995 - [W&A - Medium] a contact tab discord edit republishes inherited social handles through manager s resolver replacement
- 92912 - [W&A - Medium] any address can replace the rendered history of any ens name
- 92996 - [W&A - High] portal s symbol collision preserves a prior owner s base address when a canonical row is deleted
- 92913 - [W&A - Medium] A keep-resolver sale strands the sold name under the seller's resolution control -- and if the seller burns the resolver role first, no one can ever undo it
- 92997 - [W&A - Medium] missing factory check in the permissioned resolver lookup lets any contract get ens s audited and considered secure badge on its page and og card
- 93060 - [W&A - Low] attacker initiated verification binds a victim email to the attacker
- 92914 - [W&A - Critical] missing ensip 15 normalization check on the primary name render path lets an attacker s address be displayed as another party s name
- 93001 - [W&A - High] any contract can write persistent fabricated rows including a forged set address to 0xattacker into any ens name s history page the v1 history query has no resolver provenan
- 92925 - [W&A - Critical] the manager profile page normalizes the name for the owner query but not for the records query resolving an ens name to an attacker controlled address
- 92934 - [W&A - Medium] Unauthenticated server-side egress from the ENS Portal Worker via EIP-3668 CCIP-Read leads to ressource exhaustion
- 93006 - [W&A - Medium] medium portal registration checkout fails open on a single transient price read failure the ui freezes at 0 00 and drops every approval step while the machine charges the li
- 92944 - [W&A - Critical] recipient resolution returns a different address than every conformant ens client sending an irreversible name transfer to whoever registered a look alike name
- 93008 - [W&A - Medium] recipient controlled transfer failure leaves ens resolution attacker controlled and diverts payments
- 93073 - [W&A - Critical] explorer remove user on a resolver role holder with root plus named roles only revokes one named scope leaving the root role active
- 92945 - [W&A - Critical] renew name displays the victim s expiry but signs renew for the attacker s label the victim pays to extend someone else s name
- 93079 - [W&A - Medium] a stale manager migration plan can restore a former owner s attacker controlled resolver
- 93010 - [W&A - Critical] profile page reads ownership and records from two different names so a look alike name displays an attacker controlled receiving address
- 93080 - [W&A - Critical] Improper resolver-role grouping causes incomplete revocation and attacker-controlled ENS resolution
- 92949 - [W&A - Critical] explorer remove user revokes only one resolver scope and leaves global address write authority active
- 93016 - [W&A - Critical] manager and explorer transact the normalized twin of the displayed ens name so a renewal pays to extend an attacker s registration and a transfer moves the wrong name and th
- 93081 - [W&A - Critical] resolver roles sidebar coerces an un invertible resource hash to the empty string which the save path reads as root so an operator scoping a grant to one name silently grants
- 93084 - [W&A - Critical] renewal flow signs a paid transaction against a different ens name than the one it resolves gates and displays
- 93018 - [W&A - Critical] raw cased profile url renders the real owner over an attacker resolver s address
- 93089 - [W&A - Low] sendgrid webhook matches events to the first channel row with that email so a pre registered pending duplicate absorbs another user s unsubscribe or bounce
- 93019 - [W&A - Medium] ens manager regrants a revoked v1 manager during migration enabling resolver hijack
- 93090 - [W&A - Critical] explorer send name resolves a recipient ens name with no address record to the name s registry owner instead of failing
- 93021 - [W&A - High] swallowed budget quote failure makes the registration checkout show the rent as an exact total while the machine sizes the funding permit from the full budget so the user approves
- 93093 - [W&A - Critical] A pending role grant can be relabelled with a trusted recipient while retaining attacker calldata
- 93024 - [W&A - Insight] stale worker jwt lets a removed safe owner modify successor notifications and read their email
- 93026 - [W&A - Critical] a name sent with the portal s default plan bricks every third party subname beneath it and the name s new holder can re mint those labels to an address of their choosing
- 93096 - [W&A - Medium] missing manager revalidation during v1 v2 migration grants resolver control to a revoked manager
- 93029 - [W&A - High] manager writes l2 address records to mainnet derived coin types while the explorer reads sepolia derived ones so all five l2 rows render the owner s coin 60 address and a sender s
- 93030 - [W&A - Critical] broken scope derivation in the portal resolver roles editor leads to resolving ens names to an attacker controlled address
- 93099 - [W&A - Critical] resolver roles the sidebar displays one permission scope and signs a different one
- 93031 - [W&A - Low] missing cross user authorization on the email channel verify endpoint lets an attacker bind any third party s email to their own ens account disabling that user s own notifications
- 93103 - [W&A - Critical] deleting a resolver delegate can grant an unselected address record role to the next delegate
- 93032 - [W&A - Medium] stale v1 manager snapshot restores revoked resolver authority during migration
- 93104 - [W&A - Low] any authenticated user can bind a stranger s mailbox to their own ens account with one click and lock the real owner out of email notifications
- 93033 - [W&A - High] apps portal s address history page trusts unconsented on chain ownership anyone can plant attacker authored history and a forged from address on any address s page including a
- 93106 - [W&A - Medium] stale subgraph state in the manager s v1 to v2 migration flow re grants resolver control authority to an ensv1 manager the registrant already revoked
- 93040 - [W&A - Medium] stale ensv1 manager restoration during migration grants a revoked attacker ensv2 resolver control
- 93109 - [W&A - Low] missing per user scoping in the email verification rate limit lets any signed in account lock another user out of adding their email to notifications
- 93042 - [W&A - Medium] migration resurrects a revoked v1 manager from stale indexed state
- 93111 - [W&A - Critical] ens falsely shows a victim as owner of an attacker s v1 name via unconsented setowner suppressing the third party renewal warning so the victim pays to renew the attacker s name
- 93043 - [W&A - Critical] erc1271 signature mode confusion lets a bounded hca session drain the account s refund token
- 93112 - [W&A - Critical] unresolved resolver role resource becomes a root grant
- 93044 - [W&A - Critical] the v1 v2 migration automatically grants role set resolver on the newly migrated v2 name to the legacy v1 registry controller an address that is by construction never the
- 93115 - [W&A - Critical] manager renew route the victim pays to renew an attacker s name and their own lapses
- 93045 - [W&A - Critical] explorer resolves a recipient ens name to the ens v1 registry controller so a retained controller name silently redirects name transfers subname ownership and role grants t
- 93046 - [W&A - High] unchecked registration subregistry lets an hca session signer retain control of victim owned subnames
- 93116 - [W&A - Critical] after abandoning alpha and switching portal to bravo the surviving registration actor later submits register alpha while portal displays bravo
- 93049 - [W&A - Critical] missing resolver contract type validation turns record role delegation into registry wide name theft
- 93118 - [W&A - Critical] missing ensip 15 normalization on the register and renew write paths lets an attacker redirect a victim s renewal payment to a name the attacker owns
- 93051 - [W&A - Medium] default clean transfer preserves a prior resolver delegate allowing the recipient s ens name to be hijacked
- 93119 - [W&A - Critical] transfer flow authorizes one ens name and signs transactions for a different one
- 93053 - [W&A - Medium] failed per token price read renders a selectable 0 00 quote skips the approval leg and the amount less renew silently charges the live price against the standing 2x allowance
- 93121 - [W&A - Critical] renewal flow signs a paid transaction against a different ens name than the one it resolves gates and displays
- 93124 - [W&A - Low] an unauthenticated attacker can recover a victim s siwe nonce verbatim and burn it before any verification locking the victim out of login
- 93125 - [W&A - Low] missing authorization in the notifications channel delete handler s broadcast cleanup lets any authenticated user delete another user s sendgrid marketing contact config gated
- 93127 - [W&A - Critical] ens manager profile page reads ownership from the normalized name and records from the raw url name letting an attacker show their own receiving address on a victim s profile
- 93128 - [W&A - High] manager hca quote failure can authorize more usdc than the exact wallet total shown at checkout
- 93129 - [W&A - Critical] stale role state tied to the row position in the resolver roles sheet quietly adds root role set addr to a grant so ens names resolve to an attacker controlled address
- 93130 - [W&A - Medium] a stale manager migration plan can restore a former owner s attacker controlled resolver
- 93132 - [W&A - Medium] explorer stamps a verified forward match true primary name badge on an unverified default reverse name so any address displays a name it does not own as its confirmed prima
- 93133 - [W&A - Medium] Stale V1 migration state restores a revoked manager and attacker resolver in ENSv2
- 93135 - [W&A - Critical] Unresolved record-part role rows silently grant global resolver authority
- 93137 - [W&A - High] charged vs displayed divergence on the hca registration checkout on a failed budget quote the screen shows the rent 8 but the funding permit charges the full budget 20 20