code/yieldomega
Watch
4
0
Fork
You've already forked yieldomega
 0
Code Issues 1 Pull requests 1 Projects Releases Packages Wiki Activity

Update Home and countdown brand surfaces for TimeArena #435

Merged
PlasticDigits merged 6 commits from cursor/issue-295-home-countdown-brand-a4a5 into main 2026-06-07 07:50:20 +00:00
Conversation 14 Commits 6 Files changed 13 +386 -81
PlasticDigits commented 2026-06-07 07:34:28 +00:00 (Migrated from gitlab.com)

Summary of changes

Updates Home and launch countdown entry surfaces for GitLab #295 so they route users toward immediate PvP TimeArena play and AUDIT verification instead of legacy sale/worldbuilding framing.

  • Home hero now presents compact gameplay actions: PLAY TIME ARENA, AUDIT, CHARM/timer/podium mechanics, and tactical character accents.
  • Home cards now prioritize Time Arena, Arena AUDIT, Referrals, and external venues with current TimeArena copy from surfaceContent.
  • Launch countdown now reads as a Time Arena frontend access gate, not a DOUB sale launch, with PLAY / CRED / PVP / AUDIT chips.
  • Added focused unit/E2E coverage, a stable launch-state E2E helper, and #295 docs/invariants/manual QA guidance.

Related issues

Related to #295. Leave issue open for maintainer review.

Design review notes

  • Primary user goals: enter TimeArena quickly, understand the first action is buying CHARM, and find AUDIT verification without reading lore.
  • Primary decisions surfaced: PLAY TIME ARENA, AUDIT, Referrals, Kumbaya, and Sir. PLAY is the action-first route; AUDIT is the verification path.
  • Time-sensitive actions: countdown gate tells users when frontend routes open; once open, users should go to /arena for gameplay or /arena/protocol for verification.
  • Feature mechanics surfaced: CHARM buys, four podium timers, DOUB podium competition, Play CRED, WarBow PvP, and AUDIT reads.
  • Stale assumptions removed: DOUB launch wording, Time Arena goes-live copy, TimeCurve, generic sale/launchpad framing, PvE/worldbuilding framing, redemption assumptions.
  • Brand/visual direction: dark tactical glass, compact chips, crisp CTA hierarchy, and recognizable bunny/coin accents retained as cyberminimalist tactical elements.

Acceptance / verification checklist

Acceptance item Command or manual step Result
Home and countdown surfaces match the new visual system Rabby Chromium visual pass via xvfb-run on /home desktop/mobile and future-timestamp countdown desktop/mobile PASS
Copy emphasizes PvP TimeArena gameplay, not worldbuilding cd frontend && npm test (surfaceContent.test.ts, LaunchCountdownPage.test.tsx) + Rabby visual copy review PASS
No stale TimeCurve/sale/PvE explanations remain surfaceContent.test.ts, LaunchCountdownPage.test.tsx, e2e/home.spec.ts, e2e/launch-countdown.spec.ts PASS
Existing characters remain recognizable in the new aesthetic Rabby Chromium visual pass: Home and countdown desktop/mobile character/coin accents visible as tactical accents PASS
E2E specs (home.spec.ts, launch-countdown.spec.ts) updated and passing cd frontend && npm run build && CI=1 npm run test:e2e -- --workers=5 e2e/home.spec.ts e2e/launch-countdown.spec.ts (default no-env build: 2 passed, 2 expected build-state skips) PASS
Countdown E2E path exercised cd frontend && VITE_LAUNCH_TIMESTAMP=4102444800 npm run build && CI=1 npm run test:e2e -- --workers=5 e2e/home.spec.ts e2e/launch-countdown.spec.ts (future build: 1 passed, 3 expected build-state skips) PASS
Frontend typecheck cd frontend && npm run typecheck PASS
Frontend lint cd frontend && npm run lint PASS (0 errors; existing warnings only in unrelated Arena/provider files)
Frontend unit tests cd frontend && npm test PASS (108 files, 553 tests)
Docs/invariants/QA guidance updated bash scripts/check-doc-anchors.sh && bash scripts/check-art-readme-consumers.sh PASS

Visual/design verification checklist for third parties

  • Desktop Home: PLAY TIME ARENA is primary; AUDIT is available beside it; cards show Time Arena, Arena AUDIT, Referrals, Kumbaya, Sir.
  • Mobile Home: hero chips/CTA/cards wrap without horizontal scroll and focus rings remain visible.
  • Countdown: headline says Time Arena opens in; clock is primary; PLAY / CRED / PVP / AUDIT chips are compact and tooltip-backed.
  • Copy scan: no TimeCurve, launchpad, sale, sale-end, redemption, PvE, or worldbuilding framing appears on entry surfaces.
  • Character treatment: bunny/coin elements are recognizable but subdued tactical accents.
  • Cross-links: frontend design, invariants, manual QA, art README, and play-skill references are updated for future agents/reviewers.

Accessibility / responsive notes

  • CTA and card links remain native anchors with visible focus rings.
  • Informational mechanics are exposed through title / aria-label text while visible copy stays compact.
  • Manual/Rabby visual checks covered desktop (1440x1000) and mobile (390x844) with no horizontal overflow on Home or countdown.
  • No wallet connection or signing is required to understand the entry actions; Rabby was loaded only for visual/profile parity with the requested verification environment.

Layers touched

  • contracts (contracts/)
  • indexer (indexer/)
  • frontend (frontend/)
  • scripts / devops (scripts/, .cursor/, CI)
  • docs only (frontend docs/testing docs also updated)
  • bots (bots/)

Licensing & compliance

  • New or changed original files remain AGPL-3.0.
  • No incompatible third-party code added without NOTICE / maintainer approval.
  • Network-facing deployed frontend source remains in-repo under AGPL-3.0.

Notes for reviewers

Invariant added: INV-FRONTEND-295-HOME-COUNTDOWN-BRAND. Manual QA added: docs/testing/manual-qa-checklists.md#manual-qa-issue-295.

## Summary of changes Updates Home and launch countdown entry surfaces for GitLab #295 so they route users toward immediate PvP TimeArena play and AUDIT verification instead of legacy sale/worldbuilding framing. - Home hero now presents compact gameplay actions: **PLAY TIME ARENA**, **AUDIT**, CHARM/timer/podium mechanics, and tactical character accents. - Home cards now prioritize Time Arena, Arena AUDIT, Referrals, and external venues with current TimeArena copy from `surfaceContent`. - Launch countdown now reads as a Time Arena frontend access gate, not a DOUB sale launch, with **PLAY / CRED / PVP / AUDIT** chips. - Added focused unit/E2E coverage, a stable launch-state E2E helper, and #295 docs/invariants/manual QA guidance. ## Related issues Related to #295. Leave issue open for maintainer review. ## Design review notes - **Primary user goals:** enter TimeArena quickly, understand the first action is buying CHARM, and find AUDIT verification without reading lore. - **Primary decisions surfaced:** PLAY TIME ARENA, AUDIT, Referrals, Kumbaya, and Sir. PLAY is the action-first route; AUDIT is the verification path. - **Time-sensitive actions:** countdown gate tells users when frontend routes open; once open, users should go to `/arena` for gameplay or `/arena/protocol` for verification. - **Feature mechanics surfaced:** CHARM buys, four podium timers, DOUB podium competition, Play CRED, WarBow PvP, and AUDIT reads. - **Stale assumptions removed:** DOUB launch wording, Time Arena goes-live copy, TimeCurve, generic sale/launchpad framing, PvE/worldbuilding framing, redemption assumptions. - **Brand/visual direction:** dark tactical glass, compact chips, crisp CTA hierarchy, and recognizable bunny/coin accents retained as cyberminimalist tactical elements. ## Acceptance / verification checklist | Acceptance item | Command or manual step | Result | |---|---|---| | Home and countdown surfaces match the new visual system | Rabby Chromium visual pass via `xvfb-run` on `/home` desktop/mobile and future-timestamp countdown desktop/mobile | PASS | | Copy emphasizes PvP TimeArena gameplay, not worldbuilding | `cd frontend && npm test` (`surfaceContent.test.ts`, `LaunchCountdownPage.test.tsx`) + Rabby visual copy review | PASS | | No stale TimeCurve/sale/PvE explanations remain | `surfaceContent.test.ts`, `LaunchCountdownPage.test.tsx`, `e2e/home.spec.ts`, `e2e/launch-countdown.spec.ts` | PASS | | Existing characters remain recognizable in the new aesthetic | Rabby Chromium visual pass: Home and countdown desktop/mobile character/coin accents visible as tactical accents | PASS | | E2E specs (`home.spec.ts`, `launch-countdown.spec.ts`) updated and passing | `cd frontend && npm run build && CI=1 npm run test:e2e -- --workers=5 e2e/home.spec.ts e2e/launch-countdown.spec.ts` (default no-env build: 2 passed, 2 expected build-state skips) | PASS | | Countdown E2E path exercised | `cd frontend && VITE_LAUNCH_TIMESTAMP=4102444800 npm run build && CI=1 npm run test:e2e -- --workers=5 e2e/home.spec.ts e2e/launch-countdown.spec.ts` (future build: 1 passed, 3 expected build-state skips) | PASS | | Frontend typecheck | `cd frontend && npm run typecheck` | PASS | | Frontend lint | `cd frontend && npm run lint` | PASS (0 errors; existing warnings only in unrelated Arena/provider files) | | Frontend unit tests | `cd frontend && npm test` | PASS (108 files, 553 tests) | | Docs/invariants/QA guidance updated | `bash scripts/check-doc-anchors.sh && bash scripts/check-art-readme-consumers.sh` | PASS | ## Visual/design verification checklist for third parties - Desktop Home: **PLAY TIME ARENA** is primary; **AUDIT** is available beside it; cards show Time Arena, Arena AUDIT, Referrals, Kumbaya, Sir. - Mobile Home: hero chips/CTA/cards wrap without horizontal scroll and focus rings remain visible. - Countdown: headline says **Time Arena opens in**; clock is primary; **PLAY / CRED / PVP / AUDIT** chips are compact and tooltip-backed. - Copy scan: no TimeCurve, launchpad, sale, sale-end, redemption, PvE, or worldbuilding framing appears on entry surfaces. - Character treatment: bunny/coin elements are recognizable but subdued tactical accents. - Cross-links: frontend design, invariants, manual QA, art README, and play-skill references are updated for future agents/reviewers. ## Accessibility / responsive notes - CTA and card links remain native anchors with visible focus rings. - Informational mechanics are exposed through `title` / `aria-label` text while visible copy stays compact. - Manual/Rabby visual checks covered desktop (`1440x1000`) and mobile (`390x844`) with no horizontal overflow on Home or countdown. - No wallet connection or signing is required to understand the entry actions; Rabby was loaded only for visual/profile parity with the requested verification environment. ## Layers touched - [ ] **contracts** (`contracts/`) - [ ] **indexer** (`indexer/`) - [x] **frontend** (`frontend/`) - [ ] **scripts / devops** (`scripts/`, `.cursor/`, CI) - [x] **docs only** (frontend docs/testing docs also updated) - [ ] **bots** (`bots/`) ## Licensing & compliance - [x] New or changed original files remain AGPL-3.0. - [x] No incompatible third-party code added without `NOTICE` / maintainer approval. - [x] Network-facing deployed frontend source remains in-repo under AGPL-3.0. ## Notes for reviewers Invariant added: `INV-FRONTEND-295-HOME-COUNTDOWN-BRAND`. Manual QA added: `docs/testing/manual-qa-checklists.md#manual-qa-issue-295`.
ghost1 commented 2026-06-07 07:35:43 +00:00 (Migrated from gitlab.com)

added 1 commit

  • 2d6b56a0 - Remove stale negative framing from entry copy

Compare with previous version

added 1 commit <ul><li>2d6b56a0 - Remove stale negative framing from entry copy</li></ul> [Compare with previous version](/PlasticDigits/yieldomega/-/merge_requests/65/diffs?diff_id=1838411665&start_sha=0380831fe49c48b3b3c840320b173b15674cb62c)
ghost1 commented 2026-06-07 07:37:13 +00:00 (Migrated from gitlab.com)

added 1 commit

  • 5e35c242 - Fix Home AUDIT Playwright locator

Compare with previous version

added 1 commit <ul><li>5e35c242 - Fix Home AUDIT Playwright locator</li></ul> [Compare with previous version](/PlasticDigits/yieldomega/-/merge_requests/65/diffs?diff_id=1838412009&start_sha=2d6b56a0ac9093cb3b932d513e1d481c9c92216b)
ghost1 commented 2026-06-07 07:37:19 +00:00 (Migrated from gitlab.com)

Security review

Commit reviewed: 2d6b56a0ac9093cb3b932d513e1d481c9c92216b
Scope: MR !435 — Home + launch countdown brand/copy refresh (#295): HomePage, LaunchCountdownPage, surfaceContent, CSS, tests, docs. No indexer, contract, auth, or dependency changes.

Outcome: FINDINGS: 0 medium+

Reviewed attack surfaces

Area Result
XSS / HTML injection No dangerouslySetInnerHTML or unsanitized dynamic HTML. New copy/tooltips are static constants in surfaceContent.ts; React escapes JSX text and attribute values.
Open redirect Internal navigation uses hardcoded Link to paths (/arena, /arena/protocol, etc.). External countdown links are the same allowlisted HTTPS targets as before (t.me, x.com, github.com) with rel="noopener noreferrer".
Launch-gate bypass LaunchGate.tsx unchanged; pre-launch builds still route * to LaunchCountdownPage only.
Authn/authz, SSRF, secrets, supply chain Not in diff; no new packages or server-side code.

Prior threads

No prior security-review notes on this MR.

Inline threads: none (no medium+ findings).

## Security review **Commit reviewed:** `2d6b56a0ac9093cb3b932d513e1d481c9c92216b` **Scope:** MR !435 — Home + launch countdown brand/copy refresh (#295): `HomePage`, `LaunchCountdownPage`, `surfaceContent`, CSS, tests, docs. No indexer, contract, auth, or dependency changes. **Outcome:** `FINDINGS: 0` medium+ ### Reviewed attack surfaces | Area | Result | |------|--------| | XSS / HTML injection | No `dangerouslySetInnerHTML` or unsanitized dynamic HTML. New copy/tooltips are static constants in `surfaceContent.ts`; React escapes JSX text and attribute values. | | Open redirect | Internal navigation uses hardcoded `Link to` paths (`/arena`, `/arena/protocol`, etc.). External countdown links are the same allowlisted HTTPS targets as before (`t.me`, `x.com`, `github.com`) with `rel="noopener noreferrer"`. | | Launch-gate bypass | `LaunchGate.tsx` unchanged; pre-launch builds still route `*` to `LaunchCountdownPage` only. | | Authn/authz, SSRF, secrets, supply chain | Not in diff; no new packages or server-side code. | ### Prior threads No prior security-review notes on this MR. **Inline threads:** none (no medium+ findings).
ghost1 commented 2026-06-07 07:38:09 +00:00 (Migrated from gitlab.com)

added 1 commit

  • 1a079656 - Scope Home entry surface Playwright assertions

Compare with previous version

added 1 commit <ul><li>1a079656 - Scope Home entry surface Playwright assertions</li></ul> [Compare with previous version](/PlasticDigits/yieldomega/-/merge_requests/65/diffs?diff_id=1838412238&start_sha=5e35c24271a29fa5658b4c8c6e46aca91d1c84a4)
ghost1 commented 2026-06-07 07:40:16 +00:00 (Migrated from gitlab.com)

Security review

Commit reviewed: 1a0796564d32f3275b7205b54716f8da844bef44 (webhook trigger: 5e35c24271a29fa5658b4c8c6e46aca91d1c84a4; MR HEAD includes follow-up e2e commits)
Scope: MR !435 — Home + launch countdown brand/copy refresh (#295): HomePage, LaunchCountdownPage, surfaceContent, CSS, e2e/unit tests, docs. No indexer, contract, auth, API, or dependency changes.

Outcome: FINDINGS: 0 medium+

Reviewed attack surfaces

Area Result
XSS / HTML injection No dangerouslySetInnerHTML or unsanitized dynamic HTML. New copy, tooltips, and title attributes are static constants in surfaceContent.ts; React escapes JSX text and attribute values.
Open redirect Internal navigation uses hardcoded Link to paths (/arena, /arena/protocol, etc.). External countdown links remain allowlisted HTTPS targets (t.me, x.com, github.com) with rel="noopener noreferrer".
Launch-gate bypass LaunchGate.tsx unchanged; pre-launch builds still route * to LaunchCountdownPage only.
Authn/authz, SSRF, secrets, supply chain Not in diff; no new packages or server-side code.

Delta since prior review (2d6b56a0)

Commits 5e35c242 (Playwright AUDIT locator) and 1a079656 (scope Home e2e assertions) touch frontend/e2e/home.spec.ts only — test harness changes with no runtime security impact.

Prior threads

Prior top-level review on 2d6b56a0 (no medium+ findings) still applies; no new attack surfaces introduced in subsequent commits.

Inline threads: none (no medium+ findings).

## Security review **Commit reviewed:** `1a0796564d32f3275b7205b54716f8da844bef44` (webhook trigger: `5e35c24271a29fa5658b4c8c6e46aca91d1c84a4`; MR HEAD includes follow-up e2e commits) **Scope:** MR !435 — Home + launch countdown brand/copy refresh (#295): `HomePage`, `LaunchCountdownPage`, `surfaceContent`, CSS, e2e/unit tests, docs. No indexer, contract, auth, API, or dependency changes. **Outcome:** `FINDINGS: 0` medium+ ### Reviewed attack surfaces | Area | Result | |------|--------| | XSS / HTML injection | No `dangerouslySetInnerHTML` or unsanitized dynamic HTML. New copy, tooltips, and `title` attributes are static constants in `surfaceContent.ts`; React escapes JSX text and attribute values. | | Open redirect | Internal navigation uses hardcoded `Link to` paths (`/arena`, `/arena/protocol`, etc.). External countdown links remain allowlisted HTTPS targets (`t.me`, `x.com`, `github.com`) with `rel="noopener noreferrer"`. | | Launch-gate bypass | `LaunchGate.tsx` unchanged; pre-launch builds still route `*` to `LaunchCountdownPage` only. | | Authn/authz, SSRF, secrets, supply chain | Not in diff; no new packages or server-side code. | ### Delta since prior review (`2d6b56a0`) Commits `5e35c242` (Playwright AUDIT locator) and `1a079656` (scope Home e2e assertions) touch `frontend/e2e/home.spec.ts` only — test harness changes with no runtime security impact. ### Prior threads Prior top-level review on `2d6b56a0` (no medium+ findings) still applies; no new attack surfaces introduced in subsequent commits. **Inline threads:** none (no medium+ findings).
ghost1 commented 2026-06-07 07:41:27 +00:00 (Migrated from gitlab.com)

Security review

Commit reviewed: 1a0796564d32f3275b7205b54716f8da844bef44
Scope: MR !435 — Home + launch countdown brand/copy refresh (#295): HomePage, LaunchCountdownPage, surfaceContent, index.css, e2e/unit tests, docs. No indexer, contract, auth, API, or dependency changes.

Outcome: FINDINGS: 0 medium+

Reviewed attack surfaces

Area Result
XSS / HTML injection No dangerouslySetInnerHTML or unsanitized dynamic HTML. Copy, tooltips, and title attributes are static constants in surfaceContent.ts; React escapes JSX text and attribute values. Countdown days/clock remain numeric formatting from formatLaunchCountdown (unchanged).
Open redirect Internal navigation uses hardcoded Link to paths (/arena, /arena/protocol, etc.). External countdown links are allowlisted HTTPS targets (t.me, x.com, github.com) with rel="noopener noreferrer".
Launch-gate bypass LaunchGate.tsx unchanged; pre-launch builds still route * to LaunchCountdownPage only — /arena/protocol home card is unreachable until the gate opens.
Authn/authz, SSRF, secrets, supply chain Not in diff; no new packages or server-side code.

Prior threads

Prior top-level reviews on 2d6b56a0 and 1a079656 (no medium+ findings) still apply; this pass re-verified HEAD at the webhook commit with no new attack surfaces.

Inline threads: none (no medium+ findings).

## Security review **Commit reviewed:** `1a0796564d32f3275b7205b54716f8da844bef44` **Scope:** MR !435 — Home + launch countdown brand/copy refresh (#295): `HomePage`, `LaunchCountdownPage`, `surfaceContent`, `index.css`, e2e/unit tests, docs. No indexer, contract, auth, API, or dependency changes. **Outcome:** `FINDINGS: 0` medium+ ### Reviewed attack surfaces | Area | Result | |------|--------| | XSS / HTML injection | No `dangerouslySetInnerHTML` or unsanitized dynamic HTML. Copy, tooltips, and `title` attributes are static constants in `surfaceContent.ts`; React escapes JSX text and attribute values. Countdown `days`/`clock` remain numeric formatting from `formatLaunchCountdown` (unchanged). | | Open redirect | Internal navigation uses hardcoded `Link to` paths (`/arena`, `/arena/protocol`, etc.). External countdown links are allowlisted HTTPS targets (`t.me`, `x.com`, `github.com`) with `rel="noopener noreferrer"`. | | Launch-gate bypass | `LaunchGate.tsx` unchanged; pre-launch builds still route `*` to `LaunchCountdownPage` only — `/arena/protocol` home card is unreachable until the gate opens. | | Authn/authz, SSRF, secrets, supply chain | Not in diff; no new packages or server-side code. | ### Prior threads Prior top-level reviews on `2d6b56a0` and `1a079656` (no medium+ findings) still apply; this pass re-verified HEAD at the webhook commit with no new attack surfaces. **Inline threads:** none (no medium+ findings).
ghost1 commented 2026-06-07 07:42:44 +00:00 (Migrated from gitlab.com)

added 1 commit

  • 63ecdff0 - Stabilize launch state detection for countdown e2e

Compare with previous version

added 1 commit <ul><li>63ecdff0 - Stabilize launch state detection for countdown e2e</li></ul> [Compare with previous version](/PlasticDigits/yieldomega/-/merge_requests/65/diffs?diff_id=1838413232&start_sha=1a0796564d32f3275b7205b54716f8da844bef44)
ghost1 commented 2026-06-07 07:43:33 +00:00 (Migrated from gitlab.com)

added 1 commit

  • d9241de2 - Scope countdown handoff Playwright assertions

Compare with previous version

added 1 commit <ul><li>d9241de2 - Scope countdown handoff Playwright assertions</li></ul> [Compare with previous version](/PlasticDigits/yieldomega/-/merge_requests/65/diffs?diff_id=1838413438&start_sha=63ecdff05c4c7c97cb1f4c9f7bbd222beb928f52)
PlasticDigits commented 2026-06-07 07:45:52 +00:00 (Migrated from gitlab.com)

changed the description

changed the description
ghost1 commented 2026-06-07 07:46:01 +00:00 (Migrated from gitlab.com)

Security review

Commit reviewed: d9241de263400c61cd6386b6330c5f51f9ad9730 (MR HEAD)
Webhook trigger commit: 63ecdff05c4c7c97cb1f4c9f7bbd222beb928f52
Scope: MR !435 — Home + launch countdown brand/copy refresh (#295): HomePage, LaunchCountdownPage, surfaceContent, index.css, unit/e2e tests, docs. Diff vs main is 13 files (frontend entry surfaces + QA only). No indexer, contract, auth, API, or dependency changes.

Outcome: FINDINGS: 0 medium+

Reviewed attack surfaces

Area Result
XSS / HTML injection No dangerouslySetInnerHTML or unsanitized dynamic HTML. Copy, tooltips, and title attributes are static constants in surfaceContent.ts; React escapes JSX text and attribute values. Countdown days/clock remain numeric formatting from formatLaunchCountdown (unchanged).
Open redirect Internal navigation uses hardcoded Link to paths (/arena, /arena/protocol, etc.). External countdown links are allowlisted HTTPS targets (t.me, x.com, github.com) with rel="noopener noreferrer".
Launch-gate bypass LaunchGate.tsx unchanged; pre-launch builds still route * to LaunchCountdownPage only — /arena/protocol home card is unreachable until the gate opens.
Authn/authz, SSRF, secrets, supply chain Not in diff; no new packages or server-side code.

Delta since prior review (1a079656)

Commit Files Security impact
63ecdff0 frontend/e2e/launchState.ts E2E harness only — waitUntil: domcontentloaded + DOM readiness probe; no production/runtime change.
d9241de2 frontend/e2e/launch-countdown.spec.ts E2E locator scoping (getByLabel("Countdown handoff mechanics")); no production/runtime change.

Prior threads

Prior top-level reviews on 2d6b56a0 and 1a079656 (no medium+ findings) still apply. This pass re-verified MR HEAD and the two follow-up e2e commits; no new attack surfaces introduced.

Inline threads: none (no medium+ findings).

## Security review **Commit reviewed:** `d9241de263400c61cd6386b6330c5f51f9ad9730` (MR HEAD) **Webhook trigger commit:** `63ecdff05c4c7c97cb1f4c9f7bbd222beb928f52` **Scope:** MR !435 — Home + launch countdown brand/copy refresh (#295): `HomePage`, `LaunchCountdownPage`, `surfaceContent`, `index.css`, unit/e2e tests, docs. Diff vs `main` is 13 files (frontend entry surfaces + QA only). No indexer, contract, auth, API, or dependency changes. **Outcome:** `FINDINGS: 0` medium+ ### Reviewed attack surfaces | Area | Result | |------|--------| | XSS / HTML injection | No `dangerouslySetInnerHTML` or unsanitized dynamic HTML. Copy, tooltips, and `title` attributes are static constants in `surfaceContent.ts`; React escapes JSX text and attribute values. Countdown `days`/`clock` remain numeric formatting from `formatLaunchCountdown` (unchanged). | | Open redirect | Internal navigation uses hardcoded `Link to` paths (`/arena`, `/arena/protocol`, etc.). External countdown links are allowlisted HTTPS targets (`t.me`, `x.com`, `github.com`) with `rel="noopener noreferrer"`. | | Launch-gate bypass | `LaunchGate.tsx` unchanged; pre-launch builds still route `*` to `LaunchCountdownPage` only — `/arena/protocol` home card is unreachable until the gate opens. | | Authn/authz, SSRF, secrets, supply chain | Not in diff; no new packages or server-side code. | ### Delta since prior review (`1a079656`) | Commit | Files | Security impact | |--------|-------|-----------------| | `63ecdff0` | `frontend/e2e/launchState.ts` | E2E harness only — `waitUntil: domcontentloaded` + DOM readiness probe; no production/runtime change. | | `d9241de2` | `frontend/e2e/launch-countdown.spec.ts` | E2E locator scoping (`getByLabel("Countdown handoff mechanics")`); no production/runtime change. | ### Prior threads Prior top-level reviews on `2d6b56a0` and `1a079656` (no medium+ findings) still apply. This pass re-verified MR HEAD and the two follow-up e2e commits; no new attack surfaces introduced. **Inline threads:** none (no medium+ findings).
PlasticDigits commented 2026-06-07 07:46:10 +00:00 (Migrated from gitlab.com)

mentioned in issue #295

mentioned in issue #295
ghost1 commented 2026-06-07 07:46:32 +00:00 (Migrated from gitlab.com)

Security review

Commit reviewed: d9241de263400c61cd6386b6330c5f51f9ad9730 (MR HEAD)
Scope: MR !435 — Home + launch countdown brand/copy refresh (#295): HomePage, LaunchCountdownPage, surfaceContent, index.css, unit/e2e tests, docs (13 files vs main). No indexer, contract, auth, API, or dependency changes.

Outcome: FINDINGS: 0 medium+

Security review: no medium+ findings on this diff.

Reviewed attack surfaces

Area Result
XSS / HTML injection No dangerouslySetInnerHTML or unsanitized dynamic HTML. New copy, tooltips, and labels are static constants in surfaceContent.ts; React text/attribute escaping applies.
Open redirect Internal navigation uses hardcoded to paths (/arena, /arena/protocol, etc.) from HOME_SURFACE_CARDS.
External link safety Countdown community links remain hardcoded https:// URLs with target="_blank" and rel="noopener noreferrer".
Authn / authz No changes to wallet gates, sessions, or route guards.
Injection (SQL/shell/SSRF) No server-side or network code touched.
Secrets / logging No credentials, keys, or sensitive env exposure in the diff.
Supply chain No new or updated dependencies.
User-controlled input secondsRemaining is a numeric build-time countdown prop (existing LaunchGate path); not rendered as raw HTML in new code.

Inline threads

None — no medium+ findings to anchor on specific diff lines.

Automated security review (Cursor Cloud Agent).

## Security review **Commit reviewed:** `d9241de263400c61cd6386b6330c5f51f9ad9730` (MR HEAD) **Scope:** MR !435 — Home + launch countdown brand/copy refresh ([#295](https://gitlab.com/PlasticDigits/yieldomega/-/issues/295)): `HomePage`, `LaunchCountdownPage`, `surfaceContent`, `index.css`, unit/e2e tests, docs (13 files vs `main`). No indexer, contract, auth, API, or dependency changes. **Outcome:** `FINDINGS: 0` medium+ Security review: no medium+ findings on this diff. ### Reviewed attack surfaces | Area | Result | |------|--------| | XSS / HTML injection | No `dangerouslySetInnerHTML` or unsanitized dynamic HTML. New copy, tooltips, and labels are static constants in `surfaceContent.ts`; React text/attribute escaping applies. | | Open redirect | Internal navigation uses hardcoded `to` paths (`/arena`, `/arena/protocol`, etc.) from `HOME_SURFACE_CARDS`. | | External link safety | Countdown community links remain hardcoded `https://` URLs with `target="_blank"` and `rel="noopener noreferrer"`. | | Authn / authz | No changes to wallet gates, sessions, or route guards. | | Injection (SQL/shell/SSRF) | No server-side or network code touched. | | Secrets / logging | No credentials, keys, or sensitive env exposure in the diff. | | Supply chain | No new or updated dependencies. | | User-controlled input | `secondsRemaining` is a numeric build-time countdown prop (existing `LaunchGate` path); not rendered as raw HTML in new code. | ### Inline threads None — no medium+ findings to anchor on specific diff lines. --- *Automated security review (Cursor Cloud Agent).*
PlasticDigits commented 2026-06-07 07:50:21 +00:00 (Migrated from gitlab.com)

mentioned in commit d202bb1199

mentioned in commit d202bb11992444cd21ccf97453d185e9c742c7a6
PlasticDigits (Migrated from gitlab.com) merged commit d202bb1199 into main 2026-06-07 07:50:21 +00:00
PlasticDigits commented 2026-06-08 08:45:13 +00:00 (Migrated from gitlab.com)

mentioned in commit fc398e8e18

mentioned in commit fc398e8e18dee0bab760acd0e2129cebd235116f
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
agent:fix_bugfix

   
agent:fix_conflicts

   
agent:fix_security

   
agent:gap_analysis

   
agent:implement

   
agent:open_issues

   
agents

   
agent:security_audit

   
agent:verify
  
area
timecurve

  
arena

   
arena-v2

   
audit

   
block:feature_review

   
block:security

   
bug

   
contracts

   
design

   
devops

   
docs
Documentation

  
documentation

   
enhancement

   
epic
Epic / umbrella issue

  
feature

   
frontend

   
indexer

   
low priority
Low priority, investigate other issues first

  
megaeth

   
operations

   
ops
Deploy and operations

  
performance

   
QA

   
qa checklist

   
referrals

   
removal
Legacy removal

  
security

   
smart-contracts

   
tech-debt

   
testing

   
time-arena
TimeArena v2 revamp

  
timecurve

   
visual-qa
No labels
agent:fix_bugfix
agent:fix_conflicts
agent:fix_security
agent:gap_analysis
agent:implement
agent:open_issues
agents
agent:security_audit
agent:verify
area
timecurve
arena
arena-v2
audit
block:feature_review
block:security
bug
contracts
design
devops
docs
documentation
enhancement
epic
feature
frontend
indexer
low priority
megaeth
operations
ops
performance
QA
qa checklist
referrals
removal
security
smart-contracts
tech-debt
testing
time-arena
timecurve
visual-qa
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
code/yieldomega!435
No description provided.