code/cl8y-dex-terraclassic

Fork 0

Security: no frontend tests assert signing confirmation labels for action, pair, amount, max spread, min return, or chain [SEC-D11] #409

New issue

Closed

opened 2026-06-19 11:46:54 +00:00 by totdking · 10 comments

totdking commented

2026-06-19 11:46:54 +00:00

(Migrated from gitlab.com)

No description provided.

totdking commented

2026-06-19 11:47:33 +00:00

(Migrated from gitlab.com)

Checklist Item

SEC-D11: Model frontend wallet phishing/signing confusion. Verify: wallet signing UI clearly names action, pair, amount, max spread/min return, and chain; tests assert dangerous action labels.

Summary

The dApp's dangerous-slippage guard and expert mode opt-in flow are tested: swap-extreme-slippage-warning, swap-slippage-blocked, and the disabled "Slippage is too high" button are all asserted in SwapPage.test.tsx, and ExpertModeModal.test.tsx confirms the phrase confirmation requirement. The remaining gap is that no test asserts the pre-signing confirmation panel displays the action type, selected pair tokens, offer and return amounts, max spread or min return value, or chain name as individually labeled fields visible to the user before the Keplr signing request is dispatched.

What Was Checked

frontend-dapp/src/pages/SwapPage.test.tsx lines 541-554: swap-expected-slippage content ("100.00%"), swap-slippage-blocked, button "Slippage is too high" disabled, swap-extreme-slippage-warning, and expert mode activation flow all confirmed by direct file read -- dangerous-slippage guard IS tested
frontend-dapp/src/components/swap/ExpertModeModal.test.tsx: correct phrase required, wrong phrase rejected -- expert mode modal IS tested
frontend-dapp/src/pages/SwapPage.test.tsx lines 398, 459: swap-route-summary testid asserted -- route display IS tested
frontend-dapp/src/pages/SwapPage.test.tsx and TradePage.test.tsx: direct file read found no test asserting action label, pair token symbols, offer amount, return amount, max spread, or chain name as labeled confirmation-panel fields

Expected (per checklist)

Frontend tests must assert that the pre-signing confirmation panel clearly displays: action type ("Swap"), the selected pair token symbols, the offer amount, the expected return amount, the max spread or min return value, and the chain name.

Actual

The dangerous-slippage guard and expert mode flow are well tested. The route display (swap-route-summary) is tested. No test asserts that the confirmation panel shows action type, pair token symbols, offer amount, return amount, max spread value, or chain name as labeled fields. A phishing scenario substituting a wrong pair or chain address in the displayed confirmation would not be caught by the existing test suite.

Evidence

frontend-dapp/src/pages/SwapPage.test.tsx lines 541-554: dangerous-slippage guard and expert mode flow confirmed tested by direct file read
frontend-dapp/src/components/swap/ExpertModeModal.test.tsx: expert mode modal confirmed tested
frontend-dapp/src/pages/SwapPage.test.tsx: no test found asserting action label, pair token symbols, offer amount, return amount, max spread, or chain name in a labeled confirmation-panel context
frontend-dapp/src/pages/TradePage.test.tsx: same -- no confirmation-panel field label tests
Wallet used for all test scenarios: Keplr

Suggested Fix

Add unit tests (Vitest + Testing Library) that render the swap confirmation panel with a mocked quote and assert each of the following is visible and labeled: action type ("Swap"), offer token symbol and amount, return token symbol and estimated amount, max spread percentage, and chain name. These tests target the in-dApp confirmation step before the Keplr signing dialog opens.

Verification Checklist

Test asserts action label ("Swap") is displayed in the swap confirmation panel
Test asserts offer token symbol and amount are displayed
Test asserts return token symbol and estimated amount are displayed
Test asserts max spread value is displayed in the confirmation panel
Test asserts chain name is displayed in the confirmation panel
Tests use Keplr wallet context where applicable
All new tests pass in CI

Labels

security, pre-launch

Cc: @PlasticDigits

### Checklist Item SEC-D11: Model frontend wallet phishing/signing confusion. Verify: wallet signing UI clearly names action, pair, amount, max spread/min return, and chain; tests assert dangerous action labels. --- ### Summary The dApp's dangerous-slippage guard and expert mode opt-in flow are tested: `swap-extreme-slippage-warning`, `swap-slippage-blocked`, and the disabled "Slippage is too high" button are all asserted in `SwapPage.test.tsx`, and `ExpertModeModal.test.tsx` confirms the phrase confirmation requirement. The remaining gap is that no test asserts the pre-signing confirmation panel displays the action type, selected pair tokens, offer and return amounts, max spread or min return value, or chain name as individually labeled fields visible to the user before the Keplr signing request is dispatched. --- ### What Was Checked - `frontend-dapp/src/pages/SwapPage.test.tsx` lines 541-554: `swap-expected-slippage` content ("100.00%"), `swap-slippage-blocked`, button "Slippage is too high" disabled, `swap-extreme-slippage-warning`, and expert mode activation flow all confirmed by direct file read -- dangerous-slippage guard IS tested - `frontend-dapp/src/components/swap/ExpertModeModal.test.tsx`: correct phrase required, wrong phrase rejected -- expert mode modal IS tested - `frontend-dapp/src/pages/SwapPage.test.tsx` lines 398, 459: `swap-route-summary` testid asserted -- route display IS tested - `frontend-dapp/src/pages/SwapPage.test.tsx` and `TradePage.test.tsx`: direct file read found no test asserting action label, pair token symbols, offer amount, return amount, max spread, or chain name as labeled confirmation-panel fields --- ### Expected (per checklist) Frontend tests must assert that the pre-signing confirmation panel clearly displays: action type ("Swap"), the selected pair token symbols, the offer amount, the expected return amount, the max spread or min return value, and the chain name. --- ### Actual The dangerous-slippage guard and expert mode flow are well tested. The route display (`swap-route-summary`) is tested. No test asserts that the confirmation panel shows action type, pair token symbols, offer amount, return amount, max spread value, or chain name as labeled fields. A phishing scenario substituting a wrong pair or chain address in the displayed confirmation would not be caught by the existing test suite. --- ### Evidence - `frontend-dapp/src/pages/SwapPage.test.tsx` lines 541-554: dangerous-slippage guard and expert mode flow confirmed tested by direct file read - `frontend-dapp/src/components/swap/ExpertModeModal.test.tsx`: expert mode modal confirmed tested - `frontend-dapp/src/pages/SwapPage.test.tsx`: no test found asserting action label, pair token symbols, offer amount, return amount, max spread, or chain name in a labeled confirmation-panel context - `frontend-dapp/src/pages/TradePage.test.tsx`: same -- no confirmation-panel field label tests - Wallet used for all test scenarios: Keplr --- ### Suggested Fix Add unit tests (Vitest + Testing Library) that render the swap confirmation panel with a mocked quote and assert each of the following is visible and labeled: action type ("Swap"), offer token symbol and amount, return token symbol and estimated amount, max spread percentage, and chain name. These tests target the in-dApp confirmation step before the Keplr signing dialog opens. --- ### Verification Checklist - [ ] Test asserts action label ("Swap") is displayed in the swap confirmation panel - [ ] Test asserts offer token symbol and amount are displayed - [ ] Test asserts return token symbol and estimated amount are displayed - [ ] Test asserts max spread value is displayed in the confirmation panel - [ ] Test asserts chain name is displayed in the confirmation panel - [ ] Tests use Keplr wallet context where applicable - [ ] All new tests pass in CI --- ### Labels `security`, `pre-launch` Cc: @PlasticDigits

totdking commented

2026-06-19 12:06:49 +00:00

(Migrated from gitlab.com)

mentioned in issue #381

PlasticDigits commented

2026-06-19 12:54:40 +00:00

(Migrated from gitlab.com)

mentioned in commit f08635d0ab

mentioned in commit f08635d0ab94e6130a7696e740fc53b6e592c008

PlasticDigits commented

2026-06-19 12:54:50 +00:00

(Migrated from gitlab.com)

mentioned in merge request !929

PlasticDigits commented

2026-06-19 13:09:34 +00:00

(Migrated from gitlab.com)

mentioned in commit 049471ed2a

mentioned in commit 049471ed2a0714c4aff5b812b4670bcc0499fc75

PlasticDigits commented

2026-06-19 13:15:21 +00:00

(Migrated from gitlab.com)

Verification — SEC-D11 signing confirmation labels (#409)

All acceptance criteria are already satisfied on main (merged via f08635d0 / MR issue-409-swap-signing-confirmation-tests). No additional code changes were required in this pass.

What was verified

Criterion	Result	How
Action label ("Swap") in swap confirmation panel	PASS	`SwapPreSubmitSummary.test.tsx` asserts `swap-confirm-action` → `Swap`; `SwapPage.test.tsx` integration test with Keplr wallet context
Offer token symbol and amount displayed	PASS	`swap-confirm-offer` asserted in unit + `SwapPage` integration tests
Return token symbol and estimated amount displayed	PASS	`swap-confirm-receive` asserted in unit + integration tests
Max spread value in confirmation panel	PASS	`swap-confirm-max-spread` asserts `0.5%`
Chain name in confirmation panel	PASS	`swap-confirm-chain` asserts `LocalTerra`
Min return value in confirmation panel	PASS	`swap-confirm-min-return` asserted (issue checklist focused on max spread; both are covered)
Pair token symbols displayed	PASS	`swap-confirm-pair` asserted
Trade market tab coverage	PASS	`TradeMarketOrderPanel.submitSnapshot.test.tsx` asserts `Market swap` action + all `swap-confirm-*` fields
Tests use Keplr wallet context where applicable	PASS	`SwapPage.test.tsx` sets `walletType: 'keplr'` in pre-sign panel describe block
All new tests pass	PASS	See command output below

Commands run

bash scripts/with-node.sh --cwd frontend-dapp -- npm run test:run -- \
  src/components/swap/__tests__/SwapPreSubmitSummary.test.tsx \
  src/pages/SwapPage.test.tsx \
  src/components/trade/__tests__/TradeMarketOrderPanel.submitSnapshot.test.tsx

Result: 3 test files, 27 tests — all passed.

Implementation summary (on `main`)

Shared component: frontend-dapp/src/components/swap/SwapPreSubmitSummary.tsx — labeled rows with swap-confirm-action, swap-confirm-pair, swap-confirm-offer, swap-confirm-receive, swap-confirm-max-spread, swap-confirm-min-return, swap-confirm-chain
Wired into SwapPage.tsx (pre-submit) and TradeMarketOrderPanel.tsx (market tab, trade-market-pre-submit-summary)
Agent playbook: skills/AGENTS_FRONTEND_SWAP_SIGNING_CONFIRMATION.md
Docs: docs/frontend.md § Swap pre-sign summary; docs/security-model.md cross-reference

Closing this issue — SEC-D11 regression coverage is in place.

## Verification — SEC-D11 signing confirmation labels (#409) All acceptance criteria are **already satisfied on `main`** (merged via `f08635d0` / MR `issue-409-swap-signing-confirmation-tests`). No additional code changes were required in this pass. ### What was verified | Criterion | Result | How | |-----------|--------|-----| | Action label ("Swap") in swap confirmation panel | **PASS** | `SwapPreSubmitSummary.test.tsx` asserts `swap-confirm-action` → `Swap`; `SwapPage.test.tsx` integration test with Keplr wallet context | | Offer token symbol and amount displayed | **PASS** | `swap-confirm-offer` asserted in unit + `SwapPage` integration tests | | Return token symbol and estimated amount displayed | **PASS** | `swap-confirm-receive` asserted in unit + integration tests | | Max spread value in confirmation panel | **PASS** | `swap-confirm-max-spread` asserts `0.5%` | | Chain name in confirmation panel | **PASS** | `swap-confirm-chain` asserts `LocalTerra` | | Min return value in confirmation panel | **PASS** | `swap-confirm-min-return` asserted (issue checklist focused on max spread; both are covered) | | Pair token symbols displayed | **PASS** | `swap-confirm-pair` asserted | | Trade market tab coverage | **PASS** | `TradeMarketOrderPanel.submitSnapshot.test.tsx` asserts `Market swap` action + all `swap-confirm-*` fields | | Tests use Keplr wallet context where applicable | **PASS** | `SwapPage.test.tsx` sets `walletType: 'keplr'` in pre-sign panel describe block | | All new tests pass | **PASS** | See command output below | ### Commands run ```bash bash scripts/with-node.sh --cwd frontend-dapp -- npm run test:run -- \ src/components/swap/__tests__/SwapPreSubmitSummary.test.tsx \ src/pages/SwapPage.test.tsx \ src/components/trade/__tests__/TradeMarketOrderPanel.submitSnapshot.test.tsx ``` **Result:** 3 test files, 27 tests — all passed. ### Implementation summary (on `main`) - Shared component: `frontend-dapp/src/components/swap/SwapPreSubmitSummary.tsx` — labeled rows with `swap-confirm-action`, `swap-confirm-pair`, `swap-confirm-offer`, `swap-confirm-receive`, `swap-confirm-max-spread`, `swap-confirm-min-return`, `swap-confirm-chain` - Wired into `SwapPage.tsx` (pre-submit) and `TradeMarketOrderPanel.tsx` (market tab, `trade-market-pre-submit-summary`) - Agent playbook: `skills/AGENTS_FRONTEND_SWAP_SIGNING_CONFIRMATION.md` - Docs: `docs/frontend.md` § Swap pre-sign summary; `docs/security-model.md` cross-reference Closing this issue — SEC-D11 regression coverage is in place.

PlasticDigits (Migrated from gitlab.com) closed this issue

2026-06-19 13:15:35 +00:00

PlasticDigits commented

2026-06-25 14:12:46 +00:00

(Migrated from gitlab.com)

mentioned in issue #414