fix(swarm): LP workers + bootstrap for swap quote QA (#293) #783
No reviewers
Labels
No labels
agent:fix_bugfix
agent:fix_conflicts
agent:fix_security
agent:gap_analysis
agent:implement
agent:implement
agent:implement
agent:open_issues
agent:ready
agent:research
agent:security_audit
agent:verify
architecture
backend
blocker:hybrid
blocker:launch
blocker:limit-orders
blocker:v2
block:log_only
block:security
bug
ci
contracts
correctness
deploy
dev
devops
docs
documentation
duplicate
e2e
enhancement
epic
feature
frontend
functional-completion
gas
good first issue
governance
help wanted
high-risk
hooks
hybrid
indexer
infra
infrastructure
integrators
invalid
launch-blocker
limit-orders
localnet
localterra
low priority
missing-implementation
needs-design
ops
performance
priority
high
priority
medium
product
qa
QA
question
ready
ready
research
scripts
security
security-hardening
smartcontracts
tech-debt
testing
ux
UX
v2
verification
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
code/cl8y-dex-terraclassic!783
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "cursor/gitlab-issue-workflow-0c8f"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Summary
Addresses https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/work_items/293 — swap-only bot volume drained LocalTerra test pools, so the indexer route solver picked lopsided multi-hop paths in one direction and direct pools in the other. Quotes looked wildly non-inverse even though UI decimal math is correct (per Brouie's analysis).
Changes:
scripts/bots/):provide_liquidityworkers (--worker lp N), one-shotbootstrap-swarm-liquiditybeforelaunch-swarm.sh, reserve-floor skip on swap bots, shared sizing inswarm_liquidity.py.packages/localnet-trading-swarm): raisedadd_liquidity/ loweredremove_liquidityprofile weights.make test-swarm-liquidity,make swarm-bootstrap-liquidity; cross-links indocs/testing.md,AGENTS_LOCALNET_TRADING_SWARM.md, swarm README.Merge with
main(2026-06-05): ResolvedMakefile.PHONYconflict — union of MR targets (test-swarm-liquidity,swarm-bootstrap-liquidity) withmain(verify-issue-309/313/295,setup-cloud-localterra). MR is mergeable (no remaining conflicts).Acceptance checklist
launch-swarm.shstarts 3lpworkersbootstrap-swarm-liquidity.pywired in launchcd packages/localnet-trading-swarm && npm ci && npm run test:runmake test-swarm-liquidityVerification for third parties
Issue #293 stays open until on-chain OE-1 verification on a QA host.
changed the description
changed the description
mentioned in issue #293
changed the description
Stale Security Review comment
Stale Security Review comment
Stale Security Review comment
Stale Security Review comment
Stale Security Review comment
Cursor Bugbot has reviewed your changes and found 2 potential issues.
Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issues.
Reviewed by Cursor Bugbot for commit
fc62c1fc1d. Configure here.LP workers ignore reserve env override
Medium Severity
Swap workers honor
BOTS_MIN_RESERVE_PER_SIDEvia_min_reserve_per_side(), but LP workers callpick_scaled_provide_amounts, which always requires the hardcodedMIN_RESERVE_PER_SIDE_FOR_SWAP(10M). Lowering the env lets swaps run on pools LP workers will never replenish, so depth can erode without the intended LP backstop.Additional Locations (1)
scripts/bots/swarm_liquidity.py#L17-L23Reviewed by Cursor Bugbot for commit
fc62c1fc1d. Configure here.Stale reserves bypass thin-pool guard
Medium Severity
Swap workers refresh pool reserves before applying
BOTS_MIN_RESERVE_PER_SIDE, but when_load_pair_metafails they keep the startup snapshot and still swap. The new floor check can pass on outdated deep reserves while the pool is already drained, defeating the guard this change adds.Reviewed by Cursor Bugbot for commit
fc62c1fc1d. Configure here.Security review (automated)
Commit reviewed:
fc62c1fc1d8ed0e674dc0416c0a38864c6b4911aScope: Full MR diff vs
main(531d00e→fc62c1fc): LocalTerra QA swarm LP/bootstrap (#293), indexer rate-limit hardening (#282) + CG/CMC LCD-heavy governor test (#278), limit-fillswap_indexlinkage (#316), factory pair-creation fee/refund path (#276/#318), boundedSetLpAdminAll/SetLpAdminBatch(#277), limitclamp(1,MAX)regression tests (#317), frontend broadcast-phase UX (#305), Cloud Agent Keplr/Chrome setup scripts, and related docs/tests.Outcome:
FINDINGS: 0medium+Inline threads: None (no exploitable issues on added/modified paths).
Summary
Reviewed attacker-controlled inputs on changed surfaces (indexer HTTP query params, LCD proxy routes, factory/pair execute paths, Python swarm env/LCD metadata, frontend tx-hash display). Existing controls hold:
/64uses socketConnectInfoonly (no spoofable forwarded headers);get_pair_resting_bookSQL interpolation is limited to fixedASC/DESCafter"bid"/"ask"branch (internal callers only); new tests reinforce LCD-heavy 429 on CG/CMC orderbook mirrors.SetLpAdmin*andSetPairPausedremain governance-gated; pairSetLpAdminstill factory-only; pair-creation fee now rejects stray denoms and refunds overpay when fee is zero — reduces stuck-funds risk, not a new bypass.terradviacreate_subprocess_exec(no shell); defaults target LocalTerratest1; Keplr install pins default CWS extension id with CRX validation (dev VM tooling only).No injection, authz bypass, secret leakage, SSRF/XSS, or unsafe deserialization introduced on production-facing paths in this diff.
added 1 commit
3527ae79- Fix swarm thin-pool guards: require fresh reserves and align LP floor with envCompare with previous version
changed the description
Stale Security Review comment
Stale Security Review comment
Stale Security Review comment
Stale Security Review comment
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.
Reviewed by Cursor Bugbot for commit
3527ae79b4. Configure here.Thin pools never recover automatically
Medium Severity
When either pool reserve drops below
BOTS_MIN_RESERVE_PER_SIDE, swap workers skip the pair andlp_worker_looponly callspick_scaled_provide_amounts, which also requires both sides above that floor.bootstrap_top_up_amountsruns only at launch, so asymmetric draining can leave hub pairs stuck with no ongoing recovery during the swarm.Additional Locations (1)
scripts/bots/swarm.py#L560-L563Reviewed by Cursor Bugbot for commit
3527ae79b4. Configure here.changed this line in version 3 of the diff
changed this line in version 3 of the diff
added 1 commit
499beaa1- fix(swarm): recover thin pools in LP worker via bootstrap top-upCompare with previous version
changed the description
Security review (automated)
Commit reviewed:
499beaa1bea175f2870d99e398f4ce9b1dbde97fScope: MR !783 diff vs
main(531d00e→499beaa1): LocalTerra QA swarm LP workers + bootstrap (scripts/bots/swarm.py,swarm_liquidity.py,bootstrap-swarm-liquidity.*,launch-swarm.sh), Makefile targets, docs, and@cl8y-dex/localnet-trading-swarmprofiles.jsonweight rebalance (#293).Outcome:
FINDINGS: 0medium+Inline threads: None (no exploitable issues on added/modified paths).
Summary
Re-read prior automated review on
fc62c1fcand Bugbot diff threads (LP env floor, stale reserves, thin-pool recovery). Those items are functional QA / correctness for local pool depth, not auth or injection bugs; the latest commit (499beaa1) addresses thin-pool recovery inlp_worker_loopviabootstrap_top_up_amountsfallback.Reviewed attacker-controlled inputs on changed surfaces:
TERRA_LCD_URL/DEX_TERRA_LCD_PORTurllib.request.urlopenLCD queriesterrad tx wasm executeviacreate_subprocess_exec(no shell)terra1…; amounts are computed ints serialized to JSON. Malicious LCD requires operator misconfiguration, not a remote attack path.BOTS_*env vars--from test1,--chain-id localterra, LocalTerra docker exec.provide_liquidity_pairincrease_allowance+ pairprovide_liquidityprofiles.jsonweightsvalidateLocalnetchain-id guard; no production auth or HTTP exposure.No injection, authn/authz bypass, secret leakage, unsafe deserialization, or production-facing boundary mistakes introduced by this diff.
Security review: no medium+ findings on this diff.
Stale Security Review comment
Stale Security Review comment
Stale Security Review comment
Cursor Bugbot has reviewed your changes and found 2 potential issues.
Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issues.
Reviewed by Cursor Bugbot for commit
499beaa1be. Configure here.LP worker idle mid reserves
Medium Severity
When
pick_scaled_provide_amountsreturnsNonebecause 0.3% legs fall belowMIN_PROVIDE_LIQUIDITY_LEG, the LP worker only triesbootstrap_top_up_amountswithtarget_per_side=floor + MIN_PROVIDE_LIQUIDITY_LEG. That helper exits immediately if both sides are already at or aboveBOTS_MIN_RESERVE_PER_SIDE, so pools between the swap floor (~10M) and ~1.67B per side get no LP while swap bots still trade them, allowing the same drain/skew #293 targets.Reviewed by Cursor Bugbot for commit
499beaa1be. Configure here.LP txs lack inclusion wait
High Severity
New
provide_liquidity_pairsends three separateterradexecutes (twoincrease_allowance, thenprovide_liquidity) back-to-back with onlysyncbroadcast and no inclusion wait. Unlike the TypeScript swarm’s single multi-message tx andscripts/deploy-dex-local.sh’ssleepbetween steps, this can hit sequence mismatches orprovide_liquiditybefore allowances land, so bootstrap and LP workers may silently fail while only logging warnings.Reviewed by Cursor Bugbot for commit
499beaa1be. Configure here.changed this line in version 4 of the diff
changed this line in version 4 of the diff
added 1 commit
3eeb4ca4- Fix LP swarm tx sequencing and mid-reserve idle gapCompare with previous version
changed the description
Stale Security Review comment
Stale Security Review comment
Cursor Bugbot has reviewed your changes and found 3 potential issues.
Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issues.
Reviewed by Cursor Bugbot for commit
3eeb4ca495. Configure here.Malformed tx query treated success
Medium Severity
In
_poll_tx_inclusion, aJSONDecodeErrorwhile parsing theterrad query txoutput returnsTrue, so inclusion waiting is treated as successful when the response cannot be parsed.Reviewed by Cursor Bugbot for commit
3eeb4ca495. Configure here.Tx poll ignores nested failure
High Severity
_poll_tx_inclusiontreats a queried transaction as successful when only the top-level JSONcodeis zero. CosmosGetTxresponses usually put the execution result undertx_response.code, so failed on-chainincrease_allowanceorprovide_liquiditytxs can be read as success and the multi-step LP flow continues anyway.Reviewed by Cursor Bugbot for commit
3eeb4ca495. Configure here.LP worker logs false success
Medium Severity
The LP worker always prints a successful
provide_liquidityline afterprovide_liquidity_pairreturns, even when inner_wasm_executecalls failed and the pair was not topped up.Reviewed by Cursor Bugbot for commit
3eeb4ca495. Configure here.changed this line in version 5 of the diff
changed this line in version 5 of the diff
added 1 commit
31a5143b- fix(swarm): treat tx query failures and LP success correctlyCompare with previous version
changed the description
Security review (automated)
Commit reviewed:
31a5143bd13096b3090a674e33d22f34683e1206Scope: MR !783 diff vs
main(531d00e→31a5143): LocalTerra QA swarm LP workers + bootstrap (scripts/bots/swarm.py,swarm_liquidity.py,bootstrap-swarm-liquidity.*,launch-swarm.sh), Makefile targets, docs, and@cl8y-dex/localnet-trading-swarmprofiles.jsonweight rebalance (#293).Outcome:
FINDINGS: 0medium+Inline threads: None (no exploitable issues on added/modified paths).
Summary
Re-read prior automated reviews (
fc62c1fc,499beaa1) and Bugbot diff threads (LP env floor, stale reserves, thin-pool recovery, tx polling, false-success logging). Those items are functional QA / correctness for local pool depth and bot observability, not authn/authz or injection bugs. Commit31a5143hardens_poll_tx_inclusion(retry on malformed JSON, checktx_response.code) and gates LP success logging onprovide_liquidity_pairreturning true — reduces false-positive QA signals; no new attacker-controlled sink.TERRA_LCD_URL/DEX_TERRA_LCD_PORTurllib.request.urlopenLCD queriesterrad tx wasm executeviacreate_subprocess_exec(no shell)terra1…; amounts are computed ints in JSON. Malicious LCD requires operator misconfiguration, not a remote attack path.BOTS_*env vars--from test1,--chain-id localterra, LocalTerra docker exec.provide_liquidity_pairincrease_allowance+ pairprovide_liquidityprofiles.jsonweightsNo injection, authn/authz bypass, secret leakage, unsafe deserialization, or production-facing boundary mistakes introduced by this diff.
Security review: no medium+ findings on this diff.
Stale Security Review comment
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.
Reviewed by Cursor Bugbot for commit
31a5143bd1. Configure here.Bootstrap ignores provide liquidity failures
Medium Severity
_bootstrap_pairalways returns a success note and increments the action counter after callingprovide_liquidity_pair, even when that helper returnsFalse(terrad error, missing txhash, on-chain failure, or inclusion timeout).main_asyncthen exits 0, solaunch-swarm.shstill starts swap workers while logs imply pools were topped up.Reviewed by Cursor Bugbot for commit
31a5143bd1. Configure here.Security review (automated)
Commit reviewed:
31a5143bd13096b3090a674e33d22f34683e1206(MR head; webhook referenced3eeb4ca— delta is LP tx-polling / success-logging hardening inscripts/bots/swarm.pyonly)Scope: MR !783 diff vs
main: LocalTerra QA swarm LP workers + bootstrap (scripts/bots/swarm.py,swarm_liquidity.py,bootstrap-swarm-liquidity.*,launch-swarm.sh), Makefile targets,@cl8y-dex/localnet-trading-swarmprofiles.json, plus co-merged indexer rate-limit (#282), limit-fillswap_index(#316), factory pair-creation refund / boundedSetLpAdmin*(#276/#277/#318), frontend broadcast-phase UX (#305), and related tests/docs.Outcome:
FINDINGS: 0medium+Inline threads: None (no exploitable issues on added/modified paths).
Summary
Re-read prior automated reviews (
fc62c1fc,499beaa1,3eeb4ca) and Bugbot diff threads (LP env floor, stale reserves, thin-pool recovery, tx polling). Those are functional QA / correctness for local pool depth and bot observability, not authn/authz or injection bugs. Commit31a5143retries malformed tx-query JSON, checkstx_response.code, and gates LP success logging onprovide_liquidity_pairreturning true — reduces false-positive QA signals; no new attacker-controlled sink.TERRA_LCD_URL/DEX_TERRA_LCD_PORTurllib.request.urlopenLCD queriesterrad tx wasm executeviacreate_subprocess_exec(no shell)terra1…; amounts are computed ints in JSON. Malicious LCD requires operator misconfiguration, not a remote attack path.BOTS_*env vars--from test1,--chain-id localterra, LocalTerra docker exec.provide_liquidity_pairincrease_allowance+ pairprovide_liquidityprofiles.jsonweightsvalidateLocalnet; no production auth surface.tower_governorbuckets (/64for IPv6)ConnectInfoonly — no spoofable forwarded headers; security hardening."bid"/"ask"(internal)ORDER BY price {ASC|DESC}inget_pair_resting_bookSetLpAdmin*/ pair-creation feeensure_governance+pair::SetLpAdminfactory-only; fee stray-denom reject + refund when fee=0.txHashhref+ truncated labelSecurity review: no medium+ findings on this diff.
changed this line in version 6 of the diff
added 1 commit
d70ef866- fix(bots): fail bootstrap when provide_liquidity returns falseCompare with previous version
changed the description
Security review (automated)
Commit reviewed:
d70ef866016a015fea2c42c0bd910889b885193aScope: MR !783 diff vs
main(531d00e→d70ef866): LocalTerra QA swarm LP workers + bootstrap (scripts/bots/swarm.py,swarm_liquidity.py,bootstrap-swarm-liquidity.*,launch-swarm.sh), Makefile targets, docs, and@cl8y-dex/localnet-trading-swarmprofiles.jsonweight rebalance (#293).Outcome:
FINDINGS: 0medium+Inline threads: None (no exploitable issues on added/modified paths).
Summary
Re-read prior automated reviews (
fc62c1fc,499beaa1,31a5143) and Bugbot diff threads (LP env floor, stale reserves, thin-pool recovery, tx polling, bootstrap/LP false-success logging). Those items are functional QA / correctness for local pool depth and bot observability, not authn/authz or injection bugs. Commitd70ef866gates bootstrap success notes and exit code onprovide_liquidity_pairreturning true, so failed top-ups no longer allowlaunch-swarm.shto proceed silently.TERRA_LCD_URL/DEX_TERRA_LCD_PORTurllib.request.urlopenLCD queriesterrad tx wasm executeviacreate_subprocess_exec(no shell)terra1…; amounts are computed ints serialized withjson.dumps. Malicious LCD requires operator misconfiguration, not a remote attack path.terradtx JSON (txhash)_poll_tx_inclusion→terrad query txargv listtx_response.codechecked.txhashpassed as a single argv element (no shell injection).main_asyncexit / worker loggingprofiles.jsonweightsSecurity review: no medium+ findings on this diff.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.
Reviewed by Cursor Bugbot for commit
d70ef86601. Configure here.Bootstrap top-up breaks swarm launch
High Severity
bootstrap_top_up_amountsscales both pool legs by the same factor to lift the thinner side towardtarget_per_side. On factory pairs seeded with a very skewed ratio (severaldeploy-dex-localconfigs, including OE-1 hub ONYX/CORAL), that forces a huge deposit on the already-large leg.provide_liquiditythen fails for lack of balance, bootstrap exits non-zero, andlaunch-swarm.shaborts before any workers start.Additional Locations (2)
scripts/bots/bootstrap-swarm-liquidity.py#L71-L84scripts/bots/launch-swarm.sh#L33-L37Reviewed by Cursor Bugbot for commit
d70ef86601. Configure here.added 1 commit
0acc4920- fix(bots): skip skewed bootstrap top-up when only one leg is below floorCompare with previous version
changed the description
Security review (automated)
Commit reviewed:
0acc492055504d2fee51e29a38225f513fa1a0c8Scope: MR !783 diff vs
main(531d00e→0acc492): LocalTerra QA swarm LP workers + bootstrap (scripts/bots/swarm.py,swarm_liquidity.py,bootstrap-swarm-liquidity.*,launch-swarm.sh), Makefile targets, docs, and@cl8y-dex/localnet-trading-swarmprofiles.jsonweight rebalance (#293).Outcome:
FINDINGS: 0medium+Inline threads: None (no exploitable issues on added/modified paths).
Summary
Re-read prior automated reviews (
fc62c1fc,499beaa1,31a5143,d70ef866) and Bugbot diff threads (LP env floor, stale reserves, thin-pool recovery, tx polling, bootstrap/LP false-success logging, skewed-pair top-up). Those items are functional QA / correctness for local pool depth and bot observability, not authn/authz or injection bugs.Commit
0acc492skips proportional bootstrap top-up when only one pool leg is below the floor (skewed factory pairs like ONYX/CORAL). This avoidsprovide_liquiditybalance failures andlaunch-swarm.shaborts — a launch reliability fix with no new attacker-controlled sink.TERRA_LCD_URL/DEX_TERRA_LCD_PORTurllib.request.urlopenLCD queriesterrad tx wasm executeviacreate_subprocess_exec(no shell)terra1…; amounts are computed ints serialized withjson.dumps. Malicious LCD requires operator misconfiguration, not a remote attack path.terradtx JSON (txhash)_poll_tx_inclusion→terrad query txargv listtx_response.codechecked.txhashpassed as a single argv element (no shell injection).provide_liquidity_pairincrease_allowance(spender = on-chain pair addr) + pairprovide_liquidity--from test1,--chain-id localterra, LocalTerra docker exec.main_asyncexit / worker loggingprofiles.jsonweightsSecurity review: no medium+ findings on this diff.
mentioned in commit
69ef728323added 60 commits
main69ef7283- Merge origin/main into cursor/gitlab-issue-workflow-0c8fCompare with previous version
changed the description
Security review (automated)
Commit reviewed:
69ef72832393b14fa01540fc9d90b6e36252fc10Scope: MR !783 diff vs
main(c0d8ad6→69ef728): LocalTerra QA swarm LP workers + bootstrap (scripts/bots/swarm.py,swarm_liquidity.py,bootstrap-swarm-liquidity.*,launch-swarm.sh), Makefile targets, docs,@cl8y-dex/localnet-trading-swarmprofiles.jsonweight rebalance (#293), and incidental formatting-only edits inPoolPage.tsx/blacklist.ts.Outcome:
FINDINGS: 0medium+Inline threads: None (no exploitable issues on added/modified paths).
Summary
Re-read prior automated reviews on this MR (
fc62c1fc,499beaa1,31a5143,d70ef866,0acc492) and Bugbot diff threads (LP env floor, stale reserves, thin-pool recovery, tx polling, bootstrap false-success, skewed-pair top-up). Those items are functional QA / correctness for local pool depth and bot observability, not authn/authz or injection bugs.Latest head (
69ef728) is a merge oforigin/maininto the feature branch (Makefile.PHONYconflict resolution); no new security-relevant logic beyond prior swarm LP commits.TERRA_LCD_URL/DEX_TERRA_LCD_PORTurllib.request.urlopenLCD queriesterrad tx wasm executeviacreate_subprocess_exec(no shell)terra1…; amounts are computed ints serialized withjson.dumps. Malicious LCD requires operator misconfiguration, not a remote attack path.terradtx JSON (txhash)_poll_tx_inclusion→terrad query txargv listtx_response.codechecked.txhashpassed as a single argv element (no shell injection).provide_liquidity_pairincrease_allowance(spender = on-chain pair addr) + pairprovide_liquidity--from test1,--chain-id localterra, LocalTerra docker exec.main_asyncexit / worker loggingprofiles.jsonweightsPoolPage.tsx,blacklist.tsSecurity review: no medium+ findings on this diff.
changed the description
mentioned in commit
681cdfc9f9mentioned in merge request !807