qa: live LocalTerra gas verification for CleanLimitBook scan cap (#274) #768
No reviewers
Labels
No labels
agent:fix_bugfix
agent:fix_conflicts
agent:fix_security
agent:gap_analysis
agent:implement
agent:implement
agent:implement
agent:open_issues
agent:ready
agent:research
agent:security_audit
agent:verify
architecture
backend
blocker:hybrid
blocker:launch
blocker:limit-orders
blocker:v2
block:log_only
block:security
bug
ci
contracts
correctness
deploy
dev
devops
docs
documentation
duplicate
e2e
enhancement
epic
feature
frontend
functional-completion
gas
good first issue
governance
help wanted
high-risk
hooks
hybrid
indexer
infra
infrastructure
integrators
invalid
launch-blocker
limit-orders
localnet
localterra
low priority
missing-implementation
needs-design
ops
performance
priority
high
priority
medium
product
qa
QA
question
ready
ready
research
scripts
security
security-hardening
smartcontracts
tech-debt
testing
ux
UX
v2
verification
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
code/cl8y-dex-terraclassic!768
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "cursor/verify-274-live-gas-2325"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Summary
Hardens
scripts/qa/verify-issue-274.shfor reliable on-chain LocalTerra verification of GitLab #274 (CleanLimitBooktraversal cap +resume_cursor).mainalready ships the base script,make verify-issue-274, anddeploy-dex-local.shpair-creation fee attach (#276). This MR adds seeding fixes required for the 100-order deep-book scenario:hint_after_order_idfrom the last healthy batch (avoidsLimitInsertStepsExceededon deep books).SHORT_EXPIRYafter healthy seeding (100-order placement exceeds the prior 45s lead window).order_ids from the placement tx before running clean/resume checks.Combines with
maingas-query hardening (query_tx_jsonretries, fail whengas_usedmissing).Verification checklist
cd smartcontracts && cargo test clean_limit_book_make verify-issue-276bash -n scripts/qa/verify-issue-274.shVERIFY274_PAIR_INDEX=8 make verify-issue-274gas_used=152794, resume parks 5)VERIFY274_PAIR_INDEX=3 make verify-issue-274gas_used=152850, resume parks 5)maingit merge origin/mainReproduce
Use a pair with an empty bid book or set
VERIFY274_PAIR_INDEXto an unused dual-CW20 pair.Closes #274
Security review
Commit reviewed:
1ad11dc8f8fea13560a126b54eedf1e82b44510c(fix(qa): verify-issue-274 seeding and tx parsing for LocalTerra)Scope: MR diff only (3 files):
scripts/qa/verify-issue-274.sh(new),scripts/deploy-dex-local.sh(PAIR_CREATION_FEE_COINSoncreate_pair),Makefile(verify-issue-274target). Prior MR notes: none.Method: Traced env/chain inputs through
curl/jq/docker exec terradsinks; compared with existing QA helpers (verify-issue-238.sh,e2e-terrad-tx.sh,lcd-smart-query.sh).Outcome: FINDINGS: 0 medium+
verify-issue-274.shis LocalTerra QA-only (devtest1wallet, dockerizedterrad, LCD from local.env). Tx JSON is built withjq(--arg/--argjson); wasmresume_cursoris fed back as JSON, not shell-evaluated. No production auth surface, secret handling, or user-facing attack path.PAIR_CREATION_FEE_COINSis quoted intoterrad tx … --amount(sameterrad_txhelper as before); default matches on-chain pair-creation fee (#276). Override requires shell access on a dev/CI host — out of scope for dapp/contract adversaries.Inline threads: none (no medium+ issues on this diff).
Automated security review (Cursor Cloud Agent).
added 18 commits
main7cad4d55- fix: resolve Makefile merge conflict with main (keep verify-issue-274 + verify-issue-276)Compare with previous version
changed the description
changed the description
Stale Security Review comment
Stale Security Review comment
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.
Reviewed by Cursor Bugbot for commit
7cad4d5522. Configure here.Failed tx query passes gas
Medium Severity
tx_gas_usedfalls back to"0"when the tx query fails or returns no gas field, and the ceiling check treats any numericGASbelowGAS_CEILINGas a pass. A missing or staleCLEAN_TXcan therefore record a PASS for bounded gas while other checks fail or the clean never ran.Reviewed by Cursor Bugbot for commit
7cad4d5522. Configure here.resolved all threads
added 1 commit
5ef43677- fix(qa): fail gas check when tx query returns no gasCompare with previous version
changed the description
changed the description
Stale Security Review comment
Cursor Bugbot has reviewed your changes and found 2 potential issues.
Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issues.
Reviewed by Cursor Bugbot for commit
5ef4367786. Configure here.Resume pass masks missing cursor
Medium Severity
The resume phase always runs
execute_cleaneven whenresume_cursorwas absent on the capped pass. An emptystart_hintrestarts from the book head with a largemax_steps, so parking the expired tail can still pass while the script already recorded a failure for a missing cursor—masking broken resume behavior.Reviewed by Cursor Bugbot for commit
5ef4367786. Configure here.Expiry wait failure still runs
Medium Severity
If chain time does not reach the tail bids’
expires_atwithin 120 seconds, the script records a failure but continues intoCleanLimitBookand resume checks. Tail orders may still be unexpired, so later assertions can fail or pass for the wrong reason.Reviewed by Cursor Bugbot for commit
5ef4367786. Configure here.added 1 commit
28504415- Fix verify-issue-274: abort on expiry timeout, skip resume without cursorCompare with previous version
resolved all threads
resolved all threads
changed the description
added 1 commit
20f6cb46- fix(qa): verify-issue-274 expired tail seeding (hint + fresh expires_at)Compare with previous version
changed the description
added 4 commits
main74872ca7- fix: merge main into MR branch — combine gas-query hardening with tail seeding fixesCompare with previous version
changed the description
changed the description
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.
Reviewed by Cursor Bugbot for commit
74872ca759. Configure here.Head hint anchors tail wrongly
Medium Severity
When
VERIFY274_HEALTHY_COUNT=0,TAIL_HINT_ORDER_IDis taken fromorder_book_head(best bid). Expired tail bids atTAIL_PRICEbelong at the book tail, so anchoring after the head forces a long tail walk and can hitLimitInsertStepsExceeded, unlike the healthy-seed path that uses the last batch’s maxorder_id.Reviewed by Cursor Bugbot for commit
74872ca759. Configure here.changed the description
changed this line in version 7 of the diff
added 1 commit
3584e1c8- fix(qa): anchor expired tail hint at bid book tail when HEALTHY_COUNT=0Compare with previous version
changed the description
resolved all threads
changed the description
mentioned in commit
4490ba8d28