fix(wallet): synchronize live identities and persist vote eligibility and action state #46
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Scope and source
Priority: P1. Gap coverage: GAP-029, GAP-030, GAP-031, GAP-033, GAP-050. Derived from GAP_1791945837.md, reviewed code commit
f8dbe93df953a78b17cb3304b717dcf84c4cd517. Currente476a68da09645c2308cbf47b90211fcaffcb7afadds only the report, so implementation findings remain applicable. Report evidence is local reproduction/source inspection unless explicitly proposed; no production exploit or current live-readiness claim.Coverage and sequencing: gap backlog tracker. Workstream 11. Dependencies: 05, 06, 08, 10.
Current codebase
Recorded own-vote endpoint is unused; local voted state persists across wrong identity/route and repeat signing remains enabled. EVM store persists connector/address without active wagmi synchronization or stale-state clearing. Snapshot/detail/signing requests can resolve after account or route changes. Draft review/comment and open voting forms are shown without capabilities. Inherited gas/LocalTerra constants and verbose diagnostics remain despite HTTP-only signed voting.
Why this implementation is needed
Stale identity and result races can present another wallet's state and invite invalid/redundant signatures; users need authoritative eligibility and clear offchain expectations.
Relevant files
frontend/src/stores/evmWallet.tsfrontend/src/hooks/useConnectedIdentity.tsfrontend/src/hooks/useVotingSnapshot.tsfrontend/src/hooks/useWallet.tsfrontend/src/services/evmSign.tsfrontend/src/services/terraSign.tsfrontend/src/services/votingSign.tsfrontend/src/services/operatorVoting.tsfrontend/src/pages/VoteDetailPage.tsxfrontend/src/utils/constants.tsfrontend/src/services/terraclassic/wallet.tsoperator-voting/src/api.rsRecommended solution
Derive/subscribe to authoritative wagmi account/chain and clear disconnect/reconnect stale state; preserve ported connector behavior and early pairing hook. Use identity/proposal-keyed requests with real AbortSignal/cancellation or generations, reset view immediately and bind receipts to signed identity. Read recorded ballot/frozen eligibility/capabilities and disable immutable repeat voting, unavailable committee/editor/comment actions, with useful reasons; server remains authoritative. Validate forms before wallet prompts and confirm exact revision/freeze. Add BSC switch-network handling. Audit reachable inherited gas/tx paths before cleanup and explain offchain signature/no voting transaction fee.
Constraints and guardrails
Preserve standalone offchain advisory voting, no new smart contracts or archive-node dependency, BSC as a core electorate, raw 18-decimal integer balances and separate Terra/BSC address identities. Keep Legal fail-closed transactional UI and the proven DEX Terra/Bridge EVM connectors; no browser BSC balance RPC, seed/key prompt or embedded admin/model credential. API must retain a restricted role separate from the ledger writer. Freeze at actual opening, never at draft creation or a client-supplied height. Agents own design, implementation, review and evidence under repository guidance; do not shift approvals/tests to the human or invent PASS evidence.
Acceptance criteria
Reload/route/account changes show the correct persisted vote, eligibility and allowed actions. Account/chain/disconnect changes invalidate stale requests and block mismatched signing; rejected/cancelled prompts recover. Late registration/zero weight/unregistered/noncommittee states avoid misleading signing prompts. Voting never requests eth_sendTransaction or Cosmos broadcast; no seeds or browser balance RPCs.
Test plan: supported paths, failure paths and concurrency
Terra/BSC register/draft/amend/review/open/vote; own-vote reload, duplicate response and immutability; eligible/ineligible/late/blacklisted roles. External account/network/disconnect events, reconnect and expired WC; A slow response after B, navigation mid-signature, cancellation, disconnect during pending poll and lost mutation response. Check Legal reevaluation for changed identity and assert correct payload actor/chain on each prompt. Spy transaction methods and verify no broadcasts.
Test plan: attack, hack and abuse vectors
Stale persisted address, malicious extension identity changes during sign, wrong-network payload, race-delivered receipt for another wallet/proposal, capability forgery and replay to bypass disabled UI. Backend authorization must reject every attempted bypass; UI capability reads do not become authorization tokens.
Verification and completion criteria
Attach deterministic account/route/signing race tests and persisted-ballot reload results; run frontend unit plus both-chain full-stack browser tests. Record real injected/WC connector staging QA separately from simulated fixtures and confirm no transaction requests or altered port behavior.
Record commit and pinned toolchain, commands/results and sanitized artifacts. Relevant Rust changes require
cargo test --workspace --libplus isolated Postgres integration (explicit guarded LEDGER_TEST_DATABASE_URL); frontend changes requirenpm testand production build plus relevant browser cases. Run secret scanning for new fixtures/config. Exercise fresh/upgrade migrations when schema/grants change; report skipped/live-only checks explicitly.