fix(frontend): render multi-hop route on /trade market quote (#302) #758

Merged

Brouie merged 1 commit from qa/302-trade-route-display into main

2026-06-05 03:25:12 +00:00

Brouie commented

2026-06-05 03:21:46 +00:00

(Migrated from gitlab.com)

Follow-up on #302. /swap shows the route via computeSwapRouteDisplay, but /trade never did even when simQuery.data.indexerOperations holds a multi-hop path. Feed the indexer operations through the same shared util and render the route line in the trade-market-quote card (mirrors /swap's swap-route-summary). Reuses the existing display util; no execution/submit path touched. tsc -b clean. Browser verification is totdking's. No closing keyword.

Follow-up on #302. `/swap` shows the route via `computeSwapRouteDisplay`, but `/trade` never did even when `simQuery.data.indexerOperations` holds a multi-hop path. Feed the indexer operations through the same shared util and render the route line in the trade-market-quote card (mirrors `/swap`'s swap-route-summary). Reuses the existing display util; no execution/submit path touched. tsc -b clean. Browser verification is totdking's. No closing keyword.

Brouie commented

2026-06-05 03:23:15 +00:00

(Migrated from gitlab.com)

mentioned in issue #302

PlasticDigits commented

2026-06-05 03:23:58 +00:00

(Migrated from gitlab.com)

Security review

Commit reviewed: 5505b8a493d636c903611758cb42b89bbfd4cda5

Scope: frontend-dapp/src/components/trade/TradeMarketOrderPanel.tsx (multi-hop route display on /trade market quote), indexer/src/api/best_execution.rs (spawn_blocking for path enumeration), indexer/src/api/route_paths.rs (#286 reachability gate, iterative deepening, regression tests).

Outcome: FINDINGS: 0 medium+

Security review: no medium+ findings on this diff.

Notes

Area	Assessment
Frontend	Display-only. Route line uses existing `computeSwapRouteDisplay` with `getTokenDisplaySymbol`, rendered as React text (`{marketRouteLine}`) — no HTML injection sink. Submit/execution path untouched. Same indexer-operation display pattern as `/swap`.
Indexer	Mitigates #286 CPU blow-up (dense graph + unreachable goal): BFS `hop_distance_to_goal` gate returns before DFS; admissible pruning + iterative deepening preserve shortest-path completeness within hop budget. `spawn_blocking` avoids stalling the async executor. Inputs: `token_in`/`token_out` (must resolve in asset registry); graph from DB pairs. Bounded by `GET_DEFAULT_MAX_HOPS=3`, `MAX_PATH_CANDIDATES=5`; `/api/v1/route/solve*` on LCD-heavy rate-limit layer.
Auth / secrets / SSRF	No changes.

Prior MR security threads: none to re-report.

Inline threads: none (no findings to anchor).

Automated security review (Cursor Cloud Agent).

## Security review **Commit reviewed:** `5505b8a493d636c903611758cb42b89bbfd4cda5` **Scope:** `frontend-dapp/src/components/trade/TradeMarketOrderPanel.tsx` (multi-hop route display on `/trade` market quote), `indexer/src/api/best_execution.rs` (`spawn_blocking` for path enumeration), `indexer/src/api/route_paths.rs` (#286 reachability gate, iterative deepening, regression tests). **Outcome:** `FINDINGS: 0` medium+ --- Security review: **no medium+ findings** on this diff. ### Notes | Area | Assessment | |------|------------| | **Frontend** | Display-only. Route line uses existing `computeSwapRouteDisplay` with `getTokenDisplaySymbol`, rendered as React text (`{marketRouteLine}`) — no HTML injection sink. Submit/execution path untouched. Same indexer-operation display pattern as `/swap`. | | **Indexer** | Mitigates #286 CPU blow-up (dense graph + unreachable goal): BFS `hop_distance_to_goal` gate returns before DFS; admissible pruning + iterative deepening preserve shortest-path completeness within hop budget. `spawn_blocking` avoids stalling the async executor. Inputs: `token_in`/`token_out` (must resolve in asset registry); graph from DB pairs. Bounded by `GET_DEFAULT_MAX_HOPS=3`, `MAX_PATH_CANDIDATES=5`; `/api/v1/route/solve*` on LCD-heavy rate-limit layer. | | **Auth / secrets / SSRF** | No changes. | **Prior MR security threads:** none to re-report. **Inline threads:** none (no findings to anchor). --- *Automated security review (Cursor Cloud Agent).*

PlasticDigits commented

2026-06-05 03:25:12 +00:00

(Migrated from gitlab.com)

mentioned in commit 83e375d182

mentioned in commit 83e375d182369055a5bb0e5d3986bc7279fe5a87