Add router-side blacklist-guard fail-closed unit test (#456) #1001

Merged

Brouie merged 1 commit from qa/456-router-blacklist-guard-test into main

2026-07-01 12:04:50 +00:00

Brouie commented

2026-07-01 11:44:39 +00:00

(Migrated from gitlab.com)

Follow-up on #456 (SEC-I03 F02, closed). The blacklist guard is default-deny in both the pair and the router now, but only the pair side had a test for the fail-closed arm (factory_blacklist_query_error_blocks_swap). The router's assert_router_swap_not_blacklisted Err(_) => BlacklistGuardUnavailable branch had no coverage — the existing router_multihop_rejects_blacklisted_wallet only exercises the healthy-factory blocked=true path.

This adds a mock-querier unit test for the router: the factory answers the Pair query (which the router does first) but errors on BlacklistCheck, and the guard must reject with BlacklistGuardUnavailable. Plus healthy and blacklisted control cases.

Test-only, no behavior change. Router suite 3/3, fmt + clippy clean. Confirmed the fail-closed test fails against a fail-open guard before landing it (pre-fix proof).

Follow-up on #456 (SEC-I03 F02, closed). The blacklist guard is default-deny in both the pair and the router now, but only the pair side had a test for the fail-closed arm (`factory_blacklist_query_error_blocks_swap`). The router's `assert_router_swap_not_blacklisted` `Err(_) => BlacklistGuardUnavailable` branch had no coverage — the existing `router_multihop_rejects_blacklisted_wallet` only exercises the healthy-factory `blocked=true` path. This adds a mock-querier unit test for the router: the factory answers the `Pair` query (which the router does first) but errors on `BlacklistCheck`, and the guard must reject with `BlacklistGuardUnavailable`. Plus healthy and blacklisted control cases. Test-only, no behavior change. Router suite 3/3, fmt + clippy clean. Confirmed the fail-closed test fails against a fail-open guard before landing it (pre-fix proof).

Brouie commented

2026-07-01 11:45:03 +00:00

(Migrated from gitlab.com)

mentioned in issue #456

PlasticDigits commented

2026-07-01 12:04:51 +00:00

(Migrated from gitlab.com)

mentioned in commit 14e53a7915

mentioned in commit 14e53a7915d86585b322417388f580d493c324b1

PlasticDigits (Migrated from gitlab.com) merged commit 14e53a7915 into main

2026-07-01 12:04:51 +00:00

PlasticDigits commented

2026-07-01 12:13:30 +00:00

(Migrated from gitlab.com)

Security review — MR !1001

Commit reviewed: 30ab853c32a3e22d6e0eac798b8c261eaaf50d59 (merge: 14e53a7915d86585b322417388f580d493c324b1)

Scope: Added #[cfg(test)] unit tests in smartcontracts/contracts/router/src/blacklist_guard.rs — mock-querier coverage for assert_router_swap_not_blacklisted fail-closed (BlacklistGuardUnavailable), healthy-allow, and blacklisted-deny paths. No production/router wasm logic changes.

Method: Diff review; traced attacker-controlled inputs to sinks in modified code only; confirmed mod tests is excluded from release/wasm builds.

Outcome: FINDINGS: 0 medium+

Inline threads: none (no findings to anchor)

Security review: no medium+ findings on this diff. Test-only change strengthens regression coverage for SEC-I03 F02 default-deny blacklist guard behavior already enforced in production code (Err(_) => BlacklistGuardUnavailable at lines 67–70). No new injection surfaces, authz boundaries, secret exposure, dependency changes, or deployable attack paths introduced.

## Security review — MR !1001 **Commit reviewed:** `30ab853c32a3e22d6e0eac798b8c261eaaf50d59` (merge: `14e53a7915d86585b322417388f580d493c324b1`) **Scope:** Added `#[cfg(test)]` unit tests in `smartcontracts/contracts/router/src/blacklist_guard.rs` — mock-querier coverage for `assert_router_swap_not_blacklisted` fail-closed (`BlacklistGuardUnavailable`), healthy-allow, and blacklisted-deny paths. No production/router wasm logic changes. **Method:** Diff review; traced attacker-controlled inputs to sinks in modified code only; confirmed `mod tests` is excluded from release/wasm builds. **Outcome:** `FINDINGS: 0` medium+ **Inline threads:** none (no findings to anchor) Security review: no medium+ findings on this diff. Test-only change strengthens regression coverage for SEC-I03 F02 default-deny blacklist guard behavior already enforced in production code (`Err(_) => BlacklistGuardUnavailable` at lines 67–70). No new injection surfaces, authz boundaries, secret exposure, dependency changes, or deployable attack paths introduced.