code/cl8y-dex-terraclassic

Fork 0

Security: dApp footer does not link to security posture docs [SEC-A01] #387

New issue

Closed

opened 2026-06-18 14:41:55 +00:00 by totdking · 9 comments

totdking commented

2026-06-18 14:41:55 +00:00

(Migrated from gitlab.com)

No description provided.

totdking commented

2026-06-18 14:48:06 +00:00

(Migrated from gitlab.com)

Checklist Item

SEC-A01: Define the public security posture for small-TVL launch: capped expectations, unaudited/limited-audit language, admin controls, and known residual risks. Verify: docs page or launch notice exists and is linked from the dApp/footer.

Summary

The security posture content exists across multiple docs files but the dApp footer renders only plain text with no hyperlink to any of them. The verify condition requires a link from the footer and none is present.

What Was Checked

frontend-dapp/src/components/legal/LegalFooterNotice.tsx -- the footer component rendered in Layout
frontend-dapp/src/utils/constants.ts -- checked for any link constants used in footer
docs/security-model.md -- confirmed security posture content exists
docs/contracts-security-audit.md -- confirmed unaudited language and residual risks exist

Expected (per checklist)

A docs page or launch notice covering capped expectations, unaudited/limited-audit language, admin controls, and known residual risks must be linked from the dApp footer.

Actual

LegalFooterNotice.tsx renders a single <p> tag with the NFA short copy and a generic risk statement. No anchor tag or link of any kind is present. The constant DOCS_GITLAB_BASE exists in constants.ts line 14 pointing to the GitLab docs folder but is not imported or used anywhere in the footer component.

Evidence

frontend-dapp/src/components/legal/LegalFooterNotice.tsx lines 3-9: only a <p> with {NFA_SHORT} and static text, no <a> tag
frontend-dapp/src/utils/constants.ts line 14: DOCS_GITLAB_BASE defined but unused in the footer
docs/security-model.md: audit disclaimer exists ("Contracts have not yet been formally audited...")
docs/contracts-security-audit.md: residual risks and trust model exist

Suggested Fix

Import DOCS_GITLAB_BASE from constants.ts into LegalFooterNotice.tsx and add a link element pointing to docs/security-model.md (or a consolidated public security page) with label text such as "Security and audit docs". The link should open in a new tab and be visible without scrolling on desktop and mobile layouts.

Verification Checklist

Steps to confirm the fix is complete and the checklist item can be marked done.

LegalFooterNotice.tsx imports DOCS_GITLAB_BASE from constants.ts
Footer renders a visible anchor tag linking to the security posture doc
Link opens in a new tab and resolves to a valid page (security-model.md or equivalent)
Link is visible in the footer on both desktop and mobile layouts without scrolling
No existing footer tests are broken by the change

Labels

pre-launch ~security

Cc: @PlasticDigits

### Checklist Item SEC-A01: Define the public security posture for small-TVL launch: capped expectations, unaudited/limited-audit language, admin controls, and known residual risks. Verify: docs page or launch notice exists and is linked from the dApp/footer. --- ### Summary The security posture content exists across multiple docs files but the dApp footer renders only plain text with no hyperlink to any of them. The verify condition requires a link from the footer and none is present. --- ### What Was Checked - `frontend-dapp/src/components/legal/LegalFooterNotice.tsx` -- the footer component rendered in Layout - `frontend-dapp/src/utils/constants.ts` -- checked for any link constants used in footer - `docs/security-model.md` -- confirmed security posture content exists - `docs/contracts-security-audit.md` -- confirmed unaudited language and residual risks exist --- ### Expected (per checklist) A docs page or launch notice covering capped expectations, unaudited/limited-audit language, admin controls, and known residual risks must be linked from the dApp footer. --- ### Actual `LegalFooterNotice.tsx` renders a single `<p>` tag with the NFA short copy and a generic risk statement. No anchor tag or link of any kind is present. The constant `DOCS_GITLAB_BASE` exists in `constants.ts` line 14 pointing to the GitLab docs folder but is not imported or used anywhere in the footer component. --- ### Evidence - `frontend-dapp/src/components/legal/LegalFooterNotice.tsx` lines 3-9: only a `<p>` with `{NFA_SHORT}` and static text, no `<a>` tag - `frontend-dapp/src/utils/constants.ts` line 14: `DOCS_GITLAB_BASE` defined but unused in the footer - `docs/security-model.md`: audit disclaimer exists ("Contracts have not yet been formally audited...") - `docs/contracts-security-audit.md`: residual risks and trust model exist --- ### Suggested Fix Import `DOCS_GITLAB_BASE` from `constants.ts` into `LegalFooterNotice.tsx` and add a link element pointing to `docs/security-model.md` (or a consolidated public security page) with label text such as "Security and audit docs". The link should open in a new tab and be visible without scrolling on desktop and mobile layouts. --- ### Verification Checklist Steps to confirm the fix is complete and the checklist item can be marked done. - [ ] `LegalFooterNotice.tsx` imports `DOCS_GITLAB_BASE` from `constants.ts` - [ ] Footer renders a visible anchor tag linking to the security posture doc - [ ] Link opens in a new tab and resolves to a valid page (security-model.md or equivalent) - [ ] Link is visible in the footer on both desktop and mobile layouts without scrolling - [ ] No existing footer tests are broken by the change --- ### Labels `pre-launch` ~security Cc: @PlasticDigits

totdking commented

2026-06-18 15:38:05 +00:00

(Migrated from gitlab.com)

mentioned in issue #381

PlasticDigits commented

2026-06-19 01:33:13 +00:00

(Migrated from gitlab.com)

The security posture doc needs to be thorough and explain that security requirements scale with tvl to make cba from attackers negative as product grows.

PlasticDigits commented

2026-06-19 01:38:00 +00:00

(Migrated from gitlab.com)

mentioned in commit 7b423fdea7

mentioned in commit 7b423fdea7d57c625702acbfa412d161e0a05a2c

PlasticDigits commented

2026-06-19 01:38:15 +00:00

(Migrated from gitlab.com)

mentioned in merge request !915

PlasticDigits commented

2026-06-19 01:55:41 +00:00

(Migrated from gitlab.com)

mentioned in commit 6d45b1158c

mentioned in commit 6d45b1158c59dfa97f0b4e006f713e5b2bb68a7e

PlasticDigits commented

2026-06-19 08:17:23 +00:00

(Migrated from gitlab.com)

mentioned in commit 13900236ec

mentioned in commit 13900236eccaf4af1daf55b8fd8ebfce98e43f7d

PlasticDigits commented

2026-06-19 08:24:08 +00:00

(Migrated from gitlab.com)

Verification — SEC-A01 (#387)

Result: PASS (fix already on main via 13900236 — no verifier MR required)

Acceptance criteria

Item	Result	How verified
Footer links to public security posture doc	PASS	`LegalFooterNotice.tsx` renders `data-testid="security-posture-doc-link"` → `SECURITY_POSTURE_DOC_URL` (`…/docs/security-posture.md`) with `target="_blank"` / `rel="noopener noreferrer"`
Constant wired from `constants.ts`	PASS	`SECURITY_POSTURE_DOC_URL` built from `DOCS_GITLAB_BASE` in `frontend-dapp/src/utils/constants.ts`
Doc covers capped launch expectations, audit disclaimer, admin controls, residual risks	PASS	`docs/security-posture.md` — launch table, audit status, admin-controls table, residual-risks section
TVL-scaled security requirements (stakeholder comment)	PASS	`docs/security-posture.md` § “Security requirements scale with TVL” — USD bands ($0–$1M / $1M–$25M / $25M+) and attack-economics rationale
Link target resolves	PASS	`curl -sI` → HTTP 200 for `https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/blob/main/docs/security-posture.md`
Footer unit tests	PASS	`npm test -- --run src/components/legal/__tests__/LegalFooterNotice.test.tsx` — 3/3 passed
Visible on desktop & mobile (no scroll to find link)	PASS	Playwright smoke on `/swap` @ 1280×720: link visible. Mobile @ iPhone 13 viewport: link visible in both `app-mobile-legal-strip` (in-viewport) and `footer` (strict-mode duplicate — feature present twice on narrow layouts)
Cross-doc links	PASS	`docs/security-model.md`, `docs/frontend.md`, `docs/README.md`, `skills/AGENTS_FRONTEND_TRUST_BOUNDARIES.md` reference `security-posture.md` + SEC-A01
Related footer guardrail (#390)	PASS	`python3 scripts/check_user_incident_faq_docs.py`

Commands run

glab issue view 387 --comments
npm test -- --run src/components/legal/__tests__/LegalFooterNotice.test.tsx  # frontend-dapp
curl -sI "https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/blob/main/docs/security-posture.md"
python3 scripts/check_user_incident_faq_docs.py
PLAYWRIGHT_SKIP_CHAIN=1 REQUIRE_LOCALTERRA=0 npx playwright test e2e/verify-issue-387.spec.ts  # ephemeral; desktop pass, mobile link visible (2 instances)

Closing as verified on main.

## Verification — SEC-A01 (#387) **Result: PASS** (fix already on `main` via `13900236` — no verifier MR required) ### Acceptance criteria | Item | Result | How verified | |------|--------|--------------| | Footer links to public security posture doc | **PASS** | `LegalFooterNotice.tsx` renders `data-testid="security-posture-doc-link"` → `SECURITY_POSTURE_DOC_URL` (`…/docs/security-posture.md`) with `target="_blank"` / `rel="noopener noreferrer"` | | Constant wired from `constants.ts` | **PASS** | `SECURITY_POSTURE_DOC_URL` built from `DOCS_GITLAB_BASE` in `frontend-dapp/src/utils/constants.ts` | | Doc covers capped launch expectations, audit disclaimer, admin controls, residual risks | **PASS** | `docs/security-posture.md` — launch table, audit status, admin-controls table, residual-risks section | | TVL-scaled security requirements (stakeholder comment) | **PASS** | `docs/security-posture.md` § “Security requirements scale with TVL” — USD bands ($0–$1M / $1M–$25M / $25M+) and attack-economics rationale | | Link target resolves | **PASS** | `curl -sI` → **HTTP 200** for `https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/blob/main/docs/security-posture.md` | | Footer unit tests | **PASS** | `npm test -- --run src/components/legal/__tests__/LegalFooterNotice.test.tsx` — 3/3 passed | | Visible on desktop & mobile (no scroll to find link) | **PASS** | Playwright smoke on `/swap` @ 1280×720: link visible. Mobile @ iPhone 13 viewport: link visible in **both** `app-mobile-legal-strip` (in-viewport) and `footer` (strict-mode duplicate — feature present twice on narrow layouts) | | Cross-doc links | **PASS** | `docs/security-model.md`, `docs/frontend.md`, `docs/README.md`, `skills/AGENTS_FRONTEND_TRUST_BOUNDARIES.md` reference `security-posture.md` + SEC-A01 | | Related footer guardrail (#390) | **PASS** | `python3 scripts/check_user_incident_faq_docs.py` | ### Commands run ```bash glab issue view 387 --comments npm test -- --run src/components/legal/__tests__/LegalFooterNotice.test.tsx # frontend-dapp curl -sI "https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/blob/main/docs/security-posture.md" python3 scripts/check_user_incident_faq_docs.py PLAYWRIGHT_SKIP_CHAIN=1 REQUIRE_LOCALTERRA=0 npx playwright test e2e/verify-issue-387.spec.ts # ephemeral; desktop pass, mobile link visible (2 instances) ``` Closing as verified on `main`.

PlasticDigits (Migrated from gitlab.com) closed this issue

2026-06-19 08:24:09 +00:00

PlasticDigits commented

2026-08-26 04:13:33 +00:00

(Migrated from gitlab.com)

mentioned in issue #663