phantom-connect

No clear malicious behavior or supply-chain backdoor is present. The code is readable and uses expected Solana and Metaplex operations. However, the mint endpoint as shown has significant business-logic and authorization risks: it trusts client-supplied wallet and quantity, does not enforce the displayed payment or per-wallet limit, and the allowlist flow does not demonstrate cryptographic proof validation. These issues should be fixed before production use.