code/cl8y-dex-terraclassic

Fork 0

Security: proactive anomaly checklist with thresholds for small TVL (SEC-G02) #966

Merged

PlasticDigits merged 2 commits from issue-435-anomaly-signals-sec-g02 into main

2026-06-30 05:37:06 +00:00

PlasticDigits commented

2026-06-30 02:21:47 +00:00

(Migrated from gitlab.com)

Summary

Adds operator-facing proactive anomaly monitoring for bootstrap/small-TVL deployments (#435, SEC-G02).

New runbook docs/runbooks/anomaly-signals.md with five signals (A1–A5), each with a numeric threshold and first response action: pool drain (>15% reserves), add/remove profit loop (≥3 cycles / 30 min), route slippage deviation (>30% or >5% vs simulate), failed-tx burst (≥10 / 15 min), LCD-heavy 429 flood (>20% or single-IP dominance).
Links from docs/templates/incident-dex-indexer.md Triage, docs/security-posture.md bootstrap TVL row, and docs/runbooks/blacklist-decision.md (proactive vs reactive).
Drift guard make check-anomaly-signals-docs + acceptance script make verify-issue-435; agent playbook skills/AGENTS_ANOMALY_SIGNALS.md.

Acceptance checklist

Criterion	Verification	Result
Anomaly checklist defines thresholds for pool drain %, add/remove profit loop, route slippage deviation, failed tx volume, LCD-heavy flood	`grep -E 'A[1-5]' docs/runbooks/anomaly-signals.md`	PASS
Each entry includes a defined threshold value and a response action	`make check-anomaly-signals-docs`	PASS
Checklist linked from incident template	`grep anomaly-signals docs/templates/incident-dex-indexer.md`	PASS

Full regression: make verify-issue-435 → PASS (5/5 steps).

Third-party verification

git fetch origin issue-435-anomaly-signals-sec-g02
git checkout issue-435-anomaly-signals-sec-g02
make check-anomaly-signals-docs
make verify-issue-435

Manual review:

Open docs/runbooks/anomaly-signals.md — confirm table rows A1–A5 each have threshold + first response + escalation.
Open docs/templates/incident-dex-indexer.md — Triage section links to anomaly runbook.
Open docs/security-posture.md — bootstrap TVL row references anomaly runbook.

## Summary Adds operator-facing proactive anomaly monitoring for bootstrap/small-TVL deployments ([#435](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/issues/435), **SEC-G02**). - New runbook [`docs/runbooks/anomaly-signals.md`](docs/runbooks/anomaly-signals.md) with five signals (A1–A5), each with a **numeric threshold** and **first response action**: pool drain (>15% reserves), add/remove profit loop (≥3 cycles / 30 min), route slippage deviation (>30% or >5% vs simulate), failed-tx burst (≥10 / 15 min), LCD-heavy 429 flood (>20% or single-IP dominance). - Links from [`docs/templates/incident-dex-indexer.md`](docs/templates/incident-dex-indexer.md) Triage, [`docs/security-posture.md`](docs/security-posture.md) bootstrap TVL row, and [`docs/runbooks/blacklist-decision.md`](docs/runbooks/blacklist-decision.md) (proactive vs reactive). - Drift guard `make check-anomaly-signals-docs` + acceptance script `make verify-issue-435`; agent playbook [`skills/AGENTS_ANOMALY_SIGNALS.md`](skills/AGENTS_ANOMALY_SIGNALS.md). ## Acceptance checklist | Criterion | Verification | Result | |-----------|--------------|--------| | Anomaly checklist defines thresholds for pool drain %, add/remove profit loop, route slippage deviation, failed tx volume, LCD-heavy flood | `grep -E 'A[1-5]' docs/runbooks/anomaly-signals.md` | **PASS** | | Each entry includes a defined threshold value and a response action | `make check-anomaly-signals-docs` | **PASS** | | Checklist linked from incident template | `grep anomaly-signals docs/templates/incident-dex-indexer.md` | **PASS** | Full regression: `make verify-issue-435` → **PASS** (5/5 steps). ## Third-party verification ```bash git fetch origin issue-435-anomaly-signals-sec-g02 git checkout issue-435-anomaly-signals-sec-g02 make check-anomaly-signals-docs make verify-issue-435 ``` Manual review: 1. Open `docs/runbooks/anomaly-signals.md` — confirm table rows A1–A5 each have threshold + first response + escalation. 2. Open `docs/templates/incident-dex-indexer.md` — Triage section links to anomaly runbook. 3. Open `docs/security-posture.md` — bootstrap TVL row references anomaly runbook.

PlasticDigits commented

2026-06-30 02:23:23 +00:00

(Migrated from gitlab.com)

Security review — MR !966

Commit reviewed: bfc25c1671a6f0b641fa227ac8e9dceabb1f05da

Scope: Documentation and drift-guard tooling only — docs/runbooks/anomaly-signals.md (SEC-G02 anomaly checklist A1–A5), cross-links in docs/templates/incident-dex-indexer.md, docs/security-posture.md, docs/runbooks/blacklist-decision.md, docs/runbooks/launch-checklist.md, docs/testing.md, skills/AGENTS_ANOMALY_SIGNALS.md, scripts/check_anomaly_signals_docs.py, scripts/qa/verify-issue-435.sh, and Makefile targets. No smart contract, indexer runtime, or frontend application code in this diff.

Method: Full MR diff review; for each candidate class (injection, authn/authz bypass, SSRF, XSS, secret leakage, unsafe deserialization, path traversal) traced attacker-controlled input to sinks in added/modified files. Compared new scripts to existing doc-drift guards (check_blacklist_decision_docs.py, verify-issue-400.sh).

Outcome: FINDINGS: 0 medium+

Security review: no medium+ findings on this diff.

Inline threads: none (no findings to attach)

Summary: Added content is operator runbook guidance and doc cross-link enforcement. check_anomaly_signals_docs.py reads fixed repo paths with static marker checks — no external input. verify-issue-435.sh invokes hardcoded make/grep/test steps only. Runbook bash/curl examples use <pair>, <indexer>, etc. placeholders for manual operator use; they are not executed by CI or production services.

## Security review — MR !966 **Commit reviewed:** `bfc25c1671a6f0b641fa227ac8e9dceabb1f05da` **Scope:** Documentation and drift-guard tooling only — `docs/runbooks/anomaly-signals.md` (SEC-G02 anomaly checklist A1–A5), cross-links in `docs/templates/incident-dex-indexer.md`, `docs/security-posture.md`, `docs/runbooks/blacklist-decision.md`, `docs/runbooks/launch-checklist.md`, `docs/testing.md`, `skills/AGENTS_ANOMALY_SIGNALS.md`, `scripts/check_anomaly_signals_docs.py`, `scripts/qa/verify-issue-435.sh`, and Makefile targets. No smart contract, indexer runtime, or frontend application code in this diff. **Method:** Full MR diff review; for each candidate class (injection, authn/authz bypass, SSRF, XSS, secret leakage, unsafe deserialization, path traversal) traced attacker-controlled input to sinks in added/modified files. Compared new scripts to existing doc-drift guards (`check_blacklist_decision_docs.py`, `verify-issue-400.sh`). **Outcome:** `FINDINGS: 0` medium+ Security review: no medium+ findings on this diff. **Inline threads:** none (no findings to attach) **Summary:** Added content is operator runbook guidance and doc cross-link enforcement. `check_anomaly_signals_docs.py` reads fixed repo paths with static marker checks — no external input. `verify-issue-435.sh` invokes hardcoded `make`/`grep`/`test` steps only. Runbook bash/curl examples use `<pair>`, `<indexer>`, etc. placeholders for manual operator use; they are not executed by CI or production services.

Brouie commented

2026-06-30 02:59:05 +00:00

(Migrated from gitlab.com)

mentioned in issue #435

PlasticDigits commented

2026-06-30 05:09:14 +00:00

(Migrated from gitlab.com)

added 12 commits

bfc25c16...1921c81f - 11 commits from branch main
e2e08ba6 - Merge origin/main into issue-435-anomaly-signals-sec-g02

Compare with previous version

added 12 commits <ul><li>bfc25c16...1921c81f - 11 commits from branch <code>main</code></li><li>e2e08ba6 - Merge origin/main into issue-435-anomaly-signals-sec-g02</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/248/diffs?diff_id=1877401517&start_sha=bfc25c1671a6f0b641fa227ac8e9dceabb1f05da)

PlasticDigits commented

2026-06-30 05:09:20 +00:00

(Migrated from gitlab.com)

Resolved merge conflicts with main by merging origin/main into issue-435-anomaly-signals-sec-g02.

Conflicts resolved

Makefile — kept both SEC-G02 targets (check-anomaly-signals-docs, verify-issue-435) and main additions (check-launch-monitoring-docs, check-incident-template-docs, verify-issue-439, verify-issue-440); updated .PHONY, help, and lint accordingly.
docs/testing.md — added both docs-anomaly-signals and docs-incident-template CI job rows.

Sanity checks: make check-anomaly-signals-docs, make check-incident-template-docs, make check-launch-monitoring-docs — all pass.

Resolved merge conflicts with `main` by merging `origin/main` into `issue-435-anomaly-signals-sec-g02`. **Conflicts resolved** - `Makefile` — kept both SEC-G02 targets (`check-anomaly-signals-docs`, `verify-issue-435`) and `main` additions (`check-launch-monitoring-docs`, `check-incident-template-docs`, `verify-issue-439`, `verify-issue-440`); updated `.PHONY`, `help`, and `lint` accordingly. - `docs/testing.md` — added both `docs-anomaly-signals` and `docs-incident-template` CI job rows. **Sanity checks:** `make check-anomaly-signals-docs`, `make check-incident-template-docs`, `make check-launch-monitoring-docs` — all pass.

PlasticDigits commented

2026-06-30 05:11:08 +00:00

(Migrated from gitlab.com)

Security review — MR !966

Commit reviewed: e2e08ba60ad2b304626c56897e30cd60096e0ad3

Scope: Re-review after merge of origin/main into issue-435-anomaly-signals-sec-g02. Changed files (11): docs/runbooks/anomaly-signals.md (SEC-G02 anomaly checklist A1–A5), cross-links in docs/templates/incident-dex-indexer.md, docs/security-posture.md, docs/runbooks/blacklist-decision.md, docs/runbooks/launch-checklist.md, docs/testing.md, skills/AGENTS_ANOMALY_SIGNALS.md, skills/AGENTS_BLACKLIST_DECISION.md, scripts/check_anomaly_signals_docs.py, scripts/qa/verify-issue-435.sh, and Makefile targets. No smart contract, indexer runtime, or frontend application code in this diff.

Method: Full MR diff review against current head_sha; for each candidate class (injection, authn/authz bypass, SSRF, XSS, secret leakage, unsafe deserialization, path traversal, supply-chain) traced attacker-controlled input to sinks in added/modified files. Compared new scripts to existing doc-drift guards (check_blacklist_decision_docs.py, verify-issue-400.sh). Ran make check-anomaly-signals-docs and make verify-issue-435 locally — both pass.

Outcome: FINDINGS: 0 medium+

Security review: no medium+ findings on this diff.

Inline threads: none (no findings to attach)

Notes vs prior review (bfc25c16): Merge from main updated Makefile/docs/testing.md conflict resolution only; SEC-G02 content and security surface unchanged. Runbook bash/curl examples use <pair>, <indexer>, etc. placeholders for manual operator use — not executed by CI or production services. A5 rate-limit defaults reference already-public values in AGENTS_INDEXER_API_LCD_SECURITY.md.

## Security review — MR !966 **Commit reviewed:** `e2e08ba60ad2b304626c56897e30cd60096e0ad3` **Scope:** Re-review after merge of `origin/main` into `issue-435-anomaly-signals-sec-g02`. Changed files (11): `docs/runbooks/anomaly-signals.md` (SEC-G02 anomaly checklist A1–A5), cross-links in `docs/templates/incident-dex-indexer.md`, `docs/security-posture.md`, `docs/runbooks/blacklist-decision.md`, `docs/runbooks/launch-checklist.md`, `docs/testing.md`, `skills/AGENTS_ANOMALY_SIGNALS.md`, `skills/AGENTS_BLACKLIST_DECISION.md`, `scripts/check_anomaly_signals_docs.py`, `scripts/qa/verify-issue-435.sh`, and Makefile targets. No smart contract, indexer runtime, or frontend application code in this diff. **Method:** Full MR diff review against current `head_sha`; for each candidate class (injection, authn/authz bypass, SSRF, XSS, secret leakage, unsafe deserialization, path traversal, supply-chain) traced attacker-controlled input to sinks in added/modified files. Compared new scripts to existing doc-drift guards (`check_blacklist_decision_docs.py`, `verify-issue-400.sh`). Ran `make check-anomaly-signals-docs` and `make verify-issue-435` locally — both pass. **Outcome:** `FINDINGS: 0` medium+ Security review: no medium+ findings on this diff. **Inline threads:** none (no findings to attach) **Notes vs prior review (`bfc25c16`):** Merge from `main` updated Makefile/`docs/testing.md` conflict resolution only; SEC-G02 content and security surface unchanged. Runbook bash/curl examples use `<pair>`, `<indexer>`, etc. placeholders for manual operator use — not executed by CI or production services. A5 rate-limit defaults reference already-public values in `AGENTS_INDEXER_API_LCD_SECURITY.md`.

PlasticDigits commented

2026-06-30 05:37:06 +00:00

(Migrated from gitlab.com)

mentioned in commit ba73247a14

mentioned in commit ba73247a14f538f2c5a4c2a5ca2e388bf9a1cde4