{
  "projectId": "donut",
  "title": "Donut｜跟随同意与交易账户准备",
  "summary": "实际业务模块区分跟随条款确认、Hyperliquid 代理账户准备和原始订单；账户准备完成后，界面要求回到原始操作。",
  "scope": "d0.getdonut.ai 公开发布的跟随同意、Hyperliquid 代理账户准备、复制目标三个业务模块；REA 成功解析 3 个文件，静态分析。",
  "status": "partial",
  "analyzedAt": "2026-10-13T10:58:48.460669+00:00",
  "tool": {
    "name": "REA",
    "version": "6.4.0"
  },
  "findings": [
    {
      "title": "跟随条款记录版本与内容指纹",
      "detail": "useFollowConsent 分别提交 viewed 和 accept，载荷包含 termsVersion、contentSha256、已确认章节与时间信息。它是跟随协议确认记录的客户端实现，不能等同于钱包签名或服务端资金授权。",
      "evidenceType": "observed",
      "evidenceIds": [
        "ev_cfd7c61e3f199e608fb5471c911890a12d285cae8a4d3ac9f74d1c3980fb663f"
      ],
      "sourceUrls": [
        "https://d0.getdonut.ai/js/strategyCopyTrade-DEltpZL0.js",
        "https://d0.getdonut.ai/js/useFollowConsent-DsQsq0tD.js"
      ]
    },
    {
      "title": "账户准备采用受限动作与状态检查",
      "detail": "hlAccountSetup 只接受 delegated-agent 下的一组 GET/POST 动作，并检查 generation、network 及 rotate/revoke 参数。代码会区分 pending_confirmation、canary_ready、active，完成准备后提示返回原订单，不在该模块自动重放订单。",
      "evidenceType": "code_inference",
      "evidenceIds": [
        "ev_cfd7c61e3f199e608fb5471c911890a12d285cae8a4d3ac9f74d1c3980fb663f"
      ],
      "sourceUrls": [
        "https://d0.getdonut.ai/js/strategyCopyTrade-DEltpZL0.js",
        "https://d0.getdonut.ai/js/useFollowConsent-DsQsq0tD.js"
      ]
    },
    {
      "title": "复制入口未必代表已经下单",
      "detail": "strategyCopyTrade 将目标分为内部 strategy_signals 页面或 Hyperliquid 地址浏览器；不可解析或未开放的目标返回 disabled。点击复制入口的界面含义需要与真实交易提交区分。",
      "evidenceType": "observed",
      "evidenceIds": [
        "ev_cfd7c61e3f199e608fb5471c911890a12d285cae8a4d3ac9f74d1c3980fb663f"
      ],
      "sourceUrls": [
        "https://d0.getdonut.ai/js/strategyCopyTrade-DEltpZL0.js",
        "https://d0.getdonut.ai/js/useFollowConsent-DsQsq0tD.js"
      ]
    }
  ],
  "limitations": [
    "仅覆盖三个发布业务模块；没有审计整套交易网关、策略模型或密钥授权服务。",
    "条款确认和客户端参数检查不证明服务端逐笔风控；未操作实盘或模拟账户。",
    "静态代码不证明运行行为、完整风控、成交或收益；未审计服务端。",
    "没有登录、读取账户、连接钱包、签名、交易或执行目标代码。"
  ],
  "artifacts": [
    {
      "label": "strategyCopyTrade-DEltpZL0.js",
      "url": "https://d0.getdonut.ai/js/strategyCopyTrade-DEltpZL0.js",
      "sha256": "ca0dac5fd6257b002e7a6b83a457f669f8a60181bf704f701ee20de783a2a781"
    },
    {
      "label": "useFollowConsent-DsQsq0tD.js",
      "url": "https://d0.getdonut.ai/js/useFollowConsent-DsQsq0tD.js",
      "sha256": "793fa61e5d2bc18cd61721ea267bc56be9fa4bcd5385b50b1d25c0a8583bd3a3"
    },
    {
      "label": "hlAccountSetup-DODQkMMD.js",
      "url": "https://d0.getdonut.ai/js/hlAccountSetup-DODQkMMD.js",
      "sha256": "f91581547faf3b950ee6b5e5ac55275214b248c006e4f14c8d849e9aa8f3f4d0"
    }
  ],
  "evidenceIds": [
    "ev_cfd7c61e3f199e608fb5471c911890a12d285cae8a4d3ac9f74d1c3980fb663f"
  ],
  "reportUrl": "/research/rea/donut.json",
  "coverage": {
    "parsedFiles": 3,
    "parseFailures": 0,
    "semanticCoverage": "unknown",
    "rootArtifactSha256": "e1cd57aa888e5833b43eff866a5a7fd3e5cdfc4604a8e5241d0787860d487f10",
    "inputFileCount": 3,
    "inputBytes": 36219,
    "analysisResult": "completed"
  }
}