Pre-launch: SEC-I02 LLM hypothesis conversion #447

New issue

Closed

opened 2026-06-30 15:25:08 +00:00 by totdking · 6 comments

totdking commented

2026-06-30 15:25:08 +00:00

(Migrated from gitlab.com)

No description provided.

totdking commented

2026-06-30 15:45:39 +00:00

(Migrated from gitlab.com)

Summary

Converts the four Real Gap hypotheses from SEC-I01 (help/sec-i-prompt-pack.md) into issues or risk acceptances. Each hypothesis maps to one of: a new GitLab issue, a docs update, or explicit risk acceptance.

Conversion Table

Hypothesis	Type	Disposition
H05: Fee-on-transfer CW20 drains escrow	Docs / security model	Add explicit constraint to security-model.md: whitelisted code IDs must be audited for fee-on-transfer and rebase mechanics. Consider balance-delta assertion in escrow funding.
H07: Signing modal missing pair contract address	New issue	File as Security / Pre-launch issue: signing modal should display pair contract address alongside token symbols to allow user verification before signing.
H09: Route intermediate tokens not validated against submitted operations	New issue	File as Security / Pre-launch issue: cross-validate intermediate token addresses in router_operations against the displayed route before submit. May combine with H07 as one issue.
H14: FACTORY_ADDRESS non-empty not enforced in non-prod RUN_MODE	New issue	File as Pre-launch issue: add FACTORY_ADDRESS non-empty assertion to post-deploy verification script or launch-checklist, independent of RUN_MODE.

Verification Checklist

H05 constraint documented in security-model.md or whitelist code ID review checklist
H07 filed as issue with GitLab number assigned
H09 filed as issue with GitLab number assigned (or combined with H07)
H14 filed as issue or added to launch-checklist.md verification steps
Each Real Gap maps to test, issue, or documented risk acceptance per checklist requirement

Issues will be logged seperately as individual stand alone, this will only serve as a tracker for each. After each issue is closed and verified, I will mark the verification checklist. Do not close this until verification from all parties is completed.

Labels

security, pre-launch

### Summary Converts the four Real Gap hypotheses from SEC-I01 (`help/sec-i-prompt-pack.md`) into issues or risk acceptances. Each hypothesis maps to one of: a new GitLab issue, a docs update, or explicit risk acceptance. ### Conversion Table | Hypothesis | Type | Disposition | |------------|------|-------------| | H05: Fee-on-transfer CW20 drains escrow | Docs / security model | Add explicit constraint to security-model.md: whitelisted code IDs must be audited for fee-on-transfer and rebase mechanics. Consider balance-delta assertion in escrow funding. | | H07: Signing modal missing pair contract address | New issue | File as Security / Pre-launch issue: signing modal should display pair contract address alongside token symbols to allow user verification before signing. | | H09: Route intermediate tokens not validated against submitted operations | New issue | File as Security / Pre-launch issue: cross-validate intermediate token addresses in router_operations against the displayed route before submit. May combine with H07 as one issue. | | H14: FACTORY_ADDRESS non-empty not enforced in non-prod RUN_MODE | New issue | File as Pre-launch issue: add FACTORY_ADDRESS non-empty assertion to post-deploy verification script or launch-checklist, independent of RUN_MODE. | ### Verification Checklist - [ ] H05 constraint documented in security-model.md or whitelist code ID review checklist - [ ] H07 filed as issue with GitLab number assigned - [ ] H09 filed as issue with GitLab number assigned (or combined with H07) - [ ] H14 filed as issue or added to launch-checklist.md verification steps - [ ] Each Real Gap maps to test, issue, or documented risk acceptance per checklist requirement Issues will be logged seperately as individual stand alone, this will only serve as a tracker for each. After each issue is closed and verified, I will mark the verification checklist. Do not close this until verification from all parties is completed. ### Labels `security`, `pre-launch`

totdking commented

2026-06-30 18:37:55 +00:00

(Migrated from gitlab.com)

mentioned in issue #381

Brouie commented

2026-07-01 11:19:29 +00:00

(Migrated from gitlab.com)

Confirming the H14 piece on the fresh redeploy (21381a0e):

H14 / #451 — FACTORY_ADDRESS non-empty guard:

Live: the indexer refuses to start with an empty/whitespace FACTORY_ADDRESS, and it does so in every RUN_MODE — checked both default/dev and RUN_MODE=prod ("FACTORY_ADDRESS must be non-empty in every RUN_MODE"). The guard sits in config load before the run-mode split, so it is unconditional. verify-issue-451.sh runs 8/8 (doc invariant, config guard, unit test, live whitespace reject, launch-checklist step, qa-verify-deploy assertion, CI job).

The other three Real Gaps have landed fixes too: H05 -> #448 (rebase/fee-on-transfer whitelist docs), H07 -> the signing-modal pair-address display, H09 -> #450 (route intermediate-token cross-validation).

H14 is confirmed on the deploy and the other three are merged. @totdking for the checklist.

Confirming the H14 piece on the fresh redeploy (21381a0e): H14 / #451 — FACTORY_ADDRESS non-empty guard: - Live: the indexer refuses to start with an empty/whitespace FACTORY_ADDRESS, and it does so in every RUN_MODE — checked both default/dev and RUN_MODE=prod ("FACTORY_ADDRESS must be non-empty in every RUN_MODE"). The guard sits in config load before the run-mode split, so it is unconditional. verify-issue-451.sh runs 8/8 (doc invariant, config guard, unit test, live whitespace reject, launch-checklist step, qa-verify-deploy assertion, CI job). The other three Real Gaps have landed fixes too: H05 -> #448 (rebase/fee-on-transfer whitelist docs), H07 -> the signing-modal pair-address display, H09 -> #450 (route intermediate-token cross-validation). H14 is confirmed on the deploy and the other three are merged. @totdking for the checklist.

totdking commented

2026-07-01 18:04:04 +00:00

(Migrated from gitlab.com)

mentioned in issue #472

totdking commented

2026-07-01 18:45:59 +00:00

(Migrated from gitlab.com)

mentioned in merge request !1006

totdking commented

2026-07-02 16:18:52 +00:00

(Migrated from gitlab.com)

Verification Checklist

H05 constraint documented in security-model.md or whitelist code ID review checklist
H07 filed as issue with GitLab number assigned
H09 filed as issue with GitLab number assigned (or combined with H07)
H14 filed as issue or added to launch-checklist.md verification steps
Each Real Gap maps to test, issue, or documented risk acceptance per checklist requirement

All issues are covered and verified.

Ready for close @PlasticDigits

### Verification Checklist * [x] H05 constraint documented in security-model.md or whitelist code ID review checklist * [x] H07 filed as issue with GitLab number assigned * [x] H09 filed as issue with GitLab number assigned (or combined with H07) * [x] H14 filed as issue or added to launch-checklist.md verification steps * [x] Each Real Gap maps to test, issue, or documented risk acceptance per checklist requirement All issues are covered and verified. Ready for close @PlasticDigits

totdking (Migrated from gitlab.com) closed this issue

2026-07-03 08:44:40 +00:00