fix(scripts): verify #281 re-deploy check

PlasticDigits commented

2026-06-03 13:35:15 +00:00

(Migrated from gitlab.com)

Summary

QA verification of #281 found the implementation on main (MR !405) correct, but scripts/verify-evm-dev-wallet-seed-anvil.sh falsely failed on the re-deploy step:

yieldomega_anvil_deploy_dev overwrites DOUB in the caller scope — after the second deploy, DOUB already equals the new proxy, so DOUB2 != DOUB compared equal.
Deploy log address extraction used head -1 — simulation console.log lines precede on-chain broadcast addresses; start-local-anvil-stack.sh already uses tail -1.

This MR saves DOUB_FIRST before re-deploy and parses deploy log labels with tail -1 in _yieldomega_extract_addr_from_log.

Verification checklist (QA — issue #281)

Acceptance item	Command / output	Result
Dev-wallet seed smoke	`bash scripts/verify-evm-dev-wallet-seed-anvil.sh`	PASS
Anvil E2E consecutive run 1	`bash scripts/e2e-anvil.sh`	PASS — 6/6 specs
Anvil E2E consecutive run 2	`bash scripts/e2e-anvil.sh`	PASS — 6/6 specs
E2E seed disabled	`YIELDOMEGA_SEED_EVM_DEV_WALLETS=0 bash scripts/e2e-anvil.sh`	PASS — 6/6 specs
Cloud `KEY_EVM_1..3` non-default	`ANVIL_PORT=8547` + Anvil #1–#3 keys + verify script	PASS
Mismatched minter diagnostic	Verify script mismatch step	PASS — `MINTER_ROLE missing`
Docs / invariants on `main`	`INV-DEPLOY-281-*`, e2e-anvil §281, guardrails	PASS (unchanged in this MR)

Implementation for #281 landed in !405; this MR only fixes the QA smoke script.

Follow-ups

Consider local for TA/DOUB/… inside yieldomega_anvil_deploy_dev to avoid future caller-scope leaks.

## Summary QA verification of [#281](https://gitlab.com/PlasticDigits/yieldomega/-/issues/281) found the implementation on `main` (MR !405) correct, but `scripts/verify-evm-dev-wallet-seed-anvil.sh` falsely failed on the re-deploy step: 1. **`yieldomega_anvil_deploy_dev` overwrites `DOUB` in the caller scope** — after the second deploy, `DOUB` already equals the new proxy, so `DOUB2 != DOUB` compared equal. 2. **Deploy log address extraction used `head -1`** — simulation `console.log` lines precede on-chain broadcast addresses; `start-local-anvil-stack.sh` already uses `tail -1`. This MR saves `DOUB_FIRST` before re-deploy and parses deploy log labels with `tail -1` in `_yieldomega_extract_addr_from_log`. ## Verification checklist (QA — issue #281) | Acceptance item | Command / output | Result | |-----------------|------------------|--------| | Dev-wallet seed smoke | `bash scripts/verify-evm-dev-wallet-seed-anvil.sh` | **PASS** | | Anvil E2E consecutive run 1 | `bash scripts/e2e-anvil.sh` | **PASS** — 6/6 specs | | Anvil E2E consecutive run 2 | `bash scripts/e2e-anvil.sh` | **PASS** — 6/6 specs | | E2E seed disabled | `YIELDOMEGA_SEED_EVM_DEV_WALLETS=0 bash scripts/e2e-anvil.sh` | **PASS** — 6/6 specs | | Cloud `KEY_EVM_1..3` non-default | `ANVIL_PORT=8547` + Anvil #1–#3 keys + verify script | **PASS** | | Mismatched minter diagnostic | Verify script mismatch step | **PASS** — `MINTER_ROLE missing` | | Docs / invariants on `main` | `INV-DEPLOY-281-*`, e2e-anvil §281, guardrails | **PASS** (unchanged in this MR) | Implementation for #281 landed in !405; this MR only fixes the QA smoke script. ## Follow-ups - Consider `local` for `TA`/`DOUB`/… inside `yieldomega_anvil_deploy_dev` to avoid future caller-scope leaks.

PlasticDigits commented

2026-06-03 13:35:23 +00:00

(Migrated from gitlab.com)

changed the description

PlasticDigits commented

2026-06-03 13:35:28 +00:00

(Migrated from gitlab.com)

marked this merge request as draft

marked this merge request as **draft**

ghost1 commented

2026-06-03 13:38:36 +00:00

(Migrated from gitlab.com)

Security review

Commit reviewed: 356c93ed2098d979ae8f9a65f4522c85447a2a60
Scope: Local Anvil dev/QA scripts only — scripts/lib/anvil_deploy_dev.sh (deploy-log address extraction: head -1 → tail -1) and scripts/verify-evm-dev-wallet-seed-anvil.sh (save DOUB_FIRST before second deploy to avoid caller-scope overwrite in re-deploy assertion).

Outcome: FINDINGS: 0 medium+

Analysis summary

Reviewed the diff and traced data flow for the changed paths:

_yieldomega_extract_addr_from_log — Parses locally generated Forge DeployDev broadcast logs (tee into DEPLOY_LOG). The label argument is always a hardcoded contract name from callers (Doubloon, TimeArena, etc.); it is not attacker-controlled. Switching to tail -1 selects the on-chain broadcast address over earlier simulation console.log lines — a correctness fix for local tooling, not a new trust boundary. Downstream seeding (seed-evm-dev-wallets-anvil.sh) already enforces loopback RPC and dev chain IDs (31337 / 6342 / 6343).
verify-evm-dev-wallet-seed-anvil.sh — Test-only smoke script fix: preserves pre-redeploy token addresses before yieldomega_anvil_deploy_dev mutates caller-scope DOUB. No production/runtime surface; no user input.

No injection, auth bypass, secret exposure, SSRF, or path-traversal paths were identified in the added/modified lines. Changes stay within the existing local-only Anvil dev workflow documented in GitLab #281.

Inline threads: none (no medium+ findings to anchor on the diff).

## Security review **Commit reviewed:** `356c93ed2098d979ae8f9a65f4522c85447a2a60` **Scope:** Local Anvil dev/QA scripts only — `scripts/lib/anvil_deploy_dev.sh` (deploy-log address extraction: `head -1` → `tail -1`) and `scripts/verify-evm-dev-wallet-seed-anvil.sh` (save `DOUB_FIRST` before second deploy to avoid caller-scope overwrite in re-deploy assertion). **Outcome:** `FINDINGS: 0` medium+ ### Analysis summary Reviewed the diff and traced data flow for the changed paths: 1. **`_yieldomega_extract_addr_from_log`** — Parses locally generated Forge `DeployDev` broadcast logs (`tee` into `DEPLOY_LOG`). The `label` argument is always a hardcoded contract name from callers (`Doubloon`, `TimeArena`, etc.); it is not attacker-controlled. Switching to `tail -1` selects the on-chain broadcast address over earlier simulation `console.log` lines — a correctness fix for local tooling, not a new trust boundary. Downstream seeding (`seed-evm-dev-wallets-anvil.sh`) already enforces loopback RPC and dev chain IDs (`31337` / `6342` / `6343`). 2. **`verify-evm-dev-wallet-seed-anvil.sh`** — Test-only smoke script fix: preserves pre-redeploy token addresses before `yieldomega_anvil_deploy_dev` mutates caller-scope `DOUB`. No production/runtime surface; no user input. No injection, auth bypass, secret exposure, SSRF, or path-traversal paths were identified in the added/modified lines. Changes stay within the existing local-only Anvil dev workflow documented in GitLab #281. **Inline threads:** none (no medium+ findings to anchor on the diff).

PlasticDigits commented

2026-06-03 13:42:50 +00:00

(Migrated from gitlab.com)