## 5 Experiments
\begin{table}
\begin{tabular}{p{142.3 pt} p{142.3 pt} p{142.3 pt} p{142.3 pt} p{142.3 pt}} \hline
**No.** & **Function** & **Scenario** & **Expected Result** & **Result** \\ \hline
7 & _subscribe(email, firstName, lastName)_ & The user inputs an incorrect email address. & The function returns an error, and the user-provided data is not saved. A “Subscribed” event is not emitted. \\ \hline
8 & _subscribe(email, firstName, lastName)_ & The user inputs parameters where each has a length of a thousand characters. & The function returns an error, and the user-provided data is not saved. A “Subscribed” event is not emitted. \\ \hline
9 & _subscribe(email, firstName, lastName)_ & The user invokes the function with empty values for the parameters. & The function returns an error and does not save the provided data. A “Subscribed” event is not emitted. \\ \hline
10 & _unsubscribe()_ & A user without an active subscription invokes the function. & The function call fails. An “Unsubscribed” event is not emitted. \\ \hline
11 & _updateSubscriptionFee(newFee)_ & A non-owner user invokes the method with a correct new fee value. & The function call fails. The fee is not updated. \\ \hline
12 & _withdrawFunds()_ & A non-owner user invokes the method. & The function call fails. Funds remain in the contract account. \\ \hline
13 & _selfDestructContract()_ & A non-owner user calls the function. & The function call fails. & Positive—reverted as expected \\ \hline \end{tabular}
\end{table} 
Table 3: Unsuccessful manual testing scenarios for the implemented contract methods. This security assessment adopts an attacker model consistent with publicly accessible Ethereum contracts and front-end wallet interactions. The assumed adversary is an external user with no privileged access to backend infrastructure, off-chain databases, or admin keys. The attacker is equipped with basic blockchain development tools (e.g., Remix, Hardhat, MetaMask) and is capable of crafting transactions, observing state changes, and invoking contract functions using web-based interfaces or scripts. The threat model covers logic flaws (for example, improper input validation, insufficient access control), economic vulnerabilities (for example, reentry, integer overflow) and interface misuses between the wallet and smart contract. It does not cover low-level infrastructure attacks (e.g., node takeover), off-chain exploits (e.g., phishing, social engineering) or protocol layer bugs outside of the Solidity/EVM domain. This model reflects realistic threats in production \begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline
**Category** & **Detection Method** & **Tool(s) Used** & **No. of Findings** & **Severity Levels Present** \\ \hline Access Control & Automated & Mythril & 1 & Medium \\ \hline Arithmetic Errors & Automated & Mythril & 1 & Medium \\ \hline Transaction Ordering & Automated & Mythril & 1 & Medium \\ \hline Inefficient Data Structures & Automated & Slither & 2 & Low \\ \hline Assertion Handling & Automated & Mythril & 1 & Medium \\ \hline Visibility/Input Handling & Automated & Slither & 2 & Low \\ \hline Logic Validation Failures & Manual & Manual & 5 & Medium \\ \hline \end{tabular}
\end{table} 
Table 6: Summary of vulnerabilities by category, detection method, and severity.