Verify #437: fix LCD tx search query param in suspicious-activity runbook #972

Merged

PlasticDigits merged 1 commit from issue-437-verify-lcd-query-param into main

2026-06-30 07:59:36 +00:00

PlasticDigits commented

2026-06-30 07:25:04 +00:00

(Migrated from gitlab.com)

Summary

Verification of #437 (SEC-G04) found that LCD failed-tx discovery snippets used events= on cosmos/tx/v1beta1/txs, which returns query cannot be empty on Terra Classic LCD (LocalTerra and publicnode). Switched to query= (Cosmos tx search syntax) and tightened doc guards.

MR !969 already delivered the discovery runbook; this patch fixes live §2a/§2b LCD curls only.

Acceptance checklist

Criterion	Command / step	Result
Runbook includes suspicious wallet discovery (high failed tx count, anomalous volume)	`grep -E 'traders/leaderboard	query=message.module
Runbook includes suspicious pair/token discovery (reserve delta, swap count spike)	`grep -E 'swap_events	liquidity_events
Queries linked from incident template triage	`grep suspicious-activity-queries docs/templates/incident-dex-indexer.md`	PASS
Doc invariant	`make check-suspicious-activity-queries-docs`	PASS
Full #437 verify script	`make verify-issue-437`	PASS (5/5)
Live LCD §2a (LocalTerra)	`query=message.module='wasm'`, 100 txs scanned, 0 failed	PASS
Live indexer API §1/§3/§5	traders/leaderboard, pairs/stats, blacklist-check	PASS
Live Postgres §1–§5 SQL	via `docker compose exec postgres psql` (host psql absent)	PASS

Follow-ups

Consider adding a scripts/qa/verify-issue-437-live.sh that smoke-tests API + LCD §2a when make has-localterra succeeds (optional; current verify script is doc-only).

## Summary Verification of **#437** (SEC-G04) found that LCD failed-tx discovery snippets used `events=` on `cosmos/tx/v1beta1/txs`, which returns `query cannot be empty` on Terra Classic LCD (LocalTerra and publicnode). Switched to `query=` (Cosmos tx search syntax) and tightened doc guards. MR !969 already delivered the discovery runbook; this patch fixes live §2a/§2b LCD curls only. ## Acceptance checklist | Criterion | Command / step | Result | |-----------|----------------|--------| | Runbook includes suspicious **wallet** discovery (high failed tx count, anomalous volume) | `grep -E 'traders/leaderboard|query=message.module|code != 0' docs/runbooks/suspicious-activity-queries.md` | PASS | | Runbook includes suspicious **pair/token** discovery (reserve delta, swap count spike) | `grep -E 'swap_events|liquidity_events|pair_reserves|compliance/blacklist-check' docs/runbooks/suspicious-activity-queries.md` | PASS | | Queries linked from incident template triage | `grep suspicious-activity-queries docs/templates/incident-dex-indexer.md` | PASS | | Doc invariant | `make check-suspicious-activity-queries-docs` | PASS | | Full #437 verify script | `make verify-issue-437` | PASS (5/5) | | Live LCD §2a (LocalTerra) | `query=message.module='wasm'`, 100 txs scanned, 0 failed | PASS | | Live indexer API §1/§3/§5 | traders/leaderboard, pairs/stats, blacklist-check | PASS | | Live Postgres §1–§5 SQL | via `docker compose exec postgres psql` (host psql absent) | PASS | ## Follow-ups - Consider adding a `scripts/qa/verify-issue-437-live.sh` that smoke-tests API + LCD §2a when `make has-localterra` succeeds (optional; current verify script is doc-only).

PlasticDigits commented

2026-06-30 07:26:58 +00:00

(Migrated from gitlab.com)

Security review

Commit reviewed: 255e3630eb62e713604396fc2ec7d074fdb69651
Scope: docs/runbooks/suspicious-activity-queries.md (LCD events= → query= fix), scripts/qa/verify-issue-437.sh, scripts/check_suspicious_activity_queries_docs.py

Outcome: FINDINGS: 0 medium+

Summary

Doc-only patch correcting Terra Classic LCD tx search snippets to use the supported query= parameter (Cosmos tx search syntax) instead of the non-functional events= form. QA scripts gain a static marker check for query=message.module.

Analysis

Area	Result
Injection (shell/SQL/LCD query)	No new sinks. Runbook curls use `--data-urlencode` for form fields; `WALLET_ADDR` interpolation in §2b drill-down is pre-existing operator-controlled triage input, not attacker-controlled application input.
Authn/authz	No runtime code touched (indexer API, contracts, frontend unchanged).
Secret leakage / logging	None in diff.
SSRF / request forgery	`$LCD` / `$INDEXER_URL` are operator-set env vars in manual incident procedures; unchanged pattern.
Supply chain	No dependency changes.

Prior threads

No prior security-review comments on this MR.

Security review: no medium+ findings on this diff.

## Security review **Commit reviewed:** `255e3630eb62e713604396fc2ec7d074fdb69651` **Scope:** `docs/runbooks/suspicious-activity-queries.md` (LCD `events=` → `query=` fix), `scripts/qa/verify-issue-437.sh`, `scripts/check_suspicious_activity_queries_docs.py` **Outcome:** `FINDINGS: 0` medium+ ### Summary Doc-only patch correcting Terra Classic LCD tx search snippets to use the supported `query=` parameter (Cosmos tx search syntax) instead of the non-functional `events=` form. QA scripts gain a static marker check for `query=message.module`. ### Analysis | Area | Result | |------|--------| | Injection (shell/SQL/LCD query) | No new sinks. Runbook curls use `--data-urlencode` for form fields; `WALLET_ADDR` interpolation in §2b drill-down is pre-existing operator-controlled triage input, not attacker-controlled application input. | | Authn/authz | No runtime code touched (indexer API, contracts, frontend unchanged). | | Secret leakage / logging | None in diff. | | SSRF / request forgery | `$LCD` / `$INDEXER_URL` are operator-set env vars in manual incident procedures; unchanged pattern. | | Supply chain | No dependency changes. | ### Prior threads No prior security-review comments on this MR. **Security review: no medium+ findings on this diff.**