Indexer-first Arena display reads (#301) #446
No reviewers
Labels
No labels
agent:fix_bugfix
agent:fix_conflicts
agent:fix_security
agent:gap_analysis
agent:implement
agent:open_issues
agents
agent:security_audit
agent:verify
area
timecurve
arena
arena-v2
audit
block:feature_review
block:security
bug
contracts
design
devops
docs
documentation
enhancement
epic
feature
frontend
indexer
low priority
megaeth
operations
ops
performance
QA
qa checklist
referrals
removal
security
smart-contracts
tech-debt
testing
time-arena
timecurve
visual-qa
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
code/yieldomega!446
Loading…
Reference in a new issue
No description provided.
Delete branch "cursor/gitlab-issue-workflow-ce56"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Summary
Indexer-first Arena v2 display reads (#301): browsers no longer mirror podium/timer/sale-head state via wallet RPC when
VITE_INDEXER_URLis set or unset. The indexer head poller batches Arena v2 sale-head fields onGET /v1/arena/timers; the frontend maps them throughcoreReadRowsFromArenaTimersand serves podiums exclusively fromGET /v1/arena/podiums(including #302 prize preview fields merged frommain).Merge conflict resolution: rebased
main(podium prize preview #302) into this branch — kept indexer-first policy while integratingPodiumVaults.activePoolBalancehead reads andprize_places_doub_wadon/v1/arena/podiums.Related issues
Closes #301
Layers touched
indexer/)frontend/)docs/,skills/)Verification
cd indexer && cargo clippy --all-targets -- -D warningscd indexer && env -u DATABASE_POOL_MAX cargo testcd frontend && npm run typecheckcd frontend && npm run lintcd frontend && npm testnpm test(indexerFirstDisplay.test.ts)glab mr view 76→can_be_mergedLicensing & compliance
Notes for reviewers
INV-FRONTEND-301-INDEXER-FIRST-DISPLAYmentioned in issue #301
Security review (automation)
Commit reviewed:
a907b30e102fe28e041eb41e2e3eff157c646aa4Scope: MR !446 — indexer-first Arena v2 display reads; removal of browser RPC fallbacks; indexer
GET /v1/arena/timerssale-head fields; frontend hooks (usePodiumReads,useArenaHeroTimer,useArenaSaleSession,ArenaTimerChips).Outcome:
FINDINGS: 0medium+Summary
Reviewed added/modified runtime paths in
frontend/andindexer/(docs/skills excluded from vuln triage). Traced attacker-controlled input to sinks:api_arena.rs,chain_timer.rs)eth_callreads at pinned block; no user input, SQL, or SSRF surface added.indexerApi.ts)fetchto configuredVITE_INDEXER_URL; no new secrets/logging.AddressInlinewithisAddresschecks; nodangerouslySetInnerHTML.useArenaSaleSession)TimeArenaand wallet-signed calldata;resolveTimeArenaBuyRouterForKumbayaSingleTxstill fail-closes whenVITE_KUMBAYA_TIME_ARENA_BUY_ROUTERdisagrees with the served router. Indexer compromise could mislead display (documented in threat model) but is an accepted ops trust boundary, not a new injectable/code flaw in this diff.No injection, authn/authz bypass, XSS, SSRF, secret leakage, or dependency supply-chain changes meeting medium+ bar were found in this diff.
Inline threads: none (no medium+ findings).
Cursor security-review automation
added 4 commits
maincbeb0db4- merge(main): resolve conflicts with podium prize preview (#302)Compare with previous version
changed the description
cursor review verbose=true
cursor review verbose=true
changed the description
changed the description
Cursor Bugbot has reviewed your changes and found 2 potential issues.
Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issues.
Reviewed by Cursor Bugbot for commit
cbeb0db44e. Configure here.Wrong type in charm_price field
Low Severity
fetchLegacyArenaSaleStatesetscharm_priceto the same decimal wad string ascurrent_price_per_charm_wad, butArenaSaleState.charm_priceis an address used withaddr()incoreReadRowsFromSaleState.Reviewed by Cursor Bugbot for commit
cbeb0db44e. Configure here.Duplicate arena timers polling
Medium Severity
For Arena v2 with
VITE_INDEXER_URLset,useArenaSaleSessionmounts bothuseArenaSaleStateQueryanduseArenaTimersQuery. Each polls about every 2s and both hitGET /v1/arena/timers, while v2 sale head reads only use the timers query path.Additional Locations (2)
frontend/src/pages/arena/useArenaSaleState.ts#L147-L161frontend/src/pages/arena/useArenaSaleState.ts#L164-L178Reviewed by Cursor Bugbot for commit
cbeb0db44e. Configure here.changed this line in version 3 of the diff
added 1 commit
cf7d2f6c- fix(arena): skip duplicate timers poll on v2 and fix charm_price mappingCompare with previous version
changed the description
resolved all threads
mentioned in commit
67196222d3mentioned in commit
a427ec4c30