{
  "schema_version": "1.6.0",
  "id": "BPX-2026-003",
  "published": "2026-08-19T00:00:00Z",
  "modified": "2026-08-19T00:00:00Z",
  "summary": "Router-path finding (third bounty wave, T1)",
  "details": "First of two confirmed findings from the third bounty wave. Fixed in the DEX repository and merged to production with regression coverage. Status: fixed. Severity: unclassified. Results-level by policy — deep technical registers live in the repositories. Canonical: https://blazephoenix.xyz/security/advisories/BPX-2026-003/",
  "affected": [
    {
      "package": {
        "ecosystem": "GitHub Actions",
        "name": "blazephoenixxyz-crypto/Blaze-Phoenix-Dex"
      },
      "versions": [
        "pre-PR#5"
      ]
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://blazephoenix.xyz/security/advisories/BPX-2026-003/"
    },
    {
      "type": "WEB",
      "url": "https://github.com/blazephoenixxyz-crypto/Blaze-Phoenix-Dex/pull/5"
    }
  ],
  "credits": [
    {
      "name": "Thomas",
      "type": "FINDER"
    }
  ]
}