code/yieldomega

Watch

Fork 0

podiums (#302) #445

Merged

PlasticDigits merged 2 commits from cursor/gitlab-issue-workflow-74e5 into main

2026-06-08 06:10:56 +00:00

PlasticDigits commented

2026-06-08 06:05:36 +00:00

(Migrated from gitlab.com)

Summary

Layers touched

Check every layer this MR modifies (delete unchecked lines):

contracts (contracts/)
indexer (indexer/)
frontend (frontend/)
scripts / devops (scripts/, .cursor/, CI)
docs only (no runtime behavior change)
bots (bots/)

Verification

For each touched layer, add one row: item → command → PASS / FAIL / SKIP.

Use the smallest check that proves the change — do not require Docker, Postgres, or Vite unless this MR touches those layers. Command reference: AGENTS.md § Cloud agent verification · docs/testing/ci.md.

Layer	Command	Result

Common commands (copy rows as needed):

Layer	Command
contracts	`cd contracts && forge test`
contracts (static)	Slither workflow / local `slither` (high-severity gate)
indexer	`cd indexer && cargo clippy --all-targets -- -D warnings && cargo test`
indexer + arena	`bash scripts/verify-wallet-profile-anvil.sh`
frontend	`cd frontend && npm run typecheck && npm run lint && npm test`
Anvil deploy / `KEY_EVM_*` / seed	`bash scripts/verify-evm-dev-wallet-seed-anvil.sh` (must PASS, not SKIP)
Postgres (Cloud VM)	`bash scripts/verify-cloud-postgres.sh`
Docker (full stack only)	`bash scripts/verify-docker-cloud-agent.sh`
Playwright Anvil E2E	`bash scripts/e2e-anvil.sh`
Doc gates	`bash scripts/check-doc-anchors.sh` (+ retired-term / arena-naming scripts if docs touched)

Licensing & compliance

New or changed original files remain AGPL-3.0 (or exception is called out below).
No incompatible third-party code added without NOTICE / maintainer approval.
Network-facing changes (indexer API, deployed frontend) — Corresponding Source / AGPL obligations considered (docs/licensing.md).

Notes for reviewers

Author checklist

Diff is scoped to the stated problem (no drive-by refactors).
Arena v2 guardrails respected when touching product code (.cursor/skills/yieldomega-guardrails/SKILL.md).
Dev keys are Anvil-only; no secrets committed (scripts/lib/evm_dev_keys.sh).

## Summary  ## Related issues  ## Layers touched Check every layer this MR modifies (delete unchecked lines): - [ ] **contracts** (`contracts/`) - [ ] **indexer** (`indexer/`) - [ ] **frontend** (`frontend/`) - [ ] **scripts / devops** (`scripts/`, `.cursor/`, CI) - [ ] **docs only** (no runtime behavior change) - [ ] **bots** (`bots/`) ## Verification For **each touched layer**, add one row: *item → command → PASS / FAIL / SKIP*. Use the **smallest** check that proves the change — do not require Docker, Postgres, or Vite unless this MR touches those layers. Command reference: [`AGENTS.md` § Cloud agent verification](../../AGENTS.md#cloud-agent-verification-when-to-run-what) · [`docs/testing/ci.md`](../../docs/testing/ci.md). | Layer | Command | Result | |-------|---------|--------| | | | | **Common commands (copy rows as needed):** | Layer | Command | |-------|---------| | contracts | `cd contracts && forge test` | | contracts (static) | Slither workflow / local `slither` (high-severity gate) | | indexer | `cd indexer && cargo clippy --all-targets -- -D warnings && cargo test` | | indexer + arena | `bash scripts/verify-wallet-profile-anvil.sh` | | frontend | `cd frontend && npm run typecheck && npm run lint && npm test` | | Anvil deploy / `KEY_EVM_*` / seed | `bash scripts/verify-evm-dev-wallet-seed-anvil.sh` (**must PASS**, not SKIP) | | Postgres (Cloud VM) | `bash scripts/verify-cloud-postgres.sh` | | Docker (full stack only) | `bash scripts/verify-docker-cloud-agent.sh` | | Playwright Anvil E2E | `bash scripts/e2e-anvil.sh` | | Doc gates | `bash scripts/check-doc-anchors.sh` (+ retired-term / arena-naming scripts if docs touched) | ## Licensing & compliance - [ ] New or changed **original** files remain **AGPL-3.0** (or exception is called out below). - [ ] No incompatible third-party code added without `NOTICE` / maintainer approval. - [ ] **Network-facing** changes (indexer API, deployed frontend) — Corresponding Source / AGPL obligations considered ([`docs/licensing.md`](../../docs/licensing.md)).  ## Notes for reviewers  ## Author checklist - [ ] Diff is scoped to the stated problem (no drive-by refactors). - [ ] Arena v2 guardrails respected when touching product code ([`.cursor/skills/yieldomega-guardrails/SKILL.md`](../../.cursor/skills/yieldomega-guardrails/SKILL.md)). - [ ] Dev keys are **Anvil-only**; no secrets committed ([`scripts/lib/evm_dev_keys.sh`](../../scripts/lib/evm_dev_keys.sh)).

PlasticDigits commented

2026-06-08 06:05:44 +00:00

(Migrated from gitlab.com)

mentioned in issue #302

ghost1 commented

2026-06-08 06:07:02 +00:00

(Migrated from gitlab.com)

Security review

Commit reviewed: e24fb48af9c73ab6f023a1e3c93ef8f1e44bf034
Scope: Indexer prize-preview fields on GET /v1/arena/podiums (active_pool_balance_doub_wad, prize_places_doub_wad), PodiumVaults.activePoolBalance chain-timer polling, frontend Simple podium payout display, verify script + docs.

Outcome: FINDINGS: 0 medium+

Summary

Reviewed added/modified code paths for injection, authn/authz bypass, secret leakage, SSRF, XSS, and unsafe deserialization. No prior security-review threads on this MR (only system note).

Area	Assessment
Indexer API	`arena_podiums` adds read-only JSON fields derived from the existing head poller cache. No new query parameters or SQL. Attacker has no input surface on this path.
chain_timer	Four additional `eth_call`s to operator-configured `PodiumVaults` with hardcoded category indices 0–3. RPC URL and contract addresses come from server config, not request input.
arena_podium_prize	Pure `U256` arithmetic mirroring on-chain `ArenaPodiumSettlement.payoutShares`; no external input.
Frontend	Prize strings flow through `rawToBigIntForFormat` → `formatCompactFromRaw` and render as React text nodes (auto-escaped). Non-numeric API values degrade to `0n`, not HTML injection.
Information disclosure	Active pool balances are already public on-chain via `PodiumVaults.activePoolBalance`; this MR surfaces them for UI preview only.

Inline threads: none (no medium+ findings).

Automated security review (Cursor Cloud Agent).

## Security review **Commit reviewed:** `e24fb48af9c73ab6f023a1e3c93ef8f1e44bf034` **Scope:** Indexer prize-preview fields on `GET /v1/arena/podiums` (`active_pool_balance_doub_wad`, `prize_places_doub_wad`), `PodiumVaults.activePoolBalance` chain-timer polling, frontend Simple podium payout display, verify script + docs. **Outcome:** `FINDINGS: 0` medium+ ### Summary Reviewed added/modified code paths for injection, authn/authz bypass, secret leakage, SSRF, XSS, and unsafe deserialization. No prior security-review threads on this MR (only system note). | Area | Assessment | |------|------------| | **Indexer API** | `arena_podiums` adds read-only JSON fields derived from the existing head poller cache. No new query parameters or SQL. Attacker has no input surface on this path. | | **chain_timer** | Four additional `eth_call`s to operator-configured `PodiumVaults` with hardcoded category indices 0–3. RPC URL and contract addresses come from server config, not request input. | | **arena_podium_prize** | Pure `U256` arithmetic mirroring on-chain `ArenaPodiumSettlement.payoutShares`; no external input. | | **Frontend** | Prize strings flow through `rawToBigIntForFormat` → `formatCompactFromRaw` and render as React text nodes (auto-escaped). Non-numeric API values degrade to `0n`, not HTML injection. | | **Information disclosure** | Active pool balances are already public on-chain via `PodiumVaults.activePoolBalance`; this MR surfaces them for UI preview only. | **Inline threads:** none (no medium+ findings). --- *Automated security review (Cursor Cloud Agent).*

PlasticDigits commented

2026-06-08 06:10:56 +00:00

(Migrated from gitlab.com)

mentioned in commit 68af94b6ac

mentioned in commit 68af94b6acb5dbc5c5e0e4e3114c00d5ca70afdc

PlasticDigits (Migrated from gitlab.com) merged commit 68af94b6ac into main

2026-06-08 06:10:56 +00:00

PlasticDigits commented

2026-06-08 08:45:14 +00:00

(Migrated from gitlab.com)

mentioned in commit 818be0ba84

mentioned in commit 818be0ba8460b7274d5ef2d676cbd72f8f4229c2

No reviewers

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

code/yieldomega!445

No description provided.

Rows
Columns