Blockaid Malicious site alert on Base NFT dapp: need classification diagnosis

Uncategorized
1

Hello MetaMask team,

I’m Nathan, building Plato / The Unseen, an NFT escape room on Base mainnet. I’m seeking a technical diagnosis and the correct review route.

Domain: plato-unseen.spiffyolive4.chatgpt.site
Contract: 0x47FC75E1620437930D42607f1170CF92B2915217
Chain ID: 8453 (Base mainnet)
MetaMask support ticket: 215476327874630

When requesting commit(uint256,bytes32) for token #1 with value 0 ETH, MetaMask displays two alerts: Malicious site, and Limited address signals. The action records an answer commitment; it does not advance the gate or burn the NFT. Exact pending calldata and MetaMask version have not yet been captured. Public sale remains closed.

Dylan from User Safety confirmed Blockaid flags the domain. I submitted a mistake report October 10 and Developer project verification October 11, and replied to the existing support case with source verification evidence. No Blockaid case number is known.

Cave, EIDOS, renderer and identity have exact runtime matches on Sourcify. This establishes source identity, not a security audit.
EIDOS: 0xDA39555bFD34A8C658a5754a0AA537B3279E7D1C
Renderer: 0xC749b6B855FAb242FCeDFB1498b39143e8AE5c7e
Identity: 0xB112c65a00d6e5e026273a5d645658cfcB866dd5

Could you help clarify:

  1. Does the classification attach to our exact hostname, a parent hosting domain, the contract, or simulated behavior?
  2. What specific finding and remediation are required? Is Limited address signals a separate history-based advisory?
  3. Can the existing Blockaid review be coordinated, and how should we confirm propagation after a correction?

We will not ask collectors to disable protection or bypass alerts. Happy to provide additional public technical evidence. If this belongs in another category, please route it accordingly.

Thank you,
Nathan Meir