code/yieldomega
Watch
4
0
Fork
You've already forked yieldomega
 0
Code Issues 1 Pull requests 1 Projects Releases Packages Wiki Activity

Arena prize routing: 100% podiums with 70/20/10 epoch tranches (#300) #440

Merged
PlasticDigits merged 1 commit from cursor/arena-prize-routing-300-957c into main 2026-06-07 10:03:38 +00:00
Conversation 3 Commits 1 Files changed 27 +401 -165
PlasticDigits commented 2026-06-07 09:55:57 +00:00 (Migrated from gitlab.com)

Summary

Implements GitLab #300: 100% of DOUB buy proceeds route to podium prize vaults (zero admin take on buys). Each of the four categories receives 25% of every buy, split 70% / 20% / 10% across podiumEpoch[cat], +1, and +2 pools via new futurePools and PodiumEpochFunded events. topUpPodiumPools (#261) is unchanged.

Onchain: ArenaBuyRouting.splitBuyAmount, PodiumVaults.rollEpochTranches, TimeArena._routeDoubPrizeSplit
Indexer: podium_epoch kind + target_epoch column, schema 2.7.0
Frontend/docs: Fee transparency + AUDIT copy; INV-ARENA-PRIZE-ROUTING-300-* invariants

Related issues

Related to #300 · Parent epic #238 · Supersedes buy routing in #249

Layers touched

  • contracts (contracts/)
  • indexer (indexer/)
  • frontend (frontend/)
  • scripts / devops (scripts/, .cursor/, CI)
  • docs only (no runtime behavior change)
  • bots (bots/)

Verification

Acceptance item Command / step Result
100% podiums, 0% admin on buy forge test --match-test test_buy_routes_doub_split PASS
25% per category + 70/20/10 forge test --match-contract ArenaPrizeRouting PASS
Worked example epochs 3/4/2/5 forge test --match-test test_buy_routes_epoch_tranches_worked_example PASS
Roll + WarBow finalize `forge test --match-test "test_roll_promotes test_finalize_warbow"`
Fuzz no dust forge test --match-test testFuzz_splitBuy_no_dust PASS
Indexer vault-funding API bash scripts/verify-vault-funding-anvil.sh PASS
Buy router Anvil bash scripts/verify-time-arena-buy-router-anvil.sh PASS
Podium live predictions bash scripts/verify-podium-live-anvil.sh PASS
Frontend fee panel cd frontend && npm test -- FeeTransparency PASS
topUp unchanged forge test --match-test test_topUpPodiumPools PASS
Docs + invariants bash scripts/check-doc-anchors.sh PASS
Full contracts cd contracts && forge test --no-match-contract DoubAirdropMegaethFork PASS (133 tests; 4 fork tests SKIP — missing doub.csv)
Indexer cd indexer && cargo clippy --all-targets -- -D warnings && cargo test PASS
Frontend cd frontend && npm run typecheck && npm run lint && npm test PASS

Blockers: none

Verification checklist (3rd parties)

  1. cd contracts && forge test --match-contract "ArenaPrizeRouting|TimeArenaTest::test_buy_routes|test_topUp|test_finalize_warbow|test_roll_promotes"
  2. bash scripts/verify-vault-funding-anvil.sh — expect 12 podium_epoch rows per DOUB buy, 0 admin rows
  3. cd frontend && npm test -- FeeTransparency — expect 100% / 70/20/10 copy
  4. bash scripts/check-doc-anchors.sh
  5. Read docs/testing/invariants-and-business-logic.md#arena-prize-routing-gitlab-300

Notes for reviewers

  • Deploy: Arena v2 redeploy required; no migration of old vault balances (#259).
  • Admin revenue: Ops must not depend on buy-sourced AdminSellVault inflows post-#300.
  • Remainder policy: amount % 4 wei → Time Booster (cat 1); within-category remainder → +2 tranche.
  • Invariants: INV-ARENA-PRIZE-ROUTING-300-* · play skill skills/play-time-arena-doub/SKILL.md

Author checklist

  • Diff scoped to #300 prize routing
  • Arena v2 guardrails respected
  • Dev keys Anvil-only
## Summary Implements GitLab #300: **100% of DOUB buy proceeds** route to podium prize vaults (zero admin take on buys). Each of the four categories receives **25%** of every buy, split **70% / 20% / 10%** across `podiumEpoch[cat]`, `+1`, and `+2` pools via new `futurePools` and `PodiumEpochFunded` events. `topUpPodiumPools` (#261) is unchanged. **Onchain:** `ArenaBuyRouting.splitBuyAmount`, `PodiumVaults.rollEpochTranches`, `TimeArena._routeDoubPrizeSplit` **Indexer:** `podium_epoch` kind + `target_epoch` column, schema **2.7.0** **Frontend/docs:** Fee transparency + AUDIT copy; `INV-ARENA-PRIZE-ROUTING-300-*` invariants ## Related issues Related to #300 · Parent epic #238 · Supersedes buy routing in #249 ## Layers touched - [x] **contracts** (`contracts/`) - [x] **indexer** (`indexer/`) - [x] **frontend** (`frontend/`) - [x] **scripts / devops** (`scripts/`, `.cursor/`, CI) - [x] **docs only** (no runtime behavior change) - [ ] **bots** (`bots/`) ## Verification | Acceptance item | Command / step | Result | |-----------------|----------------|--------| | 100% podiums, 0% admin on buy | `forge test --match-test test_buy_routes_doub_split` | PASS | | 25% per category + 70/20/10 | `forge test --match-contract ArenaPrizeRouting` | PASS | | Worked example epochs 3/4/2/5 | `forge test --match-test test_buy_routes_epoch_tranches_worked_example` | PASS | | Roll + WarBow finalize | `forge test --match-test "test_roll_promotes|test_finalize_warbow"` | PASS | | Fuzz no dust | `forge test --match-test testFuzz_splitBuy_no_dust` | PASS | | Indexer vault-funding API | `bash scripts/verify-vault-funding-anvil.sh` | PASS | | Buy router Anvil | `bash scripts/verify-time-arena-buy-router-anvil.sh` | PASS | | Podium live predictions | `bash scripts/verify-podium-live-anvil.sh` | PASS | | Frontend fee panel | `cd frontend && npm test -- FeeTransparency` | PASS | | topUp unchanged | `forge test --match-test test_topUpPodiumPools` | PASS | | Docs + invariants | `bash scripts/check-doc-anchors.sh` | PASS | | Full contracts | `cd contracts && forge test --no-match-contract DoubAirdropMegaethFork` | PASS (133 tests; 4 fork tests SKIP — missing `doub.csv`) | | Indexer | `cd indexer && cargo clippy --all-targets -- -D warnings && cargo test` | PASS | | Frontend | `cd frontend && npm run typecheck && npm run lint && npm test` | PASS | **Blockers:** none ## Verification checklist (3rd parties) 1. `cd contracts && forge test --match-contract "ArenaPrizeRouting|TimeArenaTest::test_buy_routes|test_topUp|test_finalize_warbow|test_roll_promotes"` 2. `bash scripts/verify-vault-funding-anvil.sh` — expect **12** `podium_epoch` rows per DOUB buy, **0** admin rows 3. `cd frontend && npm test -- FeeTransparency` — expect **100%** / **70/20/10** copy 4. `bash scripts/check-doc-anchors.sh` 5. Read `docs/testing/invariants-and-business-logic.md#arena-prize-routing-gitlab-300` ## Notes for reviewers - **Deploy:** Arena v2 redeploy required; no migration of old vault balances (#259). - **Admin revenue:** Ops must not depend on buy-sourced `AdminSellVault` inflows post-#300. - **Remainder policy:** `amount % 4` wei → Time Booster (cat 1); within-category remainder → +2 tranche. - Invariants: `INV-ARENA-PRIZE-ROUTING-300-*` · play skill `skills/play-time-arena-doub/SKILL.md` ## Author checklist - [x] Diff scoped to #300 prize routing - [x] Arena v2 guardrails respected - [x] Dev keys Anvil-only
ghost1 commented 2026-06-07 10:00:34 +00:00 (Migrated from gitlab.com)

Security review (automation)

Commit reviewed: 8c522eda7cb3992e9dc201ab131e04faaee0e1d5
Scope: GitLab #300 — 100% DOUB buy routing to podium epoch tranches (contracts ArenaBuyRouting, PodiumVaults, TimeArena; indexer podium_epoch / target_epoch schema 2.7.0; frontend fee/AUDIT copy; docs/invariants).

Outcome: FINDINGS: 0 medium or higher on this diff.

Summary

Reviewed added/modified code for injection, authn/authz bypass, permission-boundary mistakes, secret leakage, SSRF/XSS, unsafe deserialization, and onchain fund-routing exploits. Prior MR discussions: none.

Layer Review focus Result
Contracts splitBuyAmount conservation (fuzz), buy-path nonReentrant, rollEpochTranches arena-only gate, zero admin on buy No attacker-controlled path to mis-route or drain funds beyond existing permissionless rollPodiumEpoch / owner pool config (pre-existing governance model).
Indexer target_epoch persist + API exposure Parameterized SQL; field sourced from chain logs only; tx_hash param already normalized.
Frontend Fee/AUDIT copy updates Static strings only; no new HTML injection surface.

Inline threads

None — no medium+ findings to anchor on specific diff lines.

Automated security review · MR !440 · cursor/arena-prize-routing-300-957c → main

## Security review (automation) **Commit reviewed:** `8c522eda7cb3992e9dc201ab131e04faaee0e1d5` **Scope:** GitLab #300 — 100% DOUB buy routing to podium epoch tranches (contracts `ArenaBuyRouting`, `PodiumVaults`, `TimeArena`; indexer `podium_epoch` / `target_epoch` schema 2.7.0; frontend fee/AUDIT copy; docs/invariants). **Outcome:** `FINDINGS: 0` medium or higher on this diff. ### Summary Reviewed added/modified code for injection, authn/authz bypass, permission-boundary mistakes, secret leakage, SSRF/XSS, unsafe deserialization, and onchain fund-routing exploits. Prior MR discussions: none. | Layer | Review focus | Result | |-------|----------------|--------| | **Contracts** | `splitBuyAmount` conservation (fuzz), buy-path `nonReentrant`, `rollEpochTranches` arena-only gate, zero admin on buy | No attacker-controlled path to mis-route or drain funds beyond existing permissionless `rollPodiumEpoch` / owner pool config (pre-existing governance model). | | **Indexer** | `target_epoch` persist + API exposure | Parameterized SQL; field sourced from chain logs only; `tx_hash` param already normalized. | | **Frontend** | Fee/AUDIT copy updates | Static strings only; no new HTML injection surface. | ### Inline threads None — no medium+ findings to anchor on specific diff lines. --- *Automated security review · MR !440 · `cursor/arena-prize-routing-300-957c` → `main`*
PlasticDigits commented 2026-06-07 10:03:38 +00:00 (Migrated from gitlab.com)

mentioned in commit 2398a6a1fc

mentioned in commit 2398a6a1fcf7621cefe900fca5cbcd1ce85b4557
PlasticDigits (Migrated from gitlab.com) merged commit 2398a6a1fc into main 2026-06-07 10:03:38 +00:00
PlasticDigits commented 2026-06-08 08:45:13 +00:00 (Migrated from gitlab.com)

mentioned in commit 574c16ea46

mentioned in commit 574c16ea46c73cb1546f19a3cac293ec8c754c30
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
agent:fix_bugfix

   
agent:fix_conflicts

   
agent:fix_security

   
agent:gap_analysis

   
agent:implement

   
agent:open_issues

   
agents

   
agent:security_audit

   
agent:verify
  
area
timecurve

  
arena

   
arena-v2

   
audit

   
block:feature_review

   
block:security

   
bug

   
contracts

   
design

   
devops

   
docs
Documentation

  
documentation

   
enhancement

   
epic
Epic / umbrella issue

  
feature

   
frontend

   
indexer

   
low priority
Low priority, investigate other issues first

  
megaeth

   
operations

   
ops
Deploy and operations

  
performance

   
QA

   
qa checklist

   
referrals

   
removal
Legacy removal

  
security

   
smart-contracts

   
tech-debt

   
testing

   
time-arena
TimeArena v2 revamp

  
timecurve

   
visual-qa
No labels
agent:fix_bugfix
agent:fix_conflicts
agent:fix_security
agent:gap_analysis
agent:implement
agent:open_issues
agents
agent:security_audit
agent:verify
area
timecurve
arena
arena-v2
audit
block:feature_review
block:security
bug
contracts
design
devops
docs
documentation
enhancement
epic
feature
frontend
indexer
low priority
megaeth
operations
ops
performance
QA
qa checklist
referrals
removal
security
smart-contracts
tech-debt
testing
time-arena
timecurve
visual-qa
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
code/yieldomega!440
No description provided.