code/cl8y-dex-terraclassic

Fork 0

SEC-B02: wallet blacklist test coverage for hybrid swap, claim, and update (#393) #923

Merged

PlasticDigits merged 2 commits from issue-393-wallet-blacklist-test-coverage into main

2026-06-19 13:08:30 +00:00

PlasticDigits commented

2026-06-19 10:55:30 +00:00

(Migrated from gitlab.com)

Summary

Closes the SEC-B02 gap in wallet blacklist integration tests (#393). The pair contract already gates ClaimExpiredLimitOrder, UpdateLimitOrderPrice, and hybrid Swap via gate_trading_blacklist; this MR adds regression assertions and documents invariant B1.

Changes:

Extend wallet_blacklist_blocks_swap_lp_limits_and_unban_restores to assert blacklist rejection on hybrid swap, UpdateLimitOrderPrice, and ClaimExpiredLimitOrder (with a parked expired order fixture).
Cross-link coverage in docs/security-model.md and add matrix row B1 in docs/contracts-security-audit.md.

Acceptance checklist

Criterion	Verification	Result
Hybrid swap from a blacklisted wallet is tested and returns a blacklist error	`cd smartcontracts && cargo test wallet_blacklist_blocks_swap_lp_limits_and_unban_restores`	PASS
`ClaimExpiredLimitOrder` from a blacklisted wallet is tested and returns a blacklist error	same command	PASS
`UpdateLimitOrderPrice` from a blacklisted wallet is tested and returns a blacklist error	same command	PASS
All new assertions pass in CI	pre-push hook + `cargo test blacklist_tests`	PASS

Verification for third parties

cd smartcontracts
cargo test wallet_blacklist_blocks_swap_lp_limits_and_unban_restores -- --nocapture
cargo test blacklist_tests -- --nocapture

Confirm wallet_blacklist_blocks_swap_lp_limits_and_unban_restores includes assertions for:

hybrid Cw20HookMsg::Swap with hybrid: Some(...)
ExecuteMsg::UpdateLimitOrderPrice
ExecuteMsg::ClaimExpiredLimitOrder on a parked expired order

Docs: docs/security-model.md (SEC-B02 paragraph) and docs/contracts-security-audit.md row B1.

Related: #393

## Summary Closes the SEC-B02 gap in wallet blacklist integration tests ([#393](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/work_items/393)). The pair contract already gates `ClaimExpiredLimitOrder`, `UpdateLimitOrderPrice`, and hybrid `Swap` via `gate_trading_blacklist`; this MR adds regression assertions and documents invariant **B1**. Changes: - Extend `wallet_blacklist_blocks_swap_lp_limits_and_unban_restores` to assert blacklist rejection on **hybrid swap**, **`UpdateLimitOrderPrice`**, and **`ClaimExpiredLimitOrder`** (with a parked expired order fixture). - Cross-link coverage in `docs/security-model.md` and add matrix row **B1** in `docs/contracts-security-audit.md`. ## Acceptance checklist | Criterion | Verification | Result | |-----------|--------------|--------| | Hybrid swap from a blacklisted wallet is tested and returns a blacklist error | `cd smartcontracts && cargo test wallet_blacklist_blocks_swap_lp_limits_and_unban_restores` | PASS | | `ClaimExpiredLimitOrder` from a blacklisted wallet is tested and returns a blacklist error | same command | PASS | | `UpdateLimitOrderPrice` from a blacklisted wallet is tested and returns a blacklist error | same command | PASS | | All new assertions pass in CI | pre-push hook + `cargo test blacklist_tests` | PASS | ## Verification for third parties ```bash cd smartcontracts cargo test wallet_blacklist_blocks_swap_lp_limits_and_unban_restores -- --nocapture cargo test blacklist_tests -- --nocapture ``` Confirm `wallet_blacklist_blocks_swap_lp_limits_and_unban_restores` includes assertions for: - hybrid `Cw20HookMsg::Swap` with `hybrid: Some(...)` - `ExecuteMsg::UpdateLimitOrderPrice` - `ExecuteMsg::ClaimExpiredLimitOrder` on a parked expired order Docs: `docs/security-model.md` (SEC-B02 paragraph) and `docs/contracts-security-audit.md` row **B1**. Related: #393

PlasticDigits commented

2026-06-19 10:58:39 +00:00

(Migrated from gitlab.com)

Security review — MR !923

Commit reviewed: 64a9161040ee25b687c5dcd0f46d0004b3de7239

Scope: smartcontracts/tests/src/blacklist_tests.rs (SEC-B02 regression assertions for hybrid swap, UpdateLimitOrderPrice, ClaimExpiredLimitOrder); doc cross-links in docs/security-model.md and docs/contracts-security-audit.md (matrix row B1). No pair/router/factory contract or frontend runtime changes in this diff.

Method: Traced attacker-controlled inputs on the added test paths against existing gate_trading_blacklist / blacklist_guard::assert_trade_not_blacklisted_deps sinks in contract.rs (hybrid Cw20HookMsg::Swap via execute_receive, direct ClaimExpiredLimitOrder / UpdateLimitOrderPrice execute arms). Confirmed blacklist is enforced on info.sender before handler dispatch; hybrid swap shares the same receive-path gate as pool-only swap. Ran cargo test wallet_blacklist_blocks_swap_lp_limits_and_unban_restores locally — PASS.

Outcome: FINDINGS: 0 medium+

Security review: no medium+ findings on this diff. Changes add integration-test coverage and documentation for controls already present on-chain; they do not alter auth boundaries, validation, or user-facing execution logic.

Inline threads: none (no findings to anchor).

## Security review — MR !923 **Commit reviewed:** `64a9161040ee25b687c5dcd0f46d0004b3de7239` **Scope:** `smartcontracts/tests/src/blacklist_tests.rs` (SEC-B02 regression assertions for hybrid swap, `UpdateLimitOrderPrice`, `ClaimExpiredLimitOrder`); doc cross-links in `docs/security-model.md` and `docs/contracts-security-audit.md` (matrix row **B1**). No pair/router/factory contract or frontend runtime changes in this diff. **Method:** Traced attacker-controlled inputs on the added test paths against existing `gate_trading_blacklist` / `blacklist_guard::assert_trade_not_blacklisted_deps` sinks in `contract.rs` (hybrid `Cw20HookMsg::Swap` via `execute_receive`, direct `ClaimExpiredLimitOrder` / `UpdateLimitOrderPrice` execute arms). Confirmed blacklist is enforced on `info.sender` before handler dispatch; hybrid swap shares the same receive-path gate as pool-only swap. Ran `cargo test wallet_blacklist_blocks_swap_lp_limits_and_unban_restores` locally — PASS. **Outcome:** **FINDINGS: 0** medium+ Security review: **no medium+ findings** on this diff. Changes add integration-test coverage and documentation for controls already present on-chain; they do not alter auth boundaries, validation, or user-facing execution logic. **Inline threads:** none (no findings to anchor).

PlasticDigits commented

2026-06-19 12:50:38 +00:00

(Migrated from gitlab.com)

added 7 commits

64a91610...d487a0cd - 6 commits from branch main
2cc83935 - Merge branch 'main' into issue-393-wallet-blacklist-test-coverage

Compare with previous version

added 7 commits <ul><li>64a91610...d487a0cd - 6 commits from branch <code>main</code></li><li>2cc83935 - Merge branch 'main' into issue-393-wallet-blacklist-test-coverage</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/205/diffs?diff_id=1861162916&start_sha=64a9161040ee25b687c5dcd0f46d0004b3de7239)

PlasticDigits commented

2026-06-19 12:50:52 +00:00

(Migrated from gitlab.com)

Resolved merge conflict with main in docs/security-model.md.

Resolution: Kept both documentation paragraphs — SEC-B02 (wallet blacklist hybrid swap / claim / update coverage from this MR) and SEC-B04 (pair blacklist control-pair test from main).

Sanity checks:

cargo test wallet_blacklist_blocks_swap_lp_limits_and_unban_restores — PASS
cargo test blacklist_tests — 8/8 PASS

Resolved merge conflict with `main` in `docs/security-model.md`. **Resolution:** Kept both documentation paragraphs — SEC-B02 (wallet blacklist hybrid swap / claim / update coverage from this MR) and SEC-B04 (pair blacklist control-pair test from main). **Sanity checks:** - `cargo test wallet_blacklist_blocks_swap_lp_limits_and_unban_restores` — PASS - `cargo test blacklist_tests` — 8/8 PASS

PlasticDigits commented

2026-06-19 12:53:18 +00:00

(Migrated from gitlab.com)

Security review — MR !923

Commit reviewed: 2cc83935b8fe6c6025e1d7acbb25ce7c82e48bc8

Scope: smartcontracts/tests/src/blacklist_tests.rs (SEC-B02 regression assertions for hybrid Cw20HookMsg::Swap, UpdateLimitOrderPrice, ClaimExpiredLimitOrder with expired-order fixture); doc cross-links in docs/security-model.md and docs/contracts-security-audit.md (matrix row B1). No pair/router/factory contract, indexer, or frontend runtime changes in this diff.

Method: Re-read prior security-review thread on this MR. Traced attacker-controlled inputs on the added test paths against existing sinks: gate_trading_blacklist → blacklist_guard::assert_trade_not_blacklisted_deps in contract.rs. Confirmed hybrid swap shares the execute_receive gate (checks cw20_msg.sender and optional trader before dispatch); direct ClaimExpiredLimitOrder / UpdateLimitOrderPrice arms gate info.sender before handler logic. Blacklist enforcement is factory-governance-only (non_governance_cannot_blacklist_wallet already covered). Ran cargo test wallet_blacklist_blocks_swap_lp_limits_and_unban_restores locally — PASS.

Outcome: FINDINGS: 0 medium+

Security review: no medium+ findings on this diff. Changes add integration-test coverage and documentation for on-chain controls already present; they do not alter auth boundaries, validation, execution logic, or off-chain attack surface.

Inline threads: none (no findings to anchor).

## Security review — MR !923 **Commit reviewed:** `2cc83935b8fe6c6025e1d7acbb25ce7c82e48bc8` **Scope:** `smartcontracts/tests/src/blacklist_tests.rs` (SEC-B02 regression assertions for hybrid `Cw20HookMsg::Swap`, `UpdateLimitOrderPrice`, `ClaimExpiredLimitOrder` with expired-order fixture); doc cross-links in `docs/security-model.md` and `docs/contracts-security-audit.md` (matrix row **B1**). No pair/router/factory contract, indexer, or frontend runtime changes in this diff. **Method:** Re-read prior security-review thread on this MR. Traced attacker-controlled inputs on the added test paths against existing sinks: `gate_trading_blacklist` → `blacklist_guard::assert_trade_not_blacklisted_deps` in `contract.rs`. Confirmed hybrid swap shares the `execute_receive` gate (checks `cw20_msg.sender` and optional `trader` before dispatch); direct `ClaimExpiredLimitOrder` / `UpdateLimitOrderPrice` arms gate `info.sender` before handler logic. Blacklist enforcement is factory-governance-only (`non_governance_cannot_blacklist_wallet` already covered). Ran `cargo test wallet_blacklist_blocks_swap_lp_limits_and_unban_restores` locally — PASS. **Outcome:** **FINDINGS: 0** medium+ Security review: **no medium+ findings** on this diff. Changes add integration-test coverage and documentation for on-chain controls already present; they do not alter auth boundaries, validation, execution logic, or off-chain attack surface. **Inline threads:** none (no findings to anchor).