Squeekchain · Sepolia
","title":"Header brands the page 'Squeekchain · Sepolia' although the served game never touches Squeekchain or any chain, and the footer 'Squeekchain invite' is the author's referral code"},{"citation":"resolved","description":"index.html loads only mill.js (which imports economy.js, worker.js and hash.js). game.js (an earlier settlement-driven variant that polls api.squeekchain.com) and rules.js are dead in the export, game.js line 845 loads 'burrow-room.jpg' which is not in the repository, and game.js addresses element ids (tab-live, actions, pages, clock, reveal) that index.html does not contain, so it would throw if ever loaded. server.mjs is the local-only backend and brief.json is the build brief. None of these are harmful to host: I read all of them and they contain no wallet prompts, no remote code loading, no obfuscation. They are extra bytes that reveal an abandoned design and a backend route map. Advisory: drop them from the pinned export.","line":63,"path":"index.html","reproduction":"Run `grep -n \"game.js\\|rules.js\\|server.mjs\\|brief.json\" index.html mill.js economy.js worker.js hash.js`: expected a reference if these files were served content; actual no matches. Run `ls burrow-room.jpg`: expected the file game.js line 845 requests; actual 'No such file'.","severity":"low","snippet":" ","title":"Export ships unused scripts and a Node server: game.js, rules.js, server.mjs, brief.json are not referenced by index.html, and game.js points at a missing image"},{"citation":"resolved","description":"brief.json (line 4) asks for a game whose ore is booked only from system.settlement_completed events on the Squeekchain API, with caps of 5, costs of 5/10/20/40/80 and 8/16/32/64, a hand crank, a wheel easing to the live RPM, and an English footer reading 'Burrowkeep is a mill beside the real wheel. Upgrades do not make Squeektoshi run. Testnet only.' The served mill.js instead mints ore from local SHA-256 hashes (economy.js mintOre), caps at 8 (economy.js line 1), prices 12*2^n and 18*2^n (economy.js lines 20-21), has no hand crank, draws a wheel driven by the visitor's own hashrate (mill.js line 807), and its footer omits 'Testnet only'. This matters to the requester, who commissioned the review against their own brief, not to hosting safety. Advisory.","line":121,"path":"mill.js","reproduction":"Toggle the page to English and read the footer. Expected per brief.json: 'Burrowkeep is a mill beside the real wheel. Upgrades do not make Squeektoshi run. Testnet only.' Actual: the line quoted in the snippet, with no 'Testnet only'. Open the Care tab: expected hamster upgrade cost 10 at level 1 per the brief; actual 12 (economy.js line 20).","severity":"low","snippet":" footer: \"Burrowkeep hashes SHA-256 on this tab's CPU only after you press start. The invite pays 5% of a friend's booked ore, minted extra. It does not make Squeektoshi run.\",","title":"Footer and mechanics diverge from brief.json: no 'Testnet only' line, and ore is CPU-hashed instead of booked from settlement events"},{"citation":"resolved","description":"The power-button handler catches any exception from startMiners/stopMiners and writes the raw error stack into the on-page note element. On a static host the visible stack would include the gateway URL and module paths. Cosmetic, no security impact; a short localized message would be cleaner.","line":997,"path":"mill.js","reproduction":"In DevTools run `Worker = undefined` then press '开始挖矿'. Expected: a friendly failure message. Actual: the note line under the shop shows 'TypeError: Worker is not a constructor' followed by a multi-line stack with file URLs.","severity":"info","snippet":" $(\"note\").textContent = String(error && error.stack || error);","title":"Uncaught start/stop errors are printed with their stack trace into the visible note line"},{"citation":"resolved","description":"POST /api/board accepts any 8-32 character alphanumeric minerId with a gold and decor value, creates a miner row if missing (line 128), and ranks it. The only brake is a per-id growth cap over time (lines 134-144), so a client can register unlimited fresh ids with 50 gold each and fill both top-8 boards. Likewise POST /api/pulse credits referral bonus for any ore count a client claims. This server is bound to 127.0.0.1 and is not part of the static IPFS export, so it does not affect hosting. Noted for the requester.","line":118,"path":"server.mjs","reproduction":"With `node server.mjs` running: `for i in 1 2 3 4 5 6 7 8; do curl -s -XPOST localhost:8765/api/board -d \"{\\\"minerId\\\":\\\"spoof000$i\\\",\\\"gold\\\":50,\\\"decor\\\":80}\"; done; curl -s localhost:8765/api/board`. Expected: only ids that have said hello and mined appear. Actual: the wealth board is eight 'spoof' rows at 50 gold each.","severity":"info","snippet":" if (url.pathname === \"/api/board\" && request.method === \"POST\") {","title":"server.mjs leaderboard endpoint trusts any minerId and score with no authentication (only relevant if the Node server is ever deployed)"}],"hash":"624b9bd52bf76cbf81ea0b726becf046c2dcec9abcd4c50c4c3ebf66ea3894fb","nodeId":"ea7d4626-3997-46e6-bfd5-27e5a6ed436f","outcome":"completed","summary":"The review is done and the findings file is written and validated. Nothing blocks hosting.\n\n**Verdict: no critical or high findings.** I read every file in the export: index.html, styles.css, mill.js, economy.js, worker.js, hash.js, game.js, rules.js, server.mjs, brief.json. There is no wallet or seed-phrase prompt, no signature or approval request, no remote code loading, no hidden iframe or redirect, no obfuscation, no third-party tracking, and no logo or claim of being Squeekchain itself. The only outbound requests the served page makes are to its own origin.\n\n**What I reported** in `.imd-findings.json` (seven entries, all medium or below):\n\n- **Medium: invite rewards and leaderboards are dead on IPFS.** The page calls four same-origin API routes that exist only in the Node server bound to localhost. On a static host they 404, so the advertised 5% friend bonus and both boards never work. Ore has no monetary value, so this is a broken feature, not a deceptive financial claim.\n- **Low: opt-in SHA-256 hashing on up to 8 visitor threads.** I checked this against the cryptominer pattern and it does not meet it. No pool, no share submission, nothing leaves the tab, and it runs only after the visitor presses start, with disclosure in the lede and footer. Noted so the hoster knows the site burns CPU by design.\n- **Low: header says \"Squeekchain · Sepolia\"** while the served game never contacts Squeekchain or any chain. The footer \"Squeekchain invite\" link is the author's personal referral code on that third-party site. Honestly labelled, so advisory.\n- **Low: unused files in the export.** An earlier settlement-driven game, its rules module, the local server and the brief all ship but are not loaded, and the dead script points at an image that is not in the repository.\n- **Low: divergence from the brief.** The footer lacks \"Testnet only\", prices and caps differ, and ore comes from CPU hashing rather than settlement events.\n- **Info:** a raw stack trace is printed into the UI on start failure, and the local server's leaderboard endpoint accepts unauthenticated scores.\n\nEvery finding's path, line and snippet were checked against the tree and match. No repository files were changed other than creating the findings file.","treeHash":null,"usage":{"cachedInputTokens":438699,"inputTokens":194,"model":"claude-fable-5-1","outputTokens":12717,"runtime":"claude","turns":19,"wallClockMs":184400}}],"verification":[]}