DNS-rebinding an admin bot onto a loopback listener through a PNA-exempt popup to steal the signing key, forge a seller session, then re-run the window.length oracle
Escaping a parenthesis-, quote-, and digit-free Python eval jail using a comprehension setattr as a call primitive and object.__reduce__ to reach the real builtins
Fitting a general DELEGATECALL forwarder into a 36-byte jump-free bytecode whitelist, then abusing a validated arbitrary storage write in a reversed vault
