{
  "projectId": "noya",
  "title": "NOYA 的 Omnivault 与 Agent 入口分层",
  "summary": "选定发布块展现钱包会话、Omnivault 持仓和其他研究工具的导航关系，不能据此验证跨链资金策略。",
  "scope": "实际公开网页发布的选定业务 JavaScript 包；REA 解析 1 个 JS 文件，静态分析。",
  "status": "partial",
  "analyzedAt": "2026-10-13T10:38:40.492958+00:00",
  "tool": {
    "name": "REA",
    "version": "6.4.0"
  },
  "findings": [
    {
      "title": "Omnivault、分析和 Agent 分属不同入口",
      "detail": "代码包含 Omnivault Positions 以及 agent.noya.ai 的 Token Analyzer 链接，并将相关产品导航分开组织。",
      "evidenceType": "observed",
      "evidenceIds": [
        "ev_e61f0aec773e4e90726e6ef1bf2b16af81b3b1dae08cd5e546bf84f91d823c9f"
      ],
      "sourceUrls": [
        "https://app.noya.ai/_next/static/chunks/2799-9a281d2e465dec23.js"
      ]
    },
    {
      "title": "连接状态控制账户菜单",
      "detail": "连接后界面显示账户菜单，断开分支调用 signOut 并更新视图。该前端会话退出不等于链上授权已被撤销。",
      "evidenceType": "code_inference",
      "evidenceIds": [
        "ev_e61f0aec773e4e90726e6ef1bf2b16af81b3b1dae08cd5e546bf84f91d823c9f"
      ],
      "sourceUrls": [
        "https://app.noya.ai/_next/static/chunks/2799-9a281d2e465dec23.js"
      ]
    }
  ],
  "limitations": [
    "只覆盖 9,935 字节导航/账户业务块；未覆盖整个应用或合约。",
    "未读取真实持仓或验证跨链执行、退出和撤销权限。",
    "静态代码不证明运行行为、完整风控、成交或收益；未审计服务端。",
    "没有登录、读取账户、连接钱包、签名、交易或执行目标代码。"
  ],
  "artifacts": [
    {
      "label": "2799-9a281d2e465dec23.js",
      "url": "https://app.noya.ai/_next/static/chunks/2799-9a281d2e465dec23.js",
      "sha256": "2ba2b15438873cdc680f55d52ba748ec481ad0f44a00664d3ac54b3c3b3b10a1"
    }
  ],
  "evidenceIds": [
    "ev_e61f0aec773e4e90726e6ef1bf2b16af81b3b1dae08cd5e546bf84f91d823c9f"
  ],
  "reportUrl": "/research/rea/noya.json",
  "coverage": {
    "parsedFiles": 1,
    "parseFailures": 0,
    "semanticCoverage": "unknown",
    "rootArtifactSha256": "d83089023a48397349c19f366bb6920bd3ed158692c08cfb2601b089527f21d5",
    "inputFileCount": 1,
    "inputBytes": 9935,
    "analysisResult": "completed"
  }
}