{
  "projectId": "unifai",
  "title": "UnifAI｜托管钱包界面与资产查询",
  "summary": "客户端把 managed wallet 的创建与更新交给带凭据的后台接口，资产读取另走数据 API；钱包保管及实际签名方式仍在本次范围之外。",
  "scope": "实际公开网页发布的选定业务 JavaScript 包；REA 解析 2 个 JS 文件，静态分析。",
  "status": "partial",
  "analyzedAt": "2026-10-13T10:54:14.217255+00:00",
  "tool": {
    "name": "REA",
    "version": "6.4.0"
  },
  "findings": [
    {
      "title": "钱包创建是后台请求",
      "detail": "公开模块向 /api/managed-wallet 发起 POST，提交 name 与 chainType 并携带 credentials；更新分支使用 /api/managed-wallet/update 和 walletId。已观察到接口边界，未提交任何请求。",
      "evidenceType": "observed",
      "evidenceIds": [
        "ev_629bb7397d40b0427f652dceb1b4d50ffe9c86a6561fd93a809da1ea5928c9b0"
      ],
      "sourceUrls": [
        "https://app.unifai.network/_next/static/chunks/1b97c6d054c53b0e.js",
        "https://app.unifai.network/_next/static/chunks/2cbd593c1cd3e943.js"
      ]
    },
    {
      "title": "资产读取独立于钱包管理",
      "detail": "另一个模块用 NEXT_PUBLIC_UNIFAI_DATA_API_BASE_URL 拼接 /api/v1/wallet-assets，并配置查询超时和重试。可推断 UI 将资产聚合查询与钱包管理分开；余额显示不代表链上执行已确认。",
      "evidenceType": "code_inference",
      "evidenceIds": [
        "ev_629bb7397d40b0427f652dceb1b4d50ffe9c86a6561fd93a809da1ea5928c9b0"
      ],
      "sourceUrls": [
        "https://app.unifai.network/_next/static/chunks/1b97c6d054c53b0e.js",
        "https://app.unifai.network/_next/static/chunks/2cbd593c1cd3e943.js"
      ]
    }
  ],
  "limitations": [
    "没有取得托管签名服务、私钥管理或执行器代码。",
    "重试配置只来自数据查询模块，不延伸判断资金写入接口的幂等性。",
    "静态代码不证明运行行为、完整风控、成交或收益；未审计服务端。",
    "没有登录、读取账户、连接钱包、签名、交易或执行目标代码。"
  ],
  "artifacts": [
    {
      "label": "1b97c6d054c53b0e.js",
      "url": "https://app.unifai.network/_next/static/chunks/1b97c6d054c53b0e.js",
      "sha256": "82d834a548ca754284fd88a074a3fc411267f6c1c96e6e0c1d3ef4ac376ddd22"
    },
    {
      "label": "2cbd593c1cd3e943.js",
      "url": "https://app.unifai.network/_next/static/chunks/2cbd593c1cd3e943.js",
      "sha256": "2b9bebfa20bb2090e78c5a64be59aa9db83e2c897f25fb00eae21a52baccfc1c"
    }
  ],
  "evidenceIds": [
    "ev_629bb7397d40b0427f652dceb1b4d50ffe9c86a6561fd93a809da1ea5928c9b0"
  ],
  "reportUrl": "/research/rea/unifai.json",
  "coverage": {
    "parsedFiles": 2,
    "parseFailures": 0,
    "semanticCoverage": "unknown",
    "rootArtifactSha256": "ada548379e26ae20d7596ea0c7091947195fd906015b05ae8149225eba75e96c",
    "inputFileCount": 2,
    "inputBytes": 42090,
    "analysisResult": "completed"
  }
}