{
  "generatedUTC": "2026-10-31T17:49:01.535651+00:00",
  "finding": "Official current code provides a concrete quote/calldata service path and separates generic swap fees from the incident fee-address configuration.",
  "incidentFeeAddress": "0xcd6b980029e6e6e0733ac8ec3e02be9410d09799",
  "currentGenericSwapFeeConstant": {
    "address": "0x39041f1b366fe33f9a5a79de5120f2aee2577ebc",
    "constant": "SWAP_FEE_ADDRESS",
    "sources": [
      {
        "URL": "https://github.com/RabbyHub/Rabby/blob/585ea2b42ebb48ba8eadd4f24999089674f9588e/src/constant/index.ts",
        "lines": [
          1557
        ],
        "sourceSHA256": "cd7eec6f3c7c6918b3024a9e8c4ca7953890e20ec735335a533fb01c409814b1",
        "GitBlobSHA1": "9ca16127b599afe86617a9c0e5327f5365266ac3"
      },
      {
        "URL": "https://github.com/RabbyHub/rabby-mobile/blob/19a3015a99baa9c8b39d4e65d5722a89da9a94b5/apps/mobile/src/constant/swap.ts",
        "lines": [
          29
        ],
        "sourceSHA256": "e2c70d3353d194eaddb96089bacc3689ab50d7ea6125100b13d2d1fd9867ebdf",
        "GitBlobSHA1": "cda5c17aa1e5849e1146a02369badc9f884280e4"
      }
    ],
    "shortExcerpt": "SWAP_FEE_ADDRESS = '0x39041F1B366fE33F9A5a79dE5120F2Aee2577ebc'",
    "interpretation": "Current generic swap constant differs from the observed cd6b fee address. This does not exclude historical or backend-selected use of Rabby services."
  },
  "currentLendingFeeTarget": {
    "address": "0xcd6b980029e6e6e0733ac8ec3e02be9410d09799",
    "constant": "DEBT_FEE_TARGET",
    "source": {
      "URL": "https://github.com/RabbyHub/rabby-mobile/blob/19a3015a99baa9c8b39d4e65d5722a89da9a94b5/apps/mobile/src/screens/Lending/config/paraswap.ts",
      "lines": [
        11,
        38,
        39,
        40
      ],
      "sourceSHA256": "5de24c6f44aad942a809f822fbeab72208e09753c0630b1782ef7a825d00975c",
      "GitBlobSHA1": "e9e0213907e10ac2726cf247ce64f57fe26424ab"
    },
    "scope": "Exact address match in Lending/ParaSwap configuration only; not a recovered Kyber fee-recipient policy."
  },
  "currentGenericQuoteRequest": {
    "sdk": "RabbyHub/rabby-swap",
    "source": {
      "URL": "https://github.com/RabbyHub/rabby-swap/blob/a227435fa60f1a92d1e416c0bc0e68a4d4100397/src/utils.ts",
      "lines": [
        121,
        139,
        150,
        159,
        164,
        173
      ],
      "sourceSHA256": "84dcead5da2051deb6ab897f8e9cfe3ae3a1e97ae70e85a3d5092f28e1351dbf",
      "GitBlobSHA1": "947d47bfb9d193538478e4147ab756829bc653c1"
    },
    "requestFields": [
      "id",
      "chain_id",
      "dex_id",
      "pay_token_id",
      "pay_token_raw_amount",
      "receive_token_id",
      "slippage",
      "fee_rate",
      "fee",
      "no_pre_exec"
    ],
    "walletIdentifier": "id is assigned options.userAddress, a supplied wallet address, not a recovered device/login identifier.",
    "dexRouting": "Kyber getQuote uses generateGetQuote with id kyberswap; non-Ethereum dex_id is chainServerId + _kyberswap.",
    "calldata": "Uses data.dex_swap_calldata and data.dex_swap_to returned by getSwapQuote.",
    "feeAddressBoundary": "Extension passes feeAddress into SDK options; checked generic quote builder does not put feeAddress in the outbound request. Therefore current frontend constant alone does not determine the returned Kyber fee receiver.",
    "adapterSource": {
      "URL": "https://github.com/RabbyHub/rabby-swap/blob/a227435fa60f1a92d1e416c0bc0e68a4d4100397/src/dexs/kyberswap.ts",
      "lines": [
        47,
        48,
        49,
        50,
        51
      ],
      "sourceSHA256": "c7845e5de072834b81b3e1541808f5e23b1e51d4624c4fb21e5684870e84c09f",
      "GitBlobSHA1": "6b4139529015dbaeb2000f9f1ebb23c7991bba83"
    },
    "frontendCallerSource": {
      "URL": "https://github.com/RabbyHub/Rabby/blob/585ea2b42ebb48ba8eadd4f24999089674f9588e/src/ui/views/Swap/hooks/quote.tsx",
      "lines": [
        409,
        418,
        425,
        427,
        433
      ],
      "sourceSHA256": "eb077b3029643ae3f14f2960d32e4faef63bcd55f5224ce4b8ed416a29ca11e3",
      "GitBlobSHA1": "bd7c887eb85087d0b0fdcd24edbcfc0a5dfda3a5"
    }
  },
  "publicServiceEndpoint": {
    "defaultHost": "https://api.rabby.io",
    "path": "/v1/wallet/swap_quote",
    "method": "GET",
    "hostSource": {
      "URL": "https://github.com/RabbyHub/Rabby/blob/585ea2b42ebb48ba8eadd4f24999089674f9588e/src/constant/index.ts",
      "lines": [
        529
      ],
      "sourceSHA256": "cd7eec6f3c7c6918b3024a9e8c4ca7953890e20ec735335a533fb01c409814b1",
      "GitBlobSHA1": "9ca16127b599afe86617a9c0e5327f5365266ac3"
    },
    "apiSource": {
      "URL": "https://github.com/RabbyHub/rabby-api/blob/3afa83eb812f44f86e9e3076f9882cdffce4e84b/src/index.ts",
      "lines": [
        1087,
        1096,
        1115,
        1116
      ],
      "sourceSHA256": "7a6519d81751b0439c9ebe37e8a461a2ef1ef4b21fa7c43cbf7ab2e194a3606d",
      "GitBlobSHA1": "d574a7da5de3b822fdf1a06a9794a06ebd83f898"
    },
    "evidenceStatus": "Official current code path only. Endpoint was not called. No incident request, retained server log, customer record or provider attestation was obtained."
  },
  "sharedRouterConfiguration": {
    "kyberPolygonRouter": "0x6131b5fae19ea4f9d964eac0408e4408b66337b5",
    "openOceanPolygonRouter": "0x6352a56caadc4f1e25cd6c75970fa768a3304e64",
    "source": {
      "URL": "https://github.com/RabbyHub/rabby-swap/blob/a227435fa60f1a92d1e416c0bc0e68a4d4100397/src/list.ts",
      "lines": [
        166,
        168,
        202,
        204
      ],
      "sourceSHA256": "d1a47c78e3c20c97e45df44ae84300d904e8a41214b4f8433bb16d1f71417ddd",
      "GitBlobSHA1": "07e516fb113ff31ea37df02d17bfc445786ca1f0"
    },
    "scope": "Public SDK shared-service contract configuration, not attacker-owned receiver addresses."
  },
  "limits": [
    "Current pinned source is not proof of the client/backend version used on October29.",
    "A Source rabby tag and matching configured fee address do not authenticate a Rabby app installation, browser, device, session, customer or person.",
    "No backend, account-login, customer, private log or transaction-submission endpoint was queried."
  ]
}