fix(indexer): scope lifecycle events by reserved _contract_address only (#285) #744

Merged

Brouie merged 1 commit from qa/285-forged-contract-address-parser into main

2026-06-04 08:04:38 +00:00

Brouie commented

2026-06-04 05:27:02 +00:00

(Migrated from gitlab.com)

The forgeable no-underscore contract_address attribute was trusted as the event emitter alongside the runtime-reserved _contract_address. A malicious contract emitting contract_address=<victim_pair> before its action had the forged fill/cancel/placement attributed to the victim pair. Fix: only the wasmd-stamped _contract_address scopes an event.

Demonstrated + non-vacuous: forged-fill / forged-cancel tests assert the row scopes to the real emitter not the victim; they FAIL on the pre-fix predicate (verified by reverting + re-running). No regression — confirmed against a live v4 limit_order_fill tx (real events carry _contract_address). Pre-existing fixtures that used the no-underscore key as the sole scope were corrected. Parser suite 29/29.

Follow-up (flagged on #285, not here): factory provenance in discover_new_pair — clusters with #279/#286/#287.

GitLab #285

The forgeable no-underscore `contract_address` attribute was trusted as the event emitter alongside the runtime-reserved `_contract_address`. A malicious contract emitting `contract_address=<victim_pair>` before its `action` had the forged fill/cancel/placement attributed to the victim pair. Fix: only the wasmd-stamped `_contract_address` scopes an event. Demonstrated + non-vacuous: forged-fill / forged-cancel tests assert the row scopes to the real emitter not the victim; they FAIL on the pre-fix predicate (verified by reverting + re-running). No regression — confirmed against a live v4 `limit_order_fill` tx (real events carry `_contract_address`). Pre-existing fixtures that used the no-underscore key as the sole scope were corrected. Parser suite 29/29. Follow-up (flagged on #285, not here): factory provenance in `discover_new_pair` — clusters with #279/#286/#287. GitLab #285

Rows
Columns