Document SEC-E08 extension fee guard LocalTerra-only scope (#429) #957

2026-06-29T15:14:23Z

PlasticDigits commented

2026-06-29 15:14:23 +00:00

(Migrated from gitlab.com)

Summary

Addresses GitLab #429 (SEC-E08): the post-sign extension fee guard in extensionSignedFeeGuard.ts is intentionally LocalTerra-only (localterra chain ID). Keplr on mainnet (columbus-5) does not exhibit the stale-fee rewrite that prompted the guard (#127, maintainer confirmation on #429).

This MR adds:

Security model section documenting scope, rationale, and risk acceptance
Wallet QA runbook (docs/runbooks/extension-fee-guard-wallet-qa.md) with LocalTerra + mainnet manual steps and launch sign-off text
Launch checklist Phase 4 gate referencing SEC-E08
Agent playbook (skills/AGENTS_EXTENSION_FEE_GUARD.md) for third-party agents
make verify-issue-429 — doc drift guard + extensionSignedFeeGuard unit tests (including mainnet skip)
Cross-links in gas/station signing skills and a JSDoc pointer in the guard source

No behavioral change to the guard — documentation and verification only.

Acceptance checklist

Criterion	Verification	Result
Documentation states fee guard is LocalTerra-only and explains mainnet exclusion	`docs/security-model.md` § SEC-E08; `docs/runbooks/extension-fee-guard-wallet-qa.md` Scope table	PASS
Wallet QA note confirms Keplr mainnet does not require the guard	Wallet QA runbook § mainnet manual steps + maintainer note on #429; sign-off text template	PASS
Launch checklist references this documentation	`docs/runbooks/launch-checklist.md` Phase 4 SEC-E08 item	PASS
Automated regression	`make verify-issue-429`	PASS

Verification checklist (third parties)

# Doc invariants + unit tests (no LocalTerra required)
make verify-issue-429

# Optional: full lint includes doc drift guard
make check-extension-fee-guard-docs

Manual wallet QA (pre-launch): follow docs/runbooks/extension-fee-guard-wallet-qa.md — Keplr swap on columbus-5 (or staging) and Keplr/simulated wallet on LocalTerra.

Blockers

None.

Relates to #429

## Summary Addresses GitLab #429 (**SEC-E08**): the post-sign extension fee guard in `extensionSignedFeeGuard.ts` is intentionally **LocalTerra-only** (`localterra` chain ID). Keplr on mainnet (`columbus-5`) does not exhibit the stale-fee rewrite that prompted the guard ([#127](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/issues/127), maintainer confirmation on #429). This MR adds: - **Security model** section documenting scope, rationale, and risk acceptance - **Wallet QA runbook** (`docs/runbooks/extension-fee-guard-wallet-qa.md`) with LocalTerra + mainnet manual steps and launch sign-off text - **Launch checklist Phase 4** gate referencing SEC-E08 - **Agent playbook** (`skills/AGENTS_EXTENSION_FEE_GUARD.md`) for third-party agents - **`make verify-issue-429`** — doc drift guard + `extensionSignedFeeGuard` unit tests (including mainnet skip) - Cross-links in gas/station signing skills and a JSDoc pointer in the guard source No behavioral change to the guard — documentation and verification only. ## Acceptance checklist | Criterion | Verification | Result | |-----------|--------------|--------| | Documentation states fee guard is LocalTerra-only and explains mainnet exclusion | `docs/security-model.md` § SEC-E08; `docs/runbooks/extension-fee-guard-wallet-qa.md` Scope table | **PASS** | | Wallet QA note confirms Keplr mainnet does not require the guard | Wallet QA runbook § mainnet manual steps + maintainer note on #429; sign-off text template | **PASS** | | Launch checklist references this documentation | `docs/runbooks/launch-checklist.md` Phase 4 SEC-E08 item | **PASS** | | Automated regression | `make verify-issue-429` | **PASS** | ## Verification checklist (third parties) ```bash # Doc invariants + unit tests (no LocalTerra required) make verify-issue-429 # Optional: full lint includes doc drift guard make check-extension-fee-guard-docs ``` **Manual wallet QA** (pre-launch): follow [`docs/runbooks/extension-fee-guard-wallet-qa.md`](docs/runbooks/extension-fee-guard-wallet-qa.md) — Keplr swap on `columbus-5` (or staging) and Keplr/simulated wallet on LocalTerra. ## Blockers None. Relates to #429

PlasticDigits commented

2026-06-29 15:14:23 +00:00

(Migrated from gitlab.com)

assigned to @PlasticDigits

PlasticDigits commented

2026-06-29 15:16:23 +00:00

(Migrated from gitlab.com)

Security review — MR !957

Commit reviewed: 3f91ddef7866a3c543ce9178b32fc79a424391b5
Scope: SEC-E08 documentation and verification only — security model, wallet QA runbook, launch checklist Phase 4 gate, agent playbook (skills/AGENTS_EXTENSION_FEE_GUARD.md), doc-drift guard (scripts/check_extension_fee_guard_docs.py), make verify-issue-429, Makefile/lint wiring, skill cross-links, and a JSDoc pointer in extensionSignedFeeGuard.ts. No runtime or on-chain logic changes.

Method: Full MR diff reviewed. Attacker-controlled input paths traced for new/changed scripts and tooling. extensionSignedFeeGuard.ts LocalTerra-only gate (isLocalTerraChainId → early null on mainnet) confirmed pre-existing; this MR documents intentional mainnet exclusion rather than introducing it.

Outcome: FINDINGS: 0 medium+

Security review: no medium+ findings on this diff.

Inline threads: none (no findings to anchor)

Notes:

check_extension_fee_guard_docs.py reads fixed repo paths with static string markers — no injection or SSRF surface.
scripts/qa/verify-issue-429.sh runs fixed make/Vitest steps with set -euo pipefail; no untrusted input.
Mainnet fee-guard absence is documented risk acceptance (SEC-E08), not a new exposure introduced by this MR.

## Security review — MR !957 **Commit reviewed:** `3f91ddef7866a3c543ce9178b32fc79a424391b5` **Scope:** SEC-E08 documentation and verification only — security model, wallet QA runbook, launch checklist Phase 4 gate, agent playbook (`skills/AGENTS_EXTENSION_FEE_GUARD.md`), doc-drift guard (`scripts/check_extension_fee_guard_docs.py`), `make verify-issue-429`, Makefile/lint wiring, skill cross-links, and a JSDoc pointer in `extensionSignedFeeGuard.ts`. No runtime or on-chain logic changes. **Method:** Full MR diff reviewed. Attacker-controlled input paths traced for new/changed scripts and tooling. `extensionSignedFeeGuard.ts` LocalTerra-only gate (`isLocalTerraChainId` → early `null` on mainnet) confirmed **pre-existing**; this MR documents intentional mainnet exclusion rather than introducing it. **Outcome:** `FINDINGS: 0` medium+ Security review: **no medium+ findings** on this diff. **Inline threads:** none (no findings to anchor) **Notes:** - `check_extension_fee_guard_docs.py` reads fixed repo paths with static string markers — no injection or SSRF surface. - `scripts/qa/verify-issue-429.sh` runs fixed `make`/Vitest steps with `set -euo pipefail`; no untrusted input. - Mainnet fee-guard absence is documented risk acceptance (SEC-E08), not a new exposure introduced by this MR.

Brouie commented

2026-06-29 15:17:45 +00:00

(Migrated from gitlab.com)

mentioned in issue #429