feat(indexer): Phase 1c DB hybrid route solver (#319) #798

Merged
PlasticDigits merged 11 commits from cursor/gitlab-issue-workflow-cf12 into main 2026-06-05 13:19:37 +00:00
PlasticDigits commented 2026-06-05 11:19:59 +00:00 (Migrated from gitlab.com)

Implements https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/work_items/319 — db_orderbook_sim, global_v2 DB hybrid solver (ROUTE_SOLVER_DB_HYBRID), router fidelity guard, new quote_kind values. Production enable still requires a healthy #322 book snapshot loop before setting ROUTE_SOLVER_DB_HYBRID=1.

Related to #319 (Phase 1c code complete in this MR; full issue closure blocked on #322 ops + manual localnet drift smoke per issue verification).

Merge with main checklist

Item Command Result
Merge origin/main conflict-free git merge origin/main on cursor/gitlab-issue-workflow-cf12 PASS (0dd9291)
Docs: global_v2 (#319) + #306 cache tests + max 4 hops (#323) docs/indexer-invariants.md route rows PASS
LCD mock: #306 tier-aware + Phase 1c router-only mock indexer/tests/common/lcd_mock.rs compiles PASS
Indexer compiles post-merge cd indexer && cargo check PASS
Indexer lib tests cd indexer && cargo test --lib PASS (118)
Frontend unit tests make test-frontend PASS (851)

Note

High Risk
Changes how retail route quotes are computed and capped; incorrect or stale mirror data could mislead traders until fidelity downgrade or LCD fallback kicks in, and enabling v2 in prod without snapshot health is explicitly unsafe.

Overview
Introduces global_v2 global best execution when ROUTE_SOLVER_DB_HYBRID=1: the per-hop hybrid split grid is priced from indexed pair_reserves + resting_limit_orders via new db_orderbook_sim, with LCD fallback only when a mirror is missing or stale. global_v1 (LCD HybridSimulation per grid point) remains the default.

The solver still picks among top paths using router simulate_swap_operations on the winning route when configured, but global_v2 adds a fidelity_check that compares mirror grid output to router sim (ROUTE_FIDELITY_DRIFT_BPS, default 100 bps) and can downgrade quote_kind and clamp estimated_amount_out on drift. Responses gain solver_version, db_hybrid_queries, fidelity_check, and indexer_*_db quote kinds; route cache keys now include solver_version and resolved discount_bps (optional on-chain GetDiscount when FEE_DISCOUNT_ADDRESS is set).

The dApp types and swap disclosure copy are updated for the new fields and quote kinds. Integration tests assert v2 avoids pair-level LCD hybrid calls and that fidelity drift degrades quotes. Docs/skills describe v2 and note production v2 depends on a healthy #322 book snapshot loop.

Reviewed by Cursor Bugbot for commit 9606010571. Bugbot is set up for automated code reviews on this repo. Configure here.

Implements https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/work_items/319 — `db_orderbook_sim`, `global_v2` DB hybrid solver (`ROUTE_SOLVER_DB_HYBRID`), router fidelity guard, new `quote_kind` values. **Production enable** still requires a healthy **#322** book snapshot loop before setting `ROUTE_SOLVER_DB_HYBRID=1`. Related to #319 (Phase 1c code complete in this MR; full issue closure blocked on #322 ops + manual localnet drift smoke per issue verification). ## Merge with main checklist | Item | Command | Result | |------|---------|--------| | Merge `origin/main` conflict-free | `git merge origin/main` on `cursor/gitlab-issue-workflow-cf12` | PASS (`0dd9291`) | | Docs: `global_v2` (#319) + #306 cache tests + max 4 hops (#323) | `docs/indexer-invariants.md` route rows | PASS | | LCD mock: #306 tier-aware + Phase 1c router-only mock | `indexer/tests/common/lcd_mock.rs` compiles | PASS | | Indexer compiles post-merge | `cd indexer && cargo check` | PASS | | Indexer lib tests | `cd indexer && cargo test --lib` | PASS (118) | | Frontend unit tests | `make test-frontend` | PASS (851) | <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **High Risk** > Changes how retail route quotes are computed and capped; incorrect or stale mirror data could mislead traders until fidelity downgrade or LCD fallback kicks in, and enabling v2 in prod without snapshot health is explicitly unsafe. > > **Overview** > Introduces **`global_v2`** global best execution when **`ROUTE_SOLVER_DB_HYBRID=1`**: the per-hop hybrid split grid is priced from indexed **`pair_reserves`** + **`resting_limit_orders`** via new **`db_orderbook_sim`**, with **LCD fallback** only when a mirror is missing or stale. **`global_v1`** (LCD `HybridSimulation` per grid point) remains the default. > > The solver still picks among top paths using router **`simulate_swap_operations`** on the winning route when configured, but **`global_v2`** adds a **`fidelity_check`** that compares mirror grid output to router sim (**`ROUTE_FIDELITY_DRIFT_BPS`**, default 100 bps) and can downgrade **`quote_kind`** and clamp **`estimated_amount_out`** on drift. Responses gain **`solver_version`**, **`db_hybrid_queries`**, **`fidelity_check`**, and **`indexer_*_db`** quote kinds; route cache keys now include **`solver_version`** and resolved **`discount_bps`** (optional on-chain **`GetDiscount`** when **`FEE_DISCOUNT_ADDRESS`** is set). > > The dApp types and swap disclosure copy are updated for the new fields and quote kinds. Integration tests assert v2 avoids pair-level LCD hybrid calls and that fidelity drift degrades quotes. Docs/skills describe v2 and note production v2 depends on a healthy **#322** book snapshot loop. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 9606010571e4952b289870abb1b84d0b5ee57504. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY -->
ghost1 commented 2026-06-05 11:20:08 +00:00 (Migrated from gitlab.com)

changed the description

changed the description
PlasticDigits commented 2026-06-05 11:20:08 +00:00 (Migrated from gitlab.com)

mentioned in issue #319

mentioned in issue #319
ghost1 commented 2026-06-05 11:20:18 +00:00 (Migrated from gitlab.com)

changed the description

changed the description
ghost1 commented 2026-06-05 11:22:00 +00:00 (Migrated from gitlab.com)
Stale Security Review comment
Stale Security Review comment
Stale Security Review comment
Stale Security Review comment
Stale Security Review comment
Stale Security Review comment
Stale Security Review comment

Cursor Bugbot has reviewed your changes and found 2 potential issues.
Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issues.

Reviewed by Cursor Bugbot for commit 233eb6be64. Configure here.

<details> <summary>Stale Security Review comment</summary> <details> <summary>Stale Security Review comment</summary> <details> <summary>Stale Security Review comment</summary> <details> <summary>Stale Security Review comment</summary> <details> <summary>Stale Security Review comment</summary> <details> <summary>Stale Security Review comment</summary> <details> <summary>Stale Security Review comment</summary> <!-- BUGBOT_REVIEW --> Cursor Bugbot has reviewed your changes and found 2 potential issues.<!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_BEGIN --> <sup>Bugbot Autofix is [ON](https://www.cursor.com/dashboard/bugbot). A cloud agent has been kicked off to fix the reported issues. <!-- BUGBOT_AUTOFIX_AGENT_LINK --></sup> <!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_END --> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 233eb6be646ea4ab610a0744730815ce875f54ff. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> </details> </details> </details> </details> </details> </details> </details>
ghost1 commented 2026-06-05 11:22:02 +00:00 (Migrated from gitlab.com)

Db propagate errors skip LCD fallback

Medium Severity

In propagate_offer_through_plan, HybridSimError::Lcd triggers pool-only LCD fallback, but HybridSimError::Db aborts the whole solve. In global_v2, a mirror DbSimError on an already-chosen hybrid leg (e.g. InsufficientLiquidity or InvalidNumeric) can return 502 instead of degrading like the LCD path.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 233eb6be64. Configure here.

### Db propagate errors skip LCD fallback **Medium Severity** <!-- DESCRIPTION START --> In `propagate_offer_through_plan`, `HybridSimError::Lcd` triggers pool-only LCD fallback, but `HybridSimError::Db` aborts the whole solve. In `global_v2`, a mirror `DbSimError` on an already-chosen hybrid leg (e.g. `InsufficientLiquidity` or `InvalidNumeric`) can return **502** instead of degrading like the LCD path. <!-- DESCRIPTION END --> <!-- BUGBOT_BUG_ID: fec808f5-9f2d-4c85-b8c0-58d3fffed3c5 --> <!-- LOCATIONS START indexer/src/api/hybrid_route_opt.rs#L495-L507 LOCATIONS END --> <div><a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9DVVJTT1IiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OjdhNTQyZDhiLWJjNGUtNDM2NC05ZjBkLWRjZmEwYzgyNGJiYiIsImVuY3J5cHRpb25LZXkiOiIzcmp4ZGVCa25iV1lIeEpSR1Q0ei0wcUdpd2lYZ3FIYlMybGlvNFBPakNJIiwiYnJhbmNoIjoiY3Vyc29yL2dpdGxhYi1pc3N1ZS13b3JrZmxvdy1jZjEyIiwicmVwb093bmVyIjoiUGxhc3RpY0RpZ2l0cyIsInJlcG9OYW1lIjoiY2w4eS1kZXgtdGVycmFjbGFzc2ljIn19" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a>&nbsp;<a href="https://cursor.com/agents?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9XRUIiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OjdhNTQyZDhiLWJjNGUtNDM2NC05ZjBkLWRjZmEwYzgyNGJiYiIsImVuY3J5cHRpb25LZXkiOiIzcmp4ZGVCa25iV1lIeEpSR1Q0ei0wcUdpd2lYZ3FIYlMybGlvNFBPakNJIiwiYnJhbmNoIjoiY3Vyc29yL2dpdGxhYi1pc3N1ZS13b3JrZmxvdy1jZjEyIiwicmVwb093bmVyIjoiUGxhc3RpY0RpZ2l0cyIsInJlcG9OYW1lIjoiY2w4eS1kZXgtdGVycmFjbGFzc2ljIiwicHJOdW1iZXIiOjgwLCJjb21taXRTaGEiOiIyMzNlYjZiZTY0NmVhNGFiNjEwYTA3NDQ3MzA4MTVjZTg3NWY1NGZmIiwicHJvdmlkZXIiOiJnaXRsYWIiLCJob3N0bmFtZSI6ImdpdGxhYi5jb20ifX0" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-web-light.png"><img alt="Fix in Web" width="99" height="28" src="https://cursor.com/assets/images/fix-in-web-dark.png"></picture></a></div> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 233eb6be646ea4ab610a0744730815ce875f54ff. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>
ghost1 commented 2026-06-05 11:22:02 +00:00 (Migrated from gitlab.com)

Unknown tier zero waives fees

High Severity

global_v2 maps resolve_discount_tier’s sentinel 0 (no trader/sender, or wallet absent from traders) through tier_discount_bps(0) as governance tier 0 (100% discount_bps), so effective_fee_bps becomes zero. Pair HybridSimulation and router sim use full fee_bps when trader is omitted or unregistered, so mirror grid quotes and splits are systematically too optimistic unless fidelity drift catches them.

Additional Locations (1)
Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 233eb6be64. Configure here.

### Unknown tier zero waives fees **High Severity** <!-- DESCRIPTION START --> `global_v2` maps `resolve_discount_tier`’s sentinel `0` (no `trader`/`sender`, or wallet absent from `traders`) through `tier_discount_bps(0)` as governance tier 0 (100% `discount_bps`), so `effective_fee_bps` becomes zero. Pair `HybridSimulation` and router sim use full `fee_bps` when `trader` is omitted or unregistered, so mirror grid quotes and splits are systematically too optimistic unless fidelity drift catches them. <!-- DESCRIPTION END --> <!-- BUGBOT_BUG_ID: 19a55e4e-f9f8-4b15-aa17-0ee5920ece07 --> <!-- LOCATIONS START indexer/src/api/db_orderbook_sim.rs#L20-L43 indexer/src/api/route_solver.rs#L560-L573 LOCATIONS END --> <details> <summary>Additional Locations (1)</summary> - [`indexer/src/api/route_solver.rs#L560-L573`](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-//blob/233eb6be646ea4ab610a0744730815ce875f54ff/indexer/src/api/route_solver.rs#L560-L573) </details> <div><a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9DVVJTT1IiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OmVkNzRkMTY2LTJiZjgtNGI3Zi04ODliLWFiOGJlMzRhNTU1MyIsImVuY3J5cHRpb25LZXkiOiJYeW85VkxmT1djcHJEX3FUYVNBamZrRkF6M1JsR21LX3lmSW5uMFBHbDRBIiwiYnJhbmNoIjoiY3Vyc29yL2dpdGxhYi1pc3N1ZS13b3JrZmxvdy1jZjEyIiwicmVwb093bmVyIjoiUGxhc3RpY0RpZ2l0cyIsInJlcG9OYW1lIjoiY2w4eS1kZXgtdGVycmFjbGFzc2ljIn19" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a>&nbsp;<a href="https://cursor.com/agents?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9XRUIiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OmVkNzRkMTY2LTJiZjgtNGI3Zi04ODliLWFiOGJlMzRhNTU1MyIsImVuY3J5cHRpb25LZXkiOiJYeW85VkxmT1djcHJEX3FUYVNBamZrRkF6M1JsR21LX3lmSW5uMFBHbDRBIiwiYnJhbmNoIjoiY3Vyc29yL2dpdGxhYi1pc3N1ZS13b3JrZmxvdy1jZjEyIiwicmVwb093bmVyIjoiUGxhc3RpY0RpZ2l0cyIsInJlcG9OYW1lIjoiY2w4eS1kZXgtdGVycmFjbGFzc2ljIiwicHJOdW1iZXIiOjgwLCJjb21taXRTaGEiOiIyMzNlYjZiZTY0NmVhNGFiNjEwYTA3NDQ3MzA4MTVjZTg3NWY1NGZmIiwicHJvdmlkZXIiOiJnaXRsYWIiLCJob3N0bmFtZSI6ImdpdGxhYi5jb20ifX0" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-web-light.png"><img alt="Fix in Web" width="99" height="28" src="https://cursor.com/assets/images/fix-in-web-dark.png"></picture></a></div> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 233eb6be646ea4ab610a0744730815ce875f54ff. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>
PlasticDigits commented 2026-06-05 11:22:17 +00:00 (Migrated from gitlab.com)

Security review (automated)

Commit reviewed: 233eb6be646ea4ab610a0744730815ce875f54ff
Scope: Phase 1c DB hybrid route solver — db_orderbook_sim, global_v2 / ROUTE_SOLVER_DB_HYBRID, fidelity guard (ROUTE_FIDELITY_DRIFT_BPS), route cache/solver metadata, frontend disclosure types, integration tests.

Outcome: FINDINGS: 0 medium+ (no inline threads).

Areas reviewed

Area Result
SQL injection Mirror reads use bound parameters (pair_id, side); get_pair_resting_book only interpolates fixed ASC/DESC for a hard-coded side literal.
Authn/authz No new endpoints; route solve remains public read with existing LCD-heavy + global rate limits (H7).
Quote integrity / poisoned mirror Grid pricing can use Postgres mirror, but path pick uses router simulate_swap_operations output; apply_fidelity_guard clamps when mirror grid exceeds router sim beyond drift bps and downgrades quote_kind. Integration test covers drift path.
Trader/tier spoofing trader/sender still optional query params (pre-#245); DB tier for mirror sim is keyed in cache (#283) and aligned with LCD/router via same subject — stale indexer tier inflation is mitigated by fidelity vs on-chain router sim.
Error disclosure (H6) DB sim failures map to generic 502 body; no LCD paths/URLs in client response.
XSS Frontend changes are static disclosure strings keyed on quote_kind enum only.
Cache poisoning Hybrid cache key includes solver_version (global_v1 vs global_v2) plus existing tier/trader bucket fields.

Notes (informational, below reporting threshold)

  • Enabling ROUTE_SOLVER_DB_HYBRID before the #322 snapshot loop is an operational readiness concern (stale/missing mirror → LCD fallback), not a direct unauthenticated exploit on this diff.
  • Reduced per-request LCD fanout in v2 mode lowers H7 amplification vs global_v1; bounded in-memory grid work after mirror preload.

Prior MR security threads: none to re-report.


Automated security review — Cursor Cloud Agent

## Security review (automated) **Commit reviewed:** `233eb6be646ea4ab610a0744730815ce875f54ff` **Scope:** Phase 1c DB hybrid route solver — `db_orderbook_sim`, `global_v2` / `ROUTE_SOLVER_DB_HYBRID`, fidelity guard (`ROUTE_FIDELITY_DRIFT_BPS`), route cache/solver metadata, frontend disclosure types, integration tests. **Outcome:** `FINDINGS: 0` medium+ (no inline threads). ### Areas reviewed | Area | Result | |------|--------| | **SQL injection** | Mirror reads use bound parameters (`pair_id`, `side`); `get_pair_resting_book` only interpolates fixed `ASC`/`DESC` for a hard-coded side literal. | | **Authn/authz** | No new endpoints; route solve remains public read with existing LCD-heavy + global rate limits (H7). | | **Quote integrity / poisoned mirror** | Grid pricing can use Postgres mirror, but path pick uses router `simulate_swap_operations` output; `apply_fidelity_guard` clamps when mirror grid exceeds router sim beyond drift bps and downgrades `quote_kind`. Integration test covers drift path. | | **Trader/tier spoofing** | `trader`/`sender` still optional query params (pre-#245); DB tier for mirror sim is keyed in cache (#283) and aligned with LCD/router via same subject — stale indexer tier inflation is mitigated by fidelity vs on-chain router sim. | | **Error disclosure (H6)** | DB sim failures map to generic 502 body; no LCD paths/URLs in client response. | | **XSS** | Frontend changes are static disclosure strings keyed on `quote_kind` enum only. | | **Cache poisoning** | Hybrid cache key includes `solver_version` (`global_v1` vs `global_v2`) plus existing tier/trader bucket fields. | ### Notes (informational, below reporting threshold) - Enabling `ROUTE_SOLVER_DB_HYBRID` before the #322 snapshot loop is an **operational** readiness concern (stale/missing mirror → LCD fallback), not a direct unauthenticated exploit on this diff. - Reduced per-request LCD fanout in v2 mode lowers H7 amplification vs `global_v1`; bounded in-memory grid work after mirror preload. **Prior MR security threads:** none to re-report. --- *Automated security review — Cursor Cloud Agent*
ghost1 commented 2026-06-05 11:24:54 +00:00 (Migrated from gitlab.com)

changed this line in version 2 of the diff

changed this line in [version 2 of the diff](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/80/diffs?diff_id=1836555384&start_sha=233eb6be646ea4ab610a0744730815ce875f54ff#458bf9f4877054ce5f2582fcfc19a7b5d7d3346f_507_497)
ghost1 commented 2026-06-05 11:25:01 +00:00 (Migrated from gitlab.com)

added 1 commit

  • 616c44c6 - Fix full-fee sentinel and DB propagate fallback in hybrid route solver

Compare with previous version

added 1 commit <ul><li>616c44c6 - Fix full-fee sentinel and DB propagate fallback in hybrid route solver</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/80/diffs?diff_id=1836555384&start_sha=233eb6be646ea4ab610a0744730815ce875f54ff)
ghost1 commented 2026-06-05 11:25:14 +00:00 (Migrated from gitlab.com)

changed the description

changed the description
ghost1 commented 2026-06-05 11:25:56 +00:00 (Migrated from gitlab.com)

resolved all threads

resolved all threads
ghost1 commented 2026-06-05 11:25:56 +00:00 (Migrated from gitlab.com)

resolved all threads

resolved all threads
ghost1 commented 2026-06-05 11:26:40 +00:00 (Migrated from gitlab.com)
Stale Security Review comment
Stale Security Review comment
Stale Security Review comment
Stale Security Review comment
Stale Security Review comment
Stale Security Review comment

Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.

Reviewed by Cursor Bugbot for commit 616c44c6e9. Configure here.

<details> <summary>Stale Security Review comment</summary> <details> <summary>Stale Security Review comment</summary> <details> <summary>Stale Security Review comment</summary> <details> <summary>Stale Security Review comment</summary> <details> <summary>Stale Security Review comment</summary> <details> <summary>Stale Security Review comment</summary> <!-- BUGBOT_REVIEW --> Cursor Bugbot has reviewed your changes and found 1 potential issue.<!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_BEGIN --> <sup>Bugbot Autofix is [ON](https://www.cursor.com/dashboard/bugbot). A cloud agent has been kicked off to fix the reported issue. <!-- BUGBOT_AUTOFIX_AGENT_LINK --></sup> <!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_END --> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 616c44c6e92cf973d5c1993ce80cdf54b8e3a0de. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> </details> </details> </details> </details> </details> </details>
ghost1 commented 2026-06-05 11:26:41 +00:00 (Migrated from gitlab.com)

Mirror fallback ignored in quote

Medium Severity

In global_v2, stale or missing Postgres mirrors trigger per-hop LCD HybridSimulation during grid search, but quote_kind_for never treats that as degradation. Responses can still show indexer_hybrid_db / indexer_pool_db even when optimization used LCD, contradicting IndexerHybridDbDegraded and frontend mirror/LCD disclosure.

Additional Locations (2)
Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 616c44c6e9. Configure here.

### Mirror fallback ignored in quote **Medium Severity** <!-- DESCRIPTION START --> In `global_v2`, stale or missing Postgres mirrors trigger per-hop LCD `HybridSimulation` during grid search, but `quote_kind_for` never treats that as degradation. Responses can still show `indexer_hybrid_db` / `indexer_pool_db` even when optimization used LCD, contradicting `IndexerHybridDbDegraded` and frontend mirror/LCD disclosure. <!-- DESCRIPTION END --> <!-- BUGBOT_BUG_ID: c1e7e2b9-3762-425c-aa16-eea78623cc6e --> <!-- LOCATIONS START indexer/src/api/best_execution.rs#L156-L176 indexer/src/api/best_execution.rs#L327-L342 indexer/src/api/best_execution.rs#L392-L402 LOCATIONS END --> <details> <summary>Additional Locations (2)</summary> - [`indexer/src/api/best_execution.rs#L327-L342`](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-//blob/616c44c6e92cf973d5c1993ce80cdf54b8e3a0de/indexer/src/api/best_execution.rs#L327-L342) - [`indexer/src/api/best_execution.rs#L392-L402`](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-//blob/616c44c6e92cf973d5c1993ce80cdf54b8e3a0de/indexer/src/api/best_execution.rs#L392-L402) </details> <div><a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9DVVJTT1IiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OmMzMWZjYTQ5LWVmZGItNGZhNi05ZDY3LTU4NTcxNTVjMGY4ZSIsImVuY3J5cHRpb25LZXkiOiI0NjFUbUFTenFPSHRqaS1oOWNqVlVuUnBRNVpIZEZzZV90c2Fybm5IRjBVIiwiYnJhbmNoIjoiY3Vyc29yL2dpdGxhYi1pc3N1ZS13b3JrZmxvdy1jZjEyIiwicmVwb093bmVyIjoiUGxhc3RpY0RpZ2l0cyIsInJlcG9OYW1lIjoiY2w4eS1kZXgtdGVycmFjbGFzc2ljIn19" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a>&nbsp;<a href="https://cursor.com/agents?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9XRUIiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OmMzMWZjYTQ5LWVmZGItNGZhNi05ZDY3LTU4NTcxNTVjMGY4ZSIsImVuY3J5cHRpb25LZXkiOiI0NjFUbUFTenFPSHRqaS1oOWNqVlVuUnBRNVpIZEZzZV90c2Fybm5IRjBVIiwiYnJhbmNoIjoiY3Vyc29yL2dpdGxhYi1pc3N1ZS13b3JrZmxvdy1jZjEyIiwicmVwb093bmVyIjoiUGxhc3RpY0RpZ2l0cyIsInJlcG9OYW1lIjoiY2w4eS1kZXgtdGVycmFjbGFzc2ljIiwicHJOdW1iZXIiOjgwLCJjb21taXRTaGEiOiI2MTZjNDRjNmU5MmNmOTczZDVjMTk5M2NlODBjZGY1NGI4ZTNhMGRlIiwicHJvdmlkZXIiOiJnaXRsYWIiLCJob3N0bmFtZSI6ImdpdGxhYi5jb20ifX0" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-web-light.png"><img alt="Fix in Web" width="99" height="28" src="https://cursor.com/assets/images/fix-in-web-dark.png"></picture></a></div> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 616c44c6e92cf973d5c1993ce80cdf54b8e3a0de. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>
PlasticDigits commented 2026-06-05 11:37:08 +00:00 (Migrated from gitlab.com)

Security review (automated)

Commit reviewed: 616c44c6e92cf973d5c1993ce80cdf54b8e3a0de
Scope: Phase 1c DB hybrid route solver (db_orderbook_sim, global_v2 / ROUTE_SOLVER_DB_HYBRID, fidelity guard, route cache/solver metadata, frontend disclosure, integration tests). Re-reviewed prior Bugbot threads on fee-tier sentinel and DB propagate fallback (addressed in this commit).

Outcome: FINDINGS: 0 medium+ (no inline threads).

Areas reviewed

Area Result
SQL injection Mirror reads use bound parameters (pair_id, side); get_pair_resting_book only interpolates fixed ASC/DESC for hard-coded "bid"/"ask" literals.
Authn/authz No new endpoints; route solve remains public read with existing LCD-heavy + global rate limits (H7).
Quote integrity / poisoned mirror Winning path is selected on router simulate_swap_operations output; apply_fidelity_guard clamps when mirror grid exceeds router sim beyond ROUTE_FIDELITY_DRIFT_BPS and downgrades quote_kind. Integration test covers drift.
Trader/tier spoofing Optional trader/sender params unchanged (#245); unknown subjects now use FULL_FEE_TIER_SENTINEL (-1) for mirror fee math (fixes prior 100%-discount mirror mispricing). Router sim remains authoritative for estimated_amount_out.
Error disclosure (H6) HybridSimError::Db maps to generic 502; no LCD paths/URLs in client body.
XSS Frontend disclosure is static copy keyed on quote_kind enum only.
Cache poisoning Hybrid cache key includes solver_version (global_v1 vs global_v2) plus existing tier/trader bucket fields.
Availability propagate_offer_through_plan now falls back to pool-only on HybridSimError::Db (parity with LCD path).

Notes (informational, below reporting threshold)

  • quote_kind does not yet reflect mirror-stale/missing LCD fallback during grid search (Bugbot disclosure thread); estimated_amount_out still comes from router sim and hybrid_notes expose lcd/db query counts — not a standalone unauthenticated exploit path on this diff.
  • Enabling ROUTE_SOLVER_DB_HYBRID before the #322 snapshot loop is an operational readiness concern, not a direct external auth bypass.
## Security review (automated) **Commit reviewed:** `616c44c6e92cf973d5c1993ce80cdf54b8e3a0de` **Scope:** Phase 1c DB hybrid route solver (`db_orderbook_sim`, `global_v2` / `ROUTE_SOLVER_DB_HYBRID`, fidelity guard, route cache/solver metadata, frontend disclosure, integration tests). Re-reviewed prior Bugbot threads on fee-tier sentinel and DB propagate fallback (addressed in this commit). **Outcome:** `FINDINGS: 0` medium+ (no inline threads). ### Areas reviewed | Area | Result | |------|--------| | **SQL injection** | Mirror reads use bound parameters (`pair_id`, `side`); `get_pair_resting_book` only interpolates fixed `ASC`/`DESC` for hard-coded `"bid"`/`"ask"` literals. | | **Authn/authz** | No new endpoints; route solve remains public read with existing LCD-heavy + global rate limits (H7). | | **Quote integrity / poisoned mirror** | Winning path is selected on router `simulate_swap_operations` output; `apply_fidelity_guard` clamps when mirror grid exceeds router sim beyond `ROUTE_FIDELITY_DRIFT_BPS` and downgrades `quote_kind`. Integration test covers drift. | | **Trader/tier spoofing** | Optional `trader`/`sender` params unchanged (#245); unknown subjects now use `FULL_FEE_TIER_SENTINEL` (-1) for mirror fee math (fixes prior 100%-discount mirror mispricing). Router sim remains authoritative for `estimated_amount_out`. | | **Error disclosure (H6)** | `HybridSimError::Db` maps to generic 502; no LCD paths/URLs in client body. | | **XSS** | Frontend disclosure is static copy keyed on `quote_kind` enum only. | | **Cache poisoning** | Hybrid cache key includes `solver_version` (`global_v1` vs `global_v2`) plus existing tier/trader bucket fields. | | **Availability** | `propagate_offer_through_plan` now falls back to pool-only on `HybridSimError::Db` (parity with LCD path). | ### Notes (informational, below reporting threshold) - `quote_kind` does not yet reflect mirror-stale/missing LCD fallback during grid search (Bugbot disclosure thread); `estimated_amount_out` still comes from router sim and `hybrid_notes` expose lcd/db query counts — not a standalone unauthenticated exploit path on this diff. - Enabling `ROUTE_SOLVER_DB_HYBRID` before the #322 snapshot loop is an **operational** readiness concern, not a direct external auth bypass.
ghost1 commented 2026-06-05 11:39:10 +00:00 (Migrated from gitlab.com)

added 1 commit

  • 0e6b0c12 - fix(indexer): treat mirror stale/missing as degraded in quote_kind_for

Compare with previous version

added 1 commit <ul><li>0e6b0c12 - fix(indexer): treat mirror stale/missing as degraded in quote_kind_for</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/80/diffs?diff_id=1836579719&start_sha=616c44c6e92cf973d5c1993ce80cdf54b8e3a0de)
ghost1 commented 2026-06-05 11:39:24 +00:00 (Migrated from gitlab.com)

changed the description

changed the description
PlasticDigits commented 2026-06-05 11:40:41 +00:00 (Migrated from gitlab.com)

Security review (automated)

Commit reviewed: 0e6b0c12847f0723c407cce4fc2478be986c988b
Scope: Phase 1c DB hybrid route solver — db_orderbook_sim, global_v2 / ROUTE_SOLVER_DB_HYBRID, fidelity guard (ROUTE_FIDELITY_DRIFT_BPS), route cache/solver metadata, frontend disclosure types, integration tests. Delta since prior review: quote_kind_for now marks mirror-stale/missing hops as degraded (0e6b0c1).

Outcome: FINDINGS: 0 medium+ (no inline threads).

Areas reviewed

Area Result
SQL injection Mirror reads use bound parameters (pair_id, side); get_pair_resting_book only interpolates fixed ASC/DESC for hard-coded "bid"/"ask" literals.
Authn/authz No new endpoints; route solve remains public read with existing LCD-heavy + global rate limits (H7).
Quote integrity / poisoned mirror Winning path is selected on router simulate_swap_operations output; apply_fidelity_guard clamps when mirror grid exceeds router sim beyond ROUTE_FIDELITY_DRIFT_BPS and downgrades quote_kind. Integration test covers drift.
Trader/tier spoofing Optional trader/sender params unchanged (#245); unknown subjects use FULL_FEE_TIER_SENTINEL (-1) for mirror fee math (fixes prior 100%-discount mirror mispricing in 616c44c). Router sim remains authoritative for estimated_amount_out.
Error disclosure (H6) HybridSimError::Db maps to generic 502; no LCD paths/URLs in client body.
XSS Frontend disclosure is static copy keyed on quote_kind enum only.
Cache poisoning Hybrid cache key includes solver_version (global_v1 vs global_v2) plus existing tier/trader bucket fields.
Availability propagate_offer_through_plan falls back to pool-only on HybridSimError::Db (parity with LCD path, 616c44c).

Prior threads

Re-checked Bugbot threads on fee-tier sentinel, DB propagate fallback, and mirror-stale quote_kind — all addressed in 616c44c / 0e6b0c1; no remaining medium+ exploit path on this diff.

Notes (informational, below reporting threshold)

  • Enabling ROUTE_SOLVER_DB_HYBRID before the #322 snapshot loop is an operational readiness concern (stale/missing mirror → LCD fallback), not a direct unauthenticated exploit on this diff.
  • DB mode reduces per-request LCD fanout vs global_v1; grid work is bounded after mirror preload.

Automated security review — Cursor Cloud Agent

## Security review (automated) **Commit reviewed:** `0e6b0c12847f0723c407cce4fc2478be986c988b` **Scope:** Phase 1c DB hybrid route solver — `db_orderbook_sim`, `global_v2` / `ROUTE_SOLVER_DB_HYBRID`, fidelity guard (`ROUTE_FIDELITY_DRIFT_BPS`), route cache/solver metadata, frontend disclosure types, integration tests. Delta since prior review: `quote_kind_for` now marks mirror-stale/missing hops as degraded (`0e6b0c1`). **Outcome:** `FINDINGS: 0` medium+ (no inline threads). ### Areas reviewed | Area | Result | |------|--------| | **SQL injection** | Mirror reads use bound parameters (`pair_id`, `side`); `get_pair_resting_book` only interpolates fixed `ASC`/`DESC` for hard-coded `"bid"`/`"ask"` literals. | | **Authn/authz** | No new endpoints; route solve remains public read with existing LCD-heavy + global rate limits (H7). | | **Quote integrity / poisoned mirror** | Winning path is selected on router `simulate_swap_operations` output; `apply_fidelity_guard` clamps when mirror grid exceeds router sim beyond `ROUTE_FIDELITY_DRIFT_BPS` and downgrades `quote_kind`. Integration test covers drift. | | **Trader/tier spoofing** | Optional `trader`/`sender` params unchanged (#245); unknown subjects use `FULL_FEE_TIER_SENTINEL` (-1) for mirror fee math (fixes prior 100%-discount mirror mispricing in `616c44c`). Router sim remains authoritative for `estimated_amount_out`. | | **Error disclosure (H6)** | `HybridSimError::Db` maps to generic 502; no LCD paths/URLs in client body. | | **XSS** | Frontend disclosure is static copy keyed on `quote_kind` enum only. | | **Cache poisoning** | Hybrid cache key includes `solver_version` (`global_v1` vs `global_v2`) plus existing tier/trader bucket fields. | | **Availability** | `propagate_offer_through_plan` falls back to pool-only on `HybridSimError::Db` (parity with LCD path, `616c44c`). | ### Prior threads Re-checked Bugbot threads on fee-tier sentinel, DB propagate fallback, and mirror-stale `quote_kind` — all addressed in `616c44c` / `0e6b0c1`; no remaining medium+ exploit path on this diff. ### Notes (informational, below reporting threshold) - Enabling `ROUTE_SOLVER_DB_HYBRID` before the #322 snapshot loop is an **operational** readiness concern (stale/missing mirror → LCD fallback), not a direct unauthenticated exploit on this diff. - DB mode reduces per-request LCD fanout vs `global_v1`; grid work is bounded after mirror preload. --- *Automated security review — Cursor Cloud Agent*
ghost1 commented 2026-06-05 11:41:11 +00:00 (Migrated from gitlab.com)
Stale Security Review comment
Stale Security Review comment
Stale Security Review comment
Stale Security Review comment
Stale Security Review comment

Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.

Reviewed by Cursor Bugbot for commit 0e6b0c1284. Configure here.

<details> <summary>Stale Security Review comment</summary> <details> <summary>Stale Security Review comment</summary> <details> <summary>Stale Security Review comment</summary> <details> <summary>Stale Security Review comment</summary> <details> <summary>Stale Security Review comment</summary> <!-- BUGBOT_REVIEW --> Cursor Bugbot has reviewed your changes and found 1 potential issue.<!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_BEGIN --> <sup>Bugbot Autofix is [ON](https://www.cursor.com/dashboard/bugbot). A cloud agent has been kicked off to fix the reported issue. <!-- BUGBOT_AUTOFIX_AGENT_LINK --></sup> <!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_END --> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 0e6b0c12847f0723c407cce4fc2478be986c988b. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> </details> </details> </details> </details> </details>
ghost1 commented 2026-06-05 11:41:12 +00:00 (Migrated from gitlab.com)

Hybrid propagate pool-only over-counts

Medium Severity

In propagate_offer_through_plan, when a planned hybrid simulation fails, the fallback runs pool-only pricing on the full hop offer (pool_input + book_input) instead of only the planned pool_input. That can inflate intermediate hop outputs during coordinate refinement and skew grid_out used for the fidelity guard, even though the returned router_operations still reflect the original split.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 0e6b0c1284. Configure here.

### Hybrid propagate pool-only over-counts **Medium Severity** <!-- DESCRIPTION START --> In `propagate_offer_through_plan`, when a planned hybrid simulation fails, the fallback runs pool-only pricing on the full hop `offer` (`pool_input + book_input`) instead of only the planned `pool_input`. That can inflate intermediate hop outputs during coordinate refinement and skew `grid_out` used for the fidelity guard, even though the returned `router_operations` still reflect the original split. <!-- DESCRIPTION END --> <!-- BUGBOT_BUG_ID: 2d3c6888-237e-41eb-9001-06308fdb8c3f --> <!-- LOCATIONS START indexer/src/api/hybrid_route_opt.rs#L496-L506 LOCATIONS END --> <div><a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9DVVJTT1IiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OjYzM2JlN2ZhLTAyMGItNGZkYi04ZTNjLWU1ZTkzN2NjNDcxOCIsImVuY3J5cHRpb25LZXkiOiJ2REw0TGl1cDdWV2JsbWVma1E3THpWUlo5V0JiZ2s3OU5FcDQ2U01qUW5rIiwiYnJhbmNoIjoiY3Vyc29yL2dpdGxhYi1pc3N1ZS13b3JrZmxvdy1jZjEyIiwicmVwb093bmVyIjoiUGxhc3RpY0RpZ2l0cyIsInJlcG9OYW1lIjoiY2w4eS1kZXgtdGVycmFjbGFzc2ljIn19" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a>&nbsp;<a href="https://cursor.com/agents?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9XRUIiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OjYzM2JlN2ZhLTAyMGItNGZkYi04ZTNjLWU1ZTkzN2NjNDcxOCIsImVuY3J5cHRpb25LZXkiOiJ2REw0TGl1cDdWV2JsbWVma1E3THpWUlo5V0JiZ2s3OU5FcDQ2U01qUW5rIiwiYnJhbmNoIjoiY3Vyc29yL2dpdGxhYi1pc3N1ZS13b3JrZmxvdy1jZjEyIiwicmVwb093bmVyIjoiUGxhc3RpY0RpZ2l0cyIsInJlcG9OYW1lIjoiY2w4eS1kZXgtdGVycmFjbGFzc2ljIiwicHJOdW1iZXIiOjgwLCJjb21taXRTaGEiOiIwZTZiMGMxMjg0N2YwNzIzYzQwN2NjZTRmYzI0NzhiZTk4NmM5ODhiIiwicHJvdmlkZXIiOiJnaXRsYWIiLCJob3N0bmFtZSI6ImdpdGxhYi5jb20ifX0" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-web-light.png"><img alt="Fix in Web" width="99" height="28" src="https://cursor.com/assets/images/fix-in-web-dark.png"></picture></a></div> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 0e6b0c12847f0723c407cce4fc2478be986c988b. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>
ghost1 commented 2026-06-05 11:53:57 +00:00 (Migrated from gitlab.com)

added 1 commit

  • c4b9f58c - Fix hybrid propagate pool-only fallback to use planned pool slice

Compare with previous version

added 1 commit <ul><li>c4b9f58c - Fix hybrid propagate pool-only fallback to use planned pool slice</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/80/diffs?diff_id=1836604801&start_sha=0e6b0c12847f0723c407cce4fc2478be986c988b)
ghost1 commented 2026-06-05 11:54:09 +00:00 (Migrated from gitlab.com)

changed the description

changed the description
ghost1 commented 2026-06-05 11:57:47 +00:00 (Migrated from gitlab.com)
Stale Security Review comment
Stale Security Review comment
Stale Security Review comment
Stale Security Review comment

Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.

Reviewed by Cursor Bugbot for commit c4b9f58c72. Configure here.

<details> <summary>Stale Security Review comment</summary> <details> <summary>Stale Security Review comment</summary> <details> <summary>Stale Security Review comment</summary> <details> <summary>Stale Security Review comment</summary> <!-- BUGBOT_REVIEW --> Cursor Bugbot has reviewed your changes and found 1 potential issue.<!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_BEGIN --> <sup>Bugbot Autofix is [ON](https://www.cursor.com/dashboard/bugbot). A cloud agent has been kicked off to fix the reported issue. <!-- BUGBOT_AUTOFIX_AGENT_LINK --></sup> <!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_END --> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit c4b9f58c729e991ac4fbe115e9268ea1a7fd1e4f. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> </details> </details> </details> </details>
ghost1 commented 2026-06-05 11:57:48 +00:00 (Migrated from gitlab.com)

Default tier_id zero max discount

High Severity

For global_v2, resolve_discount_tier returns a wallet’s raw traders.tier_id. New rows default to 0, which tier_discount_bps treats as a 100% fee discount, so Postgres mirror grid pricing can assume zero swap fees while LCD/router sim still charges full fees for the same trader/sender.

Additional Locations (1)
Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit c4b9f58c72. Configure here.

### Default tier_id zero max discount **High Severity** <!-- DESCRIPTION START --> For `global_v2`, `resolve_discount_tier` returns a wallet’s raw `traders.tier_id`. New rows default to `0`, which `tier_discount_bps` treats as a 100% fee discount, so Postgres mirror grid pricing can assume zero swap fees while LCD/router sim still charges full fees for the same `trader`/`sender`. <!-- DESCRIPTION END --> <!-- BUGBOT_BUG_ID: 8dd0fb57-f09a-429e-bf18-163b83fe1e82 --> <!-- LOCATIONS START indexer/src/api/route_solver.rs#L565-L580 indexer/src/api/db_orderbook_sim.rs#L20-L37 LOCATIONS END --> <details> <summary>Additional Locations (1)</summary> - [`indexer/src/api/db_orderbook_sim.rs#L20-L37`](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-//blob/c4b9f58c729e991ac4fbe115e9268ea1a7fd1e4f/indexer/src/api/db_orderbook_sim.rs#L20-L37) </details> <div><a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9DVVJTT1IiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OjcwZjQwZjQ3LWU0MmUtNGNiMC1hNTg5LTA2OTE0OTZkM2FmZCIsImVuY3J5cHRpb25LZXkiOiJQU1RrQVdzWFhJZnlabklQUTRHOFQ4ams5aEdGM3VmVVNPY3NyekdnektnIiwiYnJhbmNoIjoiY3Vyc29yL2dpdGxhYi1pc3N1ZS13b3JrZmxvdy1jZjEyIiwicmVwb093bmVyIjoiUGxhc3RpY0RpZ2l0cyIsInJlcG9OYW1lIjoiY2w4eS1kZXgtdGVycmFjbGFzc2ljIn19" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a>&nbsp;<a href="https://cursor.com/agents?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9XRUIiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OjcwZjQwZjQ3LWU0MmUtNGNiMC1hNTg5LTA2OTE0OTZkM2FmZCIsImVuY3J5cHRpb25LZXkiOiJQU1RrQVdzWFhJZnlabklQUTRHOFQ4ams5aEdGM3VmVVNPY3NyekdnektnIiwiYnJhbmNoIjoiY3Vyc29yL2dpdGxhYi1pc3N1ZS13b3JrZmxvdy1jZjEyIiwicmVwb093bmVyIjoiUGxhc3RpY0RpZ2l0cyIsInJlcG9OYW1lIjoiY2w4eS1kZXgtdGVycmFjbGFzc2ljIiwicHJOdW1iZXIiOjgwLCJjb21taXRTaGEiOiJjNGI5ZjU4YzcyOWU5OTFhYzRmYmUxMTVlOTI2OGVhMWE3ZmQxZTRmIiwicHJvdmlkZXIiOiJnaXRsYWIiLCJob3N0bmFtZSI6ImdpdGxhYi5jb20ifX0" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-web-light.png"><img alt="Fix in Web" width="99" height="28" src="https://cursor.com/assets/images/fix-in-web-dark.png"></picture></a></div> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit c4b9f58c729e991ac4fbe115e9268ea1a7fd1e4f. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>
PlasticDigits commented 2026-06-05 12:06:56 +00:00 (Migrated from gitlab.com)

Security review (automated)

Commit reviewed: c4b9f58c729e991ac4fbe115e9268ea1a7fd1e4f
Scope: Phase 1c DB hybrid route solver — db_orderbook_sim, global_v2 / ROUTE_SOLVER_DB_HYBRID, fidelity guard (ROUTE_FIDELITY_DRIFT_BPS), route cache/solver metadata, frontend disclosure types, integration tests.

Outcome: FINDINGS: 0 medium+ (no inline threads).

Areas reviewed

Area Result
SQL injection Mirror reads use bound parameters (pair_id, side); get_pair_resting_book only interpolates fixed ASC/DESC for hard-coded "bid"/"ask" literals.
Authn/authz No new endpoints; route solve remains public read with existing LCD-heavy + global rate limits (H7).
Quote integrity / poisoned mirror Winning path is selected on router simulate_swap_operations output (out_u); apply_fidelity_guard clamps when mirror grid_out exceeds router sim beyond ROUTE_FIDELITY_DRIFT_BPS and downgrades quote_kind. Integration test route_solve_db_hybrid_fidelity_drift_downgrades locks the drift path.
Trader/tier spoofing Optional trader/sender params unchanged (#245). Unknown/absent subjects resolve to FULL_FEE_TIER_SENTINEL (-1) for mirror fee math (616c44c). estimated_amount_out remains router-sim authoritative, so stale traders.tier_id = 0 defaults cannot inflate displayed output—only mirror grid planning (mitigated by fidelity).
Error disclosure (H6) HybridSimError::Db maps to generic 502; no LCD paths/URLs in client body.
XSS Frontend disclosure is static copy keyed on quote_kind enum only.
Cache poisoning Hybrid cache key includes solver_version (global_v1 vs global_v2) plus existing tier/trader bucket fields.
Availability propagate_offer_through_plan falls back to pool-only on HybridSimError::Db and uses planned pool_input slice when a book leg was planned (c4b9f58c).

Prior threads

Re-checked Bugbot threads on fee-tier sentinel, DB propagate fallback, mirror-stale quote_kind, and pool-only over-count — addressed in 616c44c / 0e6b0c1 / c4b9f58c; no remaining medium+ exploit path on this diff.

Notes (informational, below reporting threshold)

  • Enabling ROUTE_SOLVER_DB_HYBRID before the #322 snapshot loop is an operational readiness concern (stale/missing mirror → LCD fallback), not a direct unauthenticated exploit on this diff.
  • Stale traders.tier_id = 0 before tier sync can skew mirror grid fee assumptions; consider treating registered = false like FULL_FEE_TIER_SENTINEL for correctness (router output already bounds user-facing amounts).

Automated security review — Cursor Cloud Agent

## Security review (automated) **Commit reviewed:** `c4b9f58c729e991ac4fbe115e9268ea1a7fd1e4f` **Scope:** Phase 1c DB hybrid route solver — `db_orderbook_sim`, `global_v2` / `ROUTE_SOLVER_DB_HYBRID`, fidelity guard (`ROUTE_FIDELITY_DRIFT_BPS`), route cache/solver metadata, frontend disclosure types, integration tests. **Outcome:** `FINDINGS: 0` medium+ (no inline threads). ### Areas reviewed | Area | Result | |------|--------| | **SQL injection** | Mirror reads use bound parameters (`pair_id`, `side`); `get_pair_resting_book` only interpolates fixed `ASC`/`DESC` for hard-coded `"bid"`/`"ask"` literals. | | **Authn/authz** | No new endpoints; route solve remains public read with existing LCD-heavy + global rate limits (H7). | | **Quote integrity / poisoned mirror** | Winning path is selected on router `simulate_swap_operations` output (`out_u`); `apply_fidelity_guard` clamps when mirror `grid_out` exceeds router sim beyond `ROUTE_FIDELITY_DRIFT_BPS` and downgrades `quote_kind`. Integration test `route_solve_db_hybrid_fidelity_drift_downgrades` locks the drift path. | | **Trader/tier spoofing** | Optional `trader`/`sender` params unchanged (#245). Unknown/absent subjects resolve to `FULL_FEE_TIER_SENTINEL` (-1) for mirror fee math (`616c44c`). `estimated_amount_out` remains router-sim authoritative, so stale `traders.tier_id = 0` defaults cannot inflate displayed output—only mirror grid planning (mitigated by fidelity). | | **Error disclosure (H6)** | `HybridSimError::Db` maps to generic 502; no LCD paths/URLs in client body. | | **XSS** | Frontend disclosure is static copy keyed on `quote_kind` enum only. | | **Cache poisoning** | Hybrid cache key includes `solver_version` (`global_v1` vs `global_v2`) plus existing tier/trader bucket fields. | | **Availability** | `propagate_offer_through_plan` falls back to pool-only on `HybridSimError::Db` and uses planned `pool_input` slice when a book leg was planned (`c4b9f58c`). | ### Prior threads Re-checked Bugbot threads on fee-tier sentinel, DB propagate fallback, mirror-stale `quote_kind`, and pool-only over-count — addressed in `616c44c` / `0e6b0c1` / `c4b9f58c`; no remaining medium+ exploit path on this diff. ### Notes (informational, below reporting threshold) - Enabling `ROUTE_SOLVER_DB_HYBRID` before the #322 snapshot loop is an **operational** readiness concern (stale/missing mirror → LCD fallback), not a direct unauthenticated exploit on this diff. - Stale `traders.tier_id = 0` before tier sync can skew mirror grid fee assumptions; consider treating `registered = false` like `FULL_FEE_TIER_SENTINEL` for correctness (router output already bounds user-facing amounts). --- *Automated security review — Cursor Cloud Agent*
ghost1 commented 2026-06-05 12:08:43 +00:00 (Migrated from gitlab.com)

added 1 commit

  • 1aeeed6a - fix(indexer): treat unregistered traders as full-fee in discount tier lookup

Compare with previous version

added 1 commit <ul><li>1aeeed6a - fix(indexer): treat unregistered traders as full-fee in discount tier lookup</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/80/diffs?diff_id=1836631612&start_sha=c4b9f58c729e991ac4fbe115e9268ea1a7fd1e4f)
ghost1 commented 2026-06-05 12:08:57 +00:00 (Migrated from gitlab.com)

changed the description

changed the description
ghost1 commented 2026-06-05 12:10:44 +00:00 (Migrated from gitlab.com)
Stale Security Review comment
Stale Security Review comment
Stale Security Review comment

Cursor Bugbot has reviewed your changes and found 2 potential issues.
Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issues.

Reviewed by Cursor Bugbot for commit 1aeeed6ae5. Configure here.

<details> <summary>Stale Security Review comment</summary> <details> <summary>Stale Security Review comment</summary> <details> <summary>Stale Security Review comment</summary> <!-- BUGBOT_REVIEW --> Cursor Bugbot has reviewed your changes and found 2 potential issues.<!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_BEGIN --> <sup>Bugbot Autofix is [ON](https://www.cursor.com/dashboard/bugbot). A cloud agent has been kicked off to fix the reported issues. <!-- BUGBOT_AUTOFIX_AGENT_LINK --></sup> <!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_END --> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 1aeeed6ae514056d40b500326aba64975fb05a25. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> </details> </details> </details>
ghost1 commented 2026-06-05 12:10:45 +00:00 (Migrated from gitlab.com)

Fidelity drift mislabels pool-only quotes

Low Severity

When fidelity_check is drift, the handler always sets quote_kind to indexer_hybrid_db_degraded, even if the chosen plan has no book legs (any_book_leg false). Pool-only global_v2 routes can be disclosed as hybrid-degraded incorrectly.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 1aeeed6ae5. Configure here.

### Fidelity drift mislabels pool-only quotes **Low Severity** <!-- DESCRIPTION START --> When `fidelity_check` is `drift`, the handler always sets `quote_kind` to `indexer_hybrid_db_degraded`, even if the chosen plan has no book legs (`any_book_leg` false). Pool-only `global_v2` routes can be disclosed as hybrid-degraded incorrectly. <!-- DESCRIPTION END --> <!-- BUGBOT_BUG_ID: 6557b39b-6f71-4ef2-8a3a-3d06b14d3efe --> <!-- LOCATIONS START indexer/src/api/best_execution.rs#L387-L392 LOCATIONS END --> <div><a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9DVVJTT1IiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OjhjMmFjMmYxLWFiYjAtNGM3OS1iNmU4LTZhYTFiYzY4ZjFkZCIsImVuY3J5cHRpb25LZXkiOiIwLTBuWWptYl9DWTQ1czBqXzRrWW1Gd0ZaYTQ5WnMwd1RYSktiT1pXbWd3IiwiYnJhbmNoIjoiY3Vyc29yL2dpdGxhYi1pc3N1ZS13b3JrZmxvdy1jZjEyIiwicmVwb093bmVyIjoiUGxhc3RpY0RpZ2l0cyIsInJlcG9OYW1lIjoiY2w4eS1kZXgtdGVycmFjbGFzc2ljIn19" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a>&nbsp;<a href="https://cursor.com/agents?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9XRUIiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OjhjMmFjMmYxLWFiYjAtNGM3OS1iNmU4LTZhYTFiYzY4ZjFkZCIsImVuY3J5cHRpb25LZXkiOiIwLTBuWWptYl9DWTQ1czBqXzRrWW1Gd0ZaYTQ5WnMwd1RYSktiT1pXbWd3IiwiYnJhbmNoIjoiY3Vyc29yL2dpdGxhYi1pc3N1ZS13b3JrZmxvdy1jZjEyIiwicmVwb093bmVyIjoiUGxhc3RpY0RpZ2l0cyIsInJlcG9OYW1lIjoiY2w4eS1kZXgtdGVycmFjbGFzc2ljIiwicHJOdW1iZXIiOjgwLCJjb21taXRTaGEiOiIxYWVlZWQ2YWU1MTQwNTZkNDBiNTAwMzI2YWJhNjQ5NzVmYjA1YTI1IiwicHJvdmlkZXIiOiJnaXRsYWIiLCJob3N0bmFtZSI6ImdpdGxhYi5jb20ifX0" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-web-light.png"><img alt="Fix in Web" width="99" height="28" src="https://cursor.com/assets/images/fix-in-web-dark.png"></picture></a></div> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 1aeeed6ae514056d40b500326aba64975fb05a25. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>
ghost1 commented 2026-06-05 12:10:45 +00:00 (Migrated from gitlab.com)

Non-atomic mirror load torn reads

Medium Severity

load_hop_mirror loads pair_reserves and resting_limit_orders in separate queries without a shared transaction. If the #322 snapshot commits between them, the hop mirror can pair fresh reserves with an older book (or vice versa) while still marked Fresh, skewing hybrid grid pricing until fidelity catches it.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 1aeeed6ae5. Configure here.

### Non-atomic mirror load torn reads **Medium Severity** <!-- DESCRIPTION START --> `load_hop_mirror` loads `pair_reserves` and `resting_limit_orders` in separate queries without a shared transaction. If the #322 snapshot commits between them, the hop mirror can pair fresh reserves with an older book (or vice versa) while still marked `Fresh`, skewing hybrid grid pricing until fidelity catches it. <!-- DESCRIPTION END --> <!-- BUGBOT_BUG_ID: 05bb33a5-acbf-44ff-bda6-5577f5ddb20b --> <!-- LOCATIONS START indexer/src/api/db_orderbook_sim.rs#L145-L161 LOCATIONS END --> <div><a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9DVVJTT1IiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OjA4NzliYzYzLWYwMjUtNGRiMy1iYWNiLTQ1OWY5MmRiNDQ5YSIsImVuY3J5cHRpb25LZXkiOiJsY0dZVVBOQjh5NzNfM3lTNnJNQWl0c1Zyc1NuNmJFRC1ja2pGZU9WTlRrIiwiYnJhbmNoIjoiY3Vyc29yL2dpdGxhYi1pc3N1ZS13b3JrZmxvdy1jZjEyIiwicmVwb093bmVyIjoiUGxhc3RpY0RpZ2l0cyIsInJlcG9OYW1lIjoiY2w4eS1kZXgtdGVycmFjbGFzc2ljIn19" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a>&nbsp;<a href="https://cursor.com/agents?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9XRUIiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OjA4NzliYzYzLWYwMjUtNGRiMy1iYWNiLTQ1OWY5MmRiNDQ5YSIsImVuY3J5cHRpb25LZXkiOiJsY0dZVVBOQjh5NzNfM3lTNnJNQWl0c1Zyc1NuNmJFRC1ja2pGZU9WTlRrIiwiYnJhbmNoIjoiY3Vyc29yL2dpdGxhYi1pc3N1ZS13b3JrZmxvdy1jZjEyIiwicmVwb093bmVyIjoiUGxhc3RpY0RpZ2l0cyIsInJlcG9OYW1lIjoiY2w4eS1kZXgtdGVycmFjbGFzc2ljIiwicHJOdW1iZXIiOjgwLCJjb21taXRTaGEiOiIxYWVlZWQ2YWU1MTQwNTZkNDBiNTAwMzI2YWJhNjQ5NzVmYjA1YTI1IiwicHJvdmlkZXIiOiJnaXRsYWIiLCJob3N0bmFtZSI6ImdpdGxhYi5jb20ifX0" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-web-light.png"><img alt="Fix in Web" width="99" height="28" src="https://cursor.com/assets/images/fix-in-web-dark.png"></picture></a></div> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 1aeeed6ae514056d40b500326aba64975fb05a25. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>
PlasticDigits commented 2026-06-05 12:11:01 +00:00 (Migrated from gitlab.com)

Security review (automated)

Commit reviewed: 1aeeed6ae514056d40b500326aba64975fb05a25
Scope: Phase 1c DB hybrid route solver — db_orderbook_sim, global_v2 / ROUTE_SOLVER_DB_HYBRID, fidelity guard (ROUTE_FIDELITY_DRIFT_BPS), resolve_discount_tier / fee-tier mirror parity, route cache/solver metadata, frontend disclosure types, integration tests. Delta since prior review: unregistered traders rows no longer pass schema-default tier_id=0 into mirror fee math (1aeeed6a).

Outcome: FINDINGS: 0 medium+ (no inline threads).

Areas reviewed

Area Result
SQL injection Mirror reads (pair_reserves, resting_limit_orders, pairs, traders) use bound parameters; pair addresses on the hot path come from indexed graph enumeration, not raw user strings in SQL.
Authn / authz Route solve remains a public read-only quote API; no new write paths or role checks introduced.
Fee-tier mirror parity resolve_discount_tier now returns FULL_FEE_TIER_SENTINEL (-1 → 0% discount) unless traders.registered=true; fixes prior high-severity path where upserted-but-unregistered wallets inherited tier_id=0 (100% discount) in Postgres grid pricing.
Quote integrity / poisoned mirror When ROUTER_ADDRESS is configured, estimated_amount_out is always router simulate_swap_operations output; fidelity guard only downgrades quote_kind and clamps when DB grid_out exceeds router sim beyond ROUTE_FIDELITY_DRIFT_BPS. Attacker cannot inflate returned amounts via mirror manipulation alone.
Degradation / fallback Stale/missing mirrors → per-hop LCD fallback with mirror_stale/mirror_missing reflected in quote_kind; propagate_offer_through_plan pool-only fallback uses planned pool_input when a book leg was planned (not full hop offer).
Cache poisoning Hybrid cache keys include solver_version and resolved discount_tier; tier-based sharing is intentional (#283).
Input validation trader/sender validated as terra1 alphanumeric; token_in/token_out resolved against indexed assets (400 on unknown).
SSRF / path traversal No new outbound URL construction from user input; LCD queries target indexed pair/router contracts.
Secrets / logging No credentials or mnemonics logged; fidelity warnings log numeric outputs only.
Frontend XSS New quote-kind disclosure strings are static compile-time copy, not rendered from API HTML.
Dependencies No new crates in this MR.

Prior threads (re-checked)

Bugbot/security threads on fee-tier sentinel, DB propagate fallback, mirror-stale quote_kind, and propagate pool-only over-counting are addressed in the current diff; no remaining exploitable attack path traced from request parameters to a harmful sink.

Security review: no medium+ findings on this diff.

## Security review (automated) **Commit reviewed:** `1aeeed6ae514056d40b500326aba64975fb05a25` **Scope:** Phase 1c DB hybrid route solver — `db_orderbook_sim`, `global_v2` / `ROUTE_SOLVER_DB_HYBRID`, fidelity guard (`ROUTE_FIDELITY_DRIFT_BPS`), `resolve_discount_tier` / fee-tier mirror parity, route cache/solver metadata, frontend disclosure types, integration tests. Delta since prior review: unregistered `traders` rows no longer pass schema-default `tier_id=0` into mirror fee math (`1aeeed6a`). **Outcome:** `FINDINGS: 0` medium+ (no inline threads). ### Areas reviewed | Area | Result | |------|--------| | **SQL injection** | Mirror reads (`pair_reserves`, `resting_limit_orders`, `pairs`, `traders`) use bound parameters; pair addresses on the hot path come from indexed graph enumeration, not raw user strings in SQL. | | **Authn / authz** | Route solve remains a public read-only quote API; no new write paths or role checks introduced. | | **Fee-tier mirror parity** | `resolve_discount_tier` now returns `FULL_FEE_TIER_SENTINEL` (`-1` → 0% discount) unless `traders.registered=true`; fixes prior high-severity path where upserted-but-unregistered wallets inherited `tier_id=0` (100% discount) in Postgres grid pricing. | | **Quote integrity / poisoned mirror** | When `ROUTER_ADDRESS` is configured, `estimated_amount_out` is always router `simulate_swap_operations` output; fidelity guard only downgrades `quote_kind` and clamps when DB `grid_out` exceeds router sim beyond `ROUTE_FIDELITY_DRIFT_BPS`. Attacker cannot inflate returned amounts via mirror manipulation alone. | | **Degradation / fallback** | Stale/missing mirrors → per-hop LCD fallback with `mirror_stale`/`mirror_missing` reflected in `quote_kind`; `propagate_offer_through_plan` pool-only fallback uses planned `pool_input` when a book leg was planned (not full hop offer). | | **Cache poisoning** | Hybrid cache keys include `solver_version` and resolved `discount_tier`; tier-based sharing is intentional (#283). | | **Input validation** | `trader`/`sender` validated as `terra1` alphanumeric; `token_in`/`token_out` resolved against indexed assets (400 on unknown). | | **SSRF / path traversal** | No new outbound URL construction from user input; LCD queries target indexed pair/router contracts. | | **Secrets / logging** | No credentials or mnemonics logged; fidelity warnings log numeric outputs only. | | **Frontend XSS** | New quote-kind disclosure strings are static compile-time copy, not rendered from API HTML. | | **Dependencies** | No new crates in this MR. | ### Prior threads (re-checked) Bugbot/security threads on fee-tier sentinel, DB propagate fallback, mirror-stale `quote_kind`, and propagate pool-only over-counting are addressed in the current diff; no remaining exploitable attack path traced from request parameters to a harmful sink. **Security review: no medium+ findings on this diff.**
ghost1 commented 2026-06-05 12:13:58 +00:00 (Migrated from gitlab.com)

changed this line in version 6 of the diff

changed this line in [version 6 of the diff](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/80/diffs?diff_id=1836642071&start_sha=1aeeed6ae514056d40b500326aba64975fb05a25#b15023e39a0ac993be6d71725f8fcbff5724339e_392_389)
ghost1 commented 2026-06-05 12:13:58 +00:00 (Migrated from gitlab.com)

changed this line in version 6 of the diff

changed this line in [version 6 of the diff](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/80/diffs?diff_id=1836642071&start_sha=1aeeed6ae514056d40b500326aba64975fb05a25#601f910f7e4e9ef106af70db5703fd3427ca82ac_161_167)
ghost1 commented 2026-06-05 12:13:59 +00:00 (Migrated from gitlab.com)

added 1 commit

  • 6ac10f31 - Fix torn mirror reads and pool-only fidelity quote_kind

Compare with previous version

added 1 commit <ul><li>6ac10f31 - Fix torn mirror reads and pool-only fidelity quote_kind</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/80/diffs?diff_id=1836642071&start_sha=1aeeed6ae514056d40b500326aba64975fb05a25)
ghost1 commented 2026-06-05 12:14:14 +00:00 (Migrated from gitlab.com)

changed the description

changed the description
PlasticDigits commented 2026-06-05 12:15:41 +00:00 (Migrated from gitlab.com)

Security review (automated)

Commit reviewed: 6ac10f3173afa0db10e3410a2d2c6a7200825068
Scope: Phase 1c DB hybrid route solver — db_orderbook_sim, global_v2 / ROUTE_SOLVER_DB_HYBRID, fidelity guard (ROUTE_FIDELITY_DRIFT_BPS), REPEATABLE READ mirror loads, route cache/solver metadata, frontend disclosure types, integration tests. Delta since prior review: torn-read fix + fidelity quote_kind_for on drift (6ac10f3).

Outcome: FINDINGS: 0 medium+ (no inline threads).

Areas reviewed

Area Result
SQL injection Mirror reads use bound parameters (pair_id, side); get_pair_resting_book only interpolates fixed ASC/DESC for hard-coded "bid"/"ask" literals.
Authn/authz No new endpoints; route solve remains public read with existing LCD-heavy + global rate limits (H7).
Quote integrity / poisoned or torn mirror Winning path is selected on router simulate_swap_operations output; apply_fidelity_guard clamps when mirror grid exceeds router sim beyond ROUTE_FIDELITY_DRIFT_BPS and downgrades quote_kind. Reserves + resting book are read under REPEATABLE READ in one transaction (6ac10f3). Integration test covers drift downgrade.
Trader/tier spoofing Optional trader/sender params unchanged (#245); unknown/unregistered subjects use FULL_FEE_TIER_SENTINEL (-1) for mirror fee math; registered tier_id only when traders.registered is true. Router sim remains authoritative for estimated_amount_out.
Error disclosure (H6) HybridSimError::Db maps to generic 502; no LCD paths/URLs in client body.
XSS Frontend disclosure is static copy keyed on quote_kind enum only.
Cache poisoning Hybrid cache key includes solver_version (global_v1 vs global_v2) plus existing tier/trader bucket fields.
Availability propagate_offer_through_plan falls back to pool-only on HybridSimError::Db using the planned pool slice when book > 0 (parity with LCD path).

Prior threads

Re-checked Bugbot threads on fee-tier sentinel, DB propagate fallback, mirror-stale quote_kind, pool-only propagate slice, and default tier_id — addressed in 616c44c / 0e6b0c1 / c4b9f58 / 6ac10f3; no remaining medium+ exploit path on this diff.

Notes (informational, below reporting threshold)

  • Enabling ROUTE_SOLVER_DB_HYBRID before the #322 snapshot loop is an operational readiness concern (stale/missing mirror → LCD fallback), not a direct unauthenticated exploit on this diff.
  • DB mode reduces per-request LCD fanout vs global_v1; grid work is bounded after mirror preload.

Automated security review — Cursor Cloud Agent

## Security review (automated) **Commit reviewed:** `6ac10f3173afa0db10e3410a2d2c6a7200825068` **Scope:** Phase 1c DB hybrid route solver — `db_orderbook_sim`, `global_v2` / `ROUTE_SOLVER_DB_HYBRID`, fidelity guard (`ROUTE_FIDELITY_DRIFT_BPS`), REPEATABLE READ mirror loads, route cache/solver metadata, frontend disclosure types, integration tests. Delta since prior review: torn-read fix + fidelity `quote_kind_for` on drift (`6ac10f3`). **Outcome:** `FINDINGS: 0` medium+ (no inline threads). ### Areas reviewed | Area | Result | |------|--------| | **SQL injection** | Mirror reads use bound parameters (`pair_id`, `side`); `get_pair_resting_book` only interpolates fixed `ASC`/`DESC` for hard-coded `"bid"`/`"ask"` literals. | | **Authn/authz** | No new endpoints; route solve remains public read with existing LCD-heavy + global rate limits (H7). | | **Quote integrity / poisoned or torn mirror** | Winning path is selected on router `simulate_swap_operations` output; `apply_fidelity_guard` clamps when mirror grid exceeds router sim beyond `ROUTE_FIDELITY_DRIFT_BPS` and downgrades `quote_kind`. Reserves + resting book are read under `REPEATABLE READ` in one transaction (`6ac10f3`). Integration test covers drift downgrade. | | **Trader/tier spoofing** | Optional `trader`/`sender` params unchanged (#245); unknown/unregistered subjects use `FULL_FEE_TIER_SENTINEL` (-1) for mirror fee math; registered `tier_id` only when `traders.registered` is true. Router sim remains authoritative for `estimated_amount_out`. | | **Error disclosure (H6)** | `HybridSimError::Db` maps to generic 502; no LCD paths/URLs in client body. | | **XSS** | Frontend disclosure is static copy keyed on `quote_kind` enum only. | | **Cache poisoning** | Hybrid cache key includes `solver_version` (`global_v1` vs `global_v2`) plus existing tier/trader bucket fields. | | **Availability** | `propagate_offer_through_plan` falls back to pool-only on `HybridSimError::Db` using the planned `pool` slice when `book > 0` (parity with LCD path). | ### Prior threads Re-checked Bugbot threads on fee-tier sentinel, DB propagate fallback, mirror-stale `quote_kind`, pool-only propagate slice, and default `tier_id` — addressed in `616c44c` / `0e6b0c1` / `c4b9f58` / `6ac10f3`; no remaining medium+ exploit path on this diff. ### Notes (informational, below reporting threshold) - Enabling `ROUTE_SOLVER_DB_HYBRID` before the #322 snapshot loop is an **operational** readiness concern (stale/missing mirror → LCD fallback), not a direct unauthenticated exploit on this diff. - DB mode reduces per-request LCD fanout vs `global_v1`; grid work is bounded after mirror preload. --- *Automated security review — Cursor Cloud Agent*
ghost1 commented 2026-06-05 12:15:55 +00:00 (Migrated from gitlab.com)
Stale Security Review comment
Stale Security Review comment

Cursor Bugbot has reviewed your changes and found 2 potential issues.
Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issues.

Reviewed by Cursor Bugbot for commit 6ac10f3173. Configure here.

<details> <summary>Stale Security Review comment</summary> <details> <summary>Stale Security Review comment</summary> <!-- BUGBOT_REVIEW --> Cursor Bugbot has reviewed your changes and found 2 potential issues.<!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_BEGIN --> <sup>Bugbot Autofix is [ON](https://www.cursor.com/dashboard/bugbot). A cloud agent has been kicked off to fix the reported issues. <!-- BUGBOT_AUTOFIX_AGENT_LINK --></sup> <!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_END --> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 6ac10f3173afa0db10e3410a2d2c6a7200825068. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> </details> </details>
ghost1 commented 2026-06-05 12:15:56 +00:00 (Migrated from gitlab.com)

Fidelity drift mislabels quote kind

Medium Severity

When global_v2 fidelity guard records fidelity_check: drift, the special-case quote_kind refresh passes degraded: meta.degraded && meta.any_book_leg instead of meta.degraded. Pool-only mirror routes (no book leg) can stay indexer_pool_db while the response already flags drift and clamps estimated_amount_out, contradicting RouteQuoteKind docs and the new integration test.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 6ac10f3173. Configure here.

### Fidelity drift mislabels quote kind **Medium Severity** <!-- DESCRIPTION START --> When `global_v2` fidelity guard records `fidelity_check: drift`, the special-case `quote_kind` refresh passes `degraded: meta.degraded && meta.any_book_leg` instead of `meta.degraded`. Pool-only mirror routes (no book leg) can stay `indexer_pool_db` while the response already flags drift and clamps `estimated_amount_out`, contradicting `RouteQuoteKind` docs and the new integration test. <!-- DESCRIPTION END --> <!-- BUGBOT_BUG_ID: 0009dcef-67f4-4661-beef-2a048cb2468d --> <!-- LOCATIONS START indexer/src/api/best_execution.rs#L387-L398 LOCATIONS END --> <div><a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9DVVJTT1IiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OjkyNDJhYjVhLWVlNjktNGE4My04OTEzLWU2OTA4MzBlNzgyMCIsImVuY3J5cHRpb25LZXkiOiJrTmpxdjdhbV8wazktRjFoWlZDR0lMMXNKQzl6dV94TnhnR0NhaGk1RmlzIiwiYnJhbmNoIjoiY3Vyc29yL2dpdGxhYi1pc3N1ZS13b3JrZmxvdy1jZjEyIiwicmVwb093bmVyIjoiUGxhc3RpY0RpZ2l0cyIsInJlcG9OYW1lIjoiY2w4eS1kZXgtdGVycmFjbGFzc2ljIn19" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a>&nbsp;<a href="https://cursor.com/agents?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9XRUIiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OjkyNDJhYjVhLWVlNjktNGE4My04OTEzLWU2OTA4MzBlNzgyMCIsImVuY3J5cHRpb25LZXkiOiJrTmpxdjdhbV8wazktRjFoWlZDR0lMMXNKQzl6dV94TnhnR0NhaGk1RmlzIiwiYnJhbmNoIjoiY3Vyc29yL2dpdGxhYi1pc3N1ZS13b3JrZmxvdy1jZjEyIiwicmVwb093bmVyIjoiUGxhc3RpY0RpZ2l0cyIsInJlcG9OYW1lIjoiY2w4eS1kZXgtdGVycmFjbGFzc2ljIiwicHJOdW1iZXIiOjgwLCJjb21taXRTaGEiOiI2YWMxMGYzMTczYWZhMGRiMTBlMzQxMGEyZDJjNmE3MjAwODI1MDY4IiwicHJvdmlkZXIiOiJnaXRsYWIiLCJob3N0bmFtZSI6ImdpdGxhYi5jb20ifX0" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-web-light.png"><img alt="Fix in Web" width="99" height="28" src="https://cursor.com/assets/images/fix-in-web-dark.png"></picture></a></div> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 6ac10f3173afa0db10e3410a2d2c6a7200825068. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>
ghost1 commented 2026-06-05 12:15:56 +00:00 (Migrated from gitlab.com)

Zero sim skips degraded flag

Low Severity

In apply_fidelity_guard, when router estimated_amount_out parses to zero but the mirror grid output is positive, the code sets fidelity_check to drift and returns without setting meta.degraded. Downstream labeling and notes that rely on meta.degraded can disagree with fidelity_check: drift.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 6ac10f3173. Configure here.

### Zero sim skips degraded flag **Low Severity** <!-- DESCRIPTION START --> In `apply_fidelity_guard`, when router `estimated_amount_out` parses to zero but the mirror grid output is positive, the code sets `fidelity_check` to `drift` and returns without setting `meta.degraded`. Downstream labeling and notes that rely on `meta.degraded` can disagree with `fidelity_check: drift`. <!-- DESCRIPTION END --> <!-- BUGBOT_BUG_ID: 5075d03a-d7d3-4376-89a5-b472aa480976 --> <!-- LOCATIONS START indexer/src/api/best_execution.rs#L193-L200 LOCATIONS END --> <div><a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9DVVJTT1IiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OjQyNzdkMzZiLTQ1NGUtNDg4MC1hMDVkLTY4NzQyYzY1ZWJkMCIsImVuY3J5cHRpb25LZXkiOiJfalpsLTZrNDJ4ZW5pVlNyVFgzclNwNlh0Nk1FdUY2OUlCaEFkZ0wwSk9FIiwiYnJhbmNoIjoiY3Vyc29yL2dpdGxhYi1pc3N1ZS13b3JrZmxvdy1jZjEyIiwicmVwb093bmVyIjoiUGxhc3RpY0RpZ2l0cyIsInJlcG9OYW1lIjoiY2w4eS1kZXgtdGVycmFjbGFzc2ljIn19" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a>&nbsp;<a href="https://cursor.com/agents?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9XRUIiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OjQyNzdkMzZiLTQ1NGUtNDg4MC1hMDVkLTY4NzQyYzY1ZWJkMCIsImVuY3J5cHRpb25LZXkiOiJfalpsLTZrNDJ4ZW5pVlNyVFgzclNwNlh0Nk1FdUY2OUlCaEFkZ0wwSk9FIiwiYnJhbmNoIjoiY3Vyc29yL2dpdGxhYi1pc3N1ZS13b3JrZmxvdy1jZjEyIiwicmVwb093bmVyIjoiUGxhc3RpY0RpZ2l0cyIsInJlcG9OYW1lIjoiY2w4eS1kZXgtdGVycmFjbGFzc2ljIiwicHJOdW1iZXIiOjgwLCJjb21taXRTaGEiOiI2YWMxMGYzMTczYWZhMGRiMTBlMzQxMGEyZDJjNmE3MjAwODI1MDY4IiwicHJvdmlkZXIiOiJnaXRsYWIiLCJob3N0bmFtZSI6ImdpdGxhYi5jb20ifX0" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-web-light.png"><img alt="Fix in Web" width="99" height="28" src="https://cursor.com/assets/images/fix-in-web-dark.png"></picture></a></div> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 6ac10f3173afa0db10e3410a2d2c6a7200825068. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>
ghost1 commented 2026-06-05 12:19:19 +00:00 (Migrated from gitlab.com)

added 1 commit

  • 5c3a5408 - Fix fidelity drift degraded flag and quote_kind labeling

Compare with previous version

added 1 commit <ul><li>5c3a5408 - Fix fidelity drift degraded flag and quote_kind labeling</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/80/diffs?diff_id=1836652220&start_sha=6ac10f3173afa0db10e3410a2d2c6a7200825068)
ghost1 commented 2026-06-05 12:19:38 +00:00 (Migrated from gitlab.com)

changed the description

changed the description
PlasticDigits commented 2026-06-05 12:20:50 +00:00 (Migrated from gitlab.com)

Security review (automated)

Commit reviewed: 5c3a5408b8b2297cfa35f105e1fdf674247c5863
Scope: Phase 1c DB hybrid route solver — db_orderbook_sim, global_v2 / ROUTE_SOLVER_DB_HYBRID, fidelity guard (ROUTE_FIDELITY_DRIFT_BPS), REPEATABLE READ mirror loads, resolve_discount_tier / FULL_FEE_TIER_SENTINEL, route cache solver_version keying, frontend disclosure types, integration tests. Delta since prior review (6ac10f3): fidelity drift sets meta.degraded on zero-router-sim path; drift quote_kind_for uses meta.degraded without any_book_leg gate (5c3a540).

Outcome: FINDINGS: 0 medium+ (no inline threads).

Areas reviewed

Area Result
SQL injection Mirror reads use bound parameters (pair_id, side); get_pair_resting_book only interpolates fixed ASC/DESC for hard-coded "bid"/"ask" literals.
Authn/authz No new endpoints; route solve remains public read with existing LCD-heavy + global rate limits.
Quote integrity / poisoned or torn mirror Winning path selected on router simulate_swap_operations output; apply_fidelity_guard clamps when mirror grid_out exceeds router sim beyond ROUTE_FIDELITY_DRIFT_BPS and downgrades quote_kind. Reserves + resting book read under REPEATABLE READ in one transaction. Integration test route_solve_db_hybrid_fidelity_drift_downgrades locks drift downgrade.
Trader/tier spoofing Optional trader/sender validated as terra1 alphanumeric; unknown/unregistered subjects use FULL_FEE_TIER_SENTINEL (-1). Router sim remains authoritative for estimated_amount_out.
Error disclosure HybridSimError::Db maps to generic 502; no LCD paths/URLs in client body.
XSS Frontend disclosure is static copy keyed on quote_kind enum only.
Cache poisoning Hybrid cache key includes solver_version (global_v1 vs global_v2) plus existing tier/trader bucket fields.
Availability propagate_offer_through_plan falls back to pool-only on sim error using planned pool slice when book > 0. Grid work bounded (≤5 paths × ≤3 hops × fixed grid).

Prior threads (re-checked)

Bugbot/security threads on fee-tier sentinel (1aeeed6a), DB propagate fallback (c4b9f58), torn-read fix (6ac10f3), and fidelity quote_kind/degraded labeling (5c3a540) — addressed on this diff; no remaining medium+ exploit path traced from request parameters to a harmful sink.

Security review: no medium+ findings on this diff.


Automated security review — Cursor Cloud Agent

## Security review (automated) **Commit reviewed:** `5c3a5408b8b2297cfa35f105e1fdf674247c5863` **Scope:** Phase 1c DB hybrid route solver — `db_orderbook_sim`, `global_v2` / `ROUTE_SOLVER_DB_HYBRID`, fidelity guard (`ROUTE_FIDELITY_DRIFT_BPS`), REPEATABLE READ mirror loads, `resolve_discount_tier` / `FULL_FEE_TIER_SENTINEL`, route cache `solver_version` keying, frontend disclosure types, integration tests. Delta since prior review (`6ac10f3`): fidelity drift sets `meta.degraded` on zero-router-sim path; drift `quote_kind_for` uses `meta.degraded` without `any_book_leg` gate (`5c3a540`). **Outcome:** `FINDINGS: 0` medium+ (no inline threads). ### Areas reviewed | Area | Result | |------|--------| | **SQL injection** | Mirror reads use bound parameters (`pair_id`, `side`); `get_pair_resting_book` only interpolates fixed `ASC`/`DESC` for hard-coded `"bid"`/`"ask"` literals. | | **Authn/authz** | No new endpoints; route solve remains public read with existing LCD-heavy + global rate limits. | | **Quote integrity / poisoned or torn mirror** | Winning path selected on router `simulate_swap_operations` output; `apply_fidelity_guard` clamps when mirror `grid_out` exceeds router sim beyond `ROUTE_FIDELITY_DRIFT_BPS` and downgrades `quote_kind`. Reserves + resting book read under `REPEATABLE READ` in one transaction. Integration test `route_solve_db_hybrid_fidelity_drift_downgrades` locks drift downgrade. | | **Trader/tier spoofing** | Optional `trader`/`sender` validated as `terra1` alphanumeric; unknown/unregistered subjects use `FULL_FEE_TIER_SENTINEL` (-1). Router sim remains authoritative for `estimated_amount_out`. | | **Error disclosure** | `HybridSimError::Db` maps to generic 502; no LCD paths/URLs in client body. | | **XSS** | Frontend disclosure is static copy keyed on `quote_kind` enum only. | | **Cache poisoning** | Hybrid cache key includes `solver_version` (`global_v1` vs `global_v2`) plus existing tier/trader bucket fields. | | **Availability** | `propagate_offer_through_plan` falls back to pool-only on sim error using planned `pool` slice when `book > 0`. Grid work bounded (≤5 paths × ≤3 hops × fixed grid). | ### Prior threads (re-checked) Bugbot/security threads on fee-tier sentinel (`1aeeed6a`), DB propagate fallback (`c4b9f58`), torn-read fix (`6ac10f3`), and fidelity `quote_kind`/degraded labeling (`5c3a540`) — addressed on this diff; no remaining medium+ exploit path traced from request parameters to a harmful sink. **Security review: no medium+ findings on this diff.** --- *Automated security review — Cursor Cloud Agent*
PlasticDigits commented 2026-06-05 12:31:47 +00:00 (Migrated from gitlab.com)

resolved all threads

resolved all threads
ghost1 commented 2026-06-05 12:42:40 +00:00 (Migrated from gitlab.com)

mentioned in commit e0f9e00ca2

mentioned in commit e0f9e00ca2d570b80eb9b8510698f15d42e14efa
ghost1 commented 2026-06-05 12:42:40 +00:00 (Migrated from gitlab.com)

added 13 commits

  • 5c3a5408...b9121d83 - 12 commits from branch main
  • e0f9e00c - merge: resolve main conflicts for MR !798 (#319)

Compare with previous version

added 13 commits <ul><li>5c3a5408...b9121d83 - 12 commits from branch <code>main</code></li><li>e0f9e00c - merge: resolve main conflicts for MR !798 (#319)</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/80/diffs?diff_id=1836696559&start_sha=5c3a5408b8b2297cfa35f105e1fdf674247c5863)
ghost1 commented 2026-06-05 12:42:59 +00:00 (Migrated from gitlab.com)

changed the description

changed the description
PlasticDigits commented 2026-06-05 12:44:29 +00:00 (Migrated from gitlab.com)

changed the description

changed the description
PlasticDigits commented 2026-06-05 12:44:31 +00:00 (Migrated from gitlab.com)

Security review (automated)

Commit reviewed: e0f9e00ca2d570b80eb9b8510698f15d42e14efa
Scope: Phase 1c DB hybrid route solver — db_orderbook_sim, global_v2 / ROUTE_SOLVER_DB_HYBRID, fidelity guard (ROUTE_FIDELITY_DRIFT_BPS), REPEATABLE READ mirror loads, resolve_discount_tier / FULL_FEE_TIER_SENTINEL, route cache solver_version keying, frontend disclosure types, integration tests. Delta since prior review (5c3a540): main merge — GET_DEFAULT_MAX_HOPS 3→4 (#323), docs/frontend 4xx-vs-outage (#326), budget test/doc alignment.

Outcome: FINDINGS: 0 medium+ (no inline threads).

Areas reviewed

Area Result
SQL injection Mirror reads use bound parameters (pair_id, side); get_pair_resting_book only interpolates fixed ASC/DESC for hard-coded "bid"/"ask" literals.
Authn/authz No new write endpoints; route solve remains public read with existing LCD-heavy + global rate limits (H7).
Quote integrity / poisoned or torn mirror Winning path selected on router simulate_swap_operations output; apply_fidelity_guard clamps when mirror grid_out exceeds router sim beyond ROUTE_FIDELITY_DRIFT_BPS and downgrades quote_kind. Reserves + resting book read under REPEATABLE READ in one transaction. Integration test route_solve_db_hybrid_fidelity_drift_downgrades locks drift downgrade.
Trader/tier spoofing Optional trader/sender validated as terra1 addresses; unknown/unregistered subjects resolve to FULL_FEE_TIER_SENTINEL (-1 → 0% mirror discount). Router sim remains authoritative for estimated_amount_out.
Error disclosure (H6) HybridSimError::Db maps to generic 502; no LCD paths/URLs in client body.
XSS Frontend disclosure is static copy keyed on quote_kind enum only.
Cache poisoning Cache key includes solver_version, normalized tokens, amount bucket, max_maker_fills, trader address, and resolved discount_tier.
DoS / hop-cap merge (#323) GET_DEFAULT_MAX_HOPS 4 raises theoretical grid budget to 1700 (was 1275 at 3 hops); work remains bounded (top-5 paths × 17 grid × coordinate passes) and LCD-heavy routes stay rate-limited. DB hybrid mode reduces LCD fanout vs v1.

Prior threads

Earlier inline findings (fee-tier sentinel, torn mirror reads, propagate fallback, mirror-stale quote_kind) are addressed on this branch — not re-reported.

Security review: no medium+ findings on this diff.

## Security review (automated) **Commit reviewed:** `e0f9e00ca2d570b80eb9b8510698f15d42e14efa` **Scope:** Phase 1c DB hybrid route solver — `db_orderbook_sim`, `global_v2` / `ROUTE_SOLVER_DB_HYBRID`, fidelity guard (`ROUTE_FIDELITY_DRIFT_BPS`), REPEATABLE READ mirror loads, `resolve_discount_tier` / `FULL_FEE_TIER_SENTINEL`, route cache `solver_version` keying, frontend disclosure types, integration tests. Delta since prior review (`5c3a540`): main merge — `GET_DEFAULT_MAX_HOPS` 3→4 (#323), docs/frontend 4xx-vs-outage (#326), budget test/doc alignment. **Outcome:** `FINDINGS: 0` medium+ (no inline threads). ### Areas reviewed | Area | Result | |------|--------| | **SQL injection** | Mirror reads use bound parameters (`pair_id`, `side`); `get_pair_resting_book` only interpolates fixed `ASC`/`DESC` for hard-coded `"bid"`/`"ask"` literals. | | **Authn/authz** | No new write endpoints; route solve remains public read with existing LCD-heavy + global rate limits (H7). | | **Quote integrity / poisoned or torn mirror** | Winning path selected on router `simulate_swap_operations` output; `apply_fidelity_guard` clamps when mirror `grid_out` exceeds router sim beyond `ROUTE_FIDELITY_DRIFT_BPS` and downgrades `quote_kind`. Reserves + resting book read under `REPEATABLE READ` in one transaction. Integration test `route_solve_db_hybrid_fidelity_drift_downgrades` locks drift downgrade. | | **Trader/tier spoofing** | Optional `trader`/`sender` validated as `terra1` addresses; unknown/unregistered subjects resolve to `FULL_FEE_TIER_SENTINEL` (-1 → 0% mirror discount). Router sim remains authoritative for `estimated_amount_out`. | | **Error disclosure (H6)** | `HybridSimError::Db` maps to generic 502; no LCD paths/URLs in client body. | | **XSS** | Frontend disclosure is static copy keyed on `quote_kind` enum only. | | **Cache poisoning** | Cache key includes `solver_version`, normalized tokens, amount bucket, `max_maker_fills`, trader address, and resolved `discount_tier`. | | **DoS / hop-cap merge (#323)** | `GET_DEFAULT_MAX_HOPS` 4 raises theoretical grid budget to 1700 (was 1275 at 3 hops); work remains bounded (top-5 paths × 17 grid × coordinate passes) and LCD-heavy routes stay rate-limited. DB hybrid mode reduces LCD fanout vs v1. | ### Prior threads Earlier inline findings (fee-tier sentinel, torn mirror reads, propagate fallback, mirror-stale `quote_kind`) are addressed on this branch — not re-reported. **Security review: no medium+ findings on this diff.**
ghost1 commented 2026-06-05 12:45:12 +00:00 (Migrated from gitlab.com)
Stale Security Review comment

Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.

Reviewed by Cursor Bugbot for commit e0f9e00ca2. Configure here.

<details> <summary>Stale Security Review comment</summary> <!-- BUGBOT_REVIEW --> Cursor Bugbot has reviewed your changes and found 1 potential issue.<!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_BEGIN --> <sup>Bugbot Autofix is [ON](https://www.cursor.com/dashboard/bugbot). A cloud agent has been kicked off to fix the reported issue. <!-- BUGBOT_AUTOFIX_AGENT_LINK --></sup> <!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_END --> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit e0f9e00ca2d570b80eb9b8510698f15d42e14efa. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> </details>
ghost1 commented 2026-06-05 12:45:13 +00:00 (Migrated from gitlab.com)

Book leg drops offer on fallback

Medium Severity

When propagate_offer_through_plan hits a hybrid or DB sim error on a hop with a non-zero book_input, the fallback calls query_pool_only_unified with only the pool slice of the offer, not the full hop input (pool + book). The book budget is omitted from the forward simulation, so downstream hops and grid_out can be computed from a truncated amount.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit e0f9e00ca2. Configure here.

### Book leg drops offer on fallback **Medium Severity** <!-- DESCRIPTION START --> When `propagate_offer_through_plan` hits a hybrid or DB sim error on a hop with a non-zero `book_input`, the fallback calls `query_pool_only_unified` with only the `pool` slice of the offer, not the full hop input (`pool + book`). The book budget is omitted from the forward simulation, so downstream hops and `grid_out` can be computed from a truncated amount. <!-- DESCRIPTION END --> <!-- BUGBOT_BUG_ID: 7c48e808-db96-497e-93fe-efbc3d60292b --> <!-- LOCATIONS START indexer/src/api/hybrid_route_opt.rs#L496-L506 LOCATIONS END --> <div><a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9DVVJTT1IiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OjhhOWNhMjZiLWRmZWUtNDRjNy05NzYzLWUxMWY0YTk2ZmU0YyIsImVuY3J5cHRpb25LZXkiOiJXYzZsak1CNDdtWVFaQ2ptVUJLU0RralZuWmltVnFLdFg5SjJCQjNDTzIwIiwiYnJhbmNoIjoiY3Vyc29yL2dpdGxhYi1pc3N1ZS13b3JrZmxvdy1jZjEyIiwicmVwb093bmVyIjoiUGxhc3RpY0RpZ2l0cyIsInJlcG9OYW1lIjoiY2w4eS1kZXgtdGVycmFjbGFzc2ljIn19" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a>&nbsp;<a href="https://cursor.com/agents?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9XRUIiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OjhhOWNhMjZiLWRmZWUtNDRjNy05NzYzLWUxMWY0YTk2ZmU0YyIsImVuY3J5cHRpb25LZXkiOiJXYzZsak1CNDdtWVFaQ2ptVUJLU0RralZuWmltVnFLdFg5SjJCQjNDTzIwIiwiYnJhbmNoIjoiY3Vyc29yL2dpdGxhYi1pc3N1ZS13b3JrZmxvdy1jZjEyIiwicmVwb093bmVyIjoiUGxhc3RpY0RpZ2l0cyIsInJlcG9OYW1lIjoiY2w4eS1kZXgtdGVycmFjbGFzc2ljIiwicHJOdW1iZXIiOjgwLCJjb21taXRTaGEiOiJlMGY5ZTAwY2EyZDU3MGI4MGViOWI4NTEwNjk4ZjE1ZDQyZTE0ZWZhIiwicHJvdmlkZXIiOiJnaXRsYWIiLCJob3N0bmFtZSI6ImdpdGxhYi5jb20ifX0" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-web-light.png"><img alt="Fix in Web" width="99" height="28" src="https://cursor.com/assets/images/fix-in-web-dark.png"></picture></a></div> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit e0f9e00ca2d570b80eb9b8510698f15d42e14efa. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>
ghost1 commented 2026-06-05 12:47:27 +00:00 (Migrated from gitlab.com)

added 1 commit

  • f7c99545 - Fix pool-only fallback to use full hop offer when book sim fails

Compare with previous version

added 1 commit <ul><li>f7c99545 - Fix pool-only fallback to use full hop offer when book sim fails</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/80/diffs?diff_id=1836704967&start_sha=e0f9e00ca2d570b80eb9b8510698f15d42e14efa)
ghost1 commented 2026-06-05 12:47:35 +00:00 (Migrated from gitlab.com)

changed the description

changed the description
ghost1 commented 2026-06-05 12:47:41 +00:00 (Migrated from gitlab.com)

changed the description

changed the description
ghost1 commented 2026-06-05 12:47:53 +00:00 (Migrated from gitlab.com)

resolved all threads

resolved all threads
ghost1 commented 2026-06-05 12:50:06 +00:00 (Migrated from gitlab.com)

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Fix All in Cursor

Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.

Reviewed by Cursor Bugbot for commit f7c9954592. Configure here.

<!-- BUGBOT_REVIEW --> Cursor Bugbot has reviewed your changes and found 1 potential issue. <!-- BUGBOT_FIX_ALL --> <a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9BTExfSU5fQ1VSU09SIiwiZGF0YSI6eyJyZWRpc0tleSI6ImJ1Z2JvdC1tdWx0aTo5YzIxODJiZC0xOGYxLTQ5ZjctYTU4Yi1kYmU4YTQ0YzY1YWIiLCJlbmNyeXB0aW9uS2V5IjoiNlY5cjFfXzZTZ1RNVXY1TjVyVkFFWlNJaEV3S3lUbk9zS01ZNzBqZ2tKZyIsImJyYW5jaCI6ImN1cnNvci9naXRsYWItaXNzdWUtd29ya2Zsb3ctY2YxMiIsInJlcG9Pd25lciI6IlBsYXN0aWNEaWdpdHMiLCJyZXBvTmFtZSI6ImNsOHktZGV4LXRlcnJhY2xhc3NpYyJ9fQ" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix All in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a> <!-- /BUGBOT_FIX_ALL --> <!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_BEGIN --> <sup>Bugbot Autofix is [ON](https://www.cursor.com/dashboard/bugbot). A cloud agent has been kicked off to fix the reported issue. <!-- BUGBOT_AUTOFIX_AGENT_LINK --></sup> <!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_END --> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit f7c99545923f0b622342d3576107aaf5091d9820. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>
ghost1 commented 2026-06-05 12:50:07 +00:00 (Migrated from gitlab.com)

DB tier diverges from LCD

Medium Severity

In global_v2, mirror grid pricing uses resolve_discount_tier (Postgres traders, full fee when missing or unregistered), while per-hop LCD fallback and router simulation still honor on-chain tier via trader/sender. The same request can mix full-fee mirror splits with discounted LCD hops and a tier-aware router quote.

Additional Locations (1)
Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit f7c9954592. Configure here.

### DB tier diverges from LCD **Medium Severity** <!-- DESCRIPTION START --> In `global_v2`, mirror grid pricing uses `resolve_discount_tier` (Postgres `traders`, full fee when missing or unregistered), while per-hop LCD fallback and router simulation still honor on-chain tier via `trader`/`sender`. The same request can mix full-fee mirror splits with discounted LCD hops and a tier-aware router quote. <!-- DESCRIPTION END --> <!-- BUGBOT_BUG_ID: 17b32457-bc0d-4fb7-8124-2c6a7cee480a --> <!-- LOCATIONS START indexer/src/api/best_execution.rs#L251-L301 indexer/src/api/hybrid_route_opt.rs#L168-L221 LOCATIONS END --> <details> <summary>Additional Locations (1)</summary> - [`indexer/src/api/hybrid_route_opt.rs#L168-L221`](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-//blob/f7c99545923f0b622342d3576107aaf5091d9820/indexer/src/api/hybrid_route_opt.rs#L168-L221) </details> <div><a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9DVVJTT1IiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OjU5YzM5ZjhjLWI3NzEtNGNmMC05NTMwLTc3MmE2MDRlM2MxOSIsImVuY3J5cHRpb25LZXkiOiJIQW0xT1hSM2lqMGJoemx5M24zeUpvRUd5R25WVUNEbVFmNmVXTXE5WjVrIiwiYnJhbmNoIjoiY3Vyc29yL2dpdGxhYi1pc3N1ZS13b3JrZmxvdy1jZjEyIiwicmVwb093bmVyIjoiUGxhc3RpY0RpZ2l0cyIsInJlcG9OYW1lIjoiY2w4eS1kZXgtdGVycmFjbGFzc2ljIn19" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a>&nbsp;<a href="https://cursor.com/agents?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9XRUIiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OjU5YzM5ZjhjLWI3NzEtNGNmMC05NTMwLTc3MmE2MDRlM2MxOSIsImVuY3J5cHRpb25LZXkiOiJIQW0xT1hSM2lqMGJoemx5M24zeUpvRUd5R25WVUNEbVFmNmVXTXE5WjVrIiwiYnJhbmNoIjoiY3Vyc29yL2dpdGxhYi1pc3N1ZS13b3JrZmxvdy1jZjEyIiwicmVwb093bmVyIjoiUGxhc3RpY0RpZ2l0cyIsInJlcG9OYW1lIjoiY2w4eS1kZXgtdGVycmFjbGFzc2ljIiwicHJOdW1iZXIiOjgwLCJjb21taXRTaGEiOiJmN2M5OTU0NTkyM2YwYjYyMjM0MmQzNTc2MTA3YWFmNTA5MWQ5ODIwIiwicHJvdmlkZXIiOiJnaXRsYWIiLCJob3N0bmFtZSI6ImdpdGxhYi5jb20ifX0" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-web-light.png"><img alt="Fix in Web" width="99" height="28" src="https://cursor.com/assets/images/fix-in-web-dark.png"></picture></a></div> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit f7c99545923f0b622342d3576107aaf5091d9820. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>
PlasticDigits commented 2026-06-05 12:53:03 +00:00 (Migrated from gitlab.com)

Severity: Medium — LCD/factory amplification (H7)

tokens and pairs are split on commas with no count or length cap before a single query_contract(factory, blacklist_check) LCD call. Each entry is addr_validated in the factory query (query_blacklist_check). An unauthenticated client can send very large comma-separated lists (only bounded by URL/wasm gas), causing O(n) work per request while this route sits on the global governor (default 60 RPS), not lcd_heavy_router (10 RPS).

Impact: Availability — sustained abuse can amplify load on configured LCD nodes (similar class to H7/H7b budgets on limit-book and route solve).

Mitigation: Cap tokens/pairs length (e.g. ≤32 each), reject oversize with 400, validate terra1 format before LCD, and/or register this path on lcd_heavy_router.

**Severity: Medium** — LCD/factory amplification (H7) `tokens` and `pairs` are split on commas with no count or length cap before a single `query_contract(factory, blacklist_check)` LCD call. Each entry is `addr_validate`d in the factory query (`query_blacklist_check`). An unauthenticated client can send very large comma-separated lists (only bounded by URL/wasm gas), causing O(n) work per request while this route sits on the global governor (default 60 RPS), not `lcd_heavy_router` (10 RPS). **Impact:** Availability — sustained abuse can amplify load on configured LCD nodes (similar class to H7/H7b budgets on limit-book and route solve). **Mitigation:** Cap `tokens`/`pairs` length (e.g. ≤32 each), reject oversize with 400, validate `terra1` format before LCD, and/or register this path on `lcd_heavy_router`.
PlasticDigits commented 2026-06-05 12:53:12 +00:00 (Migrated from gitlab.com)

Security review (automated)

Commit reviewed: f7c99545923f0b622342d3576107aaf5091d9820
Scope: Full MR (Phase 1c DB hybrid solver, fidelity guard, mirror snapshot, trading blacklist #308, frontend disclosure, compliance API). Delta since prior review (e0f9e00): pool-only fallback routes full hop offer when book/DB sim fails (f7c9954).

Outcome: FINDINGS: 1 medium+ — see inline thread on indexer/src/api/compliance.rs (~line 51).

New finding

Severity Area Summary
Medium GET /api/v1/compliance/blacklist-check Unbounded tokens/pairs comma lists → single factory LCD query with O(n) addr_validate work; not on lcd_heavy_router (H7 amplification / availability).

Areas reviewed (no additional medium+)

Area Result
SQL injection Mirror reads use bound parameters; get_pair_resting_book only interpolates fixed ASC/DESC for "bid"/"ask".
Quote integrity (#319) Path pick uses router simulate_swap_operations (out_u); apply_fidelity_guard clamps when DB grid_out exceeds router sim beyond ROUTE_FIDELITY_DRIFT_BPS. Reserves + resting book under REPEATABLE READ. Integration test locks drift downgrade.
Trader/tier spoofing Unknown/unregistered subjects → FULL_FEE_TIER_SENTINEL (-1); registered tier only when traders.registered. Router sim authoritative for estimated_amount_out.
f7c9954 fallback Pool-only degrade now passes full hop offer (parity with optimize_one_hop); does not bypass router sim or fidelity guard.
Error disclosure (H6) LCD/DB hybrid errors use sanitized gateway bodies; compliance LCD failures use generic internal_err (no URL echo).
XSS Frontend disclosure/static copy keyed on quote_kind enum; PairSearchSelect text rendering only.
On-chain blacklist (#308) Mutations governance-gated; pair/router trading gates on swap/limit paths.
Cache poisoning Hybrid cache keys include solver_version, tier, trader bucket.

Prior threads

Re-checked automated/Bugbot threads on fee-tier sentinel, DB propagate fallback, mirror-stale quote_kind, torn-read fix, and fidelity drift — addressed in commits through e0f9e00 / 6ac10f3 / 5c3a540. Compliance blacklist-check amplification was not previously reported.

## Security review (automated) **Commit reviewed:** `f7c99545923f0b622342d3576107aaf5091d9820` **Scope:** Full MR (Phase 1c DB hybrid solver, fidelity guard, mirror snapshot, trading blacklist #308, frontend disclosure, compliance API). Delta since prior review (`e0f9e00`): pool-only fallback routes full hop `offer` when book/DB sim fails (`f7c9954`). **Outcome:** `FINDINGS: 1` medium+ — see inline thread on `indexer/src/api/compliance.rs` (~line 51). ### New finding | Severity | Area | Summary | |----------|------|---------| | **Medium** | `GET /api/v1/compliance/blacklist-check` | Unbounded `tokens`/`pairs` comma lists → single factory LCD query with O(n) `addr_validate` work; not on `lcd_heavy_router` (H7 amplification / availability). | ### Areas reviewed (no additional medium+) | Area | Result | |------|--------| | **SQL injection** | Mirror reads use bound parameters; `get_pair_resting_book` only interpolates fixed `ASC`/`DESC` for `"bid"`/`"ask"`. | | **Quote integrity (#319)** | Path pick uses router `simulate_swap_operations` (`out_u`); `apply_fidelity_guard` clamps when DB `grid_out` exceeds router sim beyond `ROUTE_FIDELITY_DRIFT_BPS`. Reserves + resting book under `REPEATABLE READ`. Integration test locks drift downgrade. | | **Trader/tier spoofing** | Unknown/unregistered subjects → `FULL_FEE_TIER_SENTINEL` (-1); registered tier only when `traders.registered`. Router sim authoritative for `estimated_amount_out`. | | **f7c9954 fallback** | Pool-only degrade now passes full hop `offer` (parity with `optimize_one_hop`); does not bypass router sim or fidelity guard. | | **Error disclosure (H6)** | LCD/DB hybrid errors use sanitized gateway bodies; compliance LCD failures use generic `internal_err` (no URL echo). | | **XSS** | Frontend disclosure/static copy keyed on `quote_kind` enum; `PairSearchSelect` text rendering only. | | **On-chain blacklist (#308)** | Mutations governance-gated; pair/router trading gates on swap/limit paths. | | **Cache poisoning** | Hybrid cache keys include `solver_version`, tier, trader bucket. | ### Prior threads Re-checked automated/Bugbot threads on fee-tier sentinel, DB propagate fallback, mirror-stale `quote_kind`, torn-read fix, and fidelity drift — addressed in commits through `e0f9e00` / `6ac10f3` / `5c3a540`. Compliance blacklist-check amplification was not previously reported.
ghost1 commented 2026-06-05 12:53:57 +00:00 (Migrated from gitlab.com)

added 1 commit

  • 96060105 - Fix DB mirror grid using on-chain GetDiscount for fee parity with LCD

Compare with previous version

added 1 commit <ul><li>96060105 - Fix DB mirror grid using on-chain GetDiscount for fee parity with LCD</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/80/diffs?diff_id=1836717519&start_sha=f7c99545923f0b622342d3576107aaf5091d9820)
ghost1 commented 2026-06-05 12:54:12 +00:00 (Migrated from gitlab.com)

changed the description

changed the description
PlasticDigits commented 2026-06-05 12:56:20 +00:00 (Migrated from gitlab.com)

Security review (automated)

Commit reviewed: 9606010571e4952b289870abb1b84d0b5ee57504
Scope: MR diff (17 files, b9121d8..9606010) — Phase 1c DB hybrid route solver: db_orderbook_sim, global_v2 / ROUTE_SOLVER_DB_HYBRID, fidelity guard (ROUTE_FIDELITY_DRIFT_BPS), resolve_discount_bps (on-chain GetDiscount), REPEATABLE READ mirror loads, route-cache solver_version + discount_bps keying, frontend disclosure types, integration tests.

Outcome: FINDINGS: 0 medium+ (no new inline threads).

Areas reviewed

Area Result
SQL injection Mirror reads use bound parameters (pair_id, side); ORDER BY direction is a fixed bid/ask branch only (resting_orders.rs).
LCD amplification (H7) global_v2 prices the hybrid grid from Postgres (bounded path set × 17-point grid); per-hop LCD fallback only on stale/missing mirror; route endpoints remain on lcd_heavy_router (10 RPS). One optional GetDiscount LCD call per solve when FEE_DISCOUNT_ADDRESS is set — not input-sized.
Quote / fee-tier parity 9606010 resolves mirror discount_bps via on-chain GetDiscount (matches pair HybridSimulation / router sim); unregistered/absent subjects use FULL_FEE_TIER_SENTINEL → full fee.
Poisoned-mirror / stale data Staleness gate + fidelity_check drift clamp (ROUTE_FIDELITY_DRIFT_BPS); degraded quote_kind on mirror miss/stale/sim failure.
Error leakage (H6) DB sim failures return generic 502 (Route mirror simulation failed); no LcdError / SQL text in client bodies.
Authn/authz No new mutating routes; mirror tables are indexer-internal.
Frontend XSS New disclosure strings are static; quote_kind rendered as text (no dangerouslySetInnerHTML).
Dependencies No new crates in this MR diff.

Prior inline threads (no re-report)

  • DB tier diverges from LCD (route_solver.rs) — addressed in 9606010 (resolve_discount_bps + GetDiscount).
  • Book leg drops offer on fallback (hybrid_route_opt.rs) — addressed in f7c9954 (pool-only fallback uses full hop offer).
  • Db propagate errors skip LCD fallback — propagate_offer_through_plan now handles HybridSimError::Db like Lcd (pool-only degrade).
  • Compliance blacklist LCD amplification — not in this MR diff (compliance.rs unchanged vs base_sha); out of scope for this delta.

Security review: no medium+ findings on this diff.

## Security review (automated) **Commit reviewed:** `9606010571e4952b289870abb1b84d0b5ee57504` **Scope:** MR diff (17 files, `b9121d8..9606010`) — Phase 1c DB hybrid route solver: `db_orderbook_sim`, `global_v2` / `ROUTE_SOLVER_DB_HYBRID`, fidelity guard (`ROUTE_FIDELITY_DRIFT_BPS`), `resolve_discount_bps` (on-chain `GetDiscount`), REPEATABLE READ mirror loads, route-cache `solver_version` + `discount_bps` keying, frontend disclosure types, integration tests. **Outcome:** `FINDINGS: 0` medium+ (no new inline threads). ### Areas reviewed | Area | Result | |------|--------| | **SQL injection** | Mirror reads use bound parameters (`pair_id`, `side`); `ORDER BY` direction is a fixed `bid`/`ask` branch only (`resting_orders.rs`). | | **LCD amplification (H7)** | `global_v2` prices the hybrid grid from Postgres (bounded path set × 17-point grid); per-hop LCD fallback only on stale/missing mirror; route endpoints remain on `lcd_heavy_router` (10 RPS). One optional `GetDiscount` LCD call per solve when `FEE_DISCOUNT_ADDRESS` is set — not input-sized. | | **Quote / fee-tier parity** | `9606010` resolves mirror `discount_bps` via on-chain `GetDiscount` (matches pair `HybridSimulation` / router sim); unregistered/absent subjects use `FULL_FEE_TIER_SENTINEL` → full fee. | | **Poisoned-mirror / stale data** | Staleness gate + `fidelity_check` drift clamp (`ROUTE_FIDELITY_DRIFT_BPS`); degraded `quote_kind` on mirror miss/stale/sim failure. | | **Error leakage (H6)** | DB sim failures return generic 502 (`Route mirror simulation failed`); no `LcdError` / SQL text in client bodies. | | **Authn/authz** | No new mutating routes; mirror tables are indexer-internal. | | **Frontend XSS** | New disclosure strings are static; `quote_kind` rendered as text (no `dangerouslySetInnerHTML`). | | **Dependencies** | No new crates in this MR diff. | ### Prior inline threads (no re-report) - **DB tier diverges from LCD** (`route_solver.rs`) — addressed in `9606010` (`resolve_discount_bps` + `GetDiscount`). - **Book leg drops offer on fallback** (`hybrid_route_opt.rs`) — addressed in `f7c9954` (pool-only fallback uses full hop `offer`). - **Db propagate errors skip LCD fallback** — `propagate_offer_through_plan` now handles `HybridSimError::Db` like `Lcd` (pool-only degrade). - **Compliance blacklist LCD amplification** — not in this MR diff (`compliance.rs` unchanged vs `base_sha`); out of scope for this delta. Security review: **no medium+ findings** on this diff.
PlasticDigits commented 2026-06-05 13:05:57 +00:00 (Migrated from gitlab.com)

resolved all threads

resolved all threads
ghost1 commented 2026-06-05 13:13:17 +00:00 (Migrated from gitlab.com)

mentioned in commit 0dd92913f8

mentioned in commit 0dd92913f8652dcf627acb52f9d70e15d74d15f2
ghost1 commented 2026-06-05 13:13:17 +00:00 (Migrated from gitlab.com)

added 24 commits

  • 96060105...c90c83b0 - 23 commits from branch main
  • 0dd92913 - merge: resolve main conflicts for MR !798 (#319)

Compare with previous version

added 24 commits <ul><li>96060105...c90c83b0 - 23 commits from branch <code>main</code></li><li>0dd92913 - merge: resolve main conflicts for MR !798 (#319)</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/80/diffs?diff_id=1836757748&start_sha=9606010571e4952b289870abb1b84d0b5ee57504)
PlasticDigits commented 2026-06-05 13:13:57 +00:00 (Migrated from gitlab.com)

changed the description

changed the description
PlasticDigits commented 2026-06-05 13:14:57 +00:00 (Migrated from gitlab.com)

Security review (automated)

Commit reviewed: 0dd92913f8652dcf627acb52f9d70e15d74d15f2
Scope: MR !798 diff vs main (Phase 1c DB hybrid route solver: db_orderbook_sim, global_v2 / ROUTE_SOLVER_DB_HYBRID, fidelity guard, resolve_discount_bps / GetDiscount, mirror preload + REPEATABLE READ loads, route-cache solver_version + discount_bps keying, frontend disclosure). Delta since 9606010: merge commit only (no indexer API changes).

Outcome: FINDINGS: 0 medium+ (no new inline threads).

Areas reviewed

Area Result
SQL injection Mirror reads use bound parameters; ORDER BY direction is fixed bid/ask branch only (resting_orders.rs).
LCD amplification (H7) global_v2 prices the hybrid grid from Postgres (bounded path set × 17-point grid); per-hop LCD fallback only on stale/missing mirror; route endpoints remain on lcd_heavy_router (10 RPS). One optional GetDiscount LCD call per solve when FEE_DISCOUNT_ADDRESS is set — not input-sized.
Quote / fee-tier parity FULL_FEE_TIER_SENTINEL (-1) → full fee in mirror sim; resolve_discount_bps uses on-chain GetDiscount when configured.
Poisoned-mirror / stale data Staleness gate + fidelity_check drift clamp (ROUTE_FIDELITY_DRIFT_BPS); degraded quote_kind on mirror miss/stale/sim failure.
Error leakage (H6) DB sim failures return generic 502 (Route mirror simulation failed); no LcdError / SQL text in client bodies.
Authn/authz No new mutating routes; mirror tables are indexer-internal.
Frontend XSS New disclosure strings are static; quote_kind rendered as text.
Dependencies No new crates in MR feature diff.

Prior inline threads (not re-reported)

  • Unknown tier zero waives fees — fixed (FULL_FEE_TIER_SENTINEL / tier_discount_bps(-1) → 0 discount).
  • Db propagate errors skip LCD fallback — fixed (HybridSimError::Db handled like Lcd in propagate_offer_through_plan).
  • Mirror fallback ignored in quote_kind — fixed (mirror_stale / mirror_missing → degraded kinds).

Security review: no medium+ findings on this diff.

## Security review (automated) **Commit reviewed:** `0dd92913f8652dcf627acb52f9d70e15d74d15f2` **Scope:** MR !798 diff vs `main` (Phase 1c DB hybrid route solver: `db_orderbook_sim`, `global_v2` / `ROUTE_SOLVER_DB_HYBRID`, fidelity guard, `resolve_discount_bps` / `GetDiscount`, mirror preload + REPEATABLE READ loads, route-cache `solver_version` + `discount_bps` keying, frontend disclosure). Delta since `9606010`: merge commit only (no indexer API changes). **Outcome:** `FINDINGS: 0` medium+ (no new inline threads). ### Areas reviewed | Area | Result | |------|--------| | **SQL injection** | Mirror reads use bound parameters; `ORDER BY` direction is fixed `bid`/`ask` branch only (`resting_orders.rs`). | | **LCD amplification (H7)** | `global_v2` prices the hybrid grid from Postgres (bounded path set × 17-point grid); per-hop LCD fallback only on stale/missing mirror; route endpoints remain on `lcd_heavy_router` (10 RPS). One optional `GetDiscount` LCD call per solve when `FEE_DISCOUNT_ADDRESS` is set — not input-sized. | | **Quote / fee-tier parity** | `FULL_FEE_TIER_SENTINEL` (-1) → full fee in mirror sim; `resolve_discount_bps` uses on-chain `GetDiscount` when configured. | | **Poisoned-mirror / stale data** | Staleness gate + `fidelity_check` drift clamp (`ROUTE_FIDELITY_DRIFT_BPS`); degraded `quote_kind` on mirror miss/stale/sim failure. | | **Error leakage (H6)** | DB sim failures return generic 502 (`Route mirror simulation failed`); no `LcdError` / SQL text in client bodies. | | **Authn/authz** | No new mutating routes; mirror tables are indexer-internal. | | **Frontend XSS** | New disclosure strings are static; `quote_kind` rendered as text. | | **Dependencies** | No new crates in MR feature diff. | ### Prior inline threads (not re-reported) - **Unknown tier zero waives fees** — fixed (`FULL_FEE_TIER_SENTINEL` / `tier_discount_bps(-1) → 0` discount). - **Db propagate errors skip LCD fallback** — fixed (`HybridSimError::Db` handled like `Lcd` in `propagate_offer_through_plan`). - **Mirror fallback ignored in quote_kind** — fixed (`mirror_stale` / `mirror_missing` → degraded kinds). Security review: **no medium+ findings** on this diff.
PlasticDigits (Migrated from gitlab.com) merged commit c0dd1104eb into main 2026-06-05 13:19:37 +00:00
PlasticDigits commented 2026-06-05 13:19:39 +00:00 (Migrated from gitlab.com)

mentioned in commit c0dd1104eb

mentioned in commit c0dd1104eb15bf92d2116364cec8ac944ac78b6c
PlasticDigits commented 2026-06-08 08:43:12 +00:00 (Migrated from gitlab.com)

mentioned in commit 620710448d

mentioned in commit 620710448db5a10e797e0084e59eed88b43d7b50
PlasticDigits commented 2026-06-08 08:43:13 +00:00 (Migrated from gitlab.com)

mentioned in commit abe16fc6a7

mentioned in commit abe16fc6a746780e666343d5bf2e84de2d02db48
Sign in to join this conversation.
No reviewers
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
code/cl8y-dex-terraclassic!798
No description provided.