Security: historical exploit replay matrix [SEC-D01] (#406) #935

Merged

PlasticDigits merged 5 commits from issue-406-exploit-replay-matrix into main 2026-06-20 04:54:41 +00:00

Conversation 14 Commits 5 Files changed 6 +171 -4

PlasticDigits commented 2026-06-19 13:24:02 +00:00 (Migrated from gitlab.com)

Copy link

Summary

Adds docs/exploit-replay-matrix.md — a committed table mapping SEC-D02–D12 historical Cosmos/CosmWasm incidents (Terra IBC-hooks, Osmosis LP-share, Levana oracle timing, malicious CW20, fake pair indexing, SQL injection, LCD amplification, admin key compromise, wallet phishing, stale deploy) to CL8Y surfaces, mitigations, and verification links.

Cross-links from docs/contracts-security-audit.md and docs/security-model.md. Agent playbook skills/AGENTS_EXPLOIT_REPLAY_MATRIX.md and drift guard make check-exploit-replay-matrix-docs (wired into make lint).

Tied to #406 / parent checklist #381.

Acceptance checklist

Item	Verification	Result
docs/exploit-replay-matrix.md committed with SEC-D02–D12 rows	grep SEC-D0 docs/exploit-replay-matrix.md	PASS
Each row has date, protocol, root cause, component, surface, mitigation, verification link	Manual review + make check-exploit-replay-matrix-docs	PASS
Linked from docs/contracts-security-audit.md	grep exploit-replay-matrix	PASS
Linked from docs/security-model.md	grep exploit-replay-matrix	PASS

Third-party verification

git fetch origin issue-406-exploit-replay-matrix
git checkout issue-406-exploit-replay-matrix
make check-exploit-replay-matrix-docs
# Spot-check matrix rows vs linked tests:
cd smartcontracts && cargo test lp_share_inflation
cd indexer && cargo test verify_factory_provenance --lib
bash scripts/with-node.sh --cwd frontend-dapp -- npm test -- --run src/components/swap/__tests__/SwapPreSubmitSummary.test.tsx

Open docs/exploit-replay-matrix.md and confirm 11 data rows (SEC-D02 through SEC-D12) with verification links.

Blockers / SKIP

None for SEC-D01 scope. Rows SEC-D02, SEC-D10, and SEC-D12 note partial ops coverage with open follow-ups (#407, #408, #410).

## Summary Adds `docs/exploit-replay-matrix.md` — a committed table mapping SEC-D02–D12 historical Cosmos/CosmWasm incidents (Terra IBC-hooks, Osmosis LP-share, Levana oracle timing, malicious CW20, fake pair indexing, SQL injection, LCD amplification, admin key compromise, wallet phishing, stale deploy) to CL8Y surfaces, mitigations, and verification links. Cross-links from `docs/contracts-security-audit.md` and `docs/security-model.md`. Agent playbook `skills/AGENTS_EXPLOIT_REPLAY_MATRIX.md` and drift guard `make check-exploit-replay-matrix-docs` (wired into `make lint`). Tied to #406 / parent checklist #381. ## Acceptance checklist | Item | Verification | Result | |------|--------------|--------| | `docs/exploit-replay-matrix.md` committed with SEC-D02–D12 rows | `grep SEC-D0 docs/exploit-replay-matrix.md` | **PASS** | | Each row has date, protocol, root cause, component, surface, mitigation, verification link | Manual review + `make check-exploit-replay-matrix-docs` | **PASS** | | Linked from `docs/contracts-security-audit.md` | grep `exploit-replay-matrix` | **PASS** | | Linked from `docs/security-model.md` | grep `exploit-replay-matrix` | **PASS** | ## Third-party verification ```bash git fetch origin issue-406-exploit-replay-matrix git checkout issue-406-exploit-replay-matrix make check-exploit-replay-matrix-docs # Spot-check matrix rows vs linked tests: cd smartcontracts && cargo test lp_share_inflation cd indexer && cargo test verify_factory_provenance --lib bash scripts/with-node.sh --cwd frontend-dapp -- npm test -- --run src/components/swap/__tests__/SwapPreSubmitSummary.test.tsx ``` Open `docs/exploit-replay-matrix.md` and confirm 11 data rows (SEC-D02 through SEC-D12) with verification links. ## Blockers / SKIP None for SEC-D01 scope. Rows **SEC-D02**, **SEC-D10**, and **SEC-D12** note partial ops coverage with open follow-ups ([#407](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/issues/407), [#408](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/issues/408), [#410](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/issues/410)).

PlasticDigits commented 2026-06-19 13:26:29 +00:00 (Migrated from gitlab.com)

Copy link

Security review — MR !935

Commit reviewed: 74c66522ed93a5c6189afd8b9e4e0d53bdc5c571

Scope: Documentation and CI drift guard only — docs/exploit-replay-matrix.md, cross-links in docs/contracts-security-audit.md and docs/security-model.md, agent playbook skills/AGENTS_EXPLOIT_REPLAY_MATRIX.md, scripts/check_exploit_replay_matrix_docs.py, Makefile lint wiring. No smart contract, indexer API, frontend runtime, or deploy script logic changes.

Method: Full diff vs origin/main; traced attacker-controlled input to sinks for the new Python checker; spot-checked matrix mitigation claims against referenced test/runbook paths (no exploitability proof required for unchanged runtime code per review charter).

Outcome: FINDINGS: 0 medium+

Security review: no medium+ findings on this diff.

Inline threads: none (no findings to anchor).

Areas examined

Surface	Result
Injection (SQL, shell, path traversal)	N/A — no runtime handlers; drift script uses fixed Path constants, no subprocess/eval/network, no external input
Authn/authz bypass	N/A — no auth boundaries touched
Secret leakage / insecure logging	No credentials, mnemonics, or internal tokens in added content
SSRF / XSS / CSRF	N/A — markdown/docs only; not served as executable user input
Supply chain	No new dependencies
Historical DeFi exploit replay	Matrix documents existing mitigations and links to regression tests; does not weaken on-chain or API controls

The drift guard (make check-exploit-replay-matrix-docs) passed locally on the reviewed SHA.

## Security review — MR !935 **Commit reviewed:** `74c66522ed93a5c6189afd8b9e4e0d53bdc5c571` **Scope:** Documentation and CI drift guard only — `docs/exploit-replay-matrix.md`, cross-links in `docs/contracts-security-audit.md` and `docs/security-model.md`, agent playbook `skills/AGENTS_EXPLOIT_REPLAY_MATRIX.md`, `scripts/check_exploit_replay_matrix_docs.py`, `Makefile` lint wiring. No smart contract, indexer API, frontend runtime, or deploy script logic changes. **Method:** Full diff vs `origin/main`; traced attacker-controlled input to sinks for the new Python checker; spot-checked matrix mitigation claims against referenced test/runbook paths (no exploitability proof required for unchanged runtime code per review charter). **Outcome:** `FINDINGS: 0` medium+ Security review: **no medium+ findings** on this diff. **Inline threads:** none (no findings to anchor). ### Areas examined | Surface | Result | |---------|--------| | Injection (SQL, shell, path traversal) | N/A — no runtime handlers; drift script uses fixed `Path` constants, no subprocess/eval/network, no external input | | Authn/authz bypass | N/A — no auth boundaries touched | | Secret leakage / insecure logging | No credentials, mnemonics, or internal tokens in added content | | SSRF / XSS / CSRF | N/A — markdown/docs only; not served as executable user input | | Supply chain | No new dependencies | | Historical DeFi exploit replay | Matrix documents existing mitigations and links to regression tests; does not weaken on-chain or API controls | The drift guard (`make check-exploit-replay-matrix-docs`) passed locally on the reviewed SHA.

PlasticDigits commented 2026-06-19 13:52:53 +00:00 (Migrated from gitlab.com)

Copy link

added 11 commits

• 74c66522...e9d32c9b - 10 commits from branch main
• 7c3b7029 - Merge branch 'main' into issue-406-exploit-replay-matrix

Compare with previous version

added 11 commits <ul><li>74c66522...e9d32c9b - 10 commits from branch <code>main</code></li><li>7c3b7029 - Merge branch &#39;main&#39; into issue-406-exploit-replay-matrix</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/217/diffs?diff_id=1861293580&start_sha=74c66522ed93a5c6189afd8b9e4e0d53bdc5c571)

PlasticDigits commented 2026-06-19 13:52:55 +00:00 (Migrated from gitlab.com)

Copy link

Resolved merge conflicts with main (Makefile only).

• Merged .PHONY to include both check-exploit-replay-matrix-docs (this MR) and check-governance-emergency-rehearsal-docs / rehearse-governance-emergency (from main).
• Updated lint target to run both doc drift checks.

Sanity: make check-exploit-replay-matrix-docs and make check-governance-emergency-rehearsal-docs pass locally.

Resolved merge conflicts with `main` (Makefile only). - Merged `.PHONY` to include both `check-exploit-replay-matrix-docs` (this MR) and `check-governance-emergency-rehearsal-docs` / `rehearse-governance-emergency` (from main). - Updated `lint` target to run both doc drift checks. Sanity: `make check-exploit-replay-matrix-docs` and `make check-governance-emergency-rehearsal-docs` pass locally.

PlasticDigits commented 2026-06-19 13:55:19 +00:00 (Migrated from gitlab.com)

Copy link

Security review — MR !935

Commit reviewed: 7c3b702965f9fdb8d13d71ccd6348d5bc9f54ccd

Scope: Documentation and CI drift guard only — docs/exploit-replay-matrix.md, cross-links in docs/contracts-security-audit.md and docs/security-model.md, agent playbook skills/AGENTS_EXPLOIT_REPLAY_MATRIX.md, scripts/check_exploit_replay_matrix_docs.py, Makefile lint wiring. No smart contract, indexer API, frontend runtime, or deploy script logic changes.

Delta since prior review (74c66522): merge of main into the feature branch; Makefile conflict resolution only (adds check-exploit-replay-matrix-docs alongside existing governance-emergency doc checks). No new runtime surfaces.

Method: Full diff e9d32c9b..7c3b7029; traced attacker-controlled input to sinks for the new Python checker; compared drift-guard pattern to existing doc-check scripts; spot-checked matrix mitigation/verification references (documentation accuracy only — unchanged runtime code not re-audited for exploitability).

Outcome: FINDINGS: 0 medium+

Security review: no medium+ findings on this diff.

Inline threads: none (no findings to anchor).

Areas examined

Surface	Result
Injection (SQL, shell, path traversal)	N/A — no runtime handlers; drift script uses fixed Path constants, read_text() only, no subprocess/eval/network, no external input
Authn/authz bypass	N/A — no auth boundaries touched
Secret leakage / insecure logging	No credentials, mnemonics, or internal tokens in added content
SSRF / XSS / CSRF	N/A — markdown/docs only; not served as executable user input
Supply chain	No new dependencies
Historical DeFi exploit replay	Matrix documents existing mitigations and links to regression tests; does not weaken on-chain or API controls

make check-exploit-replay-matrix-docs passed locally on the reviewed SHA.

## Security review — MR !935 **Commit reviewed:** `7c3b702965f9fdb8d13d71ccd6348d5bc9f54ccd` **Scope:** Documentation and CI drift guard only — `docs/exploit-replay-matrix.md`, cross-links in `docs/contracts-security-audit.md` and `docs/security-model.md`, agent playbook `skills/AGENTS_EXPLOIT_REPLAY_MATRIX.md`, `scripts/check_exploit_replay_matrix_docs.py`, `Makefile` lint wiring. No smart contract, indexer API, frontend runtime, or deploy script logic changes. **Delta since prior review (`74c66522`):** merge of `main` into the feature branch; Makefile conflict resolution only (adds `check-exploit-replay-matrix-docs` alongside existing governance-emergency doc checks). No new runtime surfaces. **Method:** Full diff `e9d32c9b..7c3b7029`; traced attacker-controlled input to sinks for the new Python checker; compared drift-guard pattern to existing doc-check scripts; spot-checked matrix mitigation/verification references (documentation accuracy only — unchanged runtime code not re-audited for exploitability). **Outcome:** `FINDINGS: 0` medium+ Security review: **no medium+ findings** on this diff. **Inline threads:** none (no findings to anchor). ### Areas examined | Surface | Result | |---------|--------| | Injection (SQL, shell, path traversal) | N/A — no runtime handlers; drift script uses fixed `Path` constants, `read_text()` only, no subprocess/eval/network, no external input | | Authn/authz bypass | N/A — no auth boundaries touched | | Secret leakage / insecure logging | No credentials, mnemonics, or internal tokens in added content | | SSRF / XSS / CSRF | N/A — markdown/docs only; not served as executable user input | | Supply chain | No new dependencies | | Historical DeFi exploit replay | Matrix documents existing mitigations and links to regression tests; does not weaken on-chain or API controls | `make check-exploit-replay-matrix-docs` passed locally on the reviewed SHA.

PlasticDigits commented 2026-06-19 14:20:57 +00:00 (Migrated from gitlab.com)

Copy link

added 6 commits

• 7c3b7029...6f4fd29b - 5 commits from branch main
• f05dc38c - Merge origin/main into issue-406-exploit-replay-matrix

Compare with previous version

added 6 commits <ul><li>7c3b7029...6f4fd29b - 5 commits from branch <code>main</code></li><li>f05dc38c - Merge origin/main into issue-406-exploit-replay-matrix</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/217/diffs?diff_id=1861351256&start_sha=7c3b702965f9fdb8d13d71ccd6348d5bc9f54ccd)

PlasticDigits commented 2026-06-19 14:21:00 +00:00 (Migrated from gitlab.com)

Copy link

Resolved merge conflicts with main in Makefile:

• Kept check-exploit-replay-matrix-docs from this branch (SEC-D01 lint target).
• Kept check-emergency-commands-docs and verify-issue-399 from main.
• Combined both doc checks in the lint recipe and .PHONY list.

Sanity: make check-exploit-replay-matrix-docs and make check-emergency-commands-docs pass.

Resolved merge conflicts with `main` in `Makefile`: - Kept `check-exploit-replay-matrix-docs` from this branch (SEC-D01 lint target). - Kept `check-emergency-commands-docs` and `verify-issue-399` from `main`. - Combined both doc checks in the `lint` recipe and `.PHONY` list. Sanity: `make check-exploit-replay-matrix-docs` and `make check-emergency-commands-docs` pass.

PlasticDigits commented 2026-06-19 14:23:21 +00:00 (Migrated from gitlab.com)

Copy link

Security review — MR !935

Commit reviewed: f05dc38ca01b5e948f8eba78cf79f617f842b556

Scope: Documentation and CI drift guard only — docs/exploit-replay-matrix.md, cross-links in docs/contracts-security-audit.md and docs/security-model.md, agent playbook skills/AGENTS_EXPLOIT_REPLAY_MATRIX.md, scripts/check_exploit_replay_matrix_docs.py, Makefile lint wiring. No smart contract, indexer API, frontend runtime, or deploy script logic changes.

Delta since prior review (7c3b7029): merge of origin/main into the feature branch (f05dc38c); Makefile conflict resolution retains both check-exploit-replay-matrix-docs (this MR) and check-emergency-commands-docs (from main). No new runtime surfaces in the MR diff.

Method: Full diff 6f4fd29b..f05dc38c vs origin/main; traced attacker-controlled input to sinks for the new Python checker; compared drift-guard pattern to existing doc-check scripts; verified no secrets in added content; spot-checked matrix mitigation/verification references (documentation accuracy only — unchanged runtime code not re-audited for exploitability).

Outcome: FINDINGS: 0 medium+

Security review: no medium+ findings on this diff.

Inline threads: none (no findings to anchor).

Areas examined

Surface	Result
Injection (SQL, shell, path traversal)	N/A — no runtime handlers; drift script uses fixed Path constants, read_text() only, no subprocess/eval/network, no external input
Authn/authz bypass	N/A — no auth boundaries touched
Secret leakage / insecure logging	No credentials, mnemonics, or internal tokens in added content
SSRF / XSS / CSRF	N/A — markdown/docs only; not served as executable user input by the dApp
Supply chain	No new dependencies
Historical DeFi exploit replay	Matrix documents existing mitigations and links to regression tests; does not weaken on-chain or API controls

make check-exploit-replay-matrix-docs passed locally on the reviewed SHA.

## Security review — MR !935 **Commit reviewed:** `f05dc38ca01b5e948f8eba78cf79f617f842b556` **Scope:** Documentation and CI drift guard only — `docs/exploit-replay-matrix.md`, cross-links in `docs/contracts-security-audit.md` and `docs/security-model.md`, agent playbook `skills/AGENTS_EXPLOIT_REPLAY_MATRIX.md`, `scripts/check_exploit_replay_matrix_docs.py`, `Makefile` lint wiring. No smart contract, indexer API, frontend runtime, or deploy script logic changes. **Delta since prior review (`7c3b7029`):** merge of `origin/main` into the feature branch (`f05dc38c`); Makefile conflict resolution retains both `check-exploit-replay-matrix-docs` (this MR) and `check-emergency-commands-docs` (from main). No new runtime surfaces in the MR diff. **Method:** Full diff `6f4fd29b..f05dc38c` vs `origin/main`; traced attacker-controlled input to sinks for the new Python checker; compared drift-guard pattern to existing doc-check scripts; verified no secrets in added content; spot-checked matrix mitigation/verification references (documentation accuracy only — unchanged runtime code not re-audited for exploitability). **Outcome:** `FINDINGS: 0` medium+ Security review: **no medium+ findings** on this diff. **Inline threads:** none (no findings to anchor). ### Areas examined | Surface | Result | |---------|--------| | Injection (SQL, shell, path traversal) | N/A — no runtime handlers; drift script uses fixed `Path` constants, `read_text()` only, no subprocess/eval/network, no external input | | Authn/authz bypass | N/A — no auth boundaries touched | | Secret leakage / insecure logging | No credentials, mnemonics, or internal tokens in added content | | SSRF / XSS / CSRF | N/A — markdown/docs only; not served as executable user input by the dApp | | Supply chain | No new dependencies | | Historical DeFi exploit replay | Matrix documents existing mitigations and links to regression tests; does not weaken on-chain or API controls | `make check-exploit-replay-matrix-docs` passed locally on the reviewed SHA.

PlasticDigits commented 2026-06-19 14:39:15 +00:00 (Migrated from gitlab.com)

Copy link

added 6 commits

• f05dc38c...0e2eaa8d - 5 commits from branch main
• d6350610 - Merge origin/main into issue-406-exploit-replay-matrix.

Compare with previous version

added 6 commits <ul><li>f05dc38c...0e2eaa8d - 5 commits from branch <code>main</code></li><li>d6350610 - Merge origin/main into issue-406-exploit-replay-matrix.</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/217/diffs?diff_id=1861386288&start_sha=f05dc38ca01b5e948f8eba78cf79f617f842b556)

PlasticDigits commented 2026-06-19 14:39:19 +00:00 (Migrated from gitlab.com)

Copy link

Resolved merge conflicts with main (issue #410 deploy-trace landed after the prior merge).

Makefile: kept both check-deploy-trace-docs (#410) and check-exploit-replay-matrix-docs (#406) targets; updated .PHONY and lint to include both.

docs/security-model.md: auto-merged cleanly (exploit-replay matrix + deploy-trace links).

Sanity: make check-exploit-replay-matrix-docs and make check-deploy-trace-docs both pass.

Resolved merge conflicts with `main` (issue #410 deploy-trace landed after the prior merge). **Makefile:** kept both `check-deploy-trace-docs` (#410) and `check-exploit-replay-matrix-docs` (#406) targets; updated `.PHONY` and `lint` to include both. **docs/security-model.md:** auto-merged cleanly (exploit-replay matrix + deploy-trace links). Sanity: `make check-exploit-replay-matrix-docs` and `make check-deploy-trace-docs` both pass.

PlasticDigits commented 2026-06-19 14:45:11 +00:00 (Migrated from gitlab.com)

Copy link

Security review — MR !935

Commit reviewed: d63506106619d170079d794fce09ab8c495ff336

Scope: Documentation and CI drift guard only — docs/exploit-replay-matrix.md, cross-links in docs/contracts-security-audit.md and docs/security-model.md, agent playbook skills/AGENTS_EXPLOIT_REPLAY_MATRIX.md, scripts/check_exploit_replay_matrix_docs.py, Makefile lint wiring. No smart contract, indexer API, frontend runtime, or deploy script logic changes.

Delta since prior review (f05dc38c): merge of origin/main into the feature branch (d6350610); Makefile conflict resolution retains both check-exploit-replay-matrix-docs (this MR) and check-deploy-trace-docs (from main #410). Merge-base diff vs origin/main remains the six SEC-D01 files above — no new runtime surfaces introduced by this MR.

Method: Full diff 0e2eaa8d..d6350610 vs merge base; traced attacker-controlled input to sinks for check_exploit_replay_matrix_docs.py; compared drift-guard pattern to existing doc-check scripts; verified no secrets in added content; spot-checked matrix mitigation/verification references (documentation accuracy only — unchanged runtime code not re-audited for exploitability).

Outcome: FINDINGS: 0 medium+

Security review: no medium+ findings on this diff.

Inline threads: none (no findings to anchor).

Areas examined

Surface	Result
Injection (SQL, shell, path traversal)	N/A — no runtime handlers; drift script uses fixed Path constants, read_text() only, no subprocess/eval/network, no external input
Authn/authz bypass	N/A — no auth boundaries touched
Secret leakage / insecure logging	No credentials, mnemonics, or internal tokens in added content
SSRF / XSS / CSRF	N/A — markdown/docs only; not served as executable user input by the dApp
Supply chain	No new dependencies
Historical DeFi exploit replay	Matrix documents existing mitigations and links to regression tests; does not weaken on-chain or API controls

make check-exploit-replay-matrix-docs passed locally on the reviewed SHA.

## Security review — MR !935 **Commit reviewed:** `d63506106619d170079d794fce09ab8c495ff336` **Scope:** Documentation and CI drift guard only — `docs/exploit-replay-matrix.md`, cross-links in `docs/contracts-security-audit.md` and `docs/security-model.md`, agent playbook `skills/AGENTS_EXPLOIT_REPLAY_MATRIX.md`, `scripts/check_exploit_replay_matrix_docs.py`, `Makefile` lint wiring. No smart contract, indexer API, frontend runtime, or deploy script logic changes. **Delta since prior review (`f05dc38c`):** merge of `origin/main` into the feature branch (`d6350610`); Makefile conflict resolution retains both `check-exploit-replay-matrix-docs` (this MR) and `check-deploy-trace-docs` (from main #410). Merge-base diff vs `origin/main` remains the six SEC-D01 files above — no new runtime surfaces introduced by this MR. **Method:** Full diff `0e2eaa8d..d6350610` vs merge base; traced attacker-controlled input to sinks for `check_exploit_replay_matrix_docs.py`; compared drift-guard pattern to existing doc-check scripts; verified no secrets in added content; spot-checked matrix mitigation/verification references (documentation accuracy only — unchanged runtime code not re-audited for exploitability). **Outcome:** `FINDINGS: 0` medium+ Security review: **no medium+ findings** on this diff. **Inline threads:** none (no findings to anchor). ### Areas examined | Surface | Result | |---------|--------| | Injection (SQL, shell, path traversal) | N/A — no runtime handlers; drift script uses fixed `Path` constants, `read_text()` only, no subprocess/eval/network, no external input | | Authn/authz bypass | N/A — no auth boundaries touched | | Secret leakage / insecure logging | No credentials, mnemonics, or internal tokens in added content | | SSRF / XSS / CSRF | N/A — markdown/docs only; not served as executable user input by the dApp | | Supply chain | No new dependencies | | Historical DeFi exploit replay | Matrix documents existing mitigations and links to regression tests; does not weaken on-chain or API controls | `make check-exploit-replay-matrix-docs` passed locally on the reviewed SHA.

PlasticDigits commented 2026-06-20 04:16:43 +00:00 (Migrated from gitlab.com)

Copy link

added 6 commits

• d6350610...6c23276f - 5 commits from branch main
• e539671b - Merge origin/main into issue-406-exploit-replay-matrix.

Compare with previous version

added 6 commits <ul><li>d6350610...6c23276f - 5 commits from branch <code>main</code></li><li>e539671b - Merge origin/main into issue-406-exploit-replay-matrix.</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/217/diffs?diff_id=1861987077&start_sha=d63506106619d170079d794fce09ab8c495ff336)

PlasticDigits commented 2026-06-20 04:16:48 +00:00 (Migrated from gitlab.com)

Copy link

Resolved merge conflicts with main in Makefile:

• .PHONY: kept check-exploit-replay-matrix-docs (this MR) alongside check-ibc-hooks-deploy-docs, verify-no-ibc-hooks-in-contracts, and verify-issue-407 from main.
• lint target: includes both check-exploit-replay-matrix-docs and check-ibc-hooks-deploy-docs.

Sanity: make check-exploit-replay-matrix-docs and make check-ibc-hooks-deploy-docs both pass.

Resolved merge conflicts with `main` in **Makefile**: - **`.PHONY`**: kept `check-exploit-replay-matrix-docs` (this MR) alongside `check-ibc-hooks-deploy-docs`, `verify-no-ibc-hooks-in-contracts`, and `verify-issue-407` from main. - **`lint` target**: includes both `check-exploit-replay-matrix-docs` and `check-ibc-hooks-deploy-docs`. Sanity: `make check-exploit-replay-matrix-docs` and `make check-ibc-hooks-deploy-docs` both pass.

PlasticDigits commented 2026-06-20 04:19:07 +00:00 (Migrated from gitlab.com)

Copy link

Security review — MR !935

Commit reviewed: e539671bee1841c79716a7ba9a713a13245118e4

Scope: Documentation and CI drift guard only — docs/exploit-replay-matrix.md, cross-links in docs/contracts-security-audit.md and docs/security-model.md, agent playbook skills/AGENTS_EXPLOIT_REPLAY_MATRIX.md, scripts/check_exploit_replay_matrix_docs.py, Makefile lint wiring. No smart contract, indexer API, frontend runtime, or deploy script logic changes.

Delta since prior review (d6350610): merge of origin/main into the feature branch (e539671b); Makefile conflict resolution retains check-exploit-replay-matrix-docs (this MR) alongside check-ibc-hooks-deploy-docs / verify-issue-407 (from main #407). Merge-base diff vs origin/main remains the six SEC-D01 files above — no new runtime surfaces introduced by this MR.

Method: Full diff 6c23276f..e539671b vs merge base; traced attacker-controlled input to sinks for check_exploit_replay_matrix_docs.py; compared drift-guard pattern to existing doc-check scripts; verified no secrets in added content; spot-checked matrix mitigation/verification references (documentation accuracy only — unchanged runtime code not re-audited for exploitability).

Outcome: FINDINGS: 0 medium+

Security review: no medium+ findings on this diff.

Inline threads: none (no findings to anchor).

Areas examined

Surface	Result
Injection (SQL, shell, path traversal)	N/A — no runtime handlers; drift script uses fixed Path constants, read_text() only, no subprocess/eval/network, no external input
Authn/authz bypass	N/A — no auth boundaries touched
Secret leakage / insecure logging	No credentials, mnemonics, or internal tokens in added content
SSRF / XSS / CSRF	N/A — markdown/docs only; not served as executable user input by the dApp
Supply chain	No new dependencies
Historical DeFi exploit replay	Matrix documents existing mitigations and links to regression tests; does not weaken on-chain or API controls

make check-exploit-replay-matrix-docs passed locally on the reviewed SHA.

## Security review — MR !935 **Commit reviewed:** `e539671bee1841c79716a7ba9a713a13245118e4` **Scope:** Documentation and CI drift guard only — `docs/exploit-replay-matrix.md`, cross-links in `docs/contracts-security-audit.md` and `docs/security-model.md`, agent playbook `skills/AGENTS_EXPLOIT_REPLAY_MATRIX.md`, `scripts/check_exploit_replay_matrix_docs.py`, `Makefile` lint wiring. No smart contract, indexer API, frontend runtime, or deploy script logic changes. **Delta since prior review (`d6350610`):** merge of `origin/main` into the feature branch (`e539671b`); Makefile conflict resolution retains `check-exploit-replay-matrix-docs` (this MR) alongside `check-ibc-hooks-deploy-docs` / `verify-issue-407` (from main #407). Merge-base diff vs `origin/main` remains the six SEC-D01 files above — no new runtime surfaces introduced by this MR. **Method:** Full diff `6c23276f..e539671b` vs merge base; traced attacker-controlled input to sinks for `check_exploit_replay_matrix_docs.py`; compared drift-guard pattern to existing doc-check scripts; verified no secrets in added content; spot-checked matrix mitigation/verification references (documentation accuracy only — unchanged runtime code not re-audited for exploitability). **Outcome:** `FINDINGS: 0` medium+ Security review: **no medium+ findings** on this diff. **Inline threads:** none (no findings to anchor). ### Areas examined | Surface | Result | |---------|--------| | Injection (SQL, shell, path traversal) | N/A — no runtime handlers; drift script uses fixed `Path` constants, `read_text()` only, no subprocess/eval/network, no external input | | Authn/authz bypass | N/A — no auth boundaries touched | | Secret leakage / insecure logging | No credentials, mnemonics, or internal tokens in added content | | SSRF / XSS / CSRF | N/A — markdown/docs only; not served as executable user input by the dApp | | Supply chain | No new dependencies | | Historical DeFi exploit replay | Matrix documents existing mitigations and links to regression tests; does not weaken on-chain or API controls | `make check-exploit-replay-matrix-docs` passed locally on the reviewed SHA.

PlasticDigits commented 2026-06-20 04:54:42 +00:00 (Migrated from gitlab.com)

Copy link

mentioned in commit 64ae472470

mentioned in commit 64ae47247045af0a16bc7bb26029612695e4a558

PlasticDigits (Migrated from gitlab.com) merged commit 64ae472470 into main 2026-06-20 04:54:42 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

agent:fix_bugfix

  

agent:fix_conflicts

  

agent:fix_security

  

agent:gap_analysis

  

agent:implement

  

agent:implement

Queue implement gate

  

agent:implement

Queue implement gate

  

agent:open_issues

  

agent:ready

  

agent:research

  

agent:security_audit

  

agent:verify

  

architecture

Architecture

  

backend

API and services

  

blocker:hybrid

Blocks hybrid launch

  

blocker:launch

Blocks launch

  

blocker:limit-orders

Blocks limits launch

  

blocker:v2

Blocks v2

  

block:log_only

  

block:security

  

bug

  

ci

  

contracts

Smart contracts

  

correctness

  

deploy

  

dev

  

devops

  

docs

  

documentation

  

duplicate

  

e2e

  

enhancement

  

epic

Epic

  

feature

  

frontend

  

functional-completion

Functional

  

gas

  

good first issue

  

governance

  

help wanted

  

high-risk

  

hooks

  

hybrid

Hybrid swaps

  

indexer

Indexer

  

infra

CI/CD

  

infrastructure

  

integrators

  

invalid

  

launch-blocker

  

limit-orders

Limit orders

  

localnet

  

localterra

  

low priority

  

missing-implementation

Implementation

  

needs-design

Design decision required

  

ops

  

performance

  

priority

high

  

priority

medium

  

product

  

qa

  

QA

  

question

  

ready

Definition of Ready

  

ready

Definition of Ready

  

research

  

scripts

  

security

Security

  

security-hardening

Security hardening

  

smartcontracts

  

tech-debt

  

testing

Testing

  

ux

  

UX

  

v2

Pool-only swaps

  

verification

  

wontfix

No labels

agent:fix_bugfix

agent:fix_conflicts

agent:fix_security

agent:gap_analysis

agent:implement

agent:implement

agent:implement

agent:open_issues

agent:ready

agent:research

agent:security_audit

agent:verify

architecture

backend

blocker:hybrid

blocker:launch

blocker:limit-orders

blocker:v2

block:log_only

block:security

bug

ci

contracts

correctness

deploy

dev

devops

docs

documentation

duplicate

e2e

enhancement

epic

feature

frontend

functional-completion

gas

good first issue

governance

help wanted

high-risk

hooks

hybrid

indexer

infra

infrastructure

integrators

invalid

launch-blocker

limit-orders

localnet

localterra

low priority

missing-implementation

needs-design

ops

performance

priority

high

priority

medium

product

qa

QA

question

ready

ready

research

scripts

security

security-hardening

smartcontracts

tech-debt

testing

ux

UX

v2

verification

wontfix

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

code/cl8y-dex-terraclassic!935

No description provided.