Add LocalTerra wrap-mapper pause/unpause smoke test (SEC-B06, #396) #926

Merged

PlasticDigits merged 2 commits from issue-396-wrap-mapper-pause-smoke into main 2026-06-19 13:08:38 +00:00

Conversation 5 Commits 2 Files changed 7 +340 -1

PlasticDigits commented 2026-06-19 11:09:27 +00:00 (Migrated from gitlab.com)

Copy link

Summary

Adds on-chain LocalTerra smoke coverage for wrap-mapper governance pause (GitLab #396 / launch checklist SEC-B06). The existing frontend and Playwright tests mock LCD pause state; this MR exercises the deployed ustr-cmm wrap-mapper contract: set_paused(true) rejects treasury wrap_deposit and LUNC-C send unwrap with clear paused errors, and set_paused(false) restores both paths.

New entry points:

• make smoke-wrap-mapper-pause — post-deploy on-chain transcript
• make verify-issue-396 — smoke + existing SEC-A02 Vitest bundle

Docs cross-linked in docs/testing.md, docs/runbooks/launch-checklist.md, and skills/AGENTS_FRONTEND_SWAP_SAFETY_CTA.md.

Related: #396 (issue stays open until merge)

Acceptance checklist

Criterion	Command / step	Result
LocalTerra smoke: wrap rejected under pause	make smoke-wrap-mapper-pause (wrap_deposit step)	PASS
LocalTerra smoke: unwrap rejected under pause	make smoke-wrap-mapper-pause (CW20 send unwrap step)	PASS
LocalTerra smoke: wrap + unwrap restored after unpause	make smoke-wrap-mapper-pause (post-unpause steps)	PASS
Wrap-mapper testable on LocalTerra (not external-only risk acceptance)	Deploy uses ustr-cmm wrap_mapper.wasm via make deploy-local	PASS (documented; no risk-acceptance waiver needed)
Frontend unit test for pause UI copy (SEC-A02)	make verify-issue-396 (Vitest SwapPage.test.tsx -t SEC-A02)	PASS

Verification checklist (third parties)

1. make start && make wait-healthy
2. make deploy-local (full seed — treasury + wrap-mapper)
3. make verify-issue-396 → expect PASS=4 FAIL=0
4. Optional isolated smoke: make smoke-wrap-mapper-pause — expect transcript ending OK: smoke-wrap-mapper-pause passed

Sample smoke output (LocalTerra):

== Assert wrap blocked while paused ==
  OK: wrap_deposit while paused — rejected at broadcast with paused error
== Assert unwrap blocked while paused ==
  OK: unwrap send while paused — rejected at broadcast with paused error
== Assert wrap restored after unpause ==
  OK: wrap_deposit after unpause (tx …)
== Assert unwrap restored after unpause ==
  OK: unwrap send after unpause (tx …)

Follow-ups

• Indexer tracking of wrap-mapper pause for frontend consumption (noted on #396) is out of scope for this MR; frontend still queries wrap-mapper LCD config directly.

## Summary Adds on-chain LocalTerra smoke coverage for wrap-mapper governance pause (GitLab #396 / launch checklist **SEC-B06**). The existing frontend and Playwright tests mock LCD pause state; this MR exercises the deployed `ustr-cmm` wrap-mapper contract: `set_paused(true)` rejects treasury `wrap_deposit` and LUNC-C `send` unwrap with clear paused errors, and `set_paused(false)` restores both paths. New entry points: - `make smoke-wrap-mapper-pause` — post-deploy on-chain transcript - `make verify-issue-396` — smoke + existing SEC-A02 Vitest bundle Docs cross-linked in `docs/testing.md`, `docs/runbooks/launch-checklist.md`, and `skills/AGENTS_FRONTEND_SWAP_SAFETY_CTA.md`. Related: #396 (issue stays open until merge) ## Acceptance checklist | Criterion | Command / step | Result | |-----------|----------------|--------| | LocalTerra smoke: wrap rejected under pause | `make smoke-wrap-mapper-pause` (wrap_deposit step) | **PASS** | | LocalTerra smoke: unwrap rejected under pause | `make smoke-wrap-mapper-pause` (CW20 send unwrap step) | **PASS** | | LocalTerra smoke: wrap + unwrap restored after unpause | `make smoke-wrap-mapper-pause` (post-unpause steps) | **PASS** | | Wrap-mapper testable on LocalTerra (not external-only risk acceptance) | Deploy uses `ustr-cmm` wrap_mapper.wasm via `make deploy-local` | **PASS** (documented; no risk-acceptance waiver needed) | | Frontend unit test for pause UI copy (SEC-A02) | `make verify-issue-396` (Vitest `SwapPage.test.tsx -t SEC-A02`) | **PASS** | ## Verification checklist (third parties) 1. `make start && make wait-healthy` 2. `make deploy-local` (full seed — treasury + wrap-mapper) 3. `make verify-issue-396` → expect `PASS=4 FAIL=0` 4. Optional isolated smoke: `make smoke-wrap-mapper-pause` — expect transcript ending `OK: smoke-wrap-mapper-pause passed` Sample smoke output (LocalTerra): ``` == Assert wrap blocked while paused == OK: wrap_deposit while paused — rejected at broadcast with paused error == Assert unwrap blocked while paused == OK: unwrap send while paused — rejected at broadcast with paused error == Assert wrap restored after unpause == OK: wrap_deposit after unpause (tx …) == Assert unwrap restored after unpause == OK: unwrap send after unpause (tx …) ``` ## Follow-ups - Indexer tracking of wrap-mapper pause for frontend consumption (noted on #396) is out of scope for this MR; frontend still queries wrap-mapper LCD `config` directly.

PlasticDigits commented 2026-06-19 11:12:04 +00:00 (Migrated from gitlab.com)

Copy link

Security review

Commit reviewed: 294de27a8287bada8c7f739812274602d950ed63
Scope: MR !926 — LocalTerra wrap-mapper pause/unpause smoke test (SEC-B06, #396): scripts/smoke-wrap-mapper-pause.sh, scripts/lib/smoke-wrap-env.sh, scripts/qa/verify-issue-396.sh, Makefile targets, docs/skills cross-links.

Outcome: FINDINGS: 0 medium+

Summary: Reviewed added/modified bash smoke/verify scripts and wiring. Changes are post-deploy LocalTerra QA tooling only (no production services, contracts, or frontend runtime paths). Attacker-controlled inputs were traced:

• Contract addresses and LCD URL are read from operator-controlled frontend-dapp/.env.local (deploy artifact) via read_env_var and passed quoted to terrad tx / lcd_smart_query_raw — same pattern as existing smoke-pool-swap / smoke-deploy-env; no command-injection or unauthenticated remote trigger path.
• e2e_terrad_tx broadcasts from the fixed LocalTerra test1 keyring inside the dev container; set_paused auth is on-chain wrap-mapper policy (out of diff scope).
• No new dependencies, secrets in logs, SSRF/XSS/injection sinks reachable by external users, or authz boundary changes in deployable code.

Inline threads: none (no medium+ findings).

Security review: no medium+ findings on this diff.

## Security review **Commit reviewed:** `294de27a8287bada8c7f739812274602d950ed63` **Scope:** MR !926 — LocalTerra wrap-mapper pause/unpause smoke test (SEC-B06, #396): `scripts/smoke-wrap-mapper-pause.sh`, `scripts/lib/smoke-wrap-env.sh`, `scripts/qa/verify-issue-396.sh`, Makefile targets, docs/skills cross-links. **Outcome:** `FINDINGS: 0` medium+ **Summary:** Reviewed added/modified bash smoke/verify scripts and wiring. Changes are post-deploy LocalTerra QA tooling only (no production services, contracts, or frontend runtime paths). Attacker-controlled inputs were traced: - Contract addresses and LCD URL are read from operator-controlled `frontend-dapp/.env.local` (deploy artifact) via `read_env_var` and passed quoted to `terrad tx` / `lcd_smart_query_raw` — same pattern as existing `smoke-pool-swap` / `smoke-deploy-env`; no command-injection or unauthenticated remote trigger path. - `e2e_terrad_tx` broadcasts from the fixed LocalTerra `test1` keyring inside the dev container; `set_paused` auth is on-chain wrap-mapper policy (out of diff scope). - No new dependencies, secrets in logs, SSRF/XSS/injection sinks reachable by external users, or authz boundary changes in deployable code. **Inline threads:** none (no medium+ findings). Security review: no medium+ findings on this diff.

PlasticDigits commented 2026-06-19 12:49:56 +00:00 (Migrated from gitlab.com)

Copy link

added 7 commits

• 294de27a...d487a0cd - 6 commits from branch main
• 9df6672a - Merge branch 'main' into issue-396-wrap-mapper-pause-smoke

Compare with previous version

added 7 commits <ul><li>294de27a...d487a0cd - 6 commits from branch <code>main</code></li><li>9df6672a - Merge branch &#39;main&#39; into issue-396-wrap-mapper-pause-smoke</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/208/diffs?diff_id=1861161400&start_sha=294de27a8287bada8c7f739812274602d950ed63)

PlasticDigits commented 2026-06-19 12:50:03 +00:00 (Migrated from gitlab.com)

Copy link

Resolved merge conflicts with main.

Conflict: Makefile .PHONY line only — both branches added new targets independently.

Resolution: Combined both sides:

• From this MR: smoke-wrap-mapper-pause, verify-issue-396
• From main: check-blacklist-decision-docs, verify-issue-400

Sanity check: make -n for the affected targets passes. Pushed merge commit 9df6672a.

Resolved merge conflicts with `main`. **Conflict:** `Makefile` `.PHONY` line only — both branches added new targets independently. **Resolution:** Combined both sides: - From this MR: `smoke-wrap-mapper-pause`, `verify-issue-396` - From `main`: `check-blacklist-decision-docs`, `verify-issue-400` Sanity check: `make -n` for the affected targets passes. Pushed merge commit `9df6672a`.

PlasticDigits commented 2026-06-19 12:54:57 +00:00 (Migrated from gitlab.com)

Copy link

Security review

Commit reviewed: 9df6672a440969f1e837dac6fee129aec5aa38d7
Scope: MR !926 — LocalTerra wrap-mapper pause/unpause smoke test (SEC-B06, #396): scripts/smoke-wrap-mapper-pause.sh, scripts/lib/smoke-wrap-env.sh, scripts/qa/verify-issue-396.sh, Makefile targets, docs/skills cross-links.

Outcome: FINDINGS: 0 medium+

Summary: Reviewed all added/modified paths in the MR diff. Changes are post-deploy LocalTerra QA tooling only — no production services, CosmWasm contracts, indexer routes, or frontend runtime code. Attacker-controlled inputs were traced to sinks:

Input source	Sink	Control
frontend-dapp/.env.local contract addresses + LCD URL (smoke-wrap-env.sh)	Quoted args to lcd_smart_query_raw / e2e_terrad_tx → terrad tx wasm execute	Operator-controlled deploy artifact; same pattern as existing smoke-deploy-env / smoke-pool-swap. Terra bech32 addresses cannot inject shell or JSON metacharacters in the constructed execute payloads.
SMOKE_WRAP_AMOUNT / SMOKE_UNWRAP_AMOUNT / TEST_ADDRESS env overrides	--amount flag and CW20 send JSON	Optional dev overrides; values are quoted/interpolated into fixed message shapes. No unauthenticated remote trigger — script requires local Docker + keyring access.
set_paused broadcasts	On-chain wrap-mapper execute	Uses fixed LocalTerra test1 keyring via e2e_terrad_tx; authorization is enforced by wrap-mapper contract policy (out of diff scope). Intended smoke behavior on localnet.
LCD queries	localterra_lcd_curl / host curl fallback	LCD base URL from deploy env; no new SSRF surface beyond existing QA LCD helpers — reachable only when an operator runs the smoke locally or in CI with trusted artifacts.

No new dependencies, secret material in logs, XSS/CSRF/injection paths in deployable application code, or authz boundary changes introduced by this diff.

Inline threads: none (no medium+ findings).

Security review: no medium+ findings on this diff.

## Security review **Commit reviewed:** `9df6672a440969f1e837dac6fee129aec5aa38d7` **Scope:** MR !926 — LocalTerra wrap-mapper pause/unpause smoke test (SEC-B06, #396): `scripts/smoke-wrap-mapper-pause.sh`, `scripts/lib/smoke-wrap-env.sh`, `scripts/qa/verify-issue-396.sh`, Makefile targets, docs/skills cross-links. **Outcome:** `FINDINGS: 0` medium+ **Summary:** Reviewed all added/modified paths in the MR diff. Changes are post-deploy LocalTerra QA tooling only — no production services, CosmWasm contracts, indexer routes, or frontend runtime code. Attacker-controlled inputs were traced to sinks: | Input source | Sink | Control | |---|---|---| | `frontend-dapp/.env.local` contract addresses + LCD URL (`smoke-wrap-env.sh`) | Quoted args to `lcd_smart_query_raw` / `e2e_terrad_tx` → `terrad tx wasm execute` | Operator-controlled deploy artifact; same pattern as existing `smoke-deploy-env` / `smoke-pool-swap`. Terra bech32 addresses cannot inject shell or JSON metacharacters in the constructed execute payloads. | | `SMOKE_WRAP_AMOUNT` / `SMOKE_UNWRAP_AMOUNT` / `TEST_ADDRESS` env overrides | `--amount` flag and CW20 `send` JSON | Optional dev overrides; values are quoted/interpolated into fixed message shapes. No unauthenticated remote trigger — script requires local Docker + keyring access. | | `set_paused` broadcasts | On-chain wrap-mapper execute | Uses fixed LocalTerra `test1` keyring via `e2e_terrad_tx`; authorization is enforced by wrap-mapper contract policy (out of diff scope). Intended smoke behavior on localnet. | | LCD queries | `localterra_lcd_curl` / host curl fallback | LCD base URL from deploy env; no new SSRF surface beyond existing QA LCD helpers — reachable only when an operator runs the smoke locally or in CI with trusted artifacts. | No new dependencies, secret material in logs, XSS/CSRF/injection paths in deployable application code, or authz boundary changes introduced by this diff. **Inline threads:** none (no medium+ findings). Security review: no medium+ findings on this diff.

PlasticDigits commented 2026-06-19 13:08:39 +00:00 (Migrated from gitlab.com)

Copy link

mentioned in commit 96e814ab22

mentioned in commit 96e814ab22dd15052c1bf838f5c5786d18743bdd

PlasticDigits (Migrated from gitlab.com) merged commit 96e814ab22 into main 2026-06-19 13:08:39 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

agent:fix_bugfix

  

agent:fix_conflicts

  

agent:fix_security

  

agent:gap_analysis

  

agent:implement

  

agent:implement

Queue implement gate

  

agent:implement

Queue implement gate

  

agent:open_issues

  

agent:ready

  

agent:research

  

agent:security_audit

  

agent:verify

  

architecture

Architecture

  

backend

API and services

  

blocker:hybrid

Blocks hybrid launch

  

blocker:launch

Blocks launch

  

blocker:limit-orders

Blocks limits launch

  

blocker:v2

Blocks v2

  

block:log_only

  

block:security

  

bug

  

ci

  

contracts

Smart contracts

  

correctness

  

deploy

  

dev

  

devops

  

docs

  

documentation

  

duplicate

  

e2e

  

enhancement

  

epic

Epic

  

feature

  

frontend

  

functional-completion

Functional

  

gas

  

good first issue

  

governance

  

help wanted

  

high-risk

  

hooks

  

hybrid

Hybrid swaps

  

indexer

Indexer

  

infra

CI/CD

  

infrastructure

  

integrators

  

invalid

  

launch-blocker

  

limit-orders

Limit orders

  

localnet

  

localterra

  

low priority

  

missing-implementation

Implementation

  

needs-design

Design decision required

  

ops

  

performance

  

priority

high

  

priority

medium

  

product

  

qa

  

QA

  

question

  

ready

Definition of Ready

  

ready

Definition of Ready

  

research

  

scripts

  

security

Security

  

security-hardening

Security hardening

  

smartcontracts

  

tech-debt

  

testing

Testing

  

ux

  

UX

  

v2

Pool-only swaps

  

verification

  

wontfix

No labels

agent:fix_bugfix

agent:fix_conflicts

agent:fix_security

agent:gap_analysis

agent:implement

agent:implement

agent:implement

agent:open_issues

agent:ready

agent:research

agent:security_audit

agent:verify

architecture

backend

blocker:hybrid

blocker:launch

blocker:limit-orders

blocker:v2

block:log_only

block:security

bug

ci

contracts

correctness

deploy

dev

devops

docs

documentation

duplicate

e2e

enhancement

epic

feature

frontend

functional-completion

gas

good first issue

governance

help wanted

high-risk

hooks

hybrid

indexer

infra

infrastructure

integrators

invalid

launch-blocker

limit-orders

localnet

localterra

low priority

missing-implementation

needs-design

ops

performance

priority

high

priority

medium

product

qa

QA

question

ready

ready

research

scripts

security

security-hardening

smartcontracts

tech-debt

testing

ux

UX

v2

verification

wontfix

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

code/cl8y-dex-terraclassic!926

No description provided.