code/cl8y-dex-terraclassic

Fork 0

Security: wallet blacklist missing ClaimExpiredLimitOrder, UpdateLimitOrderPrice, and hybrid swap test coverage [SEC-B02] #393

New issue

Closed

opened 2026-06-19 10:20:50 +00:00 by totdking · 6 comments

totdking commented

2026-06-19 10:20:50 +00:00

(Migrated from gitlab.com)

No description provided.

totdking commented

2026-06-19 10:21:59 +00:00

(Migrated from gitlab.com)

Checklist Item

SEC-B02: Verify wallet blacklist blocks swaps, hybrid swaps, provide liquidity, withdraw liquidity, limit place/cancel/claim/update, and router multihop. Verify: contract tests cover every execute path and unblacklist restores normal execution.

Summary

The wallet blacklist integration test covers swap, limit place, cancel, provide liquidity, withdraw liquidity, and router multihop. Three execute paths listed in the checklist and documented in the security model are absent from the test: ClaimExpiredLimitOrder, UpdateLimitOrderPrice, and hybrid swap via a blacklisted wallet.

What Was Checked

smartcontracts/tests/src/blacklist_tests.rs lines 87-203 (wallet_blacklist_blocks_swap_lp_limits_and_unban_restores): full test read
smartcontracts/contracts/pair/src/contract.rs lines 659-692: confirmed ClaimExpiredLimitOrder, ClaimExpiredLimitOrders, and UpdateLimitOrderPrice are registered execute messages
smartcontracts/tests/src/limit_order_tests.rs line 2035: ClaimExpiredLimitOrder IS tested under pair pause (not wallet blacklist)
smartcontracts/tests/src/blacklist_tests.rs lines 264-278: hybrid swap tested under token blacklist only
Grep for ClaimExpiredLimit and UpdateLimitOrder across all test files: no results in blacklist_tests.rs
docs/security-model.md line 139: documents wallet blacklist should block "limit place/cancel/claim/update"

Expected (per checklist)

Contract tests must cover every execute path a blacklisted wallet could attempt: swap, hybrid swap, provide liquidity, withdraw liquidity, limit place, limit cancel, ClaimExpiredLimitOrder, UpdateLimitOrderPrice, and router multihop. Unblacklist must restore normal execution.

Actual

The existing test covers 6 of the 9 required paths. Missing:

Hybrid swap attempt from a blacklisted wallet is not asserted to fail
ClaimExpiredLimitOrder attempt from a blacklisted wallet is not tested
UpdateLimitOrderPrice attempt from a blacklisted wallet is not tested

Evidence

smartcontracts/tests/src/blacklist_tests.rs lines 87-203: swap (118-131), limit place (133-146), cancel (148-157), provide LP (159-182), withdraw LP (186-199), unblacklist restore (201-202) -- no claim, no update, no hybrid
smartcontracts/contracts/pair/src/contract.rs line 659: ClaimExpiredLimitOrder registered execute message
smartcontracts/contracts/pair/src/contract.rs line 679: UpdateLimitOrderPrice registered execute message
smartcontracts/tests/src/blacklist_tests.rs lines 264-278: hybrid swap only in token_blacklist_blocks_swap_both_directions, not in wallet blacklist test
smartcontracts/tests/src/limit_order_tests.rs line 2035: claim_expired_limit_order_blocked_while_pair_paused_then_succeeds_after_unpause -- tests pair pause gate, not wallet blacklist

Suggested Fix

Extend wallet_blacklist_blocks_swap_lp_limits_and_unban_restores or add a companion test asserting that a blacklisted wallet receives a blacklist rejection on:

A hybrid swap via Cw20HookMsg::Swap with a non-None hybrid param
ClaimExpiredLimitOrder with a known expired order ID
UpdateLimitOrderPrice with a known active order ID

Verification Checklist

Hybrid swap from a blacklisted wallet is tested and returns a blacklist error
ClaimExpiredLimitOrder from a blacklisted wallet is tested and returns a blacklist error
UpdateLimitOrderPrice from a blacklisted wallet is tested and returns a blacklist error
All new assertions pass in CI

Labels

security, pre-launch

Cc: @PlasticDigits

### Checklist Item SEC-B02: Verify wallet blacklist blocks swaps, hybrid swaps, provide liquidity, withdraw liquidity, limit place/cancel/claim/update, and router multihop. Verify: contract tests cover every execute path and unblacklist restores normal execution. --- ### Summary The wallet blacklist integration test covers swap, limit place, cancel, provide liquidity, withdraw liquidity, and router multihop. Three execute paths listed in the checklist and documented in the security model are absent from the test: `ClaimExpiredLimitOrder`, `UpdateLimitOrderPrice`, and hybrid swap via a blacklisted wallet. --- ### What Was Checked - `smartcontracts/tests/src/blacklist_tests.rs` lines 87-203 (`wallet_blacklist_blocks_swap_lp_limits_and_unban_restores`): full test read - `smartcontracts/contracts/pair/src/contract.rs` lines 659-692: confirmed `ClaimExpiredLimitOrder`, `ClaimExpiredLimitOrders`, and `UpdateLimitOrderPrice` are registered execute messages - `smartcontracts/tests/src/limit_order_tests.rs` line 2035: `ClaimExpiredLimitOrder` IS tested under pair pause (not wallet blacklist) - `smartcontracts/tests/src/blacklist_tests.rs` lines 264-278: hybrid swap tested under token blacklist only - Grep for `ClaimExpiredLimit` and `UpdateLimitOrder` across all test files: no results in `blacklist_tests.rs` - `docs/security-model.md` line 139: documents wallet blacklist should block "limit place/cancel/claim/update" --- ### Expected (per checklist) Contract tests must cover every execute path a blacklisted wallet could attempt: swap, hybrid swap, provide liquidity, withdraw liquidity, limit place, limit cancel, `ClaimExpiredLimitOrder`, `UpdateLimitOrderPrice`, and router multihop. Unblacklist must restore normal execution. --- ### Actual The existing test covers 6 of the 9 required paths. Missing: - Hybrid swap attempt from a blacklisted wallet is not asserted to fail - `ClaimExpiredLimitOrder` attempt from a blacklisted wallet is not tested - `UpdateLimitOrderPrice` attempt from a blacklisted wallet is not tested --- ### Evidence - `smartcontracts/tests/src/blacklist_tests.rs` lines 87-203: swap (118-131), limit place (133-146), cancel (148-157), provide LP (159-182), withdraw LP (186-199), unblacklist restore (201-202) -- no claim, no update, no hybrid - `smartcontracts/contracts/pair/src/contract.rs` line 659: `ClaimExpiredLimitOrder` registered execute message - `smartcontracts/contracts/pair/src/contract.rs` line 679: `UpdateLimitOrderPrice` registered execute message - `smartcontracts/tests/src/blacklist_tests.rs` lines 264-278: hybrid swap only in `token_blacklist_blocks_swap_both_directions`, not in wallet blacklist test - `smartcontracts/tests/src/limit_order_tests.rs` line 2035: `claim_expired_limit_order_blocked_while_pair_paused_then_succeeds_after_unpause` -- tests pair pause gate, not wallet blacklist --- ### Suggested Fix Extend `wallet_blacklist_blocks_swap_lp_limits_and_unban_restores` or add a companion test asserting that a blacklisted wallet receives a blacklist rejection on: - A hybrid swap via `Cw20HookMsg::Swap` with a non-None `hybrid` param - `ClaimExpiredLimitOrder` with a known expired order ID - `UpdateLimitOrderPrice` with a known active order ID --- ### Verification Checklist - [ ] Hybrid swap from a blacklisted wallet is tested and returns a blacklist error - [ ] `ClaimExpiredLimitOrder` from a blacklisted wallet is tested and returns a blacklist error - [ ] `UpdateLimitOrderPrice` from a blacklisted wallet is tested and returns a blacklist error - [ ] All new assertions pass in CI --- ### Labels `security`, `pre-launch` Cc: @PlasticDigits

PlasticDigits commented

2026-06-19 10:55:01 +00:00

(Migrated from gitlab.com)

mentioned in commit 64a9161040

mentioned in commit 64a9161040ee25b687c5dcd0f46d0004b3de7239

PlasticDigits commented

2026-06-19 10:55:32 +00:00

(Migrated from gitlab.com)

mentioned in merge request !923

totdking commented

2026-06-19 10:57:15 +00:00

(Migrated from gitlab.com)

mentioned in issue #381

PlasticDigits commented

2026-06-19 13:08:31 +00:00

(Migrated from gitlab.com)

mentioned in commit 2725fdb323

mentioned in commit 2725fdb323fbe04c45ce2ccccb8da3a7bd923d58

PlasticDigits commented

2026-06-25 11:33:14 +00:00

(Migrated from gitlab.com)

Verification — SEC-B02 / #393

Verified on main at 64ae4724 (fix merged via issue-393-wallet-blacklist-test-coverage, commit 64a91610).

Checklist

Item	Result	How verified
Hybrid swap from a blacklisted wallet returns a blacklist error	PASS	`blacklist_tests::wallet_blacklist_blocks_swap_lp_limits_and_unban_restores` lines 263–287 assert `is_blacklisted_err` on `Cw20HookMsg::Swap` with `hybrid: Some(pool_only_hybrid_params(...))` after `BlacklistWallet`
`ClaimExpiredLimitOrder` from a blacklisted wallet returns a blacklist error	PASS	Same test lines 124–152 set up an expired parked order; lines 305–316 assert blacklist rejection on `ExecuteMsg::ClaimExpiredLimitOrder { order_id: expired_order_id }`
`UpdateLimitOrderPrice` from a blacklisted wallet returns a blacklist error	PASS	Same test lines 289–303 assert blacklist rejection on `ExecuteMsg::UpdateLimitOrderPrice` for active `order_id`
All new assertions pass in CI	PASS	`cargo test blacklist_tests` — 8/8 passed; `make test-contracts` — full suite green (385 tests)

Additional SEC-B02 scope (from issue body)

Path	Result	How verified
Pool swap blocked	PASS	Same test lines 187–210
Limit place / cancel blocked	PASS	Lines 212–236
Provide / withdraw LP blocked	PASS	Lines 238–261, 318–333
Router multihop blocked	PASS	`blacklist_tests::router_multihop_rejects_blacklisted_wallet`
Unblacklist restores execution	PASS	Lines 335–336 (`swap_a_to_b` succeeds after `UnblacklistWallet`)

Docs / invariants

docs/security-model.md and docs/contracts-security-audit.md matrix row B1 already reference SEC-B02 / #393 and the extended test coverage. No doc drift found.

No repository changes required. Closing as verified.

## Verification — SEC-B02 / #393 Verified on `main` at `64ae4724` (fix merged via `issue-393-wallet-blacklist-test-coverage`, commit `64a91610`). ### Checklist | Item | Result | How verified | |------|--------|--------------| | Hybrid swap from a blacklisted wallet returns a blacklist error | **PASS** | `blacklist_tests::wallet_blacklist_blocks_swap_lp_limits_and_unban_restores` lines 263–287 assert `is_blacklisted_err` on `Cw20HookMsg::Swap` with `hybrid: Some(pool_only_hybrid_params(...))` after `BlacklistWallet` | | `ClaimExpiredLimitOrder` from a blacklisted wallet returns a blacklist error | **PASS** | Same test lines 124–152 set up an expired parked order; lines 305–316 assert blacklist rejection on `ExecuteMsg::ClaimExpiredLimitOrder { order_id: expired_order_id }` | | `UpdateLimitOrderPrice` from a blacklisted wallet returns a blacklist error | **PASS** | Same test lines 289–303 assert blacklist rejection on `ExecuteMsg::UpdateLimitOrderPrice` for active `order_id` | | All new assertions pass in CI | **PASS** | `cargo test blacklist_tests` — 8/8 passed; `make test-contracts` — full suite green (385 tests) | ### Additional SEC-B02 scope (from issue body) | Path | Result | How verified | |------|--------|--------------| | Pool swap blocked | **PASS** | Same test lines 187–210 | | Limit place / cancel blocked | **PASS** | Lines 212–236 | | Provide / withdraw LP blocked | **PASS** | Lines 238–261, 318–333 | | Router multihop blocked | **PASS** | `blacklist_tests::router_multihop_rejects_blacklisted_wallet` | | Unblacklist restores execution | **PASS** | Lines 335–336 (`swap_a_to_b` succeeds after `UnblacklistWallet`) | ### Docs / invariants - `docs/security-model.md` and `docs/contracts-security-audit.md` matrix row **B1** already reference SEC-B02 / #393 and the extended test coverage. No doc drift found. No repository changes required. Closing as verified.

PlasticDigits (Migrated from gitlab.com) closed this issue

2026-06-25 11:33:19 +00:00