code/CL8Y-web
4
0
Fork 0
Code Issues 4 Pull requests 4 Projects Releases Packages Wiki Activity

Official token directory: addresses, listings, DEX-only venues #2

New issue
Closed
opened 2026-08-25 06:30:10 +00:00 by PlasticDigits · 13 comments
PlasticDigits commented 2026-08-25 06:30:10 +00:00 (Migrated from gitlab.com)
Copy link

Summary

Add an easy-to-find official directory of CL8Y token addresses, listings, and places to trade. CL8Y no longer works with centralized exchanges. All trade venues must be DEX / on-chain / aggregator pages. This is the anti-phishing surface of the marketing site: one canonical list, copyable addresses, no CEX.

Depends on the companion redesign issue for chrome/nav placement, but can land as a section + data-layer change if the redesign header is not ready.

Current codebase

Official URLs are centralized in src/data/links.ts (links, linksByCategory). Categories today: trading, contracts, chart, social, listings, audit, comingSoon.

Contracts (2):

  • Terra Classic CW20: terra16wtml2q66g82fdkx66tap0qjkahqwp4lwq3ngtygacg5q0kzycgqvhpax3 (finder.terra.money)
  • BSC ERC-20: 0x8F452a1fdd388A45e1080992eFF051b4dd9048d2 (bscscan.com)

Trading (includes a CEX we no longer use):

  • TidalDex (BSC) — primary “Buy CL8Y” everywhere
  • AscendEX (CEX) — https://ascendex.com/en-us/cashtrade-spottrading/usdt/cl8y
  • Uniswap (BNB token page)
  • PancakeSwap
  • GDEX (Terra Classic)

Listings: CZodiac, Blockspot, BeInCrypto, Coinbase price page, CoinCarp, BscScan, LUNCScan, DropsTab, Coinranking, DexScreener, DexTools, CoinPaprika, CoinGecko.

Where this data is rendered today:

  • Hero (src/features/hero/Hero.tsx) — TidalDex + “More exchanges” (Uniswap, PancakeSwap, GDEX). AscendEX is in the data file but not in the hero filter; it still appears in Institutional partners.
  • Home tokenomics card (src/app/Home.tsx “Addresses & Locks”) — contract list, truncated, View only (no copy), TidalDex “Locked on TidalDex”, audits.
  • Footer in Home.tsx — BSC + Terra Classic + Buy CL8Y (TidalDex).
  • Institutional partners grid (src/features/institutional/Institutional.tsx) — all trading + listings logos, including AscendEX and Coinbase.
  • PROJECT_GUIDE.md “Key Links” still advertises AscendEX as live trading.

UX gaps:

  • No dedicated “Token / Addresses / Markets” section or nav item.
  • Addresses are truncated (0x8F452a1f…) without a one-click copy of the full checksummed address.
  • Contracts, listings, and venues are split across hero, tokenomics, institutional, footer, and markdown.
  • CEX and CEX-adjacent pages (AscendEX, Coinbase price) sit in the same buckets as real venues.
  • GeckoTerminal chart href in links.ts points at a token path that may be wrong (/bsc/pools/0x8F452a1f… uses the token address as a pool id). DexScreener uses pool 0xbe9f06b76e301b49dc345948a7a5e3418264886a.
  • No Ethereum / other-chain addresses in data even if Bridge wraps them — confirm with product whether more chains must be listed.

There is no automated test suite.

Why this is needed

Users (and support) need one obvious place to verify the real token and the real markets. The current site hides addresses, pushes TidalDex as “buy”, and still ships AscendEX + Coinbase in partner chrome. That is how people get sent to the wrong contract or a CEX we do not support.

After this work, a visitor should find addresses, listings, and DEX venues in one scan — from header, homepage section, and footer.

Constraints / guardrails

  1. No CEX. Remove AscendEX and any other centralized-exchange trade link. Do not add Binance, Coinbase trade, Kraken, etc. A Coinbase price page is not a place to trade; if kept, it belongs under listings and must be labeled “price page, not a CL8Y listing / not a venue”. Prefer dropping it if it implies we “work with Coinbase”.
  2. Single source of truth: src/data/links.ts (or a replacement src/data/tokenDirectory.ts that links.ts re-exports). UI must not hardcode TidalDex / AscendEX / contract strings (HeroImageCard currently hardcodes TidalDex).
  3. Categories must be distinct:
    • Addresses — chain, full address, explorer URL, copy action
    • Listings — data/price pages (CoinGecko, DexScreener, etc.)
    • Trade — DEX / aggregator swap URLs only
  4. Copy UX: full address visible (wrap on mobile) or revealed; copy-to-clipboard copies the canonical address, not the explorer URL. Show a short “copied” confirmation. Do not use a third-party clipboard library that injects scripts.
  5. Checksum / format: BSC (and any EVM) addresses displayed in EIP-55 checksum form matching the canonical 0x8F452a1fdd388A45e1080992eFF051b4dd9048d2. Terra address shown in full. Do not silently lowercase for display.
  6. Findability: reachable from header and footer (“Token”, “Addresses”, or “Markets”). On /, a dedicated section with its own id for #token / #markets deep link. Do not bury it only under Institutional logos.
  7. Do not invent venues. Only keep or add links that are still valid official markets. If a DEX URL 404s, remove it. Confirm whether CL8Y DEX (https://dex.cl8y.com) should be the first trade venue.
  8. CL8Y DEX first: If CL8Y is traded on dex.cl8y.com, that link is the primary trade CTA. Third-party DEXes are alternatives, clearly labeled by chain.
  9. No “More exchanges” language. That implies CEX. Use “Trade on DEX” / “Other DEX markets”.
  10. Security copy: one line near addresses: only use addresses from this page; verify the explorer link. Do not paste addresses from DMs.
  11. PROJECT_GUIDE.md Key Links must drop AscendEX and match the directory.
  12. Do not fetch addresses from user input, query strings, or third-party APIs to define the canonical contract. Explorer links may be static.
  13. Scope: This issue is the directory and data cleanup, not the full homepage rewrite. Coordinate hrefs with the redesign issue so “Buy CL8Y” does not remain the hero primary.

Relevant files

Area Files
Data src/data/links.ts, PROJECT_GUIDE.md (Key Links), src/lib/env.ts (VITE_CL8Y_ADDRESS, pair address)
Consumers src/features/hero/Hero.tsx, src/app/Home.tsx, src/features/institutional/Institutional.tsx, src/components/visuals/HeroImageCard.tsx
Chart src/components/visuals/GeckoTerminalChart.tsx, src/data/embeds.ts
Env defaults src/lib/env.ts — keep in sync with the BSC canonical address

Recommended direction

  1. Replace ad-hoc lists with a typed directory module, e.g. src/data/tokenDirectory.ts:

    type TokenAddress = { chain: string; address: string; explorerUrl: string; standard: "ERC-20" | "CW20" }
type Listing = { id: string; label: string; href: string; kind: "price" | "analytics" }
type TradeVenue = { id: string; label: string; href: string; chain: string; dex: true }

    Keep links.ts as a thin adapter or migrate callers.

  2. New TokenDirectory feature section (src/features/token/TokenDirectory.tsx):

    • Three labeled groups: Addresses | Listings | Trade on DEX
    • Each address row: chain name, full address (<code>), explorer link, Copy button
    • Trade rows: venue name, chain, logo optional, external link
    • Listings: name + external link only (no “trade” wording)

  3. Wire findability:

    • Header item → /#token (or /#markets)
    • Footer item with the same href
    • Homepage section id="token"

  4. Purge CEX:

    • Delete ascendex-cex from data and remove /images/partners/ascendex.png usage
    • Filter Institutional partner grid so it does not reintroduce CEX
    • Update Hero: remove “More exchanges”; point secondary trade to this section or list DEX venues only
    • Update PROJECT_GUIDE.md

  5. Canonical trade order (confirm before coding):

    1. CL8Y DEX — https://dex.cl8y.com (if CL8Y pair exists there)
    2. Remaining verified DEXes: TidalDex, PancakeSwap, Uniswap (BNB), GDEX
    3. Drop dead links after a manual HEAD/GET check

  6. Copy helper: small copyText(value: string) using navigator.clipboard.writeText with document.execCommand("copy") fallback. Never copy a different string than the one shown as canonical.

Acceptance criteria

  • A user can open the token directory from the first screen of chrome (header) and from the footer without hunting through Institutional logos.
  • Homepage has a dedicated addresses / listings / trade section with a stable hash (#token or #markets).
  • Official Terra Classic and BSC addresses are shown in full (or fully revealable) and copy in one click.
  • Explorer links open the correct official explorer pages for those exact addresses.
  • Trade group contains only DEX / on-chain venues. Zero CEX links (AscendEX gone from UI, data, and PROJECT_GUIDE.md).
  • Coinbase (or similar) is not presented as a place to trade CL8Y.
  • Listings are visually separate from trade venues.
  • CL8Y DEX is included as a trade venue if the pair is live; if not, document why it is omitted in the MR.
  • No hardcoded TidalDex / contract URLs remain in components; they read from the directory module.
  • Institutional partner grid does not resurrect removed CEX entries.
  • Clipboard success and permission-denied / insecure-context failure are handled (visible feedback, no thrown UI crash).
  • yarn typecheck, yarn lint, yarn build succeed.

Test plan — functional paths

  1. Discovery

    • Load /. Header control for Token/Markets is visible on desktop and in the mobile menu (if any).
    • Activate it → section in view (or hash updates and scroll works).
    • Repeat from footer. Repeat with a cold load of https://<host>/#token.

  2. Addresses

    • BSC row shows 0x8F452a1fdd388A45e1080992eFF051b4dd9048d2 (checksum). Copy → clipboard matches exactly.
    • Terra row shows full terra16wtml2q66g82fdkx66tap0qjkahqwp4lwq3ngtygacg5q0kzycgqvhpax3. Copy matches exactly.
    • Explorer links: BscScan token page and Terra finder/LUNCScan as specified — 200 and correct contract.
    • Keyboard: each Copy and explorer control is reachable and announced.

  3. Clipboard failure paths

    • Clipboard API rejected (permission denied): user sees failure text; address remains selectable.
    • Non-secure context / API missing: fallback or manual-select instruction; no white screen.

  4. Listings

    • Each listing opens in a new tab with noopener noreferrer.
    • Labels do not say “Trade on …”.
    • Broken listing URLs are removed, not left as 404.

  5. Trade venues

    • Every venue is a DEX. Click-through lands on a swap or pool page for CL8Y, not a generic homepage.
    • No AscendEX URL in DOM (document.body.innerHTML / built dist).
    • “More exchanges” copy is gone.

  6. Institutional / hero / footer consumers

    • Partner grid: no AscendEX logo.
    • Hero does not promote CEX.
    • Footer “Buy” if present points at directory or a DEX, not a CEX.

  7. Responsive

    • 375px width: full address wraps or scrolls inside the row; copy still works; no overflow hiding the hash.

  8. Docs

    • PROJECT_GUIDE.md Key Links matches the directory (no AscendEX).

  9. Build

    • yarn typecheck, yarn lint, yarn build. Search dist/ for ascendex.com — zero hits.

Test plan — attack, hack, and abuse vectors

The directory is a high-value phishing target. Review as if an attacker wants users to copy a wrong address or click a lookalike swap.

  1. Address substitution

    • Grep the branch for the canonical BSC and Terra strings. No second “similar” address in UI, comments rendered to the page, or env defaults used for display.
    • Confirm VITE_CL8Y_ADDRESS default in src/lib/env.ts matches the directory or is not shown as the official address if different.

  2. Homograph / lookalike links

    • Trade and listing hrefs are https, exact known hosts (dex.cl8y.com, tidaldex.com, pancakeswap.finance, app.uniswap.org, garuda-defi.org, geckoterminal.com, etc.).
    • Reject ascendex.com, punycode lookalikes, and cl8y.com.<attacker> redirectors.

  3. Clipboard hijacking (defense in our code)

    • Copy handler writes only the constant address from the directory module — not event.target.innerText from a mutable DOM node that an extension could alter after render. Prefer copying from the typed constant.
    • Do not load a clipboard “helper” from a CDN.

  4. XSS via copy / toast

    • Copied value is never injected as HTML. Toast is static text (“Copied BSC address”).

  5. Open redirect / query injection

    • Directory hrefs are compile-time constants. No new URLSearchParams(location.search) to pick a venue.

  6. Tabnabbing / reverse tabnabbing

    • target="_blank" + rel="noopener noreferrer" on every external directory link.

  7. SEO / share bait

    • Section does not claim CEX listings or “official Coinbase listing”.

  8. Supply-chain widgets

    • Do not embed a third-party “add token to wallet” iframe that could request signatures. If “Add to wallet” is added later, it is a separate issue with wallet-connect review. Out of scope here.

  9. Social engineering copy

    • Include the verify-on-explorer warning. Do not use “send CL8Y to this address to unlock tiers” or any deposit instruction.

  10. Cache / stale CEX

    • After deploy, view-source and dist contain no ascendex / CEX trade URLs. CDN/old JS chunk names should not keep the old links array if the module changed — verify the built chunk.

  11. Clickjacking on copy

    • Copy buttons are not covered by an invisible overlay. Directory section is not inside a third-party iframe we create.

Verification criteria

Done when a reviewer can:

  1. From a cold homepage load, reach official addresses in ≤ 2 clicks (or one header tap) and copy both canonical addresses.
  2. Show a clean three-part list: addresses, listings, DEX trades — and explain each group without reading code.
  3. Prove ascendex.com and other CEX trade URLs are absent from src/data/links.ts (or successor), PROJECT_GUIDE.md, rendered /, and dist/.
  4. Click every remaining trade and listing link once; all resolve to the intended official page.
  5. Confirm clipboard success + failure paths on desktop Chrome and one mobile browser.
  6. Confirm yarn typecheck, yarn lint, and yarn build succeed.

Out of scope

  • Homepage narrative redesign (companion issue), except removing CEX CTAs from existing consumers.
  • Wallet “add token” flows, swap embeds, or connecting a wallet on cl8y.com.
  • Changing Bridge or DEX app code.
  • Inventing extra chain addresses without a confirmed official deployment.
## Summary Add an **easy-to-find official directory** of CL8Y **token addresses**, **listings**, and **places to trade**. CL8Y no longer works with centralized exchanges. All trade venues must be DEX / on-chain / aggregator pages. This is the anti-phishing surface of the marketing site: one canonical list, copyable addresses, no CEX. Depends on the companion redesign issue for chrome/nav placement, but can land as a section + data-layer change if the redesign header is not ready. --- ## Current codebase Official URLs are centralized in `src/data/links.ts` (`links`, `linksByCategory`). Categories today: `trading`, `contracts`, `chart`, `social`, `listings`, `audit`, `comingSoon`. **Contracts (2):** - Terra Classic CW20: `terra16wtml2q66g82fdkx66tap0qjkahqwp4lwq3ngtygacg5q0kzycgqvhpax3` (finder.terra.money) - BSC ERC-20: `0x8F452a1fdd388A45e1080992eFF051b4dd9048d2` (bscscan.com) **Trading (includes a CEX we no longer use):** - TidalDex (BSC) — primary “Buy CL8Y” everywhere - **AscendEX (CEX)** — `https://ascendex.com/en-us/cashtrade-spottrading/usdt/cl8y` - Uniswap (BNB token page) - PancakeSwap - GDEX (Terra Classic) **Listings:** CZodiac, Blockspot, BeInCrypto, **Coinbase price page**, CoinCarp, BscScan, LUNCScan, DropsTab, Coinranking, DexScreener, DexTools, CoinPaprika, CoinGecko. **Where this data is rendered today:** - Hero (`src/features/hero/Hero.tsx`) — TidalDex + “More exchanges” (Uniswap, PancakeSwap, GDEX). AscendEX is in the data file but **not** in the hero filter; it still appears in Institutional partners. - Home tokenomics card (`src/app/Home.tsx` “Addresses & Locks”) — contract list, truncated, **View** only (no copy), TidalDex “Locked on TidalDex”, audits. - Footer in `Home.tsx` — BSC + Terra Classic + Buy CL8Y (TidalDex). - Institutional partners grid (`src/features/institutional/Institutional.tsx`) — **all** `trading` + `listings` logos, including AscendEX and Coinbase. - `PROJECT_GUIDE.md` “Key Links” still advertises AscendEX as live trading. **UX gaps:** - No dedicated “Token / Addresses / Markets” section or nav item. - Addresses are truncated (`0x8F452a1f…`) without a one-click copy of the **full** checksummed address. - Contracts, listings, and venues are split across hero, tokenomics, institutional, footer, and markdown. - CEX and CEX-adjacent pages (AscendEX, Coinbase price) sit in the same buckets as real venues. - GeckoTerminal chart href in `links.ts` points at a **token** path that may be wrong (`/bsc/pools/0x8F452a1f…` uses the token address as a pool id). DexScreener uses pool `0xbe9f06b76e301b49dc345948a7a5e3418264886a`. - No Ethereum / other-chain addresses in data even if Bridge wraps them — confirm with product whether more chains must be listed. There is no automated test suite. --- ## Why this is needed Users (and support) need one obvious place to verify the real token and the real markets. The current site hides addresses, pushes TidalDex as “buy”, and still ships AscendEX + Coinbase in partner chrome. That is how people get sent to the wrong contract or a CEX we do not support. After this work, a visitor should find **addresses, listings, and DEX venues** in one scan — from header, homepage section, and footer. --- ## Constraints / guardrails 1. **No CEX.** Remove AscendEX and any other centralized-exchange trade link. Do not add Binance, Coinbase trade, Kraken, etc. A Coinbase *price* page is not a place to trade; if kept, it belongs under **listings** and must be labeled “price page, not a CL8Y listing / not a venue”. Prefer dropping it if it implies we “work with Coinbase”. 2. **Single source of truth:** `src/data/links.ts` (or a replacement `src/data/tokenDirectory.ts` that `links.ts` re-exports). UI must not hardcode TidalDex / AscendEX / contract strings (HeroImageCard currently hardcodes TidalDex). 3. **Categories must be distinct:** - **Addresses** — chain, full address, explorer URL, copy action - **Listings** — data/price pages (CoinGecko, DexScreener, etc.) - **Trade** — DEX / aggregator swap URLs only 4. **Copy UX:** full address visible (wrap on mobile) or revealed; copy-to-clipboard copies the canonical address, not the explorer URL. Show a short “copied” confirmation. Do not use a third-party clipboard library that injects scripts. 5. **Checksum / format:** BSC (and any EVM) addresses displayed in EIP-55 checksum form matching the canonical `0x8F452a1fdd388A45e1080992eFF051b4dd9048d2`. Terra address shown in full. Do not silently lowercase for display. 6. **Findability:** reachable from header and footer (“Token”, “Addresses”, or “Markets”). On `/`, a dedicated section with its own `id` for `#token` / `#markets` deep link. Do not bury it only under Institutional logos. 7. **Do not invent venues.** Only keep or add links that are still valid official markets. If a DEX URL 404s, remove it. Confirm whether CL8Y DEX (`https://dex.cl8y.com`) should be the **first** trade venue. 8. **CL8Y DEX first:** If CL8Y is traded on `dex.cl8y.com`, that link is the primary trade CTA. Third-party DEXes are alternatives, clearly labeled by chain. 9. **No “More exchanges” language.** That implies CEX. Use “Trade on DEX” / “Other DEX markets”. 10. **Security copy:** one line near addresses: only use addresses from this page; verify the explorer link. Do not paste addresses from DMs. 11. **PROJECT_GUIDE.md** Key Links must drop AscendEX and match the directory. 12. **Do not** fetch addresses from user input, query strings, or third-party APIs to *define* the canonical contract. Explorer links may be static. 13. **Scope:** This issue is the directory and data cleanup, not the full homepage rewrite. Coordinate hrefs with the redesign issue so “Buy CL8Y” does not remain the hero primary. --- ## Relevant files | Area | Files | | --- | --- | | Data | `src/data/links.ts`, `PROJECT_GUIDE.md` (Key Links), `src/lib/env.ts` (`VITE_CL8Y_ADDRESS`, pair address) | | Consumers | `src/features/hero/Hero.tsx`, `src/app/Home.tsx`, `src/features/institutional/Institutional.tsx`, `src/components/visuals/HeroImageCard.tsx` | | Chart | `src/components/visuals/GeckoTerminalChart.tsx`, `src/data/embeds.ts` | | Env defaults | `src/lib/env.ts` — keep in sync with the BSC canonical address | --- ## Recommended direction 1. **Replace ad-hoc lists with a typed directory module**, e.g. `src/data/tokenDirectory.ts`: ```ts type TokenAddress = { chain: string; address: string; explorerUrl: string; standard: "ERC-20" | "CW20" } type Listing = { id: string; label: string; href: string; kind: "price" | "analytics" } type TradeVenue = { id: string; label: string; href: string; chain: string; dex: true } ``` Keep `links.ts` as a thin adapter or migrate callers. 2. **New `TokenDirectory` feature section** (`src/features/token/TokenDirectory.tsx`): - Three labeled groups: Addresses | Listings | Trade on DEX - Each address row: chain name, full address (`<code>`), explorer link, Copy button - Trade rows: venue name, chain, logo optional, external link - Listings: name + external link only (no “trade” wording) 3. **Wire findability:** - Header item → `/#token` (or `/#markets`) - Footer item with the same href - Homepage section `id="token"` 4. **Purge CEX:** - Delete `ascendex-cex` from data and remove `/images/partners/ascendex.png` usage - Filter Institutional partner grid so it does not reintroduce CEX - Update Hero: remove “More exchanges”; point secondary trade to this section or list DEX venues only - Update `PROJECT_GUIDE.md` 5. **Canonical trade order (confirm before coding):** 1. CL8Y DEX — `https://dex.cl8y.com` (if CL8Y pair exists there) 2. Remaining verified DEXes: TidalDex, PancakeSwap, Uniswap (BNB), GDEX 3. Drop dead links after a manual HEAD/GET check 6. **Copy helper:** small `copyText(value: string)` using `navigator.clipboard.writeText` with `document.execCommand("copy")` fallback. Never copy a different string than the one shown as canonical. --- ## Acceptance criteria - [ ] A user can open the token directory from the first screen of chrome (header) and from the footer without hunting through Institutional logos. - [ ] Homepage has a dedicated addresses / listings / trade section with a stable hash (`#token` or `#markets`). - [ ] Official Terra Classic and BSC addresses are shown in full (or fully revealable) and copy in one click. - [ ] Explorer links open the correct official explorer pages for those exact addresses. - [ ] Trade group contains **only** DEX / on-chain venues. Zero CEX links (AscendEX gone from UI, data, and `PROJECT_GUIDE.md`). - [ ] Coinbase (or similar) is not presented as a place to trade CL8Y. - [ ] Listings are visually separate from trade venues. - [ ] CL8Y DEX is included as a trade venue if the pair is live; if not, document why it is omitted in the MR. - [ ] No hardcoded TidalDex / contract URLs remain in components; they read from the directory module. - [ ] Institutional partner grid does not resurrect removed CEX entries. - [ ] Clipboard success and permission-denied / insecure-context failure are handled (visible feedback, no thrown UI crash). - [ ] `yarn typecheck`, `yarn lint`, `yarn build` succeed. --- ## Test plan — functional paths 1. **Discovery** - Load `/`. Header control for Token/Markets is visible on desktop and in the mobile menu (if any). - Activate it → section in view (or hash updates and scroll works). - Repeat from footer. Repeat with a cold load of `https://<host>/#token`. 2. **Addresses** - BSC row shows `0x8F452a1fdd388A45e1080992eFF051b4dd9048d2` (checksum). Copy → clipboard matches exactly. - Terra row shows full `terra16wtml2q66g82fdkx66tap0qjkahqwp4lwq3ngtygacg5q0kzycgqvhpax3`. Copy matches exactly. - Explorer links: BscScan token page and Terra finder/LUNCScan as specified — 200 and correct contract. - Keyboard: each Copy and explorer control is reachable and announced. 3. **Clipboard failure paths** - Clipboard API rejected (permission denied): user sees failure text; address remains selectable. - Non-secure context / API missing: fallback or manual-select instruction; no white screen. 4. **Listings** - Each listing opens in a new tab with `noopener noreferrer`. - Labels do not say “Trade on …”. - Broken listing URLs are removed, not left as 404. 5. **Trade venues** - Every venue is a DEX. Click-through lands on a swap or pool page for CL8Y, not a generic homepage. - No AscendEX URL in DOM (`document.body.innerHTML` / built `dist`). - “More exchanges” copy is gone. 6. **Institutional / hero / footer consumers** - Partner grid: no AscendEX logo. - Hero does not promote CEX. - Footer “Buy” if present points at directory or a DEX, not a CEX. 7. **Responsive** - 375px width: full address wraps or scrolls inside the row; copy still works; no overflow hiding the hash. 8. **Docs** - `PROJECT_GUIDE.md` Key Links matches the directory (no AscendEX). 9. **Build** - `yarn typecheck`, `yarn lint`, `yarn build`. Search `dist/` for `ascendex.com` — zero hits. --- ## Test plan — attack, hack, and abuse vectors The directory is a **high-value phishing target**. Review as if an attacker wants users to copy a wrong address or click a lookalike swap. 1. **Address substitution** - Grep the branch for the canonical BSC and Terra strings. No second “similar” address in UI, comments rendered to the page, or env defaults used for display. - Confirm `VITE_CL8Y_ADDRESS` default in `src/lib/env.ts` matches the directory or is not shown as the official address if different. 2. **Homograph / lookalike links** - Trade and listing hrefs are https, exact known hosts (`dex.cl8y.com`, `tidaldex.com`, `pancakeswap.finance`, `app.uniswap.org`, `garuda-defi.org`, `geckoterminal.com`, etc.). - Reject `ascendex.com`, punycode lookalikes, and `cl8y.com.<attacker>` redirectors. 3. **Clipboard hijacking (defense in our code)** - Copy handler writes only the constant address from the directory module — not `event.target.innerText` from a mutable DOM node that an extension could alter after render. Prefer copying from the typed constant. - Do not load a clipboard “helper” from a CDN. 4. **XSS via copy / toast** - Copied value is never injected as HTML. Toast is static text (“Copied BSC address”). 5. **Open redirect / query injection** - Directory hrefs are compile-time constants. No `new URLSearchParams(location.search)` to pick a venue. 6. **Tabnabbing / reverse tabnabbing** - `target="_blank"` + `rel="noopener noreferrer"` on every external directory link. 7. **SEO / share bait** - Section does not claim CEX listings or “official Coinbase listing”. 8. **Supply-chain widgets** - Do not embed a third-party “add token to wallet” iframe that could request signatures. If “Add to wallet” is added later, it is a separate issue with wallet-connect review. Out of scope here. 9. **Social engineering copy** - Include the verify-on-explorer warning. Do not use “send CL8Y to this address to unlock tiers” or any deposit instruction. 10. **Cache / stale CEX** - After deploy, view-source and `dist` contain no `ascendex` / CEX trade URLs. CDN/old JS chunk names should not keep the old `links` array if the module changed — verify the built chunk. 11. **Clickjacking on copy** - Copy buttons are not covered by an invisible overlay. Directory section is not inside a third-party iframe we create. --- ## Verification criteria Done when a reviewer can: 1. From a cold homepage load, reach official addresses in ≤ 2 clicks (or one header tap) and copy both canonical addresses. 2. Show a clean three-part list: addresses, listings, DEX trades — and explain each group without reading code. 3. Prove `ascendex.com` and other CEX trade URLs are absent from `src/data/links.ts` (or successor), `PROJECT_GUIDE.md`, rendered `/`, and `dist/`. 4. Click every remaining trade and listing link once; all resolve to the intended official page. 5. Confirm clipboard success + failure paths on desktop Chrome and one mobile browser. 6. Confirm `yarn typecheck`, `yarn lint`, and `yarn build` succeed. --- ## Out of scope - Homepage narrative redesign (companion issue), except removing CEX CTAs from existing consumers. - Wallet “add token” flows, swap embeds, or connecting a wallet on cl8y.com. - Changing Bridge or DEX app code. - Inventing extra chain addresses without a confirmed official deployment.
PlasticDigits commented 2026-08-25 06:30:11 +00:00 (Migrated from gitlab.com)
Copy link

marked as related to #1

marked as related to #1
PlasticDigits commented 2026-08-25 06:51:54 +00:00 (Migrated from gitlab.com)
Copy link

mentioned in merge request !8

mentioned in merge request !8
PlasticDigits commented 2026-08-25 06:52:21 +00:00 (Migrated from gitlab.com)
Copy link

mentioned in issue #1

mentioned in issue #1
PlasticDigits commented 2026-08-25 07:00:10 +00:00 (Migrated from gitlab.com)
Copy link

mentioned in issue #3

mentioned in issue #3
PlasticDigits commented 2026-08-25 07:20:24 +00:00 (Migrated from gitlab.com)
Copy link

mentioned in merge request !9

mentioned in merge request !9
PlasticDigits commented 2026-08-25 13:10:06 +00:00 (Migrated from gitlab.com)
Copy link

mentioned in merge request !10

mentioned in merge request !10
PlasticDigits commented 2026-08-25 13:10:14 +00:00 (Migrated from gitlab.com)
Copy link

Implemented on !10 (clean branch on current main). !9 should be closed: it deletes the blog/prerender stack.

Implemented on !10 (clean branch on current `main`). !9 should be closed: it deletes the blog/prerender stack.
PlasticDigits commented 2026-08-25 13:31:57 +00:00 (Migrated from gitlab.com)
Copy link

mentioned in issue #4

mentioned in issue #4
PlasticDigits commented 2026-08-26 01:11:52 +00:00 (Migrated from gitlab.com)
Copy link

mentioned in commit b124356850

mentioned in commit b124356850453eecba3b28bc8bfe01ffdb06c578
PlasticDigits (Migrated from gitlab.com) closed this issue 2026-08-26 01:11:52 +00:00
PlasticDigits commented 2026-08-26 01:12:02 +00:00 (Migrated from gitlab.com)
Copy link

Merge review (2026-08-26)

Merged !10 (issue-2-official-token-directory) into main. That branch satisfies the directory acceptance criteria:

  • Header + footer Token reach #token; addresses (BSC checksum, Terra Classic full, MegaETH), copy-from-constant, explorers, DEX-first trade group, separate listings.
  • Zero ascendex.com / Coinbase / “Buy CL8Y” / “More exchanges” on current surfaces, src/data, PROJECT_GUIDE.md, and dist/.
  • yarn test, yarn typecheck, yarn lint, yarn build passed. Playwright e2e (5 workers) passed.

Closed !9 without merging. detailed_merge_status: conflict. Rebasing it onto current main would delete the blog/prerender stack and drop MegaETH / Kumbaya / SIR venues that are already official. Do not revive that branch.

Leftovers (not blockers for this issue): unmounted HeroImageCard / MarketingFooter still contain “Buy CL8Y” + a hardcoded TidalDex href. They are in RETIRED_HOMEPAGE_MODULES / unused; do not remount. Blog sidebar “About CL8Y” blurb is still old platform/GameFi wording (no CEX).

Post-merge: production curl -sI https://cl8y.com still has no clickjacking headers (tracked on #3 / follow-up).

Merge review (2026-08-26) **Merged !10** (`issue-2-official-token-directory`) into `main`. That branch satisfies the directory acceptance criteria: - Header + footer Token reach `#token`; addresses (BSC checksum, Terra Classic full, MegaETH), copy-from-constant, explorers, DEX-first trade group, separate listings. - Zero `ascendex.com` / Coinbase / “Buy CL8Y” / “More exchanges” on current surfaces, `src/data`, `PROJECT_GUIDE.md`, and `dist/`. - `yarn test`, `yarn typecheck`, `yarn lint`, `yarn build` passed. Playwright e2e (5 workers) passed. **Closed !9 without merging.** `detailed_merge_status: conflict`. Rebasing it onto current `main` would delete the blog/prerender stack and drop MegaETH / Kumbaya / SIR venues that are already official. Do not revive that branch. **Leftovers (not blockers for this issue):** unmounted `HeroImageCard` / `MarketingFooter` still contain “Buy CL8Y” + a hardcoded TidalDex href. They are in `RETIRED_HOMEPAGE_MODULES` / unused; do not remount. Blog sidebar “About CL8Y” blurb is still old platform/GameFi wording (no CEX). **Post-merge:** production `curl -sI https://cl8y.com` still has no clickjacking headers (tracked on #3 / follow-up).
PlasticDigits commented 2026-08-26 01:12:11 +00:00 (Migrated from gitlab.com)
Copy link

mentioned in issue #5

mentioned in issue #5
PlasticDigits commented 2026-08-31 05:20:24 +00:00 (Migrated from gitlab.com)
Copy link

mentioned in issue #6

mentioned in issue #6
PlasticDigits commented 2026-08-31 05:34:26 +00:00 (Migrated from gitlab.com)
Copy link

mentioned in issue #7

mentioned in issue #7
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
issue/12
issue/34
issue/14
renovate/configure
No results found.
Labels
Clear labels   
agent:implement

   
agent:ready

   
bug

   
documentation

   
duplicate

   
enhancement

   
good first issue

   
help wanted

   
invalid

   
question

   
ready

   
wontfix
No labels
agent:implement
agent:ready
bug
documentation
duplicate
enhancement
good first issue
help wanted
invalid
question
ready
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
code/CL8Y-web#2
No description provided.