code/cl8y-dex-terraclassic

Fork 0

Security: no frontend tests assert blacklist message copy or disabled CTAs [SEC-A02] #388

New issue

Closed

opened 2026-06-18 15:01:33 +00:00 by totdking · 13 comments

totdking commented

2026-06-18 15:01:33 +00:00

(Migrated from gitlab.com)

No description provided.

totdking commented

2026-06-18 15:03:14 +00:00

(Migrated from gitlab.com)

Checklist Item

SEC-A02: Write user-facing copy for trading blacklist, pair pause, wrap pause, rate limit, indexer outage, and excessive slippage states. Verify: frontend tests assert clear messages and disabled CTAs where applicable.

Summary

User-facing copy for the trading blacklist state exists in the codebase but there are zero frontend tests -- unit or e2e -- that assert the message text is displayed or that action buttons are disabled when a wallet, token, or pair is blacklisted.

What Was Checked

frontend-dapp/src/services/terraclassic/blacklist.ts -- confirmed copy exists for wallet, pair, token, and generic blacklist states
frontend-dapp/src/hooks/useTradingBlacklist.ts -- confirmed hook manages blacklist state
frontend-dapp/src/components/trade/TradeOrderTicket.tsx lines 688-695 -- confirmed alert renders blacklist message
frontend-dapp/src/pages/SwapPage.tsx line 897 -- confirmed "Trading restricted" disabled button text
All test directories searched: src/**/__tests__/, src/pages/*.test.tsx, frontend-dapp/e2e/

Expected (per checklist)

Frontend tests must assert that when a wallet, token, or pair is blacklisted: the correct message copy is displayed, and relevant action CTAs (swap, provide, withdraw, limit place/cancel/claim) are disabled.

Actual

No test file asserts any blacklist message string or checks that a CTA is disabled under blacklist conditions. The blacklist service and hook exist and are wired into the UI but the behavior is untested at the frontend layer.

Evidence

frontend-dapp/src/services/terraclassic/blacklist.ts lines 39-53: copy defined for all four blacklist variants
frontend-dapp/src/components/trade/TradeOrderTicket.tsx lines 688-695: alert renders the copy
frontend-dapp/src/pages/SwapPage.tsx line 897: "Trading restricted" button text
No test file found containing any of: blacklist, Trading restricted, trading blacklist, or useTradingBlacklist assertions

Suggested Fix

Add unit tests (Vitest + Testing Library) that mock useTradingBlacklist to return each blacklist variant (wallet, token, pair, generic) and assert:

The correct message string is rendered in the alert
The swap/provide/withdraw/limit action buttons are disabled Cover at minimum SwapPage and TradeOrderTicket. A Playwright e2e smoke for the wallet-blacklisted state on LocalTerra would also satisfy the checklist.

Verification Checklist

Steps to confirm the fix is complete and the checklist item can be marked done.

Unit tests exist for wallet blacklist state: message text asserted, swap button disabled
Unit tests exist for token blacklist state: message text asserted, action buttons disabled
Unit tests exist for pair blacklist state: message text asserted, action buttons disabled
Tests cover SwapPage and TradeOrderTicket at minimum
All new tests pass in CI

Labels

~security , pre-launch

Cc: @PlasticDigits

### Checklist Item SEC-A02: Write user-facing copy for trading blacklist, pair pause, wrap pause, rate limit, indexer outage, and excessive slippage states. Verify: frontend tests assert clear messages and disabled CTAs where applicable. --- ### Summary User-facing copy for the trading blacklist state exists in the codebase but there are zero frontend tests -- unit or e2e -- that assert the message text is displayed or that action buttons are disabled when a wallet, token, or pair is blacklisted. --- ### What Was Checked - `frontend-dapp/src/services/terraclassic/blacklist.ts` -- confirmed copy exists for wallet, pair, token, and generic blacklist states - `frontend-dapp/src/hooks/useTradingBlacklist.ts` -- confirmed hook manages blacklist state - `frontend-dapp/src/components/trade/TradeOrderTicket.tsx` lines 688-695 -- confirmed alert renders blacklist message - `frontend-dapp/src/pages/SwapPage.tsx` line 897 -- confirmed "Trading restricted" disabled button text - All test directories searched: `src/**/__tests__/`, `src/pages/*.test.tsx`, `frontend-dapp/e2e/` --- ### Expected (per checklist) Frontend tests must assert that when a wallet, token, or pair is blacklisted: the correct message copy is displayed, and relevant action CTAs (swap, provide, withdraw, limit place/cancel/claim) are disabled. --- ### Actual No test file asserts any blacklist message string or checks that a CTA is disabled under blacklist conditions. The blacklist service and hook exist and are wired into the UI but the behavior is untested at the frontend layer. --- ### Evidence - `frontend-dapp/src/services/terraclassic/blacklist.ts` lines 39-53: copy defined for all four blacklist variants - `frontend-dapp/src/components/trade/TradeOrderTicket.tsx` lines 688-695: alert renders the copy - `frontend-dapp/src/pages/SwapPage.tsx` line 897: "Trading restricted" button text - No test file found containing any of: `blacklist`, `Trading restricted`, `trading blacklist`, or `useTradingBlacklist` assertions --- ### Suggested Fix Add unit tests (Vitest + Testing Library) that mock `useTradingBlacklist` to return each blacklist variant (wallet, token, pair, generic) and assert: - The correct message string is rendered in the alert - The swap/provide/withdraw/limit action buttons are disabled Cover at minimum SwapPage and TradeOrderTicket. A Playwright e2e smoke for the wallet-blacklisted state on LocalTerra would also satisfy the checklist. --- ### Verification Checklist Steps to confirm the fix is complete and the checklist item can be marked done. - [ ] Unit tests exist for wallet blacklist state: message text asserted, swap button disabled - [ ] Unit tests exist for token blacklist state: message text asserted, action buttons disabled - [ ] Unit tests exist for pair blacklist state: message text asserted, action buttons disabled - [ ] Tests cover SwapPage and TradeOrderTicket at minimum - [ ] All new tests pass in CI --- ### Labels ~security , `pre-launch` Cc: @PlasticDigits

totdking commented

2026-06-18 15:38:05 +00:00

(Migrated from gitlab.com)

mentioned in issue #381

PlasticDigits commented

2026-06-19 01:40:36 +00:00

(Migrated from gitlab.com)

mentioned in commit 59d87e5f87

mentioned in commit 59d87e5f87e3f6d9b9554face7c4d45c28d27650

PlasticDigits commented

2026-06-19 01:40:48 +00:00

(Migrated from gitlab.com)

mentioned in merge request !917

PlasticDigits commented

2026-06-19 01:53:18 +00:00

(Migrated from gitlab.com)

mentioned in commit 6febcc56d4

mentioned in commit 6febcc56d4daf3cab1d543f1974d7a569a31d494

PlasticDigits commented

2026-06-19 08:21:13 +00:00

(Migrated from gitlab.com)

Verification — SEC-A02 / GitLab #388

Verified on main @ 13900236 (merge 6febcc56 — issue-388-blacklist-frontend-tests).

Checklist

Item	Result	How verified
Wallet blacklist: message text + swap CTA disabled	PASS	`SwapPage.test.tsx` `trading blacklist UX` — `it.each` wallet variant asserts `describeTradingBlacklistBlock` in `role="alert"` and `Trading restricted` button disabled
Token blacklist: message text + action CTAs disabled	PASS	`SwapPage.test.tsx` + `TradePage.test.tsx` token variants; limit Place buttons (`trade-limit-submit`) disabled on Trade
Pair blacklist: message text + action CTAs disabled	PASS	Same `it.each` pair variants on Swap + Trade
Coverage: SwapPage and TradeOrderTicket (minimum)	PASS	`SwapPage.test.tsx` + `TradePage.test.tsx` (renders `TradeOrderTicket`; asserts alert copy + disabled limit Place CTAs)
Copy source unit tests	PASS	`blacklist.test.ts` — wallet, pair, token, and generic fallback strings
All new tests pass	PASS	`bash scripts/with-node.sh --cwd frontend-dapp -- npm run test:run -- src/services/terraclassic/__tests__/blacklist.test.ts src/pages/SwapPage.test.tsx src/pages/TradePage.test.tsx` → 52/52 passed; targeted `-t blacklist` → 9/9 passed

Supporting artifacts

Shared mocks: frontend-dapp/src/test/tradingBlacklistMocks.ts
Doc cross-link: docs/security-model.md (SEC-A02 / #388 regression note)

Out of scope (not required by issue verification checklist)

SKIP Pool provide/withdraw blacklist CTAs — not in the checklist minimum (Swap + Trade order ticket only).
SKIP Playwright e2e wallet-blacklisted smoke — suggested as optional in issue body; Vitest coverage satisfies the checklist.

Closing as complete.

## Verification — SEC-A02 / GitLab #388 Verified on `main` @ `13900236` (merge `6febcc56` — `issue-388-blacklist-frontend-tests`). ### Checklist | Item | Result | How verified | |------|--------|--------------| | Wallet blacklist: message text + swap CTA disabled | **PASS** | `SwapPage.test.tsx` `trading blacklist UX` — `it.each` wallet variant asserts `describeTradingBlacklistBlock` in `role="alert"` and `Trading restricted` button disabled | | Token blacklist: message text + action CTAs disabled | **PASS** | `SwapPage.test.tsx` + `TradePage.test.tsx` token variants; limit Place buttons (`trade-limit-submit`) disabled on Trade | | Pair blacklist: message text + action CTAs disabled | **PASS** | Same `it.each` pair variants on Swap + Trade | | Coverage: SwapPage and TradeOrderTicket (minimum) | **PASS** | `SwapPage.test.tsx` + `TradePage.test.tsx` (renders `TradeOrderTicket`; asserts alert copy + disabled limit Place CTAs) | | Copy source unit tests | **PASS** | `blacklist.test.ts` — wallet, pair, token, and generic fallback strings | | All new tests pass | **PASS** | `bash scripts/with-node.sh --cwd frontend-dapp -- npm run test:run -- src/services/terraclassic/__tests__/blacklist.test.ts src/pages/SwapPage.test.tsx src/pages/TradePage.test.tsx` → **52/52 passed**; targeted `-t blacklist` → **9/9 passed** | ### Supporting artifacts - Shared mocks: `frontend-dapp/src/test/tradingBlacklistMocks.ts` - Doc cross-link: `docs/security-model.md` (SEC-A02 / #388 regression note) ### Out of scope (not required by issue verification checklist) - **SKIP** Pool provide/withdraw blacklist CTAs — not in the checklist minimum (Swap + Trade order ticket only). - **SKIP** Playwright e2e wallet-blacklisted smoke — suggested as optional in issue body; Vitest coverage satisfies the checklist. Closing as complete.

PlasticDigits (Migrated from gitlab.com) closed this issue

2026-06-19 08:21:14 +00:00

PlasticDigits commented

2026-06-25 13:12:44 +00:00

(Migrated from gitlab.com)

mentioned in issue #411