docs(#293): verification guardrails for slippage enrichment + stale quote assets

PlasticDigits commented

2026-06-06 13:03:17 +00:00

(Migrated from gitlab.com)

Summary

Verification QA for https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/work_items/293 after the Expert Mode / route-based slippage implementation. Updates make verify-issue-293 acceptance and documents a stale-indexer-DB prerequisite that caused false FAIL on slippage enrichment.

Root cause of live [3c] failure (stale VM): duplicate USTC-C rows in indexer assets from a prior deploy — find_quote_token picked an unroutable quote address and enrich_route_slippage silently omitted fields. Fresh deploy (make setup-cloud-localterra --fresh) restores enrichment.

Changes

scripts/qa/verify-issue-293.sh: [3-preflight] duplicate quote-asset probe; [3c] checks slippage_percent + spot_amount_out presence, math consistency, and retail-guard exercisability (>30%) instead of brittle global≥99%/pool≤5% thresholds
docs/testing.md, docs/indexer-invariants.md, skills/AGENTS_LOCALNET_TRADING_SWARM.md: document slippage enrichment acceptance + --fresh prerequisite

Verification checklist

Acceptance item	Command / evidence	Result
Swarm liquidity unit tests	`make test-swarm-liquidity`	PASS (5/5)
TS swarm profile tests	`cd packages/localnet-trading-swarm && npm run test:run`	PASS (14/14)
Indexer `route_slippage` lib tests	`cd indexer && cargo test route_slippage --lib`	PASS (3/3)
Frontend Expert Mode guard	`npm run test -- src/pages/SwapPage.test.tsx -t 293`	PASS
Live OE-1 pool_only reciprocal (≤5%)	`make verify-issue-293` [3b]	PASS
Route slippage enrichment	`make verify-issue-293` [3c] after `--fresh` deploy	PASS
Global route asymmetry (informational)	`make verify-issue-293` [3a]	DOCUMENTED
Swap UI expected slippage + Expert Mode block	Chrome manual QA on `http://127.0.0.1:5173`	PASS
Human-scaled amounts	Swap UI 1 EMBER → 16.23K CORAL	PASS

Issue left open for product review.

Note

Low Risk
Documentation and local QA script only; no production code paths changed.

Overview
#293 QA guardrails — no indexer or dApp logic changes; docs and scripts/qa/verify-issue-293.sh only.

verify-issue-293.sh adds [3-preflight] counting USTC-C rows in indexer assets (expects 1; duplicates → fail with make setup-cloud-localterra --fresh). [3c] drops brittle thresholds (global ≥99% / pool_only ≤5%) in favor of presence of slippage_percent, spot_amount_out, and estimated_amount_out, ±1% math check against symmetric deviation, and proof that at least one EMBER→CORAL path exceeds 30% so the retail Expert Mode block is exercisable.

Docs (docs/testing.md, docs/indexer-invariants.md, skills/AGENTS_LOCALNET_TRADING_SWARM.md) align acceptance with the new checks, explain stale duplicate quote assets breaking find_quote_token / slippage enrichment, and broaden slippage UX wording (excessive slippage vs “high on global routes only”).

^{Reviewed by Cursor Bugbot for commit 97762c0804. Bugbot is set up for automated code reviews on this repo. Configure here.}

## Summary Verification QA for https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/work_items/293 after the Expert Mode / route-based slippage implementation. Updates `make verify-issue-293` acceptance and documents a stale-indexer-DB prerequisite that caused false **FAIL** on slippage enrichment. **Root cause of live [3c] failure (stale VM):** duplicate `USTC-C` rows in indexer `assets` from a prior deploy — `find_quote_token` picked an unroutable quote address and `enrich_route_slippage` silently omitted fields. Fresh deploy (`make setup-cloud-localterra --fresh`) restores enrichment. ## Changes - `scripts/qa/verify-issue-293.sh`: [3-preflight] duplicate quote-asset probe; [3c] checks `slippage_percent` + `spot_amount_out` presence, math consistency, and retail-guard exercisability (>30%) instead of brittle global≥99%/pool≤5% thresholds - `docs/testing.md`, `docs/indexer-invariants.md`, `skills/AGENTS_LOCALNET_TRADING_SWARM.md`: document slippage enrichment acceptance + `--fresh` prerequisite ## Verification checklist | Acceptance item | Command / evidence | Result | |-----------------|-------------------|--------| | Swarm liquidity unit tests | `make test-swarm-liquidity` | **PASS** (5/5) | | TS swarm profile tests | `cd packages/localnet-trading-swarm && npm run test:run` | **PASS** (14/14) | | Indexer `route_slippage` lib tests | `cd indexer && cargo test route_slippage --lib` | **PASS** (3/3) | | Frontend Expert Mode guard | `npm run test -- src/pages/SwapPage.test.tsx -t 293` | **PASS** | | Live OE-1 pool_only reciprocal (≤5%) | `make verify-issue-293` [3b] | **PASS** | | Route slippage enrichment | `make verify-issue-293` [3c] after `--fresh` deploy | **PASS** | | Global route asymmetry (informational) | `make verify-issue-293` [3a] | **DOCUMENTED** | | Swap UI expected slippage + Expert Mode block | Chrome manual QA on `http://127.0.0.1:5173` | **PASS** | | Human-scaled amounts | Swap UI 1 EMBER → **16.23K** CORAL | **PASS** | Issue left **open** for product review.  --- > [!NOTE] > **Low Risk** > Documentation and local QA script only; no production code paths changed. > > **Overview** > **#293 QA guardrails** — no indexer or dApp logic changes; docs and `scripts/qa/verify-issue-293.sh` only. > > `verify-issue-293.sh` adds **[3-preflight]** counting `USTC-C` rows in indexer `assets` (expects **1**; duplicates → fail with `make setup-cloud-localterra --fresh`). **[3c]** drops brittle thresholds (global ≥99% / pool_only ≤5%) in favor of presence of `slippage_percent`, `spot_amount_out`, and `estimated_amount_out`, **±1%** math check against symmetric deviation, and proof that at least one EMBER→CORAL path exceeds **30%** so the retail Expert Mode block is exercisable. > > **Docs** (`docs/testing.md`, `docs/indexer-invariants.md`, `skills/AGENTS_LOCALNET_TRADING_SWARM.md`) align acceptance with the new checks, explain stale duplicate quote assets breaking `find_quote_token` / slippage enrichment, and broaden slippage UX wording (excessive slippage vs “high on global routes only”). > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 97762c0804545778c44805b27f01bcca3d6ef892. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>

ghost1 commented

2026-06-06 13:03:23 +00:00

(Migrated from gitlab.com)

changed the description

PlasticDigits commented

2026-06-06 13:03:28 +00:00

(Migrated from gitlab.com)

changed the description

ghost1 commented

2026-06-06 13:03:30 +00:00

(Migrated from gitlab.com)

changed the description

PlasticDigits commented

2026-06-06 13:03:54 +00:00

(Migrated from gitlab.com)

mentioned in issue #293

PlasticDigits commented

2026-06-06 13:04:12 +00:00

(Migrated from gitlab.com)

Security review

Commit reviewed: 131ca8a6bd8bef0450b5de4f6ac258f0716b1c34

Scope: MR !832 — docs and QA guardrails for GitLab #293 slippage enrichment verification (docs/indexer-invariants.md, docs/testing.md, skills/AGENTS_LOCALNET_TRADING_SWARM.md, scripts/qa/verify-issue-293.sh). No production indexer, frontend, or contract code changes.

Method: Reviewed the full MR diff. Traced attacker-controlled inputs on the changed script paths (new [3-preflight] Postgres probe, updated [3c] Python acceptance logic). Checked for injection, authz bypass, secret leakage, SSRF, and unsafe deserialization.

Outcome: FINDINGS: 0 medium+ vulnerabilities.

Inline threads: None (no findings to anchor).

Notes (informational, below reporting threshold)

The new psql preflight uses a hardcoded USTC-C literal inside a local docker compose exec call; no external input reaches the query. This is dev/QA-only and not attacker-exposed.
VERIFY293_INDEXER_URL can redirect the embedded Python client to an arbitrary host, but that env override predates this MR and is limited to operators running the local verification script — not a production attack surface introduced here.
Doc updates describe existing slippage-enrichment and duplicate-quote-asset behavior; they do not change runtime security controls.

Security review: no medium+ findings on this diff.

## Security review **Commit reviewed:** `131ca8a6bd8bef0450b5de4f6ac258f0716b1c34` **Scope:** MR !832 — docs and QA guardrails for GitLab #293 slippage enrichment verification (`docs/indexer-invariants.md`, `docs/testing.md`, `skills/AGENTS_LOCALNET_TRADING_SWARM.md`, `scripts/qa/verify-issue-293.sh`). No production indexer, frontend, or contract code changes. **Method:** Reviewed the full MR diff. Traced attacker-controlled inputs on the changed script paths (new `[3-preflight]` Postgres probe, updated `[3c]` Python acceptance logic). Checked for injection, authz bypass, secret leakage, SSRF, and unsafe deserialization. **Outcome:** `FINDINGS: 0` medium+ vulnerabilities. **Inline threads:** None (no findings to anchor). ### Notes (informational, below reporting threshold) - The new `psql` preflight uses a hardcoded `USTC-C` literal inside a local `docker compose exec` call; no external input reaches the query. This is dev/QA-only and not attacker-exposed. - `VERIFY293_INDEXER_URL` can redirect the embedded Python client to an arbitrary host, but that env override predates this MR and is limited to operators running the local verification script — not a production attack surface introduced here. - Doc updates describe existing slippage-enrichment and duplicate-quote-asset behavior; they do not change runtime security controls. **Security review: no medium+ findings on this diff.**

ghost1 commented

2026-06-06 13:04:32 +00:00

(Migrated from gitlab.com)

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.}

^{Reviewed by Cursor Bugbot for commit 131ca8a6bd. Configure here.}

Cursor Bugbot has reviewed your changes and found 1 potential issue.  <a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9BTExfSU5fQ1VSU09SIiwiZGF0YSI6eyJyZWRpc0tleSI6ImJ1Z2JvdC1tdWx0aToyMTNiM2RjZS1iYjNjLTRlMDktYmM2Ny1mYmI3ZmM4NmEyZGMiLCJlbmNyeXB0aW9uS2V5IjoiLVlHSzNuejZsamhpYWtvZVh4Z09KTEFmTG9LNkdKeF93Szc2SjJaTUYzUSIsImJyYW5jaCI6ImN1cnNvci9naXRsYWItaXNzdWUtdmVyaWZpY2F0aW9uLWVjODgiLCJyZXBvT3duZXIiOiJQbGFzdGljRGlnaXRzIiwicmVwb05hbWUiOiJjbDh5LWRleC10ZXJyYWNsYXNzaWMifX0" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix All in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a>   <sup>Bugbot Autofix is [ON](https://www.cursor.com/dashboard/bugbot). A cloud agent has been kicked off to fix the reported issue. </sup>  <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 131ca8a6bd8bef0450b5de4f6ac258f0716b1c34. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>

ghost1 commented

2026-06-06 13:04:33 +00:00

(Migrated from gitlab.com)

Preflight passes zero USTC rows

Medium Severity

The new [3-preflight] check only fails when USTC-C row count is greater than one. When the count is zero, it still records PASS with “quote asset rows unique,” even though the failure message for duplicates says the count should be one and the updated docs tie missing quote assets to broken slippage enrichment.

^{Reviewed by Cursor Bugbot for commit 131ca8a6bd. Configure here.}

### Preflight passes zero USTC rows **Medium Severity**  The new `[3-preflight]` check only fails when `USTC-C` row count is greater than one. When the count is zero, it still records PASS with “quote asset rows unique,” even though the failure message for duplicates says the count should be one and the updated docs tie missing quote assets to broken slippage enrichment.    <div><a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9DVVJTT1IiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OmExNzdjYjUxLTI1ODctNDQ0Ni1iMGJkLWE5ZTVhYTczYjlmZSIsImVuY3J5cHRpb25LZXkiOiIydmR1UDBPXzdKZmk1WkdhT3ZUWHdzMkpZcHdGazBMcnVibXFXNzRTNlJNIiwiYnJhbmNoIjoiY3Vyc29yL2dpdGxhYi1pc3N1ZS12ZXJpZmljYXRpb24tZWM4OCIsInJlcG9Pd25lciI6IlBsYXN0aWNEaWdpdHMiLCJyZXBvTmFtZSI6ImNsOHktZGV4LXRlcnJhY2xhc3NpYyJ9fQ" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a> <a href="https://cursor.com/agents?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9XRUIiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OmExNzdjYjUxLTI1ODctNDQ0Ni1iMGJkLWE5ZTVhYTczYjlmZSIsImVuY3J5cHRpb25LZXkiOiIydmR1UDBPXzdKZmk1WkdhT3ZUWHdzMkpZcHdGazBMcnVibXFXNzRTNlJNIiwiYnJhbmNoIjoiY3Vyc29yL2dpdGxhYi1pc3N1ZS12ZXJpZmljYXRpb24tZWM4OCIsInJlcG9Pd25lciI6IlBsYXN0aWNEaWdpdHMiLCJyZXBvTmFtZSI6ImNsOHktZGV4LXRlcnJhY2xhc3NpYyIsInByTnVtYmVyIjoxMTQsImNvbW1pdFNoYSI6IjEzMWNhOGE2YmQ4YmVmMDQ1MGI1ZGU0ZjZhYzI1OGYwNzE2YjFjMzQiLCJwcm92aWRlciI6ImdpdGxhYiIsImhvc3RuYW1lIjoiZ2l0bGFiLmNvbSJ9fQ" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-web-light.png"><img alt="Fix in Web" width="99" height="28" src="https://cursor.com/assets/images/fix-in-web-dark.png"></picture></a></div> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 131ca8a6bd8bef0450b5de4f6ac258f0716b1c34. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>

ghost1 commented

2026-06-06 13:05:06 +00:00

(Migrated from gitlab.com)

added 1 commit

97762c08 - Fix verify-issue-293 preflight to fail when USTC-C row count is zero

Compare with previous version

added 1 commit <ul><li>97762c08 - Fix verify-issue-293 preflight to fail when USTC-C row count is zero</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/114/diffs?diff_id=1837967827&start_sha=131ca8a6bd8bef0450b5de4f6ac258f0716b1c34)

ghost1 commented

2026-06-06 13:05:17 +00:00

(Migrated from gitlab.com)

changed the description

ghost1 commented

2026-06-06 13:05:23 +00:00

(Migrated from gitlab.com)

resolved all threads

PlasticDigits commented

2026-06-06 13:06:01 +00:00

(Migrated from gitlab.com)

Security review

Commit reviewed: 97762c0804545778c44805b27f01bcca3d6ef892

Scope: MR !832 — docs and QA guardrails for GitLab #293 slippage enrichment verification (docs/indexer-invariants.md, docs/testing.md, skills/AGENTS_LOCALNET_TRADING_SWARM.md, scripts/qa/verify-issue-293.sh). No production indexer, frontend, or contract code changes.

Method: Reviewed the full MR diff at head 97762c08 (includes preflight fix requiring exactly one USTC-C asset row). Traced attacker-controlled inputs on changed script paths: new [3-preflight] Postgres probe (docker compose exec … psql with hardcoded symbol literal), updated [3c] Python acceptance logic (reads indexer /api/v1/tokens and /api/v1/route/solve). Checked for injection, authz bypass, secret leakage, SSRF, path traversal, and unsafe deserialization.

Outcome: FINDINGS: 0 medium+ vulnerabilities.

Inline threads: None (no findings to anchor).

Notes (informational, below reporting threshold)

The [3-preflight] psql query uses a hardcoded 'USTC-C' literal inside a local docker compose exec call; no external input reaches the SQL. Dev/QA-only, not attacker-exposed.
VERIFY293_INDEXER_URL can redirect the embedded Python HTTP client to an arbitrary host, but that env override predates this MR and is limited to operators running the local verification script — not a production attack surface introduced here.
Doc updates describe existing slippage-enrichment and duplicate-quote-asset behavior; they do not change runtime security controls.
Commit 97762c08 fixes a QA false-pass when USTC-C row count is zero (bash empty-string vs numeric compare); this is a test-correctness fix, not a security boundary change.

Security review: no medium+ findings on this diff.

## Security review **Commit reviewed:** `97762c0804545778c44805b27f01bcca3d6ef892` **Scope:** MR !832 — docs and QA guardrails for GitLab #293 slippage enrichment verification (`docs/indexer-invariants.md`, `docs/testing.md`, `skills/AGENTS_LOCALNET_TRADING_SWARM.md`, `scripts/qa/verify-issue-293.sh`). No production indexer, frontend, or contract code changes. **Method:** Reviewed the full MR diff at head `97762c08` (includes preflight fix requiring exactly one `USTC-C` asset row). Traced attacker-controlled inputs on changed script paths: new `[3-preflight]` Postgres probe (`docker compose exec … psql` with hardcoded symbol literal), updated `[3c]` Python acceptance logic (reads indexer `/api/v1/tokens` and `/api/v1/route/solve`). Checked for injection, authz bypass, secret leakage, SSRF, path traversal, and unsafe deserialization. **Outcome:** `FINDINGS: 0` medium+ vulnerabilities. **Inline threads:** None (no findings to anchor). ### Notes (informational, below reporting threshold) - The `[3-preflight]` `psql` query uses a hardcoded `'USTC-C'` literal inside a local `docker compose exec` call; no external input reaches the SQL. Dev/QA-only, not attacker-exposed. - `VERIFY293_INDEXER_URL` can redirect the embedded Python HTTP client to an arbitrary host, but that env override predates this MR and is limited to operators running the local verification script — not a production attack surface introduced here. - Doc updates describe existing slippage-enrichment and duplicate-quote-asset behavior; they do not change runtime security controls. - Commit `97762c08` fixes a QA false-pass when `USTC-C` row count is zero (bash empty-string vs numeric compare); this is a test-correctness fix, not a security boundary change. **Security review: no medium+ findings on this diff.**

PlasticDigits (Migrated from gitlab.com) merged commit 038a457ca7 into main

2026-06-07 11:47:51 +00:00

PlasticDigits commented

2026-06-07 11:47:52 +00:00

(Migrated from gitlab.com)

mentioned in commit 038a457ca7

mentioned in commit 038a457ca74654cb1844df077b639f8e0f858421

PlasticDigits commented

2026-06-08 08:43:13 +00:00

(Migrated from gitlab.com)

mentioned in commit cde24381bb

mentioned in commit cde24381bb97fba9679f70a799a1504a0b85749d

PlasticDigits commented

2026-06-08 13:42:28 +00:00

(Migrated from gitlab.com)

mentioned in commit b3ab6a315e

mentioned in commit b3ab6a315eb41075de75d3cf294175f667d6398c

Rows
Columns

docs(#293): verification guardrails for slippage enrichment + stale quote assets #832

Summary

Changes

Verification checklist

Security review

Notes (informational, below reporting threshold)

Preflight passes zero USTC rows

Security review

Notes (informational, below reporting threshold)