code/yieldomega
Watch
4
0
Fork
You've already forked yieldomega
 0
Code Issues 1 Pull requests 1 Projects Releases Packages Wiki Activity

[visual][arena] WarBow steal-form validation leaks 'Enter a valid victim address' to page level on idle #195

New issue
Closed
opened 2026-05-11 09:15:05 +00:00 by Brouie · 6 comments
Brouie commented 2026-05-11 09:15:05 +00:00 (Migrated from gitlab.com)

Summary

During local-stack visual QA (#164 §7 exploratory), the WarBow PvP steal-form validation message Enter a valid victim address renders at the page level even when the user has not yet attempted a steal action. The error appears to leak out of the form's status area into the broader Arena view.

P3 polish — confusing UX (user sees an error referencing an action they never tried), not a functional bug.

What is wrong

On /timecurve/arena, with WarBow PvP surface visible and the steal-victim address input empty:

  • The error string Enter a valid victim address renders at page level even before the user has typed anything or clicked any steal-related CTA
  • The error appears to be the steal-form's form-status copy escaping its scoped form-status region
  • User has no actionable context for why an error is showing

Expected

Steal-form validation errors should:

  • Stay scoped to the steal-form's status area (next to the input)
  • Only render after the user attempts a steal (clicks Attempt steal or similar)
  • Not surface at page level on a fresh Arena load with an empty steal-victim input

Relevant docs / skills / files

Recommended fix

  1. Identify the validation hook driving the Enter a valid victim address string
  2. Gate its rendering on either:
    • user-initiated attempt flag (e.g. hasAttemptedSteal), or
    • non-empty input value (don't validate empty form state)
  3. Ensure the error renders inside the steal-form's scoped status region, not at page level

Acceptance criteria

  • Fresh Arena load with empty steal-victim input shows NO Enter a valid victim address message
  • Typing an invalid address and attempting to steal surfaces the error inside the steal-form's status area
  • Clearing the input does not regress to the page-level leak

Verification checklist

  • Hard refresh on /timecurve/arena with WarBow surface visible — no error visible
  • Type valid + invalid victim addresses, attempt steal — error stays in form-status region
  • Empty input + attempt — error stays in form-status region
## Summary During local-stack visual QA ([#164](https://gitlab.com/PlasticDigits/yieldomega/-/issues/164) §7 exploratory), the WarBow PvP steal-form validation message `Enter a valid victim address` renders at the **page level** even when the user has not yet attempted a steal action. The error appears to leak out of the form's status area into the broader Arena view. **P3 polish** — confusing UX (user sees an error referencing an action they never tried), not a functional bug. ## What is wrong On `/timecurve/arena`, with WarBow PvP surface visible and the steal-victim address input empty: - The error string `Enter a valid victim address` renders at page level even before the user has typed anything or clicked any steal-related CTA - The error appears to be the steal-form's form-status copy escaping its scoped form-status region - User has no actionable context for why an error is showing ## Expected Steal-form validation errors should: - Stay scoped to the steal-form's status area (next to the input) - Only render after the user attempts a steal (clicks `Attempt steal` or similar) - Not surface at page level on a fresh Arena load with an empty steal-victim input ## Relevant docs / skills / files - Umbrella: [#164](https://gitlab.com/PlasticDigits/yieldomega/-/issues/164) §7 exploratory pass - Source: WarBow PvP steal section in [`frontend/src/pages/timeCurveArena/TimeCurveArenaView.tsx`](frontend/src/pages/timeCurveArena/TimeCurveArenaView.tsx) — look for `steal` / `victim` / `Attempt steal` and the validation error string - Invariants: [`docs/testing/invariants-and-business-logic.md`](docs/testing/invariants-and-business-logic.md) (Arena WarBow surfaces) ## Recommended fix 1. Identify the validation hook driving the `Enter a valid victim address` string 2. Gate its rendering on either: - user-initiated attempt flag (e.g. `hasAttemptedSteal`), or - non-empty input value (don't validate empty form state) 3. Ensure the error renders inside the steal-form's scoped status region, not at page level ## Acceptance criteria - [ ] Fresh Arena load with empty steal-victim input shows NO `Enter a valid victim address` message - [ ] Typing an invalid address and attempting to steal surfaces the error inside the steal-form's status area - [ ] Clearing the input does not regress to the page-level leak ## Verification checklist - [ ] Hard refresh on `/timecurve/arena` with WarBow surface visible — no error visible - [ ] Type valid + invalid victim addresses, attempt steal — error stays in form-status region - [ ] Empty input + attempt — error stays in form-status region
Brouie commented 2026-05-11 09:17:03 +00:00 (Migrated from gitlab.com)

mentioned in issue #164

mentioned in issue #164
PlasticDigits commented 2026-05-11 10:34:14 +00:00 (Migrated from gitlab.com)

mentioned in commit 6858355d6da3e580fa29aa85a678efe1633cf2a2

mentioned in commit 6858355d6da3e580fa29aa85a678efe1633cf2a2
PlasticDigits commented 2026-05-11 10:34:33 +00:00 (Migrated from gitlab.com)

Shipped on main (merge 5ad24ba)

Summary

  • Scoped validation: Invalid partial victim addresses and empty Attempt steal clicks no longer populate pvpErr (hero / post–WarBow section banners). They render only under the steal victim field in WarbowSection (data-testid="warbow-steal-victim-form-status").
  • Hint strip: Removed invalid-address validation copy from the section-wide warbowActionHint StatusMessage so a fresh Arena load does not show steal-field errors above the form.
  • Helper: frontend/src/lib/warbowStealVictimInput.ts + Vitest warbowStealVictimInput.test.ts (INV-FRONTEND-195-WARBOW-STEAL-FORM).

Verification checklist for @brouie

  • Hard refresh /timecurve/arena (wallet connected, live sale): no victim-validation error in the hero error strip or the wide muted hint above the WarBow form when the victim field is empty.
  • Type invalid hex (e.g. 0xabc): Enter a valid victim address appears only directly under the victim input (red StatusMessage), not in pvpErr banners.
  • Clear the field: that inline error disappears (no regression to page-level leak).
  • Empty field + Attempt steal in the detailed section: message Enter a victim address before attempting a steal. appears only under the input (not pvpErr).
  • Valid victim + ineligible preflight (e.g. 2× rule): existing preflight StatusMessage still behaves as before; onchain reverts still surface via pvpErr where appropriate.

Requesting verification from @brouie when convenient. Leaving the issue open as requested.

## Shipped on `main` (merge `5ad24ba`) ### Summary - **Scoped validation:** Invalid partial victim addresses and empty **Attempt steal** clicks no longer populate `pvpErr` (hero / post–WarBow section banners). They render only under the steal victim field in `WarbowSection` (`data-testid="warbow-steal-victim-form-status"`). - **Hint strip:** Removed invalid-address validation copy from the section-wide `warbowActionHint` `StatusMessage` so a fresh Arena load does not show steal-field errors above the form. - **Helper:** `frontend/src/lib/warbowStealVictimInput.ts` + Vitest `warbowStealVictimInput.test.ts` (`INV-FRONTEND-195-WARBOW-STEAL-FORM`). ### Verification checklist for @brouie - [ ] Hard refresh `/timecurve/arena` (wallet connected, live sale): **no** victim-validation error in the hero error strip or the wide muted hint above the WarBow form when the victim field is **empty**. - [ ] Type invalid hex (e.g. `0xabc`): **Enter a valid victim address** appears **only** directly under the victim input (red `StatusMessage`), not in `pvpErr` banners. - [ ] Clear the field: that inline error **disappears** (no regression to page-level leak). - [ ] Empty field + **Attempt steal** in the detailed section: message **Enter a victim address before attempting a steal.** appears **only** under the input (not `pvpErr`). - [ ] Valid victim + ineligible preflight (e.g. 2× rule): existing preflight `StatusMessage` still behaves as before; onchain reverts still surface via `pvpErr` where appropriate. Requesting verification from @brouie when convenient. Leaving the issue **open** as requested.
Brouie commented 2026-05-11 11:42:05 +00:00 (Migrated from gitlab.com)

mentioned in issue #194

mentioned in issue #194
Brouie commented 2026-05-11 11:42:22 +00:00 (Migrated from gitlab.com)

verified at HEAD 5ad24ba — full pass on all 5 checklist items.

source spot-checks:

  • new helper warbowStealVictimInputFormatError(raw) at frontend/src/lib/warbowStealVictimInput.ts returns null for empty input (so a fresh load shows no validation chrome), null for valid 40-hex address, and WARBOW_STEAL_VICTIM_INVALID_ADDRESS for non-empty invalid input — uses viem isAddress for proper checksum validation
  • two named copy constants: WARBOW_STEAL_VICTIM_INVALID_ADDRESS (Enter a valid victim address) and WARBOW_STEAL_VICTIM_EMPTY_ATTEMPT (Enter a victim address before attempting a steal.) — distinct messages for the two distinct user states
  • wiring threads stealVictimInputFormatError and arenaWarbowStealFormErr from useTimeCurveArenaModel into the WarBow section so errors render only under the steal-victim input (data-testid="warbow-steal-victim-form-status"), not in hero pvpErr banners or the wide warbowActionHint hint strip

tests:

  • targeted warbowStealVictimInput.test.ts (3/3 pass)
  • full vitest 316/316 pass — no regressions

live walk on fresh stack at HEAD (saleActive, swarm running):

  • hard refresh /timecurve/arena with empty victim field — no Enter a valid victim address in hero error strip, no leak to wide muted hint above the WarBow form
  • type invalid hex (0xabc) — error appears only directly under the victim input, not in pvpErr banners
  • clear the field — inline error disappears cleanly, no regression to page-level leak
  • empty field + Attempt steal click — Enter a victim address before attempting a steal. appears only under the input
  • valid victim address (real swarm wallet 0xDf37F8...0913, 5500 BP) + ineligible 2x rule preflight — existing preflight StatusMessage continues to behave as before (2x rule not met · ... has 5500 BP vs your 5000 BP, so the steal would revert right now), scoped to the form area not leaking to page-level banners

ready for close on your side @PlasticDigits

verified at HEAD 5ad24ba — full pass on all 5 checklist items. source spot-checks: - new helper `warbowStealVictimInputFormatError(raw)` at frontend/src/lib/warbowStealVictimInput.ts returns null for empty input (so a fresh load shows no validation chrome), null for valid 40-hex address, and `WARBOW_STEAL_VICTIM_INVALID_ADDRESS` for non-empty invalid input — uses viem `isAddress` for proper checksum validation - two named copy constants: `WARBOW_STEAL_VICTIM_INVALID_ADDRESS` (`Enter a valid victim address`) and `WARBOW_STEAL_VICTIM_EMPTY_ATTEMPT` (`Enter a victim address before attempting a steal.`) — distinct messages for the two distinct user states - wiring threads `stealVictimInputFormatError` and `arenaWarbowStealFormErr` from `useTimeCurveArenaModel` into the WarBow section so errors render only under the steal-victim input (`data-testid="warbow-steal-victim-form-status"`), not in hero `pvpErr` banners or the wide `warbowActionHint` hint strip tests: - targeted `warbowStealVictimInput.test.ts` (3/3 pass) - full vitest 316/316 pass — no regressions live walk on fresh stack at HEAD (saleActive, swarm running): - hard refresh `/timecurve/arena` with empty victim field — no `Enter a valid victim address` in hero error strip, no leak to wide muted hint above the WarBow form - type invalid hex (`0xabc`) — error appears only directly under the victim input, not in pvpErr banners - clear the field — inline error disappears cleanly, no regression to page-level leak - empty field + Attempt steal click — `Enter a victim address before attempting a steal.` appears only under the input - valid victim address (real swarm wallet `0xDf37F8...0913`, 5500 BP) + ineligible 2x rule preflight — existing preflight StatusMessage continues to behave as before (`2x rule not met · ... has 5500 BP vs your 5000 BP, so the steal would revert right now`), scoped to the form area not leaking to page-level banners ready for close on your side @PlasticDigits
PlasticDigits (Migrated from gitlab.com) closed this issue 2026-05-12 07:26:05 +00:00
PlasticDigits commented 2026-05-13 15:13:34 +00:00 (Migrated from gitlab.com)

mentioned in commit 292c608bad

mentioned in commit 292c608badfe8265a4d105299bf8e1193fb62a76
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
cac-design-issue-544
renovate/configure
No results found.
Labels
Clear labels   
agent:fix_bugfix

   
agent:fix_conflicts

   
agent:fix_security

   
agent:gap_analysis

   
agent:implement

   
agent:open_issues

   
agents

   
agent:security_audit

   
agent:verify
  
area
timecurve

  
arena

   
arena-v2

   
audit

   
block:feature_review

   
block:security

   
bug

   
contracts

   
design

   
devops

   
docs
Documentation

  
documentation

   
enhancement

   
epic
Epic / umbrella issue

  
feature

   
frontend

   
indexer

   
low priority
Low priority, investigate other issues first

  
megaeth

   
operations

   
ops
Deploy and operations

  
performance

   
QA

   
qa checklist

   
referrals

   
removal
Legacy removal

  
security

   
smart-contracts

   
tech-debt

   
testing

   
time-arena
TimeArena v2 revamp

  
timecurve

   
visual-qa
No labels
agent:fix_bugfix
agent:fix_conflicts
agent:fix_security
agent:gap_analysis
agent:implement
agent:open_issues
agents
agent:security_audit
agent:verify
area
timecurve
arena
arena-v2
audit
block:feature_review
block:security
bug
contracts
design
devops
docs
documentation
enhancement
epic
feature
frontend
indexer
low priority
megaeth
operations
ops
performance
QA
qa checklist
referrals
removal
security
smart-contracts
tech-debt
testing
time-arena
timecurve
visual-qa
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
code/yieldomega#195
No description provided.