docs: SEC-I05 frontend signing and risk communication review #454

New issue

Closed

opened 2026-06-30 17:22:50 +00:00 by totdking · 6 comments

totdking commented

2026-06-30 17:22:50 +00:00

(Migrated from gitlab.com)

No description provided.

totdking commented

2026-06-30 17:25:57 +00:00

(Migrated from gitlab.com)

Summary

Agent-assisted review of frontend signing flow and risk communication completed across two independent runs. Overall verdict: NEEDS ATTENTION with two medium and one low actionable finding requiring resolution before launch. One low finding (I05-F01) was already resolved upstream at time of filing.

What Was Done

Areas reviewed: swap pre-sign summary card, limit order pre-sign summary, pool provide/withdraw signing flow, slippage guards, expert mode modal, blacklist/pause UI gating, indexer and LCD outage banners, wrap mapper rate limit UX, fee guard active status, explorer URL XSS prevention, and error humanization.

Solid findings confirmed:

SWAP_EXPERT_MODE_SLIPPAGE_BLOCK_PCT = 30 enforced. Expert mode requires typing "ENABLE EXPERT MODE" (case-sensitive). Extreme slippage blocks submission.
LCD and indexer outage banners explicitly state funds are unaffected. 429 maps to calm copy via humanizeOffChainError.ts.
Explorer URLs validated against /^[0-9a-fA-F]{64}$/ for tx hashes and isValidTerraBech32Address for addresses. No dangerouslySetInnerHTML in frontend source.
useTradingBlacklist called with connected wallet address in TradeOrderTicket. isTradeBlocked gates all limit order and market swap submissions.
Swap pre-sign summary shows action, pair, amounts, max spread, min return, and chain label (chainFullLabel).

Findings Triaged

I05-F01 (Low): post-sign fee guard inactive on mainnet -- filed as Issue 59 (#460), CLOSED: #429 was already resolved upstream before filing, no action required
I05-F02 (Medium): limit order pre-sign modal missing chain label before wallet dialog -- filed as Issue 60 (#461)
I05-F03 (Medium): pool provide/withdraw has no pre-sign summary card -- filed as Issue 61 (#462)
I05-F04 (Low): wrap mapper rate limit disables button with no inline alert or copy -- filed as Issue 62 (#463)

Finding	Severity	GitLab #
I05-F01: fee guard inactive on mainnet	Low	#460 (CLOSED -- resolved upstream before filing)
I05-F02: limit order pre-sign missing chain label	Medium	#461
I05-F03: pool provide/withdraw no pre-sign summary	Medium	#462
I05-F04: wrap mapper rate limit no inline alert	Low	#463

Verification Checklist

Swap pre-sign summary and slippage guards reviewed
Expert mode modal confirmation requirement confirmed
Blacklist/pause UI gating confirmed across swap, pool, and limit order paths
Outage banner copy confirmed funds-safe framing
Explorer URL XSS prevention confirmed
Fee guard active status confirmed and tracked
All findings triaged and filed or documented

### Summary Agent-assisted review of frontend signing flow and risk communication completed across two independent runs. Overall verdict: NEEDS ATTENTION with two medium and one low actionable finding requiring resolution before launch. One low finding (I05-F01) was already resolved upstream at time of filing. ### What Was Done Areas reviewed: swap pre-sign summary card, limit order pre-sign summary, pool provide/withdraw signing flow, slippage guards, expert mode modal, blacklist/pause UI gating, indexer and LCD outage banners, wrap mapper rate limit UX, fee guard active status, explorer URL XSS prevention, and error humanization. Solid findings confirmed: - `SWAP_EXPERT_MODE_SLIPPAGE_BLOCK_PCT = 30` enforced. Expert mode requires typing "ENABLE EXPERT MODE" (case-sensitive). Extreme slippage blocks submission. - LCD and indexer outage banners explicitly state funds are unaffected. 429 maps to calm copy via `humanizeOffChainError.ts`. - Explorer URLs validated against `/^[0-9a-fA-F]{64}$/` for tx hashes and `isValidTerraBech32Address` for addresses. No `dangerouslySetInnerHTML` in frontend source. - `useTradingBlacklist` called with connected wallet address in `TradeOrderTicket`. `isTradeBlocked` gates all limit order and market swap submissions. - Swap pre-sign summary shows action, pair, amounts, max spread, min return, and chain label (`chainFullLabel`). ### Findings Triaged - I05-F01 (Low): post-sign fee guard inactive on mainnet -- filed as Issue 59 (#460), CLOSED: #429 was already resolved upstream before filing, no action required - I05-F02 (Medium): limit order pre-sign modal missing chain label before wallet dialog -- filed as Issue 60 (#461) - I05-F03 (Medium): pool provide/withdraw has no pre-sign summary card -- filed as Issue 61 (#462) - I05-F04 (Low): wrap mapper rate limit disables button with no inline alert or copy -- filed as Issue 62 (#463) ### Related Issues | Finding | Severity | GitLab # | |---------|----------|----------| | I05-F01: fee guard inactive on mainnet | Low | #460 (CLOSED -- resolved upstream before filing) | | I05-F02: limit order pre-sign missing chain label | Medium | #461 | | I05-F03: pool provide/withdraw no pre-sign summary | Medium | #462 | | I05-F04: wrap mapper rate limit no inline alert | Low | #463 | ### Verification Checklist - [x] Swap pre-sign summary and slippage guards reviewed - [x] Expert mode modal confirmation requirement confirmed - [x] Blacklist/pause UI gating confirmed across swap, pool, and limit order paths - [x] Outage banner copy confirmed funds-safe framing - [x] Explorer URL XSS prevention confirmed - [x] Fee guard active status confirmed and tracked - [x] All findings triaged and filed or documented

totdking commented

2026-06-30 18:37:55 +00:00

(Migrated from gitlab.com)

mentioned in issue #381

Brouie commented

2026-07-01 11:30:49 +00:00

(Migrated from gitlab.com)

Checked the three pre-sign components from this review on current main at the component level:

I05-F02 / #461 (limit-order pre-sign chain label) and I05-F03 / #462 (pool provide/withdraw pre-sign summary card): the PoolPreSubmitSummary and LimitOrderPreSubmitSummary components are in and their unit tests pass — 12/12 across the pool, limit-order and swap pre-sign summaries.
I05-F04 / #463 (wrap rate-limit inline alert): the swap-wrap-rate-limit-banner renders the inline WRAP_RATE_LIMIT_EXCEEDED_MESSAGE with retry guidance instead of just a disabled button; the wrap rate-limit CTA tests pass 3/3 including the inline-alert case.

All three findings' components are in place and green at the component layer on current main.

Checked the three pre-sign components from this review on current main at the component level: - I05-F02 / #461 (limit-order pre-sign chain label) and I05-F03 / #462 (pool provide/withdraw pre-sign summary card): the PoolPreSubmitSummary and LimitOrderPreSubmitSummary components are in and their unit tests pass — 12/12 across the pool, limit-order and swap pre-sign summaries. - I05-F04 / #463 (wrap rate-limit inline alert): the swap-wrap-rate-limit-banner renders the inline WRAP_RATE_LIMIT_EXCEEDED_MESSAGE with retry guidance instead of just a disabled button; the wrap rate-limit CTA tests pass 3/3 including the inline-alert case. All three findings' components are in place and green at the component layer on current main.

totdking commented

2026-07-01 18:04:05 +00:00

(Migrated from gitlab.com)

mentioned in issue #472