Pre-launch: post-sign fee guard inactive on mainnet -- SEC-E08 must be resolved or formally closed [SEC-I05] (F-01) #460

New issue

Closed

opened 2026-06-30 18:29:55 +00:00 by totdking · 4 comments

totdking commented

2026-06-30 18:29:55 +00:00

(Migrated from gitlab.com)

No description provided.

totdking commented

2026-06-30 18:31:06 +00:00

(Migrated from gitlab.com)

Status: CLOSED -- resolved upstream before this issue was filed, no action required.

Summary

The extensionSignedFeeUndershootMessage guard in frontend-dapp/src/utils/extensionSignedFeeGuard.ts is gated by isLocalTerraChainId(chainId) (line 79), making it inactive on columbus-5 mainnet. All extension signing paths (Keplr, Station, Cosmostation) pass through assertExtensionSignedDirectFeeMeetsExpected in getTerraGetSignTxRaw.ts (line 63), but the guard silently skips the 95% floor check on mainnet. SEC-E08 / GitLab #429 tracked this. The LocalTerra-only scope is intentional: Keplr on columbus-5 does not rewrite fees, confirmed by maintainer (@PlasticDigits).

What Was Checked

frontend-dapp/src/utils/extensionSignedFeeGuard.ts line 3: isLocalTerraChainId import. Line 79: guard gated on isLocalTerraChainId(chainId).
frontend-dapp/src/services/terraclassic/getTerraGetSignTxRaw.ts line 63: assertExtensionSignedDirectFeeMeetsExpected called here but guard returns null for mainnet chainId.
frontend-dapp/src/utils/extensionSignedFeeGuard.test.ts: tests confirm the guard works on LocalTerra. At time of filing, no test asserted guard is inactive on columbus-5.
GitLab #429 (SEC-E08): was open at time of filing.

Resolution

Documented risk acceptance via MR !957 (3f91ddef). Artifacts confirmed present by verifier (@Brouie):

extensionSignedFeeGuard.ts JSDoc: "intentionally inactive on mainnet (columbus-5) -- see SEC-E08 / #429 (closed)"
docs/security-model.md SEC-E08 section: LocalTerra-only scope, 95% fee/gas threshold, lineage from #127 and #134
docs/runbooks/extension-fee-guard-wallet-qa.md: wallet QA runbook with mainnet section and launch sign-off text
docs/runbooks/launch-checklist.md Phase 4: SEC-E08 gate added, links runbook, security model, and agent skill
extensionSignedFeeGuard.test.ts 9/9 passing: columbus-5 returns null test now confirmed present
make verify-issue-429: PASS 6 / FAIL 0

Verification Checklist

SEC-E08 / GitLab #429 resolved and formally closed with documented rationale
Test added confirming guard is intentionally inactive on columbus-5 (returns null -- extensionSignedFeeGuard.test.ts)
Risk acceptance documented in security-model.md and wallet QA runbook rather than extending guard to mainnet

Labels

security, pre-launch

Cc: @PlasticDigits , please close, made an error upstream before filing this #429 was already closed and veriifed , my agent did not verify this before filing the issue

**Status:** CLOSED -- resolved upstream before this issue was filed, no action required. ### Summary The `extensionSignedFeeUndershootMessage` guard in `frontend-dapp/src/utils/extensionSignedFeeGuard.ts` is gated by `isLocalTerraChainId(chainId)` (line 79), making it inactive on columbus-5 mainnet. All extension signing paths (Keplr, Station, Cosmostation) pass through `assertExtensionSignedDirectFeeMeetsExpected` in `getTerraGetSignTxRaw.ts` (line 63), but the guard silently skips the 95% floor check on mainnet. SEC-E08 / GitLab #429 tracked this. The LocalTerra-only scope is intentional: Keplr on columbus-5 does not rewrite fees, confirmed by maintainer (@PlasticDigits). --- ### What Was Checked - `frontend-dapp/src/utils/extensionSignedFeeGuard.ts` line 3: `isLocalTerraChainId` import. Line 79: guard gated on `isLocalTerraChainId(chainId)`. - `frontend-dapp/src/services/terraclassic/getTerraGetSignTxRaw.ts` line 63: `assertExtensionSignedDirectFeeMeetsExpected` called here but guard returns null for mainnet chainId. - `frontend-dapp/src/utils/extensionSignedFeeGuard.test.ts`: tests confirm the guard works on LocalTerra. At time of filing, no test asserted guard is inactive on columbus-5. - GitLab #429 (SEC-E08): was open at time of filing. --- ### Resolution Documented risk acceptance via MR !957 (3f91ddef). Artifacts confirmed present by verifier (@Brouie): - `extensionSignedFeeGuard.ts` JSDoc: "intentionally inactive on mainnet (columbus-5) -- see SEC-E08 / #429 (closed)" - `docs/security-model.md` SEC-E08 section: LocalTerra-only scope, 95% fee/gas threshold, lineage from #127 and #134 - `docs/runbooks/extension-fee-guard-wallet-qa.md`: wallet QA runbook with mainnet section and launch sign-off text - `docs/runbooks/launch-checklist.md` Phase 4: SEC-E08 gate added, links runbook, security model, and agent skill - `extensionSignedFeeGuard.test.ts` 9/9 passing: columbus-5 returns null test now confirmed present - `make verify-issue-429`: PASS 6 / FAIL 0 --- ### Verification Checklist - [x] SEC-E08 / GitLab #429 resolved and formally closed with documented rationale - [x] Test added confirming guard is intentionally inactive on columbus-5 (returns null -- extensionSignedFeeGuard.test.ts) - [x] Risk acceptance documented in security-model.md and wallet QA runbook rather than extending guard to mainnet ### Labels `security`, `pre-launch` Cc: @PlasticDigits , please close, made an error upstream before filing this #429 was already closed and veriifed , my agent did not verify this before filing the issue

totdking commented

2026-06-30 18:37:45 +00:00

(Migrated from gitlab.com)

mentioned in issue #454

totdking commented

2026-06-30 18:37:55 +00:00

(Migrated from gitlab.com)

mentioned in issue #381

Brouie commented

2026-06-30 19:29:05 +00:00

(Migrated from gitlab.com)

Confirming totdking's read on this one — no action needed. The SEC-E08 / #429 fee-guard-inactive-on-mainnet scope is intentional (Keplr on columbus-5 doesn't rewrite fees) and #429 was already closed with the risk-acceptance docs + the columbus-5-returns-null test in extensionSignedFeeGuard.test.ts. This issue was filed against an already-resolved state.

Nothing for me to ship. @PlasticDigits this one's safe to close.

Confirming totdking's read on this one — no action needed. The SEC-E08 / #429 fee-guard-inactive-on-mainnet scope is intentional (Keplr on columbus-5 doesn't rewrite fees) and #429 was already closed with the risk-acceptance docs + the columbus-5-returns-null test in `extensionSignedFeeGuard.test.ts`. This issue was filed against an already-resolved state. Nothing for me to ship. @PlasticDigits this one's safe to close.

PlasticDigits (Migrated from gitlab.com) closed this issue

2026-06-30 22:15:50 +00:00