Request blocked (false positive) — chaotic.markets, non-custodial Jupiter front-end

[Divyn]

Domain: https://chaotic.markets

It is a non-custodial front-end for buying baskets of tokenized US stocks (xStocks by Backed Finance, and Backpack Securities) on Solana mainnet. Every transaction is a single Jupiter-built USDC to token swap (JUP6LkbZbjS1jKKwapdHNy74zcZ3tLUZoi5QNyVTaV4). The site deploys no program of its own. It holds no funds. It charges no fee. It requests no token approvals and no delegate authority.

Phantom shows the full-page "Request blocked / This dApp could be malicious" before any wallet request is made. We removed wallet auto-connect entirely, and the block still fires. That means it is a domain-level entry, not app behavior.

We also verified every transaction the site can produce, per support's own checklist (Zendesk ticket #368704). Each is one signer with 3 to 4 instructions (ComputeBudget, ATA create, one Jupiter instruction). Each is 485 to 553 bytes, which leaves 679 to 747 bytes of Lighthouse headroom under the 1232 limit. Each simulates cleanly on multiple RPCs (55k to 120k CU, no errors). Oversized routes are automatically re-quoted with maxAccounts=32 before any signature request.

The ticket has been circling for 3 days. review@phantom.com routes back to the same form.

Verification material:

• Architecture: https://chaotic.markets/how-it-works
• security.txt: https://chaotic.markets/.well-known/security.txt
• Completed transactions through the site (Solscan links in ticket #368704)
• GitHub: https://github.com/Divyn (repo private, read access available to any reviewer)
• X: https://x.com/divyasshree_

What are the actual criteria for clearing a new, legitimate domain? Happy to satisfy them. cc @adamdelphantom