code/cl8y-dex-terraclassic

Fork 0

Security: extension fee guard is LocalTerra-only with no wallet QA notes documenting that mainnet is intentionally out of scope [SEC-E08] #429

New issue

Closed

opened 2026-06-29 14:46:24 +00:00 by totdking · 19 comments

totdking commented

2026-06-29 14:46:24 +00:00

(Migrated from gitlab.com)

No description provided.

totdking commented

2026-06-29 14:50:33 +00:00

(Migrated from gitlab.com)

Summary

extensionSignedFeeGuard.ts JSDoc states it is "a post-sign fee/gas sanity check for extension wallets on LocalTerra (GitLab #127, #134)." The test at line 84 explicitly asserts the guard returns null for columbus-5 (mainnet), confirming it is LocalTerra-only. The checklist qualifies with "where applicable" and also requires "manual wallet QA notes." No wallet QA notes exist in any runbook, release checklist, or document explaining why mainnet is out of scope or confirming Keplr on mainnet does not exhibit the stale-fee behavior.

What Was Checked

frontend-dapp/src/utils/extensionSignedFeeGuard.ts JSDoc line 1: "Post-sign fee/gas sanity check for extension wallets on LocalTerra (GitLab #127, #134)." Scope stated in code but not in any external documentation.
frontend-dapp/src/utils/__tests__/extensionSignedFeeGuard.test.ts line 84-92: extensionSignedFeeUndershootMessage returns null for columbus-5. Behavior confirmed by test.
docs/runbooks/launch-checklist.md: no reference to fee guard scope or Keplr mainnet QA.
docs/security-model.md: no reference to fee guard.
No wallet QA notes in any file in the repo.

Expected (per checklist)

Manual wallet QA notes must confirm that the fee guard's LocalTerra scope is intentional and that Keplr on mainnet does not require this check, or that mainnet fee validation has been manually tested and confirmed working through a different mechanism.

Actual

The guard is LocalTerra-only per code comment and test. No document explains why or confirms mainnet behavior with Keplr has been validated. If the guard were needed on mainnet and was absent, no automated or manual check would surface this.

Evidence

frontend-dapp/src/utils/extensionSignedFeeGuard.ts line 1: "on LocalTerra" in JSDoc
frontend-dapp/src/utils/__tests__/extensionSignedFeeGuard.test.ts line 84: returns null for columbus-5
docs/runbooks/launch-checklist.md: no wallet fee guard QA item

Suggested Fix

Add a note to docs/runbooks/launch-checklist.md or docs/security-model.md stating that the extension fee guard is LocalTerra-only and explaining why mainnet is excluded (e.g., "Keplr on mainnet uses the cosmes gas flow and does not exhibit the Station stale-fee behavior that prompted this guard"). Alternatively, add a manual wallet QA note confirming a Keplr mainnet swap submitted with the correct fee without requiring the guard.

Verification Checklist

Documentation states the fee guard scope is LocalTerra-only and explains why mainnet is excluded
A wallet QA note confirms Keplr mainnet behavior does not require the guard, or the guard scope has been extended with a rationale
Launch checklist references this documentation or the risk acceptance

Labels

security, pre-launch

Cc: @PlasticDigits

### Summary `extensionSignedFeeGuard.ts` JSDoc states it is "a post-sign fee/gas sanity check for extension wallets on LocalTerra (GitLab #127, #134)." The test at line 84 explicitly asserts the guard returns null for `columbus-5` (mainnet), confirming it is LocalTerra-only. The checklist qualifies with "where applicable" and also requires "manual wallet QA notes." No wallet QA notes exist in any runbook, release checklist, or document explaining why mainnet is out of scope or confirming Keplr on mainnet does not exhibit the stale-fee behavior. --- ### What Was Checked - `frontend-dapp/src/utils/extensionSignedFeeGuard.ts` JSDoc line 1: "Post-sign fee/gas sanity check for extension wallets on LocalTerra (GitLab #127, #134)." Scope stated in code but not in any external documentation. - `frontend-dapp/src/utils/__tests__/extensionSignedFeeGuard.test.ts` line 84-92: `extensionSignedFeeUndershootMessage` returns null for `columbus-5`. Behavior confirmed by test. - `docs/runbooks/launch-checklist.md`: no reference to fee guard scope or Keplr mainnet QA. - `docs/security-model.md`: no reference to fee guard. - No wallet QA notes in any file in the repo. --- ### Expected (per checklist) Manual wallet QA notes must confirm that the fee guard's LocalTerra scope is intentional and that Keplr on mainnet does not require this check, or that mainnet fee validation has been manually tested and confirmed working through a different mechanism. --- ### Actual The guard is LocalTerra-only per code comment and test. No document explains why or confirms mainnet behavior with Keplr has been validated. If the guard were needed on mainnet and was absent, no automated or manual check would surface this. --- ### Evidence - `frontend-dapp/src/utils/extensionSignedFeeGuard.ts` line 1: "on LocalTerra" in JSDoc - `frontend-dapp/src/utils/__tests__/extensionSignedFeeGuard.test.ts` line 84: returns null for `columbus-5` - `docs/runbooks/launch-checklist.md`: no wallet fee guard QA item --- ### Suggested Fix Add a note to `docs/runbooks/launch-checklist.md` or `docs/security-model.md` stating that the extension fee guard is LocalTerra-only and explaining why mainnet is excluded (e.g., "Keplr on mainnet uses the cosmes gas flow and does not exhibit the Station stale-fee behavior that prompted this guard"). Alternatively, add a manual wallet QA note confirming a Keplr mainnet swap submitted with the correct fee without requiring the guard. --- ### Verification Checklist - [ ] Documentation states the fee guard scope is LocalTerra-only and explains why mainnet is excluded - [ ] A wallet QA note confirms Keplr mainnet behavior does not require the guard, or the guard scope has been extended with a rationale - [ ] Launch checklist references this documentation or the risk acceptance --- ### Labels `security`, `pre-launch` Cc: @PlasticDigits

PlasticDigits commented

2026-06-29 15:09:59 +00:00

(Migrated from gitlab.com)

Correct, keplr does not have this issue.

PlasticDigits commented

2026-06-29 15:14:24 +00:00

(Migrated from gitlab.com)

mentioned in merge request !957

Brouie commented

2026-06-29 15:17:44 +00:00

(Migrated from gitlab.com)

Verified MR !957 (3f91ddef) on the branch — the SEC-E08 scope is documented and gated.

extensionSignedFeeGuard.ts now carries the explicit "intentionally inactive on mainnet (columbus-5) — see SEC-E08 / #429" note; the guard's LocalTerra-only behavior is by design (returns null off localterra).
Docs: new security-model.md SEC-E08 section (LocalTerra-only scope + the 95% fee/gas threshold + #127/#134 lineage), a wallet-QA runbook (docs/runbooks/extension-fee-guard-wallet-qa.md), a launch-checklist Phase 4 item, and an agent skill.
Ran the two validators here: check_extension_fee_guard_docs.py exit 0, and verify-issue-429.sh is 6/0 (doc invariant, runbooks, security-model section, and the extensionSignedFeeGuard mainnet-skip unit test all pass).

Takes the documented-scope path the issue offered, so this closes it on the docs layer. Good to merge. @PlasticDigits needs your merge.

Verified MR !957 (3f91ddef) on the branch — the SEC-E08 scope is documented and gated. - extensionSignedFeeGuard.ts now carries the explicit "intentionally inactive on mainnet (columbus-5) — see SEC-E08 / #429" note; the guard's LocalTerra-only behavior is by design (returns null off localterra). - Docs: new security-model.md SEC-E08 section (LocalTerra-only scope + the 95% fee/gas threshold + #127/#134 lineage), a wallet-QA runbook (docs/runbooks/extension-fee-guard-wallet-qa.md), a launch-checklist Phase 4 item, and an agent skill. - Ran the two validators here: check_extension_fee_guard_docs.py exit 0, and verify-issue-429.sh is 6/0 (doc invariant, runbooks, security-model section, and the extensionSignedFeeGuard mainnet-skip unit test all pass). Takes the documented-scope path the issue offered, so this closes it on the docs layer. Good to merge. @PlasticDigits needs your merge.

PlasticDigits commented

2026-06-29 15:17:46 +00:00

(Migrated from gitlab.com)

mentioned in commit 02d9e3c982

mentioned in commit 02d9e3c98283277e5dbf69fb5029597abfd5f4e8

PlasticDigits commented

2026-06-29 15:28:02 +00:00

(Migrated from gitlab.com)

Verification — #429 (SEC-E08) — PASS

Verified on main at 8a7e7add (includes merged MR !957 / 3f91ddef). No repo changes required.

Acceptance checklist

Item	Result	How verified
Documentation states fee guard is LocalTerra-only and explains mainnet exclusion	PASS	`docs/security-model.md` § Extension wallet fee guard (SEC-E08); `docs/runbooks/extension-fee-guard-wallet-qa.md` scope table; `extensionSignedFeeGuard.ts` JSDoc ("intentionally inactive on mainnet")
Wallet QA note confirms Keplr mainnet does not require the guard	PASS	`docs/runbooks/extension-fee-guard-wallet-qa.md` (mainnet section + launch sign-off text); maintainer confirmation on #429 ("keplr does not have this issue"); `skills/AGENTS_EXTENSION_FEE_GUARD.md`
Launch checklist references documentation / risk acceptance	PASS	`docs/runbooks/launch-checklist.md` Phase 4 SEC-E08 gate links runbook, security model, and agent skill

Automated verification

make verify-issue-429
  PASS: 6   FAIL: 0

Steps: doc invariant (check_extension_fee_guard_docs.py), agent skill present, wallet QA runbook present, launch checklist SEC-E08 item, security-model SEC-E08 section, extensionSignedFeeGuard.test.ts (9/9 — columbus-5 returns null).

Manual wallet QA (launch execution)

SKIP — not required to close this documentation issue. Manual Keplr swap steps for LocalTerra and columbus-5 are documented in extension-fee-guard-wallet-qa.md for Phase 4 launch sign-off; LocalTerra was not provisioned for this verify pass.

Closing as complete on the docs/invariants layer per MR !957.

## Verification — #429 (SEC-E08) — PASS Verified on `main` at `8a7e7add` (includes merged MR !957 / `3f91ddef`). No repo changes required. ### Acceptance checklist | Item | Result | How verified | |------|--------|--------------| | Documentation states fee guard is LocalTerra-only and explains mainnet exclusion | **PASS** | `docs/security-model.md` § Extension wallet fee guard (SEC-E08); `docs/runbooks/extension-fee-guard-wallet-qa.md` scope table; `extensionSignedFeeGuard.ts` JSDoc ("intentionally inactive on mainnet") | | Wallet QA note confirms Keplr mainnet does not require the guard | **PASS** | `docs/runbooks/extension-fee-guard-wallet-qa.md` (mainnet section + launch sign-off text); maintainer confirmation on #429 ("keplr does not have this issue"); `skills/AGENTS_EXTENSION_FEE_GUARD.md` | | Launch checklist references documentation / risk acceptance | **PASS** | `docs/runbooks/launch-checklist.md` Phase 4 SEC-E08 gate links runbook, security model, and agent skill | ### Automated verification ```text make verify-issue-429 PASS: 6 FAIL: 0 ``` Steps: doc invariant (`check_extension_fee_guard_docs.py`), agent skill present, wallet QA runbook present, launch checklist SEC-E08 item, security-model SEC-E08 section, `extensionSignedFeeGuard.test.ts` (9/9 — `columbus-5` returns `null`). ### Manual wallet QA (launch execution) **SKIP** — not required to close this documentation issue. Manual Keplr swap steps for LocalTerra and `columbus-5` are documented in `extension-fee-guard-wallet-qa.md` for Phase 4 launch sign-off; LocalTerra was not provisioned for this verify pass. Closing as complete on the docs/invariants layer per MR !957.

PlasticDigits (Migrated from gitlab.com) closed this issue

2026-06-29 15:28:05 +00:00

totdking commented

2026-06-29 15:31:48 +00:00

(Migrated from gitlab.com)

mentioned in issue #381