chore(frontend): triage dependencies and reduce measured wallet bundle cost safely #50
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Scope and source
Priority: P1. Gap coverage: GAP-023, GAP-047. Derived from GAP_1791945837.md, reviewed code commit
f8dbe93df953a78b17cb3304b717dcf84c4cd517. Currente476a68da09645c2308cbf47b90211fcaffcb7afadds only the report, so implementation findings remain applicable. Report evidence is local reproduction/source inspection unless explicitly proposed; no production exploit or current live-readiness claim.Coverage and sequencing: gap backlog tracker. Workstream 14. Dependencies: 08, 11, 13.
Current codebase
Audit snapshot reported 70 affected npm entries (11 high), not 70 proven exploits; several fixes require majors and Rust advisories were not audited. Renovate is disabled. Build processed 8,085 modules and ~1,013 kB entry; Tiptap appears unused, legacy WC overlaps modern EVM dependencies. These build sizes are not measured page-load/Core Web Vitals.
Why this implementation is needed
Runtime/build advisory risk needs ongoing evidence-based triage, and eager wallet loading increases mobile participation cost. Connector stability and pairing behavior must survive any upgrade or split.
Relevant files
frontend/package.jsonfrontend/package-lock.jsonfrontend/patches/@goblinhunt+cosmes+0.0.71-ghunt.22.patchfrontend/src/main.tsxfrontend/src/lib/wagmi.tsfrontend/src/services/terraclassic/walletConnectPairingHook.tsfrontend/vite.config.tsCargo.tomlCargo.lockrenovate.json.gitlab-ci.yml.woodpecker.yamlRecommended solution
Re-run npm/Rust advisory inventories and map installed version/path to runtime/build reachability and fixes; prioritize genuinely reachable severe findings. Remove confirmed unused packages before considering compatible targeted updates; track time-bounded reviewed exceptions and automate scans/controlled updates. Measure import graph, mobile load and user interaction before budgets. Lazy-load route/modal/connector/editor code where safe, preserving pairing hook before createRoot and pinned patch application. Review any necessary wallet-stack upgrade against DEX/Bridge ports; no greenfield replacement or force audit fix.
Constraints and guardrails
Preserve standalone offchain advisory voting, no new smart contracts or archive-node dependency, BSC as a core electorate, raw 18-decimal integer balances and separate Terra/BSC address identities. Keep Legal fail-closed transactional UI and the proven DEX Terra/Bridge EVM connectors; no browser BSC balance RPC, seed/key prompt or embedded admin/model credential. API must retain a restricted role separate from the ledger writer. Freeze at actual opening, never at draft creation or a client-supplied height. Agents own design, implementation, review and evidence under repository guidance; do not shift approvals/tests to the human or invent PASS evidence.
Acceptance criteria
Each advisory has version/path/reachability/fix or bounded exception and owner. Lockfiles stay reproducible and unused dependency removal is evidenced. Pairing patch still applies after npm ci; supported Terra/EVM injected/WC signing survives. Measured bundle/load budget improves or has documented reason, and required wallet code loads under production CSP.
Test plan: supported paths, failure paths and concurrency
Clean install/build under pinned Node and Rust, advisory scans with reachable/nonreachable examples, expired exception gate and lockfile integrity. Cold/warm route load, slow mobile network, connect/cancel/reconnect/QR/deeplink and offchain signing for both chains. Assert early pairing hook and patched marker, Legal navigation, lazy chunk failures/retry and CSP request coverage. Compare before/after compressed chunks and runtime interaction metrics.
Test plan: attack, hack and abuse vectors
Advisory-specific malicious input only for reachable code in isolated fixtures; supply-chain install/script/cache tampering and dependency downgrade; WC relay/URI unsafe handling, delayed-hook race and poisoned lazy chunks. Do not use audit count alone as exploit evidence or remove required legacy connector behavior without proof.
Verification and completion criteria
Attach dated advisory triage matrix, reproducible installs, before/after measurements and connector/CSP regression results. Severe reachable findings are fixed or covered by explicit expiring mitigation; live real-wallet QA remains separate from simulated tests.
Record commit and pinned toolchain, commands/results and sanitized artifacts. Relevant Rust changes require
cargo test --workspace --libplus isolated Postgres integration (explicit guarded LEDGER_TEST_DATABASE_URL); frontend changes requirenpm testand production build plus relevant browser cases. Run secret scanning for new fixtures/config. Exercise fresh/upgrade migrations when schema/grants change; report skipped/live-only checks explicitly.