Grand Bazaar Swap

• Analyzed: May 11, 2026, 4:54 AM
• Findings: 1
• Version: 0.1.0
• Hash: b72d71f830957b8c3da9ffc41a4c31915e51c311551e064f416dda70cb18e1a4
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is designed for legitimate P2P swaps on the Base blockchain, using `ethers.js` to interact with smart contracts and Farcaster for communication. It requires `SENDER_PRIVATE_KEY` and `SIGNER_PRIVATE_KEY` from environment variables for its core functionality (signing orders and sending transactions), which is a high-risk capability. While the scripts do not exfiltrate these keys, their presence as environment variables makes the overall operation suspicious due to the inherent risk of handling sensitive credentials. A strong positive security indicator is the explicit disabling of `scripts/post_cast_farcaster_agent.js` for 'security hardening' to avoid 'code-safety exfiltration heuristics', demonstrating an intent to prevent malicious data exfiltration. However, the `SKILL.md` instructs the agent to 'bypass estimate-gated abort and submit with a manual gas limit of `650000`' if `estimateGas` fails, which is a risky operational instruction that could lead to unexpected transaction costs or failures, classifying it as a vulnerability rather than malice.