code/cl8y-dex-terraclassic

Fork 0

Add env/chain address cross-check for post-deploy verification (SEC-H04, #442) #977

Merged

PlasticDigits merged 2 commits from issue-442-env-address-cross-check into main

2026-06-30 11:40:40 +00:00

PlasticDigits commented

2026-06-30 11:18:32 +00:00

(Migrated from gitlab.com)

Summary

Adds SEC-H04 post-deploy env/chain address cross-check (#442):

New scripts/qa/verify-env-addresses.sh reads FACTORY_ADDRESS, ROUTER_ADDRESS, and FEE_DISCOUNT_ADDRESS from indexer/.env and VITE_* counterparts from the frontend env, asserts parity, then queries on-chain factory/router/fee-discount config (router factory must equal env FACTORY_ADDRESS; fee-discount governance non-empty).
Wired into make qa-verify-deploy (runs after Q1 schema/stamp) and documented as invariant Q4 in docs/qa-invariants.md.
Launch checklist Phase 4 requires pasted output before go/no-go sign-off.
Agent playbook: skills/AGENTS_DEPLOY_ENV_ADDRESSES_VERIFY.md.

Acceptance checklist

Criterion	Verification	Result
Script reads all address fields from both env files and compares against on-chain queries	`make verify-issue-442` (live LocalTerra step)	PASS
Script exits nonzero on env/chain mismatch	Manual: `VERIFY_ENV_FRONTEND_FILE=<mismatched .env.local> ./scripts/qa/verify-env-addresses.sh` → exit 1	PASS
`docs/runbooks/launch-checklist.md` Phase 4 requires comparison before go/no-go	`grep verify-env-addresses docs/runbooks/launch-checklist.md` + `make check-deploy-env-addresses-docs`	PASS

Verification checklist (third parties)

make test-qa-verify-env-addresses          # unit fixtures (no chain)
make check-deploy-env-addresses-docs       # doc drift guard

# With LocalTerra + deploy env files:
make setup-cloud-localterra                # or existing QA stack
make qa-verify-env-addresses               # standalone
make qa-verify-deploy                      # includes env check after Q1
make verify-issue-442                      # full acceptance runner

Staging/mainnet override:

export VERIFY_ENV_INDEXER_FILE=/path/to/indexer/.env
export VERIFY_ENV_FRONTEND_FILE=/path/to/frontend-dapp/.env.production
export TERRA_LCD_URL=https://<lcd>
make qa-verify-env-addresses

Paste full qa-verify-env-addresses output on the launch tracking issue (Phase 4 / SEC-H04).

## Summary Adds **SEC-H04** post-deploy env/chain address cross-check ([#442](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/issues/442)): - New [`scripts/qa/verify-env-addresses.sh`](scripts/qa/verify-env-addresses.sh) reads `FACTORY_ADDRESS`, `ROUTER_ADDRESS`, and `FEE_DISCOUNT_ADDRESS` from `indexer/.env` and `VITE_*` counterparts from the frontend env, asserts parity, then queries on-chain factory/router/fee-discount `config` (router `factory` must equal env `FACTORY_ADDRESS`; fee-discount `governance` non-empty). - Wired into **`make qa-verify-deploy`** (runs after Q1 schema/stamp) and documented as invariant **Q4** in [`docs/qa-invariants.md`](docs/qa-invariants.md). - Launch checklist **Phase 4** requires pasted output before go/no-go sign-off. - Agent playbook: [`skills/AGENTS_DEPLOY_ENV_ADDRESSES_VERIFY.md`](skills/AGENTS_DEPLOY_ENV_ADDRESSES_VERIFY.md). ## Acceptance checklist | Criterion | Verification | Result | |-----------|--------------|--------| | Script reads all address fields from both env files and compares against on-chain queries | `make verify-issue-442` (live LocalTerra step) | **PASS** | | Script exits nonzero on env/chain mismatch | Manual: `VERIFY_ENV_FRONTEND_FILE=<mismatched .env.local> ./scripts/qa/verify-env-addresses.sh` → exit 1 | **PASS** | | `docs/runbooks/launch-checklist.md` Phase 4 requires comparison before go/no-go | `grep verify-env-addresses docs/runbooks/launch-checklist.md` + `make check-deploy-env-addresses-docs` | **PASS** | ## Verification checklist (third parties) ```bash make test-qa-verify-env-addresses # unit fixtures (no chain) make check-deploy-env-addresses-docs # doc drift guard # With LocalTerra + deploy env files: make setup-cloud-localterra # or existing QA stack make qa-verify-env-addresses # standalone make qa-verify-deploy # includes env check after Q1 make verify-issue-442 # full acceptance runner ``` Staging/mainnet override: ```bash export VERIFY_ENV_INDEXER_FILE=/path/to/indexer/.env export VERIFY_ENV_FRONTEND_FILE=/path/to/frontend-dapp/.env.production export TERRA_LCD_URL=https://<lcd> make qa-verify-env-addresses ``` Paste full `qa-verify-env-addresses` output on the launch tracking issue (Phase 4 / SEC-H04).

PlasticDigits commented

2026-06-30 11:21:11 +00:00

(Migrated from gitlab.com)

Security review — MR !977

Commit reviewed: 8f5db8bccf450bf2ab864076b5e6e6ccf3e8a3f3
Scope: scripts/qa/verify-env-addresses.sh and wiring (Makefile, verify-deploy.sh, doc/skill drift guards, unit tests) for SEC-H04 env/chain address cross-check (#442).

Outcome: FINDINGS: 0 medium+

Security review: no medium+ findings on this diff.

Summary

This MR adds an operator-run post-deploy verification script that compares indexer vs frontend contract addresses and probes on-chain config via existing lcd-smart-query.sh / localterra-host-curl.sh helpers. It follows the same trust model and patterns as verify-deploy-config.sh (SEC-H03): env files and TERRA_LCD_URL are operator-controlled; address values are quoted before URL construction; no new runtime services or user-facing attack surface.

Reviewed attack paths considered:

Injection / command execution — read_env_var keys are fixed literals; contract addresses and LCD base URL are passed quoted into curl helpers; no eval or unquoted expansion.
SSRF — TERRA_LCD_URL / TERRA_RPC_URL override is intentional for staging/mainnet and matches pre-existing QA scripts; not attacker-controlled in CI/deploy contexts.
Secret leakage — script reads only named address keys via sed; does not source indexer/frontend env files wholesale.
Authz / permission boundaries — no changes to on-chain contracts, indexer API, or frontend runtime auth.
False-negative bypass — incomplete checks (e.g. no code-id/hash attestation) are inherent verification scope limits, not exploitable weaknesses introduced here.

Inline threads: none (no medium+ findings).

## Security review — MR !977 **Commit reviewed:** `8f5db8bccf450bf2ab864076b5e6e6ccf3e8a3f3` **Scope:** `scripts/qa/verify-env-addresses.sh` and wiring (Makefile, `verify-deploy.sh`, doc/skill drift guards, unit tests) for SEC-H04 env/chain address cross-check (#442). **Outcome:** `FINDINGS: 0` medium+ Security review: **no medium+ findings** on this diff. ### Summary This MR adds an operator-run post-deploy verification script that compares indexer vs frontend contract addresses and probes on-chain `config` via existing `lcd-smart-query.sh` / `localterra-host-curl.sh` helpers. It follows the same trust model and patterns as `verify-deploy-config.sh` (SEC-H03): env files and `TERRA_LCD_URL` are operator-controlled; address values are quoted before URL construction; no new runtime services or user-facing attack surface. Reviewed attack paths considered: - **Injection / command execution** — `read_env_var` keys are fixed literals; contract addresses and LCD base URL are passed quoted into curl helpers; no eval or unquoted expansion. - **SSRF** — `TERRA_LCD_URL` / `TERRA_RPC_URL` override is intentional for staging/mainnet and matches pre-existing QA scripts; not attacker-controlled in CI/deploy contexts. - **Secret leakage** — script reads only named address keys via `sed`; does not source indexer/frontend env files wholesale. - **Authz / permission boundaries** — no changes to on-chain contracts, indexer API, or frontend runtime auth. - **False-negative bypass** — incomplete checks (e.g. no code-id/hash attestation) are inherent verification scope limits, not exploitable weaknesses introduced here. **Inline threads:** none (no medium+ findings).

Brouie commented

2026-06-30 11:24:01 +00:00

(Migrated from gitlab.com)

mentioned in issue #442

PlasticDigits commented

2026-06-30 11:32:37 +00:00

(Migrated from gitlab.com)

added 7 commits

8f5db8bc...6d945d81 - 6 commits from branch main
d7b7eca3 - Merge origin/main into issue-442-env-address-cross-check.

Compare with previous version

added 7 commits <ul><li>8f5db8bc...6d945d81 - 6 commits from branch <code>main</code></li><li>d7b7eca3 - Merge origin/main into issue-442-env-address-cross-check.</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/259/diffs?diff_id=1878095753&start_sha=8f5db8bccf450bf2ab864076b5e6e6ccf3e8a3f3)

PlasticDigits commented

2026-06-30 11:32:39 +00:00

(Migrated from gitlab.com)

Resolved merge conflicts with main (Makefile only).

Merged both sides:

#442 (SEC-H04): check-deploy-env-addresses-docs, qa-verify-env-addresses, test-qa-verify-env-addresses, verify-issue-442
main: check-wasm-migration-rollback-docs, check-rollback-decision-docs, verify-issue-443, verify-issue-445

Sanity: make test-qa-verify-env-addresses and make check-deploy-env-addresses-docs pass.

Resolved merge conflicts with `main` (Makefile only). Merged both sides: - **#442 (SEC-H04):** `check-deploy-env-addresses-docs`, `qa-verify-env-addresses`, `test-qa-verify-env-addresses`, `verify-issue-442` - **main:** `check-wasm-migration-rollback-docs`, `check-rollback-decision-docs`, `verify-issue-443`, `verify-issue-445` Sanity: `make test-qa-verify-env-addresses` and `make check-deploy-env-addresses-docs` pass.

PlasticDigits commented

2026-06-30 11:34:44 +00:00

(Migrated from gitlab.com)

Security review — MR !977 (re-review)

Commit reviewed: d7b7eca3e513a71262cfe20d51fb097178d9c242
Scope: scripts/qa/verify-env-addresses.sh and wiring (Makefile, verify-deploy.sh, doc/skill drift guards, unit tests) for SEC-H04 env/chain address cross-check (#442). Re-reviewed after merge of origin/main into the MR branch (prior review was on 8f5db8b).

Outcome: FINDINGS: 0 medium+

Security review: no medium+ findings on this diff.

Summary

This MR adds an operator-run post-deploy verification script that compares indexer vs frontend contract addresses and probes on-chain config via existing lcd-smart-query.sh / localterra-host-curl.sh helpers. It follows the same trust model and patterns as verify-deploy-config.sh (SEC-H03): env files and TERRA_LCD_URL are operator-controlled; address values are quoted before URL construction; read_env_var keys are fixed literals; no eval or unquoted expansion.

Attack paths considered:

Injection / command execution — contract addresses and LCD base URL passed quoted into curl helpers; localterra_docker_exec uses printf '%q' for container args.
SSRF — TERRA_LCD_URL / TERRA_RPC_URL override is intentional for staging/mainnet and matches pre-existing QA scripts; not attacker-controlled in CI/deploy contexts.
Secret leakage — script reads only named address keys via sed; does not source indexer/frontend env files wholesale.
Authz / permission boundaries — no changes to on-chain contracts, indexer API, or frontend runtime auth.
False-negative bypass — incomplete checks (e.g. no code-id/hash attestation, prefix-only terra1 validation) are inherent verification scope limits, not exploitable weaknesses introduced here.

Inline threads: none (no medium+ findings).

## Security review — MR !977 (re-review) **Commit reviewed:** `d7b7eca3e513a71262cfe20d51fb097178d9c242` **Scope:** `scripts/qa/verify-env-addresses.sh` and wiring (Makefile, `verify-deploy.sh`, doc/skill drift guards, unit tests) for SEC-H04 env/chain address cross-check (#442). Re-reviewed after merge of `origin/main` into the MR branch (prior review was on `8f5db8b`). **Outcome:** `FINDINGS: 0` medium+ Security review: **no medium+ findings** on this diff. ### Summary This MR adds an operator-run post-deploy verification script that compares indexer vs frontend contract addresses and probes on-chain `config` via existing `lcd-smart-query.sh` / `localterra-host-curl.sh` helpers. It follows the same trust model and patterns as `verify-deploy-config.sh` (SEC-H03): env files and `TERRA_LCD_URL` are operator-controlled; address values are quoted before URL construction; `read_env_var` keys are fixed literals; no eval or unquoted expansion. Attack paths considered: - **Injection / command execution** — contract addresses and LCD base URL passed quoted into curl helpers; `localterra_docker_exec` uses `printf '%q'` for container args. - **SSRF** — `TERRA_LCD_URL` / `TERRA_RPC_URL` override is intentional for staging/mainnet and matches pre-existing QA scripts; not attacker-controlled in CI/deploy contexts. - **Secret leakage** — script reads only named address keys via `sed`; does not source indexer/frontend env files wholesale. - **Authz / permission boundaries** — no changes to on-chain contracts, indexer API, or frontend runtime auth. - **False-negative bypass** — incomplete checks (e.g. no code-id/hash attestation, prefix-only `terra1` validation) are inherent verification scope limits, not exploitable weaknesses introduced here. **Inline threads:** none (no medium+ findings).