{
  "projectId": "heyanon",
  "title": "Hey Anon｜登录证明与产品入口",
  "summary": "选定发布代码可还原钱包签名登录和多个产品入口，尚不足以验证自然语言交易从指令到链上的完整执行。",
  "scope": "实际公开网页发布的选定业务 JavaScript 包；REA 解析 2 个 JS 文件，静态分析。",
  "status": "partial",
  "analyzedAt": "2026-10-13T10:53:52.105810+00:00",
  "tool": {
    "name": "REA",
    "version": "6.4.0"
  },
  "findings": [
    {
      "title": "钱包签名用于身份登录",
      "detail": "登录模块包含“证明能访问该钱包”的登录消息，并调用钱包 signMessage；同一模块也有 Apple 和 Telegram 登录分支。该签名场景是身份验证，不能直接解释成交易授权。",
      "evidenceType": "observed",
      "evidenceIds": [
        "ev_bbf38642fbf68e9eddcb87d559b5130e7e248bf278b8b5746e5c6eec7d2ccec3"
      ],
      "sourceUrls": [
        "https://heyanon.ai/_next/static/immutable/chunks/2i6i5vtyds22r.js",
        "https://heyanon.ai/_next/static/immutable/chunks/1d_kratjplrfk.js"
      ]
    },
    {
      "title": "MCP、HUD、资讯与质押有独立入口",
      "detail": "导航模块分别配置 /mcp、/hud、/news、/gemma 和外部 staking 入口。这表明网站承载多个使用界面；模块之间是否共用账户权限、执行器和风控仍未验证。",
      "evidenceType": "code_inference",
      "evidenceIds": [
        "ev_bbf38642fbf68e9eddcb87d559b5130e7e248bf278b8b5746e5c6eec7d2ccec3"
      ],
      "sourceUrls": [
        "https://heyanon.ai/_next/static/immutable/chunks/2i6i5vtyds22r.js",
        "https://heyanon.ai/_next/static/immutable/chunks/1d_kratjplrfk.js"
      ]
    }
  ],
  "limitations": [
    "仅分析两个业务模块，未覆盖智能合约、Agent 工具实现与交易确认流程。",
    "服务端 nonce、防重放、签名有效期和权限撤销没有进行运行验证。",
    "静态代码不证明运行行为、完整风控、成交或收益；未审计服务端。",
    "没有登录、读取账户、连接钱包、签名、交易或执行目标代码。"
  ],
  "artifacts": [
    {
      "label": "2i6i5vtyds22r.js",
      "url": "https://heyanon.ai/_next/static/immutable/chunks/2i6i5vtyds22r.js",
      "sha256": "5c61de868ab56ddee6c1df02b27bf1c9b506af52689a33c0430c85720721b16f"
    },
    {
      "label": "1d_kratjplrfk.js",
      "url": "https://heyanon.ai/_next/static/immutable/chunks/1d_kratjplrfk.js",
      "sha256": "660ad17632eb975baaa270ca1e83821e7f00b8241e03730ad8dd04b9e107653b"
    }
  ],
  "evidenceIds": [
    "ev_bbf38642fbf68e9eddcb87d559b5130e7e248bf278b8b5746e5c6eec7d2ccec3"
  ],
  "reportUrl": "/research/rea/heyanon.json",
  "coverage": {
    "parsedFiles": 2,
    "parseFailures": 0,
    "semanticCoverage": "unknown",
    "rootArtifactSha256": "f29647a309e7007882659e915ab3601612e561a8e8332fe538158e483122bba0",
    "inputFileCount": 2,
    "inputBytes": 65859,
    "analysisResult": "completed"
  }
}