[Audit] Summary — Fresh Nemesis project handles src+script

[mejango]

Audit seed

Fresh Nemesis / nana-project-handles-v6 all src/**/*.sol and script/**/*.sol / identity verification + input monoculture breaker / Codex

Scope covered

• nana-project-handles-v6/src/JBProjectHandles.sol
• nana-project-handles-v6/src/interfaces/IJBProjectHandles.sol
• nana-project-handles-v6/script/Deploy.s.sol
• nana-project-handles-v6/script/helpers/ProjectHandlesDeploymentLib.sol

Method

Ran the Nemesis loop:

1. Full Feynman pass over all scoped Solidity files.
2. Full State Inconsistency pass enriched with Feynman suspects.
3. Targeted Feynman re-interrogation of the new state/display-safety gap.
4. Targeted State re-analysis, then convergence.

Findings submitted

• [Audit] [MEDIUM] Project handles can return verified handles with unblocked invisible Unicode controls #155 — [Audit] [MEDIUM] Project handles can return verified handles with unblocked invisible Unicode controls

Verification

Local commands run:

forge build --deny notes --skip '*/test/**' --skip '*/script/**'
forge build --deny notes
forge test --match-path test/audit/CodexNemesisUnicodeFormatBypass.t.sol -vvv
forge test --deny notes
slither . --filter-paths 'node_modules|lib|test|out|cache'

Final Foundry result after adding the PoC:

71 tests passed, 0 failed, 0 skipped

Eliminated candidates

• Internal stored parts not updating ENS text records: designed read-time/lazy verification; handleOf returns empty unless ENS points back.
• Resolver malformed/reverting return behavior: intended soft-fail behavior and covered by existing tests.
• Resolver large-returndata gas grief: metadata availability risk, not a cross-setter or value-impacting issue in this repo.
• Direct deploy() without run(): operational deployment footgun; default package flow initializes core, and a zero forwarder does not let arbitrary callers spoof setter slots.

Ecosystem observations

This repo is intentionally metadata-only and has no fund custody. The meaningful trust boundary is display integrity: consumers generally treat handleOf as verified metadata, so input validation needs to match the visual safety guarantees that frontends and indexers infer from a non-empty return value.