[DealAppSeo]

What

tests/xc1-l1-regrade-2.test.ts [XC1-PF-01] intermittently fails with Received array: [] where it expects recipient_substitution. Not a product bug — a bug in the test's own look-alike generator.

Root cause

The one-nibble-different recipient is built as:

`${seller.address.slice(0, 41)}${seller.address[41] === 'f' ? '0' : 'f'}`

ethers returns an EIP-55 checksummed (mixed-case) address. When the seller's last nibble is a checksum-uppercased 'F', 'F' === 'f' is false, so the flip appends 'f' — a case-only change. evaluateNpa compares addresses case-insensitively (asserted by the XC1-PF-00 control), so it reads the look-alike as the same address, returns no refusal ([]), and the probe fails.

Rate ≈ P(last nibble = f) × P(checksum uppercases it) ≈ 1/32, so it reddens the test job on unrelated PRs at random (observed on #1517, not on #1516).

Fix

Compare the last char case-insensitively so the flip is always value-distinct:

seller.address[41].toLowerCase() === 'f' ? '0' : 'f'

Proven over every last-nibble case: 'F' now maps to a genuinely different nibble; all other cases unchanged. Test-only — no src/ or behavior change.

🤖 Generated with Claude Code

[strix-security]

Strix Security Review

✅ No open security findings.

PR summary: Fixes an intermittent failure in the XC1-PF-01 NPA preflight test by making its generated look-alike recipient address genuinely value-distinct: the last nibble is now compared case-insensitively before being flipped, so an uppercase checksummed 'F' no longer yields a case-only change that the evaluator treats as the same address.

Review summary

This PR contains a single test-only change: in tests/xc1-l1-regrade-2.test.ts the XC1-PF-01 look-alike recipient generator now compares the address's last character case-insensitively (toLowerCase() === 'f'), so the synthetic "one nibble changed" recipient is always value-distinct instead of sometimes being only a case change on an EIP-55 checksummed address. I reviewed the full hunk and its surrounding test context. The change tightens the adversarial assertion rather than relaxing it, removes no security control, and touches no production code, configuration, or dependency, so there is nothing attacker-exploitable introduced here.

_{Review 1 on this PR · 41279f4 · requested Nov 5 05:22 UTC when the PR was opened}

---

Reviewed by Strix
_{Re-run review · Configure security review settings}

[strix-security]

This PR contains a single test-only change: in tests/xc1-l1-regrade-2.test.ts the XC1-PF-01 look-alike recipient generator now compares the address's last character case-insensitively (toLowerCase() === 'f'), so the synthetic "one nibble changed" recipient is always value-distinct instead of sometimes being only a case change on an EIP-55 checksummed address. I reviewed the full hunk and its surrounding test context. The change tightens the adversarial assertion rather than relaxing it, removes no security control, and touches no production code, configuration, or dependency, so there is nothing attacker-exploitable introduced here.

---

Reviewed by Strix
_{Configure security review settings}