Refresh Arena AUDIT protocol surfaces #430

2026-06-06T14:48:33Z

PlasticDigits commented

2026-06-06 14:48:33 +00:00

(Migrated from gitlab.com)

Summary of changes

Restyled /arena/protocol as the production AUDIT console for GitLab #293: compact AUDIT hero, VERIFY / TRACE / WATCH decision cards, glass state deck, compact routing cards, and responsive donate-pools console.
Updated operator copy to reflect current Arena v2 mechanics: always-live when unpaused, DOUB/Play CRED CHARM buys, 40/30/30 buy routing, 100%-to-prizes donate sponsorship, and WarBow/buy activity.
Standardized contract/vault address rows with blockie + last-six address treatment while preserving explorer links; participant activity rows continue to open wallet profiles.
Updated docs, invariants, manual QA, and focused tests for #293.

Design review notes

Primary user goals: verify authoritative state freshness, trace DOUB routing/vault addresses, watch indexed actions, and optionally sponsor prize pools with clear no-benefit disclosure.
Primary decisions/actions surfaced: state deck (~1s RPC reads), total DOUB/USD refresh, activity feed, donate amount + gated Donate action, contract/vault explorer rows, wallet profile opens from participant rows.
Stale assumptions removed: visible Protocol view, semilive, canonical fee sinks, immutable sale parameters, and legacy sale/redemption rows in AUDIT context.

Checklist

Acceptance item	Command or manual step	Status
AUDIT surfaces match new platform visual language	Chromium desktop DOM/screenshot check on `/arena/protocol`: heading `AUDIT`, 3 decision cards, 5 state cards, no desktop overflow (`bodyWidth=1270`, `viewportWidth=1280`)	PASS
AUDIT surfaces are responsive	Chromium mobile viewport 390x844: heading `AUDIT`, 3 decision cards, donate visible, no horizontal overflow (`overflowPx=-10`)	PASS
Operator copy reflects current Arena v2 mechanics	`rg "Protocol view	semilive
Donate pools, vault reads, and live buy activity remain functional	`cd frontend && npm run typecheck && npm run lint && npm test`	PASS (0 errors; 9 pre-existing warnings; 106 files / 546 tests passed)
Focused build/E2E smoke	`cd frontend && VITE_* npm run build && VITE_* npx playwright test e2e/arena.spec.ts --workers=5`	PASS (8/8 passed)
Wallet profile modal remains wired from AUDIT activity	`ArenaLiveBuysActivitySection.test.tsx` in `npm test`	PASS
Explorer links still work from AUDIT contract/vault rows	`FeeTransparency.test.tsx`; Chromium DOM check `vaultAddressRows=6`, `addressBlockies=6`, `explorerAddressLinks=6`	PASS
Docs/invariants/QA guidance updated	Review `docs/frontend/arena-views.md`, `docs/frontend/design.md`, `docs/testing/invariants-and-business-logic.md`, `docs/testing/manual-qa-checklists.md`	PASS
Rabby-loaded Chromium inspection	Installed Playwright Chromium + deps; reinstalled Rabby; tried helper launch, system Chrome launch, and CDP launch. Chrome rendered app, but unpacked Rabby did not load (`serviceWorkers=[]`, `rabbyInjected=false`).	SKIP - environment blocker

Visual/design verification checklist for third parties

Desktop: /arena/protocol reads as a dark cyberminimalist AUDIT console with crisp hierarchy and compact copy.
Mobile: decision/state/routing/donate grids collapse without horizontal overflow.
Copy: no retired TimeCurve sale-end, redemption, or legacy fee-sink framing appears in the AUDIT path.
Addresses: participant activity rows use blockie + last-six wallet labels and open profile modal; contract/vault rows use blockie + last-six labels and open explorer links.
Donate pools: no-benefit disclosure remains visible before wallet connect; wrong-network gate remains in place.

Accessibility/responsive notes

AUDIT state/routing/donate grids use semantic cards/lists and collapse at narrow widths.
Refresh and address controls retain aria labels or explorer/profile labels.
Mechanics are available via title/aria-label while visible copy stays short.

Blockers

Rabby extension did not load in this Cloud VM despite /opt/cursor/browser-extensions/rabby existing, sudo bash scripts/install-browser-extensions.sh, Playwright Chromium install, and Chrome launch retries. Evidence: CDP launch to /arena/protocol returned serviceWorkers=[], rabbyInjected=false; Playwright extension launch closed before navigation. Issue remains open for any owner-required Rabby manual sign-off.

## Summary of changes - Restyled `/arena/protocol` as the production AUDIT console for GitLab #293: compact AUDIT hero, VERIFY / TRACE / WATCH decision cards, glass state deck, compact routing cards, and responsive donate-pools console. - Updated operator copy to reflect current Arena v2 mechanics: always-live when unpaused, DOUB/Play CRED CHARM buys, 40/30/30 buy routing, 100%-to-prizes donate sponsorship, and WarBow/buy activity. - Standardized contract/vault address rows with blockie + last-six address treatment while preserving explorer links; participant activity rows continue to open wallet profiles. - Updated docs, invariants, manual QA, and focused tests for #293. ## Design review notes - Primary user goals: verify authoritative state freshness, trace DOUB routing/vault addresses, watch indexed actions, and optionally sponsor prize pools with clear no-benefit disclosure. - Primary decisions/actions surfaced: state deck (~1s RPC reads), total DOUB/USD refresh, activity feed, donate amount + gated Donate action, contract/vault explorer rows, wallet profile opens from participant rows. - Stale assumptions removed: visible `Protocol view`, `semilive`, `canonical fee sinks`, `immutable sale parameters`, and legacy sale/redemption rows in AUDIT context. ## Checklist | Acceptance item | Command or manual step | Status | |---|---|---| | AUDIT surfaces match new platform visual language | Chromium desktop DOM/screenshot check on `/arena/protocol`: heading `AUDIT`, 3 decision cards, 5 state cards, no desktop overflow (`bodyWidth=1270`, `viewportWidth=1280`) | PASS | | AUDIT surfaces are responsive | Chromium mobile viewport 390x844: heading `AUDIT`, 3 decision cards, donate visible, no horizontal overflow (`overflowPx=-10`) | PASS | | Operator copy reflects current Arena v2 mechanics | `rg "Protocol view|semilive|Canonical fee sinks|Immutable sale parameters|simple and arena views" /workspace --glob "*.{ts,tsx,md}"` | PASS | | Donate pools, vault reads, and live buy activity remain functional | `cd frontend && npm run typecheck && npm run lint && npm test` | PASS (0 errors; 9 pre-existing warnings; 106 files / 546 tests passed) | | Focused build/E2E smoke | `cd frontend && VITE_* npm run build && VITE_* npx playwright test e2e/arena.spec.ts --workers=5` | PASS (8/8 passed) | | Wallet profile modal remains wired from AUDIT activity | `ArenaLiveBuysActivitySection.test.tsx` in `npm test` | PASS | | Explorer links still work from AUDIT contract/vault rows | `FeeTransparency.test.tsx`; Chromium DOM check `vaultAddressRows=6`, `addressBlockies=6`, `explorerAddressLinks=6` | PASS | | Docs/invariants/QA guidance updated | Review `docs/frontend/arena-views.md`, `docs/frontend/design.md`, `docs/testing/invariants-and-business-logic.md`, `docs/testing/manual-qa-checklists.md` | PASS | | Rabby-loaded Chromium inspection | Installed Playwright Chromium + deps; reinstalled Rabby; tried helper launch, system Chrome launch, and CDP launch. Chrome rendered app, but unpacked Rabby did not load (`serviceWorkers=[]`, `rabbyInjected=false`). | SKIP - environment blocker | ## Visual/design verification checklist for third parties - Desktop: `/arena/protocol` reads as a dark cyberminimalist AUDIT console with crisp hierarchy and compact copy. - Mobile: decision/state/routing/donate grids collapse without horizontal overflow. - Copy: no retired TimeCurve sale-end, redemption, or legacy fee-sink framing appears in the AUDIT path. - Addresses: participant activity rows use blockie + last-six wallet labels and open profile modal; contract/vault rows use blockie + last-six labels and open explorer links. - Donate pools: no-benefit disclosure remains visible before wallet connect; wrong-network gate remains in place. ## Accessibility/responsive notes - AUDIT state/routing/donate grids use semantic cards/lists and collapse at narrow widths. - Refresh and address controls retain aria labels or explorer/profile labels. - Mechanics are available via `title`/`aria-label` while visible copy stays short. ## Blockers - Rabby extension did not load in this Cloud VM despite `/opt/cursor/browser-extensions/rabby` existing, `sudo bash scripts/install-browser-extensions.sh`, Playwright Chromium install, and Chrome launch retries. Evidence: CDP launch to `/arena/protocol` returned `serviceWorkers=[]`, `rabbyInjected=false`; Playwright extension launch closed before navigation. Issue remains open for any owner-required Rabby manual sign-off.

PlasticDigits commented

2026-06-06 14:49:26 +00:00

(Migrated from gitlab.com)

mentioned in commit b9487a5c04

mentioned in commit b9487a5c0406b159174a64f223ee3c8f5813da5d

PlasticDigits (Migrated from gitlab.com) merged commit b9487a5c04 into main

2026-06-06 14:49:26 +00:00

PlasticDigits commented

2026-06-06 14:51:26 +00:00

(Migrated from gitlab.com)

mentioned in merge request !432

ghost1 commented

2026-06-06 14:52:04 +00:00

(Migrated from gitlab.com)

Security review

Commit reviewed: 0360a73e0cb5de3c95659e821fd7efd5b45f84e7 (Fix protocol state memo dependency)

Scope: Frontend-only MR restyling /arena/protocol (AUDIT console), AddressInline adoption for contract/vault rows, donate-pools layout/copy updates, docs/tests/CSS. No indexer, contract, or dependency changes.

Method: Diff review of 16 touched files; traced attacker-controlled inputs (indexer donation rows, onchain address reads, donate amount input, explorer/profile actions) to sinks (DOM render, href, wallet writes).

Outcome: FINDINGS: 0 medium+ — Security review: no medium+ findings on this diff.

Inline threads: none (no findings to anchor).

Notes (informational, below reporting threshold)

Address rendering: MegaScannerAddressLink → AddressInline keeps viem isAddress gating and explorerAddressUrl before external links; wallet-profile paths use button handlers, not raw href.
Donate write path: Unchanged semantics — ChainMismatchWriteBarrier, parseUnits validation, balance check, ensureDoubTimeArenaAllowance, topUpPodiumPools on configured timeArena.
Indexer-fed UI: Donor/amount fields flow through AddressInline / AmountDisplay; error strings are app-controlled, not raw API bodies.
Prior review comments: none on this MR at review time.

Automated security review (Cursor Cloud Agent).

## Security review **Commit reviewed:** `0360a73e0cb5de3c95659e821fd7efd5b45f84e7` (`Fix protocol state memo dependency`) **Scope:** Frontend-only MR restyling `/arena/protocol` (AUDIT console), `AddressInline` adoption for contract/vault rows, donate-pools layout/copy updates, docs/tests/CSS. No indexer, contract, or dependency changes. **Method:** Diff review of 16 touched files; traced attacker-controlled inputs (indexer donation rows, onchain address reads, donate amount input, explorer/profile actions) to sinks (DOM render, `href`, wallet writes). **Outcome:** **FINDINGS: 0** medium+ — **Security review: no medium+ findings on this diff.** **Inline threads:** none (no findings to anchor). ### Notes (informational, below reporting threshold) - **Address rendering:** `MegaScannerAddressLink` → `AddressInline` keeps `viem` `isAddress` gating and `explorerAddressUrl` before external links; wallet-profile paths use button handlers, not raw `href`. - **Donate write path:** Unchanged semantics — `ChainMismatchWriteBarrier`, `parseUnits` validation, balance check, `ensureDoubTimeArenaAllowance`, `topUpPodiumPools` on configured `timeArena`. - **Indexer-fed UI:** Donor/amount fields flow through `AddressInline` / `AmountDisplay`; error strings are app-controlled, not raw API bodies. - **Prior review comments:** none on this MR at review time. --- *Automated security review (Cursor Cloud Agent).*

PlasticDigits commented

2026-06-08 08:45:13 +00:00

(Migrated from gitlab.com)

mentioned in commit 141a667d05

mentioned in commit 141a667d0516df4847b995a019ad376bc01d98ea

Sign in to join this conversation.

No reviewers

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

code/yieldomega!430

Rows
Columns