frontend: pre-sign summary card for pool provide/withdraw (#462) #990

Merged

Brouie merged 1 commit from qa/462-pool-presign-summary into main

2026-06-30 22:07:47 +00:00

Brouie commented

2026-06-30 19:28:32 +00:00

(Migrated from gitlab.com)

Add PoolPreSubmitSummary (action, pair, amount lines, chain label from
getNetworkBadgeCopy().fullLabel) and render it in PoolPage before both the
provide button (gated on amountA && amountB) and the withdraw button (gated on
lpAmount).

Tests: new component suite (provide 2-amount + chain, withdraw LP + chain, env
badge fallback) 3/0; PoolPage suite green, tsc clean.

Source + unit verified; the before-the-wallet-dialog placement/UX is a laptop
browser-pass item.

Pool provide and withdraw had no pre-sign summary — a user saw only token amounts and a submit button, with chain/action/pair absent before the Keplr dialog. Swaps already have this SEC-D11 anti-phishing anchor (SEC-I05 F-03). Add `PoolPreSubmitSummary` (action, pair, amount lines, chain label from `getNetworkBadgeCopy().fullLabel`) and render it in PoolPage before both the provide button (gated on amountA && amountB) and the withdraw button (gated on lpAmount). Tests: new component suite (provide 2-amount + chain, withdraw LP + chain, env badge fallback) 3/0; PoolPage suite green, tsc clean. Source + unit verified; the before-the-wallet-dialog placement/UX is a laptop browser-pass item.

Brouie commented

2026-06-30 19:28:32 +00:00

(Migrated from gitlab.com)

assigned to @Brouie

Brouie commented

2026-06-30 19:29:05 +00:00

(Migrated from gitlab.com)

mentioned in issue #462

PlasticDigits commented

2026-06-30 19:30:40 +00:00

(Migrated from gitlab.com)

Security review — MR !990

Commit reviewed: 75700b087c5969e649db1543d8c81f2a8d4ed5a4
Scope: PoolPreSubmitSummary.tsx, PoolPreSubmitSummary.test.tsx, PoolPage.tsx (pool provide/withdraw pre-sign summary card, #462 / SEC-I05 F-03)

Outcome: FINDINGS: 0 medium+

Summary: No medium, high, or critical vulnerabilities identified on this diff. The change adds a read-only pre-sign summary (action, pair, amounts, chain label) rendered immediately before the provide/withdraw buttons. All displayed values are React text nodes (no dangerouslySetInnerHTML), chain label defaults to env-scoped getNetworkBadgeCopy().fullLabel, and amount/pair fields reuse the same user input and useTokenDisplayInfo labels already shown elsewhere on PoolPage — no new attacker-controlled sink or auth boundary. This is an anti-phishing UX hardening aligned with existing limit-order pre-submit patterns.

Prior review threads: None on this MR; no inline security findings to reference.

Inline threads: None (zero medium+ findings).

## Security review — MR !990 **Commit reviewed:** `75700b087c5969e649db1543d8c81f2a8d4ed5a4` **Scope:** `PoolPreSubmitSummary.tsx`, `PoolPreSubmitSummary.test.tsx`, `PoolPage.tsx` (pool provide/withdraw pre-sign summary card, #462 / SEC-I05 F-03) **Outcome:** `FINDINGS: 0` medium+ **Summary:** No medium, high, or critical vulnerabilities identified on this diff. The change adds a read-only pre-sign summary (action, pair, amounts, chain label) rendered immediately before the provide/withdraw buttons. All displayed values are React text nodes (no `dangerouslySetInnerHTML`), chain label defaults to env-scoped `getNetworkBadgeCopy().fullLabel`, and amount/pair fields reuse the same user input and `useTokenDisplayInfo` labels already shown elsewhere on `PoolPage` — no new attacker-controlled sink or auth boundary. This is an anti-phishing UX hardening aligned with existing limit-order pre-submit patterns. **Prior review threads:** None on this MR; no inline security findings to reference. **Inline threads:** None (zero medium+ findings).

PlasticDigits commented

2026-06-30 22:07:48 +00:00

(Migrated from gitlab.com)

mentioned in commit a19bb72260

mentioned in commit a19bb72260d4d439d51d0764baddcb9631bf8189