Limit order pre-sign summary: labeled signing fields (#461) #995

Merged

PlasticDigits merged 1 commit from qa/461-limit-presign-signing-fields into main

2026-07-01 00:08:06 +00:00

PlasticDigits commented

2026-06-30 22:20:20 +00:00

(Migrated from gitlab.com)

Summary

Addresses #461 (SEC-I05 F-02): limit order placement now shows a structured pre-sign card with labeled Action, Pair, Side, Amount, and Chain rows before the Keplr wallet dialog opens — matching the swap/pool anti-phishing pattern from SEC-D11.

The prior merge added only a Chain bullet inside the fee-focused card; this refactor leads with the signing fields (same getNetworkBadgeCopy().fullLabel source as swaps) and shortens the resting-vs-market copy to reduce cognitive overload per review feedback.

Acceptance checklist

Criterion	Verification	Result
Limit order placement renders pre-sign summary with chain label, action type, pair, side, and amount	`npm run test:run -- src/components/trade/__tests__/LimitOrderPreSubmitSummary.test.tsx`	PASS
Chain label derives from `getNetworkBadgeCopy().fullLabel`	Unit test `falls back to the env network badge`; `TradePage.test.tsx` asserts `LocalTerra` on limit tab	PASS
Unit test asserts chain label field in limit order pre-sign summary	`LimitOrderPreSubmitSummary.test.tsx` — `limit-order-pre-submit-summary-chain`	PASS
Keplr wallet dialog is not the first place chain is identified	`TradePage.test.tsx` — `trade-limit-pre-submit-summary-chain` before submit; manual: Place limit on `/trade` or `/limits` with Keplr	PASS (unit); manual step for third parties

Third-party verification

export PATH="$HOME/.nvm/versions/node/$(cat .nvmrc)/bin:$PATH"
cd frontend-dapp
npm run test:run -- \
  src/components/trade/__tests__/LimitOrderPreSubmitSummary.test.tsx \
  src/pages/TradePage.test.tsx
npx tsc --noEmit

Manual (wallet): make setup-cloud-localterra && make dev → open /trade/{pair} Limit tab or /limits → confirm the pre-submit card shows Action / Pair / Side / Amount / Chain above Place limit → click Place limit → Keplr should not be the first place the chain name appears.

Files

LimitOrderPreSubmitSummary.tsx — structured signing rows + compact fee section
TradeOrderTicket.tsx, LimitOrdersPage.tsx — wire pair/side/amount props
Docs/skills cross-links updated

## Summary Addresses [#461](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/issues/461) (SEC-I05 F-02): limit order placement now shows a **structured pre-sign card** with labeled **Action**, **Pair**, **Side**, **Amount**, and **Chain** rows before the Keplr wallet dialog opens — matching the swap/pool anti-phishing pattern from SEC-D11. The prior merge added only a Chain bullet inside the fee-focused card; this refactor leads with the signing fields (same `getNetworkBadgeCopy().fullLabel` source as swaps) and shortens the resting-vs-market copy to reduce cognitive overload per review feedback. ## Acceptance checklist | Criterion | Verification | Result | |-----------|--------------|--------| | Limit order placement renders pre-sign summary with chain label, action type, pair, side, and amount | `npm run test:run -- src/components/trade/__tests__/LimitOrderPreSubmitSummary.test.tsx` | PASS | | Chain label derives from `getNetworkBadgeCopy().fullLabel` | Unit test `falls back to the env network badge`; `TradePage.test.tsx` asserts `LocalTerra` on limit tab | PASS | | Unit test asserts chain label field in limit order pre-sign summary | `LimitOrderPreSubmitSummary.test.tsx` — `limit-order-pre-submit-summary-chain` | PASS | | Keplr wallet dialog is not the first place chain is identified | `TradePage.test.tsx` — `trade-limit-pre-submit-summary-chain` before submit; manual: Place limit on `/trade` or `/limits` with Keplr | PASS (unit); manual step for third parties | ## Third-party verification ```bash export PATH="$HOME/.nvm/versions/node/$(cat .nvmrc)/bin:$PATH" cd frontend-dapp npm run test:run -- \ src/components/trade/__tests__/LimitOrderPreSubmitSummary.test.tsx \ src/pages/TradePage.test.tsx npx tsc --noEmit ``` **Manual (wallet):** `make setup-cloud-localterra && make dev` → open `/trade/{pair}` Limit tab or `/limits` → confirm the pre-submit card shows Action / Pair / Side / Amount / Chain above **Place limit** → click Place limit → Keplr should **not** be the first place the chain name appears. ## Files - `LimitOrderPreSubmitSummary.tsx` — structured signing rows + compact fee section - `TradeOrderTicket.tsx`, `LimitOrdersPage.tsx` — wire pair/side/amount props - Docs/skills cross-links updated

PlasticDigits commented

2026-06-30 22:24:22 +00:00

(Migrated from gitlab.com)

Security review — MR !995

Commit reviewed: 16d19e715afb515fc5edb1fe75bdf6546588072d
Scope: Limit order pre-sign summary labeled signing fields (LimitOrderPreSubmitSummary.tsx, TradeOrderTicket.tsx, LimitOrdersPage.tsx, tests/docs/skills). Frontend-only; no CosmWasm, indexer API, or auth changes.

Outcome: FINDINGS: 0 medium+ — NONE

Summary

This MR extends the existing SEC-D11 / SEC-I05 anti-phishing pattern (already used by SwapPreSubmitSummary and PoolPreSubmitSummary) to limit orders: labeled Action, Pair, Side, Amount, and Chain rows rendered as React text nodes before the wallet dialog.

Reviewed attack paths (not exploitable on this diff):

Area	Trace	Control
XSS / HTML injection	`pairLabel`, `sideLabel`, `escrowAmountLabel`, `chainFullLabel` flow from registry/indexer symbols + user `amountHuman` into `SummaryRow` `{value}`	React JSX auto-escaping; no `dangerouslySetInnerHTML`
Display vs signing mismatch	Pre-submit props derive from the same React state (`amountHuman`, `side`, token display symbols) consumed by `placeMutation` → `placeLimitOrderWithAllowance`	Live re-render on state change; wallet still shows raw CosmWasm execute msg
Chain spoofing	`chainFullLabel` defaults to `getNetworkBadgeCopy().fullLabel` (build-time `DEFAULT_NETWORK`)	Same source as swap/pool pre-sign cards
Authn/authz / SSRF / secrets	Not touched	N/A

No prior security-review threads on this MR to re-validate.

Inline threads: none (zero medium+ findings).

Automated security review run.

## Security review — MR !995 **Commit reviewed:** `16d19e715afb515fc5edb1fe75bdf6546588072d` **Scope:** Limit order pre-sign summary labeled signing fields (`LimitOrderPreSubmitSummary.tsx`, `TradeOrderTicket.tsx`, `LimitOrdersPage.tsx`, tests/docs/skills). Frontend-only; no CosmWasm, indexer API, or auth changes. **Outcome:** `FINDINGS: 0` medium+ — **NONE** ### Summary This MR extends the existing SEC-D11 / SEC-I05 anti-phishing pattern (already used by `SwapPreSubmitSummary` and `PoolPreSubmitSummary`) to limit orders: labeled **Action**, **Pair**, **Side**, **Amount**, and **Chain** rows rendered as React text nodes before the wallet dialog. **Reviewed attack paths (not exploitable on this diff):** | Area | Trace | Control | |------|-------|---------| | XSS / HTML injection | `pairLabel`, `sideLabel`, `escrowAmountLabel`, `chainFullLabel` flow from registry/indexer symbols + user `amountHuman` into `SummaryRow` `{value}` | React JSX auto-escaping; no `dangerouslySetInnerHTML` | | Display vs signing mismatch | Pre-submit props derive from the same React state (`amountHuman`, `side`, token display symbols) consumed by `placeMutation` → `placeLimitOrderWithAllowance` | Live re-render on state change; wallet still shows raw CosmWasm execute msg | | Chain spoofing | `chainFullLabel` defaults to `getNetworkBadgeCopy().fullLabel` (build-time `DEFAULT_NETWORK`) | Same source as swap/pool pre-sign cards | | Authn/authz / SSRF / secrets | Not touched | N/A | No prior security-review threads on this MR to re-validate. **Inline threads:** none (zero medium+ findings). --- *Automated security review run.*