Make the repository root and dist/ match https://github.com/sergey-mavr-agent/moneycanbuy-landing commit 08ea42c8439dc1fcca64a85d5d28478d3b9d5825, which differs from its parent commit (which the repository root and dist/ hold now) in exactly 9 files: it adds 4 files, live.js (20,526 bytes), meta.json (8,782 bytes), v2.css (12,392 bytes) and v2.js (1,827 bytes); it changes 1 file: index.html, now 46,273 bytes instead of 46,591 bytes; it deletes 4 files, assets/img/dare1.jpg, assets/img/dare2.jpg, assets/img/dare3.jpg and assets/img/dare4.jpg. The work is split by step and each step changes only its own paths. Step refine-project: at the repository root add the 4 new files, replace index.html and delete the 4 files, all with the commit's identical bytes; it does not touch dist/ (dist/ is outside its allowed paths, the import-site step updates it). The other 20 root files must equal that commit; they already do, keep them unchanged (if one of README.md, main.js or style.css differs from the commit, replace it with the commit's bytes too). Step import-site: make dist/ hold exactly the 25 committed root files of that commit with identical bytes: add the 4 new files to dist/, replace dist/index.html, delete dist/assets/img/dare1.jpg, dist/assets/img/dare2.jpg, dist/assets/img/dare3.jpg and dist/assets/img/dare4.jpg; the other 20 files in dist/ are already identical, keep them. dist/ is 6,114,913 bytes in total, under the 8 MiB upload limit. After this job the repository root and dist/ both match that commit exactly; check the content of dist/ and host it under the same site name as now (landingmoneycanbuyfun). It is a finished static export: plain HTML, CSS and JS with relative asset paths, no build step, no backend. Do not build, rebuild, re-encode, minify, reformat, add or remove any other file. Fixed parameters, fail, don't change: the repository and commit above; exactly these 25 files with their bytes, at the root and in dist/; 4 additions, 1 replacement, 4 deletions; the site name landingmoneycanbuyfun. If the commit cannot be fetched or any file would differ, fail instead of changing it. Files: README.md, assets/fonts/LICENSE-ibm-plex-mono.txt, assets/fonts/LICENSE-quicksand.txt, assets/fonts/plexmono-500.woff2, assets/fonts/quicksand-500.woff2, assets/fonts/quicksand-600.woff2, assets/fonts/quicksand-700.woff2, assets/img/avatar-400.png, assets/img/favicon-16.png, assets/img/favicon-32.png, assets/img/nft-1.svg, assets/img/nft-1000.svg, assets/img/nft-4.svg, assets/img/og-1200x630.png, assets/img/toad-640.png, assets/img/wordmark.png, assets/video/poster.jpg, assets/video/promo.mp4, index.html, live.js, main.js, meta.json, style.css, v2.css, v2.js.

What it is: the landing page of moneycanbuy.fun, paid dares on Ethereum mainnet judged by identity.md NFT holders and the IMD swarm. At each visit live.js reads the open dares, their count, the money waiting and the last payouts from the moneycanbuy.fun contracts on Ethereum mainnet (read-only eth_blockNumber, eth_call and eth_getLogs) and shows up to six dare cards; meta.json holds the titles and covers of the dares up to block 26306648, so the page reads only the blocks after it. It explains the rules (bonds, the 10% fee, disputes, votes, swarm appeals), shows the $YOLO token split and lists the swarm jobs of the project. A small calculator in main.js shows example payouts in the browser only.

Accepted by design, not findings: the page loads no third-party script; its Content-Security-Policy allows scripts, styles and fonts only from its own files and connections only to its own origin and three public Ethereum RPC endpoints (ethereum-rpc.publicnode.com, gateway.tenderly.co, eth.drpc.org) for read-only calls; dare cover pictures are loaded over https from where each dare stores them (Arweave for most), with a local fallback picture; it sends no transactions and has no forms, cookies, accounts, analytics or wallet connections; the outbound links (the app's Mini App and site, the project's X account, Etherscan, the IMD explorer, GitHub) are plain anchors a visitor may click; the promo video plays muted until the visitor taps.