fix(#328): degraded pair search typed fallback + seed token names for QA #812
No reviewers
Labels
No labels
agent:fix_bugfix
agent:fix_conflicts
agent:fix_security
agent:gap_analysis
agent:implement
agent:implement
agent:implement
agent:open_issues
agent:ready
agent:research
agent:security_audit
agent:verify
architecture
backend
blocker:hybrid
blocker:launch
blocker:limit-orders
blocker:v2
block:log_only
block:security
bug
ci
contracts
correctness
deploy
dev
devops
docs
documentation
duplicate
e2e
enhancement
epic
feature
frontend
functional-completion
gas
good first issue
governance
help wanted
high-risk
hooks
hybrid
indexer
infra
infrastructure
integrators
invalid
launch-blocker
limit-orders
localnet
localterra
low priority
missing-implementation
needs-design
ops
performance
priority
high
priority
medium
product
qa
QA
question
ready
ready
research
scripts
security
security-hardening
smartcontracts
tech-debt
testing
ux
UX
v2
verification
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
code/cl8y-dex-terraclassic!812
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "cursor/gitlab-issue-workflow-4e2c"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Summary
Fixes #328 — follow-up to #314 pair search combobox.
What changed
EMBERmatches factory pairs if token metadata was cached from a prior on-chain read.PairSearchSelectshows a dim Offline search hint in degraded mode.resolve_assetre-fetches CW20token_infoand upserts when an existing DB row has emptynameorsymbol.main— Combined main’s sticky indexer-unavailable fallback and two-tokenXXX YYY/XXX/YYYpair queries with #328 haystack search.Acceptance checklist
mainresolvedgit merge origin/mainon branchEMBERreturns factory matchesPairSearchSelect.degraded.test.tsxPairSearchSelect.test.tsx,pairSearchQuery.test.ts(17 tests)cargo check(indexer)q=Embertier 2/3 hits./scripts/qa/verify-issue-328.shlayer 2Third-party verification
Closes #328
Related: #314
changed the description
changed the description
mentioned in issue #328
changed the description
Stale Security Review comment
Stale Security Review comment
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.
Reviewed by Cursor Bugbot for commit
fd54fb6ce2. Configure here.LCD failure blocks partial assets
Medium Severity
When a CW20 row exists but
nameorsymbolis blank,resolve_assetalways re-queries LCD. Any LCD/token_infoerror now fails resolution entirely instead of returning the existing asset id, so pair discovery and swap indexing can stop for pairs that previously indexed with partial metadata.Reviewed by Cursor Bugbot for commit
fd54fb6ce2. Configure here.added 1 commit
5e81f6f3- fix(indexer): fall back to existing asset id when LCD refresh failsCompare with previous version
Security review
Commit reviewed:
fd54fb6ce27308d55471c0ac66e85f6f3b82eb01Scope: MR !812 — degraded pair search haystack fallback (
pairSearchQuery.ts,PairSearchSelect.tsx,tokenDisplay.ts), indexerresolve_assetmetadata refresh (asset_resolver.rs), QA script/docs.Outcome:
FINDINGS: 0medium+Areas reviewed
includes()filtering; rendered option labels still come frompairInfoMenuLabel/ React text nodes ({opt.label}), not haystack content. No newdangerouslySetInnerHTMLor HTML sinks.getCachedTokenEntryreads same-origincl8y-dex-token-infocache (pre-existing write path via on-chaintoken_info). Poisoning requires prior same-origin compromise (XSS). Degraded search results are still gated tofactoryPairs/factorySet; selectedvalueis a factory-registered pair address, not attacker-supplied haystack text.upsert_assetand pair list filters remain parameterized (push_bind). QA scriptverify-issue-328.shis operator-run tooling only.resolve_assetLCDquery_contractcalls use operator-configured endpoints with on-chaincontract_addrfrom pair discovery — not user HTTP input. Extra refresh when DB name/symbol are empty is bounded to assets already referenced by indexed pairs.Prior threads
No prior security-review inline comments on this MR. Bugbot’s LCD partial-metadata availability note (reliability regression, not an attacker-controlled exploit path) was considered out of scope for medium+ security findings.
Inline threads: none (no medium+ findings).
changed the description
resolved all threads
Stale Security Review comment
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.
Reviewed by Cursor Bugbot for commit
5e81f6f3bd. Configure here.Repeated LCD refresh partial assets
Medium Severity
When a CW20 row exists but
nameorsymbolis empty,resolve_assetnow queries LCD on every call. Iftoken_infofails, it returns the existing id without persisting a skip or backoff, so later indexing (e.g. each swap’sresolve_asset_str) repeats the same failing LCD request indefinitely instead of reusing the cached row like before.Reviewed by Cursor Bugbot for commit
5e81f6f3bd. Configure here.Security review
Commit reviewed:
5e81f6f3bd7b3fb95cf244d4880ff843fa722dbcScope: MR !812 — degraded pair search haystack fallback (
pairSearchQuery.ts,PairSearchSelect.tsx,tokenDisplay.ts), indexerresolve_assetmetadata refresh + LCD failure fallback (asset_resolver.rs), QA script/docs.Outcome:
FINDINGS: 0medium+Areas reviewed
includes()filtering; rendered option labels still come frompairInfoMenuLabel/ React text nodes ({opt.label}), not haystack content. No newdangerouslySetInnerHTMLor HTML sinks.getCachedTokenEntryreads same-origincl8y-dex-token-infocache (pre-existing write path via on-chaintoken_info). Poisoning requires prior same-origin compromise (XSS). Degraded search results are still gated tofactoryPairs/factorySet; selectedvalueis a factory-registered pair address, not attacker-supplied haystack text.upsert_assetand pair list filters remain parameterized (push_bind). QA scriptverify-issue-328.shis operator-run tooling only.resolve_assetLCDquery_contractcalls use operator-configured endpoints with on-chaincontract_addrfrom pair discovery — not user HTTP input. Extra refresh when DB name/symbol are empty is bounded to assets already referenced by indexed pairs. Commit5e81f6fadds best-effort fallback to existing asset id on LCD failure, addressing the availability regression noted in prior Bugbot thread.Prior threads
fd54fb6reportedFINDINGS: 0medium+; re-reviewed after5e81f6fLCD fallback fix.5e81f6f.Inline threads: none (no medium+ findings).
added 1 commit
74a30537- fix(indexer): persist contract fallback when CW20 LCD refresh failsCompare with previous version
changed the description
resolved all threads
Security review
Commit reviewed:
74a305371e93cc18acaf76960fcd346ca1c81b3dScope: MR !812 — degraded pair search haystack fallback (
pairSearchQuery.ts,PairSearchSelect.tsx,tokenDisplay.ts), indexerresolve_assetCW20 metadata refresh + LCD failure fallback persistence (asset_resolver.rs), QA script/docs.Outcome:
FINDINGS: 0medium+Security review: no medium+ findings on this diff.
Areas reviewed
includes()filtering. Rendered option labels remainpairInfoMenuLabel/ React text nodes ({opt.label}), not haystack content. No newdangerouslySetInnerHTMLor HTML sinks.getCachedTokenEntryreads same-origincl8y-dex-token-info(existing write path via on-chaintoken_info). Poisoning requires prior same-origin compromise (XSS). Degraded matches are still limited tofactoryPairs/factorySet; selectedvalueis a factory-registered pair address, not attacker-supplied haystack text.upsert_assetand pair list filters remain parameterized (push_bind). QA scriptverify-issue-328.shis operator-run tooling only.resolve_assetLCDquery_contractuses operator-configured endpoints with on-chaincontract_addrfrom pair discovery / swap indexing — not user HTTP input. Extra refresh when DB name/symbol are empty is bounded to assets already referenced by indexed pairs. Commit74a30537persists contract-address placeholders on LCD failure so partial rows stop re-querying; this is an availability hardening, not a new attacker-controlled sink.Prior threads
5e81f6f3reportedFINDINGS: 0medium+; re-reviewed after74a30537LCD fallback persistence.5e81f6f+74a30537.Inline threads: none (no medium+ findings).
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.
Reviewed by Cursor Bugbot for commit
74a305371e. Configure here.LCD fallback blocks metadata refresh
Medium Severity
When
token_infofails during a metadata refresh, emptynameorsymbolfields are upserted with the contract address as placeholders. Laterresolve_assetcalls treat those rows as complete and skip the LCD refresh, so real CW20 names/symbols (e.g. Ember) may never populate after a transient LCD outage during pair sync.Reviewed by Cursor Bugbot for commit
74a305371e. Configure here.added 1 commit
d2414ae0- Fix LCD fallback writing placeholder metadata that blocks refresh retriesCompare with previous version
changed the description
resolved all threads
Security review
Commit reviewed:
d2414ae05e449d239289029258c556ffd2b3c0c0Scope: MR !812 — degraded pair search haystack fallback (
pairSearchQuery.ts,PairSearchSelect.tsx,tokenDisplay.ts), indexerresolve_assetCW20 metadata refresh + LCD failure fallback (asset_resolver.rs), QA script/docs.Outcome:
FINDINGS: 0medium+Security review: no medium+ findings on this diff.
Areas reviewed
includes()filtering. Rendered option labels remainpairInfoMenuLabel/ React text nodes ({opt.label}), not haystack content. No newdangerouslySetInnerHTMLor HTML sinks.getCachedTokenEntryreads same-origincl8y-dex-token-info(existing write path via on-chaintoken_info). Poisoning requires prior same-origin compromise (XSS). Degraded matches are still limited tofactoryPairs/factorySet; selectedvalueis a factory-registered pair address, not attacker-supplied haystack text.upsert_assetand pair list filters remain parameterized (push_bind). QA scriptverify-issue-328.shis operator-run tooling only.resolve_assetLCDquery_contractuses operator-configured endpoints with on-chaincontract_addrfrom pair discovery / swap indexing — not user HTTP input. Extra refresh when DB name/symbol are empty is bounded to assets already referenced by indexed pairs. Commitd2414ae0returns the existing asset id on LCD failure without upserting placeholder metadata, preserving retry behavior without introducing new attacker-controlled sinks.Prior threads
fd54fb6,5e81f6f3, and74a30537reportedFINDINGS: 0medium+; re-reviewed afterd2414ae0removes placeholder upsert on LCD failure (addresses Bugbot availability thread; no new exploit path).Inline threads: none (no medium+ findings).
added 30 commits
main15d38d53- Merge origin/main into cursor/gitlab-issue-workflow-4e2cCompare with previous version
changed the description
changed the description
mentioned in commit
9134e2843fSecurity review
Commit reviewed:
15d38d53d6d75dbb701d0e7aa004a89e25727493Scope: MR !812 — merge with
main+ degraded pair search haystack fallback (pairSearchQuery.ts,PairSearchSelect.tsx,tokenDisplay.ts), indexerresolve_assetCW20 metadata refresh + LCD failure fallback (asset_resolver.rs), QA script/docs.Outcome:
FINDINGS: 0medium+Security review: no medium+ findings on this diff.
Areas reviewed
includes()filtering. Rendered option labels remainpairInfoMenuLabel/ React text nodes ({opt.label}), not haystack content. No newdangerouslySetInnerHTMLor HTML sinks.getCachedTokenEntryreads same-origincl8y-dex-token-info(existing write path via on-chaintoken_info). Poisoning requires prior same-origin compromise (XSS). Degraded matches are still limited tofactoryPairs/factorySet; selectedvalueis a factory-registered pair address, not attacker-supplied haystack text.upsert_assetand pair list filters remain parameterized (push_bind). QA scriptverify-issue-328.shis operator-run tooling only.resolve_assetLCDquery_contractuses operator-configured endpoints with on-chaincontract_addrfrom pair discovery / swap indexing — not user HTTP input. Extra refresh when DB name/symbol are empty is bounded to assets already referenced by indexed pairs; LCD errors return the existing asset id without persisting placeholder metadata (lines 32–43).Prior threads
Re-checked Bugbot threads on
asset_resolver.rs(LCD failure / repeated refresh). Current head handles LCD errors by returning the existing partial asset id without upserting placeholders; remaining behavior is indexer availability/retry semantics, not a plausible confidentiality/integrity attack path for external callers.Inline findings: none on this revision.
mentioned in commit
02c49cbb2amentioned in commit
81784caa84