{"id":"ship:3e761f00-f605-450a-a744-612b64f43c0c","withdrawn":false,"project":{"slug":"loom","name":"Loom","url":"https://heyresearch.xyz/project/loom"},"domain":"build","claimType":"GITHUB_RELEASE","summary":"0.7.1","sourceType":"github","sourceUrl":"https://github.com/loomdesk-hq/sdk/releases/tag/v0.7.1","publishedAt":"2026-11-02T16:49:01.000Z","detectedAt":"2026-11-02T17:48:21.735Z","precision":"EXACT","verification":"PUBLICLY_VERIFIED","countsAsBuilding":true,"countedAs":"counted","countedAsSentence":"Yes. It is one of the records HEY’s activity status is built from.","recordedAt":"2026-11-02T17:48:21.735Z","metadata":{"summary":"## 0.7.1 (2026-11-02) Four low findings from Hey Research Lab's read of 0.7.0, all under the same threat model as before (a hostile plan reaching a trusted contract), none exploitable by LoomDesk's own plans, none seen on chain: - The router check accepted the router itself (ADDRESS_THIS) as a recipient without asking whether the execute moved everything back out. A plan could wrap the wallet's ETH to the router, or pull tokens to it with Permit2, and end there: the router keeps no balances, so anyone sweeps them in the next transaction. Now every currency routed to the router must leave it by","releaseVersion":"v0.7.1","prerelease":false},"sources":[{"evidenceRowId":"299022be-c1da-4f91-9763-e9ba0bdf945d","sourceType":"GITHUB_REPO","sourceUrl":"https://github.com/loomdesk-hq/sdk/releases/tag/v0.7.1","observedAt":"2026-11-02T17:48:21.735Z","metadata":{"tag":"v0.7.1","prerelease":false}}],"disclaimer":"Public, source-backed activity HEY recorded. Still Building means counted ships during a market drawdown HEY itself tracked — it is not a prediction, not a ranking by price, and not investment advice. Few projects meet Still Building or Under the Radar at any time; both are strict by design, and list responses carry the counts."}