Frontend trust boundaries, build guards, and expert mode (#378) #902

2026-06-13T09:45:31Z

PlasticDigits commented

2026-06-13 09:45:31 +00:00

(Migrated from gitlab.com)

Summary

Implements GitLab #378 (remediation bundle for #376): hardens frontend off-chain trust boundaries without on-chain hop cross-checks.

H-04: Documents indexer MITM/compromised-indexer risks; deploy checklist requires HTTPS VITE_INDEXER_URL; existing swap route summary unchanged.
H-05: vite build rejects VITE_DEV_MNEMONIC outside development mode (escape: VITE_ALLOW_DEV_MNEMONIC=local-only).
M-07: Production CSP narrows connect-src to LCD/RPC/indexer + WalletConnect; bootstrap scripts moved to /bootstrap/*.js (script-src 'self'). Dev keeps broader policy for Vite HMR.
M-08: Factory/router/LCD/RPC on /protocol audit panel only; optional deployAddressVerification.ts documented.
M-09: Token logo host allowlist (tokenLogoAllowlist.ts); untrusted URLs fall back to blockie; ops doc for human-reviewed indexer listings.
M-10: Production vite build requires VITE_WC_PROJECT_ID; dev-only WC default in wallet.ts.
M-15: Expert mode requires typing ENABLE EXPERT MODE; 30%/50% slippage thresholds unchanged.

Docs: security-model.md, frontend.md, operator-secrets.md, launch-checklist.md, skills/AGENTS_FRONTEND_TRUST_BOUNDARIES.md.

Acceptance checklist

Criterion	Verification	Result
Off-chain indexer trust documented; HTTPS indexer deploy checklist	`docs/security-model.md`, `docs/runbooks/launch-checklist.md` Phase 4	PASS
`vite build` fails on dev mnemonic outside development	`VITE_DEV_MNEMONIC=… npx vite build --mode staging` → error	PASS
`vite build` fails on missing WC project ID in production	`unset VITE_WC_PROJECT_ID; npx vite build --mode production` → error	PASS
CSP tightened (no broad `https:` connect-src in production)	`viteConfig.build.test.ts` CSP tests; `render.yaml` headers	PASS
Factory/router on protocol/audit page only	`ProtocolPage.tsx` `data-testid="protocol-deploy-addresses"`	PASS
Logo host allowlist; listing human-review documented	`tokenLogoAllowlist.test.ts`; `operator-secrets.md`	PASS
Expert mode typed confirmation; 30%/50% unchanged	`ExpertModeModal.test.tsx`, `swapRouteSlippage.ts` constants	PASS
All frontend unit tests	`make test-frontend` (997 tests)	PASS
Frontend lint	`make lint-frontend` (0 errors)	PASS

Third-party verification

make test-frontend
make lint-frontend
cd frontend-dapp && npm run test:run -- src/viteConfig.build.test.ts src/utils/tokenLogoAllowlist.test.ts src/components/swap/ExpertModeModal.test.tsx

# Abuse checks (must fail):
cd frontend-dapp && VITE_DEV_MNEMONIC='abandon … about' npx vite build --mode staging
cd frontend-dapp && unset VITE_WC_PROJECT_ID && npx vite build --mode production

Manual (optional): make dev → /protocol shows factory/router; swap expert mode requires typing phrase; evil logo URL shows blockie.

Blockers

None.

Note

Medium Risk
Touches production build env, CSP, and WalletConnect configuration—misconfigured deploy env could break builds or mobile wallets, but changes are defensive with regression tests and no on-chain logic changes.

Overview
Implements GitLab #378 remediation for off-chain trust: documents indexer/MITM and build-time risks, and adds concrete frontend guards without browser-side route re-validation.

Build & deploy: vite build now blocks VITE_DEV_MNEMONIC for any mode except development (escape VITE_ALLOW_DEV_MNEMONIC=local-only), and production builds require VITE_WC_PROJECT_ID. Production CSP is generated at build time with a narrow connect-src (LCD/RPC/indexer + WalletConnect) and script-src 'self' after moving theme/trade bootstrap out of inline HTML into /bootstrap/*. render.yaml drops the blanket CSP header so the built index.html policy applies.

UX & safety: Expert Mode requires typing ENABLE EXPERT MODE (slippage caps unchanged). Token logos use an HTTPS host allowlist with blockie fallback. /protocol shows factory/router/LCD/RPC for audit only; optional VITE_VERIFY_DEPLOY_ADDRESSES runs an LCD router-config check at startup. WalletConnect’s shared default project ID is dev-only in wallet.ts.

Docs, .env.example, E2E/unit tests, and AGENTS_FRONTEND_TRUST_BOUNDARIES.md align with the launch checklist (HTTPS indexer, WC ID, CSP).

^{Reviewed by Cursor Bugbot for commit ec409fde96. Bugbot is set up for automated code reviews on this repo. Configure here.}

## Summary Implements GitLab #378 (remediation bundle for #376): hardens frontend off-chain trust boundaries without on-chain hop cross-checks. - **H-04:** Documents indexer MITM/compromised-indexer risks; deploy checklist requires HTTPS `VITE_INDEXER_URL`; existing swap route summary unchanged. - **H-05:** `vite build` rejects `VITE_DEV_MNEMONIC` outside `development` mode (escape: `VITE_ALLOW_DEV_MNEMONIC=local-only`). - **M-07:** Production CSP narrows `connect-src` to LCD/RPC/indexer + WalletConnect; bootstrap scripts moved to `/bootstrap/*.js` (`script-src 'self'`). Dev keeps broader policy for Vite HMR. - **M-08:** Factory/router/LCD/RPC on `/protocol` audit panel only; optional `deployAddressVerification.ts` documented. - **M-09:** Token logo host allowlist (`tokenLogoAllowlist.ts`); untrusted URLs fall back to blockie; ops doc for human-reviewed indexer listings. - **M-10:** Production `vite build` requires `VITE_WC_PROJECT_ID`; dev-only WC default in `wallet.ts`. - **M-15:** Expert mode requires typing `ENABLE EXPERT MODE`; 30%/50% slippage thresholds unchanged. Docs: `security-model.md`, `frontend.md`, `operator-secrets.md`, `launch-checklist.md`, `skills/AGENTS_FRONTEND_TRUST_BOUNDARIES.md`. ## Acceptance checklist | Criterion | Verification | Result | |-----------|--------------|--------| | Off-chain indexer trust documented; HTTPS indexer deploy checklist | `docs/security-model.md`, `docs/runbooks/launch-checklist.md` Phase 4 | PASS | | `vite build` fails on dev mnemonic outside development | `VITE_DEV_MNEMONIC=… npx vite build --mode staging` → error | PASS | | `vite build` fails on missing WC project ID in production | `unset VITE_WC_PROJECT_ID; npx vite build --mode production` → error | PASS | | CSP tightened (no broad `https:` connect-src in production) | `viteConfig.build.test.ts` CSP tests; `render.yaml` headers | PASS | | Factory/router on protocol/audit page only | `ProtocolPage.tsx` `data-testid="protocol-deploy-addresses"` | PASS | | Logo host allowlist; listing human-review documented | `tokenLogoAllowlist.test.ts`; `operator-secrets.md` | PASS | | Expert mode typed confirmation; 30%/50% unchanged | `ExpertModeModal.test.tsx`, `swapRouteSlippage.ts` constants | PASS | | All frontend unit tests | `make test-frontend` (997 tests) | PASS | | Frontend lint | `make lint-frontend` (0 errors) | PASS | ## Third-party verification ```bash make test-frontend make lint-frontend cd frontend-dapp && npm run test:run -- src/viteConfig.build.test.ts src/utils/tokenLogoAllowlist.test.ts src/components/swap/ExpertModeModal.test.tsx # Abuse checks (must fail): cd frontend-dapp && VITE_DEV_MNEMONIC='abandon … about' npx vite build --mode staging cd frontend-dapp && unset VITE_WC_PROJECT_ID && npx vite build --mode production ``` Manual (optional): `make dev` → `/protocol` shows factory/router; swap expert mode requires typing phrase; evil logo URL shows blockie. ## Blockers None.  --- > [!NOTE] > **Medium Risk** > Touches production build env, CSP, and WalletConnect configuration—misconfigured deploy env could break builds or mobile wallets, but changes are defensive with regression tests and no on-chain logic changes. > > **Overview** > Implements GitLab **#378** remediation for off-chain trust: documents indexer/MITM and build-time risks, and adds concrete frontend guards without browser-side route re-validation. > > **Build & deploy:** `vite build` now blocks **`VITE_DEV_MNEMONIC`** for any mode except `development` (escape **`VITE_ALLOW_DEV_MNEMONIC=local-only`**), and production builds require **`VITE_WC_PROJECT_ID`**. Production CSP is generated at build time with a narrow **`connect-src`** (LCD/RPC/indexer + WalletConnect) and **`script-src 'self'`** after moving theme/trade bootstrap out of inline HTML into **`/bootstrap/*`**. **`render.yaml`** drops the blanket CSP header so the built **`index.html`** policy applies. > > **UX & safety:** Expert Mode requires typing **`ENABLE EXPERT MODE`** (slippage caps unchanged). Token logos use an **HTTPS host allowlist** with blockie fallback. **`/protocol`** shows factory/router/LCD/RPC for audit only; optional **`VITE_VERIFY_DEPLOY_ADDRESSES`** runs an LCD router-config check at startup. WalletConnect’s shared default project ID is **dev-only** in **`wallet.ts`**. > > Docs, **`.env.example`**, E2E/unit tests, and **`AGENTS_FRONTEND_TRUST_BOUNDARIES.md`** align with the launch checklist (HTTPS indexer, WC ID, CSP). > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit ec409fde96255489523f8772334d480cc3e56b11. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>

ghost1 commented

2026-06-13 09:45:39 +00:00

(Migrated from gitlab.com)

changed the description

ghost1 commented

2026-06-13 09:45:48 +00:00

(Migrated from gitlab.com)

changed the description

ghost1 commented

2026-06-13 09:46:30 +00:00

(Migrated from gitlab.com)

Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.

^{Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issues.}

^{Reviewed by Cursor Bugbot for commit b45ac0aea6. Configure here.}

Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.  <a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9BTExfSU5fQ1VSU09SIiwiZGF0YSI6eyJyZWRpc0tleSI6ImJ1Z2JvdC1tdWx0aTozZWQwMjJiOC00OWE5LTRlZTAtYmUxNC1lMDc3YzEzMDY1NDkiLCJlbmNyeXB0aW9uS2V5IjoiYzAyZXdsRUkzM01QNkYxbzU1cXpaanhXbnp1Q2FwZVdyMWY5eDdReTE4ayIsImJyYW5jaCI6Imlzc3VlLTM3OC1mcm9udGVuZC10cnVzdC1ib3VuZGFyaWVzIiwicmVwb093bmVyIjoiUGxhc3RpY0RpZ2l0cyIsInJlcG9OYW1lIjoiY2w4eS1kZXgtdGVycmFjbGFzc2ljIn19" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix All in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a>   <sup>Bugbot Autofix is [ON](https://www.cursor.com/dashboard/bugbot). A cloud agent has been kicked off to fix the reported issues. </sup>  <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit b45ac0aea60c370b1097a42a4677a9c14bbb0dbb. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>

ghost1 commented

2026-06-13 09:46:31 +00:00

(Migrated from gitlab.com)

Deploy address verify never runs

Medium Severity

verifyDeployAddressesOnLcd is documented and env-gated via VITE_VERIFY_DEPLOY_ADDRESSES, but nothing in the app reads that flag or calls the function at startup, so operators get no LCD mismatch warning when they enable the option.

^{Reviewed by Cursor Bugbot for commit b45ac0aea6. Configure here.}

### Deploy address verify never runs **Medium Severity**  `verifyDeployAddressesOnLcd` is documented and env-gated via `VITE_VERIFY_DEPLOY_ADDRESSES`, but nothing in the app reads that flag or calls the function at startup, so operators get no LCD mismatch warning when they enable the option.    <div><a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9DVVJTT1IiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90Ojg1OTRiM2M1LWYxMTgtNDIzZC05ODE3LTE0MjY4YjEwODdmMSIsImVuY3J5cHRpb25LZXkiOiI0R0sxbTA1ejA4STU1QlR4d1JlNU50RDJiN080aVpxbzJYOXF5U19JT0hjIiwiYnJhbmNoIjoiaXNzdWUtMzc4LWZyb250ZW5kLXRydXN0LWJvdW5kYXJpZXMiLCJyZXBvT3duZXIiOiJQbGFzdGljRGlnaXRzIiwicmVwb05hbWUiOiJjbDh5LWRleC10ZXJyYWNsYXNzaWMifX0" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a> <a href="https://cursor.com/agents?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9XRUIiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90Ojg1OTRiM2M1LWYxMTgtNDIzZC05ODE3LTE0MjY4YjEwODdmMSIsImVuY3J5cHRpb25LZXkiOiI0R0sxbTA1ejA4STU1QlR4d1JlNU50RDJiN080aVpxbzJYOXF5U19JT0hjIiwiYnJhbmNoIjoiaXNzdWUtMzc4LWZyb250ZW5kLXRydXN0LWJvdW5kYXJpZXMiLCJyZXBvT3duZXIiOiJQbGFzdGljRGlnaXRzIiwicmVwb05hbWUiOiJjbDh5LWRleC10ZXJyYWNsYXNzaWMiLCJwck51bWJlciI6MTg0LCJjb21taXRTaGEiOiJiNDVhYzBhZWE2MGMzNzBiMTA5N2E0MmE0Njc3YTljMTRiYmIwZGJiIiwicHJvdmlkZXIiOiJnaXRsYWIiLCJob3N0bmFtZSI6ImdpdGxhYi5jb20ifX0" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-web-light.png"><img alt="Fix in Web" width="99" height="28" src="https://cursor.com/assets/images/fix-in-web-dark.png"></picture></a></div> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit b45ac0aea60c370b1097a42a4677a9c14bbb0dbb. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>

ghost1 commented

2026-06-13 09:46:31 +00:00

(Migrated from gitlab.com)

Render CSP omits indexer host

High Severity

The static host Content-Security-Policy connect-src lists LCD, RPC, and WalletConnect origins but not the production indexer API. Browsers enforce CSP from both the response header and the built index.html meta tag, so cross-origin indexer fetches fail on Render even when the bundle’s meta policy includes VITE_INDEXER_URL.

^{Reviewed by Cursor Bugbot for commit b45ac0aea6. Configure here.}

### Render CSP omits indexer host **High Severity**  The static host `Content-Security-Policy` `connect-src` lists LCD, RPC, and WalletConnect origins but not the production indexer API. Browsers enforce CSP from both the response header and the built `index.html` meta tag, so cross-origin indexer fetches fail on Render even when the bundle’s meta policy includes `VITE_INDEXER_URL`.    <div><a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9DVVJTT1IiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OmE5YWNmNDIzLTc5ZTctNDcxYS04ZDRiLWEyMjlmYjg3ZmUxZSIsImVuY3J5cHRpb25LZXkiOiJJTHRnQVpPOEs3RDZER3RPTnVraEtrRVduTUZ5cnVOdUVuaXk3aWJ5OUlrIiwiYnJhbmNoIjoiaXNzdWUtMzc4LWZyb250ZW5kLXRydXN0LWJvdW5kYXJpZXMiLCJyZXBvT3duZXIiOiJQbGFzdGljRGlnaXRzIiwicmVwb05hbWUiOiJjbDh5LWRleC10ZXJyYWNsYXNzaWMifX0" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a> <a href="https://cursor.com/agents?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9XRUIiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OmE5YWNmNDIzLTc5ZTctNDcxYS04ZDRiLWEyMjlmYjg3ZmUxZSIsImVuY3J5cHRpb25LZXkiOiJJTHRnQVpPOEs3RDZER3RPTnVraEtrRVduTUZ5cnVOdUVuaXk3aWJ5OUlrIiwiYnJhbmNoIjoiaXNzdWUtMzc4LWZyb250ZW5kLXRydXN0LWJvdW5kYXJpZXMiLCJyZXBvT3duZXIiOiJQbGFzdGljRGlnaXRzIiwicmVwb05hbWUiOiJjbDh5LWRleC10ZXJyYWNsYXNzaWMiLCJwck51bWJlciI6MTg0LCJjb21taXRTaGEiOiJiNDVhYzBhZWE2MGMzNzBiMTA5N2E0MmE0Njc3YTljMTRiYmIwZGJiIiwicHJvdmlkZXIiOiJnaXRsYWIiLCJob3N0bmFtZSI6ImdpdGxhYi5jb20ifX0" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-web-light.png"><img alt="Fix in Web" width="99" height="28" src="https://cursor.com/assets/images/fix-in-web-dark.png"></picture></a></div> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit b45ac0aea60c370b1097a42a4677a9c14bbb0dbb. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>

PlasticDigits commented

2026-06-13 09:48:26 +00:00

(Migrated from gitlab.com)

Security review — MR !902

Commit reviewed: b45ac0aea60c370b1097a42a4677a9c14bbb0dbb

Scope: Frontend off-chain trust boundaries (#378): build-time guards (VITE_DEV_MNEMONIC, VITE_WC_PROJECT_ID), production CSP narrowing, bootstrap script externalization, token logo host allowlist, expert-mode typed confirmation, /protocol deploy-address audit panel, optional deployAddressVerification.ts, docs/runbooks.

Outcome: FINDINGS: 0 medium+

Summary: Reviewed added/modified code and traced attacker-controlled inputs (indexer logo_url, token logo URIs, expert-mode UI input, build env) to sinks (fetch/CSP/img src/localStorage). Changes are defensive: production CSP drops blanket https:/unsafe-inline scripts, build guards block dev mnemonic and shared WalletConnect ID in production bundles, token logos require HTTPS allowlisted hosts with blockie fallback, and TokenLogo re-validates URLs passed from callers.

Prior threads reviewed: Bugbot flagged Render CSP missing indexer host (availability/deployment — not an exploitable trust-boundary bypass) and unwired verifyDeployAddressesOnLcd (optional mitigation never hooked — no new attack path). Neither meets medium+ security criteria on this diff.

Inline findings: None.

Security review: no medium+ findings on this diff.

## Security review — MR !902 **Commit reviewed:** `b45ac0aea60c370b1097a42a4677a9c14bbb0dbb` **Scope:** Frontend off-chain trust boundaries (#378): build-time guards (`VITE_DEV_MNEMONIC`, `VITE_WC_PROJECT_ID`), production CSP narrowing, bootstrap script externalization, token logo host allowlist, expert-mode typed confirmation, `/protocol` deploy-address audit panel, optional `deployAddressVerification.ts`, docs/runbooks. **Outcome:** `FINDINGS: 0` medium+ **Summary:** Reviewed added/modified code and traced attacker-controlled inputs (indexer `logo_url`, token logo URIs, expert-mode UI input, build env) to sinks (fetch/CSP/img src/localStorage). Changes are defensive: production CSP drops blanket `https:`/`unsafe-inline` scripts, build guards block dev mnemonic and shared WalletConnect ID in production bundles, token logos require HTTPS allowlisted hosts with blockie fallback, and `TokenLogo` re-validates URLs passed from callers. **Prior threads reviewed:** Bugbot flagged Render CSP missing indexer host (availability/deployment — not an exploitable trust-boundary bypass) and unwired `verifyDeployAddressesOnLcd` (optional mitigation never hooked — no new attack path). Neither meets medium+ security criteria on this diff. **Inline findings:** None. Security review: no medium+ findings on this diff.

ghost1 commented

2026-06-13 09:52:17 +00:00

(Migrated from gitlab.com)

changed this line in version 2 of the diff

changed this line in [version 2 of the diff](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/184/diffs?diff_id=1850267328&start_sha=b45ac0aea60c370b1097a42a4677a9c14bbb0dbb#1b8a9c728ebe242b14ab7e5c41c6324017da50ee_11_9)

ghost1 commented

2026-06-13 09:52:17 +00:00

(Migrated from gitlab.com)

added 1 commit

ec409fde - fix: align Render CSP with build indexer origin and run deploy verify

Compare with previous version

added 1 commit <ul><li>ec409fde - fix: align Render CSP with build indexer origin and run deploy verify</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/184/diffs?diff_id=1850267328&start_sha=b45ac0aea60c370b1097a42a4677a9c14bbb0dbb)

ghost1 commented

2026-06-13 09:52:31 +00:00

(Migrated from gitlab.com)

changed the description

ghost1 commented

2026-06-13 09:52:52 +00:00

(Migrated from gitlab.com)

resolved all threads

ghost1 commented

2026-06-13 09:52:52 +00:00

(Migrated from gitlab.com)

resolved all threads