feat(indexer): Phase 1c DB hybrid route solver (#319) #798
No reviewers
Labels
No labels
agent:fix_bugfix
agent:fix_conflicts
agent:fix_security
agent:gap_analysis
agent:implement
agent:implement
agent:implement
agent:open_issues
agent:ready
agent:research
agent:security_audit
agent:verify
architecture
backend
blocker:hybrid
blocker:launch
blocker:limit-orders
blocker:v2
block:log_only
block:security
bug
ci
contracts
correctness
deploy
dev
devops
docs
documentation
duplicate
e2e
enhancement
epic
feature
frontend
functional-completion
gas
good first issue
governance
help wanted
high-risk
hooks
hybrid
indexer
infra
infrastructure
integrators
invalid
launch-blocker
limit-orders
localnet
localterra
low priority
missing-implementation
needs-design
ops
performance
priority
high
priority
medium
product
qa
QA
question
ready
ready
research
scripts
security
security-hardening
smartcontracts
tech-debt
testing
ux
UX
v2
verification
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
code/cl8y-dex-terraclassic!798
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "cursor/gitlab-issue-workflow-cf12"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Implements https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/work_items/319 —
db_orderbook_sim,global_v2DB hybrid solver (ROUTE_SOLVER_DB_HYBRID), router fidelity guard, newquote_kindvalues. Production enable still requires a healthy #322 book snapshot loop before settingROUTE_SOLVER_DB_HYBRID=1.Related to #319 (Phase 1c code complete in this MR; full issue closure blocked on #322 ops + manual localnet drift smoke per issue verification).
Merge with main checklist
origin/mainconflict-freegit merge origin/mainoncursor/gitlab-issue-workflow-cf120dd9291)global_v2(#319) + #306 cache tests + max 4 hops (#323)docs/indexer-invariants.mdroute rowsindexer/tests/common/lcd_mock.rscompilescd indexer && cargo checkcd indexer && cargo test --libmake test-frontendchanged the description
mentioned in issue #319
changed the description
Stale Security Review comment
Stale Security Review comment
Stale Security Review comment
Stale Security Review comment
Stale Security Review comment
Stale Security Review comment
Stale Security Review comment
Cursor Bugbot has reviewed your changes and found 2 potential issues.
Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issues.
Reviewed by Cursor Bugbot for commit
233eb6be64. Configure here.Db propagate errors skip LCD fallback
Medium Severity
In
propagate_offer_through_plan,HybridSimError::Lcdtriggers pool-only LCD fallback, butHybridSimError::Dbaborts the whole solve. Inglobal_v2, a mirrorDbSimErroron an already-chosen hybrid leg (e.g.InsufficientLiquidityorInvalidNumeric) can return 502 instead of degrading like the LCD path.Reviewed by Cursor Bugbot for commit
233eb6be64. Configure here.Unknown tier zero waives fees
High Severity
global_v2mapsresolve_discount_tier’s sentinel0(notrader/sender, or wallet absent fromtraders) throughtier_discount_bps(0)as governance tier 0 (100%discount_bps), soeffective_fee_bpsbecomes zero. PairHybridSimulationand router sim use fullfee_bpswhentraderis omitted or unregistered, so mirror grid quotes and splits are systematically too optimistic unless fidelity drift catches them.Additional Locations (1)
indexer/src/api/route_solver.rs#L560-L573Reviewed by Cursor Bugbot for commit
233eb6be64. Configure here.Security review (automated)
Commit reviewed:
233eb6be646ea4ab610a0744730815ce875f54ffScope: Phase 1c DB hybrid route solver —
db_orderbook_sim,global_v2/ROUTE_SOLVER_DB_HYBRID, fidelity guard (ROUTE_FIDELITY_DRIFT_BPS), route cache/solver metadata, frontend disclosure types, integration tests.Outcome:
FINDINGS: 0medium+ (no inline threads).Areas reviewed
pair_id,side);get_pair_resting_bookonly interpolates fixedASC/DESCfor a hard-coded side literal.simulate_swap_operationsoutput;apply_fidelity_guardclamps when mirror grid exceeds router sim beyond drift bps and downgradesquote_kind. Integration test covers drift path.trader/senderstill optional query params (pre-#245); DB tier for mirror sim is keyed in cache (#283) and aligned with LCD/router via same subject — stale indexer tier inflation is mitigated by fidelity vs on-chain router sim.quote_kindenum only.solver_version(global_v1vsglobal_v2) plus existing tier/trader bucket fields.Notes (informational, below reporting threshold)
ROUTE_SOLVER_DB_HYBRIDbefore the #322 snapshot loop is an operational readiness concern (stale/missing mirror → LCD fallback), not a direct unauthenticated exploit on this diff.global_v1; bounded in-memory grid work after mirror preload.Prior MR security threads: none to re-report.
Automated security review — Cursor Cloud Agent
changed this line in version 2 of the diff
added 1 commit
616c44c6- Fix full-fee sentinel and DB propagate fallback in hybrid route solverCompare with previous version
changed the description
resolved all threads
resolved all threads
Stale Security Review comment
Stale Security Review comment
Stale Security Review comment
Stale Security Review comment
Stale Security Review comment
Stale Security Review comment
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.
Reviewed by Cursor Bugbot for commit
616c44c6e9. Configure here.Mirror fallback ignored in quote
Medium Severity
In
global_v2, stale or missing Postgres mirrors trigger per-hop LCDHybridSimulationduring grid search, butquote_kind_fornever treats that as degradation. Responses can still showindexer_hybrid_db/indexer_pool_dbeven when optimization used LCD, contradictingIndexerHybridDbDegradedand frontend mirror/LCD disclosure.Additional Locations (2)
indexer/src/api/best_execution.rs#L327-L342indexer/src/api/best_execution.rs#L392-L402Reviewed by Cursor Bugbot for commit
616c44c6e9. Configure here.Security review (automated)
Commit reviewed:
616c44c6e92cf973d5c1993ce80cdf54b8e3a0deScope: Phase 1c DB hybrid route solver (
db_orderbook_sim,global_v2/ROUTE_SOLVER_DB_HYBRID, fidelity guard, route cache/solver metadata, frontend disclosure, integration tests). Re-reviewed prior Bugbot threads on fee-tier sentinel and DB propagate fallback (addressed in this commit).Outcome:
FINDINGS: 0medium+ (no inline threads).Areas reviewed
pair_id,side);get_pair_resting_bookonly interpolates fixedASC/DESCfor hard-coded"bid"/"ask"literals.simulate_swap_operationsoutput;apply_fidelity_guardclamps when mirror grid exceeds router sim beyondROUTE_FIDELITY_DRIFT_BPSand downgradesquote_kind. Integration test covers drift.trader/senderparams unchanged (#245); unknown subjects now useFULL_FEE_TIER_SENTINEL(-1) for mirror fee math (fixes prior 100%-discount mirror mispricing). Router sim remains authoritative forestimated_amount_out.HybridSimError::Dbmaps to generic 502; no LCD paths/URLs in client body.quote_kindenum only.solver_version(global_v1vsglobal_v2) plus existing tier/trader bucket fields.propagate_offer_through_plannow falls back to pool-only onHybridSimError::Db(parity with LCD path).Notes (informational, below reporting threshold)
quote_kinddoes not yet reflect mirror-stale/missing LCD fallback during grid search (Bugbot disclosure thread);estimated_amount_outstill comes from router sim andhybrid_notesexpose lcd/db query counts — not a standalone unauthenticated exploit path on this diff.ROUTE_SOLVER_DB_HYBRIDbefore the #322 snapshot loop is an operational readiness concern, not a direct external auth bypass.added 1 commit
0e6b0c12- fix(indexer): treat mirror stale/missing as degraded in quote_kind_forCompare with previous version
changed the description
Security review (automated)
Commit reviewed:
0e6b0c12847f0723c407cce4fc2478be986c988bScope: Phase 1c DB hybrid route solver —
db_orderbook_sim,global_v2/ROUTE_SOLVER_DB_HYBRID, fidelity guard (ROUTE_FIDELITY_DRIFT_BPS), route cache/solver metadata, frontend disclosure types, integration tests. Delta since prior review:quote_kind_fornow marks mirror-stale/missing hops as degraded (0e6b0c1).Outcome:
FINDINGS: 0medium+ (no inline threads).Areas reviewed
pair_id,side);get_pair_resting_bookonly interpolates fixedASC/DESCfor hard-coded"bid"/"ask"literals.simulate_swap_operationsoutput;apply_fidelity_guardclamps when mirror grid exceeds router sim beyondROUTE_FIDELITY_DRIFT_BPSand downgradesquote_kind. Integration test covers drift.trader/senderparams unchanged (#245); unknown subjects useFULL_FEE_TIER_SENTINEL(-1) for mirror fee math (fixes prior 100%-discount mirror mispricing in616c44c). Router sim remains authoritative forestimated_amount_out.HybridSimError::Dbmaps to generic 502; no LCD paths/URLs in client body.quote_kindenum only.solver_version(global_v1vsglobal_v2) plus existing tier/trader bucket fields.propagate_offer_through_planfalls back to pool-only onHybridSimError::Db(parity with LCD path,616c44c).Prior threads
Re-checked Bugbot threads on fee-tier sentinel, DB propagate fallback, and mirror-stale
quote_kind— all addressed in616c44c/0e6b0c1; no remaining medium+ exploit path on this diff.Notes (informational, below reporting threshold)
ROUTE_SOLVER_DB_HYBRIDbefore the #322 snapshot loop is an operational readiness concern (stale/missing mirror → LCD fallback), not a direct unauthenticated exploit on this diff.global_v1; grid work is bounded after mirror preload.Automated security review — Cursor Cloud Agent
Stale Security Review comment
Stale Security Review comment
Stale Security Review comment
Stale Security Review comment
Stale Security Review comment
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.
Reviewed by Cursor Bugbot for commit
0e6b0c1284. Configure here.Hybrid propagate pool-only over-counts
Medium Severity
In
propagate_offer_through_plan, when a planned hybrid simulation fails, the fallback runs pool-only pricing on the full hopoffer(pool_input + book_input) instead of only the plannedpool_input. That can inflate intermediate hop outputs during coordinate refinement and skewgrid_outused for the fidelity guard, even though the returnedrouter_operationsstill reflect the original split.Reviewed by Cursor Bugbot for commit
0e6b0c1284. Configure here.added 1 commit
c4b9f58c- Fix hybrid propagate pool-only fallback to use planned pool sliceCompare with previous version
changed the description
Stale Security Review comment
Stale Security Review comment
Stale Security Review comment
Stale Security Review comment
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.
Reviewed by Cursor Bugbot for commit
c4b9f58c72. Configure here.Default tier_id zero max discount
High Severity
For
global_v2,resolve_discount_tierreturns a wallet’s rawtraders.tier_id. New rows default to0, whichtier_discount_bpstreats as a 100% fee discount, so Postgres mirror grid pricing can assume zero swap fees while LCD/router sim still charges full fees for the sametrader/sender.Additional Locations (1)
indexer/src/api/db_orderbook_sim.rs#L20-L37Reviewed by Cursor Bugbot for commit
c4b9f58c72. Configure here.Security review (automated)
Commit reviewed:
c4b9f58c729e991ac4fbe115e9268ea1a7fd1e4fScope: Phase 1c DB hybrid route solver —
db_orderbook_sim,global_v2/ROUTE_SOLVER_DB_HYBRID, fidelity guard (ROUTE_FIDELITY_DRIFT_BPS), route cache/solver metadata, frontend disclosure types, integration tests.Outcome:
FINDINGS: 0medium+ (no inline threads).Areas reviewed
pair_id,side);get_pair_resting_bookonly interpolates fixedASC/DESCfor hard-coded"bid"/"ask"literals.simulate_swap_operationsoutput (out_u);apply_fidelity_guardclamps when mirrorgrid_outexceeds router sim beyondROUTE_FIDELITY_DRIFT_BPSand downgradesquote_kind. Integration testroute_solve_db_hybrid_fidelity_drift_downgradeslocks the drift path.trader/senderparams unchanged (#245). Unknown/absent subjects resolve toFULL_FEE_TIER_SENTINEL(-1) for mirror fee math (616c44c).estimated_amount_outremains router-sim authoritative, so staletraders.tier_id = 0defaults cannot inflate displayed output—only mirror grid planning (mitigated by fidelity).HybridSimError::Dbmaps to generic 502; no LCD paths/URLs in client body.quote_kindenum only.solver_version(global_v1vsglobal_v2) plus existing tier/trader bucket fields.propagate_offer_through_planfalls back to pool-only onHybridSimError::Dband uses plannedpool_inputslice when a book leg was planned (c4b9f58c).Prior threads
Re-checked Bugbot threads on fee-tier sentinel, DB propagate fallback, mirror-stale
quote_kind, and pool-only over-count — addressed in616c44c/0e6b0c1/c4b9f58c; no remaining medium+ exploit path on this diff.Notes (informational, below reporting threshold)
ROUTE_SOLVER_DB_HYBRIDbefore the #322 snapshot loop is an operational readiness concern (stale/missing mirror → LCD fallback), not a direct unauthenticated exploit on this diff.traders.tier_id = 0before tier sync can skew mirror grid fee assumptions; consider treatingregistered = falselikeFULL_FEE_TIER_SENTINELfor correctness (router output already bounds user-facing amounts).Automated security review — Cursor Cloud Agent
added 1 commit
1aeeed6a- fix(indexer): treat unregistered traders as full-fee in discount tier lookupCompare with previous version
changed the description
Stale Security Review comment
Stale Security Review comment
Stale Security Review comment
Cursor Bugbot has reviewed your changes and found 2 potential issues.
Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issues.
Reviewed by Cursor Bugbot for commit
1aeeed6ae5. Configure here.Fidelity drift mislabels pool-only quotes
Low Severity
When
fidelity_checkisdrift, the handler always setsquote_kindtoindexer_hybrid_db_degraded, even if the chosen plan has no book legs (any_book_legfalse). Pool-onlyglobal_v2routes can be disclosed as hybrid-degraded incorrectly.Reviewed by Cursor Bugbot for commit
1aeeed6ae5. Configure here.Non-atomic mirror load torn reads
Medium Severity
load_hop_mirrorloadspair_reservesandresting_limit_ordersin separate queries without a shared transaction. If the #322 snapshot commits between them, the hop mirror can pair fresh reserves with an older book (or vice versa) while still markedFresh, skewing hybrid grid pricing until fidelity catches it.Reviewed by Cursor Bugbot for commit
1aeeed6ae5. Configure here.Security review (automated)
Commit reviewed:
1aeeed6ae514056d40b500326aba64975fb05a25Scope: Phase 1c DB hybrid route solver —
db_orderbook_sim,global_v2/ROUTE_SOLVER_DB_HYBRID, fidelity guard (ROUTE_FIDELITY_DRIFT_BPS),resolve_discount_tier/ fee-tier mirror parity, route cache/solver metadata, frontend disclosure types, integration tests. Delta since prior review: unregisteredtradersrows no longer pass schema-defaulttier_id=0into mirror fee math (1aeeed6a).Outcome:
FINDINGS: 0medium+ (no inline threads).Areas reviewed
pair_reserves,resting_limit_orders,pairs,traders) use bound parameters; pair addresses on the hot path come from indexed graph enumeration, not raw user strings in SQL.resolve_discount_tiernow returnsFULL_FEE_TIER_SENTINEL(-1→ 0% discount) unlesstraders.registered=true; fixes prior high-severity path where upserted-but-unregistered wallets inheritedtier_id=0(100% discount) in Postgres grid pricing.ROUTER_ADDRESSis configured,estimated_amount_outis always routersimulate_swap_operationsoutput; fidelity guard only downgradesquote_kindand clamps when DBgrid_outexceeds router sim beyondROUTE_FIDELITY_DRIFT_BPS. Attacker cannot inflate returned amounts via mirror manipulation alone.mirror_stale/mirror_missingreflected inquote_kind;propagate_offer_through_planpool-only fallback uses plannedpool_inputwhen a book leg was planned (not full hop offer).solver_versionand resolveddiscount_tier; tier-based sharing is intentional (#283).trader/sendervalidated asterra1alphanumeric;token_in/token_outresolved against indexed assets (400 on unknown).Prior threads (re-checked)
Bugbot/security threads on fee-tier sentinel, DB propagate fallback, mirror-stale
quote_kind, and propagate pool-only over-counting are addressed in the current diff; no remaining exploitable attack path traced from request parameters to a harmful sink.Security review: no medium+ findings on this diff.
changed this line in version 6 of the diff
changed this line in version 6 of the diff
added 1 commit
6ac10f31- Fix torn mirror reads and pool-only fidelity quote_kindCompare with previous version
changed the description
Security review (automated)
Commit reviewed:
6ac10f3173afa0db10e3410a2d2c6a7200825068Scope: Phase 1c DB hybrid route solver —
db_orderbook_sim,global_v2/ROUTE_SOLVER_DB_HYBRID, fidelity guard (ROUTE_FIDELITY_DRIFT_BPS), REPEATABLE READ mirror loads, route cache/solver metadata, frontend disclosure types, integration tests. Delta since prior review: torn-read fix + fidelityquote_kind_foron drift (6ac10f3).Outcome:
FINDINGS: 0medium+ (no inline threads).Areas reviewed
pair_id,side);get_pair_resting_bookonly interpolates fixedASC/DESCfor hard-coded"bid"/"ask"literals.simulate_swap_operationsoutput;apply_fidelity_guardclamps when mirror grid exceeds router sim beyondROUTE_FIDELITY_DRIFT_BPSand downgradesquote_kind. Reserves + resting book are read underREPEATABLE READin one transaction (6ac10f3). Integration test covers drift downgrade.trader/senderparams unchanged (#245); unknown/unregistered subjects useFULL_FEE_TIER_SENTINEL(-1) for mirror fee math; registeredtier_idonly whentraders.registeredis true. Router sim remains authoritative forestimated_amount_out.HybridSimError::Dbmaps to generic 502; no LCD paths/URLs in client body.quote_kindenum only.solver_version(global_v1vsglobal_v2) plus existing tier/trader bucket fields.propagate_offer_through_planfalls back to pool-only onHybridSimError::Dbusing the plannedpoolslice whenbook > 0(parity with LCD path).Prior threads
Re-checked Bugbot threads on fee-tier sentinel, DB propagate fallback, mirror-stale
quote_kind, pool-only propagate slice, and defaulttier_id— addressed in616c44c/0e6b0c1/c4b9f58/6ac10f3; no remaining medium+ exploit path on this diff.Notes (informational, below reporting threshold)
ROUTE_SOLVER_DB_HYBRIDbefore the #322 snapshot loop is an operational readiness concern (stale/missing mirror → LCD fallback), not a direct unauthenticated exploit on this diff.global_v1; grid work is bounded after mirror preload.Automated security review — Cursor Cloud Agent
Stale Security Review comment
Stale Security Review comment
Cursor Bugbot has reviewed your changes and found 2 potential issues.
Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issues.
Reviewed by Cursor Bugbot for commit
6ac10f3173. Configure here.Fidelity drift mislabels quote kind
Medium Severity
When
global_v2fidelity guard recordsfidelity_check: drift, the special-casequote_kindrefresh passesdegraded: meta.degraded && meta.any_book_leginstead ofmeta.degraded. Pool-only mirror routes (no book leg) can stayindexer_pool_dbwhile the response already flags drift and clampsestimated_amount_out, contradictingRouteQuoteKinddocs and the new integration test.Reviewed by Cursor Bugbot for commit
6ac10f3173. Configure here.Zero sim skips degraded flag
Low Severity
In
apply_fidelity_guard, when routerestimated_amount_outparses to zero but the mirror grid output is positive, the code setsfidelity_checktodriftand returns without settingmeta.degraded. Downstream labeling and notes that rely onmeta.degradedcan disagree withfidelity_check: drift.Reviewed by Cursor Bugbot for commit
6ac10f3173. Configure here.added 1 commit
5c3a5408- Fix fidelity drift degraded flag and quote_kind labelingCompare with previous version
changed the description
Security review (automated)
Commit reviewed:
5c3a5408b8b2297cfa35f105e1fdf674247c5863Scope: Phase 1c DB hybrid route solver —
db_orderbook_sim,global_v2/ROUTE_SOLVER_DB_HYBRID, fidelity guard (ROUTE_FIDELITY_DRIFT_BPS), REPEATABLE READ mirror loads,resolve_discount_tier/FULL_FEE_TIER_SENTINEL, route cachesolver_versionkeying, frontend disclosure types, integration tests. Delta since prior review (6ac10f3): fidelity drift setsmeta.degradedon zero-router-sim path; driftquote_kind_forusesmeta.degradedwithoutany_book_leggate (5c3a540).Outcome:
FINDINGS: 0medium+ (no inline threads).Areas reviewed
pair_id,side);get_pair_resting_bookonly interpolates fixedASC/DESCfor hard-coded"bid"/"ask"literals.simulate_swap_operationsoutput;apply_fidelity_guardclamps when mirrorgrid_outexceeds router sim beyondROUTE_FIDELITY_DRIFT_BPSand downgradesquote_kind. Reserves + resting book read underREPEATABLE READin one transaction. Integration testroute_solve_db_hybrid_fidelity_drift_downgradeslocks drift downgrade.trader/sendervalidated asterra1alphanumeric; unknown/unregistered subjects useFULL_FEE_TIER_SENTINEL(-1). Router sim remains authoritative forestimated_amount_out.HybridSimError::Dbmaps to generic 502; no LCD paths/URLs in client body.quote_kindenum only.solver_version(global_v1vsglobal_v2) plus existing tier/trader bucket fields.propagate_offer_through_planfalls back to pool-only on sim error using plannedpoolslice whenbook > 0. Grid work bounded (≤5 paths × ≤3 hops × fixed grid).Prior threads (re-checked)
Bugbot/security threads on fee-tier sentinel (
1aeeed6a), DB propagate fallback (c4b9f58), torn-read fix (6ac10f3), and fidelityquote_kind/degraded labeling (5c3a540) — addressed on this diff; no remaining medium+ exploit path traced from request parameters to a harmful sink.Security review: no medium+ findings on this diff.
Automated security review — Cursor Cloud Agent
resolved all threads
mentioned in commit
e0f9e00ca2added 13 commits
maine0f9e00c- merge: resolve main conflicts for MR !798 (#319)Compare with previous version
changed the description
changed the description
Security review (automated)
Commit reviewed:
e0f9e00ca2d570b80eb9b8510698f15d42e14efaScope: Phase 1c DB hybrid route solver —
db_orderbook_sim,global_v2/ROUTE_SOLVER_DB_HYBRID, fidelity guard (ROUTE_FIDELITY_DRIFT_BPS), REPEATABLE READ mirror loads,resolve_discount_tier/FULL_FEE_TIER_SENTINEL, route cachesolver_versionkeying, frontend disclosure types, integration tests. Delta since prior review (5c3a540): main merge —GET_DEFAULT_MAX_HOPS3→4 (#323), docs/frontend 4xx-vs-outage (#326), budget test/doc alignment.Outcome:
FINDINGS: 0medium+ (no inline threads).Areas reviewed
pair_id,side);get_pair_resting_bookonly interpolates fixedASC/DESCfor hard-coded"bid"/"ask"literals.simulate_swap_operationsoutput;apply_fidelity_guardclamps when mirrorgrid_outexceeds router sim beyondROUTE_FIDELITY_DRIFT_BPSand downgradesquote_kind. Reserves + resting book read underREPEATABLE READin one transaction. Integration testroute_solve_db_hybrid_fidelity_drift_downgradeslocks drift downgrade.trader/sendervalidated asterra1addresses; unknown/unregistered subjects resolve toFULL_FEE_TIER_SENTINEL(-1 → 0% mirror discount). Router sim remains authoritative forestimated_amount_out.HybridSimError::Dbmaps to generic 502; no LCD paths/URLs in client body.quote_kindenum only.solver_version, normalized tokens, amount bucket,max_maker_fills, trader address, and resolveddiscount_tier.GET_DEFAULT_MAX_HOPS4 raises theoretical grid budget to 1700 (was 1275 at 3 hops); work remains bounded (top-5 paths × 17 grid × coordinate passes) and LCD-heavy routes stay rate-limited. DB hybrid mode reduces LCD fanout vs v1.Prior threads
Earlier inline findings (fee-tier sentinel, torn mirror reads, propagate fallback, mirror-stale
quote_kind) are addressed on this branch — not re-reported.Security review: no medium+ findings on this diff.
Stale Security Review comment
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.
Reviewed by Cursor Bugbot for commit
e0f9e00ca2. Configure here.Book leg drops offer on fallback
Medium Severity
When
propagate_offer_through_planhits a hybrid or DB sim error on a hop with a non-zerobook_input, the fallback callsquery_pool_only_unifiedwith only thepoolslice of the offer, not the full hop input (pool + book). The book budget is omitted from the forward simulation, so downstream hops andgrid_outcan be computed from a truncated amount.Reviewed by Cursor Bugbot for commit
e0f9e00ca2. Configure here.added 1 commit
f7c99545- Fix pool-only fallback to use full hop offer when book sim failsCompare with previous version
changed the description
changed the description
resolved all threads
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.
Reviewed by Cursor Bugbot for commit
f7c9954592. Configure here.DB tier diverges from LCD
Medium Severity
In
global_v2, mirror grid pricing usesresolve_discount_tier(Postgrestraders, full fee when missing or unregistered), while per-hop LCD fallback and router simulation still honor on-chain tier viatrader/sender. The same request can mix full-fee mirror splits with discounted LCD hops and a tier-aware router quote.Additional Locations (1)
indexer/src/api/hybrid_route_opt.rs#L168-L221Reviewed by Cursor Bugbot for commit
f7c9954592. Configure here.Severity: Medium — LCD/factory amplification (H7)
tokensandpairsare split on commas with no count or length cap before a singlequery_contract(factory, blacklist_check)LCD call. Each entry isaddr_validated in the factory query (query_blacklist_check). An unauthenticated client can send very large comma-separated lists (only bounded by URL/wasm gas), causing O(n) work per request while this route sits on the global governor (default 60 RPS), notlcd_heavy_router(10 RPS).Impact: Availability — sustained abuse can amplify load on configured LCD nodes (similar class to H7/H7b budgets on limit-book and route solve).
Mitigation: Cap
tokens/pairslength (e.g. ≤32 each), reject oversize with 400, validateterra1format before LCD, and/or register this path onlcd_heavy_router.Security review (automated)
Commit reviewed:
f7c99545923f0b622342d3576107aaf5091d9820Scope: Full MR (Phase 1c DB hybrid solver, fidelity guard, mirror snapshot, trading blacklist #308, frontend disclosure, compliance API). Delta since prior review (
e0f9e00): pool-only fallback routes full hopofferwhen book/DB sim fails (f7c9954).Outcome:
FINDINGS: 1medium+ — see inline thread onindexer/src/api/compliance.rs(~line 51).New finding
GET /api/v1/compliance/blacklist-checktokens/pairscomma lists → single factory LCD query with O(n)addr_validatework; not onlcd_heavy_router(H7 amplification / availability).Areas reviewed (no additional medium+)
get_pair_resting_bookonly interpolates fixedASC/DESCfor"bid"/"ask".simulate_swap_operations(out_u);apply_fidelity_guardclamps when DBgrid_outexceeds router sim beyondROUTE_FIDELITY_DRIFT_BPS. Reserves + resting book underREPEATABLE READ. Integration test locks drift downgrade.FULL_FEE_TIER_SENTINEL(-1); registered tier only whentraders.registered. Router sim authoritative forestimated_amount_out.f7c9954fallbackoffer(parity withoptimize_one_hop); does not bypass router sim or fidelity guard.internal_err(no URL echo).quote_kindenum;PairSearchSelecttext rendering only.solver_version, tier, trader bucket.Prior threads
Re-checked automated/Bugbot threads on fee-tier sentinel, DB propagate fallback, mirror-stale
quote_kind, torn-read fix, and fidelity drift — addressed in commits throughe0f9e00/6ac10f3/5c3a540. Compliance blacklist-check amplification was not previously reported.added 1 commit
96060105- Fix DB mirror grid using on-chain GetDiscount for fee parity with LCDCompare with previous version
changed the description
Security review (automated)
Commit reviewed:
9606010571e4952b289870abb1b84d0b5ee57504Scope: MR diff (17 files,
b9121d8..9606010) — Phase 1c DB hybrid route solver:db_orderbook_sim,global_v2/ROUTE_SOLVER_DB_HYBRID, fidelity guard (ROUTE_FIDELITY_DRIFT_BPS),resolve_discount_bps(on-chainGetDiscount), REPEATABLE READ mirror loads, route-cachesolver_version+discount_bpskeying, frontend disclosure types, integration tests.Outcome:
FINDINGS: 0medium+ (no new inline threads).Areas reviewed
pair_id,side);ORDER BYdirection is a fixedbid/askbranch only (resting_orders.rs).global_v2prices the hybrid grid from Postgres (bounded path set × 17-point grid); per-hop LCD fallback only on stale/missing mirror; route endpoints remain onlcd_heavy_router(10 RPS). One optionalGetDiscountLCD call per solve whenFEE_DISCOUNT_ADDRESSis set — not input-sized.9606010resolves mirrordiscount_bpsvia on-chainGetDiscount(matches pairHybridSimulation/ router sim); unregistered/absent subjects useFULL_FEE_TIER_SENTINEL→ full fee.fidelity_checkdrift clamp (ROUTE_FIDELITY_DRIFT_BPS); degradedquote_kindon mirror miss/stale/sim failure.Route mirror simulation failed); noLcdError/ SQL text in client bodies.quote_kindrendered as text (nodangerouslySetInnerHTML).Prior inline threads (no re-report)
route_solver.rs) — addressed in9606010(resolve_discount_bps+GetDiscount).hybrid_route_opt.rs) — addressed inf7c9954(pool-only fallback uses full hopoffer).propagate_offer_through_plannow handlesHybridSimError::DblikeLcd(pool-only degrade).compliance.rsunchanged vsbase_sha); out of scope for this delta.Security review: no medium+ findings on this diff.
resolved all threads
mentioned in commit
0dd92913f8added 24 commits
main0dd92913- merge: resolve main conflicts for MR !798 (#319)Compare with previous version
changed the description
Security review (automated)
Commit reviewed:
0dd92913f8652dcf627acb52f9d70e15d74d15f2Scope: MR !798 diff vs
main(Phase 1c DB hybrid route solver:db_orderbook_sim,global_v2/ROUTE_SOLVER_DB_HYBRID, fidelity guard,resolve_discount_bps/GetDiscount, mirror preload + REPEATABLE READ loads, route-cachesolver_version+discount_bpskeying, frontend disclosure). Delta since9606010: merge commit only (no indexer API changes).Outcome:
FINDINGS: 0medium+ (no new inline threads).Areas reviewed
ORDER BYdirection is fixedbid/askbranch only (resting_orders.rs).global_v2prices the hybrid grid from Postgres (bounded path set × 17-point grid); per-hop LCD fallback only on stale/missing mirror; route endpoints remain onlcd_heavy_router(10 RPS). One optionalGetDiscountLCD call per solve whenFEE_DISCOUNT_ADDRESSis set — not input-sized.FULL_FEE_TIER_SENTINEL(-1) → full fee in mirror sim;resolve_discount_bpsuses on-chainGetDiscountwhen configured.fidelity_checkdrift clamp (ROUTE_FIDELITY_DRIFT_BPS); degradedquote_kindon mirror miss/stale/sim failure.Route mirror simulation failed); noLcdError/ SQL text in client bodies.quote_kindrendered as text.Prior inline threads (not re-reported)
FULL_FEE_TIER_SENTINEL/tier_discount_bps(-1) → 0discount).HybridSimError::Dbhandled likeLcdinpropagate_offer_through_plan).mirror_stale/mirror_missing→ degraded kinds).Security review: no medium+ findings on this diff.
mentioned in commit
c0dd1104ebmentioned in commit
620710448dmentioned in commit
abe16fc6a7