{
  "projectId": "listen",
  "title": "Listen · 源码静态检查与执行边界",
  "summary": "源码呈现的是可执行跨链交易的服务端架构：Pipeline 绑定认证用户钱包，交易经 LiFi 构造后交给 Privy 执行。其 EVM 分支还包含最大额度代币授权路径，不能把它理解为只有研究权限的聊天工具。",
  "scope": "固定 commit 官方源码 ZIP 的 REA 文件清单，以及 Rust 的 Pipeline 身份认证、跨链执行和 EVM 授权代码检查；未取得线上应用运行证据。",
  "status": "partial",
  "analyzedAt": "2026-10-13",
  "tool": {
    "name": "REA",
    "version": "6.4.0"
  },
  "findings": [
    {
      "title": "REA 已固定源码归档身份与文件清单",
      "detail": "inspect_artifact 返回 978 个内容节点、1147 个文件/目录出现项。这个结果证明本次检查输入的身份和结构，不证明 Python、Go 或 Rust 代码运行行为，也不等同于完成产品逆向。",
      "evidenceType": "observed",
      "evidenceIds": [
        "ev_2d5ce834f35320c876f5e02c4197fd30f12477a4e2e4d772052a60920d1fa3d6"
      ],
      "sourceUrls": [
        "https://codeload.github.com/piotrostr/listen/zip/76efbafc6712d54008460136b641adb5610b3089"
      ]
    },
    {
      "title": "Pipeline 钱包来自认证会话",
      "detail": "create_pipeline 先调用 verify_auth，再从认证用户填入 user_id、wallet_address 与 pubkey，而不是直接使用请求体指定的这些身份。Privy 验证器使用 ES256，并设置 issuer 与 app audience。这里只验证代码存在与数据流，未做鉴权绕过或线上配置测试。",
      "evidenceType": "code_inference",
      "evidenceIds": [],
      "sourceUrls": [
        "https://github.com/piotrostr/listen/blob/76efbafc6712d54008460136b641adb5610b3089/listen-engine/src/server/create.rs#L64",
        "https://github.com/piotrostr/listen/blob/76efbafc6712d54008460136b641adb5610b3089/listen-engine/src/server/common.rs#L7",
        "https://github.com/piotrostr/listen/blob/76efbafc6712d54008460136b641adb5610b3089/privy/src/auth.rs#L110"
      ]
    },
    {
      "title": "执行器包含跨链交易发送能力",
      "detail": "execute_order 区分 Solana/EVM 钱包是否存在，再调用 LiFi 相关的 swap_order_to_transaction。EVM 分支经 ensure_approvals 后调用 Privy.execute_transaction；Solana 分支更新 blockhash 后进入带重试的交易执行。这些调用属于执行权限，不只是生成交易建议。",
      "evidenceType": "code_inference",
      "evidenceIds": [],
      "sourceUrls": [
        "https://github.com/piotrostr/listen/blob/76efbafc6712d54008460136b641adb5610b3089/listen-engine/src/engine/execute.rs#L13",
        "https://github.com/piotrostr/listen/blob/76efbafc6712d54008460136b641adb5610b3089/listen-engine/src/engine/execute.rs#L43"
      ]
    },
    {
      "title": "EVM 路径会构造最大额度代币授权",
      "detail": "ensure_approvals 对非原生代币比较现有 allowance 是否为 uint256 最大值；未达到该值时调用 create_approval_transaction，并通过 Privy 提交。approvals 模块将 MAX_APPROVAL_AMOUNT 写入 approve 的 calldata，因此这一机制不是只授权本次订单金额。结论限定固定源码，未在链上实际验证。",
      "evidenceType": "code_inference",
      "evidenceIds": [],
      "sourceUrls": [
        "https://github.com/piotrostr/listen/blob/76efbafc6712d54008460136b641adb5610b3089/listen-engine/src/engine/execute.rs#L88",
        "https://github.com/piotrostr/listen/blob/76efbafc6712d54008460136b641adb5610b3089/approvals/src/lib.rs#L11",
        "https://github.com/piotrostr/listen/blob/76efbafc6712d54008460136b641adb5610b3089/approvals/src/lib.rs#L149"
      ]
    }
  ],
  "limitations": [
    "REA 仅提供源码 ZIP 清单，未进行 Rust 语义恢复、运行验证或完整鉴权审计。",
    "本次协同采集对 app.listen-rs.com 的 HTTPS 请求遇到 TLS 错误，未取得线上应用脚本；不能据此断言服务对所有用户不可用，也不能把仓库代码等同当前部署。",
    "未启动服务、接入 Privy 用户、连接钱包、签名、授权代币或提交交易。"
  ],
  "artifacts": [
    {
      "label": "REA 输入：官方源码 ZIP · 76efbafc6712",
      "url": "https://codeload.github.com/piotrostr/listen/zip/76efbafc6712d54008460136b641adb5610b3089",
      "sha256": "155e533780edcb4c49597cb5f423b178d9eb566754d18fa714202b3a498114d1",
      "bytes": 12008841
    }
  ],
  "evidenceIds": [
    "ev_2d5ce834f35320c876f5e02c4197fd30f12477a4e2e4d772052a60920d1fa3d6"
  ],
  "reportUrl": "/research/rea/listen.json",
  "methodology": "REA 原始输出负责产物身份、文件结构或原生元数据；code_inference 结论来自带固定版本引用的源码阅读。未完成动态运行、实盘测试、完整安全审计或收益验证。",
  "sourceCommit": "76efbafc6712d54008460136b641adb5610b3089",
  "releasedArtifactAvailable": false,
  "analysisInput": {
    "sha256": "155e533780edcb4c49597cb5f423b178d9eb566754d18fa714202b3a498114d1",
    "format": "zip",
    "evidenceId": "ev_2d5ce834f35320c876f5e02c4197fd30f12477a4e2e4d772052a60920d1fa3d6",
    "operation": "inspect_artifact",
    "publicSourceUrls": [
      "https://codeload.github.com/piotrostr/listen/zip/76efbafc6712d54008460136b641adb5610b3089"
    ]
  },
  "analysisAttempts": [
    {
      "command": "rea inspect-artifact listen-source.zip --format json",
      "result": "completed",
      "evidenceIds": [
        "ev_2d5ce834f35320c876f5e02c4197fd30f12477a4e2e4d772052a60920d1fa3d6"
      ],
      "coverage": "public_source_archive_inventory"
    }
  ]
}