{
  "asOf": {
    "chainId": 8453,
    "block": 53294971,
    "UTC": "2026-10-30T16:54:49+00:00"
  },
  "finding": "The specific bridged 1,526.93 USDC was authorized and then fully captured through Base Commerce Payments v1.0.0. The contract paid 1,511.660700 USDC to the configured payment receiver and 15.269300 USDC to the fee receiver. The payment receiver later swept its pooled 2,267.694 USDC balance to an explorer-labeled Coinbase address.",
  "protocolRoles": {
    "escrow": {
      "address": "0xbdea0d1bcc5966192b070fdf62ab4ef5b4420cff",
      "role": "AuthCaptureEscrow v1.0.0",
      "primaryRegistry": "https://github.com/base/commerce-payments/releases/tag/v1.0.0"
    },
    "collector": {
      "address": "0x0e3df9510de65469c4518d7843919c0b8c7a7757",
      "role": "ERC3009PaymentCollector v1.0.0",
      "primaryRegistry": "https://github.com/base/commerce-payments/releases/tag/v1.0.0"
    },
    "operator": {
      "address": "0x00f8d7a519c70bf71d411e4bd89bf6d7e3065835",
      "role": "Configured payment operator and AA UserOperation sender; smart-account contract. Business identity not established."
    },
    "payer": {
      "address": "0x133243d447026345c2b368d7ffe435dbe3c566eb",
      "role": "USDC ReceiveWithAuthorization payer; public signature recovers this key. Preexisting high-volume address; not assumed controlled by upstream fund sender."
    },
    "tokenStore": {
      "address": "0x47c5d3fc37f66f7cbf450bd3ea912b0765104fc3",
      "role": "Per-operator pooled TokenStore. getTokenStore(operator) and authCaptureEscrow() independently verified. Not a private attacker holding wallet."
    },
    "paymentReceiver": {
      "address": "0x5638604d86fa995d5e311659e6e6c850f48ef361",
      "role": "Configured receiver receiving net payment. Human/business identity and attacker control not established."
    },
    "feeReceiver": {
      "address": "0x6d8675a52438849d90241cb639fba41bdc3329c8",
      "role": "Configured 1% fee receiver. This role does not establish Coinbase exchange ownership."
    }
  },
  "specificPayment": {
    "hash": "0x2f03059f9cf09248f70a80cb6069ae616a615cc0951ac4c0e05e5ab6c4e85106",
    "asset": "Base canonical USDC: 0x833589fcd6edb6e08f4c7c32d4f71b54bda02913",
    "grossUSDC": "1526.930000",
    "feeBps": 100,
    "feeUSDC": "15.269300",
    "receiverUSDC": "1511.660700",
    "AcrossFill": {
      "tx": "0xd76de27a568ac7d591dcfd5ac19dc207a287c17de95b60123a91c623c6023b64",
      "block": 53270757,
      "UTC": "2026-10-30T03:27:41+00:00"
    },
    "authorization": {
      "tx": "0xd424133bf4d8052c51acdcb0bd547f8be7613c3e952a27ef5b0d827b8ef4391d",
      "block": 53270762,
      "UTC": "2026-10-30T03:27:51+00:00"
    },
    "capture": {
      "tx": "0xd0aafc461c2092361a1fca4d784e66821d985aed7a2ba592dfcb8408130079b8",
      "block": 53270764,
      "UTC": "2026-10-30T03:27:55+00:00",
      "receiptStatus": "0x1"
    },
    "lifecycleAtFixedHead": {
      "hasCollectedPayment": true,
      "capturableAmountRaw": "0",
      "refundableAmountRaw": "1526930000"
    },
    "sameHashEventCoverage": {
      "fromBlock": 53270762,
      "toBlock": 53294971,
      "successfulQueries": 3,
      "queries": 3,
      "events": 2,
      "eventTypes": [
        "PaymentAuthorized",
        "PaymentCaptured"
      ],
      "refundVoidReclaimEvents": 0
    },
    "refundableFieldMeaning": "Captured gross amount still eligible for refund under protocol accounting; not a balance remaining escrowed for this payment."
  },
  "payerSignature": {
    "recoveredSigner": "0x133243d447026345c2b368d7ffe435dbe3c566eb",
    "matchesPayer": true,
    "matchesMainCollectorKey3f701": false,
    "getterHashesMatch": true,
    "validBeforeUTC": "2027-10-31T03:22:58+00:00",
    "authorizationNonce": "0x12ac6529946e1a8bb59665c8df1a864799b51fd0f113c87fa87516282af30c6e"
  },
  "receiverAtFixedHead": {
    "address": "0x5638604d86fa995d5e311659e6e6c850f48ef361",
    "code": "0x",
    "nonce": 1583,
    "USDC": "0"
  },
  "firstOnwardAggregateSweep": {
    "direction": "out",
    "tx": "0x0b81f92ca0795c955bda95fdf792fec74189283bf5b3810b43c7c6073a220f9d",
    "block": 53270871,
    "logIndex": 372,
    "UTC": "2026-10-30T03:31:29+00:00",
    "from": "0x5638604d86fa995d5e311659e6e6c850f48ef361",
    "to": "0x20fe51a9229eef2cf8ad9e89d91cab9312cf3b7a",
    "USDC": "2267.694",
    "outerFrom": "0x5638604d86fa995d5e311659e6e6c850f48ef361",
    "outerTo": "0x833589fcd6edb6e08f4c7c32d4f71b54bda02913",
    "selector": "0xa9059cbb",
    "nonce": 1580,
    "status": "0x1",
    "positivePrincipal": true,
    "priorUSDC": "756.0333",
    "specificPayoutUSDC": "1511.6607",
    "balanceReconciliationExact": true,
    "destinationPublicLabel": "Coinbase 14 (Blockscan/Etherscan explorer label; Etherscan cites hildobby compilation)",
    "destinationLabelSources": [
      "https://blockscan.com/Address/0x20fe51a9229eef2cf8ad9e89d91cab9312cf3b7a",
      "https://etherscan.io/address/0x20fe51a9229eef2cf8ad9e89d91cab9312cf3b7a"
    ]
  },
  "zeroValueLookalikeLogs": [
    {
      "direction": "out",
      "tx": "0x240efdfbefb8703ccc86e2946eeafd13af73d741c8267e200934b1d35813e1bf",
      "block": 53271162,
      "logIndex": 265,
      "UTC": "2026-10-30T03:41:11+00:00",
      "from": "0x5638604d86fa995d5e311659e6e6c850f48ef361",
      "to": "0x20fe366f23b274c4ef4cec202234b06fef8e3b7a",
      "USDC": "0",
      "outerFrom": "0x3959e49639d3b1bd9d1746a7971155e94fecf1f6",
      "outerTo": "0xc3236716cbdc725b518ac0a5d830fbadcfd05032",
      "selector": "0x12514bba",
      "nonce": 315563,
      "status": "0x1",
      "positivePrincipal": false
    },
    {
      "direction": "out",
      "tx": "0x9d87e928fc6d4b375a160efdaa4b08dfcf52a5a15fb8e8dab74e989cb4bbef35",
      "block": 53278776,
      "logIndex": 278,
      "UTC": "2026-10-30T07:54:59+00:00",
      "from": "0x5638604d86fa995d5e311659e6e6c850f48ef361",
      "to": "0x739179459d6b043f99ee9cb79ec82ec877692360",
      "USDC": "0",
      "outerFrom": "0x3959e49639d3b1bd9d1746a7971155e94fecf1f6",
      "outerTo": "0xc3236716cbdc725b518ac0a5d830fbadcfd05032",
      "selector": "0x12514bba",
      "nonce": 315880,
      "status": "0x1",
      "positivePrincipal": false
    },
    {
      "direction": "out",
      "tx": "0x2a4e6e515449d937806f04a56ffb434d10b99d42f339d4e5754d46412ea86bd3",
      "block": 53291759,
      "logIndex": 646,
      "UTC": "2026-10-30T15:07:45+00:00",
      "from": "0x5638604d86fa995d5e311659e6e6c850f48ef361",
      "to": "0x6dcb1c8320f59254a85abeba458f7b634e804467",
      "USDC": "0",
      "outerFrom": "0x3959e49639d3b1bd9d1746a7971155e94fecf1f6",
      "outerTo": "0xc3236716cbdc725b518ac0a5d830fbadcfd05032",
      "selector": "0x12514bba",
      "nonce": 317426,
      "status": "0x1",
      "positivePrincipal": false
    }
  ],
  "limits": [
    "Coinbase-authored Commerce Payments contracts are a payment protocol, not proof of Coinbase exchange custody or KYC.",
    "The later recipient sweep reaches an explorer-labeled exchange service, but pooled funds and service use do not identify an attacker customer/account or prove receiver ownership by the attacker.",
    "The configured receiver business identity remains unattributed.",
    "The ERC3009 signer1332 differs from upstream3f701, but distinct keys do not prove distinct people; no human identity or informed consent is established.",
    "Zero-value lookalike transfer logs are excluded from principal movement and ownership attribution."
  ],
  "proofFiles": [
    "payment-state-and-same-hash-events-raw.json",
    "specific-capture-receipt-and-roles-at-fixed-head.json",
    "payer1332-erc3009-signature-recovery.json",
    "merchant5638-post-capture-USDC-logs-raw.json",
    "merchant-positive-sweeps-zero-logs-and-prior-balance.json"
  ],
  "primarySourceFiles": {
    "TokenCollector.sol": "865dd504cbac5f9e69a89cf49161ef3b552d8079bb3961e976e5208b94feb9a3",
    "ERC3009PaymentCollector.sol": "749a4b6b53bcf173b68b74d15555982d9fbf386715c5ce14a5f6244868a83084",
    "AuthCaptureEscrow.sol": "7e56936b256c5c761e745b86afa68e22d875adbe3b99090a64b85ea3a18c60de",
    "TokenStore.sol": "01b75781e5e1cc0fd72c0f25a3af181867dedb017164b408bc37f909afadc672"
  }
}