qa(#285): live-proof harness + L285 indexer invariants #799

Merged

PlasticDigits merged 6 commits from cursor/gitlab-issue-verification-cd8d into main 2026-06-05 13:06:30 +00:00

Conversation 32 Commits 6 Files changed 7 +53 -15

PlasticDigits commented 2026-06-05 11:23:17 +00:00 (Migrated from gitlab.com)

Copy link

Summary

Verification QA for GitLab #285 — confirms the parser fix on main (runtime _contract_address only) meets all acceptance criteria, including the live positive control requested by @PlasticDigits.

Parser fix is already on main — this MR adds guardrails only:

• scripts/qa/verify-issue-285.sh + make verify-issue-285
• docs/indexer-invariants.md — L285 lifecycle emitter scoping row
• skills/AGENTS_INDEXER_LIFECYCLE_EMITTER_SCOPING.md
• Cloud Agent docker fallback (sg docker) so live leg runs without manual wrapper

Supersedes !787.

Acceptance criteria checklist

Criterion	Verification	Result
Merge origin/main (Makefile + swarm targets)	git merge origin/main on cursor/gitlab-issue-verification-cd8d	PASS (65c07c1)
AC1: Forged fill not attributed to victim	cargo test --lib forged_contract_address	PASS (post-merge)
AC2: Forged cancel/placement cannot alter victim	same test module	PASS
AC3: Only _contract_address scopes lifecycle	parser + limit_order_parked_lifecycle	PASS (CI)
make verify-issue-285 retains sg docker fallback	Makefile target	PASS
Live positive control (on-chain fill under correct pair)	make verify-issue-285 live leg	PASS (LocalTerra; prior run)

Command: make setup-cloud-localterra && make verify-issue-285 → 12 passed, 0 failed (2026-06-05).

Direction 3 (factory provenance) remains tracked on #279/#286/#287 — out of scope.

Closes #285

---

Note

Low Risk
Changes are limited to QA/Makefile bash helpers and import formatting; no production indexer or contract logic in this diff.

Overview
Extends the #285 verification harness so the live LocalTerra leg runs reliably on Cloud Agent shells that cannot talk to Docker directly.

scripts/lib/localterra-host-curl.sh now resolves the localterra container via sg docker when plain docker compose ps returns nothing, sets LOCALTERRA_DOCKER_VIA_SG, and routes docker exec (including in-container curl) through the same localterra_docker_exec wrapper.

E2E helpers (e2e-provision-dev-wallet.sh, e2e-seed-hybrid-book.sh, e2e-terrad-tx.sh) use localterra_container_id / localterra_docker_exec instead of ad-hoc docker compose / docker exec. verify-issue-285.sh sources the lib, uses localterra_lcd_curl for tx LCD polling, and tolerates a failed swap broadcast under set -e (|| SWAP_TX="").

make verify-issue-285 chmods the host-curl lib and runs the script under sg docker -c when docker info fails. Minor import formatting in indexerErrors.test.ts only.

^{Reviewed by Cursor Bugbot for commit 03e183a99a. Bugbot is set up for automated code reviews on this repo. Configure here.}

## Summary Verification QA for [GitLab #285](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/work_items/285) — confirms the parser fix on `main` (runtime `_contract_address` only) meets all acceptance criteria, including the **live positive control** requested by @PlasticDigits. **Parser fix is already on `main`** — this MR adds guardrails only: - `scripts/qa/verify-issue-285.sh` + `make verify-issue-285` - `docs/indexer-invariants.md` — **L285** lifecycle emitter scoping row - `skills/AGENTS_INDEXER_LIFECYCLE_EMITTER_SCOPING.md` - Cloud Agent docker fallback (`sg docker`) so live leg runs without manual wrapper Supersedes [!787](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/69). ## Acceptance criteria checklist | Criterion | Verification | Result | |-----------|--------------|--------| | Merge `origin/main` (Makefile + swarm targets) | `git merge origin/main` on `cursor/gitlab-issue-verification-cd8d` | PASS (`65c07c1`) | | AC1: Forged fill not attributed to victim | `cargo test --lib forged_contract_address` | PASS (post-merge) | | AC2: Forged cancel/placement cannot alter victim | same test module | PASS | | AC3: Only `_contract_address` scopes lifecycle | parser + `limit_order_parked_lifecycle` | PASS (CI) | | `make verify-issue-285` retains `sg docker` fallback | `Makefile` target | PASS | | Live positive control (on-chain fill under correct pair) | `make verify-issue-285` live leg | PASS (LocalTerra; prior run) | **Command:** `make setup-cloud-localterra && make verify-issue-285` → **12 passed, 0 failed** (2026-06-05). **Direction 3 (factory provenance)** remains tracked on #279/#286/#287 — out of scope. Closes #285 <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Low Risk** > Changes are limited to QA/Makefile bash helpers and import formatting; no production indexer or contract logic in this diff. > > **Overview** > Extends the **#285 verification harness** so the live LocalTerra leg runs reliably on **Cloud Agent** shells that cannot talk to Docker directly. > > **`scripts/lib/localterra-host-curl.sh`** now resolves the `localterra` container via `sg docker` when plain `docker compose ps` returns nothing, sets **`LOCALTERRA_DOCKER_VIA_SG`**, and routes **`docker exec`** (including in-container curl) through the same **`localterra_docker_exec`** wrapper. > > **E2E helpers** (`e2e-provision-dev-wallet.sh`, `e2e-seed-hybrid-book.sh`, **`e2e-terrad-tx.sh`**) use **`localterra_container_id`** / **`localterra_docker_exec`** instead of ad-hoc `docker compose` / `docker exec`. **`verify-issue-285.sh`** sources the lib, uses **`localterra_lcd_curl`** for tx LCD polling, and tolerates a failed swap broadcast under **`set -e`** (`|| SWAP_TX=""`). > > **`make verify-issue-285`** chmods the host-curl lib and runs the script under **`sg docker -c`** when **`docker info`** fails. Minor import formatting in **`indexerErrors.test.ts`** only. > > ^{Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 03e183a99a687fe1508e196954045e1de938375c. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).} <!-- /CURSOR_SUMMARY -->

ghost1 commented 2026-06-05 11:23:25 +00:00 (Migrated from gitlab.com)

Copy link

changed the description

changed the description

PlasticDigits commented 2026-06-05 11:23:28 +00:00 (Migrated from gitlab.com)

Copy link

mentioned in issue #285

mentioned in issue #285

ghost1 commented 2026-06-05 11:23:31 +00:00 (Migrated from gitlab.com)

Copy link

changed the description

changed the description

PlasticDigits commented 2026-06-05 11:24:47 +00:00 (Migrated from gitlab.com)

Copy link

Security review

Commit reviewed: 09612440778ccaa0c997b3b946d9c6d7fd5bd97e
Scope: 7 files — Makefile (verify-issue-285), scripts/qa/verify-issue-285.sh, scripts/lib/localterra-host-curl.sh (Cloud Agent sg docker fallback), scripts/e2e-provision-dev-wallet.sh, scripts/e2e-seed-hybrid-book.sh, docs/indexer-invariants.md, skills/AGENTS_INDEXER_LIFECYCLE_EMITTER_SCOPING.md

Outcome: FINDINGS: 0 medium+

Security review: no medium+ findings on this diff.

What was reviewed

• No production runtime changes — indexer parser, API handlers, frontend, and smart contracts are untouched. The L285 emitter-scoping fix is already on main; this MR adds QA guardrails and documentation only.
• QA / dev scripts (verify-issue-285.sh, E2E helpers, localterra_container_id sg docker fallback): traced inputs (REPO_ROOT, LCD_URLS, API_PORT, PAIR_ADDR, txhash) to sinks (docker compose, curl, terrad tx, jq). All are local-dev/CI paths with no external attacker-controlled entry point.
• Injection / SSRF: curl targets are built from deploy-time .env files (127.0.0.1 defaults) or on-chain LocalTerra responses filtered to terra1… addresses; jq --arg is used for tx construction. No plausible remote exploitation path.
• Secrets / logging: No mnemonics, keys, or tokens logged; truncated addresses/tx hashes only.
• Authn/authz: No new HTTP endpoints or permission boundaries.

Prior threads

No prior security-review comments on this MR; nothing to re-report.

Inline findings

None — no inline threads opened.

## Security review **Commit reviewed:** `09612440778ccaa0c997b3b946d9c6d7fd5bd97e` **Scope:** 7 files — `Makefile` (`verify-issue-285`), `scripts/qa/verify-issue-285.sh`, `scripts/lib/localterra-host-curl.sh` (Cloud Agent `sg docker` fallback), `scripts/e2e-provision-dev-wallet.sh`, `scripts/e2e-seed-hybrid-book.sh`, `docs/indexer-invariants.md`, `skills/AGENTS_INDEXER_LIFECYCLE_EMITTER_SCOPING.md` **Outcome:** `FINDINGS: 0` medium+ Security review: **no medium+ findings** on this diff. ### What was reviewed - **No production runtime changes** — indexer parser, API handlers, frontend, and smart contracts are untouched. The L285 emitter-scoping fix is already on `main`; this MR adds QA guardrails and documentation only. - **QA / dev scripts** (`verify-issue-285.sh`, E2E helpers, `localterra_container_id` `sg docker` fallback): traced inputs (`REPO_ROOT`, `LCD_URLS`, `API_PORT`, `PAIR_ADDR`, `txhash`) to sinks (`docker compose`, `curl`, `terrad tx`, `jq`). All are local-dev/CI paths with no external attacker-controlled entry point. - **Injection / SSRF:** `curl` targets are built from deploy-time `.env` files (`127.0.0.1` defaults) or on-chain LocalTerra responses filtered to `terra1…` addresses; `jq --arg` is used for tx construction. No plausible remote exploitation path. - **Secrets / logging:** No mnemonics, keys, or tokens logged; truncated addresses/tx hashes only. - **Authn/authz:** No new HTTP endpoints or permission boundaries. ### Prior threads No prior security-review comments on this MR; nothing to re-report. ### Inline findings None — no inline threads opened.

ghost1 commented 2026-06-05 11:24:50 +00:00 (Migrated from gitlab.com)

Copy link

Stale Security Review comment

Stale Security Review comment

Cursor Bugbot has reviewed your changes and found 2 potential issues.
^{Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issues.}

^{Reviewed by Cursor Bugbot for commit 0961244077. Configure here.}

<details> <summary>Stale Security Review comment</summary> <details> <summary>Stale Security Review comment</summary> <!-- BUGBOT_REVIEW --> Cursor Bugbot has reviewed your changes and found 2 potential issues.<!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_BEGIN --> ^{Bugbot Autofix is [ON](https://www.cursor.com/dashboard/bugbot). A cloud agent has been kicked off to fix the reported issues. <!-- BUGBOT_AUTOFIX_AGENT_LINK -->} <!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_END --> ^{Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 09612440778ccaa0c997b3b946d9c6d7fd5bd97e. Configure [here](https://www.cursor.com/dashboard/bugbot).} </details> </details>

ghost1 commented 2026-06-05 11:24:52 +00:00 (Migrated from gitlab.com)

Copy link

Docker exec lacks sg fallback

Medium Severity

localterra_container_id can resolve the LocalTerra container via sg docker, but e2e_terrad_tx still calls plain docker exec, so running QA scripts outside the Makefile sg docker wrapper can enter the live leg and then fail every on-chain step.

 

^{Reviewed by Cursor Bugbot for commit 0961244077. Configure here.}

### Docker exec lacks sg fallback **Medium Severity** <!-- DESCRIPTION START --> `localterra_container_id` can resolve the LocalTerra container via `sg docker`, but `e2e_terrad_tx` still calls plain `docker exec`, so running QA scripts outside the Makefile `sg docker` wrapper can enter the live leg and then fail every on-chain step. <!-- DESCRIPTION END --> <!-- BUGBOT_BUG_ID: 2ae735c7-cbd4-4910-8b02-4ada5acc6874 --> <!-- LOCATIONS START scripts/lib/localterra-host-curl.sh#L19-L26 LOCATIONS END --> <div><a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9DVVJTT1IiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OjBhZTU0MmIyLWIxMzktNDJiMC04NzM1LTI5NzBmMjllNTNhYiIsImVuY3J5cHRpb25LZXkiOiJLQnNEdFZZdWREYk1TaVRqM2I1WWJhM0ZNNVI4TGtNb19OM3MyTlVmN2Y4IiwiYnJhbmNoIjoiY3Vyc29yL2dpdGxhYi1pc3N1ZS12ZXJpZmljYXRpb24tY2Q4ZCIsInJlcG9Pd25lciI6IlBsYXN0aWNEaWdpdHMiLCJyZXBvTmFtZSI6ImNsOHktZGV4LXRlcnJhY2xhc3NpYyJ9fQ" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a>&nbsp;<a href="https://cursor.com/agents?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9XRUIiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OjBhZTU0MmIyLWIxMzktNDJiMC04NzM1LTI5NzBmMjllNTNhYiIsImVuY3J5cHRpb25LZXkiOiJLQnNEdFZZdWREYk1TaVRqM2I1WWJhM0ZNNVI4TGtNb19OM3MyTlVmN2Y4IiwiYnJhbmNoIjoiY3Vyc29yL2dpdGxhYi1pc3N1ZS12ZXJpZmljYXRpb24tY2Q4ZCIsInJlcG9Pd25lciI6IlBsYXN0aWNEaWdpdHMiLCJyZXBvTmFtZSI6ImNsOHktZGV4LXRlcnJhY2xhc3NpYyIsInByTnVtYmVyIjo4MSwiY29tbWl0U2hhIjoiMDk2MTI0NDA3NzhjY2FhMGM5OTdiM2I5NDZkOWM2ZDdmZDViZDk3ZSIsInByb3ZpZGVyIjoiZ2l0bGFiIiwiaG9zdG5hbWUiOiJnaXRsYWIuY29tIn19" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-web-light.png"><img alt="Fix in Web" width="99" height="28" src="https://cursor.com/assets/images/fix-in-web-dark.png"></picture></a></div> ^{Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 09612440778ccaa0c997b3b946d9c6d7fd5bd97e. Configure [here](https://www.cursor.com/dashboard/bugbot).}

ghost1 commented 2026-06-05 11:24:52 +00:00 (Migrated from gitlab.com)

Copy link

Pipefail aborts verify script

High Severity

With set -o pipefail, assigning SWAP_TX from terrad_tx … | tx_hash_from_json exits the whole script when terrad_tx fails, so the empty-txhash bad() path and final results summary never run.

 

^{Reviewed by Cursor Bugbot for commit 0961244077. Configure here.}

### Pipefail aborts verify script **High Severity** <!-- DESCRIPTION START --> With `set -o pipefail`, assigning `SWAP_TX` from `terrad_tx … | tx_hash_from_json` exits the whole script when `terrad_tx` fails, so the empty-txhash `bad()` path and final results summary never run. <!-- DESCRIPTION END --> <!-- BUGBOT_BUG_ID: cfb3349a-c69c-4e37-8ca8-f771967ae99b --> <!-- LOCATIONS START scripts/qa/verify-issue-285.sh#L194-L195 LOCATIONS END --> <div><a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9DVVJTT1IiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OmQ4YjlhYWUxLWFlZGItNGJjNS04OWIwLWUxMDE5ZjFhNzRiNCIsImVuY3J5cHRpb25LZXkiOiJzX1ZJeWVfZjFGTjR4aHNnZmJoUVJ2WXlpdHNkWjZjR1JZSlpnN0JZRHhjIiwiYnJhbmNoIjoiY3Vyc29yL2dpdGxhYi1pc3N1ZS12ZXJpZmljYXRpb24tY2Q4ZCIsInJlcG9Pd25lciI6IlBsYXN0aWNEaWdpdHMiLCJyZXBvTmFtZSI6ImNsOHktZGV4LXRlcnJhY2xhc3NpYyJ9fQ" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a>&nbsp;<a href="https://cursor.com/agents?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9XRUIiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OmQ4YjlhYWUxLWFlZGItNGJjNS04OWIwLWUxMDE5ZjFhNzRiNCIsImVuY3J5cHRpb25LZXkiOiJzX1ZJeWVfZjFGTjR4aHNnZmJoUVJ2WXlpdHNkWjZjR1JZSlpnN0JZRHhjIiwiYnJhbmNoIjoiY3Vyc29yL2dpdGxhYi1pc3N1ZS12ZXJpZmljYXRpb24tY2Q4ZCIsInJlcG9Pd25lciI6IlBsYXN0aWNEaWdpdHMiLCJyZXBvTmFtZSI6ImNsOHktZGV4LXRlcnJhY2xhc3NpYyIsInByTnVtYmVyIjo4MSwiY29tbWl0U2hhIjoiMDk2MTI0NDA3NzhjY2FhMGM5OTdiM2I5NDZkOWM2ZDdmZDViZDk3ZSIsInByb3ZpZGVyIjoiZ2l0bGFiIiwiaG9zdG5hbWUiOiJnaXRsYWIuY29tIn19" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-web-light.png"><img alt="Fix in Web" width="99" height="28" src="https://cursor.com/assets/images/fix-in-web-dark.png"></picture></a></div> ^{Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 09612440778ccaa0c997b3b946d9c6d7fd5bd97e. Configure [here](https://www.cursor.com/dashboard/bugbot).}

ghost1 commented 2026-06-05 11:26:48 +00:00 (Migrated from gitlab.com)

Copy link

changed this line in version 2 of the diff

changed this line in [version 2 of the diff](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/81/diffs?diff_id=1836558738&start_sha=09612440778ccaa0c997b3b946d9c6d7fd5bd97e#8c2151db37c31ae6bb05e3b80af70f931311ca08_195_195)

ghost1 commented 2026-06-05 11:26:49 +00:00 (Migrated from gitlab.com)

Copy link

added 1 commit

• 527512c0 - Fix verify-issue-285 pipefail abort and sg docker exec fallback

Compare with previous version

added 1 commit <ul><li>527512c0 - Fix verify-issue-285 pipefail abort and sg docker exec fallback</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/81/diffs?diff_id=1836558738&start_sha=09612440778ccaa0c997b3b946d9c6d7fd5bd97e)

ghost1 commented 2026-06-05 11:27:00 +00:00 (Migrated from gitlab.com)

Copy link

changed the description

changed the description

ghost1 commented 2026-06-05 11:27:35 +00:00 (Migrated from gitlab.com)

Copy link

resolved all threads

resolved all threads

ghost1 commented 2026-06-05 11:28:13 +00:00 (Migrated from gitlab.com)

Copy link

Stale Security Review comment

Cursor Bugbot has reviewed your changes and found 1 potential issue.
^{Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.}

^{Reviewed by Cursor Bugbot for commit 527512c004. Configure here.}

<details> <summary>Stale Security Review comment</summary> <!-- BUGBOT_REVIEW --> Cursor Bugbot has reviewed your changes and found 1 potential issue.<!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_BEGIN --> ^{Bugbot Autofix is [ON](https://www.cursor.com/dashboard/bugbot). A cloud agent has been kicked off to fix the reported issue. <!-- BUGBOT_AUTOFIX_AGENT_LINK -->} <!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_END --> ^{Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 527512c004b61482ef952665e26961fc656054e0. Configure [here](https://www.cursor.com/dashboard/bugbot).} </details>

ghost1 commented 2026-06-05 11:28:15 +00:00 (Migrated from gitlab.com)

Copy link

LCD tx query skips curl fallback

Medium Severity

The live leg’s query_tx_lcd uses bare host curl against LCD for /cosmos/tx/v1beta1/txs/…, without localterra_lcd_curl or the shared connect/max timeouts. On hosts where published :1317 hangs (documented userland-proxy case), the harness can stall or time out while other steps already use in-container LCD access.

 

^{Reviewed by Cursor Bugbot for commit 527512c004. Configure here.}

### LCD tx query skips curl fallback **Medium Severity** <!-- DESCRIPTION START --> The live leg’s `query_tx_lcd` uses bare host `curl` against `LCD` for `/cosmos/tx/v1beta1/txs/…`, without `localterra_lcd_curl` or the shared connect/max timeouts. On hosts where published `:1317` hangs (documented userland-proxy case), the harness can stall or time out while other steps already use in-container LCD access. <!-- DESCRIPTION END --> <!-- BUGBOT_BUG_ID: 4c7f0eb8-15de-4774-a170-d7c11f18c6ce --> <!-- LOCATIONS START scripts/qa/verify-issue-285.sh#L96-L112 LOCATIONS END --> <div><a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9DVVJTT1IiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OmU1OWUwMDlkLWYzMmYtNDdiOC05OTVhLTdjNDNmNzQzODllYiIsImVuY3J5cHRpb25LZXkiOiJ5blNULXJvN1RaVTdOb0l3QlUySmtQR3VqZVZnVHhueU96M1dyR01xWkdnIiwiYnJhbmNoIjoiY3Vyc29yL2dpdGxhYi1pc3N1ZS12ZXJpZmljYXRpb24tY2Q4ZCIsInJlcG9Pd25lciI6IlBsYXN0aWNEaWdpdHMiLCJyZXBvTmFtZSI6ImNsOHktZGV4LXRlcnJhY2xhc3NpYyJ9fQ" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a>&nbsp;<a href="https://cursor.com/agents?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9XRUIiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OmU1OWUwMDlkLWYzMmYtNDdiOC05OTVhLTdjNDNmNzQzODllYiIsImVuY3J5cHRpb25LZXkiOiJ5blNULXJvN1RaVTdOb0l3QlUySmtQR3VqZVZnVHhueU96M1dyR01xWkdnIiwiYnJhbmNoIjoiY3Vyc29yL2dpdGxhYi1pc3N1ZS12ZXJpZmljYXRpb24tY2Q4ZCIsInJlcG9Pd25lciI6IlBsYXN0aWNEaWdpdHMiLCJyZXBvTmFtZSI6ImNsOHktZGV4LXRlcnJhY2xhc3NpYyIsInByTnVtYmVyIjo4MSwiY29tbWl0U2hhIjoiNTI3NTEyYzAwNGI2MTQ4MmVmOTUyNjY1ZTI2OTYxZmM2NTYwNTRlMCIsInByb3ZpZGVyIjoiZ2l0bGFiIiwiaG9zdG5hbWUiOiJnaXRsYWIuY29tIn19" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-web-light.png"><img alt="Fix in Web" width="99" height="28" src="https://cursor.com/assets/images/fix-in-web-dark.png"></picture></a></div> ^{Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 527512c004b61482ef952665e26961fc656054e0. Configure [here](https://www.cursor.com/dashboard/bugbot).}

ghost1 commented 2026-06-05 11:29:16 +00:00 (Migrated from gitlab.com)

Copy link

added 1 commit

• 0d294636 - fix(qa): use localterra_lcd_curl for tx queries in verify-issue-285

Compare with previous version

added 1 commit <ul><li>0d294636 - fix(qa): use localterra_lcd_curl for tx queries in verify-issue-285</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/81/diffs?diff_id=1836563072&start_sha=527512c004b61482ef952665e26961fc656054e0)

ghost1 commented 2026-06-05 11:29:28 +00:00 (Migrated from gitlab.com)

Copy link

changed the description

changed the description

ghost1 commented 2026-06-05 11:29:30 +00:00 (Migrated from gitlab.com)

Copy link

resolved all threads

resolved all threads

PlasticDigits commented 2026-06-05 11:38:26 +00:00 (Migrated from gitlab.com)

Copy link

Security review

Commit reviewed: 0d294636039a2716e4c97d849a61818098a6fab8
Scope: 8 files — Makefile (verify-issue-285), scripts/qa/verify-issue-285.sh, scripts/lib/localterra-host-curl.sh (sg docker fallback + localterra_docker_exec), scripts/lib/e2e-terrad-tx.sh, scripts/e2e-provision-dev-wallet.sh, scripts/e2e-seed-hybrid-book.sh, docs/indexer-invariants.md, skills/AGENTS_INDEXER_LIFECYCLE_EMITTER_SCOPING.md

Outcome: FINDINGS: 0 medium+

Security review: no medium+ findings on this diff.

What was reviewed

• No production runtime changes — indexer parser, API handlers, frontend, and smart contracts are untouched. The L285 emitter-scoping fix is already on main; this MR adds QA guardrails and documentation only.
• Commits since prior review (0961244): 527512c (pipefail-safe swap broadcast, localterra_docker_exec via sg docker with printf '%q' quoting) and 0d29463 (LCD tx queries routed through localterra_lcd_curl for docker-exec fallback). Both remain local-dev/CI plumbing with no new external attack surface.
• QA / dev scripts: traced inputs (REPO_ROOT, LCD_URLS, API_PORT, PAIR_ADDR, txhash, VERIFY285_*) to sinks (docker compose, sg docker, curl, terrad tx, jq). All require shell access on a developer/CI host; no remote caller can drive these paths.
• Injection / SSRF: curl/localterra_lcd_curl targets come from deploy-time .env files (defaults 127.0.0.1) or on-chain LocalTerra responses filtered to terra1… addresses; jq --arg/--argjson used for tx JSON construction; localterra_docker_exec uses %q shell-quoting. No plausible remote exploitation path.
• Secrets / logging: no mnemonics, keys, or tokens logged; truncated addresses/tx hashes only.
• Authn/authz: no new HTTP endpoints or permission boundaries.

Prior threads

Prior review on 0961244 reported zero medium+ findings; the two follow-up commits do not introduce new security concerns. Nothing to re-report.

Inline findings

None — no inline threads opened.

## Security review **Commit reviewed:** `0d294636039a2716e4c97d849a61818098a6fab8` **Scope:** 8 files — `Makefile` (`verify-issue-285`), `scripts/qa/verify-issue-285.sh`, `scripts/lib/localterra-host-curl.sh` (`sg docker` fallback + `localterra_docker_exec`), `scripts/lib/e2e-terrad-tx.sh`, `scripts/e2e-provision-dev-wallet.sh`, `scripts/e2e-seed-hybrid-book.sh`, `docs/indexer-invariants.md`, `skills/AGENTS_INDEXER_LIFECYCLE_EMITTER_SCOPING.md` **Outcome:** `FINDINGS: 0` medium+ Security review: **no medium+ findings** on this diff. ### What was reviewed - **No production runtime changes** — indexer parser, API handlers, frontend, and smart contracts are untouched. The L285 emitter-scoping fix is already on `main`; this MR adds QA guardrails and documentation only. - **Commits since prior review (`0961244`):** `527512c` (pipefail-safe swap broadcast, `localterra_docker_exec` via `sg docker` with `printf '%q'` quoting) and `0d29463` (LCD tx queries routed through `localterra_lcd_curl` for docker-exec fallback). Both remain local-dev/CI plumbing with no new external attack surface. - **QA / dev scripts:** traced inputs (`REPO_ROOT`, `LCD_URLS`, `API_PORT`, `PAIR_ADDR`, `txhash`, `VERIFY285_*`) to sinks (`docker compose`, `sg docker`, `curl`, `terrad tx`, `jq`). All require shell access on a developer/CI host; no remote caller can drive these paths. - **Injection / SSRF:** `curl`/`localterra_lcd_curl` targets come from deploy-time `.env` files (defaults `127.0.0.1`) or on-chain LocalTerra responses filtered to `terra1…` addresses; `jq --arg`/`--argjson` used for tx JSON construction; `localterra_docker_exec` uses `%q` shell-quoting. No plausible remote exploitation path. - **Secrets / logging:** no mnemonics, keys, or tokens logged; truncated addresses/tx hashes only. - **Authn/authz:** no new HTTP endpoints or permission boundaries. ### Prior threads Prior review on `0961244` reported zero medium+ findings; the two follow-up commits do not introduce new security concerns. Nothing to re-report. ### Inline findings None — no inline threads opened.

PlasticDigits commented 2026-06-05 11:41:09 +00:00 (Migrated from gitlab.com)

Copy link

Security review

Commit reviewed: 0d294636039a2716e4c97d849a61818098a6fab8
Scope: 8 files — Makefile (verify-issue-285), scripts/qa/verify-issue-285.sh, scripts/lib/localterra-host-curl.sh (localterra_container_id / localterra_docker_exec + sg docker fallback), scripts/lib/e2e-terrad-tx.sh, scripts/e2e-provision-dev-wallet.sh, scripts/e2e-seed-hybrid-book.sh, docs/indexer-invariants.md, skills/AGENTS_INDEXER_LIFECYCLE_EMITTER_SCOPING.md

Outcome: FINDINGS: 0 medium+

Security review: no medium+ findings on this diff.

What was reviewed

• No production runtime changes — indexer parser, API handlers, frontend, and smart contracts are untouched. The L285 emitter-scoping fix is already on main; this MR adds QA guardrails and documentation only.
• Latest commit (0d29463) — query_tx_lcd now uses localterra_lcd_curl (connect/max timeouts + docker exec fallback), consistent with other LCD calls in the script. Dev/CI reliability only; no new attacker-controlled sink.
• QA / dev scripts — traced inputs (REPO_ROOT, .env LCD_URLS / API_PORT, on-chain terra1… addresses, txhash) to sinks (docker compose / sg docker, docker exec via printf '%q', curl, terrad tx, jq --arg). All are local-dev/CI paths with no remote exploitation surface.
• Injection / SSRF — HTTP targets come from deploy-time env defaults (127.0.0.1) or chain responses filtered to terra1…; JSON/tx construction uses jq --arg. No plausible path for an external attacker to steer requests.
• Secrets / logging — no mnemonics, keys, or tokens logged; truncated addresses/tx hashes only.
• Authn/authz — no new HTTP endpoints or permission boundaries.

Prior threads

• Prior top-level security review on 0961244… (also 0 medium+); conclusions unchanged after 0d29463.
• Bugbot “Docker exec lacks sg fallback” thread is resolved in this MR (localterra_docker_exec + _e2e_docker_exec); that was a QA reliability issue, not a security boundary.

Inline findings

None — no inline threads opened.

## Security review **Commit reviewed:** `0d294636039a2716e4c97d849a61818098a6fab8` **Scope:** 8 files — `Makefile` (`verify-issue-285`), `scripts/qa/verify-issue-285.sh`, `scripts/lib/localterra-host-curl.sh` (`localterra_container_id` / `localterra_docker_exec` + `sg docker` fallback), `scripts/lib/e2e-terrad-tx.sh`, `scripts/e2e-provision-dev-wallet.sh`, `scripts/e2e-seed-hybrid-book.sh`, `docs/indexer-invariants.md`, `skills/AGENTS_INDEXER_LIFECYCLE_EMITTER_SCOPING.md` **Outcome:** `FINDINGS: 0` medium+ Security review: **no medium+ findings** on this diff. ### What was reviewed - **No production runtime changes** — indexer parser, API handlers, frontend, and smart contracts are untouched. The L285 emitter-scoping fix is already on `main`; this MR adds QA guardrails and documentation only. - **Latest commit (`0d29463`)** — `query_tx_lcd` now uses `localterra_lcd_curl` (connect/max timeouts + docker exec fallback), consistent with other LCD calls in the script. Dev/CI reliability only; no new attacker-controlled sink. - **QA / dev scripts** — traced inputs (`REPO_ROOT`, `.env` `LCD_URLS` / `API_PORT`, on-chain `terra1…` addresses, `txhash`) to sinks (`docker compose` / `sg docker`, `docker exec` via `printf '%q'`, `curl`, `terrad tx`, `jq --arg`). All are local-dev/CI paths with no remote exploitation surface. - **Injection / SSRF** — HTTP targets come from deploy-time env defaults (`127.0.0.1`) or chain responses filtered to `terra1…`; JSON/tx construction uses `jq --arg`. No plausible path for an external attacker to steer requests. - **Secrets / logging** — no mnemonics, keys, or tokens logged; truncated addresses/tx hashes only. - **Authn/authz** — no new HTTP endpoints or permission boundaries. ### Prior threads - Prior top-level security review on `0961244…` (also **0** medium+); conclusions unchanged after `0d29463`. - Bugbot “Docker exec lacks sg fallback” thread is **resolved** in this MR (`localterra_docker_exec` + `_e2e_docker_exec`); that was a QA reliability issue, not a security boundary. ### Inline findings None — no inline threads opened.

ghost1 commented 2026-06-05 12:43:56 +00:00 (Migrated from gitlab.com)

Copy link

added 21 commits

• 0d294636...b9121d83 - 20 commits from branch main
• 65c07c13 - merge: resolve main Makefile conflicts for MR !799 (#285)

Compare with previous version

added 21 commits <ul><li>0d294636...b9121d83 - 20 commits from branch <code>main</code></li><li>65c07c13 - merge: resolve main Makefile conflicts for MR !799 (#285)</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/81/diffs?diff_id=1836698806&start_sha=0d294636039a2716e4c97d849a61818098a6fab8)

ghost1 commented 2026-06-05 12:43:56 +00:00 (Migrated from gitlab.com)

Copy link

mentioned in commit 65c07c1385

mentioned in commit 65c07c1385a976ba1aef5e4098b7dd8d72476a52

ghost1 commented 2026-06-05 12:44:08 +00:00 (Migrated from gitlab.com)

Copy link

changed the description

changed the description

PlasticDigits commented 2026-06-05 12:44:30 +00:00 (Migrated from gitlab.com)

Copy link

changed the description

changed the description

PlasticDigits commented 2026-06-05 12:45:08 +00:00 (Migrated from gitlab.com)

Copy link

Security review

Commit reviewed: 65c07c1385a976ba1aef5e4098b7dd8d72476a52
Scope: 7 files in MR diff — Makefile (verify-issue-285 + main merge union for swarm targets), scripts/qa/verify-issue-285.sh, scripts/lib/localterra-host-curl.sh (localterra_container_id / localterra_docker_exec + sg docker fallback), scripts/lib/e2e-terrad-tx.sh, scripts/e2e-provision-dev-wallet.sh, scripts/e2e-seed-hybrid-book.sh, frontend-dapp/src/utils/__tests__/indexerErrors.test.ts (import formatting only)

Outcome: FINDINGS: 0 medium+

Security review: no medium+ findings on this diff.

What was reviewed

• No production runtime changes — indexer parser, API handlers, frontend app code, and smart contracts are untouched. The L285 emitter-scoping fix is already on main; this MR adds QA guardrails and dev-script plumbing only.
• Latest commit (65c07c13) — merge of main into the MR branch; only Makefile delta vs prior review is union of swarm-liquidity .PHONY/targets from main alongside the existing verify-issue-285 sg docker wrapper. QA scripts (verify-issue-285.sh, localterra-host-curl.sh, e2e-terrad-tx.sh, E2E seed helpers) are unchanged since 0d29463.
• QA / dev scripts — traced inputs (REPO_ROOT, deploy-time .env LCD_URLS/API_PORT, on-chain terra1… addresses, txhash from terrad JSON) to sinks (docker compose / sg docker, docker exec via printf '%q', curl/localterra_lcd_curl, terrad tx, jq --arg). All require shell access on a developer/CI host; no remote caller can drive these paths.
• Injection / SSRF — HTTP targets come from deploy-time env defaults (127.0.0.1) or chain responses filtered to terra1…; JSON/tx construction uses jq --arg/--argjson; localterra_docker_exec shell-quotes container id and argv. No plausible path for an external attacker to steer requests or execute arbitrary commands.
• Secrets / logging — no mnemonics, keys, or tokens logged; truncated addresses/tx hashes only.
• Authn/authz — no new HTTP endpoints or permission boundaries.

Prior threads

• Prior top-level security reviews on 0961244… and 0d29463… (both 0 medium+); conclusions unchanged after merge commit 65c07c13.
• Bugbot “Docker exec lacks sg fallback” thread is resolved in this MR (localterra_docker_exec + _e2e_docker_exec); that was a QA reliability issue, not a security boundary.

Inline findings

None — no inline threads opened.

## Security review **Commit reviewed:** `65c07c1385a976ba1aef5e4098b7dd8d72476a52` **Scope:** 7 files in MR diff — `Makefile` (`verify-issue-285` + main merge union for swarm targets), `scripts/qa/verify-issue-285.sh`, `scripts/lib/localterra-host-curl.sh` (`localterra_container_id` / `localterra_docker_exec` + `sg docker` fallback), `scripts/lib/e2e-terrad-tx.sh`, `scripts/e2e-provision-dev-wallet.sh`, `scripts/e2e-seed-hybrid-book.sh`, `frontend-dapp/src/utils/__tests__/indexerErrors.test.ts` (import formatting only) **Outcome:** `FINDINGS: 0` medium+ Security review: **no medium+ findings** on this diff. ### What was reviewed - **No production runtime changes** — indexer parser, API handlers, frontend app code, and smart contracts are untouched. The L285 emitter-scoping fix is already on `main`; this MR adds QA guardrails and dev-script plumbing only. - **Latest commit (`65c07c13`)** — merge of `main` into the MR branch; only Makefile delta vs prior review is union of swarm-liquidity `.PHONY`/targets from `main` alongside the existing `verify-issue-285` `sg docker` wrapper. QA scripts (`verify-issue-285.sh`, `localterra-host-curl.sh`, `e2e-terrad-tx.sh`, E2E seed helpers) are unchanged since `0d29463`. - **QA / dev scripts** — traced inputs (`REPO_ROOT`, deploy-time `.env` `LCD_URLS`/`API_PORT`, on-chain `terra1…` addresses, `txhash` from `terrad` JSON) to sinks (`docker compose` / `sg docker`, `docker exec` via `printf '%q'`, `curl`/`localterra_lcd_curl`, `terrad tx`, `jq --arg`). All require shell access on a developer/CI host; no remote caller can drive these paths. - **Injection / SSRF** — HTTP targets come from deploy-time env defaults (`127.0.0.1`) or chain responses filtered to `terra1…`; JSON/tx construction uses `jq --arg`/`--argjson`; `localterra_docker_exec` shell-quotes container id and argv. No plausible path for an external attacker to steer requests or execute arbitrary commands. - **Secrets / logging** — no mnemonics, keys, or tokens logged; truncated addresses/tx hashes only. - **Authn/authz** — no new HTTP endpoints or permission boundaries. ### Prior threads - Prior top-level security reviews on `0961244…` and `0d29463…` (both **0** medium+); conclusions unchanged after merge commit `65c07c13`. - Bugbot “Docker exec lacks sg fallback” thread is **resolved** in this MR (`localterra_docker_exec` + `_e2e_docker_exec`); that was a QA reliability issue, not a security boundary. ### Inline findings None — no inline threads opened.

ghost1 commented 2026-06-05 12:46:25 +00:00 (Migrated from gitlab.com)

Copy link

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.}

^{Reviewed by Cursor Bugbot for commit 65c07c1385. Configure here.}

<!-- BUGBOT_REVIEW --> Cursor Bugbot has reviewed your changes and found 1 potential issue. <!-- BUGBOT_FIX_ALL --> <a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9BTExfSU5fQ1VSU09SIiwiZGF0YSI6eyJyZWRpc0tleSI6ImJ1Z2JvdC1tdWx0aTphNGJlZTMzZi04ZmUxLTRjZDktYjc3Zi03Y2JiOTFiNDdkM2QiLCJlbmNyeXB0aW9uS2V5IjoiZzhIRmp3WjNHRWpPbzdLczNwUVV4SDdmZHJSaTNnSGVzQ3NMQ0RmUXdBZyIsImJyYW5jaCI6ImN1cnNvci9naXRsYWItaXNzdWUtdmVyaWZpY2F0aW9uLWNkOGQiLCJyZXBvT3duZXIiOiJQbGFzdGljRGlnaXRzIiwicmVwb05hbWUiOiJjbDh5LWRleC10ZXJyYWNsYXNzaWMifX0" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix All in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a> <!-- /BUGBOT_FIX_ALL --> <!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_BEGIN --> ^{Bugbot Autofix is [ON](https://www.cursor.com/dashboard/bugbot). A cloud agent has been kicked off to fix the reported issue. <!-- BUGBOT_AUTOFIX_AGENT_LINK -->} <!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_END --> ^{Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 65c07c1385a976ba1aef5e4098b7dd8d72476a52. Configure [here](https://www.cursor.com/dashboard/bugbot).}

ghost1 commented 2026-06-05 12:46:26 +00:00 (Migrated from gitlab.com)

Copy link

sg docker flag cleared before exec

Medium Severity

These scripts call localterra_container_id (which sets LOCALTERRA_DOCKER_VIA_SG when the container id is resolved via sg docker) and then source lcd-smart-query.sh, which re-sources localterra-host-curl.sh and resets LOCALTERRA_DOCKER_VIA_SG to empty. Later e2e_terrad_tx uses plain docker exec instead of the sg docker wrapper, so terrad broadcasts fail on hosts that need the sg fallback.

Additional Locations (1)

• scripts/e2e-seed-hybrid-book.sh#L35-L47

 

^{Reviewed by Cursor Bugbot for commit 65c07c1385. Configure here.}

### sg docker flag cleared before exec **Medium Severity** <!-- DESCRIPTION START --> These scripts call `localterra_container_id` (which sets `LOCALTERRA_DOCKER_VIA_SG` when the container id is resolved via `sg docker`) and then source `lcd-smart-query.sh`, which re-sources `localterra-host-curl.sh` and resets `LOCALTERRA_DOCKER_VIA_SG` to empty. Later `e2e_terrad_tx` uses plain `docker exec` instead of the `sg docker` wrapper, so terrad broadcasts fail on hosts that need the sg fallback. <!-- DESCRIPTION END --> <!-- BUGBOT_BUG_ID: ab91a267-bf4c-4833-8940-e44c67fc8dca --> <!-- LOCATIONS START scripts/e2e-provision-dev-wallet.sh#L37-L49 scripts/e2e-seed-hybrid-book.sh#L35-L47 LOCATIONS END --> <details> <summary>Additional Locations (1)</summary> - [`scripts/e2e-seed-hybrid-book.sh#L35-L47`](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-//blob/65c07c1385a976ba1aef5e4098b7dd8d72476a52/scripts/e2e-seed-hybrid-book.sh#L35-L47) </details> <div><a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9DVVJTT1IiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OjI4Mjk0MjMwLWQ2OTktNGRmMi05YTdiLWY5MzY5ZjUzMTg0OSIsImVuY3J5cHRpb25LZXkiOiJ5MHFaQUpJRThFV1Z0TnRQU2p6WXJDaVRjbV9VVzAwdUt6dzQ1NHllRE1RIiwiYnJhbmNoIjoiY3Vyc29yL2dpdGxhYi1pc3N1ZS12ZXJpZmljYXRpb24tY2Q4ZCIsInJlcG9Pd25lciI6IlBsYXN0aWNEaWdpdHMiLCJyZXBvTmFtZSI6ImNsOHktZGV4LXRlcnJhY2xhc3NpYyJ9fQ" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a>&nbsp;<a href="https://cursor.com/agents?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9XRUIiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OjI4Mjk0MjMwLWQ2OTktNGRmMi05YTdiLWY5MzY5ZjUzMTg0OSIsImVuY3J5cHRpb25LZXkiOiJ5MHFaQUpJRThFV1Z0TnRQU2p6WXJDaVRjbV9VVzAwdUt6dzQ1NHllRE1RIiwiYnJhbmNoIjoiY3Vyc29yL2dpdGxhYi1pc3N1ZS12ZXJpZmljYXRpb24tY2Q4ZCIsInJlcG9Pd25lciI6IlBsYXN0aWNEaWdpdHMiLCJyZXBvTmFtZSI6ImNsOHktZGV4LXRlcnJhY2xhc3NpYyIsInByTnVtYmVyIjo4MSwiY29tbWl0U2hhIjoiNjVjMDdjMTM4NWE5NzZiYTFhZWY1ZTQwOThiN2RkOGQ3MjQ3NmE1MiIsInByb3ZpZGVyIjoiZ2l0bGFiIiwiaG9zdG5hbWUiOiJnaXRsYWIuY29tIn19" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-web-light.png"><img alt="Fix in Web" width="99" height="28" src="https://cursor.com/assets/images/fix-in-web-dark.png"></picture></a></div> ^{Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 65c07c1385a976ba1aef5e4098b7dd8d72476a52. Configure [here](https://www.cursor.com/dashboard/bugbot).}

ghost1 commented 2026-06-05 12:47:31 +00:00 (Migrated from gitlab.com)

Copy link

added 1 commit

• 03e183a9 - Preserve LOCALTERRA_DOCKER_VIA_SG when localterra-host-curl is re-sourced

Compare with previous version

added 1 commit <ul><li>03e183a9 - Preserve LOCALTERRA_DOCKER_VIA_SG when localterra-host-curl is re-sourced</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/81/diffs?diff_id=1836705072&start_sha=65c07c1385a976ba1aef5e4098b7dd8d72476a52)

ghost1 commented 2026-06-05 12:47:39 +00:00 (Migrated from gitlab.com)

Copy link

changed the description

changed the description

ghost1 commented 2026-06-05 12:47:47 +00:00 (Migrated from gitlab.com)

Copy link

changed the description

changed the description

ghost1 commented 2026-06-05 12:48:08 +00:00 (Migrated from gitlab.com)

Copy link

resolved all threads

resolved all threads

PlasticDigits commented 2026-06-05 12:48:49 +00:00 (Migrated from gitlab.com)

Copy link

Security review

Commit reviewed: 03e183a99a687fe1508e196954045e1de938375c
Scope: 7 files in MR diff — Makefile (verify-issue-285 + sg docker wrapper), scripts/qa/verify-issue-285.sh, scripts/lib/localterra-host-curl.sh (localterra_container_id / localterra_docker_exec + LOCALTERRA_DOCKER_VIA_SG preservation), scripts/lib/e2e-terrad-tx.sh (_e2e_docker_exec), scripts/e2e-provision-dev-wallet.sh, scripts/e2e-seed-hybrid-book.sh, frontend-dapp/src/utils/__tests__/indexerErrors.test.ts (import formatting only)

Outcome: FINDINGS: 0 medium+

Security review: no medium+ findings on this diff.

What was reviewed

• No production runtime changes — indexer parser, API handlers, frontend app code, and smart contracts are untouched. The L285 emitter-scoping fix is already on main; this MR adds QA guardrails and dev-script plumbing only.
• Latest commit (03e183a) — preserves LOCALTERRA_DOCKER_VIA_SG across re-source of localterra-host-curl.sh (Cloud Agent sg docker exec path). Dev/CI reliability only; no new attacker-controlled sink.
• QA / dev scripts — traced inputs (REPO_ROOT, deploy-time .env LCD_URLS/API_PORT, on-chain terra1… addresses, txhash from terrad JSON) to sinks (docker compose / sg docker, docker exec via printf '%q', curl/localterra_lcd_curl, terrad tx, jq --arg). All require shell access on a developer/CI host; no remote caller can drive these paths.
• Injection / SSRF — HTTP targets come from deploy-time env defaults (127.0.0.1) or chain responses filtered to terra1…; JSON/tx construction uses jq --arg/--argjson; localterra_docker_exec shell-quotes container id and argv. No plausible path for an external attacker to steer requests or execute arbitrary commands.
• Secrets / logging — no mnemonics, keys, or tokens logged; truncated addresses/tx hashes only.
• Authn/authz — no new HTTP endpoints or permission boundaries.

Prior threads

• Prior top-level security reviews on 0961244…, 0d29463…, and 65c07c13… (all 0 medium+); conclusions unchanged after 03e183a.
• Bugbot threads (sg-docker flag, LCD curl fallback, pipefail abort, docker-exec fallback) are QA reliability issues, not security boundaries; addressed in this MR where applicable.

Inline findings

None — no inline threads opened.

## Security review **Commit reviewed:** `03e183a99a687fe1508e196954045e1de938375c` **Scope:** 7 files in MR diff — `Makefile` (`verify-issue-285` + `sg docker` wrapper), `scripts/qa/verify-issue-285.sh`, `scripts/lib/localterra-host-curl.sh` (`localterra_container_id` / `localterra_docker_exec` + `LOCALTERRA_DOCKER_VIA_SG` preservation), `scripts/lib/e2e-terrad-tx.sh` (`_e2e_docker_exec`), `scripts/e2e-provision-dev-wallet.sh`, `scripts/e2e-seed-hybrid-book.sh`, `frontend-dapp/src/utils/__tests__/indexerErrors.test.ts` (import formatting only) **Outcome:** `FINDINGS: 0` medium+ Security review: **no medium+ findings** on this diff. ### What was reviewed - **No production runtime changes** — indexer parser, API handlers, frontend app code, and smart contracts are untouched. The L285 emitter-scoping fix is already on `main`; this MR adds QA guardrails and dev-script plumbing only. - **Latest commit (`03e183a`)** — preserves `LOCALTERRA_DOCKER_VIA_SG` across re-source of `localterra-host-curl.sh` (Cloud Agent `sg docker` exec path). Dev/CI reliability only; no new attacker-controlled sink. - **QA / dev scripts** — traced inputs (`REPO_ROOT`, deploy-time `.env` `LCD_URLS`/`API_PORT`, on-chain `terra1…` addresses, `txhash` from `terrad` JSON) to sinks (`docker compose` / `sg docker`, `docker exec` via `printf '%q'`, `curl`/`localterra_lcd_curl`, `terrad tx`, `jq --arg`). All require shell access on a developer/CI host; no remote caller can drive these paths. - **Injection / SSRF** — HTTP targets come from deploy-time env defaults (`127.0.0.1`) or chain responses filtered to `terra1…`; JSON/tx construction uses `jq --arg`/`--argjson`; `localterra_docker_exec` shell-quotes container id and argv. No plausible path for an external attacker to steer requests or execute arbitrary commands. - **Secrets / logging** — no mnemonics, keys, or tokens logged; truncated addresses/tx hashes only. - **Authn/authz** — no new HTTP endpoints or permission boundaries. ### Prior threads - Prior top-level security reviews on `0961244…`, `0d29463…`, and `65c07c13…` (all **0** medium+); conclusions unchanged after `03e183a`. - Bugbot threads (sg-docker flag, LCD curl fallback, pipefail abort, docker-exec fallback) are **QA reliability** issues, not security boundaries; addressed in this MR where applicable. ### Inline findings None — no inline threads opened.

PlasticDigits commented 2026-06-05 13:06:31 +00:00 (Migrated from gitlab.com)

Copy link

mentioned in commit 1d644f99d8

mentioned in commit 1d644f99d80117c569a389c580926b01082eb63b

PlasticDigits (Migrated from gitlab.com) merged commit 1d644f99d8 into main 2026-06-05 13:06:31 +00:00

PlasticDigits commented 2026-06-08 08:43:12 +00:00 (Migrated from gitlab.com)

Copy link

mentioned in commit 48baa914d4

mentioned in commit 48baa914d4bd3c54d674da0f019e40b4dcf66814

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

agent:fix_bugfix

  

agent:fix_conflicts

  

agent:fix_security

  

agent:gap_analysis

  

agent:implement

  

agent:implement

Queue implement gate

  

agent:implement

Queue implement gate

  

agent:open_issues

  

agent:ready

  

agent:research

  

agent:security_audit

  

agent:verify

  

architecture

Architecture

  

backend

API and services

  

blocker:hybrid

Blocks hybrid launch

  

blocker:launch

Blocks launch

  

blocker:limit-orders

Blocks limits launch

  

blocker:v2

Blocks v2

  

block:log_only

  

block:security

  

bug

  

ci

  

contracts

Smart contracts

  

correctness

  

deploy

  

dev

  

devops

  

docs

  

documentation

  

duplicate

  

e2e

  

enhancement

  

epic

Epic

  

feature

  

frontend

  

functional-completion

Functional

  

gas

  

good first issue

  

governance

  

help wanted

  

high-risk

  

hooks

  

hybrid

Hybrid swaps

  

indexer

Indexer

  

infra

CI/CD

  

infrastructure

  

integrators

  

invalid

  

launch-blocker

  

limit-orders

Limit orders

  

localnet

  

localterra

  

low priority

  

missing-implementation

Implementation

  

needs-design

Design decision required

  

ops

  

performance

  

priority

high

  

priority

medium

  

product

  

qa

  

QA

  

question

  

ready

Definition of Ready

  

ready

Definition of Ready

  

research

  

scripts

  

security

Security

  

security-hardening

Security hardening

  

smartcontracts

  

tech-debt

  

testing

Testing

  

ux

  

UX

  

v2

Pool-only swaps

  

verification

  

wontfix

No labels

agent:fix_bugfix

agent:fix_conflicts

agent:fix_security

agent:gap_analysis

agent:implement

agent:implement

agent:implement

agent:open_issues

agent:ready

agent:research

agent:security_audit

agent:verify

architecture

backend

blocker:hybrid

blocker:launch

blocker:limit-orders

blocker:v2

block:log_only

block:security

bug

ci

contracts

correctness

deploy

dev

devops

docs

documentation

duplicate

e2e

enhancement

epic

feature

frontend

functional-completion

gas

good first issue

governance

help wanted

high-risk

hooks

hybrid

indexer

infra

infrastructure

integrators

invalid

launch-blocker

limit-orders

localnet

localterra

low priority

missing-implementation

needs-design

ops

performance

priority

high

priority

medium

product

qa

QA

question

ready

ready

research

scripts

security

security-hardening

smartcontracts

tech-debt

testing

ux

UX

v2

verification

wontfix

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

code/cl8y-dex-terraclassic!799

No description provided.