qa(#285): live-proof harness + L285 indexer invariants #787

Merged

PlasticDigits merged 5 commits from cursor/gitlab-issue-verification-4494 into main 2026-06-05 11:06:35 +00:00

Conversation 27 Commits 5 Files changed 4 +311 -1

PlasticDigits commented 2026-06-05 10:05:45 +00:00 (Migrated from gitlab.com)

Copy link

Summary

Verification QA for GitLab #285 — confirms the parser fix (runtime _contract_address only) meets acceptance criteria and adds a repeatable live-proof harness.

Changes (guardrails only — parser fix already on main):

• scripts/qa/verify-issue-285.sh + make verify-issue-285
• docs/indexer-invariants.md — L285 lifecycle emitter scoping row
• skills/AGENTS_INDEXER_LIFECYCLE_EMITTER_SCOPING.md

Merge with main (2026-06-05): Resolved Makefile conflicts — kept verify-issue-285 alongside main verify targets (309, 313, 295, setup-cloud-localterra). MR is mergeable (no remaining conflicts).

Acceptance criteria checklist

Criterion	Command	Result
AC1: Forged contract_address = victim_pair + limit_order_fill does not attribute fill to victim	cargo test --lib forged_contract_address (via harness)	PASS
AC2: Forged cancel/placement cannot alter victim lifecycle	same unit suite	PASS
AC3: Only runtime-stamped emitter scopes lifecycle events	is_wasm_contract_addr_key + integration fixtures	PASS
Integration: limit_order_parked_lifecycle	make verify-issue-285 (Postgres up)	PASS
Live positive control: genuine on-chain fill indexed under correct pair	make verify-issue-285 live leg	SKIP (no LocalTerra in agent VM)

Agent VM run: docker compose up -d postgres + make verify-issue-285 → 2 passed, 0 failed, live skipped.

Full live proof (QA host): make start && make wait-healthy && make deploy-local && make verify-issue-285

Direction 3 (factory provenance) remains tracked on #279/#286/#287 — out of scope for this MR.

Does not close #285 until live leg passes on a host with LocalTerra + deploy env.

---

Note

Low Risk
Documentation and QA scripts only; no runtime indexer or contract changes in this diff.

Overview
Adds repeatable verification for GitLab #285 (limit-order lifecycle rows must scope to runtime _contract_address, not forgeable contract_address). The parser behavior is assumed already on main; this MR is guardrails and proof wiring.

make verify-issue-285 runs scripts/qa/verify-issue-285.sh: parser unit tests (forged_contract_address, dual-key regression), Postgres integration (limit_order_parked_lifecycle), and an optional LocalTerra leg (hybrid swap → on-chain limit_order_fill → indexer /limit-fills) when compose + deploy env exist; otherwise the live steps SKIP.

Docs: new L285 row in docs/indexer-invariants.md and agent skill skills/AGENTS_INDEXER_LIFECYCLE_EMITTER_SCOPING.md (invariants, test commands, cross-links). Makefile .PHONY and target align with other verify-issue-* hooks.

^{Reviewed by Cursor Bugbot for commit fec1c254a7. Bugbot is set up for automated code reviews on this repo. Configure here.}

## Summary Verification QA for [GitLab #285](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/work_items/285) — confirms the parser fix (runtime `_contract_address` only) meets acceptance criteria and adds a repeatable live-proof harness. **Changes (guardrails only — parser fix already on `main`):** - `scripts/qa/verify-issue-285.sh` + `make verify-issue-285` - `docs/indexer-invariants.md` — **L285** lifecycle emitter scoping row - `skills/AGENTS_INDEXER_LIFECYCLE_EMITTER_SCOPING.md` **Merge with `main` (2026-06-05):** Resolved `Makefile` conflicts — kept `verify-issue-285` alongside `main` verify targets (`309`, `313`, `295`, `setup-cloud-localterra`). MR is **mergeable** (no remaining conflicts). ## Acceptance criteria checklist | Criterion | Command | Result | |-----------|---------|--------| | AC1: Forged `contract_address = victim_pair` + `limit_order_fill` does **not** attribute fill to victim | `cargo test --lib forged_contract_address` (via harness) | **PASS** | | AC2: Forged cancel/placement cannot alter victim lifecycle | same unit suite | **PASS** | | AC3: Only runtime-stamped emitter scopes lifecycle events | `is_wasm_contract_addr_key` + integration fixtures | **PASS** | | Integration: `limit_order_parked_lifecycle` | `make verify-issue-285` (Postgres up) | **PASS** | | Live positive control: genuine on-chain fill indexed under correct pair | `make verify-issue-285` live leg | **SKIP** (no LocalTerra in agent VM) | **Agent VM run:** `docker compose up -d postgres` + `make verify-issue-285` → **2 passed, 0 failed**, live skipped. **Full live proof (QA host):** `make start && make wait-healthy && make deploy-local && make verify-issue-285` **Direction 3 (factory provenance)** remains tracked on #279/#286/#287 — out of scope for this MR. Does **not** close #285 until live leg passes on a host with LocalTerra + deploy env. <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Low Risk** > Documentation and QA scripts only; no runtime indexer or contract changes in this diff. > > **Overview** > Adds **repeatable verification** for GitLab **#285** (limit-order lifecycle rows must scope to runtime **`_contract_address`**, not forgeable **`contract_address`**). The parser behavior is assumed already on `main`; this MR is guardrails and proof wiring. > > **`make verify-issue-285`** runs `scripts/qa/verify-issue-285.sh`: parser unit tests (`forged_contract_address`, dual-key regression), Postgres integration (`limit_order_parked_lifecycle`), and an optional **LocalTerra** leg (hybrid swap → on-chain `limit_order_fill` → indexer **`/limit-fills`**) when compose + deploy env exist; otherwise the live steps **SKIP**. > > Docs: new **L285** row in `docs/indexer-invariants.md` and agent skill `skills/AGENTS_INDEXER_LIFECYCLE_EMITTER_SCOPING.md` (invariants, test commands, cross-links). Makefile `.PHONY` and target align with other `verify-issue-*` hooks. > > ^{Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit fec1c254a70950d87ce4388a353ff12581279050. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).} <!-- /CURSOR_SUMMARY -->

ghost1 commented 2026-06-05 10:05:52 +00:00 (Migrated from gitlab.com)

Copy link

changed the description

changed the description

PlasticDigits commented 2026-06-05 10:05:58 +00:00 (Migrated from gitlab.com)

Copy link

mentioned in issue #285

mentioned in issue #285

ghost1 commented 2026-06-05 10:06:00 +00:00 (Migrated from gitlab.com)

Copy link

changed the description

changed the description

ghost1 commented 2026-06-05 10:07:35 +00:00 (Migrated from gitlab.com)

Copy link

Stale Security Review comment

Cursor Bugbot has reviewed your changes and found 2 potential issues.
^{Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issues.}

^{Reviewed by Cursor Bugbot for commit e342cdf5e6. Configure here.}

<details> <summary>Stale Security Review comment</summary> <!-- BUGBOT_REVIEW --> Cursor Bugbot has reviewed your changes and found 2 potential issues.<!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_BEGIN --> ^{Bugbot Autofix is [ON](https://www.cursor.com/dashboard/bugbot). A cloud agent has been kicked off to fix the reported issues. <!-- BUGBOT_AUTOFIX_AGENT_LINK -->} <!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_END --> ^{Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit e342cdf5e631cd3150301583cef06122010623ee. Configure [here](https://www.cursor.com/dashboard/bugbot).} </details>

ghost1 commented 2026-06-05 10:07:36 +00:00 (Migrated from gitlab.com)

Copy link

Live leg after pair failure

Medium Severity

After bad for missing dual-CW20 pair resolution, the live block still builds SEND_MSG and runs terrad_tx wasm execute with an empty TOKEN0 and a stale PAIR_ADDR from the last factory row scanned, instead of skipping the on-chain steps.

 

^{Reviewed by Cursor Bugbot for commit e342cdf5e6. Configure here.}

### Live leg after pair failure **Medium Severity** <!-- DESCRIPTION START --> After `bad` for missing dual-CW20 pair resolution, the live block still builds `SEND_MSG` and runs `terrad_tx wasm execute` with an empty `TOKEN0` and a stale `PAIR_ADDR` from the last factory row scanned, instead of skipping the on-chain steps. <!-- DESCRIPTION END --> <!-- BUGBOT_BUG_ID: 8567a640-a274-4e50-bd35-02b298b54efc --> <!-- LOCATIONS START scripts/qa/verify-issue-285.sh#L174-L193 LOCATIONS END --> <div><a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9DVVJTT1IiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OmY4ZGU3NDM2LWYyMTgtNGEyYi1iMzg1LWY0OTcyNTE1YjVmZSIsImVuY3J5cHRpb25LZXkiOiJXWDVoQjk3TnZWa3ZTbVFIbEhDTy0yVUZmZWVYWmswRjlkUm8yRVlMM2s4IiwiYnJhbmNoIjoiY3Vyc29yL2dpdGxhYi1pc3N1ZS12ZXJpZmljYXRpb24tNDQ5NCIsInJlcG9Pd25lciI6IlBsYXN0aWNEaWdpdHMiLCJyZXBvTmFtZSI6ImNsOHktZGV4LXRlcnJhY2xhc3NpYyJ9fQ" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a>&nbsp;<a href="https://cursor.com/agents?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9XRUIiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OmY4ZGU3NDM2LWYyMTgtNGEyYi1iMzg1LWY0OTcyNTE1YjVmZSIsImVuY3J5cHRpb25LZXkiOiJXWDVoQjk3TnZWa3ZTbVFIbEhDTy0yVUZmZWVYWmswRjlkUm8yRVlMM2s4IiwiYnJhbmNoIjoiY3Vyc29yL2dpdGxhYi1pc3N1ZS12ZXJpZmljYXRpb24tNDQ5NCIsInJlcG9Pd25lciI6IlBsYXN0aWNEaWdpdHMiLCJyZXBvTmFtZSI6ImNsOHktZGV4LXRlcnJhY2xhc3NpYyIsInByTnVtYmVyIjo2OSwiY29tbWl0U2hhIjoiZTM0MmNkZjVlNjMxY2QzMTUwMzAxNTgzY2VmMDYxMjIwMTA2MjNlZSIsInByb3ZpZGVyIjoiZ2l0bGFiIiwiaG9zdG5hbWUiOiJnaXRsYWIuY29tIn19" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-web-light.png"><img alt="Fix in Web" width="99" height="28" src="https://cursor.com/assets/images/fix-in-web-dark.png"></picture></a></div> ^{Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit e342cdf5e631cd3150301583cef06122010623ee. Configure [here](https://www.cursor.com/dashboard/bugbot).}

ghost1 commented 2026-06-05 10:07:36 +00:00 (Migrated from gitlab.com)

Copy link

Cargo filter skips unit tests

High Severity

The parser run_step passes a single cargo test --lib filter containing a pipe, but Cargo matches test names by substring only, not regex OR. No test name includes that full literal string, so zero L285 unit tests run while cargo test still exits successfully and the step is marked PASS.

 

^{Reviewed by Cursor Bugbot for commit e342cdf5e6. Configure here.}

### Cargo filter skips unit tests **High Severity** <!-- DESCRIPTION START --> The parser `run_step` passes a single `cargo test --lib` filter containing a pipe, but Cargo matches test names by substring only, not regex OR. No test name includes that full literal string, so zero L285 unit tests run while `cargo test` still exits successfully and the step is marked PASS. <!-- DESCRIPTION END --> <!-- BUGBOT_BUG_ID: d7a5c8d1-842e-484e-94b7-f5d8d92c46e9 --> <!-- LOCATIONS START scripts/qa/verify-issue-285.sh#L46-L48 LOCATIONS END --> <div><a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9DVVJTT1IiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OjQwYTgzMDIyLTNiZGItNDNmNi1iMGIxLWMxMjA4NjA4NTA3OCIsImVuY3J5cHRpb25LZXkiOiJJMzlfR25SMlJlTTIwb0RwNlNoeUN6aEp0Qm54MkxySDNHbjVYMGlaNEVnIiwiYnJhbmNoIjoiY3Vyc29yL2dpdGxhYi1pc3N1ZS12ZXJpZmljYXRpb24tNDQ5NCIsInJlcG9Pd25lciI6IlBsYXN0aWNEaWdpdHMiLCJyZXBvTmFtZSI6ImNsOHktZGV4LXRlcnJhY2xhc3NpYyJ9fQ" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a>&nbsp;<a href="https://cursor.com/agents?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9XRUIiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OjQwYTgzMDIyLTNiZGItNDNmNi1iMGIxLWMxMjA4NjA4NTA3OCIsImVuY3J5cHRpb25LZXkiOiJJMzlfR25SMlJlTTIwb0RwNlNoeUN6aEp0Qm54MkxySDNHbjVYMGlaNEVnIiwiYnJhbmNoIjoiY3Vyc29yL2dpdGxhYi1pc3N1ZS12ZXJpZmljYXRpb24tNDQ5NCIsInJlcG9Pd25lciI6IlBsYXN0aWNEaWdpdHMiLCJyZXBvTmFtZSI6ImNsOHktZGV4LXRlcnJhY2xhc3NpYyIsInByTnVtYmVyIjo2OSwiY29tbWl0U2hhIjoiZTM0MmNkZjVlNjMxY2QzMTUwMzAxNTgzY2VmMDYxMjIwMTA2MjNlZSIsInByb3ZpZGVyIjoiZ2l0bGFiIiwiaG9zdG5hbWUiOiJnaXRsYWIuY29tIn19" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-web-light.png"><img alt="Fix in Web" width="99" height="28" src="https://cursor.com/assets/images/fix-in-web-dark.png"></picture></a></div> ^{Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit e342cdf5e631cd3150301583cef06122010623ee. Configure [here](https://www.cursor.com/dashboard/bugbot).}

ghost1 commented 2026-06-05 10:09:51 +00:00 (Migrated from gitlab.com)

Copy link

changed this line in version 2 of the diff

changed this line in [version 2 of the diff](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/69/diffs?diff_id=1836413061&start_sha=e342cdf5e631cd3150301583cef06122010623ee#8c2151db37c31ae6bb05e3b80af70f931311ca08_48_48)

ghost1 commented 2026-06-05 10:09:51 +00:00 (Migrated from gitlab.com)

Copy link

added 1 commit

• ff15bf4c - fix(verify-issue-285): run L285 unit tests and skip live swap without pair

Compare with previous version

added 1 commit <ul><li>ff15bf4c - fix(verify-issue-285): run L285 unit tests and skip live swap without pair</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/69/diffs?diff_id=1836413061&start_sha=e342cdf5e631cd3150301583cef06122010623ee)

ghost1 commented 2026-06-05 10:10:02 +00:00 (Migrated from gitlab.com)

Copy link

changed the description

changed the description

ghost1 commented 2026-06-05 10:10:30 +00:00 (Migrated from gitlab.com)

Copy link

resolved all threads

resolved all threads

ghost1 commented 2026-06-05 10:10:30 +00:00 (Migrated from gitlab.com)

Copy link

resolved all threads

resolved all threads

PlasticDigits commented 2026-06-05 10:11:14 +00:00 (Migrated from gitlab.com)

Copy link

Security review

Commit reviewed: ff15bf4

Scope: scripts/qa/verify-issue-285.sh, make verify-issue-285, docs/indexer-invariants.md (L285 row), skills/AGENTS_INDEXER_LIFECYCLE_EMITTER_SCOPING.md.

Outcome: FINDINGS: 0 medium+ — no medium+ findings on this diff.

Summary

This MR adds local QA automation and documentation for GitLab #285 (limit-order lifecycle emitter scoping). It does not modify production indexer, API, contract, or frontend runtime code; the _contract_address-only parser behavior is already on main.

Review traced attacker-controlled inputs in the new bash harness:

Surface	Source	Sink	Assessment
LCD / indexer HTTP	Operator .env (LCD_URLS, API_PORT)	curl to LocalTerra / local indexer	Same dev-only pattern as other verify-issue-* scripts; not exposed to untrusted users in production
On-chain addresses	Factory LCD smart query (terra1…)	terrad_tx, GET …/pairs/{pair}/limit-fills	Values constrained to bech32 pair/token addresses from chain state; JSON built via jq --arg
Tx hash	terrad JSON output	LCD tx query	Hex hash from local broadcast; no shell interpolation beyond quoted vars

No injection, authz bypass, secret leakage, SSRF against production services, or unsafe deserialization paths were identified in added/modified code. Doc/skill changes are informational only.

Prior threads (non-security)

Bugbot notes on the earlier commit (cargo test filter false-PASS, live leg continuing after pair-resolution failure) are QA reliability issues in the harness, not production vulnerabilities; both are addressed in ff15bf4 (separate cargo test filters; swap broadcast gated inside successful pair-resolution branch).

Inline findings: none (0 threads).

## Security review **Commit reviewed:** [`ff15bf4`](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/commit/ff15bf4c7dc100a7aa7716c7e20ac702ab742a06) **Scope:** `scripts/qa/verify-issue-285.sh`, `make verify-issue-285`, `docs/indexer-invariants.md` (L285 row), `skills/AGENTS_INDEXER_LIFECYCLE_EMITTER_SCOPING.md`. **Outcome:** `FINDINGS: 0` medium+ — **no medium+ findings on this diff.** ### Summary This MR adds **local QA automation and documentation** for GitLab #285 (limit-order lifecycle emitter scoping). It does **not** modify production indexer, API, contract, or frontend runtime code; the `_contract_address`-only parser behavior is already on `main`. Review traced attacker-controlled inputs in the new bash harness: | Surface | Source | Sink | Assessment | |---------|--------|------|------------| | LCD / indexer HTTP | Operator `.env` (`LCD_URLS`, `API_PORT`) | `curl` to LocalTerra / local indexer | Same dev-only pattern as other `verify-issue-*` scripts; not exposed to untrusted users in production | | On-chain addresses | Factory LCD smart query (`terra1…`) | `terrad_tx`, `GET …/pairs/{pair}/limit-fills` | Values constrained to bech32 pair/token addresses from chain state; JSON built via `jq --arg` | | Tx hash | `terrad` JSON output | LCD tx query | Hex hash from local broadcast; no shell interpolation beyond quoted vars | No injection, authz bypass, secret leakage, SSRF against production services, or unsafe deserialization paths were identified in **added/modified** code. Doc/skill changes are informational only. ### Prior threads (non-security) Bugbot notes on the earlier commit (cargo test filter false-PASS, live leg continuing after pair-resolution failure) are **QA reliability** issues in the harness, not production vulnerabilities; both are addressed in `ff15bf4` (separate `cargo test` filters; swap broadcast gated inside successful pair-resolution branch). **Inline findings:** none (0 threads).

PlasticDigits commented 2026-06-05 10:13:00 +00:00 (Migrated from gitlab.com)

Copy link

Security review

Commit reviewed: ff15bf4

Scope: MR diff vs main — scripts/qa/verify-issue-285.sh, make verify-issue-285, docs/indexer-invariants.md (L285 row), skills/AGENTS_INDEXER_LIFECYCLE_EMITTER_SCOPING.md.

Outcome: FINDINGS: 0 medium+ — Security review: no medium+ findings on this diff.

Summary

This MR adds local QA automation and documentation for GitLab #285 (limit-order lifecycle emitter scoping). It does not modify production indexer, API, contract, or frontend runtime code; the _contract_address-only parser behavior is already on main.

Attacker-controlled inputs in the new bash harness were traced to sinks:

Surface	Source	Sink	Assessment
LCD / indexer HTTP	Operator indexer/.env (LCD_URLS, API_PORT)	curl to LocalTerra / local indexer	Dev-only QA pattern (same as other verify-issue-* scripts); not exposed to untrusted users in production
On-chain addresses	Factory LCD smart query (terra1…)	terrad_tx, GET …/pairs/{pair}/limit-fills	Values from chain state; JSON built via jq --arg / --argjson (no shell interpolation)
Tx hash	terrad JSON output	LCD tx query	Hex hash from local broadcast; quoted in URL

No injection, authn/authz bypass, secret leakage, SSRF against production services, or unsafe deserialization paths were identified in added/modified code. Doc/skill changes are informational only.

Prior threads

• Bugbot (cargo test filter false-PASS, live leg after pair-resolution failure): QA reliability, not production security; addressed in ff15bf4 (separate cargo test filters; swap broadcast gated inside successful pair-resolution branch).
• Prior security review on this MR: same scope and outcome; re-verified at current HEAD.

Inline findings: none (0 threads).

## Security review **Commit reviewed:** [`ff15bf4`](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/commit/ff15bf4c7dc100a7aa7716c7e20ac702ab742a06) **Scope:** MR diff vs `main` — `scripts/qa/verify-issue-285.sh`, `make verify-issue-285`, `docs/indexer-invariants.md` (L285 row), `skills/AGENTS_INDEXER_LIFECYCLE_EMITTER_SCOPING.md`. **Outcome:** `FINDINGS: 0` medium+ — **Security review: no medium+ findings on this diff.** ### Summary This MR adds **local QA automation and documentation** for GitLab #285 (limit-order lifecycle emitter scoping). It does **not** modify production indexer, API, contract, or frontend runtime code; the `_contract_address`-only parser behavior is already on `main`. Attacker-controlled inputs in the new bash harness were traced to sinks: | Surface | Source | Sink | Assessment | |---------|--------|------|------------| | LCD / indexer HTTP | Operator `indexer/.env` (`LCD_URLS`, `API_PORT`) | `curl` to LocalTerra / local indexer | Dev-only QA pattern (same as other `verify-issue-*` scripts); not exposed to untrusted users in production | | On-chain addresses | Factory LCD smart query (`terra1…`) | `terrad_tx`, `GET …/pairs/{pair}/limit-fills` | Values from chain state; JSON built via `jq --arg` / `--argjson` (no shell interpolation) | | Tx hash | `terrad` JSON output | LCD tx query | Hex hash from local broadcast; quoted in URL | No injection, authn/authz bypass, secret leakage, SSRF against production services, or unsafe deserialization paths were identified in **added/modified** code. Doc/skill changes are informational only. ### Prior threads - **Bugbot** (cargo test filter false-PASS, live leg after pair-resolution failure): **QA reliability**, not production security; addressed in `ff15bf4` (separate `cargo test` filters; swap broadcast gated inside successful pair-resolution branch). - **Prior security review** on this MR: same scope and outcome; re-verified at current HEAD. **Inline findings:** none (0 threads).

PlasticDigits commented 2026-06-05 10:53:20 +00:00 (Migrated from gitlab.com)

Copy link

resolved all threads

resolved all threads

ghost1 commented 2026-06-05 11:01:25 +00:00 (Migrated from gitlab.com)

Copy link

added 60 commits

• ff15bf4c...c0d8ad6c - 59 commits from branch main
• 0711f26b - Merge origin/main into cursor/gitlab-issue-verification-4494

Compare with previous version

added 60 commits <ul><li>ff15bf4c...c0d8ad6c - 59 commits from branch <code>main</code></li><li>0711f26b - Merge origin/main into cursor/gitlab-issue-verification-4494</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/69/diffs?diff_id=1836513166&start_sha=ff15bf4c7dc100a7aa7716c7e20ac702ab742a06)

ghost1 commented 2026-06-05 11:01:34 +00:00 (Migrated from gitlab.com)

Copy link

mentioned in commit 50f4417551

mentioned in commit 50f441755141564b0826ccc84dc802e5162bd731

ghost1 commented 2026-06-05 11:01:38 +00:00 (Migrated from gitlab.com)

Copy link

changed the description

changed the description

PlasticDigits commented 2026-06-05 11:01:51 +00:00 (Migrated from gitlab.com)

Copy link

changed the description

changed the description

PlasticDigits commented 2026-06-05 11:04:05 +00:00 (Migrated from gitlab.com)

Copy link

Security review

Commit reviewed: 0711f26 (merge origin/main into MR branch)

Scope: MR diff vs main (c0d8ad6): scripts/qa/verify-issue-285.sh, make verify-issue-285, docs/indexer-invariants.md (L285 row), skills/AGENTS_INDEXER_LIFECYCLE_EMITTER_SCOPING.md. Merge also carries whitespace-only churn in PoolPage.tsx / blacklist.ts (no logic change).

Outcome: FINDINGS: 0 medium+ — Security review: no medium+ findings on this diff.

Summary

This MR adds local QA automation and documentation for GitLab #285 (limit-order lifecycle emitter scoping). It does not modify production indexer, API, contract, or frontend runtime behavior; _contract_address-only scoping in parser.rs is already on main.

Attacker-controlled inputs in the new bash harness were traced to sinks:

Surface	Source	Sink	Assessment
LCD / indexer HTTP	Operator indexer/.env (LCD_URLS, API_PORT)	curl to LocalTerra / local indexer	Dev-only QA pattern (same as other verify-issue-* scripts); not exposed to untrusted users in production
On-chain addresses	Factory LCD smart query (terra1…)	terrad_tx, GET …/pairs/{pair}/limit-fills	Values from chain state; JSON via jq --arg / --argjson (no shell interpolation)
Tx hash	terrad JSON output	LCD tx query	Hex hash from local broadcast; quoted in URL

No injection, authn/authz bypass, secret leakage, SSRF against production services, or unsafe deserialization in added/modified code. Doc/skill changes are informational only.

Prior threads (re-checked at 0711f26)

• Bugbot (cargo test filter false-PASS, live swap after pair-resolution failure): QA reliability, not production security; addressed in ff15bf4 (separate cargo test filters; hybrid swap gated inside successful pair-resolution else at lines 176–252).
• Earlier security review on this MR: same scope; merge commit adds no new executable attack surface beyond prior HEAD.

Inline findings: none (0 threads).

## Security review **Commit reviewed:** [`0711f26`](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/commit/0711f26b51421aa71823d6d8da9ba54d53ac8606) (merge `origin/main` into MR branch) **Scope:** MR diff vs `main` (`c0d8ad6`): `scripts/qa/verify-issue-285.sh`, `make verify-issue-285`, `docs/indexer-invariants.md` (L285 row), `skills/AGENTS_INDEXER_LIFECYCLE_EMITTER_SCOPING.md`. Merge also carries whitespace-only churn in `PoolPage.tsx` / `blacklist.ts` (no logic change). **Outcome:** `FINDINGS: 0` medium+ — **Security review: no medium+ findings on this diff.** ### Summary This MR adds **local QA automation and documentation** for GitLab #285 (limit-order lifecycle emitter scoping). It does **not** modify production indexer, API, contract, or frontend runtime behavior; `_contract_address`-only scoping in `parser.rs` is already on `main`. Attacker-controlled inputs in the new bash harness were traced to sinks: | Surface | Source | Sink | Assessment | |---------|--------|------|------------| | LCD / indexer HTTP | Operator `indexer/.env` (`LCD_URLS`, `API_PORT`) | `curl` to LocalTerra / local indexer | Dev-only QA pattern (same as other `verify-issue-*` scripts); not exposed to untrusted users in production | | On-chain addresses | Factory LCD smart query (`terra1…`) | `terrad_tx`, `GET …/pairs/{pair}/limit-fills` | Values from chain state; JSON via `jq --arg` / `--argjson` (no shell interpolation) | | Tx hash | `terrad` JSON output | LCD tx query | Hex hash from local broadcast; quoted in URL | No injection, authn/authz bypass, secret leakage, SSRF against production services, or unsafe deserialization in **added/modified** code. Doc/skill changes are informational only. ### Prior threads (re-checked at `0711f26`) - **Bugbot** (cargo test filter false-PASS, live swap after pair-resolution failure): **QA reliability**, not production security; **addressed** in `ff15bf4` (separate `cargo test` filters; hybrid swap gated inside successful pair-resolution `else` at lines 176–252). - **Earlier security review** on this MR: same scope; merge commit adds no new executable attack surface beyond prior HEAD. **Inline findings:** none (0 threads).

ghost1 commented 2026-06-05 11:05:15 +00:00 (Migrated from gitlab.com)

Copy link

added 12 commits

• 0711f26b...c179fa92 - 11 commits from branch main
• fec1c254 - Merge origin/main into cursor/gitlab-issue-verification-4494

Compare with previous version

added 12 commits <ul><li>0711f26b...c179fa92 - 11 commits from branch <code>main</code></li><li>fec1c254 - Merge origin/main into cursor/gitlab-issue-verification-4494</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/69/diffs?diff_id=1836520272&start_sha=0711f26b51421aa71823d6d8da9ba54d53ac8606)

ghost1 commented 2026-06-05 11:05:21 +00:00 (Migrated from gitlab.com)

Copy link

changed the description

changed the description

ghost1 commented 2026-06-05 11:05:26 +00:00 (Migrated from gitlab.com)

Copy link

changed the description

changed the description

PlasticDigits commented 2026-06-05 11:06:28 +00:00 (Migrated from gitlab.com)

Copy link

Security review

Commit reviewed: fec1c254

Scope: MR diff vs main (c179fa9) — scripts/qa/verify-issue-285.sh, make verify-issue-285, docs/indexer-invariants.md (L285 row), skills/AGENTS_INDEXER_LIFECYCLE_EMITTER_SCOPING.md.

Outcome: FINDINGS: 0 medium+ — Security review: no medium+ findings on this diff.

Summary

This MR adds local QA automation and documentation for GitLab #285 (limit-order lifecycle emitter scoping). It does not modify production indexer, API, contract, or frontend runtime code; _contract_address-only scoping in parser.rs is already on main.

Attacker-controlled inputs in the new bash harness were traced to sinks:

Surface	Source	Sink	Assessment
LCD / indexer HTTP	Operator indexer/.env (LCD_URLS, API_PORT)	curl to LocalTerra / local indexer	Dev-only QA pattern (same as other verify-issue-* scripts); not exposed to untrusted users in production
On-chain addresses	Factory LCD smart query (terra1…)	terrad_tx, GET …/pairs/{pair}/limit-fills	Values from chain state; bech32-constrained; JSON via jq --arg / --argjson (no shell interpolation)
Tx hash	terrad JSON output	LCD tx query	Hex hash from local broadcast; quoted in URL
Hybrid swap msg	jq-built SEND_MSG	e2e_terrad_tx → docker exec terrad tx	Args passed as discrete argv to terrad; no eval

No injection, authn/authz bypass, secret leakage, SSRF against production services, or unsafe deserialization in added/modified code. Doc/skill changes are informational only.

Prior threads (re-checked at fec1c254)

• Bugbot (cargo test filter false-PASS, live swap after pair-resolution failure): QA reliability, not production security; addressed in ff15bf4 (separate cargo test filters at lines 47–48; hybrid swap gated inside successful pair-resolution else at lines 176–252).
• Earlier security reviews on this MR: same scope and outcome; merge commit fec1c254 adds no new executable attack surface beyond prior HEAD.

Inline findings: none (0 threads).

## Security review **Commit reviewed:** [`fec1c254`](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/commit/fec1c254a70950d87ce4388a353ff12581279050) **Scope:** MR diff vs `main` (`c179fa9`) — `scripts/qa/verify-issue-285.sh`, `make verify-issue-285`, `docs/indexer-invariants.md` (L285 row), `skills/AGENTS_INDEXER_LIFECYCLE_EMITTER_SCOPING.md`. **Outcome:** `FINDINGS: 0` medium+ — **Security review: no medium+ findings on this diff.** ### Summary This MR adds **local QA automation and documentation** for GitLab #285 (limit-order lifecycle emitter scoping). It does **not** modify production indexer, API, contract, or frontend runtime code; `_contract_address`-only scoping in `parser.rs` is already on `main`. Attacker-controlled inputs in the new bash harness were traced to sinks: | Surface | Source | Sink | Assessment | |---------|--------|------|------------| | LCD / indexer HTTP | Operator `indexer/.env` (`LCD_URLS`, `API_PORT`) | `curl` to LocalTerra / local indexer | Dev-only QA pattern (same as other `verify-issue-*` scripts); not exposed to untrusted users in production | | On-chain addresses | Factory LCD smart query (`terra1…`) | `terrad_tx`, `GET …/pairs/{pair}/limit-fills` | Values from chain state; bech32-constrained; JSON via `jq --arg` / `--argjson` (no shell interpolation) | | Tx hash | `terrad` JSON output | LCD tx query | Hex hash from local broadcast; quoted in URL | | Hybrid swap msg | `jq`-built `SEND_MSG` | `e2e_terrad_tx` → `docker exec terrad tx` | Args passed as discrete argv to `terrad`; no eval | No injection, authn/authz bypass, secret leakage, SSRF against production services, or unsafe deserialization in **added/modified** code. Doc/skill changes are informational only. ### Prior threads (re-checked at `fec1c254`) - **Bugbot** (cargo test filter false-PASS, live swap after pair-resolution failure): **QA reliability**, not production security; **addressed** in `ff15bf4` (separate `cargo test` filters at lines 47–48; hybrid swap gated inside successful pair-resolution `else` at lines 176–252). - **Earlier security reviews** on this MR: same scope and outcome; merge commit `fec1c254` adds no new executable attack surface beyond prior HEAD. **Inline findings:** none (0 threads).

PlasticDigits commented 2026-06-05 11:06:35 +00:00 (Migrated from gitlab.com)

Copy link

mentioned in commit 856f024255

mentioned in commit 856f024255f28757f1cc799c12449e765c8d509b

PlasticDigits (Migrated from gitlab.com) merged commit 856f024255 into main 2026-06-05 11:06:35 +00:00

ghost1 commented 2026-06-05 11:07:20 +00:00 (Migrated from gitlab.com)

Copy link

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is ON, but it could not run because the branch was deleted or merged before autofix could start.}

^{Reviewed by Cursor Bugbot for commit fec1c254a7. Configure here.}

<!-- BUGBOT_REVIEW --> Cursor Bugbot has reviewed your changes and found 1 potential issue. <!-- BUGBOT_FIX_ALL --> <a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9BTExfSU5fQ1VSU09SIiwiZGF0YSI6eyJyZWRpc0tleSI6ImJ1Z2JvdC1tdWx0aTowODZlNDY3OC01N2VkLTQyODktODI1ZS0wMTE1ZTRjZWZlMWMiLCJlbmNyeXB0aW9uS2V5Ijoia25LbTdfaVVMd3hMRklFc3Q4SFhhMG5EaUlEd21uWnFFdFh5SFViNDVVVSIsImJyYW5jaCI6ImN1cnNvci9naXRsYWItaXNzdWUtdmVyaWZpY2F0aW9uLTQ0OTQiLCJyZXBvT3duZXIiOiJQbGFzdGljRGlnaXRzIiwicmVwb05hbWUiOiJjbDh5LWRleC10ZXJyYWNsYXNzaWMifX0" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix All in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a> <!-- /BUGBOT_FIX_ALL --> <!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_BEGIN --> ^{Bugbot Autofix is ON, but it could not run because the branch was deleted or merged before autofix could start.} <!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_END --> ^{Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit fec1c254a70950d87ce4388a353ff12581279050. Configure [here](https://www.cursor.com/dashboard/bugbot).}

ghost1 commented 2026-06-05 11:07:21 +00:00 (Migrated from gitlab.com)

Copy link

LCD tx query lacks fallback

Medium Severity

The live leg loads factory pair data through lcd_smart_query_raw, which uses localterra_lcd_curl and the documented docker exec fallback when host LCD curls hang. query_tx_lcd uses plain curl against the same LCD base URL, so on those hosts the swap can succeed while tx lookup always times out and the harness reports a false failure.

 

^{Reviewed by Cursor Bugbot for commit fec1c254a7. Configure here.}

### LCD tx query lacks fallback **Medium Severity** <!-- DESCRIPTION START --> The live leg loads factory pair data through `lcd_smart_query_raw`, which uses `localterra_lcd_curl` and the documented docker exec fallback when host LCD curls hang. `query_tx_lcd` uses plain `curl` against the same `LCD` base URL, so on those hosts the swap can succeed while tx lookup always times out and the harness reports a false failure. <!-- DESCRIPTION END --> <!-- BUGBOT_BUG_ID: 4576793b-21c7-4a90-a11b-d43b08c4077f --> <!-- LOCATIONS START scripts/qa/verify-issue-285.sh#L94-L110 LOCATIONS END --> <div><a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9DVVJTT1IiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OjM1ODY0NTYwLWY1MjEtNDkxZC04MDM0LTdlODNjMjFlNGQ5MCIsImVuY3J5cHRpb25LZXkiOiJyUWtZUF8yenRhNDg1bjhkY09SUXRiTHl3VnJhRkF1Mzlrdzl5UUhBZkpJIiwiYnJhbmNoIjoiY3Vyc29yL2dpdGxhYi1pc3N1ZS12ZXJpZmljYXRpb24tNDQ5NCIsInJlcG9Pd25lciI6IlBsYXN0aWNEaWdpdHMiLCJyZXBvTmFtZSI6ImNsOHktZGV4LXRlcnJhY2xhc3NpYyJ9fQ" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a>&nbsp;<a href="https://cursor.com/agents?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9XRUIiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OjM1ODY0NTYwLWY1MjEtNDkxZC04MDM0LTdlODNjMjFlNGQ5MCIsImVuY3J5cHRpb25LZXkiOiJyUWtZUF8yenRhNDg1bjhkY09SUXRiTHl3VnJhRkF1Mzlrdzl5UUhBZkpJIiwiYnJhbmNoIjoiY3Vyc29yL2dpdGxhYi1pc3N1ZS12ZXJpZmljYXRpb24tNDQ5NCIsInJlcG9Pd25lciI6IlBsYXN0aWNEaWdpdHMiLCJyZXBvTmFtZSI6ImNsOHktZGV4LXRlcnJhY2xhc3NpYyIsInByTnVtYmVyIjo2OSwiY29tbWl0U2hhIjoiZmVjMWMyNTRhNzA5NTBkODdjZTQzODhhMzUzZmYxMjU4MTI3OTA1MCIsInByb3ZpZGVyIjoiZ2l0bGFiIiwiaG9zdG5hbWUiOiJnaXRsYWIuY29tIn19" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-web-light.png"><img alt="Fix in Web" width="99" height="28" src="https://cursor.com/assets/images/fix-in-web-dark.png"></picture></a></div> ^{Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit fec1c254a70950d87ce4388a353ff12581279050. Configure [here](https://www.cursor.com/dashboard/bugbot).}

PlasticDigits commented 2026-06-05 11:23:19 +00:00 (Migrated from gitlab.com)

Copy link

mentioned in merge request !799

mentioned in merge request !799

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

agent:fix_bugfix

  

agent:fix_conflicts

  

agent:fix_security

  

agent:gap_analysis

  

agent:implement

  

agent:implement

Queue implement gate

  

agent:implement

Queue implement gate

  

agent:open_issues

  

agent:ready

  

agent:research

  

agent:security_audit

  

agent:verify

  

architecture

Architecture

  

backend

API and services

  

blocker:hybrid

Blocks hybrid launch

  

blocker:launch

Blocks launch

  

blocker:limit-orders

Blocks limits launch

  

blocker:v2

Blocks v2

  

block:log_only

  

block:security

  

bug

  

ci

  

contracts

Smart contracts

  

correctness

  

deploy

  

dev

  

devops

  

docs

  

documentation

  

duplicate

  

e2e

  

enhancement

  

epic

Epic

  

feature

  

frontend

  

functional-completion

Functional

  

gas

  

good first issue

  

governance

  

help wanted

  

high-risk

  

hooks

  

hybrid

Hybrid swaps

  

indexer

Indexer

  

infra

CI/CD

  

infrastructure

  

integrators

  

invalid

  

launch-blocker

  

limit-orders

Limit orders

  

localnet

  

localterra

  

low priority

  

missing-implementation

Implementation

  

needs-design

Design decision required

  

ops

  

performance

  

priority

high

  

priority

medium

  

product

  

qa

  

QA

  

question

  

ready

Definition of Ready

  

ready

Definition of Ready

  

research

  

scripts

  

security

Security

  

security-hardening

Security hardening

  

smartcontracts

  

tech-debt

  

testing

Testing

  

ux

  

UX

  

v2

Pool-only swaps

  

verification

  

wontfix

No labels

agent:fix_bugfix

agent:fix_conflicts

agent:fix_security

agent:gap_analysis

agent:implement

agent:implement

agent:implement

agent:open_issues

agent:ready

agent:research

agent:security_audit

agent:verify

architecture

backend

blocker:hybrid

blocker:launch

blocker:limit-orders

blocker:v2

block:log_only

block:security

bug

ci

contracts

correctness

deploy

dev

devops

docs

documentation

duplicate

e2e

enhancement

epic

feature

frontend

functional-completion

gas

good first issue

governance

help wanted

high-risk

hooks

hybrid

indexer

infra

infrastructure

integrators

invalid

launch-blocker

limit-orders

localnet

localterra

low priority

missing-implementation

needs-design

ops

performance

priority

high

priority

medium

product

qa

QA

question

ready

ready

research

scripts

security

security-hardening

smartcontracts

tech-debt

testing

ux

UX

v2

verification

wontfix

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

code/cl8y-dex-terraclassic!787

No description provided.