Align trade bid/ask labels and slippage terminology for CEX migrants (#412) #939

Merged

PlasticDigits merged 1 commit from issue-412-trade-slippage-labels into main

2026-06-25 21:51:30 +00:00

PlasticDigits commented

2026-06-25 20:44:34 +00:00

(Migrated from gitlab.com)

Summary

Addresses #412 for CEX/DEX migrants on the pro trade surface and swap settings:

/trade bid/ask: Buttons and ticket heading now both use CEX-standard Buy {base} / Sell {base} (tradeDirectionSideLabels.ts, TradeOrderTicket.tsx). Ask heading no longer shows the quote symbol.
Slippage terminology: Retail label Slippage protection (on-chain max_spread footnote) is unified across Swap Settings, trade summary, pre-sign summary, market panel, hop-spread guards, and humanized chain errors (slippageProtectionCopy.ts, humanizeTerraTxError.ts).
Transaction deadline: Swap Settings exposes 1 / 5 / 10 min presets + custom minutes (default 300s) wired to deadlineSeconds in dex.ts; summary row shows formatted deadline.
Route slippage (#293): Expected slippage kept distinct with an (i) help tooltip clarifying it is execution-quality, not the protection setting.
Docs/skills: Updated docs/frontend.md, docs/swap-max-spread-ux.md, and agent playbooks for bid/ask + slippage invariants.

Acceptance checklist

Criterion	Verification	Result
Bid/ask buttons and ticket heading use consistent Buy/Sell semantics	`cd frontend-dapp && npm run test:unit -- src/utils/__tests__/tradeDirectionSideLabels.test.ts`; manual `/trade` toggle bid/ask	PASS (unit); SKIP (screenshot — see verification below)
Unit tests cover label semantics for both sides	`tradeDirectionSideLabels.test.ts`	PASS
Settings, pre-submit, and humanized chain errors use unified slippage-protection wording	`npm run test:unit -- src/utils/__tests__/humanizeTerraTxError.test.ts src/components/swap/__tests__/SwapPreSubmitSummary.test.tsx src/services/terraclassic/__tests__/transactions.test.ts`	PASS
Tx deadline visible and editable in Swap Settings (default 300s)	Code review + `slippageProtectionCopy.test.ts`; manual Swap Settings	PASS (unit/format); SKIP (screenshot)
Route slippage (#293) labeled distinctly from tolerance	`slippageProtectionCopy.test.ts`; Expected slippage row + tooltip in `SwapPage.tsx`	PASS
Screenshot: `/trade` order ticket bid/ask	Manual Chrome on `/trade`	SKIP (no screenshot attached in MR; steps below)
Screenshot: Swap Settings slippage + deadline	Manual Chrome on `/` → expand Settings	SKIP (no screenshot attached in MR; steps below)

Test plan

Check	Command	Result
Extended label + copy tests	`cd frontend-dapp && npm run test:unit -- src/utils/__tests__/tradeDirectionSideLabels.test.ts src/utils/__tests__/slippageProtectionCopy.test.ts src/utils/__tests__/humanizeTerraTxError.test.ts src/components/swap/__tests__/SwapPreSubmitSummary.test.tsx src/pages/TradePage.test.tsx src/pages/SwapPage.test.tsx`	PASS
Frontend lint	`make lint-frontend`	PASS (0 errors; pre-existing warnings only)
Full frontend suite	`make test-frontend`	SKIP — 1 unrelated failure: `cosmesPatch127.test.ts` patch SHA drift on main (pre-existing)
TradePage bid/ask regression	`TradePage.test.tsx`	PASS

Verification for third parties

git fetch && git checkout issue-412-trade-slippage-labels
cd frontend-dapp && npm run test:unit -- src/utils/__tests__/tradeDirectionSideLabels.test.ts src/utils/__tests__/slippageProtectionCopy.test.ts src/pages/TradePage.test.tsx src/pages/SwapPage.test.tsx
make lint-frontend
Manual /trade: Open order ticket → select Buy {base} → heading reads Buy {base} → select Sell {base} → heading reads Sell {base} (buttons and heading agree).
Manual Swap Settings: On /, enter an amount, expand Slippage protection row → confirm presets, max_spread footnote, Transaction deadline presets (default 5 min), and Expected slippage (i) tooltip text.

Blockers

Screenshot acceptance items not attached to this MR (manual steps provided).
make test-frontend cosmes patch SHA test failure appears unrelated to this diff.

## Summary Addresses [#412](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/work_items/412) for CEX/DEX migrants on the pro trade surface and swap settings: - **`/trade` bid/ask:** Buttons and ticket heading now both use CEX-standard **Buy {base}** / **Sell {base}** (`tradeDirectionSideLabels.ts`, `TradeOrderTicket.tsx`). Ask heading no longer shows the quote symbol. - **Slippage terminology:** Retail label **Slippage protection** (on-chain `max_spread` footnote) is unified across Swap Settings, trade summary, pre-sign summary, market panel, hop-spread guards, and humanized chain errors (`slippageProtectionCopy.ts`, `humanizeTerraTxError.ts`). - **Transaction deadline:** Swap Settings exposes 1 / 5 / 10 min presets + custom minutes (default 300s) wired to `deadlineSeconds` in `dex.ts`; summary row shows formatted deadline. - **Route slippage (#293):** **Expected slippage** kept distinct with an `(i)` help tooltip clarifying it is execution-quality, not the protection setting. - **Docs/skills:** Updated `docs/frontend.md`, `docs/swap-max-spread-ux.md`, and agent playbooks for bid/ask + slippage invariants. ## Acceptance checklist | Criterion | Verification | Result | |-----------|--------------|--------| | Bid/ask buttons and ticket heading use consistent Buy/Sell semantics | `cd frontend-dapp && npm run test:unit -- src/utils/__tests__/tradeDirectionSideLabels.test.ts`; manual `/trade` toggle bid/ask | **PASS** (unit); **SKIP** (screenshot — see verification below) | | Unit tests cover label semantics for both sides | `tradeDirectionSideLabels.test.ts` | **PASS** | | Settings, pre-submit, and humanized chain errors use unified slippage-protection wording | `npm run test:unit -- src/utils/__tests__/humanizeTerraTxError.test.ts src/components/swap/__tests__/SwapPreSubmitSummary.test.tsx src/services/terraclassic/__tests__/transactions.test.ts` | **PASS** | | Tx deadline visible and editable in Swap Settings (default 300s) | Code review + `slippageProtectionCopy.test.ts`; manual Swap Settings | **PASS** (unit/format); **SKIP** (screenshot) | | Route slippage (#293) labeled distinctly from tolerance | `slippageProtectionCopy.test.ts`; Expected slippage row + tooltip in `SwapPage.tsx` | **PASS** | | Screenshot: `/trade` order ticket bid/ask | Manual Chrome on `/trade` | **SKIP** (no screenshot attached in MR; steps below) | | Screenshot: Swap Settings slippage + deadline | Manual Chrome on `/` → expand Settings | **SKIP** (no screenshot attached in MR; steps below) | ## Test plan | Check | Command | Result | |-------|---------|--------| | Extended label + copy tests | `cd frontend-dapp && npm run test:unit -- src/utils/__tests__/tradeDirectionSideLabels.test.ts src/utils/__tests__/slippageProtectionCopy.test.ts src/utils/__tests__/humanizeTerraTxError.test.ts src/components/swap/__tests__/SwapPreSubmitSummary.test.tsx src/pages/TradePage.test.tsx src/pages/SwapPage.test.tsx` | **PASS** | | Frontend lint | `make lint-frontend` | **PASS** (0 errors; pre-existing warnings only) | | Full frontend suite | `make test-frontend` | **SKIP** — 1 unrelated failure: `cosmesPatch127.test.ts` patch SHA drift on main (pre-existing) | | TradePage bid/ask regression | `TradePage.test.tsx` | **PASS** | ## Verification for third parties 1. `git fetch && git checkout issue-412-trade-slippage-labels` 2. `cd frontend-dapp && npm run test:unit -- src/utils/__tests__/tradeDirectionSideLabels.test.ts src/utils/__tests__/slippageProtectionCopy.test.ts src/pages/TradePage.test.tsx src/pages/SwapPage.test.tsx` 3. `make lint-frontend` 4. **Manual `/trade`:** Open order ticket → select **Buy {base}** → heading reads **Buy {base}** → select **Sell {base}** → heading reads **Sell {base}** (buttons and heading agree). 5. **Manual Swap Settings:** On `/`, enter an amount, expand **Slippage protection** row → confirm presets, `max_spread` footnote, **Transaction deadline** presets (default 5 min), and **Expected slippage** `(i)` tooltip text. ## Blockers - Screenshot acceptance items not attached to this MR (manual steps provided). - `make test-frontend` cosmes patch SHA test failure appears unrelated to this diff.

PlasticDigits commented

2026-06-25 20:46:44 +00:00

(Migrated from gitlab.com)

Security review — MR !939

Commit reviewed: dc7ec3abea7e26e04d17e085ee5db682181ba822
Scope: Frontend copy/label alignment (tradeDirectionSideLabels, slippageProtectionCopy), Swap Settings transaction-deadline UI, SEC-D11 pre-sign label rename, docs/skills updates. No smart-contract, indexer, or auth changes.

Outcome: FINDINGS: 0 medium+

Method

Traced attacker-controlled inputs (custom deadline minutes, slippage presets, indexer token symbols) to sinks (Zustand setDeadlineSeconds, on-chain deadline / max_spread construction, React render paths). Re-checked prior MR threads (none).

Areas reviewed (no issues)

Area	Result
Transaction deadline UI (`handleCustomDeadlineMinutes`, `dex.ts`)	Input sanitized (`/[^\d.]/g`); UI range 0.5–60 min; store clamps `Math.max(30, Math.min(3600, seconds))`. Deadline computed at submit as `floor(now/1000) + deadlineSeconds` — no overflow or bypass path.
Bid/ask label change (`TradeOrderTicket`, `tradeDirectionSideLabels`)	Display-only; on-chain side/escrow mapping unchanged (`bid` → escrow token1, `ask` → escrow token0). Aligns CEX Buy/Sell copy; reduces prior heading/button mismatch.
Slippage copy rename	Constants and string templates only; `max_spread` math and `setSlippageTolerance` clamps unchanged.
SEC-D11 pre-sign summary	Label updated to “Slippage protection”; required `swap-confirm-*` testids preserved. Deadline now visible in trade summary row (`swap-deadline-summary`); omission from pre-sign panel is pre-existing pattern, not a new trust-boundary regression.
XSS / injection	No `dangerouslySetInnerHTML`; token symbols remain React text nodes (auto-escaped). Tooltip/title strings are static constants.
Dependencies / secrets	No new packages; no logging or credential changes.

Inline threads: none (no medium+ findings).

Security review: no medium+ findings on this diff.

## Security review — MR !939 **Commit reviewed:** `dc7ec3abea7e26e04d17e085ee5db682181ba822` **Scope:** Frontend copy/label alignment (`tradeDirectionSideLabels`, `slippageProtectionCopy`), Swap Settings transaction-deadline UI, SEC-D11 pre-sign label rename, docs/skills updates. No smart-contract, indexer, or auth changes. **Outcome:** `FINDINGS: 0` medium+ ### Method Traced attacker-controlled inputs (custom deadline minutes, slippage presets, indexer token symbols) to sinks (Zustand `setDeadlineSeconds`, on-chain `deadline` / `max_spread` construction, React render paths). Re-checked prior MR threads (none). ### Areas reviewed (no issues) | Area | Result | |------|--------| | **Transaction deadline UI** (`handleCustomDeadlineMinutes`, `dex.ts`) | Input sanitized (`/[^\d.]/g`); UI range 0.5–60 min; store clamps `Math.max(30, Math.min(3600, seconds))`. Deadline computed at submit as `floor(now/1000) + deadlineSeconds` — no overflow or bypass path. | | **Bid/ask label change** (`TradeOrderTicket`, `tradeDirectionSideLabels`) | Display-only; on-chain side/escrow mapping unchanged (`bid` → escrow token1, `ask` → escrow token0). Aligns CEX Buy/Sell copy; reduces prior heading/button mismatch. | | **Slippage copy rename** | Constants and string templates only; `max_spread` math and `setSlippageTolerance` clamps unchanged. | | **SEC-D11 pre-sign summary** | Label updated to “Slippage protection”; required `swap-confirm-*` testids preserved. Deadline now visible in trade summary row (`swap-deadline-summary`); omission from pre-sign panel is pre-existing pattern, not a new trust-boundary regression. | | **XSS / injection** | No `dangerouslySetInnerHTML`; token symbols remain React text nodes (auto-escaped). Tooltip/title strings are static constants. | | **Dependencies / secrets** | No new packages; no logging or credential changes. | **Inline threads:** none (no medium+ findings). Security review: no medium+ findings on this diff.

PlasticDigits commented

2026-06-25 21:51:31 +00:00

(Migrated from gitlab.com)

mentioned in commit 35fba18e01

mentioned in commit 35fba18e011c668090da540ea35b83334e5db7b5